Authentication system using authentication information valid one-time

Abstract

An authentication method adopting simple steps, in which it is difficult for a third person, who steals authentication data, to reuse (to replay, for attacking purpose) the stolen authentication data. First inspection data (value=D.sub.n-1), used for inspecting client's authentication data, is stored in a server in advance, while the client also stores first seed data (value=D.sub.n-1) for generating authentication data. The client first sends an authentication request to the server, and receives an authentication data request from the server. Then the client generates authentication data (value=D.sub.n) by enciphering the first seed data (value=D.sub.n-1) using a client's secret key (K.sub.s), and sends the enciphered data to the server. The server deciphers the received authentication data (value=D.sub.n) by using a public key (K.sub.p) of the client to generate second inspection data (value=D.sub.n-1), compares the second inspection data with the first inspection data (value=D.sub.n-1), and when they are coincident, grants the authentication request and stores the authentication data (value=D.sub.n) in place of the first inspection data. Upon receiving the grant, the client stores the authentication data (value=D.sub.n) as second seed data in place of the first seed data (value=D.sub.n-1).