JP2001325228A - Network user authentication method and network user authentication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a network user authentication method and a network user authentication system capable of safely authenticating the proper user of a client terminal. SOLUTION: In this user authentication system for transmitting a user identifier and a password from the client terminal to a server, confirming the presence of the pertinent user identifier and the password in the registration information on the server and authenticating the user, the client terminal operated by the user transmits the user identifier and the password to the respectively different servers and the user of the client terminal is authenticated by the user identifier and the password received in the different server.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network user authentication method and a network user authentication system, and more particularly to a network user authentication method in a network environment where an unspecified number of computers are connected as client terminals or servers. The present invention relates to a network user authentication method and a network user authentication system for securely authenticating a user.

[0002]

2. Description of the Related Art When a user uses resources provided by various servers connected to a network from a client terminal connected to the network via a network, a user identifier and a password are transmitted from the client terminal to the server. Is a general authentication method of transmitting to the client terminal and authenticating the user of the client terminal using the user identifier and the password registered in the server.

According to such an authentication method, when a server is to be authenticated, for example, when a user identifier and a password are simultaneously transmitted in plain text, if a monitoring device or the like is installed in a communication path, it is relatively easy. Because eavesdropping is possible, such eavesdropping leaks user identifiers and passwords, and the leaked user identifiers and passwords are used, so that unauthorized third parties can use the server resources. And there is a risk that the system will be abused.

[0004] As a method of dealing with such danger,
Conventionally, when a user identifier and a password are transmitted, various encryption processes are performed on the user identifier and the password, so that even if a third party eavesdrops on the communication path, the user identifier and the password are transmitted. An authentication method for preventing a password from leaking has been proposed.

In such an authentication method using an encrypted user identifier and a password, it is possible to prevent the password from being leaked by eavesdropping. For example, the eavesdropped data is recorded in an encrypted form, and the data is stored in the server as it is. It is powerless against attacks that resend to

[0006] In recent years, with the dramatic improvement in computer performance and the progress of cryptanalysis technology, if a simple cipher is used,
Decryption has become possible in a relatively short time, and it has become difficult to secure sufficient security only by encrypting the user identifier and the password.

One of the methods for solving such a problem is as follows.
One known invention is described in Japanese Patent Application Laid-Open No. 7-325785, entitled "Network User Authentication Method and Encrypted Communication Method, Application Client and Server". In short, the present invention is an authentication method for rejecting the above-mentioned attack by retransmission by performing communication between the client terminal and the authentication server a plurality of times. Specifically, according to this authentication method, first, in response to an authentication request from a client terminal, the server generates a random number and transmits it to the client terminal. The client terminal adds the random number received from the server to the user identifier and the password, encrypts the same, and transmits the encrypted data to the server again. The server compares the random number obtained by decrypting the encrypted data with the random number previously transmitted to the client terminal, and if they match, performs authentication using the user identifier and the password. According to such an authentication method, a different random number is used every time there is an authentication request from the client terminal, and the encrypted data transmitted to the server has different contents every time. be able to.

[0008]

However, the authentication method of the invention described in Japanese Patent Application Laid-Open No. 7-325785 is based on the premise that encrypted data transmitted by the client terminal is not decrypted. If the user succeeds in decrypting the cipher, there is a problem that the user identifier and the password can be obtained, and the third party can be authenticated as a legitimate user.

SUMMARY OF THE INVENTION The present invention has been made to solve such a problem, and an object of the present invention is to provide a network user authentication system in which a third party succeeds in decrypting a cipher. Another object of the present invention is to provide a network user authentication method and a network user authentication system capable of securely authenticating a legitimate user of a client terminal.

[0010]

In order to achieve the above object, a network user authentication method according to the present invention transmits a user identifier and a password from a client terminal to a server, and stores the user identifier and password in the registration information of the server. In a network user authentication system that verifies the existence of a corresponding user identifier and password to authenticate the user, the client terminal operated by the user transmits the user identifier and password to different servers,
The authentication of the user of the client terminal is performed using the user identifier and the password received by different servers.

As another feature, the network user authentication method according to the present invention transmits a user identifier and a password from a client terminal to an authentication server, and stores the corresponding user identifier and password in registration information of the authentication server. In a network user authentication system that verifies the existence of a user and authenticates the user, the user sends the user identifier and password sent from the client terminal to different servers, and the authentication server The authentication of the user is performed by confirming the existence of the corresponding user identifier and password in the registration information using the user identifier and the password.

Further, in the system configuration, the network user authentication system according to the present invention includes a first server that receives only the user identifier transmitted from the client terminal, and a second server that receives only the password transmitted from the client terminal. 2 server, connected to the first server and the second server by a local area network, obtains a user identifier and a password from the first server and the second server, and registers a user identifier registered in advance And an authentication server for authenticating the user with a password.

As another feature, a network user authentication system according to the present invention comprises a first server for receiving only a user identifier transmitted from a client terminal connected to a network, and a client terminal connected to the network. A second server that receives only the password transmitted from the first server, a user identifier and a password received from the first server and the second server via a network, respectively, and are used by using a previously registered user identifier and a password. And an authentication server for authenticating the user.

According to the network user authentication method of the present invention having such features, for example, in order to receive a service, a user identifier and a password transmitted from a client terminal by a user are transmitted to different servers. Transmitted and received by different servers. This prevents a third party from combining a user identifier and a password required for authentication even if the transmission content transmitted to the server is wiretapped. The server that authenticates the user confirms the existence of the corresponding user identifier and password in the registration information based on the user identifier and the password received by the different servers, and authenticates the user.

As described above, when a user requests authentication from a client terminal to a server, a user identifier and a password for the authentication are transmitted to different servers. Even if this information is only eavesdropped by a third party who is not a legitimate user, it is only individual eavesdropping, or only a password. There is no leakage of contents that combine passwords and passwords properly. Further, if the user identifier and the password are individually encrypted and transmitted, the security is further improved.

[0016]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a block diagram illustrating a configuration of a network user authentication system according to an embodiment of the present invention. The network user authentication system has a basic configuration shown in FIG.
As shown in the figure, the client terminal 21 that makes an authentication request,
22, a user identifier receiving server 13 for receiving only the user identifier transmitted from the client terminal;
A password receiving server 14 that receives only the password transmitted from the client terminal, an authentication server 11 in which the user identifier and the password are registered, and a client terminal and the server (the authentication server 11, the user identifier receiving server 13, the password Receiving server 14)
Are connected by the network 20.

The network 20 is a wide area network (WAN), and includes an authentication server 11, a user identifier receiving server 13, a password receiving server 14, and a server for various services (not shown).
The server group including the server is also connected to a local area network (LAN) 12, and constitutes a center 10 that performs various services in response to requests from the client terminals 21, 22, and 23.

In order for a user to receive various services via a network, an authentication request is made from a client terminal 21 to a center 10 of a group of servers connected to a wide area network (WAN) 20. In that case, the user identifier (ID1) prepared for the authentication request
And the password (AAA) are transmitted to different servers. That is, the user identifier is transmitted to the user identifier receiving server 13, and the password is transmitted to the password receiving server 14. The separately transmitted user identifier and password are asynchronously received by the user identifier receiving server 13 and the password receiving server 14 via the network 20, respectively.
At 1, an authentication process is performed.

Here, the network user authentication process will be described below by taking as an example a case where the user identifier 13a is received first by the user identifier receiving server 13. The same applies to the case in which is received first. In this case, the start of the authentication processing is as follows. First, the user identifier receiving server 13 that has received the user identifier “ID1” transmitted from the client terminal 21 is connected to the authentication server connected by the local area network (LAN) 12. 11, "I" which is the user identifier 13a
It starts by notifying the reception of "D1".

The authentication server 11, which has received the notification of the user identifier from the user identifier receiving server 13, refers to the file 11a in which the user identifier and the password are registered, and records corresponding to the user identifier "ID1". And sets its status to the “waiting for authentication” state. Subsequently, the password “A” transmitted by the client terminal 21
When the password receiving server 14 receiving the “AA” notifies the authentication server 11 of the reception of the “AAA” password 14a, the authentication server 11 uses the password “AAA” received from the password receiving server 14 to output the user identifier. Confirm that the status of the corresponding record of the file 11a in which the password and the password are registered is "waiting for authentication", and the user identifier and the password of the registration information registered in advance in the file 11a and the transmitted password. Confirms the match with the user identifier and the password, authenticates the user of the network, and when the authentication is confirmed, the client terminal 21 that has transmitted the user identifier and the password registered in advance is sent to the client terminal 21. Then, the authentication is notified and the authentication for the client terminal 21 is given. As a result, the client terminal
Various services of the server group can be received.

In the above example, it is assumed that the user identifier 13a is received first by the user identifier receiving server 13. However, the user identifier and the password transmitted from the client terminal 21 are different from each other through the different communication paths. And arrive at each server asynchronously. Then, each server is authenticated by the user identifier and password received by another server, and the client terminal used by the user is specified in advance in the registration information. Give authentication to. Password receiving server 1
In 4, the same processing is performed when the password 14a is received first. In order to cope with this, a procedure of an authentication process performed on the authentication server 11 will be described below.

FIG. 2 is a flowchart showing a procedure of an authentication process performed by the authentication server. As shown in FIG. 2, in the authentication process, first, it is determined whether the information notified from the client terminal is a user identifier or a password (step 31). If the information notified from the client terminal is a password, a record corresponding to the notified password is searched from the file 11a in which the user identifier and the password are registered (step 3).
2). Conversely, if the information notified from the client terminal is a user identifier, a record corresponding to the notified user identifier is searched from the file 11a in which the user identifier and the password are registered. (Step 33).

Next, the status of the record searched in the previous record search process is referred to, and the process proceeds to a process corresponding to the value (step 34). That is, if the status of the retrieved record is "waiting", the status is set to "waiting for authentication" and the next notification from the client terminal is waited (step 35). If the status of the retrieved record is “waiting for authentication”, it indicates that the user identifier or the password has already been notified, so the user identifier of the record registered in advance as registration information Alternatively, after confirming that the password matches the password, authentication is given to the corresponding client terminal (step 36), and the status of the record is set to the initial value "standby", and (another) It waits for the next notification from the client terminal (step 37).

In the network user authentication system of the embodiment described above, the file 11a for registering the user identifier and the password stored as the registration information in the authentication server 11 includes the user identifier and the password for each. It is assumed that they are uniquely registered.

As described above, according to the network user authentication system of the present embodiment, the user identifier receiving server 13 receives only the user identifier transmitted from each of the client terminals 21, 22, 23 connected to the network.
And a password receiving server 14 that receives only the password transmitted from the client terminals 21, 22, 23
Authentication server 1 in which a record of a user identifier and a password is registered in advance as registration information for authentication.
The authentication server 11 communicates with the user identifier receiving server 13 and the password receiving server 14 connected via the local area network 12, respectively, so that the user identifier transmitted from the client terminal and The system is configured to acquire a password and provide authentication to a client terminal that has requested authentication.

The client terminals 21, 22, 2
When requesting authentication from the authentication server 11 to the authentication server 11, the user identifier and the password for the authentication are transmitted to different servers (user identifier receiving server 13 and password receiving server 14). Only the user identifier or the password is passed on the information 20. Even if the information is eavesdropped by a third party who is not a valid user, the proper combination of the user identifier and the password is leaked. There is no.

Each server (user identifier receiving server 13 and password receiving server 14) that receives data for authentication from a client terminal and the authentication server 11 are connected to a wide area network (WAN) network 20. The authentication server 11 and the respective servers (13, 14) are connected to this network 2
Although the communication may be performed through the route 0, the user identifier and the password are obtained by performing the communication through the network 12 because the connection is also made through the local area network 12 in the center 10. Thus, the security against an attack by the external retransmission to the authentication server 11 is improved.

In the above example, the user identifier and the password transmitted from the client terminal 21 are:
Each is notified by a different communication path, and arrives at each server asynchronously. In general, identification information of the same client terminal that is the source of each transmission is added to transmission information such as a user identifier and a password received by different servers. Therefore, when both servers (user identifier receiving server 13 and password receiving server 14) are simultaneously eavesdropped, it becomes possible to combine the user identifier and the password using the identification information of the client terminal as a key. Would. In order to avoid such a risk, in the above-described example, the identification information of the client terminal when the authentication is given to the network user is registered in advance in the registration information, and the transmission information of the user identifier and the password is included in the transmission information of the user identifier and the password. The transmission is performed without adding the identification information of the client terminal of the transmission source.

However, if the identification information of the client terminal that is the transmission source of the network user is not transmitted as described above and the client terminal that can be used by the user is limited to the terminal registered in advance, the network usage form is restricted. Not preferred. In this case, the identification information of the client terminal is added to only one of the user identifier and the password in the transmission information of the user identifier and the password transmitted from the client terminal operated by the user. Then, when the authentication server receives notification of reception of either the user identifier or the password from the different reception servers, the identification information of the client terminal added to one of the notification servers is replaced by the user who received the notification. It is set in correspondence with the identifier or the password, and when the authentication is established by the subsequent matching of the user identifier and the password, the authentication is given (transmitted) to the client terminal that has transmitted the set identification information. To Thus, the user of the network can obtain the user authentication from any client terminal connected to the network.

When the network user authentication system is modified as described above, the file 11a for the registration information of the authentication processing in the authentication server 11 of FIG. 1 is stored as shown in FIG. Is modified to a configuration of a file 41a having a structure in which identification information of a client terminal can be set in accordance with the registration information.

FIG. 3 is a block diagram illustrating the configuration of a network user authentication system according to another embodiment of the present invention. Next, the network user authentication system shown in FIG. 3 will be described. However, since the basic operation is the same as that of the system described with reference to FIG. explain.

As shown in FIG. 3, the authentication server 41 shown in FIG. 3 stores the identification information of the client terminal in correspondence with the registration information of the user identifier and the password as a file 41a for the registration information of the authentication processing. It is assumed that a column (data field) that can be set is provided. Client terminal 2 operated by the user to receive authentication
From 1, the identification information of the client terminal is added to only one of the user identifier and the password, and the user identifier and the password are transmitted to the different receiving servers, respectively. Sets the identification information of the client terminal in the file 41a in accordance with the registration information of the user identifier and the password when the identification information of the client terminal is notified from one of the receiving servers.

In the authentication process (FIG. 2), the user identifier or the password is already notified, and when the password or the user identifier is passed next, the notified record of the record registered in advance as the registration information is transmitted. Make sure it matches your user identifier or password,
Authentication is given to the corresponding client terminal (step 36). At that time, when the password or the user identifier is passed, the identification information of the client terminal is notified from one of the receiving servers. Is set, authentication is given (transmitted) with the client terminal of the identification information as the corresponding client terminal.

Even in the case of such a modification, as in the case described above, another problem arises when both servers (user identifier receiving server 13 and password receiving server 14) are simultaneously eavesdropped. Even if it is not possible to obtain a combination of a user identifier and a password, all data intercepted at a certain point in time (all data including the password and the user identifier) are retained, and the client terminal of the eavesdropper is used as a request terminal. By sending all data to each server, there is a danger that authentication is given to the requesting terminal.

On the other hand, when the authentication server confirms the coincidence of the user identifier and the password received by the different servers and gives authentication to the client terminal (step 36), the entire file 41a is searched. Then, the fact that a plurality of authentication requests are not issued from the same terminal is given as a precondition for authentication. In this case, even if an authorized user who has registered a plurality of authentication IDs (user identifiers and passwords) issues an authentication request from the same client terminal using a plurality of authentication IDs, an error occurs. The system is operated on the premise that it is known to authorized users.

[0036]

As described above, according to the network user authentication method of the present invention, when requesting authentication from a client terminal to a server, a user identifier and a password are transmitted to different servers. Therefore, the only information that flows on the network is the user identifier or only the password. Even if this information is intercepted by a third party who is not a valid user, the proper combination of the user identifier and password is leaked. Therefore, even if the third party succeeds in decrypting the encrypted data, it is possible to securely authenticate a valid user of the client terminal.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a configuration of a network user authentication system according to an embodiment of the present invention.

FIG. 2 is a flowchart illustrating a procedure of an authentication process performed by an authentication server.

FIG. 3 is a block diagram illustrating a configuration of a network user authentication system according to another embodiment of the present invention.

[Explanation of symbols]

 10 Center 11 Authentication Server 12 Local Area Network (LAN) 13 User Identifier Receiving Server 14 Password Receiving Server 20 Wide Area Network (WAN) 21 Client Terminal 22 Client Terminal 23 Client Terminal 41 Authentication Server

Claims (7)

[Claims] 1. A network user authentication for transmitting a user identifier and a password from a client terminal to a server, confirming the existence of the user identifier and the password in the registration information of the server, and authenticating the user. In the system, a client terminal operated by a user transmits a user identifier and a password to different servers, respectively, and authenticates a user of the client terminal based on the user identifier and the password received by the different servers. User authentication method. 2. A network user who transmits a user identifier and a password from a client terminal to an authentication server and confirms the existence of the corresponding user identifier and password in the registration information of the authentication server to authenticate the user. In the authentication system, the user sends the user identifier and password sent from the client terminal to different servers, and the authentication server uses the user identifier and password received by the different server to register the corresponding user in the registration information. A network user authentication method characterized by confirming the existence of an identifier and a password to perform user authentication. 3. A first server that receives only a user identifier transmitted from a client terminal, a second server that receives only a password transmitted from the client terminal, and the first server via a local area network And an authentication server that is connected to the second server, acquires a user identifier and a password from the first server and the second server, and authenticates the user with a pre-registered user identifier and password. A network user authentication system, characterized in that: 4. A first server that receives only a user identifier transmitted from a client terminal connected to a network, a second server that receives only a password transmitted from a client terminal connected to the network, An authentication server which receives a user identifier and a password from the first server and the second server via a network, respectively, and authenticates the user with a user identifier and a password registered in advance. Network user authentication system. 5. A network user authentication for transmitting a user identifier and a password from a client terminal to a server, confirming the existence of the user identifier and the password in the registration information of the server, and authenticating the user. In the system, the client terminal operated by the user adds the identification information of the client terminal to either the user identifier or the password, transmits the user identifier and the password to different servers, and receives the user from the different server. A network user authentication method, wherein a user of a corresponding client terminal is authenticated by an identifier and a password. 6. A network user who transmits a user identifier and a password from a client terminal to an authentication server, checks the existence of the corresponding user identifier and password in the registration information of the authentication server, and authenticates the user. In the authentication system, the user adds the identification information of the client terminal to one of the user identifier and the password transmitted from the client terminal, transmits the user identifier and the password to different servers, and the authentication server is different. Network usage characterized in that the existence of the corresponding user identifier and password in the registration information is confirmed based on the user identifier and password received by the server, the user is authenticated, and the corresponding client terminal is authenticated. Authentication method. 7. The network user authentication system according to claim 3, wherein the user identifier and the password transmitted from the client terminal connected to the network have the identification information of the client terminal added to only one of them. A client which is transmitted as a user identifier and a password and which is added to one of the user identifier and the password when the authentication server receives the user identifier and the password from the first server and the second server via the network, respectively. A network user authentication system, wherein terminal identification information is set and a client terminal to be authenticated is specified.