JP2002312319A - Password system - Google Patents

Abstract

(57) [Summary] [PROBLEMS] To realize a password system that does not use encryption and does not burden users. SOLUTION: In a password system which authenticates a password when a user logs in to a server which is a remote computer via a network from a client which is a local computer used as a terminal, in the password system, the user in advance Means for registering a plurality of one-time passwords in a database, and when the user logs in to the server from the client using one of the registered one-time passwords, the server determines whether the login password matches the registered password. Means for permitting login when confirmed, and for deleting the registered password from the database registration of the server.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a password system for authenticating a password when a user logs in to a remote computer (hereinafter, a server) via a network from a local computer (hereinafter, a client) used as a terminal. It is.

[0002]

2. Description of the Related Art FIG. 3 shows a conventional password system in which a user inputs a user ID and a password from a client 1 via a network 3 and a server 2 checks whether the user ID and the transmitted password match. Is a system that verifies passwords using a password database on the server side and permits login.

FIG. 4 shows a password system based on SSH (Secure Shell), which is a standard encryption standard recently widely used. Both the client 1 and the server 2 have encryption software based on SSH.
The client 1 receives a public key from the server 2 in advance, uses the public key to encrypt a password using SSH, and sends the encrypted password to the server 2.

On the server 2 side, a password is opened using a secret key, decryption is performed using SSH, the password is checked against a password database registered in a server side database, and login is permitted. In addition, SSH
Is encrypted not only for the password but also for the entire communication.

FIG. 5 shows an original method of a one-time (disposable) password system which is the subject of the present invention. When the user sends the user ID to the server 2 from the client 1, the server generates a random number,
The shared key is encrypted and returned to the client 1. The client 1 further decrypts it and sends a random number to the server 2. The server 2 authenticates the user by checking whether the transmitted random number matches the generated random number. New random numbers are successively generated.

FIG. 6 shows another method of the password system. When the user gives an initial password to the server 2 in advance, the server 2 automatically generates some passwords using a hash function. If the client 1 has a dedicated command to use the hash function, the user can calculate the password at that location to know the usable password, or output the calculation result of the server 2 on paper in advance. In some cases, users carry this with paper.

[0007]

In the password system shown in FIG. 3, since the password input by the user flows on the network line in the form of raw text, it is intercepted by a third party. In the SSH system of FIG. 4, the client needs to be an SSH client. Users cannot always log in remotely to a server from a machine that supports SSH.

In the password system shown in FIG. 5, a client must always have a random number generation tool for decryption, like SSH. FIG. 6 In the password system, there is an annoyance that the user has to memorize the random one-time password passed from the server in advance. In addition, it is not impossible that a third party can guess the next one-time password from one one-time password by finding an inverse function of the hash function.

[0009] For a person working in a company or university network, a machine at home or on a business trip, or a machine installed in a conference or the like whose form is unknown,
You may want to log in to a company or university remotely. In recent years, network security has been strongly demanded, and in many places remote login without encryption has been prohibited.

[0010] If SSH is used, the entire communication is encrypted, so there is no security problem.
It is not always possible to access the server from a client supporting H. Also, most remote login cases do not involve remote exchange of confidential files and the like, but exchange files that may be known to others, so that encryption of the entire communication is unnecessary.

[0011] As described above, in the conventional password system using encryption, the user is inconvenienced by giving the user a compounding tool or making the user memorize a random password character string in order. Was something. An object of the present invention is to realize a password system that does not use encryption and does not burden a user.

[0012]

SUMMARY OF THE INVENTION In order to achieve the above object, a feature of the present invention is that a user who is a local computer used as a terminal by a user through a network. In a password system for authenticating a password when logging in to a server which is a remote computer, a means for the user to register a plurality of one-time passwords in advance in the database with respect to the server; When logging in to the server using one of the time passwords, the server permits login when the login password and the registered password match, and deletes the registered password from the server database registration. In points allowed and means that, the.

A feature of the present invention is that the user adds expiration date information to a password registered in the server.

[0014] A feature of the invention according to claim 3 is that, when the server receives a password registration by the user,
Check the password registration conditions including the expiration date,
When the condition is satisfied, a message for permitting registration to the database is notified to the user, and when the condition is not satisfied, a message for rejecting registration to the database is notified to the user.

According to a fourth aspect of the present invention, when the server accepts a password registration by the user, checks the password registration condition and permits the registration in the database, the server includes the current registration including the newly registered password. The effective password is output to a list file in the home directory of the user.

According to a fifth aspect of the present invention, when the user logs in to the server from the client using one of the registered one-time passwords, the registered password is deleted from the database registration of the server, The point is that the list file in the home directory of the user is updated.

According to a sixth aspect of the present invention, when the server accepts a password registration by the user,
If the password is the same as or different from the password used in the past, it is determined that the registration condition is not satisfied, and the user is notified of a message rejecting registration in the database.

[0018]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a functional block diagram illustrating a preliminary operation on the server 2 side by the user 4 in the password system of the present invention.

The user 4 registers a password in the one-time password database 6 via the man-machine interface 5 of the server 2 having the one-time password service (in this example, a new password passwd123 is added to the already registered password). to add. The password to be input is an arbitrary character string, and the longest expiration date information is also input as necessary. At this time, the number of passwords may be input as much as permitted.

The server 2 has a registration permission / non-permission judging means 7, and the password passwd12 which the user tried to register according to the contents of the condition table 8 based on the security policy of the administrator (the number of character strings of the password, the expiration date, etc.).
3. Determine whether 3 can be registered in the database.

As a result of the determination, if the registration is not possible, the user is notified via the man-machine interface 5 that the user cannot be registered. If the registration is successful, the password passwd123 is additionally registered in the database 6, and the currently available one including the newly added password is registered. The time password is output to the list file 10 in the user's home directory 9 and the contents are updated.

FIG. 2 shows that in the password system according to the present invention, the user operates the network 3 from the client 1.
FIG. 7 is a functional block diagram illustrating an operation when a one-time password is sent to the server 2 via the PC to request permission for login.

In use, the user 4 sends a password (for example, passwd12) to the server 2 via the network 3 from the man-machine interface of the client 1.
Send 3) and ask for permission to log in.

Reference numeral 11 denotes a user authentication means which is a function of the server 2. When the password passwd123 sent from the client 1 is received, if the password matches one of the passwords registered in the database 6 in advance, The log-in permission is notified to the client 1 via the network.

When login is permitted by matching the password passwd123, the password is
The passwd 123 is discarded from the database 6 and cannot be used. Further, the change in the registered contents of the database 6 due to the discard of the password is rewritten to the latest information by updating the password list file 10 in the home directory 9 of the user.

In the operation of the system of the present invention, in the registration condition table 8 on the server side, the password used in the past is stored in addition to the minimum number of character strings and the maximum expiration date, and password registration by the user is accepted. At this time, it is preferable in terms of security that a registration condition is set such that if the password is the same as or different from the password used in the past, the registration is rejected and the password is not adopted.

[0027]

As is apparent from the above description,
According to the present invention, since no special processing such as encryption and decryption is required on the client, it is possible to log in to the server from any machine connected to the Internet.

The user can use a password which is easy for the user to remember, thereby avoiding the trouble of memorizing the password in order.

[Brief description of the drawings]

FIG. 1 is a functional block diagram of a password system according to the present invention.

FIG. 2 is a functional block diagram of the password system of the present invention.

FIG. 3 is a block diagram showing a conventional password system.

FIG. 4 is a block diagram showing a conventional password system.

FIG. 5 is a block diagram showing a conventional password system.

FIG. 6 is a block diagram showing a conventional password system.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Client 2 Server 3 Network 4 User 5 Server-side man-machine interface 6 One-time password database 7 Registration permission / non-permission means 8 Registration condition table 9 User home directory 10 Password list file 11 User authentication means

Claims (6)

[Claims] 1. A password system which authenticates a password when a user logs in to a server which is a remote computer via a network from a client which is a local computer used as a terminal. Means for registering a plurality of one-time passwords in a database, and when the user logs in to the server from the client using one of the registered one-time passwords, the server matches the login password with the registered password. And a means for permitting login when confirming, and for deleting the registered password from the database registration of the server. 2. The password system according to claim 1, wherein expiration date information is added to a password registered in said server. 3. The server, upon receiving a password registration by the user, checks a password registration condition including the expiration date, and if the condition is satisfied, sends a message permitting registration to a database, and a message that satisfies the condition. 2. The method according to claim 1, wherein if not, a message rejecting registration to the database is notified to the user.
And 2. The password system according to 2. 4. The server accepts the password registration by the user, checks the password registration condition and permits the registration in the database, and replaces the current effective password including the newly registered password with the user. 4. The password system according to claim 1, wherein the password is output to a list file in a home directory. 5. When the user logs in to the server from the client using one of the registered one-time passwords, the registered password is deleted from the database registration of the server, and a list of the home directory of the user is provided. The password system according to any one of claims 1 to 4, wherein the file is updated. 6. When the server accepts the password registration by the user, if the password is the same as or different from the password used in the past, the server judges that the registration condition is not satisfied, and The password system according to any one of claims 1 to 5, wherein the user is notified of a message rejecting registration of the password.