JP2005309590A - User authentication system and user authentication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a user authentication system that maintains high security strength and realizes group unit authentication and individual unit authentication at the same time.
In a conventional method of authenticating a user with high security strength when performing user authentication with an application server, a method of using a hardware key storing authentication information therein and a method of using physical line location information are provided. Both of them were inconvenient because they could not achieve both individual and group authentication. In addition, when authenticating on an individual basis, it is economically disadvantageous because it is necessary to distribute hardware keys for the number of people. In the present invention, authentication information is stored in the router installed at the end of the user line, the authentication server authenticates, and a common ID is notified from the authentication server to the application server in the terminals under the router. In addition, when the user inputs a different PW, the ID to be sent is changed for each PW.
[Selection] Figure 1

Description

  The present invention relates to a user authentication system and a user authentication method capable of achieving both group unit and individual unit authentication while maintaining high security strength.

  When the system authenticates the user, one of the problems to be solved by the system is how to provide a highly convenient authentication means while increasing the security strength.

  As a method of authenticating a user by an application server that requires user selection, as represented by BASIC authentication when performing user authentication in a WEB system, an ID (identification symbol) configured by a character string is used. There is a method of authenticating a user by inputting a PW (password).

  In this method, the application server pays out to the user a pair of ID and PW that are previously configured by a character string. When the application server authenticates the user, the WEB screen for inputting the ID and PW is presented to the user by HTTP (HyperText Transfer Protocol), and the user manually inputs the paid-out ID and PW on the WEB screen. The ID and PW input by the user are superimposed on HTTP and notified to the application server. The application server authenticates the user by comparing the received ID and PW with those that have been paid out in advance.

  In this method, a third party can easily steal an ID and PW by spoofing and impersonate the person, so that the security is weak and the stolen ID and PW are used by a normal owner. At the same time, there is a drawback that the security is weak in that there is a risk that a third party uses it in different places.

  As another method for the application server to authenticate the user, the application server issues a hardware key (for example, an IC card) in which the ID and PW are stored in advance to the user, and uses the hardware key to identify the user. There is a method for authentication (see Non-Patent Document 1, for example).

  In this method, at the time of authentication, the user attaches the issued hardware key to the user terminal. The application that authenticates at the user terminal generates a response using the ID and PW in the hardware key in response to the challenge sent from the application server superimposed on HTTP, along with the ID in the hardware key , Superimposed on HTTP and sent to the application server. The application server authenticates the user by comparing the received ID and response with information registered in advance.

  In this method, since a physical device itself called a hardware key cannot be impersonated unless it is stolen, security is strong. Also, since there is only one hardware key, there is an advantage that the third party is not authenticated at a different place at the same time that a normal holder uses it, and security is strong.

  As another method for the application server to authenticate the user, there is a method of using the position information of the physical line laid by the user. In this method, the application server registers the position information of the physical line laid by the user for each user in advance, and the user accesses the application server via the physical line registered in advance at the time of authentication with the application server. The application server authenticates the user by acquiring the position information of the physical line accessed by the user and comparing it with the position information registered in advance.

In this method, since the person is not impersonated unless the physical device itself called a physical line is illegally accessed, the security is strong. In addition, since authentication is performed only at the place where it is laid, there is an advantage that a third party is not authenticated at a different place at the same time as a normal owner uses, and security is strong.
“Safety Pass” (http://www.safety-pass.com) as of April 13, 2004

  In a conventional system that uses a hardware key, the hardware key is attached to the terminal and used. Therefore, it is possible to authenticate the user only on an individual basis using the terminal, and cannot authenticate the user on a group basis. Thus, the user is inconvenient when making a payment in units of groups such as a family member or a person in charge of work. In addition, in order to authenticate an individual, the hardware key must be distributed for each individual, which is expensive, and there is a problem that the user cannot be authenticated on a terminal where the hardware key cannot be attached. It was.

  Further, in the conventional system that uses physical line position information, users are authenticated in units of groups called lines, so it is not possible to identify individuals accommodated in the same physical line and authenticate users in units of individuals. In this regard, the user is inconvenient when granting access authority to each individual in the group. In addition, since it can be used only at the place where the line is laid, there is a problem that the user is inconvenient in that the user cannot be authenticated at various places.

  The present invention has been made in order to solve such problems, and its purpose is to enable user authentication in units of groups and individuals while maintaining high security strength and improve user convenience. An object of the present invention is to provide a user authentication system and a user authentication method that can be improved.

The present invention has been made to solve the above problems, and the user authentication system of the present invention is an authentication server installed on the Internet when user authentication is required by an application server installed on the Internet. Is a user authentication system that authenticates a user, notifies the application server of the authentication result, and performs user authentication, wherein the authentication server assigns a device number and an encryption to each router installed at a terminal end position of the user line. A key and ID are generated and registered, the generated device number and encryption key are stored in advance in the router, and the ID is stored in advance in the application server, and the application server requires user authentication. Means for requesting user authentication by the authentication server and before receiving the authentication request. Means for sending an authentication request including a challenge value to a user terminal; and when the router detects an authentication request including a challenge value from the authentication server via the user terminal. Means for extracting the stored device number and encryption key, calculating a response value, and sending the response value together with the challenge value and device number to the authentication server; and the authentication server receiving the response value, challenge value and device number from the router In this case, the response value is calculated based on the device number registered in the authentication server, the encryption key, and the received challenge value, and the ID is assigned to each router when the response value is correctly verified. Means for sending to the application server.
As a result, user authentication can be performed in groups by the device number of the router. Therefore, it is possible to perform user authentication using a device number in the router without distributing a high-cost hardware key while maintaining high security strength.
Also, a user terminal that cannot be fitted with a hardware key can be authenticated using a device number in the router as long as it has a browser.

The user authentication system of the present invention sets one PW for each device number stored in the router in advance by the authentication server, and presents a PW input screen to the user terminal when the authentication server performs user authentication. And means for notifying the PW together when the router sends an authentication request including a response value to the authentication server when the router receives the PW input to the user terminal, and the authentication server And a means for performing user authentication by an authentication request including a response value and PW.
Thus, user authentication can be performed in units of groups based on the device number of the router, and authentication by PW can be performed.
By adding PW, it is possible to further increase the security strength.

In the user authentication system of the present invention, the authentication server sets a plurality of PWs for each device number and an ID corresponding to each PW, and one PW among the plurality of PWs set for the user terminal. And a means for changing the ID sent from the authentication server to the application server for each PW by selecting and inputting.
As a result, user authentication can be performed in units of groups based on the device number of the router, and personal authentication by PW can be performed. For this reason, it is effective for the user in that the group unit authentication and the individual unit authentication can be performed simultaneously while maintaining high security strength. In addition, while maintaining high security strength, it is possible to authenticate an individual only by distributing a PW without distributing a high-cost hardware key, which is effective in reducing the cost of the user. Also, a user terminal that cannot be fitted with a hardware key can be authenticated using a device number in the router as long as it has a browser.

Further, the user authentication system of the present invention is different from the means for attaching / detaching the hardware key, which is a recording medium storing the device number and encryption key of the router, in the router and the user terminal, and mounting the hardware key on the router. The router also sends the same device number and encryption key information and the authentication server authenticates, and the authentication server sends an ID common to the user terminals under the router to the application server, and the hardware to the user terminal Attach the key, send the device number and encryption key information sent by the router from the user terminal, authenticate by the authentication server, and use the same ID as when the hardware key is attached to the router on one user terminal Means for sending to the server.
Thus, it is effective for the user in that group-based authentication using the same authentication information can be performed at various places while maintaining high security strength.

Further, in the user authentication method of the present invention, when user authentication is required by an application server installed on the Internet, the authentication server installed on the Internet authenticates the user and notifies the application server of the authentication result. A user authentication method for performing user authentication, wherein the authentication server generates and registers a device number, an encryption key, and an ID to be assigned to each router installed at a terminal line end position, and the generated device A procedure for storing a number and an encryption key in the router in advance and a procedure for storing the ID in an application server in advance, and a procedure for requesting user authentication by the authentication server when the application server requires user authentication. The authentication server that received the authentication request sends an authentication request including a challenge value to the user terminal. And when the router detects an authentication request including a challenge value from the authentication server via a user terminal, the device number and encryption key stored in the router are extracted and a response value is obtained. A procedure for calculating and sending to the authentication server together with the challenge value and device number, and a device number registered in the authentication server when the authentication server receives the response value, challenge value and device number from the router; A response value is calculated based on the encryption key and the received challenge value, collation is performed, and when the collation is correctly performed, an ID assigned to each router is transmitted to the application server. .
As a result, user authentication can be performed in groups by the device number of the router. Therefore, it is possible to perform user authentication using a device number in the router without distributing a high-cost hardware key while maintaining high security strength.
Also, a user terminal that cannot be fitted with a hardware key can be authenticated using a device number in the router as long as it has a browser.

In the user authentication method of the present invention, one PW is set for each device number stored in the router in advance by the authentication server, and a PW input screen is presented to the user terminal when the authentication server performs user authentication. And a procedure for notifying the PW together when the router sends an authentication request including a response value to the authentication server when the router receives the PW input to the user terminal, and the authentication server And a procedure for performing user authentication by an authentication request including a response value and PW.
Thus, user authentication can be performed in units of groups based on the device number of the router, and authentication by PW can be performed.
By adding PW, it is possible to further increase the security strength.

In the user authentication method of the present invention, the authentication server sets a plurality of PWs for each device number and an ID corresponding to each PW, and one PW among the plurality of PWs set for the user terminal. And a procedure for changing the ID sent from the authentication server to the application server for each PW by selecting and inputting.
As a result, user authentication can be performed in units of groups based on the device number of the router, and personal authentication by PW can be performed. For this reason, it is effective for the user in that the group unit authentication and the individual unit authentication can be performed simultaneously while maintaining high security strength. In addition, while maintaining high security strength, it is possible to authenticate an individual only by distributing a PW without distributing a high-cost hardware key, which is effective in reducing the cost of the user. Also, a user terminal that cannot be fitted with a hardware key can be authenticated using a device number in the router as long as it has a browser.

The user authentication method of the present invention is different from the procedure for attaching and detaching the hardware key, which is a recording medium storing the device number and encryption key of the router, in the router and the user terminal, and attaching the hardware key to the router. The router also sends the same device number and encryption key information and the authentication server authenticates, the authentication server sends a common ID to the user terminal under the router to the application server, and the hardware to the user terminal. Attach the key, send the device number and encryption key information sent by the router from the user terminal, authenticate by the authentication server, and use the same ID as when the hardware key is attached to the router on one user terminal And a procedure for sending to the server.
Thus, it is effective for the user in that group-based authentication using the same authentication information can be performed at various places while maintaining high security strength.

In the user authentication system and the user authentication method of the present invention, the authentication server generates a device number and an encryption key for each router and stores them in advance in each router. In addition, when the application server requires user authentication, it requests user authentication from the authentication server. When receiving the authentication request, the authentication server sends an authentication request including the challenge value to the user terminal. The router detects the authentication request including the challenge value via the user terminal, extracts the device number and encryption key stored therein, calculates the response value, and sends the response value together with the challenge value and the device number to the authentication server. To send. When the authentication server receives the response value, the authentication server performs collation based on information registered in advance. If the authentication server collates correctly, the authentication server sends an ID assigned to each router by the authentication server to the application server.
As a result, user authentication can be performed in groups by the device number of the router. Therefore, it is possible to perform user authentication using a device number in the router without distributing a high-cost hardware key while maintaining high security strength.
Also, a user terminal that cannot be fitted with a hardware key can be authenticated using a device number in the router as long as it has a browser.

In the user authentication system and the user authentication method of the present invention, one PW is set for each device number stored in the router in advance by the authentication server, and when the authentication server performs user authentication, a PW input screen is displayed on the user terminal. Present. When the user inputs PW, when the router sends an authentication request including a response value to the authentication server, the router also notifies the authentication server together with the PW, and the authentication server performs user authentication based on the authentication request including the response value and the PW.
Thus, user authentication can be performed in units of groups based on the device number of the router, and authentication by PW can be performed.
By adding PW, it is possible to further increase the security strength.

Further, in the user authentication system and the user authentication method of the present invention, a plurality of PWs to be set for each device number and IDs corresponding to the PWs are prepared in advance, and a plurality of settings are set when the user inputs the PW. By selecting and inputting one PW from the PWs that have been set, the ID sent from the authentication server to the application server is changed for each PW.
As a result, user authentication can be performed in units of groups based on the device number of the router, and personal authentication by PW can be performed. For this reason, it is effective for the user in that the group unit authentication and the individual unit authentication can be performed simultaneously while maintaining high security strength. In addition, while maintaining high security strength, it is possible to authenticate an individual only by distributing a PW without distributing a high-cost hardware key, which is effective in reducing the cost of the user. Also, a user terminal that cannot be fitted with a hardware key can be authenticated using a device number in the router as long as it has a browser.

In the user authentication system and the user authentication method of the present invention, the device number and the encryption key stored in the router are stored in a hardware key such as an IC card and can be attached and detached at the router and the user terminal. Also, by attaching a hardware key to the router, the same device number and the like are sent out by different routers, and the authentication server authenticates, and a common ID is sent to the application server at the user terminals under the router. Furthermore, by attaching a hardware key to the user terminal, the device number sent by the router is sent from the user terminal and the authentication server authenticates, and the same ID as that attached to the router is obtained by one user terminal. Send to application server.
Thus, it is effective for the user in that group-based authentication using the same authentication information can be performed at various places while maintaining high security strength.

  Next, the best mode for carrying out the present invention will be described with reference to the drawings.

[First Embodiment]
FIG. 1 is a diagram showing a configuration example of the entire system of a user authentication system according to the present invention.
In the system shown in FIG. 1, user terminals 10 including user terminal # 1 (11) and user terminal # 2 (12) are connected to a user network 13. Also, a router 14 storing “device number” and “encryption key” given from the authentication server 17 is connected to the boundary between the user line 15 connected to the Internet 16 and the user network 13. Is connected to the authentication server 17.

  Further, an application server 18 that authenticates a user using an authentication result by the authentication server 17 is connected to the Internet 16.

  FIG. 2 is a diagram showing a system configuration example of a user terminal in the user authentication system of the present invention. The user terminal 10 has a WEB browser 21 for displaying both sides on the user terminal 10 when, for example, the user accesses an application server or the like to use an application.

  FIG. 3 is a diagram showing a system configuration example of the router 14 in the user authentication system of the present invention. The router 14 includes an HTTP transfer unit 31 that receives an HTTP request from the user network 13 and the Internet 16 and performs processing based on a transmission destination address, a page, and the like. The authentication control unit 32 performs authentication with the authentication server 17 using the “device number 33” and the “encryption key 34” stored in the router 14. The “device number 33” and the “encryption key 34” are information for the authentication server 17 to identify and authenticate the router 14, and are information given in advance from the authentication server 17.

FIG. 4 is a diagram showing a system configuration example of the authentication server 17 in the user authentication system of the present invention.
The authentication server 17 includes an HTTP processing unit 41 that receives a WEB access by HTTP from the WEB browser of the user terminal 10 and transmits HTTP to the WEB browser of the user terminal 10. The authentication processing unit 42 performs user authentication based on the device number 33 and the encryption key 34 stored in the user router 14. In addition, it has a user DB 43 that manages information such as the device number 33 and encryption key 34 stored in the user's router 14 and the PW that is set in the device number 33 and manually entered by the user.

  FIG. 5 is a diagram showing a system configuration example of an application server in the user authentication system of the present invention. The application server 18 includes an HTTP processing unit 51 that receives a WEB access by HTTP from the WEB browser of the user terminal 10 and transmits HTTP to the WEB browser of the user terminal 10. In addition, the authentication server 17 is requested to perform authentication, and an authentication processing unit 52 that processes an authentication result from the authentication server 17 is provided. The authentication server 17 has a user DB 53 that manages information such as an ID given to the user.

  FIG. 6 is a diagram illustrating a configuration example of the user DB of the authentication server 17. The user DB 43 of the authentication server 17 has a device information table 61 and an ID table 62. The device information table 61 records information such as “device number”, “encryption key”, and “user name”. In the ID table 62, “device number”, “PW”, “ID” information and the like are recorded.

  FIG. 7 is a diagram illustrating a configuration example of the user DB of the application server 18. The user DB 53 of the application server 18 has a user information table 71. The user information table 71 includes information such as “ID” and “user name”.

  The procedure of authentication processing according to the present invention performed based on the system configuration described above will be described with reference to the sequence diagram shown in FIG.

  When the user accesses the WEB page that requires user authentication in the application server 18 installed on the Internet 16 from the user terminal 10 (step S101), the authentication processing unit 52 of the application server 18 detects the user's access. The authentication request process is started (step S102).

  The authentication processing unit 52 “the address of the user terminal 10” of the user who has accessed as the transmission destination address, “the address of the authentication start page” of the authentication server 17 as the reconnection destination address, and “the application server as the return address” An HTTP response in which “18 addresses” is set is generated and passed to the HTTP processing unit 51. The HTTP processing unit 51 transmits the HTTP response passed from the authentication processing unit 52 to the transmission destination address (the address of the user terminal 10) (step S103).

  FIG. 8 shows an example of an HTTP response of the authentication start request generated by the authentication processing unit 52. As shown in FIG. 8, the HTTP response transmitted from the application server 18 includes “transmission destination address (user terminal) 81”, “reconnection destination address (authentication server authentication start page) 82”, “return destination address ( Application server) 83 ”.

  The WEB browser of the user terminal 10 generates an HTTP request to the authentication start page of the authentication server 17 set as the reconnection destination address in the HTTP response received from the application server 18 and transmits the HTTP request to the authentication server 17 ( Step S104).

  When the HTTP processing unit 41 receives an HTTP request from the WEB browser of the user terminal 10 to the authentication start page of the authentication server 17, the authentication processing unit 42 authenticates the user by the challenge and response method. To create a challenge value.

  Furthermore, the authentication processing unit 42 sets the address of the user terminal 10 used by the user who has accessed as the transmission destination address and the challenge value generated as data, and the authentication execution page of the authentication server 17 as the PW transmission destination address. An HTTP response storing HTML data for presenting a PW input screen to the user's WEB browser is generated and passed to the HTTP processing unit 41. The HTTP processing unit 41 transmits the HTTP response passed from the authentication processing unit 42 to the transmission destination address (user terminal 10) (steps S105 and S106).

  FIG. 9 shows an example of an “authentication execution request HTTP response” generated by the authentication processing unit 42 in the authentication server 17. As shown in FIG. 9, the HTTP response includes “destination address (user terminal) 91”, “data # 1 (challenge value) 92”, “data # 2 (HTML data for PW input screen presentation) 93”, “ PW transmission destination address (authentication server authentication execution page) 94 ”.

  The WEB browser of the user terminal 10 interprets the HTML data “data # 2 (HTML data for PW input screen presentation) 93” stored in the HTTP response received from the authentication server 17, and displays the PW input screen on the user terminal 10. Is displayed. The user selects one PW from a plurality of PWs set in advance for each device number stored in the router 14, inputs it to both sides of the PW input, and presses the confirmation button displayed on both sides of the PW input (Step S107).

  When the PW is input, the WEB browser of the user terminal 10 receives the address of the authentication execution page of the authentication server 17 notified from the authentication server 17 as the transmission destination address, the challenge value notified from the authentication server 17 as data, and An HTTP request in which the PW input by the user is set is generated and transmitted to the transmission destination address (step S108).

  FIG. 10 shows an example of an HTTP request for an authentication execution request generated by the user terminal 10. As shown in FIG. 10, the HTTP request is composed of data of “destination address (authentication server authentication execution page) 101”, “data # 1 (challenge value) 102”, and “data # 2 (PW) 103”. Is done.

When the HTTP transfer unit 31 of the router 14 installed at the boundary between the user network 13 and the Internet 16 receives an HTTP request from the WEB browser of the user terminal 10, the destination address is the address of the authentication server 17 set in advance. (Step S109), and further checks whether the destination page is a page for performing authentication of the authentication server 17 set in advance (step S110). It should be noted that the authentication server 17 may be provided with a page for performing authentication on a dedicated server, thereby making it possible to omit checking whether the page is for performing authentication.
In the authentication server 17, the authentication execution page can be set on the same server as the authentication start page and can be listened to at a dedicated port number. As a result, the router 14 checks whether it is the port number for performing authentication, thereby checking whether it is the address of the server 17 and whether it is the page for performing authentication of the authentication server 17. Can be omitted.

  When the transmission destination address is the authentication execution page of the authentication server 17, the authentication control unit 32 calculates a response value from the challenge value extracted from the HTTP request and the device number and encryption key stored in the router 14. (Step S111).

  Further, the address of the authentication execution page of the authentication server 17 notified from the authentication server 17 as the transmission destination address, the challenge value notified from the authentication server 17 as the data, the PW input by the user, the calculated response value, and the router 14 generates an HTTP request in which the device number extracted from the inside is set, and transmits it to the transmission destination address of the authentication server 17 (step S112).

  FIG. 11 shows an example of an HTTP request for an authentication execution request generated by the authentication control unit 32 of the router 14. As shown in FIG. 11, the HTTP request includes “destination address (authentication server authentication execution page) 111”, “data # 1 (challenge value) 112”, “data # 2 (PW) 113”, “data #”. 3 (response value) 114 ”and“ data # 4 (device number) 115 ”.

  When the HTTP processing unit 41 receives an HTTP request to the authentication execution page of the authentication server 17 from the WEB browser of the user terminal 10 via the router 14, the authentication processing unit 42 The challenge value, response value, device number, and PW input by the user are extracted from the request (HTTP request generated by the router).

  Next, the authentication processing unit 42 extracts an encryption key from the device information table 61 of the user DB 43 using the device number as a key, and calculates a response value from the challenge value, the device number, and the encryption key. Then, the response value in the received HTTP request is collated with the calculated response value. If the two match, it is assumed that the user is authenticated (step S113).

  Further, using the device number and PW in the received HTTP request as keys, a matching record is searched for from the records having the same device number and different PWs from the ID table of the user DB 43 (step S114). If there is a matching record, the ID stored in the record is extracted. Further, as the transmission destination, the address of the router 14 used by the accessing user, the reconnection destination, the return address stored in the HTTP request received from the application server 18 via the user's WEB browser, and the data An HTTP response in which the extracted ID is set is generated and passed to the HTTP processing unit 41.

  The HTTP processing unit 41 transmits the HTTP response passed from the authentication processing unit 42 to the transmission destination address (user terminal 10) (step S116).

  In FIG. 12, the example of the HTTP response of the authentication implementation result produced | generated by the authentication process part 42 of the authentication server 17 is shown. As shown in FIG. 12, the HTTP response includes data of “transmission destination address (user router) 121”, “reconnection destination address (application server) 122”, and “data # 1 (ID)”.

  When the HTTP transfer unit 31 of the router 14 installed at the boundary between the user network 13 and the Internet 16 receives the HTTP response storing the ID extracted after authentication by the authentication server 17, it is used by the user who has accessed at the time of the authentication request. Transfer to user terminal 10.

  When the WEB browser of the user terminal 10 receives the HTTP response transferred from the router 14, the return address of the application server 18 that is the reconnection destination stored in the HTTP response as the transmission destination address, and the HTTP response as the data. An “HTTP request” in which the ID extracted from is set is generated and transmitted to the destination address (step S117).

  FIG. 13 shows an example of an “HTTP request” generated by the WEB browser. As shown in FIG. 13, the HTTP request includes data of “transmission destination address (application server) 131” and “data # 1 (ID) 132”.

  In the application server 18, when the HTTP processing unit 51 receives an HTTP request to the return address from the WEB browser of the user terminal 10, the authentication processing unit 52 extracts the ID from the HTTP request data. Further, the authentication processing unit 52 compares the extracted ID with the ID stored in the user information table of the user DB 53, and authenticates the user (step S118).

[Second Embodiment]
In the first embodiment, the authentication server 17 can send a different ID to the application server 18 for each PW input by the user, but the user using the same router inputs a different PW. Even so, the application server 18 can also identify that the user is using the same router.

  For the ID notified by the authentication server 17 to the application server 18, the application server is explicitly separated from the part indicating which router the user is using and the part indicating which PW the user has input. 18 can identify that it was accessed using the same router.

  FIG. 15 shows an example of an ID notified from the authentication server 17 to the application server 18. In the example illustrated in FIG. 15, the ID notified by the authentication server 17 includes a “router corresponding part 151” and a “PW corresponding part 152”. The “router corresponding portion 151” is information corresponding to identification in groups, and the “PW corresponding portion 152” is information corresponding to user personal identification.

[Third Embodiment]
In the mechanism of the first embodiment, when the response value calculated by the authentication control unit 32 of the router 14 is transmitted to the authentication server 17, the PW is stored and transmitted as it is in the data unit. By calculating a response value as a calculation target, it is possible to improve security without transmitting the PW as it is.

  The sequence of processing by this method is shown in the sequence diagram of FIG. In the sequence diagram shown in FIG. 16, compared with the sequence diagram in the first embodiment shown in FIG. 14, only the processing of the portion surrounded by the broken line (step S111a to step S115a) is changed. This is the same as the case of 14.

  In this method, when the response value is calculated by the router 14, the authentication control unit 32 responds from the challenge value extracted from the HTTP request, the device number and encryption key stored in the router 14, and the PW input by the user. The value is calculated (step S111a), an HTTP request is generated, and the HTTP transfer unit 31 transmits the HTTP request to the authentication execution page of the authentication server 17 (step S112a).

  The authentication processing unit 42 of the authentication server 17 extracts a challenge value, a response value, and a device number from the HTTP request. Next, using the device number as a key, the authentication processing unit 42 extracts one encryption key that matches the device number from the device information table 61 of the user DB 43 and extracts a plurality of PWs that match the device number from the ID table. Further, a response value is calculated from the challenge value, the device number, the encryption key, and each PW (step S113a). Then, the response value in the received HTTP request is collated with the calculated response value (step S114a). If there is a matching PW, it is assumed that the user has been authenticated, and an ID corresponding to the matching PW is extracted from the ID table and transmitted to the user terminal 10 (step S115a).

[Fourth Embodiment]
In the mechanism of the first embodiment, the user authentication by the router and the user authentication by the PW are performed in the same sequence, but the user authentication (group unit authentication) by the router is performed by separating the sequences. Then, by performing user authentication (personal authentication) by PW, even when the user does not use the router 14 corresponding to the present invention, the load that the authentication server 17 generates the PW input screen is reduced. You can also.

  FIG. 17 is a sequence diagram showing the flow of processing in the fourth embodiment, and will be described below with reference to FIG. Note that the processing from step S201 to step S214 shown in FIG. 17 is replaced with the processing from step S105 to step S115 in the first embodiment shown in FIG.

  In the first embodiment, when transmitting an authentication request from the authentication server 17 to the user terminal 10, the HTML data for presenting the PW input screen in addition to the challenge value is transmitted. In the embodiment, only the challenge value is transmitted (steps S201 and S202). The user terminal 10 generates an HTTP request and transmits it to the transmission destination address (step S203). When receiving the HTTP request from the user terminal 10, the router determines whether the destination address is the address of the authentication server 17 set in advance (step S204), or the authentication server 17 set in advance on the destination page. It is checked whether it is a page for performing authentication (step S205).

  Then, similarly to the first embodiment, the router 14 calculates a response value using the device number and encryption key stored therein (step S206), and transmits the response value to the authentication server 17 (step S207). . The authentication server 17 calculates a response value from a device number or the like registered in the user DB 43 in advance and collates it with the received response value (step S208).

  When the verification is correctly performed, the authentication processing unit 42 of the authentication server 17 sets the address of the user terminal 10 of the user who has accessed as the transmission destination address, and sets the address of the authentication execution page of the authentication server 17 as the PW transmission destination address. The HTTP response storing the HTML data for setting and presenting both sides of the PW input to the WEB browser of the user terminal 10 is generated and passed to the HTTP processing unit 41. The HTTP processing unit 41 transmits the HTTP response passed from the authentication processing unit 42 to the transmission destination address (user terminal 10) (steps S209 and S210).

  The WEB browser of the user terminal 10 interprets the HTML data stored in the HTTP response received from the authentication server 17 and displays a PW input screen on the user terminal 10. The user selects one PW from a plurality of PWs set in advance for each device number stored in the router 14 and inputs it to the PW input screen, and presses a confirmation button displayed on the PW input screen. (Step S211). Then, the WEB browser of the user terminal 10 generates an HTTP request in which the address of the authentication execution page of the authentication server 17 notified from the authentication server 17 as the transmission destination address and the PW input by the user as data are generated. The data is transmitted to the transmission destination address (authentication server 17) (step S212).

  When the HTTP processing unit 41 of the authentication server 17 receives an HTTP request from the WEB browser to the authentication execution page of the authentication server 17, the authentication processing unit 42 extracts the PW input by the user from the HTTP request.

  Next, the authentication processing unit 42 extracts the PW from the device information table 61 of the user DB 43, and uses the PW in the received HTTP request and the device number received at the time of authentication by the device number in the router 14 as a key. In the ID table, a matching record is searched from records having the same device number and different PWs (step S213).

  If there is a matching record, the ID stored in the record is extracted. Further, as the transmission destination, the address of the router 14 used by the accessing user, the reconnection destination, the return address stored in the HTTP request received from the application server via the user's WEB browser, and the data An HTTP response in which the extracted ID is set is generated and passed to the HTTP processing unit 41. The HTTP processing unit 41 transmits the HTTP response passed from the authentication processing unit 42 to the transmission destination address (step S214).

  By the processing procedure as described above, authentication is performed in units of groups first, and then individual authentication of users by PW becomes possible.

[Fifth Embodiment]
In the first embodiment, the device number and the encryption key are stored in the router 14, but the device number and the encryption key are stored in a hardware key (for example, an IC card), and the router 14 and user The hardware key may be detachable from the terminal 10.

  In this case, the router 14 checks the destination address of the HTTP request received by the HTTP transfer unit 31 and performs authentication processing with the authentication server 17 only when the hardware key is attached. As a result, the same device number and the like can be transmitted from different routers 14, and the authentication server 17 can transmit the same ID to the application server 18. In addition, the device number transmitted by the router 14 can be transmitted from the user terminal 10, and the authentication server 17 can transmit the same ID to the application server 18.

  FIG. 18 is a sequence diagram illustrating a flow in which the router 14 calculates a response value and notifies the authentication server 17 when the hardware key is attached to the router 14. The sequence diagram shown in FIG. 18 is different from the sequence diagram of the first embodiment shown in FIG. 14 in that the processing from step S301 to step S304 is the same as that of the first embodiment shown in FIG. This replaces the processing from step S109 to step S111. That is, only when the hardware key is attached (step S301), the destination address of the HTTP request received by the HTTP transfer unit 31 is checked, and the authentication process with the authentication server 17 is performed (step S302, S303, S304).

  FIG. 19 is a diagram illustrating a system configuration example of the user terminal 10 when a hardware key is attached to the user terminal 10. The user terminal 10 illustrated in FIG. 19 includes an HTTP transfer unit 191 that receives an HTTP request from the WEB browser 192 and performs transfer processing based on a transmission destination address, a page, and the like. The authentication server 17 also has a “hardware key 196” that stores “device number 194” and “encryption key 195”, which are information for identifying and authenticating the user terminal 10. The authentication control unit 193 is a processing unit for performing authentication with the authentication server 17 using the device number 194 and the encryption key 195.

  FIG. 20 is a sequence diagram illustrating a flow of processing in which the user terminal 10 calculates a response value and notifies the authentication server 17 of the response value. Note that the sequence diagram shown in FIG. 20 is different from the sequence diagram of the first embodiment shown in FIG. 14 in that the processing from step S401 to step S407 is the first embodiment shown in FIG. This replaces the processing from step S107 to step S112.

  That is, the user terminal 10 inputs PW (step S401) and makes an HTTP request (step S402). Only when the hardware key is attached (step S403), the transmission destination address (authentication server 17) of the HTTP request is checked (step S404), and whether it is a page for performing authentication (step S405). Then, a response value is calculated from the device number, encryption key, and challenge value in the hardware key (step S406), and “challenge value + response value + device number + PW” is transmitted to the authentication server 17 (step S407).

[Sixth Embodiment]
In the fifth embodiment, when the user uses a plurality of hardware keys, when the hardware keys are attached to both the user terminal 10 and the router 14, the hardware keys attached to the router 14 are not used. The authentication server 17 performs user authentication using the device number and encryption key stored in the hardware key attached to the user terminal 10.

  FIG. 21 is a sequence diagram illustrating a processing flow when hardware keys are attached to both the user terminal 10 and the router 14. Hereinafter, the processing flow will be described with reference to FIG. The sequence diagram shown in FIG. 21 is similar to the sequence shown in FIG. 20 from step S403 to step S406 as compared to the sequence diagram shown in FIG. 20, and the processing in the router 14 from step S501 to step S505 is the same. It has been added.

  In authenticating the user, when the HTTP transfer unit 191 of the user terminal 10 receives the HTTP request from the WEB browser, the destination address is the address of the authentication server 17 set in advance, or the destination page is It is checked whether the authentication server 17 is a pre-set authentication page (steps S403, S404, and S405).

  When the transmission destination address is the authentication execution page of the authentication server 17, the authentication control unit 193 in the user terminal 10 determines the challenge value extracted from the HTTP request, the device number and the encryption key stored in the hardware key From this, a response value is calculated (step S406).

  Further, the address of the authentication execution page of the authentication server 17 notified from the authentication server 17 as the transmission destination address, the challenge value notified from the authentication server 17 as data, the PW input by the user, the calculated response value, and hardware A device number extracted from the inside of the key is set, and an HTTP request in which a flag indicating that authentication is performed using a hardware key attached to the user terminal 10 is set in the HTTP header portion is generated, and a transmission destination is generated. It transmits to the address (step S501).

  When the HTTP transfer unit 31 of the router 14 installed at the boundary between the user network and the Internet receives an HTTP request from the user's WEB browser, whether the destination address is the address of the authentication server 17 set in advance ( In step S502), it is checked whether the destination page is a page for performing authentication of the authentication server 17 set in advance (step S503).

  If the destination address is a pre-set authentication server 17 authentication page, the HTTP transfer unit checks whether a flag indicating that a response value has been generated by the terminal is set in the HTTP header. (Step S504).

  When the flag is set, the HTTP request is transmitted to the authentication server 17 without performing any special operation. If the flag is not set, the authentication control unit 32 generates a response using a challenge value in the HTTP request and transmits an HTTP request to the authentication server 17 (step S505).

  As described above, the user authentication system of the present invention is effective in user convenience in that group-level authentication and individual-level authentication can be performed simultaneously while maintaining high security strength. In addition, while maintaining high security strength, it is possible to authenticate an individual only by distributing a PW without distributing a high-cost hardware key, which is effective in reducing the cost of the user. Also, a user terminal that cannot be fitted with a hardware key can be authenticated using an ID in the router as long as it has a browser. In addition, it is effective for the user in that group-based authentication using the same authentication information can be performed in various places while maintaining high security strength.

  Further, the above-described user terminal 10, router 14, authentication server 17, and application server 18 have a computer system therein.

  A series of processes related to the above-described process is stored in a computer-readable recording medium in the form of a program, and the above-described process is performed by the computer reading and executing this program.

  That is, each processing in the user terminal 10, the router 14, the authentication server 17, and the application server 18 is performed by a central processing unit such as a CPU reading the above program into a main storage device such as a ROM or a RAM to process or calculate information. This is realized by executing the process.

  Here, the computer-readable recording medium means a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, a semiconductor memory, or the like. Alternatively, the computer program may be distributed to the computer via a communication line, and the computer that has received the distribution may execute the program.

  The embodiment of the present invention has been described above. However, the user authentication system of the present invention is not limited to the illustrated example described above, and various modifications can be made without departing from the scope of the present invention. Of course.

  In the present invention, it is possible to simultaneously perform group-unit authentication and individual-unit authentication while maintaining high security strength. Therefore, the present invention is useful for a user authentication system, a user authentication method, and the like. .

It is a figure which shows the structural example of the whole system of the user authentication system by this invention. It is a figure which shows the system structural example of the user terminal in the user authentication system of this invention. It is a figure which shows the system structural example of the router in the user authentication system of this invention. It is a figure which shows the system configuration example of the authentication server in the user authentication system of this invention. It is a figure which shows the system configuration example of the application server in the user authentication system of this invention. It is a figure which shows the structural example of user DB of an authentication server. It is a figure which shows the structural example of user DB of an application server. It is a figure which shows the example of the HTTP response of an authentication start request | requirement. It is a figure which shows the example of the HTTP response of an authentication implementation request | requirement. It is a figure which shows the example of the HTTP request | requirement of an authentication implementation request | requirement. It is a figure which shows the example of the HTTP request | requirement of the authentication implementation request | requirement in which the response value was stored. It is a figure which shows the example of the HTTP response of an authentication implementation result. It is a figure which shows the example of the HTTP request of an authentication implementation result. It is a sequence diagram which shows the flow of the process in 1st Embodiment. It is a figure which shows the example of ID notified by an authentication server. It is a sequence diagram which shows the flow of the process in the example of 3rd Embodiment. It is a sequence diagram which shows the flow of a process in the example of 4th Embodiment. It is a sequence diagram which shows the flow of a process at the time of attaching a hardware key to the router in a 5th embodiment. It is a figure which shows the structural example of the user terminal in the case of mounting | wearing with the hardware key in a 5th embodiment. It is a sequence diagram which shows the flow of a process at the time of mounting | wearing a hardware key with the user terminal in the example of 5th Embodiment. It is a sequence diagram which shows the flow of the process in 6th Embodiment.

Explanation of symbols

10, 11, 12 User terminal 13 User network 14 Router 15 User line 16 Internet 17 Authentication server 18 Application server 21 WEB browser 31 Router HTTP transfer unit 32 Router authentication control unit 33 Device number 34 Encryption key 41 HTTP processing of authentication server Unit 42 Authentication processing unit of authentication server 43 User DB of authentication server
51 HTTP processing unit of application server 52 Authentication processing unit of application server 53 User DB of application server
61 Device Information Table 62 ID Table 71 User Information Table 191 HTTP Transfer Unit of User Terminal 192 WEB Browser of User Terminal 193 Authentication Control Unit of User Terminal 194 Device Number 195 Encryption Key

Claims (8)

When a user authentication is required by an application server installed on the Internet, a user authentication system that authenticates a user by an authentication server installed on the Internet and notifies the application server of the authentication result and performs user authentication. And
The authentication server generates and registers a device number, an encryption key, and an ID to be assigned to each router installed at the end position of the user line, and stores the generated device number and encryption key in the router in advance. And means for storing the ID in the application server in advance,
Means for requesting user authentication by the authentication server when the application server requires user authentication;
Means for sending an authentication request including a challenge value to the user terminal, the authentication server receiving the authentication request;
When the router detects an authentication request including a challenge value from the authentication server via a user terminal, the router extracts a device number and an encryption key stored in the router, calculates a response value, and Means for sending to the authentication server along with the value and device number;
When the authentication server receives the response value, challenge value, and device number from the router, the response value is calculated based on the device number registered in the authentication server, the encryption key, and the received challenge value, and verified. And a means for sending an ID assigned to each router to the application server when it is correctly verified. Means for setting one PW for each device number stored in the router in advance by the authentication server and presenting a PW input screen to the user terminal when the authentication server performs user authentication;
Means for notifying the PW together when the router sends an authentication request including a response value to the authentication server when the router receives the PW input to the user terminal;
The user authentication system according to claim 1, wherein the authentication server includes means for performing user authentication by an authentication request including the response value and PW. Means for the authentication server to set a plurality of PWs and IDs corresponding to each PW for each device number;
And a means for changing, for each PW, an ID transmitted from the authentication server to the application server by selecting and inputting one PW from among the plurality of PWs set in the user terminal. Item 3. The user authentication system according to Item 2. Means for attaching / detaching a hardware key, which is a recording medium storing the device number and encryption key of the router, in the router and the user terminal;
Attach the hardware key to the router, send the same device number and encryption key information in different routers, and the authentication server authenticates, and the authentication server sends the common ID to the user terminals under the router to the application server Means for sending out;
The hardware key is attached to the user terminal, the device number and encryption key information sent by the router is sent from the user terminal, the authentication server authenticates, and the hardware key is attached to the router at one user terminal. The user authentication system according to claim 1, further comprising means for sending the same ID as the case to the application server. This is a user authentication method in which when an application server installed on the Internet requires user authentication, the authentication server installed on the Internet authenticates the user, notifies the application server of the authentication result, and performs user authentication. And
The authentication server generates and registers a device number, an encryption key, and an ID to be assigned to each router installed at the end position of the user line, and stores the generated device number and encryption key in the router in advance. And storing the ID in the application server in advance,
A procedure for requesting user authentication by the authentication server when the application server requires user authentication;
The authentication server that has received the authentication request sends out an authentication request including a challenge value to the user terminal;
When the router detects an authentication request including a challenge value from the authentication server via a user terminal, the router extracts a device number and an encryption key stored in the router, calculates a response value, and Sending it to the authentication server along with the value and device number;
When the authentication server receives the response value, the challenge value, and the device number from the router, the response value is calculated based on the device number registered in the authentication server, the encryption key, and the received challenge value. And a procedure for sending an ID assigned to each router to the application server when the verification is correctly performed. A procedure for setting one PW for each device number stored in the router in advance by the authentication server and presenting a PW input screen to the user terminal when the authentication server performs user authentication;
A procedure for notifying the PW together when the router sends an authentication request including a response value to the authentication server when the router receives the PW input to the user terminal;
The user authentication method according to claim 5, further comprising: a procedure in which the authentication server performs user authentication by an authentication request including the response value and PW. A procedure in which the authentication server sets a plurality of PWs and IDs corresponding to the PWs for each device number;
And a procedure for changing the ID sent from the authentication server to the application server for each PW by selecting and inputting one PW from among the plurality of PWs set in the user terminal. Item 7. The user authentication method according to Item 6. A procedure for attaching / detaching a hardware key, which is a recording medium storing a device number and encryption key of a router, in the router and a user terminal;
Attach the hardware key to the router, send the same device number and encryption key information in different routers, and the authentication server authenticates, and the authentication server sends the common ID to the user terminals under the router to the application server Sending procedure,
The hardware key is attached to the user terminal, the device number and encryption key information sent by the router is sent from the user terminal, the authentication server authenticates, and the hardware key is attached to the router at one user terminal. The user authentication method according to claim 5, further comprising: a procedure of sending the same ID as the case to the application server.

Images