JP2010086175A - Remote access management system and method - Google Patents

Abstract

A remote access management system that can guarantee the validity of an encryption key used for user authentication without using a certificate issued by a certificate authority.
When a user inputs a password and user data to a remote computer 2 (a in FIG. 1), an encryption key used for user authentication and an ID number of a USB memory 5 are generated by the remote computer 2, and the encryption key And the ID number are stored in the USB memory 5 (a in FIG. 1), and the password and user data are transmitted to the authentication server 3 (c in FIG. 1). When the remote computer 4 accesses the LAN 6, an authentication code using an encryption key is generated in the USB memory 5 (FIG. 1D), and the authentication server 3 verifies the authentication code generated in the USB memory 5. User authentication is performed to manage remote access to the remote computer 2 (e in FIG. 1).
[Selection] Figure 1

Description

  The present invention relates to a technique for managing remote access of an external computer to a security-managed network.

  Along with the development of network technology, in order to prevent the leakage and theft of corporate information, enterprises, etc. have information resources (applications) on the server side installed in the security-managed network by providing clients with the minimum functions. Thin client systems that concentrate data and data files) are becoming popular.

  When a thin client accesses a server or computer installed in a LAN (LAN: Local Area Network) in the company, the thin client is connected by an authentication server that supports the Radius protocol (Radius: Remote Access Dial In User Authentication Service). It is common to authenticate the user who operates.

  Similar to a general client-server system, in a thin client system, as described in “Prior Art” of Patent Document 1, a public key cryptosystem is often used for user authentication. In order to prove the validity of the public key, a user public key certificate issued by a certificate authority is used.

  However, since the certificate issued from the certificate authority has an expiration date as described in “Problems to be Solved by the Invention” in Patent Document 1, the certificate issuance / update, etc. The business becomes a burden on the system administrator, and it is necessary to implement the invention of Patent Document 1 in order to reduce the business load such as certificate issuance / update.

JP 2002-215826 A

  Therefore, the present invention provides a user without using a certificate issued by a certificate authority when remotely accessing a server or computer installed in the network from outside the security-managed network, as in a thin client system. It is an object of the present invention to provide a remote access management system and method capable of guaranteeing the validity of an encryption key used for authentication.

  A first invention for solving the above-mentioned problem is a remote access management system for managing access to a security-managed network, wherein a remote computer installed in the network has an authority to use the remote computer. An encryption key used for user authentication is generated from the first data input by the user having the password, and the encryption key is stored in the token possessed by the user, and the ID number of the first data and the token is stored. A user registration means for sending the token to the authentication server installed in the network, and the token is stored in the memory, a data storage means for storing the encryption key transmitted from the remote computer in a memory Provided with an authentication code generating means for generating an authentication code using the encryption key; When the authentication server installed in the network receives the first data and the ID number from the remote computer, the authentication server generates the encryption key from the first data and associates it with the received ID number. The user information storage means for storing the encryption key and the unique information of the remote computer in a data storage device, and the authentication code and the ID number generated by the token are received from the remote computer installed outside the network When the authentication code is verified using the encryption key associated with the ID number and the authentication code is successfully verified, access to the remote computer specified by the specific information is permitted. Remote access management system, characterized by comprising access management means for outputting information to be transmitted It is a non.

  According to the remote access management system of the first invention described above, the encryption key used for user authentication is a user having authority to use the remote computer installed in the network (for example, an employee of a company). ) Is generated from the first data input to the remote computer, so that the authentication server can perform user authentication during remote access to the remote computer without using the certificate of the encryption key. The validity of the encryption key to be used can be guaranteed.

  Here, the token means a portable medium having a calculation function and a memory such as a USB memory or an IC card.

  Further, the second invention is the remote access management system according to the first invention, wherein the user registration means provided in the remote computer is configured so that the user can add the encryption key to the remote computer. The token ID number is generated from the second data unique to each user, and the encryption key and the ID number are stored in the token possessed by the user, and instead of the ID number Means for transmitting the second data to an authentication server, wherein the data storage means provided in the token is means for storing the encryption key and the ID number transmitted from the remote computer in a memory; The user information storage means of the authentication server receives the first data and the second data from the remote computer. Then, a remote access management system, characterized in that from said first data and said second data is a means for generating each said cryptographic key and the ID number.

  According to the second invention described above, since the ID number for identifying the token storing the encryption key is also generated by the remote computer, there is no need to issue a token at the factory or the administrator side. .

  Further, a third invention is the remote access management system according to the first invention or the second invention, wherein the user information storage means of the authentication server transmits at least the encryption key. The remote access management system is characterized in that at least the encryption key is calculated only when the verification is successful.

  According to the third invention described above, the authentication server includes means for verifying, for example, by confirming an IP address of the remote computer that transmits at least the encryption key, so that user registration is surely performed in the network. It can be confirmed that the remote computer is installed.

  Further, a fourth invention is the remote access management system according to any one of the first invention to the third invention, wherein the token generates the authentication code using a random number, and the authentication The server is a remote access management system that verifies the authentication code using a random number used by the token for generating the authentication code.

  According to the fourth aspect described above, by generating the authentication code using a random number, the authentication code becomes different every time, and reuse of the authentication code can be prevented.

  A fifth invention for solving the above-mentioned problem is a remote access management method for managing access to a security-managed network, in which a remote computer installed in the network is authorized to use the remote computer. A step of generating an encryption key to be used for user authentication from first data input from a user having the following: and the remote computer stores the encryption key in the token connected to the remote computer A step of transmitting the first data and the ID number of the token to an authentication server installed in the network, the authentication server generating the encryption key from the first data, and Link and record the encryption key and the unique information of the remote computer. A user registration step in which step a3 is executed, and when a remote computer installed outside the network accesses the remote computer, the remote computer connects the encryption key to the token connected to the remote computer. A step b1 of sending an authentication code generated using the token and transmitting the authentication code generated by the token and the ID number stored in the token to an authentication server; and The authentication code is verified using the encryption key associated with the received ID number, and when the authentication code is successfully verified, the authentication target specified by the unique information associated with the ID number is obtained. Step that outputs information that permits access to the remote computer b2 is a remote access management method characterized in that it comprises a remote access management process is executed.

  A sixth invention for solving the above-described problem is the remote access management method according to the fifth invention, wherein, in the step a1 of the user registration step, the remote computer adds the encryption key, and A user inputs to the remote computer and generates the token ID number from second data that is unique for each user. In step a2, the remote computer adds the encryption key to the token. The ID number is stored, and the second data is transmitted to the authentication server instead of the ID number. In the step a3, the authentication server uses the first data and the second data to perform the encryption. A remote access management method characterized by generating a key and the ID number.

  According to the fifth and sixth inventions, the same effects as those of the first and second inventions can be obtained.

  As described above, according to the present invention, a certificate issued by a certificate authority is used when remotely accessing a server or a computer installed in the network from outside the security-managed network as in a thin client system. Therefore, it is possible to provide a remote access management system and method that can guarantee the validity of an encryption key used for user authentication.

  Now, preferred embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram illustrating a configuration of a remote access management system 1 in the present embodiment.

  The remote access management system 1 illustrated in FIG. 1 stores an operating system (OS) for a thin client, a USB memory 5 (USB Memory) that functions as a token according to the present invention, and a DMZ 7 (DMZ: DeMilitarized). Zone) and a firewall device 70 and a VPN device 71 (VPN: Virtual Private Network) for forming a LAN 6 (LAN: Local Area Network), a router 60 installed in the LAN 6, and a network device connected to the router 60. The computer includes at least a remote computer 2 and an authentication server 3 that authenticates a user who operates the remote computer 4 that accesses the LAN 60.

  In the remote access management system 1 illustrated in FIG. 1, the user performs user registration by operating the remote computer 2. When performing user registration, when the user inputs the password, which is the first data related to the present invention, and the user data, which is the second data related to the present invention, to the remote computer 2 (a in FIG. 1), the user As information used for authentication, an encryption key used for user authentication and an ID number for identifying the USB memory 5 registered by the user are generated by the remote computer 2, and the remote computer 2 stores the encryption key and the ID number. Is stored in the USB memory 5 (a in FIG. 1), and the password and user data are transmitted to the authentication server 3 (c in FIG. 1).

  When the user accesses the LAN 6 from the remote computer 4, an authentication code using the encryption key generated when the user registration is performed is generated in the USB memory 5, and the authentication code is transmitted from the remote computer 4 to the authentication server 3. (D in FIG. 1).

  The authentication server 3 performs user authentication by verifying the authentication code generated in the USB memory 5, and when the authentication server 3 succeeds in user authentication, the computer on which user registration is executed (here, the remote target in the LAN 6). The remote computer 4 is permitted to access only the computer 2) (e in FIG. 1).

  As described above, in the remote access management system 1 according to the present embodiment, the encryption key used for user authentication is obtained by a user (for example, a company employee) who has the authority to use the remote computer 2 installed in the LAN 6. Since the password is generated from the password input to the remote computer 2, the authentication server 3 can verify the validity of the encryption key used for user authentication executed during remote access to the remote computer 2 without using the encryption key certificate. Can be guaranteed.

  In addition, since the ID number for identifying the USB memory 5 registered by the user is also generated by the remote computer 2 installed in the LAN 6, it is necessary to issue a token such as the USB memory 5 on the factory or administrator side. Disappear.

  From here, the process performed by the remote access management system 1 illustrated in FIG. 1 will be described. FIG. 2 is a flowchart showing the procedure of the user registration process executed when the user is registered. FIG. 3 is a flowchart showing the procedure of the remote access management process executed when accessing the LAN 6 from outside the LAN 6. FIG.

  First, the user registration process will be described with reference to FIG. In a user registration process executed when registering a user, the user is installed on a remotely accessed computer 2 (for example, a user's own computer) and starts a computer program for executing user registration. User registration is started (S1 in FIG. 2).

  When the computer program is started, the remote computer 2 displays a screen for inputting a password and user data on the display of the remote computer 2, and the remote computer 2 is input by the user using an input device such as a keyboard. A password and user data are acquired (S2 in FIG. 2).

  The password that the user inputs to the remote computer 2 is information that becomes the seed of the encryption key, and the user can arbitrarily determine the password. The user data is information used as a seed for the ID number, and the user data is unique data for each user, for example, the employee number or mail address of the user.

  When the password and user data are input to the remote computer 2, the remote computer 2 generates an encryption key to be used for user authentication from the password using a predetermined encryption algorithm, and further performs USB registration for user registration. An ID number for identifying the memory 5 is generated from the user data (S3 in FIG. 2).

  Note that it is desirable in terms of security that the encryption algorithm for generating the encryption key and the encryption algorithm for generating the ID number are different from each other, and here, the encryption algorithm (ENC1) is used when generating the encryption key from the password. Furthermore, an encryption algorithm (ENC2) is used when generating an ID number from user data.

  When the remote computer 2 generates an encryption key from the password and generates an ID number from the user data, the authentication server 3 receives the password that is the seed of the encryption key and the user data that is the seed of the ID number via the LAN 6. (S4 in FIG. 2).

  When the password and user data are transmitted from the remote computer 2, the authentication server 3 uses the same encryption algorithm as the remote computer 2 to generate an encryption key used for user authentication from the password, Further, the ID number of the USB memory 5 registered as a user is generated from the user data (S5 in FIG. 2).

  Here, since the remote computer 2 uses the encryption algorithm (ENC1) when generating the encryption key from the password, the authentication server 3 also uses the encryption algorithm (ENC1) when generating the encryption key from the password. For this reason, an encryption algorithm (EC2) is used when an ID number is generated from user data.

  When the authentication server 3 generates the encryption key and the ID number, the authentication server 3 stores the encryption key and unique information of the remote computer 2 (IP address or MAC address in the LAN) in a hard disk or the like in association with the ID number. When the ID number is stored, a message indicating that the generation of the encryption key and the ID number is completed is transmitted to the remote computer 2 via the LAN 6 (S6 in FIG. 2).

  When the remote computer 2 receives the message from the authentication server 3, the remote computer 2 writes the encryption key and ID number generated in S3 of FIG. 2 into the USB memory 5 connected to the remote computer 2, and via the LAN 6, A message indicating that the user registration is completed is transmitted to the authentication server 3, and the user registration process illustrated in FIG.

  Next, the remote access management process will be described with reference to FIG. When the user accesses the remote computer 2 installed on the LAN 6 from the remote computer 4, the user connects the USB memory 5 for which user registration has been completed to the remote computer 4, and the computer in the LAN 6 (for example, a remote computer) When a computer program used when accessing 2) is started, processing related to remote access to the remote computer 2 is started. (S10 in FIG. 3).

  When processing related to remote access to the remote computer 2 is started, the remote computer 4 sends a command to the USB memory 5 to generate a random number Rc, which is the basis of an authentication code used for user authentication, so that the USB The memory 5 is requested to generate a random number Rc that is the basis of an authentication code used for user authentication (S11 in FIG. 3).

  When the USB memory 5 receives a request for generating a random number Rc from the remote computer 4, the USB memory 5 generates a random number Rc inside the USB memory 5, returns the generated random number Rc to the remote computer 4, and generates a random number until an authentication code is generated. Rc is held inside (S12 in FIG. 3).

  When the remote computer 4 receives the random number Rc from the USB memory 5, the remote computer 4 transmits a message including the random number Rc to the authentication server 3, and requests the authentication server 3 for user authentication (S13 in FIG. 3).

  Upon receiving a user authentication request from the remote computer 4, the authentication server 3 internally generates a random number Rs, and returns a user authentication request to the remote computer 4 (S14 in FIG. 3). Note that the authentication server 3 holds the random number Rc and the random number Rs inside the authentication server 3 until the user authentication is completed.

  When the remote computer 4 receives the random number Rs from the authentication server 3, the remote computer 4 authenticates the USB memory 5 by sending a command for generating an authentication code to the USB memory 5 including data obtained by combining the random number Rc and the random number Rs. Code generation is requested (S15 in FIG. 3).

  When the USB memory 5 receives the command from the remote computer 4, the USB memory 5 uses the encryption key stored in the USB memory 5 and follows a predetermined algorithm such as a MAC algorithm of ISO / IEC9797-1 (1999). Then, an authentication code is generated from the combination of the random number Rc and the random number Rs, and in addition to the generated authentication code, the ID number stored in the USB memory 5 is returned to the remote computer 4 (S16 in FIG. 3).

  When receiving the authentication code and the ID number from the USB memory 5, the remote computer 4 transmits a message including the authentication code and the ID number, and requests the authentication server 3 to verify the authentication code (S17 in FIG. 3).

  When the authentication server 3 receives the verification request for the authentication code from the remote computer 4, the authentication server 3 uses the encryption key stored in association with the ID number included in the message, and follows the same algorithm as that of the USB memory 5. An authentication code transmitted from the remote computer 4 is generated by generating a reference authentication code from the combination of the random number Rc and the random number Rs held in the above and collating the authentication code transmitted from the remote computer 4 with the reference authentication code. Is verified (S18 in FIG. 3).

  When the authentication server 3 verifies the validity of the authentication code, the authentication server 3 changes the behavior according to the verification result (S19 in FIG. 3), and when the verification of the authentication code is successful, a message indicating that the user authentication is successful is displayed. In addition to being transmitted to the remote computer 4, an instruction for permitting the remote computer 4 to access the remote computer 2 specified by the unique information stored in association with the ID number is transmitted to the VPN device 71 (see FIG. 3, S20), when the verification of the authentication code fails, the remote access management process shown in FIG. 3 ends without issuing an instruction to permit the remote computer 4 to access.

  From here, the remote computer 2, the authentication server 3, and the USB memory 5 which comprise the access management system 1 shown in FIG. 1 are demonstrated in detail, referring a figure.

  4 is a block diagram of the remote computer 2, FIG. 4 (a) is a circuit block diagram, and FIG. 4 (b) is a functional block diagram.

  As shown in FIG. 4A, the remote computer 2 is realized by a general-purpose computer, and the remote computer 2 includes, as hardware, a CPU 20 (Central Processing Unit), a RAM 21 (Random Access Memory), and a data storage device. A hard disk 22, a network interface 23, a display 24, a keyboard 25, a pointing device (for example, a mouse) 26, and the like.

  Further, as shown in FIG. 4B, in order to function as a remote computer according to the present invention, the remote computer 2 is realized by a computer program using the hardware shown in FIG. 2, the encryption key and the ID number are generated from the password and user data input to the remote computer 2 by executing S1 to S4 and S7 in FIG. User registration means 200 that stores the password and user data to the authentication server 3 as well as being stored in the memory 5 is provided.

  5 is a block diagram of the authentication server 3, FIG. 5 (a) is a circuit block diagram, and FIG. 5 (b) is a functional block diagram.

  As shown in FIG. 5A, the authentication server 3 is realized by a general-purpose server, and the authentication server 3 is a CPU 30 (Central Processing Unit), a RAM 31 (Random Access Memory), and a data storage device as hardware. A hard disk 32, a network interface 33, a display 34, a keyboard 35, a pointing device (for example, a mouse) 36, and the like are provided.

  Further, as illustrated in FIG. 5B, in order to function as an authentication server according to the present invention, the authentication server 3 is realized by a computer program using the hardware illustrated in FIG. As means, a user information storage means 300 and an access management means 301 are provided.

  The user information storage means 300 provided in the authentication server 3 generates an encryption key and an ID number from the password and user data received from the remote computer 2 by executing S5 and S6 in FIG. It is a means for storing the encryption key and the unique information of the remote computer 2 in the hard disk 32 in association with each other.

  Further, the access management means 301 provided in the authentication server 3 executes S14 and S18 to S20 in FIG. 3 to use the encryption key stored in association with the ID number received by the remote computer 4. The reference authentication code based on the data obtained by combining the random number Rc generated by the USB memory 5 and the Rs generated by the authentication server 3 is calculated, and the authentication code received from the remote computer 4 and the reference authentication code calculated by the authentication server 3 are calculated. The user information is verified by verifying the authenticity of the authentication code received from the remote computer 4 and the unique information stored in association with the ID number received by the remote computer 4 only when the user authentication is successful. This is means for outputting an instruction for permitting access to the remote computer 2 specified in (2) to the VPN device 71.

  FIG. 6 is a block diagram of the USB memory 5, FIG. 6A is a circuit block diagram, and FIG. 6B is a functional block diagram.

  As shown in FIG. 6A, the USB memory 5 has a USB connector for USB connection with a computer, and a USB interface circuit 50 for realizing USB communication and the USB memory 5 are connected to the computer. A controller 51 that at least controls the USB memory 5 to act as an external storage device, and a flash memory 52 that stores data and computer programs. The flash memory 52 includes a computer program as a computer program A thin client OS 53 is stored in the RAM of a computer (here, the remote computer 4) to which the USB memory 5 is connected.

  As shown in FIG. 6 (b), in order to function as a token according to the invention, the USB memory 5 has encryption as means realized by a computer program using the hardware shown in FIG. 6 (a). A computer comprising data storage means 301 for storing data such as a key and an ID number, and an authentication code generating means 300 for generating an authentication code to be verified by the authentication server 3, and causing the controller 51 of the USB memory 5 to function as these means The program is written in the nonvolatile memory of the controller 51.

  Specifically, when the encryption key and the ID number are transmitted from the remote computer 2 in S7 of FIG. 2, the data storage unit 301 provided in the USB memory 5 stores the data in the flash memory 52 provided in the USB memory 5. A means for writing an encryption key and an ID number.

  Further, the authentication code generating means 300 provided in the USB memory 5 receives the random number Rc generated by the USB memory 5 and the external computer (here, the remote computer 4) by executing S12 and S16 of FIG. This is means for calculating an authentication code based on the data combined with Rs and returning the calculated authentication code and ID number to an external computer (here, the remote computer 4).

  Note that the thin client OS 53 stored in the USB memory 5 has a function of executing S10, S11, S13, S15, and S17 of FIG. 3 when the syncline OS 53 is activated on the remote computer 4.

  The function for executing the functions for executing S10, S11, S13, S15, and S17 in FIG. 3 can be realized by a method other than the thin client OS. For example, a computer program for causing the remote computer 4 to execute the functions is installed in advance. Further, when the authentication server 3 is accessed from the remote computer 4, a computer program for executing the function can be transmitted from the authentication server 3 to the remote computer 4.

  The present invention is not limited to the embodiments described so far, and various modifications and changes can be made.

  For example, the ID number for identifying the USB memory 5 can be stored in the USB memory 5 in advance without being generated by the remote computer 2 and the authentication server 3.

  At this time, in S2 of FIG. 2, the user inputs only the password to the remote computer 2, and in S3 of FIG. 2, the remote computer 2 generates only the encryption key from the password. In S4 of FIG. 2 reads the ID number from the USB memory 5 and transmits the generated encryption key and the read ID number to the authentication server 3. The authentication server 3 generates only the encryption key from the password in S5 of FIG.

  Further, in the user registration step illustrated in FIG. 2, the authentication server 3 verifies the remote computer 2 on which the user registration is executed by checking at least the IP address of the remote computer 2 that transmits the encryption key. Thus, it can be confirmed that the user registration is surely performed in the remote computer installed in the network.

The figure explaining the structure of the remote access management system in this embodiment. The flowchart which showed the procedure of the user registration process. The flowchart which showed the procedure of the remote access management process. The block diagram of a remote computer. The block diagram of an authentication server. The block diagram of USB memory.

Explanation of symbols

1 Remote Access Management System 2 Remote Computer 3 Authentication Server 4 Remote Computer 5 USB Memory

Claims (6)

  A remote access management system for managing access to a security-managed network, wherein a remote computer installed in the network is based on first data input by a user having authority to use the remote computer. Generates an encryption key used for user authentication, stores the encryption key in the token possessed by the user, and transmits the first data and the token ID number to an authentication server installed in the network User registration means, and the token generates a data storage means for storing the encryption key transmitted from the remote computer in a memory, and an authentication code using the encryption key stored in the memory The authentication code generating means, and the authentication installed in the network When the server receives the first data and the ID number from the remote computer, the server generates the encryption key from the first data and associates the encryption key with the received ID number User information storage means for storing unique information of the remote computer in a data storage device, and when the authentication code generated by the token and the ID number are received from a remote computer installed outside the network, Access management that verifies the authentication code using the associated encryption key, and outputs information permitting access to the remote computer specified by the specific information when the authentication code is successfully verified A remote access management system comprising means.   2. The remote access management system according to claim 1, wherein the user registration means provided in the remote computer is unique to each user when the user inputs the remote computer in addition to the encryption key. The token ID number is generated from the second data, and the encryption key and the ID number are stored in the token possessed by the user, and the second data is stored in the authentication server instead of the ID number. The data storage means provided in the token is a means for transmitting, the means for storing the encryption key and the ID number transmitted from the remote computer in a memory, and the user information storage means of the authentication server is When the first data and the second data are received from the remote computer, the first data Remote access management system, characterized in that the data and the second data is a means for generating each said cryptographic key and the ID number.   3. The remote access management system according to claim 1, wherein the user information storage unit of the authentication server verifies at least the remote computer that transmits the encryption key and succeeds in the verification. A remote access management system, wherein at least the encryption key is calculated.   4. The remote access management system according to claim 1, wherein the token generates the authentication code using a random number, and the authentication server includes the authentication code of the authentication code. A remote access management system, wherein the authentication code is verified using a random number used for generation.   A remote access management method for managing access to a security-managed network, wherein a remote computer installed in the network is based on first data input from a user having authority to use the remote computer. Step a1 for generating an encryption key used for user authentication, and the remote computer stores the encryption key in the token connected to the remote computer, and the first data and the ID number of the token Is transmitted to an authentication server installed in the network, a2, the authentication server generates the encryption key from the first data, associates the ID key with the encryption key and the remote computer The user who executes step a3 for storing the unique information And when the remote computer installed outside the network accesses the remote computer, the remote computer generates an authentication code using the encryption key for the token connected to the remote computer. A step b1 of transmitting the authentication code generated by the token and the ID number stored in the token to an authentication server, and the authentication server linked to the ID number received from the remote computer The authentication code is verified using the encrypted key, and when the authentication code is successfully verified, access to the remote computer specified by the unique information associated with the ID number is permitted. Remote access tube in which step b2 for outputting information is executed Remote access management method characterized by comprising the step. 6. The remote access management method according to claim 5, wherein, in the step a1 of the user registration step, the remote computer inputs the remote key to the remote computer in addition to the encryption key. The ID number of the token is generated from the second data that is unique to each other. In step a2, the remote computer stores the ID number in addition to the encryption key in the token, and replaces the ID number. The second data is transmitted to an authentication server, and in the step a3, the authentication server generates the encryption key and the ID number from the first data and the second data. Remote access management method.

Images