JP2001005784A - Device and method for collating password - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a password collating device and method by which password theft is prevented and data secrecy is kept by enabling a user to be authenticated through transmitting a character string which is changed every time a password is transmitted. SOLUTION: This password collating device is provided with a user terminal 10 which acquires a random character table generated by a manager terminal 12 through inputting a user name of a user and further transmits a character string converted by the random character table when the user input a password and the manager terminal 12 which receives the name from the terminal 10, generates a random character table to transmit the random character table to the terminal 10 when the name is a correct user name, converts a preliminarily stored password into a character string when the character string converted by the random character table is received from the user terminal and authenticates the character string by collating the character string with the received character string.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to password verification between computers, and more particularly to a password verification apparatus and method capable of authenticating a user by transmitting a character string that changes every time a password is transmitted.

[0002]

2. Description of the Related Art It is generally known that a conventional password collation method transmits a user name and a password registered in advance to an administrator to perform authentication.

[0003] An example of a conventional password collation method is described in Japanese Patent No. 2581276. The password management system described in this publication inspects and authenticates a use right when a computer is connected to a computer, a server, and other information processing devices via communication means.

In this password management method, a random character string generating means for generating a random character from a random number and a password key indicating a position of a character to be extracted from the random character string generated by the random character string generating means are registered in a password key file. Password key registering means, password conversion processing means for extracting a character from the random character string by the password key to generate a password character string, random character display processing means for displaying the random character string, and displaying the displayed random character string and password key Password input means for inputting a password character string created by the user from the user terminal and transmitted from the user terminal; a password character string generated by the password conversion processing means and a password character string input by the password input processing means And a password comparison processing means for performing authentication.

[0005]

However, simply by inputting the user name and password, the password can be specified by brute force of the character string. Can be eavesdropped on, making data confidential.

In the password management system described in Japanese Patent No. 2581276, a fixed type random character table is used. In other words, this table always stores one type of character only by changing the order of the characters in the table, and does not store the same character. As a result, even if a different character table is generated each time, regular data flows if line data is picked up.

SUMMARY OF THE INVENTION An object of the present invention is to limit the characters in a random character table, change the regularity every time, and authenticate a user only by transmitting a character string that changes each time instead of transmitting a password directly. It is an object of the present invention to provide a password collating apparatus and method which prevent password theft and protect data confidentiality.

[0008]

A password collating apparatus according to the present invention obtains a random character table, which is a character table having no regularity, from a manager terminal by inputting a name by a user, and further comprises the user When a user terminal transmits a character string converted by the random character table, a name is received from the user terminal, and if the name is a correct user name, a random character table is generated. An administrator terminal for transmitting to the user terminal, receiving the character string from the user terminal, converting the password of the user stored in advance into a character string, collating the received character string with the received character string, and performing authentication. It is characterized by the following.

[0009] A password collation method according to the present invention comprises a user terminal and an administrator terminal, and determines whether a connection from the user terminal is a correct access when the user terminal accesses the administrator terminal. In a password verification method for authenticating with an encrypted password, personal information of a user is transmitted from the user terminal to the administrator terminal, and the administrator terminal generates a random character table for converting the password. Then, transmitting to the user terminal, the user terminal converts the password into a first character string based on the random character table and transmits the first character string to the administrator terminal, and the administrator terminal stores the password in advance. Converting the password of the user into a second character string in the random character table;
Is compared with the second character string, and when they match, authentication is given.

[0010]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The structure of an embodiment of the present invention will be described in detail with reference to FIG. FIG. 1 is a diagram showing a configuration of a password collation device of the present invention.

As shown in FIG. 1, the password collating apparatus obtains a random character table from the administrator terminal 10 by inputting a name by the user, and is converted by the random character table when the user further inputs a password. A user terminal 10 that transmits a character string, and receives a name from the user terminal 10 and generates a random character table if the user name is correct,
When transmitting to the user terminal 10 and receiving a character string converted by the random character table from the user terminal, an administrator terminal that converts a password stored in advance into a character string, collates with the received character string, and performs authentication. 12 is provided.

The user terminal 10 has an input unit 14 for inputting a user name and a password, and a password extraction unit for extracting characters corresponding to the password from a random character table generated by a random character generation unit 22 of the administrator terminal 12. Part 16;
A data transmitting / receiving unit 18 for transmitting a user name and an extracted character string and receiving a random character table.

The administrator terminal 12 receives a user name and an extracted character string, and transmits a random character table generated by the random character generation unit 22 to a data transmitting / receiving unit 20. Each time the user name is received, a random number is transmitted. A random character generating unit 22 for generating a random character table by generating the extracted character string extracted by the password extracting unit 16 of the user terminal 10; and a user password and a random character stored in the password storage unit 26 in advance. A password collating unit for collating a character string extracted from the table;

Here, the random character table has no limitation on characters. For example, it is assumed that a plurality of 0s may be continuous. The random character table can be defined as an n-dimensional table, and the regularity can be changed every time. The present invention makes it possible to authenticate a user only by transmitting a character string that changes every time, instead of transmitting a password directly,
Prevent password theft and enable data confidentiality.

Next, the operation of the embodiment of the present invention will be described.
The user inputs a user name from the password input unit 14 of the user terminal 10 to perform authentication. The input user name is passed to the data transmission / reception unit 18 and transmitted to the administrator terminal 12.

The transmitted data is received by the data transmitting / receiving unit 20 of the manager terminal 12. When the data received by the data transmitting / receiving unit 20 is a user name, the random character generation unit 22 generates a random character table. The random character table is an n-dimensional array generated from random numbers. The generated random character table is transmitted from the data transmission / reception unit 20 to the user terminal 10.

The transmitted data is received by the data transmission / reception unit 18 of the user terminal 10. If the data received by the data transmitting / receiving unit 18 is a random character table, the user terminal 10 issues a password input instruction to the password input unit 14 and passes the random character table to the password extracting unit 16. The user inputs a password through the password input unit 14. The input password is passed to the password extracting unit 16. The password extraction unit 16 extracts a character string from the password input from the password input unit 14 and a random character table. The extracted character string is passed to the data transmission / reception unit 18 and transmitted to the administrator terminal 12.

The transmitted data is received by the data transmitting / receiving unit 20 of the administrator terminal 12. The data received by the data transmission / reception unit 20 is passed to the password verification unit 24.
The password matching unit 24 extracts a character string by using the random character table transmitted to the user terminal 10 and the password extracted from the password storage unit 26 in which the user password is stored in advance. The extracted character string is compared with the received character string. As a result of the collation, if they match, authentication success is transmitted. If they do not match, authentication failure is transmitted from the data transmitting / receiving unit 20 to the user terminal 10.

The transmitted data is received by the data transmission / reception unit 18 of the user terminal 10. If the data received by the data transmission / reception unit 18 is successful, the authentication is completed. If the authentication fails, the user is notified of a message indicating that the authentication has failed.

Next, as one embodiment, the random character table is 2
The operation of extracting a character string in the case of a dimensional array will be described.
Decompose one character of the password into a two-dimensional array of dots.
A character corresponding to the decomposed array is extracted from the random character table. The same processing is performed from the second character to n characters to create a series of character strings. The order of the sequence to be extracted is
Notify the user terminal in advance, or hand it over with the random character table.

[0021]

According to the password verification device of the present invention, the password is not directly passed from the user terminal to the administrator terminal.
Since the random character table changes for each use, it is impossible for a third party to eavesdrop on the password, so that security against unauthorized use is strengthened and confidentiality can be protected.

The random character table has no restriction on characters and changes for each password, so it is difficult to analyze even if line data is picked up.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of a password collation device of the present invention.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 10 User terminal 12 Administrator terminal 14 Password input part 16 Password extraction part 18 Data transmission / reception part 20 Data transmission / reception part 22 Random character generation part 24 Password collation part 26 Password storage part

Claims (6)

[Claims] A user terminal and an administrator terminal are provided, and when a connection is made from the user terminal to the administrator terminal, a password is sent from the user to check whether the user is a legitimate user. When transmitting, the password collating apparatus transmits a character string that changes every time the password is transmitted. 2. A random character table, which is a character table having no regularity, is obtained from the administrator terminal by a user inputting a name, and is converted by the random character table when the user inputs the password. A user terminal that transmits a character string, receives a name from the user terminal, generates a random character table when the name is a correct user name, transmits the table to the user terminal, 2. The system according to claim 1, further comprising: an administrator terminal that, when receiving the character string, converts the password of the user stored in advance into a character string, and checks and authenticates the received character string. Password verification device. 3. The user terminal according to claim 1, wherein the user terminal inputs a user name and a password, and a character corresponding to the password is extracted from a random character table generated from the administrator terminal to generate a character string. 3. The password verification device according to claim 2, further comprising: a password extracting unit that performs the transmission of the user name and the character string and a data transmitting and receiving unit that receives the random character table. 4. The administrator terminal receives a user name and a character string, transmits a random character table, and generates a random number each time the user name is received. A random character generation unit for generating a table, and a user name and a password, which are user information, are stored.
A password storage unit for temporarily storing the random character table, a character string extracted by the password extraction unit, and a user's password previously stored in the password storage unit and a character string extracted from the random character table The password matching device according to claim 3, further comprising: a password matching unit that matches the password. 5. A communication system comprising a user terminal and an administrator terminal, wherein when the user terminal accesses the administrator terminal, whether or not the connection from the user terminal is a correct access is determined by an encrypted password. In the password collating method for authentication, transmitting personal information of a user from the user terminal to the administrator terminal, the administrator terminal generates a random character table for converting the password, The user terminal converts the password into a first character string based on the random character table and transmits the first character string to the administrator terminal. The administrator terminal stores the password of the user stored in advance. Is converted into a second character string in the random character table, the first character string is compared with the second character string, and authentication is performed when they match with each other. . 6. The password matching method according to claim 5, wherein the personal information of the user is a name.