JP3914152B2 - Authentication server, authentication system, and authentication program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an authentication server, an authentication system, and an authentication program, for example.
[0002]
[Prior art]
Today, with the spread of Internet cafes with shared terminals that can be connected to the Internet and hotspots that serve as wireless communication access points, users can easily connect to the Internet regardless of location or time.
[0003]
2. Description of the Related Art Conventionally, an authentication system that allows a user to use network resources from a terminal after confirming the validity of the user has been proposed (see Patent Document 1). This authentication system uses a mobile phone number and password registered in advance as an authentication target, and a user obtains a temporary password by performing an authentication procedure from the mobile phone terminal to realize remote connection of a PC. is there.
[0004]
Conventionally, there has been proposed a login method that allows the terminal user to use the terminal even if the terminal user forgets his / her password (see Patent Document 2). This login method is a mechanism in which a password is requested from the portable terminal to the management server, the password is received by the portable terminal, and the password is used to log in at the client terminal.
[0005]
[Patent Document 1]
JP 2000-10927 (page 3-5, FIG. 1)
[Patent Document 2]
JP 2002-251376 (page 4-5, FIG. 1)
[0006]
[Problems to be solved by the invention]
Conventionally, when an unauthorized program is installed in a shared terminal or when the administrator himself / herself performs fraud, highly confidential information such as a password required for authentication is based on information entered by the user from the keyboard. There was a risk of leaking. For this reason, the shared terminal used in the Internet cafe has low reliability.
[0007]
In this Internet cafe, even if the communication information sent from the shared terminal is encrypted, the password information entered from the keyboard is plain text. The leak could not be prevented.
[0008]
In addition, recent browsers (for example, IE (Internet Explorer: a registered trademark of Microsoft Corporation)) have a function of storing ID and password information from the viewpoint of convenience. There was also a risk of leaking confidential information to a third party.
[0009]
Further, in the case of a hot spot using a wireless network, since a user own terminal is often used, fraud when inputting a password such as the Internet cafe described above is eliminated. Thereby, the reliability on the terminal side is increased. However, the section in which communication can be encrypted to maintain security is between the terminal and the base station. If the administrator of the base station cheats, it is difficult to prevent information such as passwords from leaking as in the Internet cafe.
[0010]
As a security measure for this hot spot, there is a case where a protocol for encrypting communication contents such as SSL (Secure Sockets Layer) is used for information transmitted from a base station. In this case, information such as a password can be prevented from leaking due to encryption. However, services that send password information in plain text such as POP (Post Office Protocol) and FTP (File Transfer Protocol) often communicate without encryption without using SSL, and password leakage is a problem. became.
[0011]
The object of the present invention is to use a highly reliable terminal in combination with a highly reliable terminal when there is a network service request from an unreliable terminal or an unreliable network. It is an object to provide an authentication server, an authentication system, and an authentication program that can use a network service that secures security.
[0012]
[Means for Solving the Problems]
In order to solve the above-described problems and achieve the object, the present invention is connected via a network to a temporary authentication terminal that requires confirmation authentication by another terminal and a confirmation authentication terminal that confirms temporary authentication by the temporary authentication terminal. An authentication server for authenticating the temporary authentication terminal, the storage means storing a set of user identifier and user authentication information for each user, a set of user identifier and user authentication information for temporary authentication, and a user identifier When the user authentication information and arbitrary code information are received from the terminal, if the received user identifier and user authentication information match the temporary authentication user identifier and user authentication information, it is determined that the request is a temporary authentication request. If they do not match, it is received when the determination means determines that the request is a confirmation authentication request, and when the determination means determines that the request is a temporary authentication request. Temporary authentication means for storing arbitrary code information and session information for uniquely identifying connection to the terminal in the storage means, and arbitrary code information received when the determination means determines a confirmation authentication request, Confirmation authentication means for confirming authentication by comparing the user identifier and user authentication information with the storage means, and the session corresponding to the received arbitrary code information on the condition that the matching match is confirmed by the confirmation authentication means And setting means for setting the connection indicated by the information to the authentication state.
[0013]
The present invention also provides a temporary authentication terminal that requires confirmation authentication by another terminal and an authentication server that is connected via a network to a confirmation authentication terminal that confirms temporary authentication by the temporary authentication terminal and performs authentication of the temporary authentication terminal. A storage means for storing a set of user identifiers and user authentication information for each user, a set of user identifiers and user authentication information for temporary authentication, and a case where the user identifier and user authentication information are received from the terminal If the received user identifier and user authentication information match the temporary authentication user identifier and user authentication information, it is determined that the request is a temporary authentication request; otherwise, it is determined that the request is a confirmation authentication request. And when the provisional authentication request is determined by the determination means, the arbitrary code information is generated, and the generated arbitrary code information is sent to the terminal. In addition, the temporary authentication unit that stores the arbitrary code information and the session information that uniquely identifies the connection to the terminal in the storage unit, and the confirmation authentication request received by the determination unit Confirmation authentication means for performing verification authentication by comparing the arbitrary code information, user identifier and user authentication information with the storage means, and arbitrary code received on the condition that the verification match is confirmed by the verification authentication means Setting means for setting the connection indicated by the session information corresponding to the information to an authenticated state.
[0017]
The present invention also includes a temporary authentication terminal that requires confirmation authentication by another terminal, a confirmation authentication terminal that confirms temporary authentication by the temporary authentication terminal, and the temporary authentication terminal and the confirmation authentication terminal connected via a network. And an authentication server that performs authentication of the temporary authentication terminal, wherein the authentication server includes a set of a user identifier and user authentication information for each user, and a set of a user identifier and user authentication information for temporary authentication. And when the user identifier, user authentication information, and arbitrary code information are received from the terminal, the received user identifier and user authentication information match the temporary authentication user identifier and user authentication information. If it is determined that the request is a temporary authentication request, and if the request does not match, the determination unit determines that the request is a confirmation authentication request, and the determination unit Therefore, when it is determined as a temporary authentication request, the temporary authentication means for storing the received arbitrary code information and the session information for uniquely identifying the connection to the terminal in the storage means, and the confirmation authentication request by the determination means If it is determined, the verification authentication means that performs verification authentication by comparing the received arbitrary code information, user identifier, and user authentication information with the storage means, and that the verification match is confirmed by the verification authentication means And setting means for setting the connection indicated by the session information corresponding to the received arbitrary code information to an authenticated state.
[0018]
The present invention also provides a temporary authentication terminal that requires confirmation authentication by another terminal and an authentication server that is connected via a network to a confirmation authentication terminal that confirms temporary authentication by the temporary authentication terminal and performs authentication of the temporary authentication terminal. A storage procedure for storing a set of user identifier and user authentication information for each user and a set of user identifier and user authentication information for temporary authentication in a storage unit, a user identifier, and a user When authentication information and arbitrary code information are received from the terminal, if the received user identifier and user authentication information match the temporary authentication user identifier and user authentication information, it is determined as a temporary authentication request; If they do not match, it is received when it is determined that the request is a confirmation authentication request and when it is determined as a temporary authentication request by the determination procedure. Temporary authentication procedure for storing arbitrary code information and session information for uniquely identifying connection to a terminal in the storage unit, and arbitrary code information received when it is determined as a confirmation authentication request by the determination procedure, Confirmation authentication procedure for confirming authentication by comparing the user identifier and user authentication information with the storage unit, and the session corresponding to the received arbitrary code information on the condition that the matching match is confirmed by the confirmation authentication procedure The computer is caused to execute a setting procedure for setting a connection indicated by information to an authenticated state.
[0019]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments according to the present invention will be described below in detail with reference to the accompanying drawings.
[0020]
(Embodiment 1)
First, the authentication system according to the first embodiment will be described with reference to FIG. FIG. 1 is a block diagram showing a configuration example of an authentication system according to an embodiment of the present invention. As shown in FIG. 1, for example, the authentication system according to the present embodiment is connected to a network 4 such as the Internet via a service provider 1, a mobile phone network 6 and the like, a mobile phone 61, a PC (personal computer) terminal 62, It has a configuration in which an Internet cafe 8, a hot spot 9, etc. are connected.
[0021]
For example, as shown in FIG. 1, the service provider 1 includes an authentication server 2 for authenticating a user who requests service provision, an application server 3 having an application for service provision, and the like. In FIG. 1, one service provider 1 is illustrated, but a configuration in which a plurality of service providers are connected to the network 4 according to the service may be used.
[0022]
In the first embodiment, for example, as shown in FIG. 1, a highly reliable terminal that can be directly connected to the network 4 by a user, such as a mobile phone 61 and a PC terminal 62, is one of the highly reliable terminal group 5. It is positioned as.
[0023]
In the first embodiment, for example, as shown in FIG. 1, a base station 91 disposed in the Internet cafe 8 and provided in the shared terminals 81, 82... And the hot spot 9 that can be shared by unspecified users. As described above, a facility that is likely to be leaked to a third party due to connection to the network 4 is positioned as a low-reliability facility 7. For example, by connecting a PC terminal 92, a notebook PC terminal 93, and the like to the base station 91, connection to the network 4 becomes possible.
[0024]
Next, the authentication server 2 will be described with reference to FIG. FIG. 2 is a block diagram showing a configuration example of the authentication server 2 according to the first embodiment of the present invention. As shown in FIG. 2, the authentication server 2 has a configuration in which a communication control device 22, a control device 23, an authentication information storage device 24, and the like are connected to the bus 21.
[0025]
The communication control device 22 is connected to, for example, the network 4 and the application server 3, and manages communication with the low reliability facility 7 and the high reliability terminal group 5 via the network 4.
[0026]
For example, as illustrated in FIG. 2, the control device 23 includes an authentication type determination unit 23 </ b> A that determines whether the type of authentication requested by the access source terminal is normal authentication, provisional authentication, or confirmation authentication. An authentication processing unit 23B that performs authentication processing according to the type and an authentication management unit 23C that manages information necessary for authentication are provided.
[0027]
For example, as shown in FIG. 2, the authentication information storage device 24 stores regular authentication information (a combination of an ID and a password) and temporary authentication information (for example, a combination of an ID and a password of NULL and NULL) assigned to each user. A registered ID / password correspondence table 24A, a one-time password / session correspondence table 24B that stores a one-time password that is arbitrary code information in association with a session, and a session authentication state management table 24C that stores a session authentication state I have.
[0028]
Here, “normal authentication” refers to authentication that does not require authentication at another terminal, which has been conventionally performed, and stores an ID and password transmitted from the terminal that is the access source to the authentication server 2 and authentication information. This is an authentication procedure for verifying with a regular ID and password assigned to each user registered in the ID / password correspondence table 24A of the device 24.
[0029]
“Temporary authentication” refers to an authentication start request in authentication using another terminal with high reliability. The ID and password transmitted from the terminal that is the access source to the authentication server 2 and the ID of the authentication information storage device 24 The session matches the one-time password transmitted from the terminal that has accessed the authentication server 2 when the collation result matches the temporary authentication information registered in the password correspondence table 24A (for example, both ID and password are NULL). This is an authentication procedure for storing the information together with the one-time password / session correspondence table 24B without duplication. As the temporary authentication terminal that performs the temporary authentication, a low-reliability terminal such as the low-reliability facility 7 or a low-reliability network is assumed.
[0030]
“Confirmation authentication” refers to a procedure for authenticating the previous temporary authentication with a highly reliable terminal, and is separated from the access source terminal (for example, the low-reliability equipment 7) through the temporary authentication described above. ID, password, and one-time password transmitted from the terminal in the ID / password correspondence table 24A and one-time password / session correspondence table 24B. As the confirmation authentication terminal for performing the confirmation authentication, a highly reliable terminal such as the highly reliable terminal group 5 is assumed.
[0031]
Here, with reference to FIG. 3, each table of the authentication information storage device 24 will be described in detail. FIG. 3 is a diagram for explaining a table according to the first embodiment. FIG. 3A shows an ID / password correspondence table 24A in which IDs and passwords are associated with each other, and FIG. 3B shows a one-time password / session correspondence in which one-time passwords and sessions are associated with each other. A table 24B is shown, and FIG. 10C shows a session authentication state management table 24C in which a session is associated with its state.
[0032]
In FIG. 3A, IDs and passwords of registered user names “Hanako”, “Taro”, and “Jiro” are shown as an example. For the user names “Hanako”, “Taro”, and “Jiro”, “hanako”, “taro”, “jiro” corresponding to the ID, and “123865”, “189625”, “134527” corresponding to the password, respectively. It is associated. The registered password is stored after being encrypted or hashed from the viewpoint of security, but is not particularly described for convenience of explanation.
[0033]
The ID / password correspondence table 24A is used in procedures for normal authentication, temporary authentication, and confirmation authentication. FIG. 3A includes a correspondence relationship of “NULL” as the ID of the user name “temporary authentication” and “NULL” as the password. The combination of ID and password indicating the correspondence relationship of “NULL” is referred to in the temporary authentication procedure. In the first embodiment, a NULL code is applied for temporary authentication, but a code other than NULL may be used.
[0034]
FIG. 3B shows, for example, “1”, “2”, “3” corresponding to a session for “Aiueo”, “Kakikukeko”, “Sashisuseso”, “GOOD” corresponding to a one-time password. , “4” are associated with each other and are used when determining which session the one-time password corresponds to. A record that is not accessed from any terminal for a certain period of time is automatically deleted.
[0035]
In FIG. 3C, for example, the sessions “1”, “2”, and “3” that can be authenticated are associated with the status being authenticated, and each session that can be authenticated is associated with each session. It is a table which manages the authentication state of.
[0036]
Next, the authentication server 2 described above will be described in detail. FIG. 4 is a block diagram functionally illustrating the authentication server 2 according to the first embodiment of the present invention. As shown in FIG. 4, the authentication server 2 functionally includes a received data processing unit 101, a received data determination unit 102, an authentication information analysis unit 103, a one-time password search / corresponding session registration processing unit 104, an ID / ID The configuration includes a session information search / authentication management unit 105, a one-time password search processing unit 106, and the like, and refers to the ID / password correspondence table 24A, the one-time password / session correspondence table 24B, and the session authentication state management table 24C.
[0037]
In FIG. 4, the received data processing unit 101 corresponds to the communication control device 22, and receives authentication information transmitted from an accessing terminal and session information for specifying a session established with the terminal. have. The reception data determination unit 102 corresponds to the authentication type determination unit 23A, and has a function of determining which authentication type the data received by the reception data processing unit 101 is based on and allocating the processing flow.
[0038]
Here, according to the determination result of the reception data determination unit 102, “normal authentication”, “confirmation authentication” (received data from another highly reliable terminal), “temporary authentication” (another highly reliable terminal is used in combination) Distribution to any one of the three authentication types (authentication start request).
[0039]
The data transmitted from the terminal includes an ID, a password, and a one-time password. If only the combination of ID and password exists in the received data, it is determined that the authentication type is normal authentication. If the received data includes an ID, a password, and a one-time password, and the ID and password are the temporary authentication ID and password, respectively, the authentication type is determined to be temporary authentication. If the received data includes an ID, a password, and a one-time password, and the ID and password are not the temporary authentication ID and password, respectively, the authentication type is determined to be confirmation authentication.
[0040]
Here, the ID / password correspondence table 24A is referred to in order to determine whether it is temporary authentication or confirmation authentication. The received data judgment unit 102 judges only whether the ID and password are the temporary authentication ID and password (see FIG. 3A), respectively. If it is not provisional authentication, a determination result of confirmation authentication is obtained.
[0041]
The authentication information analysis unit 103 functions in normal authentication and confirmation authentication, and corresponds to the authentication processing unit 23B. This authentication information analysis unit 103 confirms the validity of the user based on, for example, the collation of the ID / password combination passed as an argument and the ID / password combination for each user registered in the ID / password correspondence table 24A. It has a processing function.
[0042]
The one-time password search / corresponding session registration processing unit 104 functions in provisional authentication and corresponds to the authentication management unit 23C. This one-time password search / corresponding session registration processing unit 104 fetches the one-time password and session information indicating connection with the terminal from the received data determination unit 102, and refers to the one-time password / session correspondence table 24B. If the passwords do not overlap, it has a function of registering the one-time password and session information in association with each other.
[0043]
The ID / session information search / authentication management unit 105 functions in confirmation authentication and corresponds to the authentication management unit 23C. The ID / session information search / authentication management unit 105 refers to the ID / password correspondence table 24A through the authentication information analysis unit 103, collates the combination of the ID and password captured from the received data determination unit 102, and checks the validity of the user. It has the function to judge.
[0044]
The one-time password search processing unit 106 functions in confirmation authentication and corresponds to the authentication management unit 23C. The one-time password search processing unit 106 obtains a valid authentication result from the ID / session information search / authentication management unit 105, and then refers to the one-time password / session correspondence table 24B to capture the one-time password fetched from the received data determination unit 102. It has a function of collating passwords, and a function of managing information on a session that can be authenticated as a result of confirmation authentication using the session authentication state management table 24C.
[0045]
Next, an authentication procedure according to the first embodiment will be described with reference to FIGS. FIG. 5 is a diagram for explaining screen transition at the time of authentication according to the first embodiment of the present invention, and FIGS. 6 to 11 are flowcharts for explaining the operation according to the first embodiment of the present invention. The operation here is processing based on an authentication program stored in the control device 23 of the authentication server 2. The authentication program may be stored in the ROM, or may be downloaded via the network 4 or installed from a recording medium such as a CD-ROM or DVD-ROM.
[0046]
The authentication server 2 can be accessed from any terminal or facility. First, with reference to FIG. 5 and FIG. 6, processing from the access to the authentication server from the terminal and the determination of the authentication type will be described. In the authentication system shown in FIG. 1, a connection for establishing a session is made in response to a user operation from a certain terminal to the authentication server 2 (step S11). The authentication server 2 responds to the connection request by communication (step S21), and a TCP (Transmission Control Protocol) connection is established (step S12). That is, a three-way handshake is performed.
[0047]
After the session is established, an authentication screen is transmitted from the authentication server 2 to the access source terminal (step S22), and the ID, password, and one-time password are input at the terminal as shown in FIG. A screen for doing this is displayed (step S13).
[0048]
Next, authentication information is input from the terminal by a user operation, and the input authentication information is transmitted to the authentication server 2 (step S14). Here, in the case of normal authentication, it is assumed that only an ID and a password are input. In the case of temporary authentication, it is assumed that an ID, a password, and an arbitrary one-time password for temporary authentication are input. In the case of confirmation authentication, it is assumed that a regular ID, a password, and a one-time password input at the time of temporary authentication are input.
[0049]
The authentication server 2 receives the authentication information transmitted from the terminal (step S23), and determines the type of authentication (step S24). Here, the determination of the type of authentication information in step S24 will be described.
[0050]
In step S14, when the authentication information transmitted from the terminal is only an ID and a password, it is determined that the request is a normal authentication request from the normal authentication terminal, and thereafter, normal processing described later between the authentication server 2 and the terminal is performed. Processing according to authentication is executed (see FIGS. 7 and 8).
[0051]
If the authentication information transmitted from the terminal is an ID, password, or one-time password in step S14, the ID / password correspondence table 24A of the authentication server 2 is referred to, and whether the received ID and password are for temporary authentication. A search for whether is done. In the case of the temporary authentication ID and password, it is determined as a temporary authentication request from the temporary authentication terminal, and processing corresponding to temporary authentication described later is executed between the authentication server 2 and the terminal (FIG. 9). And FIG. 10).
[0052]
If the authentication information transmitted from the terminal is an ID, password, or one-time password in step S14, the ID / password correspondence table 24A of the authentication server 2 is referred to, and whether the received ID and password are for temporary authentication. A search for whether is done. If it is not the temporary authentication ID and password, it is determined as a confirmation authentication request from the confirmation authentication terminal, and processing corresponding to confirmation authentication described later is executed between the authentication server 2 and the terminal (see FIG. 11). ).
[0053]
Next, normal authentication will be described in detail with reference to FIGS. Here, description will be made assuming that the PC terminal 62 is used as a normal authentication terminal used for normal authentication. If it is determined in FIG. 6 that the authentication type is normal authentication, the authentication server 2 determines whether there is an ID / password combination that matches the received ID / password combination. A process of referring to and collating is executed (step S41). In the first embodiment, the ID and password can be re-input only once, and the number of verifications is stored.
[0054]
If the matching results match (YES route in step S42), the process proceeds to step S48. On the other hand, if they do not match (NO route in step S42), the process proceeds to step S43.
[0055]
If they do not match, it is first determined whether the number of collations is the second. If the number of collations is the second time (YES route of step S43), a process of releasing the connection with the PC terminal 62 that is the access source terminal is executed (step S44), and this process ends. If the number of collations is the first time (NO route of step S43), a re-input request is transmitted to the PC terminal 62 in order to give the PC terminal 62 a chance of re-input (step S45). At this time, the screen displayed on the display unit of the PC terminal 62 may be configured to input only an ID and a password.
[0056]
When the re-input request is transmitted from the authentication server 2, the re-input request is accepted on the terminal side as shown in FIG. 8 (step S51). When the ID and password are re-input according to the user's operation and re-transmission is instructed, the re-input ID and password are transmitted to the authentication server 2 (step S52).
[0057]
In the authentication server 2, in order to allow a re-input for a certain period of time, after the re-input request is transmitted, the time count is started (step S46), and the presence or absence of re-reception is confirmed until time-out (NO route of step S47) And NO route of step S48). Here, when the time-out is confirmed (YES route in step S48), the connection is released in step S44, and this process ends.
[0058]
If the authentication information (ID, password) can be received again within a certain time without timing out (YES route of step S47), the process returns to step S41 and the above-described process is repeated. Note that the number of re-inputs appropriate for the authentication system is not limited to two.
[0059]
If a collation match is obtained in step S42 (YES route), the TCP connection of the accessing terminal is set to the authentication state, and the session information of the terminal is registered in the session authentication state management table 24C as authenticable session information. Is executed (step S48).
[0060]
When normal authentication is completed in this way, a notification of normal authentication completion is transmitted from the authentication server 2 to the PC terminal 62 (step S49), and the PC terminal 62 receives a notification of normal authentication completion (step S31). At the time of receipt, as shown in FIG. 5B, for example, a message “Normal authentication completed” is displayed on the display unit D3 of the PC terminal 62. As a result, the user can visually confirm the normal authentication completion message.
[0061]
After receiving the normal authentication completion, when a service request is transmitted according to the user's operation (step S32), the authentication server 2 starts the process of providing the service (step S50).
[0062]
Next, the temporary authentication will be described in detail with reference to FIGS. 9 and 10. Here, description will be made assuming that the shared terminal 81 is used as a temporary authentication terminal used for temporary authentication. When it is determined in FIG. 6 that the authentication type is provisional authentication, the authentication server 2 refers to the one-time password / session correspondence table 24B to determine whether there is a one-time password that overlaps the received one-time password. The process of collating is executed (step S61). In the first embodiment, it is assumed that the one-time password can be re-input only once and the number of verifications is stored.
[0063]
If there is no duplication of one-time passwords (NO route of step S62), the process proceeds to step S69. If there is any duplication (YES route of step S62), the process proceeds to step S63.
[0064]
If there is an overlap, it is first determined whether or not the number of collations is the second. If the number of collations is the second time (YES route in step S63), a process for releasing the connection with the shared terminal 81 that is the access source terminal is executed (step S64), and this process ends. If the number of collations is the first time (NO route in step S63), a request for re-input is transmitted to the shared terminal 81 (step S65). At this time, the screen displayed on the display unit D1 of the shared terminal 81 may have a configuration for inputting only the one-time password as shown in FIG.
[0065]
When the re-input request is transmitted from the authentication server 2, as shown in FIG. 10, the shared terminal 81 accepts the re-input request (step S72). When the one-time password is re-input according to the user's operation and re-transmission is instructed, the re-input one-time password is transmitted to the authentication server 2 (step S73).
[0066]
In the authentication server 2, in order to allow a re-input for a certain period of time, after the re-input request is transmitted, the time count is started (step S66), and the presence / absence of re-reception is confirmed until time-out (NO route of step S67) And NO route of step S68). Here, when the time-out is confirmed (YES route in step S68), the connection is released in step S64, and this process ends.
[0067]
If the one-time password can be received again within a certain time without timing out (YES route of step S67), the process returns to step S61 and the above-described process is repeated. Note that the number of re-inputs appropriate for the authentication system is not limited to two.
[0068]
If there is no duplication of the one-time password in step S62 (NO route), the session information indicating the connection with the shared terminal 81 accessed as temporary authentication and the received one-time password are associated with each other. Processing to be added and stored in the session information correspondence table 24B is executed (step S69).
[0069]
When temporary authentication is completed in this way, a notification of completion of temporary authentication is transmitted from the authentication server 2 to the shared terminal 81 (step S70), and the notification of completion of temporary authentication is received at the shared terminal 81 (step S71). At the time of receipt, as shown in FIG. 5D, for example, a message “Temporary authentication completed. Please confirm and authenticate at another terminal.” Is displayed on the display unit D1 of the shared terminal 81. . As a result, the user can visually confirm the temporary authentication completion message.
[0070]
Next, confirmation authentication will be described in detail with reference to FIG. Here, description will be made assuming that the mobile phone 61 is used as a confirmation authentication terminal used for confirmation authentication. When it is determined in FIG. 6 that the authentication type is confirmation authentication, the authentication server 2 determines that the combination of ID and password that matches the combination of ID and password received from the mobile phone 61 that is the access source terminal. A process of collating with reference to the ID / password correspondence table 24A is executed (step S91). In the first embodiment, the ID and password can be re-input only once, and the number of verifications is stored.
[0071]
If the matching results match (YES route in step S92), the process proceeds to step S99. On the other hand, if they do not match (NO route in step S92), the process proceeds to step S93.
[0072]
If they do not match, it is first determined whether the number of collations is the second. If the number of collations is the second time (YES route of step S93), a process of releasing the connection with the mobile phone 61 that is the access source terminal is executed (step S98), and this process ends. If the number of collations is the first time (NO route in step S93), a request for re-input is transmitted to the mobile phone 61 (step S94). At this time, the screen displayed on the display unit 62 of the mobile phone 61 may be configured to input only an ID and a password.
[0073]
In this case, in order to give a certain time to re-input, after issuing the re-input request, the time count is started (step S95), and the presence or absence of re-reception is confirmed until time-out (NO route of step S96) And NO route of step S97). Here, when the time-out is confirmed (YES route in step S97), the connection is released in step S98, and this process ends.
[0074]
If the authentication information (ID, password) can be received again within a certain time without timing out (YES route in step S96), the process returns to step S91 and the above-described process is repeated. Note that the number of re-inputs appropriate for the authentication system is not limited to two. Here, the re-input process of the ID and password is the same as the description of FIG.
[0075]
After the ID and password are verified, a process of checking whether there is a one-time password that matches the one-time password received from the mobile phone 61 that is the access source terminal with reference to the one-time password / session correspondence table 24B Is executed (step S99). In the first embodiment, it is assumed that the one-time password can be re-input only once and the number of verifications is stored.
[0076]
If the matching results match (YES route in step S100), the process proceeds to step S106. On the other hand, if they do not match (NO route in step S100), the process proceeds to step S101.
[0077]
If they do not match, it is first determined whether the number of collations is the second. If the number of collations is the second time (YES route in step S101), a process of releasing the connection with the mobile phone 61 that is the access source terminal is executed (step S98), and this process ends. If the number of collations is the first (NO route in step S101), a re-input request is transmitted to the mobile phone 61 (step S102).
[0078]
In this case, in order to give a certain time to re-input, the time count is started after the re-input request is transmitted (step S103), and the presence or absence of re-reception is confirmed until time-out (NO route of step S104) And NO route of step S105). Here, when the timeout is confirmed (YES route in step S105), the connection is released in step S98, and this process ends.
[0079]
If the one-time password can be re-received within a certain time without timing out (YES route in step S104), the process returns to step S99 and the above-described process is repeated. Note that the number of re-inputs appropriate for the authentication system is not limited to two. Here, the re-input processing of the ID and password is the same as that described above with reference to FIG.
[0080]
In step S100, if a one-time password verification match is obtained (YES route), the corresponding session information is read from the one-time password / session correspondence table 24B, and the TCP connection is set to the authenticated state for the session. The process is executed (step 106). That is, the shared terminal 81 that has been provisionally authenticated first enters the authentication state. Further, the session information is registered in the session authentication state management table 24C as authenticable session information, and at the same time, a process of deleting the combination of the one-time password and session information from the one-time password / session information correspondence table 24B is executed ( Step 107).
[0081]
When the confirmation authentication is completed in this way, a confirmation authentication completion notification is transmitted from the authentication server 2 to the mobile phone 61 (step S108), and the mobile phone 61 receives a confirmation authentication completion notification (step S81). At the time of this reception, as shown in FIG. 5E, for example, a message “Authenticated. Temporary authentication terminal can be used.” Is displayed on the display unit D2 of the mobile phone 61. As a result, the user can visually confirm the confirmation and authentication completion message.
[0082]
After the confirmation authentication is notified to the mobile phone 61, when a service request is transmitted from the shared terminal 81 to the authentication server 2 according to the user's operation (step S82), the authentication server 2 sends the request to the shared terminal 81. Processing for providing a service is started (step S109). Note that the order of steps S91 and S99 may be reversed.
[0083]
As described above, according to the first embodiment, when there is a network service request from a low-reliability terminal or a low-reliability network, the reliability can be improved by using another high-reliability terminal together. It is possible to use a network service that ensures security even on a low terminal or a low-reliability network.
[0084]
That is, in the low-reliability equipment 7, the user can use the network service with peace of mind by a mechanism capable of performing the authentication procedure without inputting or transmitting confidential information such as a regular password. It is possible. For example, although the user feels that the facilities such as the Internet cafe 8 and the hot spot 9 are convenient, the user is worried about the leakage of the regular password, but according to the present embodiment, the use of the above facilities has been refrained so far. It is possible to create an environment that can be used with peace of mind by users.
[0085]
Specifically, when using the network service with the low-reliability equipment 7, since the authentication is performed using the high-reliability terminal, it is proper for the low-reliability terminal and the low-reliability network. There is no need to input and transmit confidential information such as passwords. In this way, it is possible to safely follow the authentication procedure.
[0086]
In the authentication server 2, only an ID and password as regular authentication information necessary for a legitimate user to use a network service and information for identifying temporary authentication need be registered in advance. There is no need to register information other than passwords in advance. That is, since it is not necessary to register information such as the telephone number and mail address of the highly reliable terminal in advance in the authentication server, security is ensured by performing the authentication procedure using the highly reliable terminal.
[0087]
Furthermore, when using a network service by directly using a terminal belonging to the high-reliability terminal group 5 such as a terminal installed at a user's home, an ID registered in advance in the authentication server from the terminal at the home, You only need to send a password, which completes the authentication. In this case, the troublesome trouble of generating a one-time password for the user is omitted, and the processing load on the authentication server 2 can be reduced.
[0088]
And since authentication is not performed for IP addresses or one-time passwords but for existing established connections, if the user terminates the use of the network service, the termination is performed. It is possible to automatically reset the authentication state in response to.
[0089]
Conventionally, when exchanging information such as a password using a mobile phone before establishing a connection, if a one-time password is stolen by a third party, it is malicious before a legitimate user connects. The third party may use the one-time password. In this case, there is a risk that a third party impersonates the person, but this problem can be solved by the first embodiment. That is, this is because the connection from the high reliability terminal (for example, the mobile phone 61) to the authentication server 2 is performed after the session between the low reliability facility 7 (for example, the shared terminal 81) and the authentication server 2 is established. Therefore, the connection of a malicious third party does not precede the legitimate user.
[0090]
(Embodiment 2)
In the first embodiment, the procedure is shifted to normal authentication, temporary authentication, or confirmation authentication by a combination of input of ID, password, and one-time password on the initial screen provided to the terminal side. The present invention is not limited to this, and options for normal authentication, temporary authentication, and confirmation authentication are given from the initial screen to a terminal that accesses the authentication server, and normal authentication and temporary authentication are performed according to the user's selection. Alternatively, the procedure may be advanced to confirmation authentication.
[0091]
Here, in order to show the difference with the authentication server 2 of Embodiment 1 mentioned above, a screen transition and the process procedure accompanying the screen transition are demonstrated. FIG. 12 is a diagram for explaining screen transition at the time of authentication according to the second embodiment of the present invention, and FIG. 13 is a flowchart for explaining an operation according to the second embodiment. Also in this description, the PC terminal 62 is used as a normal authentication terminal used for normal authentication, the shared terminal 81 is used as a temporary authentication terminal used for temporary authentication, and the mobile phone 61 is used as a confirmation authentication terminal used for confirmation authentication. It will be explained as a thing.
[0092]
As in the first embodiment described above, after the session is established (step S112, step S121) by accessing the authentication server from the terminal (step S111), the authentication server requests the terminal to select the authentication type. The screen information for doing so is transmitted (step S122).
[0093]
In this case, screen information for selecting normal authentication, temporary authentication, and confirmation authentication is transmitted from the authentication server to the access source terminal and displayed on the display unit of the terminal as shown in FIG. The
[0094]
First, a case where normal authentication is selected will be described. In this case, access from the PC terminal 62 is taken as an example. In the display state shown in FIG. 12A, the normal authentication check box CH1 is selected by the user operating the PC terminal 62 (step S113), and when the transmission instruction is operated, the terminal selects the authentication server. Information indicating normal authentication is transmitted (step S114).
[0095]
In the authentication server, the type selected by the PC terminal 62 is determined (step S124), and screen information that prompts the PC terminal 62 to input authentication information is transmitted (step S125). Then, as shown in FIG. 12B, a screen for inputting the ID and password is displayed on the display unit D3 of the PC terminal 62.
[0096]
An ID and a password are input from a user operating the PC terminal 62 (step S116), and when a transmission instruction is operated, the ID and password input from the PC terminal 62 to the authentication server are transmitted (step S117). ). The authentication server performs normal authentication based on the ID and password received from the PC terminal 62 (step S126). Thereafter, processing according to normal authentication is executed between the authentication server and the PC terminal 62 as in the first embodiment described above (see FIGS. 7 and 8).
[0097]
Next, a case where temporary authentication is selected will be described. In this case, an access from the shared terminal 81 is taken as an example of an unreliable terminal or an unreliable network. In the display state shown in FIG. 12A, the user who operates the shared terminal 81 selects the temporary authentication check box CH2 (step S113), and when the transmission instruction is operated, the shared terminal 81 selects the authentication server. Information indicating the provisional authentication is transmitted (step S114).
[0098]
In this case, since the authentication server determines that the selection type is provisional authentication (step S124), screen information that prompts the shared terminal 81 to input a one-time password is transmitted from the authentication server (step S125). ). In this case, as shown in FIG. 12C, a screen for inputting the one-time password is displayed on the display unit D1 of the shared terminal 81 (step S115).
[0099]
When a one-time password is input from a user operating shared terminal 81 (step S116) and a transmission instruction is operated, the one-time password input from shared terminal 81 to the authentication server is transmitted (step S117). Thereafter, processing according to provisional authentication is executed between the authentication server and the shared terminal 81 as in the first embodiment described above (see FIGS. 9 and 10).
[0100]
Next, a case where confirmation authentication is selected will be described. In this case, access from the mobile phone 61 is taken as an example of a highly reliable terminal. In the display state shown in FIG. 12A, when the check / authentication check box CH3 is selected by the user operating the mobile phone 61 (step S113) and the transmission instruction is operated, the mobile phone 61 sends an authentication server to the authentication server. Information indicating the confirmation authentication selected in step S114 is transmitted.
[0101]
In this case, since the authentication server determines that the selection type is confirmation authentication (step S124), the authentication server transmits screen information that prompts the mobile phone 61 to input an ID, password, and one-time password. (Step S125). In this case, as shown in FIG. 12D, a screen for inputting the ID, password, and one-time password is displayed on the display unit D2 (step S115).
[0102]
An ID, password, and one-time password are respectively input from the user operating the mobile phone 61 (step S116), and when a transmission instruction is operated, the ID, password, and one-time input from the mobile phone 61 to the authentication server. The password is transmitted as information necessary for confirmation authentication (step S117). Thereafter, processing corresponding to confirmation authentication is executed between the authentication server, the PC terminal 62, and the mobile phone 61 as in the first embodiment (see FIG. 11).
[0103]
In this way, in the second embodiment, the type of authentication can be selected on the initial screen on the terminal side, so it is determined whether or not provisional authentication is performed in the table corresponding to the ID / password correspondence table 24A of the first embodiment described above. This eliminates the need to register temporary authentication information for this purpose.
[0104]
(Embodiment 3)
In the first and second embodiments described above, the one-time password is transmitted from the terminal side to the authentication server. However, the present invention is not limited to this, and temporary authentication is performed. Alternatively, the authentication server may generate a one-time password, transmit it to the low-reliability equipment, and input it from the high-reliability terminal during confirmation authentication.
[0105]
Here, in order to show the difference with the authentication server 2 of Embodiment 1 mentioned above, a screen transition and the process procedure accompanying the screen transition are demonstrated. FIG. 14 is a diagram for explaining an example of a display screen according to the third embodiment of the present invention, and FIG. 15 is a flowchart for explaining main operations on the authentication server side according to the third embodiment. Also in this description, the PC terminal 62 is used as a normal authentication terminal used for normal authentication, the shared terminal 81 is used as a temporary authentication terminal used for temporary authentication, and the mobile phone 61 is used as a confirmation authentication terminal used for confirmation authentication. It will be explained as a thing.
[0106]
When this third embodiment is applied to the pattern of the first embodiment described above, an initial screen for the terminal is displayed with an input screen for ID, password, and one-time password as shown in FIG. . At this time, when there is no input of a one-time password and the ID and password are transmitted as temporary authentication information from the shared terminal 81 to the authentication server, in the authentication server as in the first embodiment described above. A temporary authentication procedure is started. Here, the processing shifts to processing for preparing an arbitrary one-time password on the authentication server side.
[0107]
Then, in the authentication server, as shown in FIG. 15, a process of randomly generating a non-overlapping one-time password by applying a random number or the like is executed with reference to the above-mentioned one-time password / session correspondence table 24B. (Step S131). The one-time password generated in this way is transmitted from the authentication server to the shared terminal 81 (step S132).
[0108]
Then, as shown in FIG. 14, the one-time password arbitrarily generated by the authentication server is presented to the shared terminal 81. At the time of this presentation, an icon asking whether or not the confirmation has been made may be displayed on the shared terminal 81, and it may be handled as a valid one-time password only after the user confirms the icon.
[0109]
In this case, the user inputs and uses the one-time password presented from the shared terminal 81 when confirming and authenticating from the mobile phone 61. This confirmation authentication procedure is performed by inputting all of the ID, password, and one-time password on the initial screen on the terminal side, and is omitted here because it is the same as in the first embodiment.
[0110]
Further, when the third embodiment is applied to the pattern of the second embodiment, a one-time password is presented to the terminal as shown in FIG. 14 by selecting temporary authentication on the initial screen. become.
[0111]
(Embodiment 4)
In the first embodiment described above, the high-reliability terminal group 5 has a mechanism for accessing the authentication server in order to perform verification authentication by itself. However, the present invention is not limited to this. By transmitting information for identifying a terminal such as a mail address of the high-reliability terminal group 5 that performs confirmation and authentication from the low-reliability equipment 7 to the authentication server, the authentication server sends the information to the high-reliability terminal group 5 for confirmation authentication. URL (Uniform Resource
Address information such as (Locator) may be transmitted.
[0112]
Here, in order to show the difference with the authentication server 2 of Embodiment 1 mentioned above, a screen transition and the process procedure accompanying the screen transition are demonstrated. FIG. 16 is a diagram for explaining a part of screen transition according to the fourth embodiment of the present invention, and FIG. 17 is a flowchart for explaining main operations according to the fourth embodiment. Also in this description, the PC terminal 62 is used as a normal authentication terminal used for normal authentication, the shared terminal 81 is used as a temporary authentication terminal used for temporary authentication, and the mobile phone 61 is used as a confirmation authentication terminal used for confirmation authentication. It will be explained as a thing.
[0113]
In the fourth embodiment, after provisional authentication, it is necessary to input from the shared terminal 81 a mail address for accessing the mobile phone 61 which is a highly reliable terminal used when the user performs confirmation authentication. Therefore, the display screen after provisional authentication in the shared terminal 81 may have a screen configuration for inputting a mail address that is destination information of a terminal to be confirmed and authenticated, as shown in FIG. This display screen is transmitted from the authentication server to the shared terminal 81.
[0114]
When a mail address is input in the shared terminal 81 and the mail address is transmitted to the authentication server, a URL for confirmation and authentication is transmitted from the authentication server to the mobile phone 61 by e-mail, for example. In this case, as shown in FIG. 16B, information including a URL for confirmation and authentication is displayed on the mobile phone 61. When a URL displayed on the display unit D2 of the mobile phone 61 is clicked by a user operation, a display screen is formed on the display unit D2 as shown in FIG. 12D, for example.
[0115]
The fourth embodiment will be described with reference to FIG. After the temporary authentication, the authentication server executes a process for requesting the shared terminal 81 for the mail address of the terminal for confirmation authentication (step S151). In this case, screen information for displaying and displaying the screen shown in FIG. 16A is transmitted from the authentication server to the shared terminal 81 and displayed on the shared terminal 81 (step S141).
[0116]
When a mail address is input by a user operation (step S142), the input mail address is transmitted to the authentication server (step S143). In this way, the e-mail address reaches the authentication server, and the e-mail address is retained for a certain period (step S152).
[0117]
When the screen information including the URL for confirmation and authentication is sent to the mail address held in step S152 (step S153), the mobile phone 61 receives the mail, as shown in FIG. 16B. A screen based on the screen information is formed on the display unit D2 (step S161). Thereafter, the same processing as in FIG. 11 described above is performed.
[0118]
【The invention's effect】
As described above, according to the present invention, when there is a network service request from a low-reliability terminal or a low-reliability network, a low-reliability terminal or a reliability can be obtained by using a high-reliability terminal together. It is possible to provide an authentication server, an authentication system, and an authentication program that can use a network service that ensures security even in a low-performance network.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration example of an authentication system according to a first embodiment of the present invention.
FIG. 2 is a block diagram showing a configuration example of an authentication server according to the first embodiment of the present invention.
FIG. 3 is a diagram illustrating a table according to the first embodiment of the present invention.
FIG. 4 is a block diagram functionally illustrating an authentication server according to Embodiment 1 of the present invention.
FIG. 5 is a diagram illustrating screen transition according to the first embodiment of the present invention.
FIG. 6 is a flowchart illustrating an operation according to the first embodiment of the present invention.
FIG. 7 is a flowchart illustrating an operation according to the first embodiment of the present invention.
FIG. 8 is a flowchart illustrating an operation according to the first embodiment of the present invention.
FIG. 9 is a flowchart illustrating an operation according to the first embodiment of the present invention.
FIG. 10 is a flowchart illustrating an operation according to the first embodiment of the present invention.
FIG. 11 is a flowchart illustrating an operation according to the first embodiment of the present invention.
FIG. 12 is a diagram illustrating screen transition at the time of authentication according to the second embodiment of the present invention.
FIG. 13 is a flowchart illustrating an operation according to the second embodiment of the present invention.
FIG. 14 is a diagram illustrating an example of a display screen according to a third embodiment of the present invention.
FIG. 15 is a flowchart illustrating main operations on the authentication server side according to the third embodiment of the present invention.
FIG. 16 is a diagram illustrating a part of screen transition according to the fourth embodiment of the present invention.
FIG. 17 is a flowchart illustrating main operations according to Embodiment 4 of the present invention.
[Explanation of symbols]
2 Authentication server
3 Application server
4 network
5 Highly reliable terminals
6 Mobile phone network
21 Bus
22 Communication control device
23 Control device
23A Authentication type determination unit
23B Authentication processing section
23C Authentication Management Department
24 Authentication information storage device
24A ID / password correspondence table
24B one-time password / session correspondence table
24C session authentication status management table
61 Mobile phone
62 PC terminal
81,82 shared terminal
91 base station
92 PC terminal
93 Notebook PC terminal
101 Received data processing section
102 Received data judgment unit
103 Authentication information analysis unit
104 One-time password search / corresponding session registration processing part
105 ID / Session Information Search / Authentication Management Department
106 One-time password search processor

Claims (5)

An authentication server that is connected via a network to a temporary authentication terminal that requires confirmation authentication by another terminal and a verification authentication terminal that confirms temporary authentication by the temporary authentication terminal, and performs authentication of the temporary authentication terminal,
  Storage means for storing a set of user identifier and user authentication information for each user and a set of user identifier and user authentication information for temporary authentication;
  When a user identifier, user authentication information, and arbitrary code information are received from the terminal, if the received user identifier and user authentication information match the temporary authentication user identifier and user authentication information, the request is a temporary authentication request. Determining means for determining that it is a confirmation authentication request if they do not match,
  Temporary authentication means for storing the received arbitrary code information and session information for uniquely identifying the connection to the terminal in the storage means when the determination means determines that it is a temporary authentication request;
  A confirmation authentication unit that performs verification authentication by comparing the received arbitrary code information, user identifier, and user authentication information with the storage unit when the determination unit determines that it is a confirmation authentication request;
  Setting means for setting the connection pointed to by the session information corresponding to the received arbitrary code information to be in an authenticated state on the condition that the verification match is confirmed by the confirmation authentication means
  An authentication server comprising: An authentication server that is connected via a network to a temporary authentication terminal that requires confirmation authentication by another terminal and a verification authentication terminal that confirms temporary authentication by the temporary authentication terminal, and performs authentication of the temporary authentication terminal,
  Storage means for storing a set of user identifier and user authentication information for each user and a set of user identifier and user authentication information for temporary authentication;
  When the user identifier and the user authentication information are received from the terminal, if the received user identifier and the user authentication information match the temporary authentication user identifier and the user authentication information, it is determined that the request is a temporary authentication request. Otherwise, a determination means for determining that the request is a confirmation authentication request,
  When the determination means determines that it is a temporary authentication request, it generates arbitrary code information, transmits the generated arbitrary code information to the terminal, and uniquely identifies the arbitrary code information and connection to the terminal Temporary authentication means for storing session information to be stored in the storage means;
  A confirmation authentication unit that performs verification authentication by comparing the received arbitrary code information, user identifier, and user authentication information with the storage unit when the determination unit determines that it is a confirmation authentication request;
  Setting means for setting the connection pointed to by the session information corresponding to the received arbitrary code information to be in an authenticated state on the condition that the verification match is confirmed by the confirmation authentication means
  An authentication server comprising: After the temporary authentication means causes the temporary authentication terminal to wait for confirmation authentication, the temporary authentication terminal requests destination information of the confirmation authentication terminal from the temporary authentication terminal, and sends the request to the confirmation authentication terminal indicated by the received destination information. 3. The authentication server according to claim 1, further comprising notification means for notifying address information. A temporary authentication terminal that requires confirmation authentication by another terminal, a confirmation authentication terminal that confirms the temporary authentication by the temporary authentication terminal, and the temporary authentication terminal and the confirmation authentication terminal that are connected to each other via a network. An authentication system having an authentication server for performing authentication,
  The authentication server is
  Storage means for storing a set of user identifier and user authentication information for each user and a set of user identifier and user authentication information for temporary authentication;
  When the user identifier, user authentication information, and arbitrary code information are received from the terminal, the received user identifier and user authentication information are used for the temporary authentication user identifier and user authentication. Determining means for determining that it is a temporary authentication request if it matches the certificate information, and determining that it is a confirmation authentication request if not matching;
  Temporary authentication means for storing the received arbitrary code information and session information for uniquely identifying the connection to the terminal in the storage means when the determination means determines that it is a temporary authentication request;
  A confirmation authentication unit that performs verification authentication by comparing the received arbitrary code information, user identifier, and user authentication information with the storage unit when the determination unit determines that it is a confirmation authentication request;
  Setting means for setting the connection pointed to by the session information corresponding to the received arbitrary code information to be in an authenticated state on the condition that the verification match is confirmed by the confirmation authentication means
  An authentication system characterized by comprising: A temporary authentication terminal that requires confirmation authentication by another terminal and an authentication program that is connected to a confirmation authentication terminal that confirms temporary authentication by the temporary authentication terminal via a network and that is installed in an authentication server that authenticates the temporary authentication terminal Because
  A storage procedure for storing a set of a user identifier and user authentication information for each user and a set of a user identifier and user authentication information for temporary authentication in a storage unit;
  When a user identifier, user authentication information, and arbitrary code information are received from the terminal, if the received user identifier and user authentication information match the temporary authentication user identifier and user authentication information, a temporary authentication request is issued. If it does not match, the determination procedure for determining that it is a confirmation authentication request,
  A temporary authentication procedure for storing the received arbitrary code information and session information for uniquely identifying the connection to the terminal in the storage unit when it is determined as a temporary authentication request by the determination procedure;
  A confirmation authentication procedure for performing confirmation authentication by comparing the received arbitrary code information, user identifier and user authentication information with the storage unit when it is determined as a confirmation authentication request by the determination procedure;
  A setting procedure for setting the connection pointed to by the session information corresponding to the received arbitrary code information to the authentication state on the condition that the matching match is confirmed by the confirmation authentication procedure;
  An authentication program for causing a computer to execute.

Images