JPH10260939A - Computer network client machine authentication method, client machine, host machine and computer system - Google Patents

Abstract

(57) [Summary] [PROBLEMS] In personal computer communication, an authentication method is adopted to secure security. But the user
In the conventional authentication method using only the ID and the password, the password uses an easily identifiable number such as the user's birthday, or the user writes down the password and puts it on the monitor. There was a problem that the authentication function was not sufficient because of many problems in password management. SOLUTION: User database 10 on host machine HM
By referring to the machine-specific information (for example, HDD-
ID31, CPU-ID32, etc.) to identify the user ID and the client machine CM used by that user.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for authenticating a client machine in a computer system, and more particularly, to a communication using a personal computer system, for example, a computer network communication such as a personal computer communication, and a client for implementing such an authentication method. The present invention relates to a machine, a host machine, and a computer system.

[0002]

2. Description of the Related Art With the recent development of computer technology, especially with the development of large-capacity, high-speed communication technology and various kinds of easy-to-operate communication software, many people use personal computers such as the Internet on a daily basis. It is supposed to.

[0003]

By the way, in the personal computer communication as described above, an authentication method is adopted to secure security. However, in the conventional authentication method using only the user ID and the password, an easily identifiable number such as the user's own birthday is used as the password, or the user writes down the password and affixes it to the monitor. However, there are many problems in password management by the user, so that the actual authentication function is not sufficiently achieved.

There is also a method of checking the caller's telephone number to check whether the user is a legitimate user. In this method, a user having a portable personal computer uses a public line while traveling. It cannot be used in a so-called mobile environment. Further, in this method, since the telephone number at the time of the previous access is displayed for confirming unauthorized access, there is a problem that the unauthorized user is informed of the telephone number of the authorized user.

[0005] The present invention has been made in view of the above-described circumstances, and has been made to enhance an authentication method capable of coping with a mobile environment which is expected to increase in the future, and to enable authorized users to utilize machine-specific information. It is an object of the present invention to provide a computer network client machine authentication method capable of protecting the privacy of authorized users and preventing unauthorized users from intruding into the network by specifying the machine to be used.

[0006]

A first invention of a client machine authentication method for a computer network according to the present invention is a client machine authentication method when a client machine and a host machine communicate via a computer network. Machine information unique to each client machine is registered in the host machine in advance in association with the user ID of a user who uses each client machine, and each client machine requests access to the host machine. Sometimes the user ID entered
At the same time, it transmits its own machine unique information to the host machine, and the host machine registers the machine unique information transmitted from the client machine requesting access in accordance with the user ID transmitted at the same time. It is characterized in that it is determined whether or not it matches the unique information.

[0007] In a first aspect of the present invention, a unique machine unique information given to each client machine and a user ID of a user who uses each client machine are registered in advance in association with each other. A client machine that communicates with a host machine equipped with a database via a computer network, and transmits, when an access request is made to the host machine, its own machine-specific information to the host machine together with the input user ID. It is characterized by the following.

A first invention of a host machine according to the present invention is a host machine which communicates with a client machine via a computer network, wherein the unique machine unique information given to each client machine and each client machine are provided. A user who has previously registered a database in which user IDs of users who use the machine are associated with each other, and machine-specific information transmitted from the client machine requesting access by referring to the registered contents of the database. Means for determining whether or not the information matches the machine unique information registered corresponding to the ID.

According to the first aspect of the present invention for a client machine authentication method for a computer network and a client machine and a host machine of the present invention, the machine ID unique to the client machine together with the user ID input at the time of the access request from the client machine is stored in the host machine. Sent to the machine,
The host machine refers to the database to determine whether the client machine is a regular user's machine.

A second invention of a client machine authentication method for a computer network according to the present invention is a client machine authentication method for communication between a client machine and a host machine via a computer network. The unique machine-specific information is registered in the host machine in advance in association with the user ID of the user who uses the individual client machine, and the host machine is configured to have at least the machine-specific information of the individual client machine and the individual client machine. An access code file is created by encrypting the access permission information with the secret key and sent to each client machine in advance, and each client machine receives the user ID entered at the time of the access request to the host machine. , Host machine Sends the access code file sent in advance to the host machine, and the host machine decrypts the access code file sent from the client machine requesting access with the secret key,
Determines the authenticity of the decrypted access permission information,
It is characterized in that it is determined whether or not the decrypted machine unique information matches the machine unique information registered corresponding to the transmitted user ID.

According to a second aspect of the present invention, a unique machine unique information assigned to each client machine and a user ID of a user who uses each client machine are registered in advance in association with each other. A client machine that communicates via a computer network with a host machine equipped with a database, and when an access request to the host machine is made, an access code file previously sent from the host machine together with the input user ID to the host machine. It is characterized by being transmitted.

A second invention of a host machine according to the present invention is a host machine which communicates with a client machine via a computer network, wherein the unique machine unique information given to each client machine and each client machine are provided. Creates a database pre-registered in association with the user ID of the user who uses the machine, and an access code file in which at least machine-specific information of each client machine and access permission information for each client machine are encrypted with a secret key. Means for sending to the individual client machine in advance, means for decrypting the access code file transmitted from the client machine requesting access with a secret key, and means for determining the authenticity of the decrypted access permission information And the registered contents of the database. To, and further comprising a means for determining whether the machine-specific information registered in correspondence that the user ID transmitted with the machine-specific information decoded match.

According to the second aspect of the present invention of the client machine authentication method for a computer network and the client machine and the host machine of the present invention, the client machine sends in advance the user ID entered at the time of the access request from the client machine, together with the user ID. The encrypted access code file including its own machine-specific information is transmitted to the host machine, and the host machine refers to the database to determine whether the client machine is a machine of an authorized user.

[0014] A third invention of a client machine authentication method for a computer network according to the present invention is a client machine authentication method for communication between a client machine and a host machine via a computer network. The unique machine-specific information is registered in the host machine in advance in association with the user ID of the user who uses the individual client machine, and the host machine is configured to have at least the machine-specific information of the individual client machine and the individual client machine. An access code file is created by encrypting the access permission information with the secret key and sent to each client machine in advance, and the client machine, together with the user ID entered at the time of the access request to the host machine,
The host machine transmits an access code file and machine unique information sent in advance from the host machine to the host machine, and the host machine decrypts the access code file transmitted from the client machine requesting access with a secret key, and Judge the authenticity of the access permission information, and determine whether or not the decrypted machine unique information matches the transmitted machine unique information, based on the decoded machine unique information and the transmitted user ID. It is determined whether or not the registered machine unique information matches.

In a third aspect of the client machine according to the present invention, unique machine unique information given to each client machine and a user ID of a user who uses each client machine are registered in advance in association with each other. A client machine that communicates via a computer network with a host machine equipped with a database, and an access code file and machine-specific information previously sent from the host machine together with an input user ID when an access request to the host machine is requested. Is transmitted to the host machine.

A third invention of the host machine according to the present invention is a host machine which communicates with a client machine via a computer network, wherein the unique machine unique information given to each client machine and each client machine are provided. Creates a database pre-registered in association with the user ID of the user who uses the machine, and an access code file in which at least machine-specific information of each client machine and access permission information for each client machine are encrypted with a secret key. Means for sending to the individual client machine in advance, means for decrypting the access code file transmitted from the client machine requesting access with a secret key, and means for determining the authenticity of the decrypted access permission information And the registered contents of the database. To, whether the machine-specific information transmitted with the machine-specific information decoded match,
Means for determining whether or not the decrypted machine unique information matches the machine unique information registered corresponding to the transmitted user ID.

According to the third aspect of the present invention for a client machine authentication method for a computer network, a client machine and a host machine of the present invention, together with a user ID input at the time of an access request from the client machine, its own machine unique information and The encrypted access code file containing the machine's own machine-specific information sent from the host machine is sent to the host machine, and the host machine refers to the database to determine whether the client machine is an authorized user's machine. judge.

A fourth invention of a client machine authentication method for a computer network according to the present invention is a client machine authentication method for communication between a client machine and a host machine via a computer network. The unique machine-specific information is registered in the host machine in advance in association with the user ID of the user who uses the individual client machine, and the host machine is configured to have at least the machine-specific information of the individual client machine and the individual client machine. Creates an access code file that is obtained by encrypting the access permission information with the secret key and sends it to each client machine in advance. When an access request is made from each client machine, the access code file is unique to the client machine making the access request. A public key containing the public key is generated, a portion of the generated public key other than the machine-specific information is transmitted to the client machine, and the client machine requesting access transmits the input user ID to the host machine, The public key is restored from a part of the public key received from the machine and the own machine unique information, and the access code file previously sent from the host machine and / or the own machine unique information is encrypted with the restored public key. To the host machine, the host machine decrypts the access code file and / or machine unique information encrypted with the secret key of the public key encryption transmitted from the client machine requesting access with the secret key, The authenticity of the decrypted access permission information is determined, and the decrypted machine specific information and the transmitted machine are determined. Whether the specific information matches, and judging whether the machine-specific information registered in correspondence that the user ID transmitted with the machine-specific information decoded match.

In a fourth aspect of the client machine according to the present invention, the unique machine unique information assigned to each client machine and the user ID of a user who uses each client machine are registered in advance in association with each other. A client machine that communicates via a computer network with a host machine equipped with a database, transmits an input user ID to the host machine at the time of an access request, and transmits a part of a public key received from the host machine and its own. The public key is restored from the machine unique information, and the access code file previously sent from the host machine and / or the own machine unique information is encrypted with the restored public key and transmitted to the host machine. Features.

A fourth aspect of the host machine according to the present invention is a host machine that communicates with a client machine via a computer network, wherein the unique machine unique information assigned to each client machine and the individual client machine are provided. Creates a database pre-registered in association with the user ID of the user who uses the machine, and an access code file in which at least machine-specific information of each client machine and access permission information for each client machine are encrypted with a secret key. Means for sending to the individual client machine in advance, and when an access request is made from the individual client machine, a public key including the machine unique information of the client machine making the access request is generated, and the machine unique information of the generated public key is generated. Other than the client Means for transmitting to the emission, means for decoding the access code files and / or machine-specific information encrypted by the private key of the public key cryptography, which has been transmitted by the private key from a client machine that is an access request,
Means for determining the authenticity of the decrypted access permission information;
By referring to the registered contents of the database, it is determined whether the decrypted machine specific information matches the transmitted machine specific information, and registered in correspondence with the decrypted machine specific information and the transmitted user ID. Means for judging whether or not the machine-specific information matches.

In the computer network client machine authentication method of the present invention, the client machine and the host machine according to the fourth aspect of the present invention, together with the user ID input at the time of the access request from the client machine, its own machine unique information and The access code file containing the encrypted own machine-specific information sent from the host machine is encrypted with the public key and sent to the host machine, and the host machine decrypts it with the private key and refers to the database. It is determined whether or not the client machine is a machine of an authorized user.

Further, in each of the above-mentioned inventions, the access code file is changed by the host machine every time the host machine permits access to the access request from the client machine.

Therefore, in each of the above-mentioned inventions, each time access from the client machine to the host machine is permitted,
Since the access code file is changed, the security becomes higher.

Further, in each of the above-mentioned inventions, the client machine transmits the machine unique information to the host system by using the first reading means for reading the machine unique information held in the hardware hierarchy to the operating system hierarchy. For this purpose, second reading means for reading from the first reading means are provided in the application layer, respectively, and further, authentication means for mutually authenticating communication between the first reading means and the second reading means is provided. It is characterized by being provided in the operating system layer and the application layer respectively.

Therefore, in each of the above-described inventions, the falsification of the machine unique information of the client machine itself is prevented.

Further, the computer system according to the present invention holds machine unique information unique to the hardware hierarchy, and stores the machine unique information held in the hardware hierarchy by first reading means provided in the operating system hierarchy. A computer system which reads out the machine-specific information read by the first reading means by the second reading means provided in the application layer and outputs the information to the outside, wherein the first authentication means is provided in the operating system layer. A second authentication unit provided in the hierarchy, wherein the first authentication unit generates a first random number in response to an authentication request from the second authentication unit and generates a second random number;
And the second authentication unit transmits the received first
A predetermined operation is performed between the random number generated by itself and the second random number generated by itself, and the operation result and the second random number are transmitted to the first authentication unit. , Performs a reverse operation of the predetermined operation, compares the result with the received second random number, and if they match, performs a predetermined operation between the first random number and the second random number to obtain the calculation result. And the first
To the second authentication means, the second authentication means,
An inverse operation of a predetermined operation is performed on the received operation result, and the result is compared with the received first random number. If they match, it is determined that the mutual authentication has been completed, and the first reading means determines that the second authentication has been completed. It is characterized in that machine specific information is transmitted to the reading means.

In the computer system of the present invention, tampering at the time of outputting the machine unique information, which is the ID of the hard disk, CPU, etc., held in the hardware hierarchy to the outside is prevented.

[0028]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the drawings showing the embodiments. First, the configuration of the client machine on the user side used for implementing the client machine authentication method of the computer network of the present invention and the state of the network connection will be described with reference to the schematic diagram of FIG.

In FIG. 1, reference numeral CM indicates a client machine used by a user, and is basically a general personal computer. This client machine CM is connected to the communication center 1 via the network NW. Although not shown in FIG. 1, a host machine HM is installed in the communication center 1, and a user ID of each user and machine-specific information (HDD-ID, CPU-ID, etc.) are registered. User database 10 is installed.

The client machine CM includes a CPU 20, a hard disk 21, and a C like the general computer system.
A D-ROM drive 22 and the like are provided. Hard disk 2
A unique ID (hereinafter referred to as HDD-ID) 31 is given to 1, and a unique ID (hereinafter referred to as CPU-ID) is also assigned to the CPU 20.
32 has been granted. In addition, this client machine CM
The communication with the communication center 1 is realized, for example, by reading the communication software 11 recorded on the CD-ROM 50 by the CD-ROM drive 22 and writing it on the hard disk 21 and operating the CPU 20 accordingly.

FIG. 2 is a flowchart showing the procedure of the first invention of the client machine authentication method for a computer network according to the present invention. The double box indicates the operation by the user on the client machine CM side and the processing by the client machine CM, and the thick box indicates the operation and processing on the host machine HM installed in the communication center 1, respectively.

First, the user operates his own client machine.
The CM connects the line to the host machine HM to request access (step S11), and then sends the user ID and password to enter the user identification sequence (step S12). In response to the above communication on the client machine CM side, the host machine HM first checks whether the transmitted user ID is registered in the user database 10 and specifies the user (step S1). However, if a matching user ID is not found, the host machine HM requests the client machine CM to retransmit the user ID, and disconnects the line if it does not match again (step S2).

The user who passes the user identification sequence in this way enters the machine identification authentication sequence. First, the host machine HM requests the client machine CM for machine-specific information (step S13). In contrast, the client machine CM has machine-specific information, for example,
Send HDD-ID31, CPU-ID32 or both
(Step S14).

When the machine unique information is transmitted from the client machine CM to the host machine HM as described above, the machine unique information used by each user is registered in the user database 10 in advance in the host machine HM.
The previously identified user ID is compared with the machine-specific information. As a result, if they match, the subsequent access from the client machine CM to the host machine HM is permitted (step S16). However, if they do not match (step S17),
Formal access is not permitted (step S18), for example, provisional access is permitted.

However, in the first invention of the client machine authentication method for a computer network according to the present invention as described above, if the security of the communication path between the client machine CM and the host machine HM is not sufficient, If the machine-specific information of the CM is easily available to a third party and the unauthorized user is at the programmer level and is familiar with the software, the effect may be low.

FIG. 3 is a flowchart showing the procedure of the second invention of the client machine authentication method for a computer network according to the present invention. The double box is used for user operations and processing on the client machine CM side.
Bold boxes indicate operations and processes on the host machine HM side installed in the communication center 1, respectively.

First, the user operates his own client machine.
The CM connects the line to the host machine HM to request access (step S31), and then sends the user ID and password to enter the user identification sequence (step S22). In response to the above communication on the client machine CM side, the host machine HM first checks whether the transmitted user ID is registered in the user database 10 and specifies the user (step S1). However, if a matching user ID is not found, the host machine HM requests the client machine CM to retransmit the user ID, and disconnects the line if it does not match again (step S2).

A user who has passed the user identification sequence in this way enters a machine identification authentication sequence. First, the access code file is requested from the host machine HM to the client machine CM (step S23). On the other hand, if the client machine CM already owns the access code file, the client machine CM sends it (step
S24). However, if the access code file is not yet owned by the client machine CM, this is notified.
(Step S25). In this case, formal access is not permitted, but provisional access is permitted. The processing procedure at this time will be described later.

When the access code file is transmitted from the client machine CM to the host machine HM as described above, the host machine HM decrypts the transmitted access code file with the secret key (step S26), and The access code is verified (step S27).
At this time, if the access code is incorrect (step S30), formal access is not permitted (step S3
2).

Next, the host machine HM stores the machine unique information contained in the decrypted access code in the user database.
The user ID specified before 10 is compared with the machine-specific information (step S28). As a result, if they match, the subsequent access from the client machine CM to the host machine HM is permitted (step S29). However, if they do not match (step S31), formal access is not permitted (step S32), for example, provisional access is permitted.

Next, the fact that the client machine CM does not yet own the access code file indicates that the host machine
The processing procedure after the notification to the HM (step S25) or when the access code is incorrect (step S32) will be described with reference to the flowchart in FIG.

First, in this case, provisional registration is performed for a machine that does not have an access code file (client machine CM), and access is terminated for a machine (client machine CM) with an invalid access code. Is selected (steps S40, S41, S42).

The temporary registration is performed in the following procedure. First,
The machine unique information is requested from the host machine HM to the client machine CM, and the host public key is transmitted (step S42). Client machine CM accordingly
Encrypts its own machine unique information with the host public key sent from the host machine HM (step S43), and sends the encrypted machine unique information to the host machine HM.
(Step S44).

In the host machine HM, the client machine CM
Then, the encrypted machine unique information sent from the client machine CM is decrypted with the secret key to obtain the unique information of the client machine CM (step S45). Further, the host machine HM encrypts the access permission information or the machine unique information with the second secret key to create an access code file (step S46). The access code file is transmitted from the host machine HM to the client machine CM, and is temporarily registered in the host machine HM by linking to the corresponding user ID in the user database 10 (step S47).

However, according to the second invention of the client machine authentication method for a computer network according to the present invention as described above, if the security of the communication path is not sufficient, or a third party obtains the access code file of the client machine CM. If it is easy to do, the effect may be low.

FIGS. 5, 6 and 7 are flowcharts showing the procedures of the third invention and the fourth invention of the client machine authentication method for the computer network according to the present invention. Note that the double boxes indicate operations and processes by the user on the client machine CM side, and the thick boxes indicate operations and processes on the host machine HM side installed in the communication center 1.

First, the user operates his own client machine.
The CM connects the line to the host machine HM to request access (step S51), and then sends the user ID and password to enter the user identification sequence (step S52). In response to the above communication on the client machine CM side, the host machine HM first checks whether the transmitted user ID is registered in the user database 10 and specifies the user (step S1). However, if a matching user ID is not found, the host machine HM requests the client machine CM to retransmit the user ID, and disconnects the line if it does not match again (step S2).

The user who has passed the user identification sequence in this way enters the machine identification authentication sequence. First, the host machine HM requests the client machine for the machine unique information and the access code file, and transmits the public key (step S53). In contrast, the client machine CM uses machine-specific information (machine name, CP
U-ID, HDD-ID, OS-ID, etc.) with public key encryption
The access code file is transmitted together with (Step S54) (Step S56). However, if the client machine CM does not yet own the access code file, it notifies that fact (step S55). In this case, formal access is not permitted, but provisional access is permitted.
The processing procedure at this time will be described later.

The host machine HM decrypts the machine unique information using the secret key of the public key encryption (step S80), and searches the machine database for the machine unique information (step S80).
S81), check whether it is a machine of an unauthorized user,
If the machine is an unauthorized user, the process proceeds to an unauthorized user handling process (step S83). Specifically, access denied,
It is possible to take measures such as registering the phone number of an unauthorized user and reverse detection of the location of the unauthorized user. On the other hand, when the host machine HM does not correspond to the unauthorized user machine, the host machine HM compares the decrypted machine unique information with the machine list registered in the user database 10 (step S82), and proceeds to the next processing.

When the client machine CM transmits the access code file, the host machine HM decrypts the access code file using the secret key for the access code to obtain the access code (step S60). Then, the access code is collated with the access code (including the machine unique information) registered in the data of the user in the collated user database 10 in step S82 described above (step S61). It is determined that there is (Step S62). Then, the received machine unique information is collated with the access code of the user database 10 (Step S63). As a result, if they match (step S64), the host machine HM confirms that the client machine CM is a machine of an authorized user and permits access (step S93).

In step S93, it is effective to update the access code file by changing the access code for each access after the access is permitted for the purpose of further enhancing security. In addition, the access date and time is recorded in the access code file and compared with the access date and time record of the host to notify whether there has been unauthorized access, or to notify the user of the previous access date and time to check the possibility of unauthorized access on the user side. It is also possible to be able to check. Further, although only one access code may be prepared in the host machine, it is more preferable to prepare the access code for each user or machine as described above.

When the access is permitted as described above, the registered machine,
A list of machines that have been temporarily registered and machines that have passed password authentication (machines that have not been temporarily registered after password authentication) are displayed. Here, the user of the client machine CM officially registers the temporary registration machine, cancels the registration,
It is possible to certify an unauthorized access machine using its own user ID. If the user himself / herself certifies the temporary registration or password authentication passing machine as an unauthorized user machine, the information is transmitted to the host machine HM and registered in the host-side unauthorized user machine database. However, when the number of times that the machine has been authorized as an unauthorized user machine exceeds a certain number, the machine may be registered in the unauthorized user database. The machine registered in the unauthorized user database in this way can take measures to prevent access to the host machine HM thereafter.

In the above-described step S63, the machine unique information received by the host machine HM and the user database 10
If the machine ID does not match the machine ID corresponding to the user ID registered in the client machine CM (step S65), the host machine HM either terminates the access to the client machine CM or temporarily registers the client machine CM. The process is performed (step S94).

This step S94 corresponds to a case where an authorized user or an unauthorized user has copied the latest access code file to a non-registered machine. In this case, make sure that the host machine uses the correct access code file.
HM presents it to the client machine CM, and allows the user to select either access termination or temporary registration.

If the access code file does not exist on the client machine CM in step S55, the machine unique information received by the host machine HM is further compared with the machine unique information registered in the user database 10 ( In step S57), if they match, they are recognized as registered machines, and in step S91, if they do not match, they are provisionally registered in step S92 as non-registered machines.

In step S91, the client machine CM is provisionally registered assuming that the user has lost (intentionally or accidentally deleted) the access code file. The possibility that the unauthorized user has altered the machine-specific information is considered. There is also. In step S92, the client machine
The CM is considered unregistered and the user in this case may be both a legitimate user and a fraudulent user.

Further, if it is determined in step S61 that the access code is invalid (step S66), the machine unique information received by the host machine HM and the machine unique information included in the access code are stored in the user database 10.
Is compared with the machine-specific information corresponding to the user (step S67). This collation result is divided into the following four processes of steps S68 and S95, processes of steps S69 and S96, processes of steps S70 and S97, and processes of steps S71 and S98.

Step S68 is a case where the information registered in the user database 10 matches the received information and the access code information in step S67. In this case, there is a possibility that the user has altered the access code file, a possibility that there has been an unauthorized access before the authorized user has accessed it, and that the unauthorized user has the ability to alter machine-specific information and has an old access code file. May have been obtained.

Accordingly, in step S95, the fact that the access code file is incorrect and the possibility of access by an unauthorized user are presented from the host machine HM to the client machine CM, and either the access end or the temporary registration of the machine is selected. It is possible for the user to do so.

Step S69 is a case where the information registered in the user database 10 does not match the received information and matches the access code information in step S67. In this case, it is possible that an authorized user or an unauthorized user has copied an old access code file to a non-registered machine.

Therefore, in step S96, the host machine HM is presented to the client machine CM to use the correct ascord file, and the user can select either the access end or the temporary registration of the machine. .

Step S70 is a case where the information registered in the user database 10 in step S67 matches the received information and does not match the information of the access code. In this case, the possibility that the user used the access code file of another machine, the possibility that the unauthorized user had the ability to falsify the machine-specific information, and used the access code file of another machine, etc. are considered. Can be

Accordingly, in step S97, the host machine HM is presented to the client machine CM to use the correct ascord file, and the user can select either the end of access or the temporary registration of the machine. .

Step S71 is a case where the information registered in the user database 10 does not match the received information and does not match the access code information in step S67. In this case, if the received information and the access code match, it is highly likely that the access request is from another user ID or a user registered on another machine. On the other hand, if the received information and the access code are different, there is a high possibility that an unauthorized user is trying to access using another access code file on another machine.

Accordingly, in step S98, the host machine HM is presented to the client machine CM to use the correct ascord file, and the user can select either the access end or the temporary registration of the machine. . If the received information and the access code are different as described above, the host machine HM indicates to the client machine CM that the registration information does not match, the access is denied, and the next access from the authorized user is performed. At this time, it is desirable to prompt the user to change the password by presenting that there has been unauthorized access.

In any of the above cases, if the user temporarily registers a machine, an access code file is created on the host side using a public key including machine-specific information and downloaded to the client machine CM. . In the temporary registration state, access may be made with a time limit, or usable functions and access ranges may be limited. Also, in the case of initial registration, formal registration confirmation may be performed offline (postal mail or the like) after provisional registration.

In the processing for dealing with an unauthorized user, the access may be simply rejected.
Search for the unauthorized user from the machine-specific information, record the phone number of the unauthorized user, track the location by reverse detection, and notify the unauthorized network of the unauthorized user machine's unique information to each Access may be prevented on the network. Further, an authentication method based on the telephone number of the caller may be used together.

In the third aspect of the computer network client machine authentication method of the present invention as described above, if the security of the communication path is not sufficient, or if both the machine unique information of the client machine CM and the access code file are If the third party is easily available and the unauthorized user is familiar with the software at the programmer level, the effect may be low.

Further, in the fourth invention of the client machine authentication method for a computer network according to the present invention as described above, it is preferable that "when the security of the communication path is not sufficient or when the security of the communication path is not sufficient and the client machine CM In the case where both the unique information and the access code file are easily available to a third party ", and the unauthorized user is familiar with the software at the programmer level, the effect may be low.

By the way, even if the method of authenticating a client machine of a computer network according to the present invention as described above is used, it is impossible to cope with the case where the machine unique information is falsified in the client machine CM. Therefore, in the following, measures for preventing falsification of machine unique information in the client machine CM will be described.

FIG. 8 is a schematic diagram showing a configuration example of a client machine CM of the present invention, in other words, a software module of the computer system of the present invention.

In FIG. 8, the client machine CM is composed of three levels of a hardware level 100, an OS level 110, and an application level 120. The machine level information 101 is provided at the hardware level 100, and the machine ID support API (Application Programmer's Int.
erface) 111 and a mutual authentication module 112, and a machine ID authentication module 121,
Mutual authentication module 122, access code file management module 123, access code file 124 and user ID
Authentication sequence scripts 125 are arranged. Reference numeral 130 denotes a main module of the communication software of the client machine CM (hereinafter, referred to as a communication software main module).

Machine level information of hardware level 100
Reference numeral 101 denotes, for example, the HDD-ID 31 of the hard disk 21 and the CPU-ID 32 of the CPU 20 of the client machine CM. OS level 110 machine ID support API 111 is used for machine-specific information
Read 101 and machine at application level 120
The ID is sent to the ID authentication module 121. When the communication software main module 130 needs to transmit machine-specific information, the machine ID authentication module 121
Causes the support API 111 to send the machine-specific information 101.

Normally, as described above, the machine specific information 10
1 is read and transmitted to the host machine HM by the communication software main module 130. In this case, the OS uniqueness of the machine unique information 101 is possible at the OS level 110. Therefore, in the present invention, in order to prevent tampering by intervening in communication of the machine unique information 101 between the OS level 110 and the application level 120, a machine ID support API is used.
A mutual authentication module 112 is connected to 111, and a mutual authentication module 122 is connected to the machine ID authentication module 121.

FIG. 9 shows the mutual authentication module 12 at the application level 120 of the computer system as described above.
FIG. 9 is a schematic diagram showing a procedure of a mutual authentication procedure executed between the second authentication module 112 and the mutual authentication module 112 of the OS level 110.

First, an authentication request is issued from the mutual authentication module 122 at the application level 120 (P1). In response to this, the mutual authentication module 112 of the OS level 110 generates a random number “R1” to generate the application level 120 “R1”.
To the mutual authentication module 122 (P2). The mutual authentication module 122 at the application level 120 generates a random number “R2”, which is also its own, and this random number “R2” and the OS level
The random number “R1” received from the mutual authentication module 112 of 110
And a predetermined operation "*" is executed between the values and the resulting value "R1 *
R2 ".

The operation result “R1
* R2 ”is transmitted to the mutual authentication module 112 of the OS level 110 together with the random number“ R2 ”(P3). OS level that received this
In the mutual authentication module 112 of 110, “R1 * R2” and “R
The inverse operation "! *" Of the operation "*" is performed between "1" and "1".
If the value obtained as a result of the inverse operation is “R2” transmitted, it means that no data has been tampered with during communication from the application level 120 to the OS level 110.

Conversely, a mutual authentication module of OS level 110
At 112 also, a predetermined operation “*” is executed between the random numbers “R1” and “R2” to generate a result value “R1 * R2”, and the random number “R1” and the operation result “R1 * R2” Is transmitted to the mutual authentication module 122 of the application level 120. Upon receiving this, the mutual authentication module 122 of the application level 120 performs the inverse operation “! *” Of the operation “*” between “R1 * R2” and “R2”. If the value obtained as a result of the inverse operation is “R1” transmitted, it means that data has not been tampered with during communication from the OS level 110 to the application level 120.

As a result, the mutual authentication between the OS level 110 and the application level 120 is completed, and the machine unique information 101 is stored in the communication software main module.
Even if 130 is read and transmitted, there is no possibility of tampering.

In such a client machine CM, a mutual authentication method is adopted for the client machine CM such that the communication control unit and the machine-specific information calling unit perform mutual authentication to prevent an unauthorized user program from being interrupted. As a result, it is possible to prevent an unauthorized user who is familiar with software at the programmer level from falsifying the machine unique information transmitted to the host.

[0081]

As described above, according to the client machine authentication method of the computer network, the client machine, the host machine, and the computer system of the present invention, the machine to be used is specified by using the machine-specific information, thereby making the unauthorized use possible. By preventing access by a user and identifying the machine of the unauthorized user, it is possible to prevent all subsequent accesses by the machine.

According to the computer network client machine authentication method, client machine, host machine and computer system according to the first aspect of the present invention,
The own machine unique information is transmitted to the host machine together with the user ID entered at the time of the access request from the client machine, and the host machine refers to the database to determine whether the client machine is a machine of an authorized user. By identifying the machine to be used using machine-specific information, it is possible to prevent unauthorized users from accessing it, and by identifying the unauthorized user's machine, it is possible to prevent all subsequent accesses by that machine. Will be possible.

According to the client machine authentication method of the computer network, the client machine, the host machine and the computer system according to the second aspect of the present invention, the user ID entered at the time of the access request from the client machine is transmitted from the host machine in advance. The sent access code file containing the encrypted own machine-specific information is sent to the host machine, and the host machine refers to the database to determine whether the client machine is a machine of an authorized user. By identifying the machine to be used using machine-specific information, it is possible to prevent unauthorized users from accessing it, and by identifying the unauthorized user's machine, it is possible to prevent all subsequent accesses by that machine. Will be possible.

Further, according to the third aspect of the present invention of a client machine authentication method for a computer network, a client machine, a host machine, and a computer system, together with a user ID input at the time of an access request from the client machine, The information and the access code file containing its own machine encrypted information sent in advance from the host machine are sent to the host machine, and the host machine refers to the database and checks whether the client machine is a machine of an authorized user Since it is determined whether or not the machine is used by using the machine-specific information, the access of the unauthorized user is prevented, and by identifying the machine of the unauthorized user,
All subsequent access by the machine can be prevented.

Further, in the computer machine client machine authentication method, the client machine, the host machine and the computer system according to the fourth invention of the present invention, the own machine unique information together with the user ID input at the time of the access request from the client machine. And the access code file containing its own machine-specific information, which has been sent in advance from the host machine, is encrypted with the public key and sent to the host machine, and the host machine decrypts it with the private key and refers to the database To determine whether the client machine is a legitimate user machine. Therefore, by using the machine-specific information to identify the machine to be used, it is possible to prevent access by an unauthorized user, and By specifying the It is possible to prevent all.

According to each of the above-mentioned inventions, the access code file is changed by the host machine every time the host machine permits access to an access request from the client machine, so that the security is further improved.

Further, according to each of the above-mentioned inventions, it is possible to prevent the machine unique information itself in the client machine from being falsified.

Further, according to the computer system of the present invention, tampering at the time of outputting the machine unique information, which is the ID of the hard disk, CPU, etc., held in the hardware hierarchy, to the outside is prevented.

[Brief description of the drawings]

FIG. 1 is a schematic diagram showing a configuration of a client machine on a user side used for implementing a client machine authentication method for a computer network of the present invention and a state of network connection thereof.

FIG. 2 is a flowchart showing a procedure of a first invention of a client machine authentication method for a computer network according to the present invention.

FIG. 3 is a flowchart showing a procedure of a second invention of a client machine authentication method for a computer network according to the present invention.

FIG. 4 is a flowchart showing a procedure of a second invention of a client machine authentication method for a computer network according to the present invention.

FIG. 5 is a flowchart showing a procedure of a third invention and a fourth invention of a client machine authentication method for a computer network according to the present invention.

FIG. 6 is a flowchart showing a procedure of a third invention and a fourth invention of a client machine authentication method for a computer network according to the present invention.

FIG. 7 is a flowchart showing a procedure of a third invention and a fourth invention of a client machine authentication method for a computer network according to the present invention.

FIG. 8 is a schematic diagram showing a configuration example of a software module of the computer system of the present invention.

FIG. 9 is a schematic diagram showing a procedure of a mutual authentication procedure executed between mutual authentication modules of the computer system of the present invention.

[Explanation of symbols]

 CM client machine HM host machine NW network 1 communication center 10 user database 21 hard disk 20 CPU 31 HDD-ID 32 CPU-ID

Claims (17)

[Claims] 1. A client machine authentication method when a client machine and a host machine communicate with each other via a computer network, wherein machine-specific information unique to each client machine is provided.
User ID of the user who uses each client machine
Registered in advance on the host machine side in association with, and each client machine transmits its own machine unique information to the host machine together with the input user ID when requesting access to the host machine, The host machine determines whether or not the machine unique information transmitted from the client machine requesting access matches the machine unique information registered corresponding to the simultaneously transmitted user ID. Computer network client machine authentication method. 2. A client machine authentication method when a client machine and a host machine communicate with each other via a computer network, wherein machine-specific information unique to each client machine is provided.
User ID of the user who uses each client machine
The host machine creates an access code file in which at least the machine-specific information of each client machine and the access permission information for each client machine are encrypted with a secret key. In advance, each client machine sends an access code file previously sent from the host machine together with the input user ID at the time of an access request to the host machine. Transmitted to the machine, the host machine decrypts the access code file transmitted from the client machine requesting access with the secret key, and determines the authenticity of the decrypted access permission information. For the machine-specific information and the transmitted user ID A client machine authentication method for a computer network, which determines whether the registered machine unique information matches the registered machine unique information. 3. A client machine authentication method when a client machine and a host machine communicate with each other via a computer network, wherein machine-specific information unique to each client machine is provided.
User ID of the user who uses each client machine
The host machine creates an access code file in which at least the machine-specific information of each client machine and the access permission information for each client machine are encrypted with a secret key. The access code file and the machine unique information previously sent from the host machine together with the input user ID at the time of the access request to the host machine. To the host machine, the host machine decrypts the access code file transmitted from the client machine requesting access with the secret key, and determines the authenticity of the decrypted access permission information, Decrypted machine specific information and sent Determining whether the received machine ID matches the received machine ID, and whether the decrypted machine ID matches the registered machine ID corresponding to the transmitted user ID. Computer network client machine authentication method. 4. A client machine authentication method for communication between a client machine and a host machine via a computer network, wherein machine-specific information unique to each client machine is provided.
User ID of the user who uses each client machine
The host machine creates an access code file in which at least the machine-specific information of each client machine and the access permission information for each client machine are encrypted with a secret key. And sends it to each client machine in advance, and when an access request is made from each client machine, generates a public key including the machine unique information of the client machine requesting access, and generates the machine unique information of the generated public key. The client machine requesting access sends the input user ID to the host machine, and a part of the public key received from the host machine and its own machine-specific information. And restores the public key from Access code file sent and / or
Or, encrypt the original machine unique information with the restored public key and send it to the host machine, and the host machine is encrypted with the private key of the public key encryption sent from the client machine requesting access. The access code file and / or the machine unique information is decrypted with the secret key, the authenticity of the decrypted access permission information is determined, and whether the decrypted machine unique information matches the transmitted machine unique information. or not,
A client machine authentication method for a computer network, comprising: determining whether or not the decrypted machine unique information matches the machine unique information registered corresponding to the transmitted user ID. 5. The apparatus according to claim 2, wherein the access code file is changed by the host machine every time the host machine permits access to an access request from the client machine. A method for authenticating a client machine in a computer network according to any one of the above. 6. The client machine transmits the machine unique information to the host machine through a first reading unit for reading the machine unique information held in a hardware hierarchy to an operating system hierarchy. Therefore, second read means for reading from the first read means is provided in each application layer, and furthermore, authentication for mutually authenticating communication between the first read means and the second read means. 5. The method according to claim 1, further comprising providing means for the operating system layer and the application layer. 7. A computer machine and a host machine having a database registered in advance by associating unique machine unique information assigned to each client machine with a user ID of a user who uses each client machine. A client machine for transmitting, when an access request is made to the host machine, its own machine-specific information together with the input user ID to the host machine. 8. A host machine having a database registered in advance in which the unique machine unique information assigned to each client machine and the user ID of a user who uses each client machine are associated with each other, via a computer network. A client machine that communicates with the host machine at the time of an access request to the host machine, by transmitting an access code file previously sent from the host machine together with the input user ID to the host machine. Characteristic client machine. 9. A host computer provided with a database pre-registered by associating unique machine-specific information assigned to each client machine with a user ID of a user who uses each client machine, and a computer network. A client machine that communicates with the host machine at the time of an access request to the host machine, in order to transmit an access code file and machine unique information previously sent from the host machine together with the input user ID to the host machine. A client machine characterized in that: 10. A host computer provided with a database pre-registered by associating unique machine-specific information given to each client machine with a user ID of a user who uses each client machine, and a computer network. A client machine that transmits an input user ID to the host machine at the time of an access request, and extracts the public key from a part of the public key received from the host machine and own machine unique information. A client machine which is restored, encrypts an access code file previously sent from the host machine and / or its own machine-specific information with the restored public key, and transmits the encrypted information to the host machine. 11. A first reading means for reading out the machine unique information held in a hardware layer, the first means for reading the machine unique information to an operating system layer, and the first machine reading means for transmitting the machine unique information to the host machine. Second reading means for reading from the reading means are provided in the application layer, respectively, and further, authentication means for mutually authenticating communication between the first reading means and the second reading means is provided in the operating system. The client machine according to any one of claims 7 to 10, wherein the client machine is provided in each of a hierarchy and an application hierarchy. 12. A host machine which communicates with a client machine via a computer network, wherein unique machine unique information assigned to each client machine corresponds to a user ID of a user who uses each client machine. A machine registered with reference to the database registered in advance and the registered contents of the database, and machine-specific information transmitted from the client machine requesting access corresponding to the user ID transmitted simultaneously. Means for determining whether or not the information matches the unique information. 13. A host machine that communicates with a client machine via a computer network, wherein a unique machine-specific information assigned to each client machine corresponds to a user ID of a user who uses each client machine. Means for creating an access code file obtained by encrypting a database registered in advance and at least machine-specific information of each client machine and access permission information for each client machine with a secret key, and sending the access code file to each client machine in advance Means for decrypting the access code file transmitted from the client machine requesting access with the secret key, means for determining the authenticity of the decrypted access permission information, and referring to the registered contents of the database. The decrypted machine Host machine, characterized by comprising means for determining whether the machine-specific information coincides that is registered in correspondence with the user ID transmitted information. 14. A host machine that communicates with a client machine via a computer network, wherein a unique machine unique information assigned to each client machine is associated with a user ID of a user who uses each client machine. Means for creating an access code file obtained by encrypting a database registered in advance and at least machine-specific information of each client machine and access permission information for each client machine with a secret key, and sending the access code file to each client machine in advance Means for decrypting the access code file transmitted from the client machine requesting access with the secret key, means for determining the authenticity of the decrypted access permission information, and referring to the registered contents of the database. The decrypted machine Determines whether the information matches the transmitted machine unique information, and whether the decrypted machine unique information matches the machine unique information registered corresponding to the transmitted user ID. And a host machine. 15. A host machine that communicates with a client machine via a computer network, wherein unique machine-specific information assigned to each client machine corresponds to a user ID of a user who uses each client machine. Means for creating an access code file obtained by encrypting a database registered in advance and at least machine-specific information of each client machine and access permission information for each client machine with a secret key, and sending the access code file to each client machine in advance Means for generating, when an access request is made from each client machine, a public key including machine-specific information of the client machine making the access request, and transmitting a portion other than the machine-specific information of the generated public key to the client machine; Request access Means for decrypting the access code file and / or machine unique information encrypted with the private key of the public key encryption transmitted from the client machine using the private key, and determining the authenticity of the decrypted access permission information Means for referring to the registered contents of the database, whether or not the decrypted machine unique information and the transmitted machine unique information match, to the decrypted machine unique information and the transmitted user ID. Means for determining whether or not the registered machine-specific information matches the host machine. 16. The host according to claim 13, wherein the access code file is changed each time the host machine permits access to an access request from the client machine. Machine. 17. A method for holding machine-specific information unique to a hardware layer, reading the machine-specific information stored in the hardware layer by a first reading unit provided in an operating system layer, and storing the information in an application layer. In a computer system for reading out the machine unique information read by the first reading means by the provided second reading means and outputting the information to the outside, a first authentication means is provided in the operating system hierarchy,
The application layer includes a second authentication unit, wherein the first authentication unit generates a first random number in response to an authentication request from the second authentication unit, and transmits the first random number to the second authentication unit. The second authentication unit performs a predetermined operation between the received first random number and a second random number generated by itself, and outputs the operation result and the second random number to the first authentication unit. The first authentication means performs an inverse operation of the predetermined operation on the received operation result and compares the result with the received second random number. Performing the predetermined calculation between the random number and the second random number, transmitting the calculation result and the first random number to the second authentication unit, wherein the second authentication unit receives the calculation result Performs the inverse operation of the predetermined operation, and receives the result thereof and the received first A random number is compared, and if they match, it is determined that mutual authentication has been completed, and the first reading means transmits machine-specific information to the second reading means. Computer system.