JP2005192110A - Distribution method of authentication and dynamic key in mobile terminal device, and mobile terminal device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To realize simple and convenient operation without requiring a certificate in procedures for the distribution of authentication and a dynamic key in a mobile terminal device, and to make it difficult to forge or falsify authentication data by eavesdropping. <P>SOLUTION: In a method for the distribution of the authentication and the dynamic key of the mobile terminal device, the mobile terminal device 1 is connected to an authentication device 2 via a wireless system to start EAP/TTLS 30, and a physical address of a wireless device 10 which is a unique device identifier information of the mobile terminal device 1 is determined as ID20. In a hash calculation unit 11, hash calculation of an Ethernet (R) device physical address 12, an OS serial number 13, and a user PIN 14 is performed, of which a result is used as a password 21 when making an authentication request 31 to the authentication device 2. On the basis of an authentication result 32, the dynamic key distribution 33 is realized with the authentication. Encoding and decoding are executed using the dynamic key to perform data exchange 34 with the authentication device 2. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a mobile terminal device authentication and dynamic key distribution method and a mobile terminal device to which the method is applied when data communication is performed by connecting to an authentication device via a wireless system.

  Conventionally, as an authentication and dynamic key distribution method for mobile terminal devices such as PCs (Personal Computers) and PDAs (Personal Data Assistants) connected to authentication devices via a wireless system, IEEE (Institute of Electrical and The Internet Engineering Task Force (IETF) is a procedure for performing authentication according to IEEE 802.11, which is a wireless connection standard defined by Electronics Engineers), and requesting authentication using a certificate issued by a specific certification authority. There are known ones that use the EAP (Extensible Authentication Protocol) / TLS (Transport Level Security) protocol described in RFC2716, which is a communication standard defined by the above.

  FIG. 2 shows a conventional mobile terminal device authentication and dynamic key distribution method using the EAP / TLS protocol. FIG. 2A shows that certificate data is stored in the mobile terminal device. (B) shows an example in which certificate data is read by a hardware token device, both of which are based on the contents of the communication standard RFC2716 described in Non-Patent Document 1. Is based.

2A, the terminal device 100 includes a wireless device 110, and has a function of performing communication based on the IEEE 802.11 standard via a wireless system and connecting to the authentication device 200.
When the terminal device 100 requests authentication and dynamic key distribution from the authentication device 200 via the wireless system, after starting the EAP / TLS 300 procedure with the authentication device 200, for example, an HDD (Hard Disk The certificate data 150 is transmitted by a certificate stored in advance in a drive (not shown), and an authentication request 310 is made to the authentication device 200.

  The authentication device 200 compares the transmitted certificate data with the certificate data held therein to detect a match / mismatch, notifies the terminal device 100 of the authentication result 320, and obtains authentication. If so, a key distribution 330 procedure for sending a dynamic key used for subsequent communications is performed. The dynamic key is used for data encryption and decryption (decryption) of the encrypted data in the data communication 340 performed between the terminal device 100 and the authentication device 200.

  Since the certificate is issued to a specific user by a specific certification authority, in the case of the authentication and dynamic key distribution method shown in FIG. There is no problem in the case of the one-to-one correspondence, but if a plurality of users try to use the same terminal device 100, a plurality of certificates must be held in the terminal device. Therefore, it is necessary to identify the user, and there is a problem that management becomes difficult due to difficulty in managing certificates.

In contrast, in the mobile terminal device authentication and dynamic key distribution method shown in FIG. 2B, the user uses a hardware token device instead of holding a certificate in the terminal device. In order to avoid such problems, the certificate data is input every time an authentication request is made.
In FIG. 2B, the terminal device 100A includes the wireless device 110 and has a function of performing communication based on the IEEE 802.11 standard via the wireless system and connecting to the authentication device 200. This is the same as the example shown in FIG.

When a user requests authentication and dynamic key distribution from the terminal device 100A to the authentication device 200 via the wireless system, the hardware token device 120 is inserted into, for example, a USB (Universal Serial Bus) terminal. Connect to the terminal device 100A.
In the terminal device 100A, after starting the EAP / TLS 300 procedure with the authentication device 200, the certificate data 150 is transmitted by reading the certificate stored in the hardware token device 120. Then, an authentication request 310 is made to the authentication device 200.

  The subsequent operation is the same as the example shown in FIG. 2A, and the authentication device 200 notifies the authentication result 320 to the terminal device 100A according to the transmitted certificate data, and authentication is obtained. In this case, after performing the procedure of the key distribution 330 for sending the dynamic key used for the subsequent communication, the terminal device performs the encryption of the data and the decryption of the encrypted data using this key. Data communication 340 between 100A and authentication device 200 is executed.

  In the case of the example shown in FIG. 2B, the same terminal device 100A can be used by a plurality of users, but the hardware token device is expensive and the hardware token device is lost. There is a problem that security may not be ensured due to theft or theft.

  FIG. 3 shows the authentication and authentication of mobile terminal equipment using the EAP / TTLS (Tunneled TLS Authentication Protocol) protocol defined in the conventional IETF tentative standard (draft-ietf-PPPext-eap-ttls-03.txt). An example of a dynamic key distribution method is shown, which is based on the contents of the provisional standard described in Non-Patent Document 2.

In FIG. 3, the terminal device 100B includes a wireless device 110, and has a function of performing communication based on the IEEE 802.11 standard via a wireless system and connecting to the authentication device 200A.
When the terminal device 100B requests authentication and dynamic key distribution from the authentication device 200A via the wireless system, after starting the EAP / TTLS 400 with the authentication device 200A, the terminal device 100B is connected to, for example, an HDD (not shown). The ID 200 is transmitted by the user's personal ID (Identifier) held in advance, and the password 210 is input from the keyboard 130, for example, so that the authentication request 410 to the authentication device 200A is obtained by the ID and the password. Is executed.

The authentication device 200A compares the transmitted ID and password with the ID and password data stored therein to detect a match / mismatch, notifies the terminal device 100B of the authentication result 320, and authenticates the authentication device 200A. Is obtained, the procedure of key distribution 330 for sending a dynamic key used for subsequent communication is performed.
As a result, in the data communication 340 performed between the terminal device 100B and the authentication device 200A, data encryption and decryption of the encrypted data are performed as shown in FIGS. This is the same as in the example shown in b).

In the case of the example shown in FIG. 3, a simple operation that does not require a certificate is possible. On the other hand, the data used for authentication is only the user ID and password. There is a problem that forgery and tampering are easily performed, and therefore security is not sufficiently maintained.
B. Aboba & D. Simon (Microsoft); Network Working Group, Requests for Comments: 2716, Category: Experimental, PPP EAP TLS Authentication Protocol, IETF, October 1999 Paul Funk (Funk Software inc.) & Simon Blake-Wilson (Basic Commerce & Industries inc.); PPPEXT Working Group, Internet-Draft, Category: Standard Track, draft-ietf-pppext-eap-ttls-03.txt, EAP Tunneled TLS Authentication Protocol (EAP-TTLS), IETF, August 2003

As described above, in the mobile terminal device authentication and dynamic key distribution method in which a procedure is performed according to the EAP / TLS protocol and a certificate is used for authentication, if the terminal device has certificate data, When the terminal device and the user do not correspond one-to-one, there is a problem that the management of the certificate including the identification of the user becomes difficult and the operation becomes difficult.
Further, when performing the authentication procedure by the EAP / TLS protocol, there is no such problem in the method of reading the certificate from the hardware token device instead of having the certificate data in the terminal device. There is a new problem that the device is expensive and security may not be ensured due to loss or theft of the hardware token device.
In addition, in the mobile terminal device authentication and dynamic key distribution method in which an authentication request is made using the user's personal ID and password by the EAP / TTLS protocol, the data used for the authentication is simple. There is a problem that data is easily counterfeited or falsified, and therefore security is not sufficiently maintained.

  The present invention has been made in view of the above-described circumstances, and has been proved in the procedure of mobile terminal device authentication and dynamic key distribution when data communication is performed by connecting to the authentication device via a wireless system. Propose a mobile terminal device authentication and dynamic key distribution method, and a mobile terminal device to which the method is applied, which allows easy operation without writing and makes it difficult to forge or tamper authentication data by eavesdropping The purpose is that.

  In order to solve the above-mentioned problem, the invention according to claim 1 relates to a mobile terminal device authentication and dynamic key distribution method, wherein the mobile terminal device is connected to an authentication device via a wireless system according to the EAP / TTLS protocol. Any one of the unique device unique information in the mobile terminal device is set as an ID (Identifier; hereinafter omitted), unique device unique information other than that used as the ID, and a PIN (Personal Identifier) designated by the user When an authentication request is made to the authentication device using the hash calculation result of “Number; omitted below” as a password, and the dynamic key is distributed by obtaining authentication from the authentication device, the dynamic key is used. It is characterized by performing data communication with the authentication device by performing encryption and decryption.

  The invention according to claim 2 relates to the mobile terminal device authentication and dynamic key distribution method according to claim 1, wherein the one device-specific information used as the ID is a wireless signal of the mobile terminal device. It is characterized by a physical address assigned to the device.

  According to a third aspect of the present invention, there is provided the mobile terminal device authentication and dynamic key distribution method according to the first or second aspect, wherein the device-specific information other than that used as the ID is the mobile terminal device. Is an Ethernet (registered trademark) device physical address and / or a serial number of an OS (Operating System; hereinafter omitted) in the mobile terminal device.

  According to a fourth aspect of the present invention, there is provided a mobile terminal apparatus, comprising a wireless device, and performing communication for authentication and dynamic key distribution with an authentication device via a wireless system according to an EAP / TTLS protocol. Calculation of a hash of a unique device-specific information other than the physical address of the wireless device and a PIN specified by the user, when the authentication request is issued to the authentication device, using the physical address of the wireless device as an ID When an authentication request is made to the authentication device with the result as a password, authentication is obtained from the authentication device and a dynamic key is distributed, encryption and decryption are performed using the dynamic key. The apparatus is configured to perform data communication with the authentication device.

  The invention described in claim 5 relates to the mobile terminal device described in claim 4, wherein the unique device unique information other than the physical address of the wireless device is an Ethernet device physical address and / or It is the serial number of the OS in the mobile terminal device.

  According to the mobile terminal device authentication and dynamic key distribution method of the present invention, it is possible to use the same mobile terminal device by a plurality of users without using a hardware token device, and a certificate. Authentication and dynamic key distribution method for mobile terminal devices that can be operated easily and without special costs for certificates, and forgery / falsification of authentication data by eavesdropping is difficult In addition, a mobile terminal device can be realized.

  The mobile terminal device is connected to the authentication device according to the EAP / TTLS protocol via the wireless system, and any one of the unique device specific information in the mobile terminal device is set as an ID, and the unique other than the ID is used as the ID When the authentication request is sent to the authentication device using the hash calculation result of the device-specific information and the PIN specified by the user as the password, the authentication device receives the authentication and the dynamic key is distributed. Encryption and decryption are performed using the dynamic key, and data communication is performed with the authentication device.

FIG. 1 is a diagram for explaining a mobile terminal device authentication and dynamic key distribution method according to an embodiment of the present invention.
In FIG. 1, a mobile terminal device 1 and an authentication device 2 are shown. The terminal device 1 has a schematic configuration including a wireless device 10, a hash calculation unit 11, an Ethernet device physical address 12, an OS serial number 13, and a user PIN.

  The wireless device 10 has a function of performing wireless communication with the authentication device 2 in accordance with the IEEE 802.11 standard, has a unique physical address unique to the device, and outputs this as an ID 20. The hash calculation unit 11 includes a physical address 12 assigned to the terminal device 1 as an Ethernet (Ethernet (registered trademark)) device, a serial number 13 included in an OS (Operating System), and a unique number designated by the user. A hash operation is performed from a certain PIN (Personal Identifier Number) 14 and, for example, a part is extracted from the operation result and output as a password 21.

  The authentication device 2 communicates with the terminal device 1 via a wireless system, performs authentication processing in response to an authentication request from the terminal device 1, notifies the terminal device 1 of the authentication result, and performs authentication. Is obtained, a dynamic key is distributed to the terminal device 1 and then data communication is performed with the terminal device 1. The authentication device 2 may separately have an authentication server for storing information of the counterpart terminal device, or may itself have all functions including the authentication server.

Hereinafter, the operation of each unit in the mobile terminal device authentication and dynamic key distribution method of this example will be described with reference to FIG.
When the terminal device 1 requests authentication and dynamic key distribution from the authentication device 2 via the wireless system, the terminal device 1 starts the EAP / TTLS 30 procedure with the authentication device 2, and then from the wireless device 10. The ID 20 and the password 21 from the hash calculator 11 are sent out, and an authentication request 31 is made to the authentication device 2.

  The authentication device 2 compares the transmitted ID and password with the ID and password data stored therein to detect a match / mismatch, and notifies the terminal device 1 of the authentication result 32. When authentication is obtained, a key distribution 33 procedure for sending a dynamic key used for subsequent communications is performed. The dynamic key is used for data encryption and decryption of the encrypted data in the data communication 34 performed between the terminal device 1 and the authentication device 2.

  As described above, in the mobile terminal device authentication and dynamic key distribution method of this example, an authentication request is made with an ID and a password in accordance with the EAP / TTLS protocol, so a certificate is required as in the case of the EAP / TLS protocol. Therefore, it is possible to easily operate, and it is not necessary to use a hardware token device even when a plurality of users use the same terminal device. At this time, the mobile terminal device is recorded on the authentication server as data that can uniquely identify the terminal called a physical address.

  Furthermore, when an authentication request is made with an ID and password according to the EAP / TTLS protocol, the physical address of the wireless device 10 that is unique device-specific information is used as an ID, and the Ethernet device physical address 12 of the terminal device 1 or the OS Since the hash value obtained by combining the unique device unique information such as the OS serial number 13 assigned to the user and the PIN 13 specified by the user is used as a password, it is difficult to forge / tamper by eavesdropping. There is an advantage that it is easy to hold.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and even if there is a design change or the like without departing from the gist of the present invention. Included in the invention. For example, the device unique information used as the ID is not limited to the physical address of the wireless device 10 and may be other unique device unique information. The unique device-specific information used as the password is not limited to the case where the combination of the Ethernet device physical address 12 of the terminal device 1 and the OS serial number 13 assigned to the OS is used. It may be used alone. Further, when there is unique device unique information other than the Ethernet device physical number and OS serial number of the terminal, it may be used in combination with the above data or alone.

  The mobile terminal device authentication and dynamic key distribution method according to the present invention is useful when a PC or PDA is connected to an authentication device. If it comes to have, it can be applied similarly.

It is a figure for demonstrating the authentication of a mobile terminal device and the dynamic key distribution method which are one Example of this invention. It is a figure which shows the example of the authentication of a mobile terminal device and the dynamic key distribution method using the conventional EAP / TLS protocol. It is a figure which shows the example of the authentication of a mobile terminal device, and the dynamic key distribution method using the conventional EAP / TTLS protocol.

Explanation of symbols

1 Terminal Device 2 Authentication Device 10 Wireless Device 11 Hash Calculation Unit 12 Ethernet Device Physical Address 13 OS Serial Number 14 User PIN

Claims (5)

  The mobile terminal device is connected to the authentication device according to the EAP / TTLS protocol via the wireless system, and any one of the unique device specific information in the mobile terminal device is set as an ID (Identifier; hereinafter omitted), An authentication request is made to the authentication device using a hash calculation result of unique device unique information other than that used and a PIN (Personal Identifier Number; hereinafter omitted) designated by the user as a password. When the mobile device receives authentication and receives a dynamic key, the mobile device performs encryption and decryption using the dynamic key, and performs data communication with the authentication device. Type terminal device authentication and dynamic key distribution method.   2. The mobile terminal device authentication and dynamic key distribution according to claim 1, wherein the one device-specific information used as the ID is a physical address assigned to a wireless device of the mobile terminal device. Method.   The device-specific information other than that used as the ID is an Ethernet (registered trademark) device physical address for the mobile terminal device and / or a serial number of an OS (Operating System; hereinafter omitted) in the mobile terminal device. The mobile terminal device authentication and dynamic key distribution method according to claim 1 or 2. A mobile terminal device that includes a wireless device and performs communication for authentication and dynamic key distribution with an authentication device via a wireless system according to an EAP / TTLS protocol,
When an authentication request is made to the authentication device, the physical device address is used as an ID, and a hash calculation result of unique device unique information other than the physical address of the wireless device and a PIN specified by a user is used as the password. When receiving an authentication request from the authentication device and receiving distribution of a dynamic key, performing encryption and decryption using the dynamic key, A mobile terminal device configured to perform data communication with each other. 5. The unique device unique information other than the physical address of the wireless device is an Ethernet device physical address for the mobile terminal device and / or an OS serial number in the mobile terminal device. Mobile terminal device.

Images