JP2015176156A - System and information processing apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a system configured to execute authentication processing with sufficient security, without requiring authentication processing that uses an electronic certificate, and to provide an information processing apparatus.SOLUTION: A system includes one or more terminals, and an information processing apparatus to be connected to the one or more terminals. The system includes a transmission control section at least. The transmission control section controls the information processing apparatus to transmit a program for generating authentication information which is to be used for authentication processing that determines whether the terminal has a specific authority or not, to a terminal to which the electronic certificate is to be distributed.

Description

  The present invention relates to a system and an information processing apparatus.

  In order for a terminal such as a smart device on the Internet to remotely access, for example, an in-house network (hereinafter sometimes referred to as an “intranet”), a VPN (Internet Virtual Private Network) is a virtual private network established via the Internet. Network) When the client software is used to perform authentication processing using an ID (user information for identifying a user) and a password and authentication is performed (when it is determined that the user has authority to access the intranet), access to the intranet It is common practice to allow

  In this case, if a third party can obtain an ID and a password, it becomes possible to access the intranet with an unspecified number of smart devices, which may cause an information leakage accident.

  In order to solve such problems, by installing an electronic certificate on the terminal, in addition to the authentication process by ID and password, the authentication process by the electronic certificate is added, and only to the terminal that passes all the authentication processes A technique is known that prevents access from an unspecified number of terminals by permitting access to an intranet. In addition, digital certificates are generally provided as an option of MDM (Master Data Management) service. By using MDM, distribution, expiration, and revocation of electronic certificates can be managed. Security can be maintained efficiently.

  However, in the prior art, in order to restrict the terminals that can access the intranet (terminals used by the user), a separate facility for executing authentication processing using an electronic certificate is prepared and authentication using an electronic certificate is performed. It was necessary to execute processing.

  The present invention has been made in view of the above, and provides a system and an information processing apparatus capable of executing authentication processing capable of sufficiently securing security without requiring authentication processing using an electronic certificate. Objective.

  In order to solve the above-described problems and achieve the object, the present invention is a system including one or more terminals and an information processing apparatus connectable to the terminals, wherein the information processing apparatus receives an electronic certificate. A transmission control unit that performs control for transmitting a program for generating authentication information used for authentication processing for determining whether or not the terminal has a specific authority to the terminal to be distributed is provided.

  ADVANTAGE OF THE INVENTION According to this invention, the authentication process which can fully ensure security is possible, without requiring the authentication process by an electronic certificate.

FIG. 1 is a block diagram illustrating a schematic configuration example of a system according to the embodiment. FIG. 2 is a diagram illustrating a functional configuration example of the MDM server according to the embodiment. FIG. 3 is a diagram illustrating a functional configuration example of the smart device according to the embodiment. FIG. 4 is a diagram for explaining an example of authentication information. FIG. 5 is a sequence diagram illustrating an example of an operation procedure of the system.

  Hereinafter, embodiments of a system and an information processing apparatus according to the present invention will be described in detail with reference to the accompanying drawings.

  FIG. 1 is a block diagram illustrating a schematic configuration example of a system 1 according to the present embodiment. As shown in FIG. 1, the system 1 includes at least one smart device 10 and an MDM server 20. The smart device 10 is a terminal owned by the user, and corresponds to a “terminal” in the claims.

  The MDM server 20 can be connected to one or more smart devices 10 via a first network (for example, a public communication network such as the Internet) 11. The MDM server 20 registers one or more smart devices 10 and performs device management from the first network 11. The MDM server 20 also has a function of distributing an electronic certificate to the smart device 10. In this example, the MDM server 20 corresponds to an “information processing apparatus” in the claims.

  FIG. 2 is a block diagram illustrating an example of a functional configuration of the MDM server 20. As illustrated in FIG. 2, the MDM server 20 includes a registration information storage unit 21, a distribution target determination unit 22, and a transmission control unit 23. 2 mainly illustrates the functions according to the present invention, but the functions of the MDM server 20 are not limited to these.

  In this embodiment, the hardware configuration of the MDM server 20 uses a hardware configuration of a normal computer including a CPU, a ROM, a RAM, and the like, and the CPU executes a program stored in the ROM or the like. Thus, the functions of the distribution target determining unit 22 and the transmission control unit 23 are realized. The registration information storage unit 21 can be realized by, for example, a ROM or an HDD.

  The registration information storage unit 21 stores at least correspondence information (e-mail address in this example) indicating contact information for each piece of device information (for example, a serial number) identifying one or more smart devices 10. The distribution target determining unit 22 transmits information for inquiring whether to receive the management service provided by the MDM server 20 using the mail address stored in the registration information storage unit 21. When the distribution target determining unit 22 receives information (response information) indicating that the management service is provided from the smart device 10, the electronic certificate issued by the MDM server 20 is issued to the smart device 10. And the electronic certificate is distributed to the determined smart device 10.

  The transmission control unit 23 sends the smart device 10 (smart device 10) to the smart device 10 that has been determined by the distribution target determination unit 22 as a target for distributing the electronic certificate (in other words, a management target by the MDM server 20). Control is performed to transmit a software token for generating authentication information used in an authentication process for determining whether or not a user possessing 10 has a specific authority. In this example, the software token corresponds to the “program” in the claims. In this example, the “specific authority” is an authority for the smart device 10 to connect to the second network 12 different from the first network 11. The second network 12 is an intranet such as an in-house network.

  FIG. 3 is a block diagram illustrating an example of a functional configuration of the smart device 10. As illustrated in FIG. 3, the smart device 10 includes a communication I / F 15 that is an interface for connecting to the first network 11, and an authentication control unit 16. In addition, in FIG. 3, although the function which concerns on this invention is mainly illustrated, the function which the smart device 10 has is not restricted to these. In the present embodiment, the hardware configuration of the smart device 10 uses a hardware configuration of a normal computer including a CPU, a ROM, a RAM, and the like. In this example, the function of the authentication control unit 16 is realized by the CPU of the smart device 10 executing a software token acquired (downloaded) from the MDM server 20 or a VPN connection software described later.

  The authentication control unit 16 controls the authentication server 30 described later to execute an authentication process using the authentication information. In this example, the authentication information is information indicating a character string derived from a random number table in which characters (including numbers, symbols, and the like) are irregularly arranged, and position setting information in which a position in the random number table is predetermined. . For example, in the random number table as shown in FIG. 4, when position setting information as indicated by “s” is set, a character string indicating “2922668” becomes authentication information. In the following description, the authentication information may be referred to as “password”. The location setting information is determined by the user of the smart device 10 that has downloaded the software token. The authentication control unit 16 has a function of transmitting the position setting information determined by the user to the authentication server 30 in advance.

  In addition, when the authentication control unit 16 causes the authentication server 30 to execute an authentication process, the authentication control unit 16 includes user information (ID) for identifying a user who uses the smart device 10, and requests random number table request information for requesting the above random number table. Is transmitted to the authentication server 30. The authentication control unit 16 has a function of generating authentication information from the random number table acquired from the authentication server 30 and preset position setting information and transmitting the generated authentication information to the authentication server 30. More specific contents will be described later.

  Returning to FIG. 1, the description will be continued. The system 1 of this embodiment includes an authentication server 30, a relay server 40, an application distribution server 50, a VPN device 60, and an in-house server 70 in addition to the smart device 10 and the MDM server 20. The authentication server 30 executes an authentication process for determining whether the smart device 10 has a specific authority. When the authentication server 30 registers one or more pieces of user information in advance and receives the above random number table request information from the smart device 10 (authentication control unit 16), the user information included in the received random number table request information If the user information held in advance matches, the random number table is transmitted to the smart device 10 (authentication control unit 16) that has transmitted the random number table request information. In this example, the authentication server 30 newly generates a random number table every time the random number table request information is received.

  In addition, the authentication server 30 receives the authentication information (password) derived from the position setting information received from the smart device 10 (authentication control unit 16) in advance and the random number table generated by itself, from the smart device 10 (authentication control). An authentication process for determining whether or not the authentication information from the unit 16) matches is executed. More specific contents will be described later.

  The relay server 40 is a server that relays communication between the smart device 10 and the MDM server 20. The application distribution server 50 is a server provided by a developer who has developed an OS (Operating System) of the smart device 10 such as Google or Apple, and distributes applications (applications for external sales) used in the smart device 10. The server that distributes the application is not limited to the application distribution server 50. For example, the relay server 40 and the MDM server 20 can also distribute the application.

  The VPN device 60 is a device serving as an entrance for connection (access) from the first network 11 to the second network 12. In this example, the VPN device 60 corresponds to “server device” in the claims. The VPN device 60 has a function of constructing a third network 13 interposed between the first network 11 and the second network 12. In this example, the smart device 10 can perform communication via the VPN device 60 from the existing first network 11 by installing and executing VPN connection software distributed from the application distribution server 50.

  The in-house server 70 shown in FIG. 1 is a device connected to the second network 12.

  FIG. 5 is a sequence diagram illustrating an example of an operation procedure of the system 1 according to the present embodiment. First, the MDM server 20 (distribution target determining unit 22) asks the smart device 10 whose e-mail address is registered in the registration information storage unit 21 to inquire whether or not to receive the management service provided by the MDM server 20. Transmit (step S1). This information is sent to the smart device 10 via the relay server 40 (step S2). When the user of the smart device 10 receiving this information desires to provide a management service by the MDM server 20, the smart device 10 desires to provide the management service by the MDM server 20 according to the operation of the user. Reply information indicating this is transmitted to the MDM server 20 via the relay server 40 (steps S3 and S4). The MDM server 20 (distribution target determining unit 22) that has received the response information determines the smart device 10 that has transmitted the response information as the distribution target of the electronic certificate, and sends the electronic certificate to the smart device 10. Is distributed (transmitted) (step S5). This electronic certificate is sent to the smart device 10 via the relay server 40 (step S6).

  Next, the smart device 10 that has received the digital certificate accesses the application distribution server 50 via the first network 11 and requests VPN connection software from the application distribution server 50 (step S7). Upon receiving this request, the application distribution server 50 distributes (transmits) VPN connection software to the smart device 10 (step S8).

  Next, the MDM server 20 (transmission control unit 23) transmits a software token to the smart device 10 that has been determined as an electronic certificate distribution target (step S9). This software token is sent to the smart device 10 via the relay server 40 (step S10). Next, the smart device 10 that has acquired the software token from the MDM server 20 activates the software token. The authentication control unit 16 realized by the smart device 10 executing the software token transmits the random number table request information described above to the authentication server 30 (step S11). Upon receiving the random number table request information from the smart device 10, the authentication server 30 newly generates a random number table. If the user information included in the random number table request information matches the user information held in advance by the authentication server 30, the authentication server 30 notifies the smart device 10 that has transmitted the random number table request information. On the other hand, the newly generated random number table is transmitted (step S12).

  The smart device 10 that has received the random number table of the authentication server 30 generates a character string derived from the received random number table and preset position setting information as authentication information (password). Then, the authentication control unit 16 realized by the smart device 10 executing the above-described VPN connection software transmits the generated authentication information and user information of the user who uses the smart device 10 to the VPN device 60. Transmit (step S13).

  The VPN device 60 transmits the authentication request information that includes the authentication information and the user information received from the smart device 10 and requests the execution of the authentication process to the authentication server 30 (step S14). Then, the authentication server 30 receives the authentication request information received from the VPN device 60 as the authentication information derived from the position setting information received from the smart device 10 (authentication control unit 16) in advance and the random number table generated by itself. The authentication process is executed to determine whether or not the user information included in the authentication request information matches the user information included in the authentication request information. As a result of the authentication process, when it is determined that the smart device 10 has specific authority (in this example, authority to connect to the second network 12) (when the smart device 10 is authenticated), the authentication server 30 Information indicating authentication is transmitted to the VPM device 60 (step S15). The VPN apparatus 60 transfers this information to the smart device 10 (step S16). Thereafter, the authenticated smart device 10 can be connected to the second network 12 from the existing first network 11 via the VPN device 60 (step S17).

  As described above, in the present embodiment, the MDM server 20 (transmission control unit 23) performs authentication used for authentication processing by the authentication server 30 only for the smart device 10 to which the electronic certificate is to be distributed. Control to send a software token for generating information (password). Accordingly, it is possible to achieve an advantageous effect that it is possible to realize an authentication process capable of sufficiently securing security without requiring an authentication process using an electronic certificate.

  As mentioned above, although embodiment of this invention was described, the above-mentioned embodiment is shown as an example and is not intending limiting the range of invention. The present invention is not limited to the above-described embodiments as they are, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the above-described embodiments. For example, some components may be deleted from all the components shown in the embodiment.

  The program executed by the system 1 described above is an installable or executable file and is read by a computer such as a CD-ROM, a flexible disk (FD), a CD-R, or a DVD (Digital Versatile Disk). You may comprise so that it may record on a possible recording medium and provide. Furthermore, the program executed in the system 1 described above may be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network. Further, the program executed by the system 1 may be provided or distributed via a network such as the Internet.

1 System 10 Smart Device 11 First Network 12 Second Network 13 Third Network 15 Communication I / F
16 Authentication control unit 20 MDM server 21 Registration information storage unit 22 Distribution target determination unit 23 Transmission control unit 30 Authentication server 40 Relay server 50 Application distribution server 60 VPN device 70 In-house server

JP 2013-77956 A

Claims (8)

A system comprising one or more terminals and an information processing apparatus connectable to the terminals,
The information processing apparatus transmits a program for generating authentication information used for authentication processing for determining whether or not the terminal has a specific authority to the terminal to which the electronic certificate is distributed. A transmission control unit for controlling,
system. The terminal that executes the program is:
An authentication control unit that performs control to execute the authentication process using the authentication information with respect to an authentication server that executes the authentication process;
The system of claim 1. The authentication information is information indicating a character string derived from a random number table in which characters are irregularly arranged, and position setting information in which a position in the random number table is predetermined.
The authentication control unit transmits the position setting information to the authentication server in advance.
The system according to claim 2. When the authentication control unit causes the authentication server to execute the authentication process, the authentication control unit includes user information for identifying a user who uses the terminal, and sends random number table request information for requesting the random number table to the authentication server. Send to
When the user information included in the random number table request information matches the user information held in advance, the authentication server sends the random number to the authentication control unit that has transmitted the random number table request information. Send table,
The system according to claim 3. The authentication control unit generates the authentication information from the random number table received from the authentication server and the position setting information, and transmits the generated authentication information to the authentication server.
The authentication server determines whether or not the authentication information derived from the location setting information received in advance from the authentication control unit and the random number table matches the authentication information from the authentication control unit. Performing the authentication process
The system according to claim 4. The specific authority is an authority to connect to a second network different from the first network to which the terminal can connect;
The authentication control unit is configured to connect the authentication information generated from the random number table received from the authentication server and the location setting information, and the user information from the first network to the second network. Send to the server device that becomes the entrance,
The server device includes the authentication information and the user information received from the authentication control unit, and transmits authentication request information for requesting execution of the authentication process to the authentication server.
The authentication server is
The position setting information received from the authentication control unit in advance and the authentication information derived from the random number table match the authentication information included in the authentication request information received from the server device, and Executing the authentication process for determining whether or not the user information included in the authentication request information matches the user information held in advance;
The system according to claim 5. The first network is a public communication network;
The second network is an intranet;
The system according to any one of claims 1 to 6. An information processing apparatus connectable to one or more terminals,
Transmission control for controlling transmission of a program for generating authentication information used for authentication processing for determining whether or not the terminal has a specific authority to the terminal to which an electronic certificate is to be distributed Comprising a part,
Information processing device.

Images