JP6451947B2 - Remote authentication system - Google Patents

Description

  The present invention relates to a technique for remotely managing the use of data stored in an encrypted state in a client terminal.

  With the spread of client terminals such as smartphones and tablet terminals, attention to BYOD (Bring Your Own Device) is increasing. BYOD means that an employee uses a private client terminal for business.

  By introducing BYOD, companies can benefit from reducing the costs associated with client terminals used in their work, and employees can use the client terminals they want to use in their work. However, the risk of leaking business data increases.

  As a measure to prevent business data leaks, it is often used to manage access from client terminals to servers on the corporate network and to encrypt business data exchanged between servers on the corporate network and client terminals. . For example, Patent Document 1 discloses an invention for limiting access to client terminals that satisfy a preset security policy as an invention for managing access to a server on a corporate network. ing. In addition, when encrypting business data exchanged between a server on a corporate network and a client terminal, as described in Patent Document 2, a shared encryption key is used between the server on the corporate network and the client terminal. Is common. The invention disclosed in Patent Document 2 uses a non-contact IC card for mutual authentication between a server and a client.

  In addition, as a measure to prevent the leakage of business data, in order to prevent the leakage of business data from the client terminal, the business data is encrypted and stored in the client terminal, and the business data stored in the client terminal in an encrypted state is stored. A method is also used in which a user who uses data is personally authenticated on the client terminal side so that only a legitimate user who is authorized to access business data can decrypt the encrypted business data. For example, in Patent Document 3, a biometric information reader is attached to a terminal device, and the biometric information of a user who is permitted to use the file is set in a file and encrypted, so that a user other than the user who has biometric information set. Discloses an invention in which this file cannot be decrypted. Note that it is common to use a password instead of biometric information as information for confirming a valid user.

JP 2014-187453 A JP 2009-140275 A JP 2008-217300 A

  However, if the client terminal is configured to authenticate users who use business data stored in an encrypted state on the client terminal, the client terminal can access the business data stored on the client terminal. The use of business data can be managed based on the verification result, but the company verifies the legitimacy of the user accessing the business data stored in the client terminal. The use of business data cannot be managed based on the results.

  Therefore, the present invention verifies the validity of the user accessing the encrypted data stored in the client terminal on the server side connected to the client terminal via the network, and based on the verification result, The purpose is to be able to manage usage.

A remote authentication system according to the present invention that solves the above-described problems includes a client terminal in which an encrypted file system is constructed, an authentication device that stores a mount key necessary for mounting the encrypted file system, and the encryption And at least a remote authentication server for remotely authenticating a user who uses the computerized file system.
In the present invention, the client terminal includes a reader / writer unit that performs data communication with the authentication device, and a client management unit that executes a process of mounting the encrypted file system using the mount key. The client management unit includes: When the user inputs a PIN, the authentication device is requested to verify the PIN, and when the authentication device is notified that the PIN has been successfully verified, after requesting the personal authentication from the remote authentication server, The reader / writer unit is used to relay communication between the remote authentication server and the authentication device, and when the completion of personal authentication is notified from the remote authentication server, the reader / writer unit is used. Requesting the authentication device to read the mount key, and sending the mount key from the authentication device. If the bets key was sent, that perform processing for mounting the encrypted file system using the mount key.
Further, in the present invention, when personal authentication is requested from the client terminal, the remote authentication server communicates with the authentication device via the client terminal and performs mutual authentication with the authentication device as personal authentication. And an access right determination process that refers to a security policy relating to the use of the encrypted file system and at least determines whether or not a user possessing the authentication device has an access right to the encrypted file system. After the execution, the personal authentication result reflecting the result of the mutual authentication and the access right determination process is notified to the authentication device. When the authentication device is notified that the personal authentication result has been received , A remote authentication unit for notifying the client terminal of completion is provided.
In the present invention, the authentication device collates the PIN transmitted from the client terminal, and performs mutual authentication between the PIN verification unit that notifies the client terminal of the PIN verification result and the remote authentication server. When the mutual authentication unit to be executed, the data reading unit that reads the mount key and transmits it to the client terminal, and receives the mount key read request from the client terminal, the PIN is successfully verified, and the remote A security management unit that activates the data reading unit and permits the data reading unit to transmit the mount key only when the personal authentication result notified from the authentication server indicates successful personal authentication.

  According to the present invention described above, on the server side connected to the client terminal via the network, the validity of the user accessing the encrypted data stored in the client terminal is verified, and the encryption is performed based on the verification result. Manage data usage.

The figure explaining the structure of the remote authentication system which concerns on this embodiment. The block diagram of the remote authentication system which concerns on this embodiment. The figure explaining operation | movement of the remote authentication system which concerns on this embodiment.

  From here, preferred embodiments of the present invention will be described. The following description is not intended to limit the technical scope of the present invention, but is provided to aid understanding.

  FIG. 1 is a diagram illustrating a configuration of a remote authentication system 1 according to the present embodiment, FIG. 2 is a block diagram of the remote authentication system 1 according to the present embodiment, and an operation of the remote authentication system 1 according to the present embodiment. It is a figure to do.

  The remote authentication system 1 according to this embodiment includes a client terminal 2 in which an encrypted file system 21 is constructed in a physical storage, and an authentication device 3 possessed by a user who is permitted to use the encrypted file system 21 (in FIG. 1). , Shown as an IC card) and a remote authentication server 4 that personally authenticates a user who uses the encrypted file system 21, and only when the remote authentication server 4 succeeds in personal authentication using the authentication device 3. The encrypted file system 21 constructed in the physical storage of the client terminal 2 is permitted to be used.

  When the remote authentication system 1 according to the present embodiment is applied to BYOD, the client terminal 2 according to the present embodiment is a mobile terminal possessed by a company employee, and the authentication device 3 according to the present embodiment is It becomes an IC card employee card possessed by a company employee, and the personal remote authentication server 4 according to this embodiment is a business server installed in the company network. Further, the encrypted file system 21 provided in the client terminal 2 can be used as a data area for business applications, can store business applications in the encrypted file system 21, and is connected to a corporate network. The encrypted file system 21 can be used as a temporary area that is valid only during the period.

  Further, the remote authentication system 1 according to the present embodiment can be applied not only to BYOD but also to work from home. When the remote authentication system 1 according to the present embodiment is applied to telecommuting, the authentication device 3 according to the present embodiment becomes a contact type IC card employee ID card possessed by a company employee. The client terminal 2 is a personal computer installed at a company employee's home and connected to a contact reader / writer.

  The client terminal 2 constituting the remote authentication system 1 according to the present embodiment means a computer device that can be easily carried by a user, such as a smartphone, a tablet terminal, or a netbook. As illustrated in FIG. The client terminal 2 according to the embodiment includes a processor 2a, an NVM (Nonvolatile Memory) 2b, an NFC (Near Field Communication) module 2c, and a network I / F (InterFace) 2d. In FIG. 2, a RAM (Random Access Memory) is further provided. 2e and a touch panel 2f with a display.

  The NVM 2 b included in the client terminal 2 is an electrically rewritable nonvolatile memory that is a memory serving as a physical storage of the client terminal 2. In the present embodiment, the encrypted file system 21 is constructed in a partial area of the NVM 2b included in the client terminal 2.

  The NFC module 2c included in the client terminal 2 is an IC module including an MPU (Microprocessor) and a CLF (Contact-Less Frontend) that demodulates and modulates radio waves used for short-range wireless communication. According to the NFC standard, the NFC module 2c is compatible with a reader / writer mode that operates as a reader / writer device for a non-contact IC card. Therefore, in this embodiment, the client terminal 2 that performs data communication with the authentication device 3 is used. The reader / writer unit is realized by the NFC module 2c. The reader / writer unit of the client terminal 2 can be realized by connecting a reader / writer device to an input / output port (for example, a USB interface) of the client terminal 2, and the USB interface of the client terminal 2 is connected to the client terminal 2. It can also be used for a reader / writer unit.

  The network I / F 2d included in the client terminal 2 includes a circuit necessary for network communication, and the client terminal 2 performs network communication with the remote authentication server 4 using the network I / F 2d. A specific form of the network I / F 2d depends on a place where the use of the encrypted file system 21 constructed in the client terminal 2 is permitted. For example, if the encrypted file system 21 of the client terminal 2 can be used outside, a communication module for mobile communication is used as the network I / F 2d. Further, if the encrypted file system 21 of the client terminal 2 can be used only within the company, a wireless communication module (for example, Wi-Fi) is used as the network I / F 2d.

  The processor 2a included in the client terminal 2 is an IC module that controls the client terminal 2, and includes a multi-core CPU (Central Processing Unit), a GPU (Graphics Processing Unit), and the like. The client terminal 2 includes a client management unit 20 that manages the mounting of the encrypted file system 21 created in the NVM 2b as a function realized by a computer program that operates the processor 2a, and the computer program functions as the client management unit 20 Is stored in the area of the NVM 2b that is not used by the encrypted file system 21.

  The authentication device 3 according to the present embodiment includes a communication interface 3a that performs data communication with an external device, an NVM 3c that stores data, and a CPU (Central Processing Unit) 3b that executes operations necessary for mutual authentication. Thus, in addition to the IC card, the USB key can be used for the authentication device 3.

  The communication interface 3a included in the authentication device 3 is an interface corresponding to the reader / writer unit of the client terminal 2, and in this embodiment, the reader / writer unit of the client terminal 2 is realized by the NFC module 2c. The communication interface 3a of the authentication device 3 according to this is a short-range wireless communication interface. When the authentication device 3 is a USB key, the communication interface 3a included in the authentication device 3 is a USB interface.

  In addition, the NVM 3c of the authentication device 3 according to the present embodiment includes a device secret key 34 that is a secret key of the authentication device 3 as a cryptographic key for mutual authentication used for mutual authentication with the remote authentication server 4, and remote authentication. A server public key 35, which is a public key of the server 4, is stored. Further, a user ID 36 assigned to a user possessing the authentication device 3, a reference PIN (Personal Identification Number) 37 of the user possessing the authentication device 3, A mount key 38 that is data necessary for mounting the encrypted file system 21 is stored.

  Further, as a function realized by a computer program for operating the CPU 3b of the authentication device 3, the authentication device 3 transmits a PIN verification unit 33 for verifying the PIN input to the authentication device 3 and data designated by an external device. Whether or not to transmit the mount key 38 stored in the authentication device 3 as security management of the authentication device 3 and the mutual authentication unit 30 that executes processing related to mutual authentication between the data reading unit 34 and the remote authentication server 4 The security management part 31 which controls is provided.

  The PIN verification unit 33 of the authentication device 3 is realized by a command for verifying the PIN (for example, VERIFY command), and the data reading unit 34 of the authentication device 3 is realized by a command for reading data (for example, READ BINARY command). The mutual authentication unit 30 of the authentication device 3 is realized by one or a plurality of commands (for example, EXTERNAL AUTHENTICATE command and INTERNAL AUTHENTICATE command) used for mutual authentication. The security management unit 31 of the authentication device 3 functions as an operating system that operates on the authentication device 3.

  Next, the remote authentication server 4 will be described. The remote authentication server 4 is provided so that a user who uses the encrypted file system 21 constructed in the client terminal 2 can be personally authenticated, and only the user who has succeeded in personal authentication can permit the encrypted file system 21. As shown in FIG. 2, the remote authentication server 4 according to the present embodiment includes a processor 4a, a data storage device 4b, and a network I / F 4c. In FIG. 2, the server further includes a RAM 4d.

  The processor 4a included in the remote authentication server 4 is an IC module that controls the remote authentication server 4, and includes a multi-core CPU (Central Processing Unit) and a GPU (Graphics Processing Unit). The data storage device 4b included in the remote authentication server 4 is a device capable of storing data, and is an electrically rewritable nonvolatile memory or hard disk. The network I / F 4c included in the remote authentication server 4 is an interface used when the remote authentication server 4 performs network communication. The remote authentication server 4 performs network communication with the client terminal 2 using the network I / F 4c.

  The remote authentication server 4 according to the present embodiment includes a remote authentication unit 40 that remotely authenticates a user who uses the encrypted file system 21 of the client terminal 2 as a function realized by a computer program that operates the processor 4a. The data storage device 4b included in the remote authentication server 4 includes a computer program that functions as the remote authentication unit 40 and a user who is permitted to use the encrypted file system 21 of the client terminal 2 as data used by the remote authentication unit 40. A security policy 43 that includes at least authorization conditions for use of the encrypted file system 21 and a device public key that is a public key of the authentication device 3 as an encryption key used for mutual authentication with the authentication device 3 41 and remote The server secret key 42 which is the secret key of the authentication server 4 is stored. The device public key 41 is associated with the user ID 36 of the user who has the authentication device 3 corresponding to the device public key 41.

  From here, referring to FIG. 3, while explaining the operation of the remote authentication system 1 according to the present embodiment, the authentication device 3, the client terminal 2, and the remote authentication server 4 constituting the remote authentication system 1 according to the present embodiment. Will be described in detail.

  When using the encrypted file system 21 constructed in the NVM 2 b of the client terminal 2, the user of the client terminal 2 taps an icon corresponding to the client management unit 20 of the client terminal 2. By executing an operation for starting the management unit 20, the client management unit 20 of the client terminal 2 is started on the client terminal 2 (S1).

  When the client management unit 20 of the client terminal 2 is started on the client terminal 2, the NFC module 2c of the client terminal 2 is operated in the reader / writer mode, and when the NFC module 2c detects the authentication device 3, the PIN is given to the user. After the screen to be input is displayed on the touch panel, the authentication device 3 is requested to verify the PIN input by the user using the touch panel (S2).

  When the authentication device 3 receives the PIN verification request, the PIN verification unit 33 of the authentication device 3 operates, and the PIN verification unit 33 of the authentication device 3 transmits the reference PIN 37 stored in the authentication device 3 and the client terminal 2. The entered PIN is collated (S3).

  The security management unit 31 of the authentication device 3 holds the completion result of the process related to the transmission of the mount key 38, and determines whether the mount key 38 stored in the authentication device 3 can be transmitted based on the completion result of the process. In this example, the PIN verification result is held in a volatile memory (not shown) of the authentication device 3 as one of the results of completion of the process related to the transmission of the mount key 38 (S4). The authentication device 3 transmits the PIN verification result to the NFC module 2c of the client terminal 2 (S5).

  When the NFC module 2c of the client terminal 2 receives the PIN verification result, the client management unit 20 of the client terminal 2 confirms the PIN verification result received from the authentication device 3 by the NFC module 2c, indicating that the PIN verification is successful. Only when the personal authentication request is transmitted to the remote authentication server 4, only the communication between the remote authentication server 4 and the authentication device 3 is relayed (S6). The client terminal 2 relays communication between the remote authentication server 4 and the authentication device 3 by transmitting data received from the remote authentication server 4 via the network 5 to the authentication device 3 using the NFC module 2c. This means that data received from the authentication device 3 using the NFC module 2 c is transmitted to the remote authentication server 4 via the network 5.

  When the remote authentication server 4 receives the personal authentication request, the remote authentication unit 40 of the remote authentication server 4 operates, and the remote authentication unit 40 of the remote authentication server 4 first performs the encrypted file system 21 as a process related to personal authentication. In order to verify whether the user using the device possesses a valid authentication device 3, the user communicates with the authentication device 3 via the client terminal 2 and executes mutual authentication with the authentication device 3 (S 7).

  In this embodiment, as mutual authentication (S7) between the authentication device 3 and the remote authentication server 4, the remote authentication server 4 verifies the authenticity of the authentication device 3 that is the mutual authentication destination, that is, the user possessing the authentication device 3, that is, , Device authentication for identifying a user who uses the encrypted file system 21 of the client terminal 2 (S70), the authentication device 3 verifies the authenticity of the remote authentication server 4 that is the mutual authentication destination, and the authentication device 3 is the mutual authentication destination. Server authentication (S71) is performed to confirm the above.

  In the device authentication (S70), first, the remote authentication unit 40 of the remote authentication server 4 transmits the random number A generated by the remote authentication unit 40 of the remote authentication server 4 to the authentication device 3, and the authentication device 3 uses the device secret key 34. The ciphertext of the random number A encrypted by using the authentication device 3 and the user ID 36 stored in the authentication device 3 are acquired from the authentication device 3. Next, the remote authentication unit 40 of the remote authentication server 4 decrypts the ciphertext of the random number A acquired from the authentication device 3 by using the device public key 41 corresponding to the user ID 36 acquired from the authentication device 3, and the authentication device 3, the authenticity of the authentication device 3 is verified by confirming whether or not the decryption result of the ciphertext of the random number A acquired from 3 matches the random number A.

  In server authentication (S71), the remote authentication unit 40 of the remote authentication server 4 receives the random number B generated by the authentication device 3, and then authenticates the ciphertext of the random number B encrypted using the server private key 42. The mutual authentication unit 30 of the authentication device 3 decrypts the ciphertext of the random number B using the server public key 35 and decrypts the random number B and the ciphertext of the random number B transmitted to the remote authentication server 4. By confirming whether the results match, the validity of the remote authentication server 4 is verified, and the validity verification result of the remote authentication server 4 is transmitted to the remote authentication server 4. The timing at which the authentication device 3 transmits the random number B to the remote authentication server 4 may be when the ciphertext of the random number A is transmitted to the remote authentication server 4 in the device authentication (S70). It may be when a random number generation is requested.

  When the remote authentication unit 40 of the remote authentication server 4 completes the mutual authentication with the authentication device 3, the user specified by the user ID 36 acquired by the authentication device 3 by the mutual authentication has the right to access the encrypted file system 21. Is executed to determine whether or not the user is given (S8). When determining whether or not the user specified by the user ID 36 obtained by the mutual authentication is a user who has been given access rights to the encrypted file system 21, the remote authentication unit 40 of the remote authentication server 4 first The remote authentication server 4 confirms whether or not the user ID 36 obtained by the mutual authentication is included in the security policy 43, so that the user specified by the user ID 36 obtained by the mutual authentication is the encrypted file system 21. After identifying whether the user is permitted to use the encrypted file system 21, if the user is permitted to use the encrypted file system 21, it is confirmed whether all the authorization conditions described in the security policy 43 are satisfied. If all of the above are satisfied, it is determined that the user is given the access right to the encrypted file system 21. Authorization conditions described in the security policy 43 may be set arbitrarily. For example, the user can include common authorization conditions in the security policy 43 such as a time zone and a day of the week when the use of the encrypted file system 21 is permitted. In addition, the user can include individual authorization conditions in the security policy 43, such as a limited role assignment by shift or turn system, or a change in office system due to personnel changes.

After confirming the access right given to the user, the remote authentication unit 40 of the remote authentication server 4 notifies the authentication device 3 of the personal authentication result via the client terminal 2 (S9). A user who has succeeded in mutual authentication (device authentication and server authentication) between the authentication device 3 and the remote authentication server 4 and who is specified by the user ID 36 obtained by the mutual authentication has the right to access the encrypted file system 21. In the case of a given user, the personal authentication result transmitted to the client terminal 2 is successful, and otherwise it is a failure. In the present embodiment, by adding a digital signature generated by the server secret key 4 2 to the personal authentication result.

Security management unit 31 of the authentication device 3, when the personal authentication result is notified from the remote authentication server 4, using the server's public key 35, the personal authentication result is added the to verify the digital signature, digital signature verification If successful, the personal authentication result is held in a volatile memory (not shown) of the authentication device 3 as one of the results of completion of the process related to the transmission of the mount key 38 (S10). The remote authentication server 4 is notified through the terminal 2 that the personal authentication result has been received (S11).

  When the remote authentication unit 40 of the remote authentication server 4 is notified from the authentication device 3 that the personal authentication result has been received, the remote authentication unit 40 notifies the client management unit 20 of the client terminal 2 that the personal authentication result has been completed (S12). . When the remote authentication server 4 is notified that the personal authentication result is completed, the client management unit 20 of the client terminal 2 designates the data to be read as the mount key 38, thereby reading the mount key 38 to the authentication device 3. A request is made (S13).

  When the data read request is received, the security management unit 31 of the authentication device 3 refers to the result of completion of the process related to the transmission of the mount key 38 and only when the condition for enabling the mount key 38 is satisfied. The data reading unit 34 is allowed to operate (S14), and the data reading unit 34 transmits the mount key 38 to the NFC module 2c of the client terminal 2 (S15). In the present embodiment, the conditions that allow the mount key 38 to be transmitted are successful PIN verification and successful personal authentication.

  When the NFC module 2c of the client terminal 2 receives the mount key 38 from the authentication device 3, the client management unit 20 of the client terminal 2 mounts the encrypted file system 21 using the mount key 38 (S16). The procedure ends.

  Thus, according to the remote authentication system 1 according to the present embodiment, the remote authentication server 4 has an authentication device 3 possessed by a user who accesses the encrypted file system 21 built in the client terminal 2 as personal authentication. In addition, the access authority to the encrypted file system 21 is given by determining whether or not this user is a legitimate user who is given the access authority to the encrypted file system 21. Whether the user is a valid user is verified on the remote authentication server 4 side. Further, the authentication device 3 that stores the mount key 38 necessary for mounting the encrypted file system 21 cannot read the mount key 38 from the authentication device 3 unless the remote authentication server 4 notifies the success of the personal authentication. Thus, on the remote authentication server 4 side, the use of the encrypted file system 21 constructed in the client terminal 2 can be managed remotely.

DESCRIPTION OF SYMBOLS 1 Remote authentication system 2 Client terminal 2c NFC module 20 Client management part 21 Encrypted file system 3 Authentication device 30 Mutual authentication part 31 Security management part 33 PIN verification part 34 Data reading part 38 Mount key 4 Remote authentication server 40 Remote authentication part 43 Security policy

Claims (1)

A client terminal on which an encrypted file system is constructed, an authentication device storing a mount key necessary for mounting the encrypted file system, and remote authentication for remotely authenticating a user who uses the encrypted file system A server and at least
The client terminal includes a reader / writer unit that performs data communication with the authentication device, and a client management unit that executes a process of mounting the encrypted file system using the mount key. Is input to the authentication device, and when the authentication device is notified that the PIN verification is successful , the reader / writer unit requests the remote authentication server for personal authentication. Is used to relay the communication between the remote authentication server and the authentication device, and when the completion of personal authentication is notified from the remote authentication server, the reader / writer unit is used to Is requested to the authentication device, and the mount key is transmitted from the authentication device. If executes a process of mounting the encrypted file system using the mount key,
The remote authentication server, when the personal authentication is requested from the client terminal, as a personal authentication, communicates with the authentication device via the client terminal, executes the authentication device mutual authentication, further, the cryptographic After referring to the security policy related to the use of the encrypted file system and executing the access right determination process for determining at least whether the user possessing the authentication device has the access right to the encrypted file system, mutual authentication is performed. The personal authentication result reflecting the result of the access right and the result of the access right determination process is notified to the authentication device. When the authentication device notifies that the personal authentication result has been received, the completion of the personal authentication is notified to the client terminal. A remote authentication unit to notify
The authentication device collates the PIN transmitted from the client terminal and notifies the client terminal of the PIN collation result; a mutual authentication unit that performs mutual authentication with the remote authentication server; , A data reading unit that reads the mount key and transmits it to the client terminal, and upon receiving the mount key read request from the client terminal, the PIN is successfully verified and notified from the remote authentication server A security management unit that activates the data reading unit only when the personal authentication result indicates successful personal authentication, and permits the data reading unit to transmit the mount key;
A remote authentication system.

Images