JPH1185700A - Device and method for authentication of transmission source - Google Patents

Abstract

PROBLEM TO BE SOLVED: To guarantee a conventional operating style and to block illegal access by providing a calculation part for outputting a signal for setting a flag when a prescribed value is counted by the output of a password collation part and a connection control part for controlling the start of communication with the transmission source. SOLUTION: A password collation part 5 collates a received password(PW) and a PW 4-2 registered in a registration part 4. In the case of non-coincidence as a result, a step signal is outputted to a count part 6, and a reception part 1 waits the re-reception of transmission source recognition data. Each time there is an output from the password collation part 5, the count part 6 is stepped by '1' and when the prescribed value is counted, a relevant (f) 4-4 in the registration part 4 is set by its output. A connection control part 7 recognizes the state of that (f),4-4 and when it is set to ON, the presence of access caused by an incoorrect PW is reported to the transmission source. Then, the flag is reset to OFF and the following regular communication procedure is executed.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to authentication of a transmission source in a network environment such as personal computer communication and the Internet.

[0002]

2. Description of the Related Art In an environment where an unspecified number of clients such as a personal computer communication and the Internet are connected, user identification information (user ID) and a password are used together to protect data and prevent unauthorized access to a paid service. Source authentication is being performed. However, user I
Programs that continuously transmit similar passwords inferred in connection with D have been secretly developed and used, and password breakage due to this has been widespread. To prevent this, it has been required to strengthen authentication methods. I have.

In order to prevent such password theft, it is recommended to increase the number of characters in the password, to recommend the use of alphabets and special symbols for the character type of the character string of the password which has been limited to only numbers, or to specify an unspecified period. For example, the password is updated every time. As a part of this strengthening measure, an authentication method using a combination of a user ID, a password, and a network address (line address, telephone number, etc.) as disclosed in Japanese Patent Application Laid-Open No. 63-253450, for example, has been proposed. Proposed.

[0004]

However, the above-mentioned method of increasing the number of password characters, a method of recommending a mixture of alphabet characters and special characters for the password character type, and updating of the password every unspecified period are not necessarily fundamental. It is not a preventive measure. Furthermore, in the authentication disclosed in the above-mentioned Japanese Patent Application Laid-Open No. 63-253450, which requires the combination of three users, "user ID / password / network address", a portable terminal (portable network terminal) is required. In recent years when the spread has become remarkable, if the registered user has more than one terminal including the mobile terminal, if the registered user wants to use the network on the go while carrying the mobile terminal on a business trip etc. However, since the network address (line address, telephone number, etc.) is different each time, there is a problem that the use of the network is restricted.

SUMMARY OF THE INVENTION In view of the foregoing, an object of the present invention is to provide a new network authentication method that can guarantee a conventional operation mode and prevent unauthorized access in a network environment.

[0006]

The above-mentioned object is achieved by the present invention constructed as shown in FIG. FIG. 1 is a block diagram showing the principle of the present invention. In the figure, 1 is a receiving unit, 2 is a flag inquiry unit, 3 is a network address collating unit, 4 is a registration unit, 4-1 is ID (user authentication information),
4-2, PW (password), 4-3, NWA (network address), 4-4, f (flag), 5 a password collating unit, 6 a counting unit, and 7 a connection control unit. .

In the above configuration, the sender authentication data is received by the receiver 1 including at least the user identification information (user ID) and the password (PW), and the sender's network address (NWA) is used alone or in advance. Receive with both parties.

[0008] The f (flag) 4-4 holds the correct / incorrect state (on / off) of the authentication data received for each source authentication data registered in the registration unit 4, and the flag inquiry unit 2 An inquiry is made to f4-4 corresponding to the transmitted sender authentication data. When the f4-4 is set to ON, the network address collating unit 3 is activated, and when it is reset to OFF, the password collating unit 5 is activated.

[0009] The network address collating unit 3 receives the received network address NWA and the NW registered in the registration unit 4.
A (network address) 4-3 is checked. As a result, if they do not match, a reception prohibition signal is output to the receiving unit 1, and if they match, the password matching unit 5 is activated.

The password collating unit 5 collates the received password PW with the PW (password) 4-2 registered in the registration unit 4. As a result, if they do not match, a stepping signal is output to the counting unit 6 and the receiving unit 1 is made to wait for re-receiving of the sender authentication data.

The counting section 6 advances by one every time there is an output from the password collating section 5, outputs it when a predetermined value is counted, and sets the corresponding f4-4 of the registration section 4. Connection control unit 7
Confirms the state of f4-4, and if set to on, notifies that the source has been accessed by an incorrect password, resets it to off, and performs the normal communication procedure thereafter.

[0012]

Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 4 is a functional block configuration diagram according to the embodiment of the present invention. In the figure, 10
Reference numeral 0 denotes a personal computer serving as a sender, 101 denotes user authentication information (hereinafter abbreviated as ID) forming source authentication data, and 102 denotes a password (hereinafter abbreviated as PW) forming source authentication data. ), 103 is a network address forming source authentication data (hereinafter, NW
A), 300 is a public line, 200 is a communication center, 10 is a receiving function unit, 40 is a registration table,
Details will be described with reference to FIG.

That is, FIG. 3 is an explanatory view of a registration table. Reference numeral 40 denotes a registration table. In each row of the registration table 40, a first column is a user authentication column, which is abbreviated as ID41. A code consisting of alphanumeric characters.
The second column is a password column, which is abbreviated as PW42, and is, for example, a code composed of alphanumeric characters including special codes of at least 4 digits and at most 10 digits. Incidentally, the password on the first line is “10 digits”, and the password on the third line is “4”.
The “digit” and the password in the last line are “eight digits”, but due to the nature of the password, the description in this specification is replaced with “?” As a hidden character.

The next third column is a network address column, which is abbreviated as NWA 43 and uses, for example, a telephone number, and the fourth column is a status column for forming a flag, which is abbreviated as f44. , Hold the on or off state. The next fifth column is an error type 45 indicating the cause of f44 being turned on.

In the example shown in FIG. 3, the 4-digit “????” and the ID 41 are “EFGH567” as the PW 42.
The second line having "8" records that there was an abnormal access, and the date and time at that time and the telephone number of the caller are recorded.

FIG. 4 is a functional block diagram according to the embodiment, which will be described together with an explanatory diagram of the registration table of FIG. 3 and a flowchart of FIG.

In FIG. 4, when the personal computer 100 accesses the communication center 200 via the public line 300, an ID (user authentication information) 101 is transmitted together with a PW (password) 102. At this time, the NWA (network address) 103 is sent out simultaneously with these,
Alternatively, it is separately transmitted in response to a request from the communication center 200.

The communication center 200 stores the ID 101 and P
W102 is received by the receiving function unit 10, and the authentication program 5
0 and checks the registration with the registration table 40 (FIG. 3) with the sender authentication data registered, and requests the personal computer 10 to connect.
It is determined whether the source authentication data from 0 is normal or abnormal.

The detailed operation of the authentication program 50 (FIG. 4) will be described with reference to FIG. That is, FIG. 2 is a flowchart illustrating the authentication process. In FIG. 2, step S1: source authentication data is received via line 300. The sender authentication data at this time is “ID101 +
PW102 "or" ID101 + PW102 + NWA "
103 ”(see the personal computer 100 in FIG. 4).

Step S2: registration table 40 (FIG. 3)
Search for ID41 that matches the received ID101 within
The state of f44 is confirmed in the corresponding row of ID41. Here, if f44 is set to ON, it means that an abnormal connection request was issued before the current connection request.
It branches to step S3. Alternatively, if f44 is off, there is no abnormal connection request before the current connection request, and the process branches to step S5.

Step S3: If the NWA 103 (network address) is not included in the source authentication data received this time, the transmission is requested again and the NWA 103 is received. Next, the NWA 103 is checked with the NWA 43 (telephone number) in the row of the corresponding ID 41 in the registration table 40, and if they match, the process branches to step S5, and if they do not match, the process branches to step S4 to notify access prohibition. In addition, perform the procedure for disconnecting the line.

Step S5: The PW 102 contained in the source authentication data received this time is confirmed by the PW 42 in the row of the corresponding ID 41 in the registration table 40, and if they match, the process branches to step S11; It branches to step S6.

Step S6: Since step S5 may have gone through step S3, this is confirmed. Therefore, the state of f44 is confirmed again in the row of the corresponding ID 41 in the registration table 40. Here, if f44 is set to ON, it means that the process has gone through step S3, and the process branches to step S10. Or f4
If 4 is off, the process branches to step S7.

Step S7: Although an abnormal connection request was made before the current connection request, the connection request is counted as being within the allowable number of reconnection requests, and then, at step S8, a predetermined value (for example, up to three times in succession) is set. Until it reaches, the process branches to step S1 to accept the connection request again, and when it reaches the predetermined value, it branches to step S9.

Step S9: The f44 in the row of the corresponding ID 41 in the registration table 40 is set to ON, the counter is reset to zero, and the flow branches to step S10. Step S10: An authentication error is notified to the transmission source personal computer 100 requesting the current connection, and the line disconnection procedure is performed.

Step S11: Since step S5 may have gone through step S3, this is confirmed. Therefore, the state of f44 is confirmed again in the row of the corresponding ID 41 in the registration table 40. Here, if f44 is set to ON, it means that the process has gone through step S3, and the process branches to step S12. Or f
If 44 is off, the process branches to step S13.

Step S12: The personal computer 100, which has requested the current connection, is notified that there was an abnormal connection request before the current connection request and that an authentication error has occurred. Branch to

Step S13: The f44 in the row of the corresponding ID 41 in the registration table 40 is reset to off, and the procedure for starting communication is performed. Further, a network address (NWA) to be used together may be set to a specific telephone number or the like for each user, and a specific service function may be used when the network address is used together.

The authentication program 50 may be provided from outside the system, that is, loaded with the program via a line, or provided on a portable medium such as a floppy disk or a CD-ROM.

FIG. 5 is an explanatory diagram for loading this computer program into the system. In the figure, reference numeral 901 denotes a processing device; 902, a display provided in the processing device; 903, a driver for reading a computer program recorded on a floppy disk; 904, a memory of the processing device 901; 905, a floppy disk or CD. A portable medium such as a ROM, 906 is another device which is a provider of the computer program, 907
Indicates a line.

As shown in the figure, when the computer program is provided from another processing device 906 connected online such as a network, the computer program is installed in the processing device 901 via a line 907 and then loaded into the memory 904. Be executed. In the case where the portable medium 905 is provided directly by the portable medium 905, the portable medium 905
After installing on the processing device 901,
The program is loaded into the memory 904 and executed.

[0032]

As described in detail above, according to the present invention, it is possible to make password breakage virtually impossible while guaranteeing the conventional operation compatibility. Alternatively, by using a network address together with a password, it is easy to confirm the source even for unauthorized access by a hacker or the like, and a useful means for crime prevention can be provided. Therefore, there is an extraordinary effect that it greatly contributes to the operation and reliability improvement of network computing.

[Brief description of the drawings]

FIG. 1 is a principle configuration diagram according to claim 1;

FIG. 2 is a flowchart illustrating an authentication process.

FIG. 3 is an explanatory diagram of a registration table.

FIG. 4 is a functional block configuration diagram in the embodiment.

FIG. 5 is an explanatory diagram for loading a program into a system.

[Description of Signs] 1 reception unit 2 flag inquiry unit 3 network address collation unit 4 registration unit 5 password collation unit 6 counting unit 7 connection control unit 10 reception function unit 40 registration table 41 ID (registered user authentication information) 42 PW (registered password) 43 NWA (registered network address) 44 f (flag) 45 Error type 50 Authentication program 100 Personal computer 101 ID (caller-side user authentication information) 102 PW (caller-side password) 103 NWA (Network Address of Calling Party) 200 Communication Center 300 Public Line 901 Processing Unit 902 Display 903 Driver 904 Memory 905 Portable Media 906 Other Device 907 Line

Claims (5)

[Claims] 1. An apparatus for authenticating a sender when transmitting and receiving information by being connected to a network, comprising: a receiver for sender authentication data; at least user authentication information forming the sender authentication data; Registering a password associated with the source network address and the user authentication information,
A registration unit having a flag that is set when the received source authentication data cannot be authenticated with the registered authentication data; and a network address included in the source authentication data and received by the registration unit. A network address collating unit for collating with a network address registered in relation to authentication data, and a password for collating a received password included in the source authentication data with a password registered in the registration unit in relation to the authentication data A collating unit; a flag inquiry unit for confirming the state of the flag when the sender authentication data is received; and a signal for counting by an output of the password collating unit and setting the flag when a predetermined value is counted. A counting unit, and a connection control unit that controls start of communication with the transmission source. Origin authentication device according to symptoms. 2. A sender authentication method for collating a password registered in advance in relation to user authentication information included in received sender authentication data and starting communication when a proper password is received up to a predetermined number of times. In the case where a password different from the registered password is continuously received a predetermined number of times, the network address of the source is collated with a network address registered in advance, and if the collation does not match, the source address of the source is collated. A sender authentication method characterized by rejecting a connection request. 3. When the flag is set, the connection control unit determines that there is a connection request using source authentication data not registered in the registration unit, 2. The sender authentication apparatus according to claim 1, wherein the flag is reset by notifying the sender of the connection request. 4. A rejection of the connection request is stored as a history, and when there is a connection request using legitimate source authentication data, the history is notified to a legitimate source. 3. The source authentication method according to claim 2, wherein: 5. A network address collating function for collating a received network address included in the sender authentication data with a network address registered in advance in relation to the authentication data registered in the registration function; A password collating function for collating the received password included in the password with the password registered in relation to the authentication data in the registration function. A flag inquiry function for confirming a state of a flag which is set when the source authentication data cannot be authenticated with the registered authentication data when the source authentication data is received; and an output of the password verification function And a counting function for outputting a signal for setting the flag.