WO2013008352A1

WO2013008352A1 - Authentication system and authentication method

Info

Publication number: WO2013008352A1
Application number: PCT/JP2011/080040
Authority: WO
Inventors: 敏文新谷; 壮一最首
Original assignee: 株式会社野村総合研究所
Priority date: 2011-07-08
Filing date: 2011-12-26
Publication date: 2013-01-17
Also published as: JP4820928B1; JP2013020312A

Abstract

Provided is an authentication system that provides a single sign-on to a plurality of servers and that enables simultaneous, parallel authentication while maintaining security between each server and system. Each server (100) has an authentication unit (120) that performs authentication; a client terminal (300) has an authentication request unit (311) that sends an authentication request to each server (100); and the authentication unit (120) has a server seed and user information (130) including a hashed password (132) being a password that has been hashed for each user ID, using the server seed. The server seed is sent in response to an authentication request to the client terminal (300), as a seed; the authentication request unit (311) sends to the server (100) a hash value being a password hashed using the seed received from the server (100); and the authentication unit (120) performs authentication by comparing the hash value received from the client terminal (300) and the hashed password (132) relating to the relevant user.

Description

Authentication system and authentication method

The present invention relates to an authentication technology, and more particularly to a technology effective when applied to an authentication system and an authentication method for performing single sign-on by inputting a single user ID and password for a plurality of servers and the like.

In recent years, due to the progress of cloud computing services, etc., it is common to perform operations related to information processing by accessing multiple data centers and servers continuously or concurrently from client terminals owned by users. It has become to. In such a system environment, a so-called single sign-on mechanism is applied in order to avoid the complexity of performing user authentication individually on each server, etc., every time access to each server, etc. is started. There is also a case.

The single sign-on mechanism allows users to access multiple systems and servers that require user authentication without performing individual authentication procedures by performing authentication once. As a technique for realizing this mechanism, for example, each server or system communicates between servers using the SAML (Security Assertion Markup Language) protocol (Non-Patent Document 1) and is performed by a specific server such as an authentication server. By automatically taking over the authentication result information, a method of eliminating the need for a second authentication procedure by the user at each server or the like is employed.

However, the single sign-on environment based on such a mechanism is premised on the establishment of a trust relationship that allows authentication information to be taken over and accepted between servers and systems, such as an in-house system on an intranet. Therefore, when each server or system is operated by a different business operator, such a trust relationship may not be established due to a security relationship or the like.

On the other hand, for example, JP 2010-86435 A (Patent Document 1) describes an example of the following network system. That is, the network system includes a plurality of Web servers, relay servers, and a plurality of user terminals, and the first Web server performs authentication by comparing authentication information from the terminals and authentication information in the storage unit, When authentication is established, the message includes information related to the first user ID included in the authentication information, the first URL to the first Web server, the second URL to the second Web server, and the authentication strength. Is generated and sent to the relay server.

The relay server acquires the second user ID corresponding to the first user ID from the table for registering the same user information, rewrites the first user ID in the message with the second user ID, Send to Web server. When the second Web server receives the message, the second Web server obtains the second user ID from the message, and when the second user ID is stored in the storage unit, the information related to the received authentication strength and the storage unit The user is re-authenticated based on information related to the authentication strength. As a result, in a network system composed of a plurality of systems that are not in a trust relationship or cooperative relationship with each other, a plurality of applications requiring authentication can be used by inputting authentication information once.

JP 2010-86435 A

As described above, it is possible to construct a single sign-on environment using a technique such as Non-Patent Document 1. However, in such an environment, it is necessary that a trust relationship is established between servers and systems. Therefore, for example, in an environment where a trust relationship is not established between servers and systems, for example, inside and outside the company or between different operators, authentication information acquired from an authentication server or the like for authentication processing on the server. It is also conceivable that unauthorized access is made to other servers using the server, and there is a problem in terms of ensuring security between servers and systems.

On the other hand, if a mechanism such as Patent Document 1 is used, it is possible to construct a single sign-on environment between servers and systems in which a trust relationship is not established. However, in addition to user management at a certain server, the user usually has to manage registration and change of user IDs individually at other servers as well. Moreover, it is necessary to manage the correspondence relationship between user IDs in a plurality of servers, such as the relay server in Patent Document 1, and the management becomes complicated. In addition, in such a form in which authentication is continuously performed between a plurality of servers and systems, when the user needs to access a large number of servers and systems at the same time, the response is reduced. Have

SUMMARY OF THE INVENTION An object of the present invention is to provide an authentication system and an authentication method that enable single sign-on for a plurality of servers and systems, and that can perform authentication in parallel while ensuring security among the servers and systems. Is to provide. The above and other objects and novel features of the present invention will be apparent from the description of this specification and the accompanying drawings.

Of the inventions disclosed in this application, the outline of typical ones will be briefly described as follows.

An authentication system according to a representative embodiment of the present invention is an authentication system that performs single sign-on to a plurality of servers connected via a network by a single authentication process from a client terminal by a user. It has characteristics.

That is, each server has an authentication processing unit that performs authentication processing for access to the server, and the client terminal receives a user ID and password from a user when executing or using the function of each server. And an authentication request unit that transmits authentication requests to the servers sequentially or in parallel.

The authentication processing unit of the server has a server seed which is unique information different for each server and a hash obtained by hashing the user password for each registered user ID using the server seed in a predetermined procedure. User information holding account information including a password, and in response to the authentication request received from the client terminal, the server seed is transmitted to the client terminal as a seed, and the client terminal The authentication request unit transmits a hash value obtained by hashing a password designated by the user in a predetermined procedure using the seeds received from the server, and the authentication processing unit of the server The hash value received from the client terminal and the hash associated with the target user. Authenticate by comparing the Interview of password, and transmits the authentication result to the client terminal.

The present invention can also be applied to an authentication method for performing single sign-on to a plurality of servers connected via a network by a single authentication process from a client terminal by a user.

Among the inventions disclosed in the present application, effects obtained by typical ones will be briefly described as follows.

According to a typical embodiment of the present invention, single sign-on for a plurality of servers and systems is possible, and authentication processing is performed by performing authentication in parallel while ensuring security between the servers and systems. It is possible to suppress a decrease in response due to.

It is the figure which showed the outline | summary about the structural example of the authentication system which is one embodiment of this invention. It is the figure which showed the outline | summary about the example of the flow of the authentication process in one embodiment of this invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiment, and the repetitive description thereof will be omitted.

An authentication system according to an embodiment of the present invention realizes single sign-on for a plurality of servers and systems (hereinafter simply referred to as “servers”) by a single authentication process from a client terminal by a user. System. At this time, by using a different key (server specific information) for each server, authentication can be performed independently and securely. In addition, it is possible to perform authentication on each server simultaneously, reducing the time required for authentication when there is a need to access many servers in parallel, and suppressing a decrease in response. Is possible.

<System configuration>
Below, the system configuration | structure of the authentication system of this Embodiment is demonstrated. FIG. 1 is a diagram showing an outline of a configuration example of an authentication system according to an embodiment of the present invention. The authentication system 1 has a configuration in which a plurality of servers 100, a master server 200, and client terminals 300 are connected to a network 400.

The server 100 is a computer system composed of server devices. For example, a web server, an application server, a database server, a file server, a storage system, etc., receives user access from the client terminal 300 after user authentication and provides services. Has the function to provide. The server 100 includes, for example, a business processing unit 110 and an authentication processing unit 120 that are implemented by software programs. The business processing unit 110 executes processing related to a service (business) provided by the server 100, and includes, for example, middleware, application programs, and the like.

The authentication processing unit 120 performs an authentication process for access to the server 100. The authentication processing unit 120 includes user information 130 including account information for each user as information used when performing authentication processing. The user information 130 is configured by, for example, a database, a file table, or the like. For example, for each registered user ID of the registered user, the user seed 131 as unique information that is different for each user and the password are hashed by a predetermined procedure. Account information such as hashed password 132 is included. In addition, the authentication processing unit 120 has a server seed 140 as unique information that is different for each server.

In this embodiment, as will be described later, the authentication processing unit 120 performs authentication processing with the client terminal 300 by a challenge / response method. That is, in response to the authentication request from the user, the server seeds 140, the user seeds 131, and a random number as a challenge are transmitted. Further, the hashed hash value is received as a response from the client terminal 300, and authentication is performed by comparing the received hash value with the hashed password 132 hashed by the random number. . Therefore, the authentication processing unit 120 has a random number generation function and a hash algorithm. In addition, various known techniques and algorithms can be used for these implementations. When security of the communication path between the server 100 and the client terminal 300 is secured, a method other than the challenge / response method may be adopted.

The master server 200 is a computer system composed of server devices, PCs (Personal Computers), and the like, and generates and provides user seeds 131 and server seeds 140 held in each server 100. Since it is not a so-called authentication server that performs authentication representatively, it does not have a user authentication function. The master server 200 includes, for example, a seed generation unit 210 that is implemented by a software program.

The seeds generation unit 210 generates seeds based on an instruction from an administrator or the like or a request from each server 100, and provides the seeds as user seeds 131 or server seeds 140 to the target server 100 via the network 400. The seed generation method and the seed format are not particularly limited. For example, a unique character string or binary data having a predetermined length can be generated and used as a seed.

The client terminal 300 is a computer system composed of a PC, a portable terminal, and the like, and has a function of accessing the server 100 via the network 400 in order to execute and use a service (business) provided by each server 100. The client terminal 300 has a client application 310 implemented by, for example, a software program. The client application 310 is an application program for executing and using a function (business) provided by each server 100. The client application 310 has an authentication request unit 311 and may use, for example, a program that runs on a Web browser. it can.

The authentication request unit 311 makes an authentication request to the server 100 when the client application 310 executes and uses the function of each server 100. For example, an input of a user ID and password is accepted from a user via a login screen, and authentication processing is performed individually or in parallel with the authentication processing unit 120 of each server 100 by a challenge / response method or the like. This realizes the single sign-on function.

Here, based on the server seeds 140, the user seeds 131, and the random numbers transmitted from the authentication processing unit 120 of the server 100 in response to the transmission of the authentication request, the password designated by the user is hashed according to a predetermined procedure. Is transmitted to the authentication processing unit 120 of the server 100 to perform authentication processing. Accordingly, the authentication request unit 311 has the same hash algorithm as that implemented by the authentication processing unit 120 of the server 100.

As the network 400, for example, a public communication network such as the Internet, a communication network partially using a general public line such as a WAN (Wide Area Network), a VPN (Virtual Private Network), or a LAN (Local Area Network) is appropriately used. Can be used.

<Authentication process>
Below, the content of the authentication process in the authentication system 1 of this Embodiment is demonstrated. As an initial state for performing the authentication process, it is assumed that each server 100 holds a seed generated by the seed generation unit 210 of the master server 200 as a server seed 140 in advance. Furthermore, initial registration of account information including a user ID, a password, and the like is performed in advance by each user. At this time, as account information, the seeds generated by the seed generation unit 210 of the master server 200 are stored as user seeds 131 for each user ID. Further, the password is stored as a hashed password 132 hashed by a predetermined hash algorithm using the user seeds 131 and the server seeds 140 as seed values.

 By not holding the password directly, it is possible to prevent password leakage. In addition, hashing is performed by using a unique user seed 131 for each user as a seed value, so that, for example, even when the same password is accidentally specified by a plurality of users, the hash value may be different for each user. it can.

FIG. 2 is a diagram showing an outline of an example of the flow of authentication processing in the present embodiment. First, the user requests authentication (login) via the authentication request unit 311 of the client terminal 300. At this time, for example, user ID and password information are specified via a login screen or the like. The authentication request unit 311 transmits an authentication request including the designated user ID to the server 100 (S01).

Upon receiving the user ID, the authentication processing unit 120 of the server 100 generates a random number as a challenge in the challenge / response method, acquires seeds, and transmits them to the client terminal 300 (S02). Here, in addition to the random number, the server seed 140 and the user seed 131 corresponding to the user ID held in the user information 130 are acquired.

The server seed 140, the user seed 131, and the authentication request unit 311 of the client terminal 300 that has received the random number hash the password specified in step S01 with a predetermined hash algorithm (S03). Further, the hash value obtained in step S03 is hashed using the user seeds 131 as a seed value (S04). Furthermore, the hash value obtained in step S04 is hashed using the server seeds 140 as a seed value (S05). Further, the hash value obtained in step S05 is made one-time by hashing using a random number as a seed value, and the obtained hash value is transmitted to the server 100 (S06).

Note that the series of hashing procedures in steps S03 to S05 described above is merely an example, and other procedures that can obtain equivalent results are naturally possible. However, the password is hashed in advance during user registration. It is necessary to use the same procedure as the hashing process when the hashed password 132 is acquired. Further, for example, when an instruction to update the password is received from the server 100 in step S02, the password (and hash) is executed before executing step S03 as necessary. Update password 132) may be updated.

Upon receiving the hash value, the authentication processing unit 120 of the server 100 acquires the hashed password 132 corresponding to the target user ID from the user information 130 (S07), and the random number generated in step S02 is the acquired hashed password 132. Is hashed as a seed value (S08). Thereafter, authentication processing is performed by comparing the obtained hash value with the hash value received from the client terminal 300 in step S07, and the authentication result is transmitted to the client terminal 300 (S09). That is, if the two match as a result of the comparison, the authentication is established, and if they do not coincide, the authentication is not established. At this time, for example, information related to the location of the transmission source such as the IP address is acquired from the request message from the client terminal 300, and other conditions such as whether or not the information is within a predetermined range are successful or unsuccessful. It may be added to the judgment.

The authentication request unit 311 of the client terminal 300 receives the authentication result (S10), and then automatically performs the above-described series of processes sequentially for the other servers 100 as necessary, and authenticates each server 100. Process. Since the authentication processing in each server 100 is independent, the above-described series of processing can be performed simultaneously on a plurality of necessary servers 100 in parallel. The necessary information on the server 100 can be grasped by, for example, holding a setting file including a list of servers 100 on the client terminal 300.

Through the above processing, the user can perform authentication processing for each necessary server 100 only by specifying the user ID and password once.

Even if the administrator of a certain server 100 obtains account information such as the user's seeds 131 and the hashed password 132 of the target user from his / her user information 130 by taking the above-described method, This information cannot be used to authenticate other servers 100 by impersonation, and security between the servers 100 is ensured.

This is because the value of the user's hashed password 132 in a certain server 100 is hashed by its own server seeds 140, and the user's hashed password 132 in the other server 100 is stored in the other server 100. This is because the value is different because it is hashed by 100 server seeds 140. Therefore, even if both are hashed using the same random number as a seed value, the same hash value is not obtained, and authentication is not established in step S09 in FIG. Further, even if the server seeds 140 of the other server 100 are acquired by some means, a hash value having the same value as the hashed password 132 in the other server 100 is generated unless the password of the target user is known. It is not possible.

As described above, according to the authentication system 1 according to an embodiment of the present invention, single sign-on for a plurality of servers 100 can be realized by a single authentication process from the client terminal 300 by the user. At this time, by performing authentication using unique information (server seeds 140) different for each server 100, it is possible to independently and securely access each server 100. In addition, it is possible to perform authentication in each server 100 in parallel and reduce the time required for authentication in cases where it is necessary to access a large number of servers in parallel to suppress a decrease in response. Is possible.

As mentioned above, the invention made by the present inventor has been specifically described based on the embodiment. However, the present invention is not limited to the embodiment, and various modifications can be made without departing from the scope of the invention. Needless to say.

The present invention can be used for an authentication system and an authentication method for performing single sign-on by inputting a user ID and a password once for a plurality of servers and the like.

1 ... Authentication system,
DESCRIPTION OF SYMBOLS 100 ... Server, 110 ... Business processing part, 120 ... Authentication processing part, 130 ... User information, 131 ... User seed, 132 ... Hash password, 140 ... Server seed,
200: Master server, 210: Seeds generation unit,
300 ... Client terminal, 310 ... Client application, 311 ... Authentication request unit,
400: Network.

Claims

An authentication system that performs single sign-on to a plurality of servers connected via a network by a single authentication process from a client terminal by a user,
Each of the servers has an authentication processing unit that performs an authentication process for access to the server,
The client terminal has an authentication request unit that receives a user ID and password designation from a user and sequentially or concurrently sends authentication requests to the servers when executing or using the functions of the servers. And
The authentication processing unit of the server has a server seed which is unique information different for each server and a hash obtained by hashing the user password for each registered user ID using the server seed in a predetermined procedure. User information holding account information including a password, and in response to the authentication request received from the client terminal, the server seed as a seed is transmitted to the client terminal,
The authentication request unit of the client terminal transmits a hash value obtained by hashing a password designated by the user in a predetermined procedure using the seeds received from the server to the server,
The authentication processing unit of the server performs authentication by comparing the hash value received from the client terminal with the hashed password relating to the target user, and transmits an authentication result to the client terminal. A featured authentication system.
The authentication system according to claim 1,
The authentication processing unit of the server further includes, as the account information for each user held in the user information, user seeds that are unique information different for each user, and the user password is stored in the server A hashed password that has been hashed in a predetermined procedure using the seeds and the user seeds, and in response to the authentication request received from the client terminal, the server seeds and the target user as the seeds The authentication system according to claim 1, wherein the user seeds are transmitted to the client terminal.
The authentication system according to claim 1 or 2,
The authentication processing unit of the server transmits the seeds and the generated random number to the client terminal in response to the authentication request received from the client terminal,
The authentication request unit of the client terminal hashes the password designated by the user using a predetermined procedure using the seeds received from the server, and further hashed using the random number received from the server Sending a hash value to the server;
The authentication processing unit of the server performs authentication by comparing the hash value received from the client terminal with a value obtained by hashing the hashed password related to the target user using the random number. A featured authentication system.
The authentication system according to any one of claims 1 to 3,
The authentication system further comprises a master server connected to the network and generating and providing a seed value as the seed for each server based on a request from each server.
An authentication method for performing single sign-on to a plurality of servers connected via a network by a single authentication process from a client terminal by a user,
Each server includes server seeds that are unique information different for each server, user seeds that are unique information different for each user for each registered user ID, and a password for the user. Having account information including a hashed password hashed in a predetermined procedure using the user seeds,
A first step of transmitting an authentication request including a user ID designated by the user to the server when the client terminal executes or uses the function of each server;
A second step in which the server receiving the authentication request transmits the server seed and the user seed related to the target user and the generated random number to the client terminal;
The client terminal hashes the password designated by the user with a predetermined procedure using the server seeds and the user seeds received from the server, and further hashes the hash value hashed with the random numbers. A third step of sending to
The server that has received the hash value performs authentication by comparing the hash value with a value obtained by hashing the hashed password associated with the target user using the random number, and the authentication result is the client terminal. And a fourth step of transmitting to
An authentication method, wherein the first to fourth steps are executed sequentially or in parallel on the servers.