JP2001084226A - Communication system, communications equipment and recording medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform authentication with access request data generated by using time data, while hardly having to take into consideration the allowable range of an error time by allowing authenticating side communications equipment to generate differential data showing the difference between times shown by respective clock circuits provided in the authenticating side communications equipment and communications equipment side to be authenticated and absorbing the error of each of the clock circuits by using the generated differential data. SOLUTION: Communications equipment side 10 to be authenticated transmits 1st time data showing a read time to authenticating side communications equipment 20 (S104). The equipment 20 transmits a read time and differential data showing time difference shown by the received 1st time data to the equipment 10 (S204). The equipment 10 transmits 2nd time data, showing the read time and access request data generated on the basis of the differential data to the equipment 20 (S109). The equipment 20 performs authentication on the basis of the read time and the access request data (S209).

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention
A communication device transmits access request data to a second communication device, and the second communication device determines whether the first communication device can access based on the received access request data, a communication device used in the system, and And a recording medium on which a program for realizing the device is recorded.

[0002]

2. Description of the Related Art LAN (Local Area Network), WAN (W
In a communication network such as the Internet (ide Area Network) and the Internet, when a user accesses a specific server computer (hereinafter referred to as an authentication device) from a client computer (hereinafter referred to as a device to be authenticated), the user needs ID data and a password. Is input to the device to be authenticated, and the input ID data and password are transmitted as access request data from the device to be authenticated to the authentication device,
When the authentication device determines that the ID data and the password correspond to each other, a communication system that authenticates the device as a legitimate device to be authenticated and permits access is widely used. However, in this communication system, if a password having the same content is used every time, the password may be intercepted and an unauthorized access may be performed.

A communication system that generates different access request data each time is disclosed in
No. 173645. In other words, the device to be authenticated encrypts the ID data and the password, and the time data indicating the time indicated by the clock circuit provided in the device to be authenticated, with a predetermined encryption function to generate access request data. Then, the access request data is transmitted to the authentication device. The authentication device decrypts the received access request data and, when determining that the ID data and the password correspond, further compares the time indicated by the time data with the time indicated by the clock circuit provided in the authentication device. When the time indicated by the time data is determined to be correct, the communication system authenticates the device to be authenticated and permits access.

[0004]

However, in a conventional communication system, there is a case where the authentication device is determined to be an unauthorized access due to a time error indicated by a clock circuit provided in each of the authentication device and the device to be authenticated. When comparing times to determine the validity of the device to be authenticated, it is necessary to provide an allowable range having a certain width.

[0005] For this reason, if the time is within the allowable range, unauthorized access can be performed by intercepting the access request data transmitted from the authenticated device to the authentication device and reusing the intercepted access request data. There is a problem that there is.

To solve the problem of reuse of the intercepted access request data, a recording means for recording the received access request data is provided in the authentication device, and the same access request data as the access request data recorded in the recording means is provided. When a message is received, a measure to prevent access is proposed.

However, since this measure requires additional recording means for recording the access request data or securing a new recording area in the existing recording means, the cost of adding the recording means and securing the recording capacity of the recording means are required. There are problems with system construction and management costs.

Further, if access request data exceeding the capacity of the recording means is received within the allowable time, a part of the recorded access request data needs to be erased, so that unauthorized access is prevented. There is a problem that the function is not fulfilled.

Further, in order not to erase the access request data within the allowable time, it is necessary to restrict the access, so that there is a problem that the number of devices that can be simultaneously authenticated is limited.

Further, when there is a time difference between the authentication device and the device to be authenticated, there is a problem of a processing load that it is necessary to perform a correction process for the time difference.

[0011] The present invention has been made in view of the above-described circumstances, and uses an authentication device to transmit difference data indicating a time difference between a clock circuit provided in an authentication device and a clock circuit provided in a device to be authenticated. By generating and adding the generated difference data to the generation of the access request data, the authentication can be performed with little consideration of the allowable time range, and the recording means for recording the access request becomes unnecessary, so that the recording is performed. A communication system that suppresses unauthorized access without causing problems related to the cost of adding a unit, securing the recording capacity of the recording unit, and system and management costs, and that does not require a limit on the number of devices that can be simultaneously authenticated and a correction process for a time difference; Communication device used as an authentication device and a device to be authenticated in a system, and a program for realizing those devices Arm is intended to provide a recording medium which is recorded.

[0012]

A communication system according to a first aspect of the present invention includes a plurality of communication devices, wherein the first communication device transmits access request data to a second communication device, and the second communication device receives the access request data. In a communication system for determining whether or not an access of a first communication device is possible based on request data, the first communication device includes a first clock circuit, and means for generating time data indicating a time indicated by the first clock circuit. Means for transmitting the time data to the second communication device,
The second communication device includes: a second clock circuit; means for generating difference data indicating a difference between a time indicated by the second clock circuit and a time indicated by the received time data; Means for transmitting to the device,
The communication device further includes: a unit configured to generate access request data based on the received difference data and the time indicated by the first clock circuit; and a unit configured to transmit the access request data to the second communication device. The second communication device further includes a unit that determines whether the first communication device can access based on the received access request data and the time indicated by the second clock circuit.

A communication device according to a second aspect of the present invention includes a clock circuit,
Means for generating difference data indicating a difference between the time indicated by the clock circuit and the time indicated by the external device clock circuit provided in the external device; means for transmitting the difference data to the external device; It is characterized by comprising access request data based on time data indicating the time indicated by the device clock circuit, and means for judging whether the external device can be accessed based on the time indicated by the clock circuit.

[0014] A communication device according to a third aspect of the present invention includes a clock circuit,
Means for generating time data indicating the time indicated by the clock circuit; means for transmitting the time data to an external device; and indicating the difference between the time indicated by the clock circuit provided in the external device and the time indicated by the time data. It is characterized by comprising means for generating access request data based on the difference data and the time indicated by the clock circuit, and means for transmitting the access request data to an external device.

A computer-readable recording medium according to a fourth aspect of the present invention is a computer-readable recording medium in which a computer having a clock circuit and communication means for communicating with an external device is recorded with a program for determining whether or not access is possible. In a readable recording medium, the computer
Program code means for generating difference data indicating a difference between the time indicated by the external device clock circuit provided in the external device and the time indicated by the clock circuit, and a program causing a computer to transmit the generated difference data to the external device Code means, and a program for causing a computer to determine whether the external device can be accessed based on difference data and access request data based on time data indicating a time indicated by a clock circuit for the external device, and a time indicated by the clock circuit. A computer program including code means is recorded.

A computer readable recording medium according to a fifth aspect of the present invention is a computer readable recording medium storing a program for requesting an access to a computer having a clock circuit and a communication unit for communicating with an external device. In a recording medium capable of, a program code means for causing a computer to generate time data indicating the time indicated by the clock circuit, program code means for causing the computer to transmit the generated time data to the external device, Program code means for generating access request data based on the time indicated by the clock circuit included in the external device and the difference data indicating the time difference indicated by the time data, and the time indicated by the clock circuit; Access request data Characterized in that are recorded thereon a computer program comprising program code means for transmitting to the location.

In the communication system, the communication device, and the recording medium according to the present invention, the time difference indicated by the respective clock circuits provided in the communication device on the authenticated side making an access request and the communication device on the authenticating side for judging whether access is permitted is provided. Is used to determine whether access is possible or not, it is possible to absorb the time error indicated by each clock circuit, so that it is based on the difference in the processing speed of each device and the difference in the transmission time due to the influence of communication traffic. Although an error may occur, such an error is extremely small as compared with the error of each clock circuit, so that the access is performed using the access request data generated using the time data without considering the allowable range of the error time. It is possible to judge whether or not unauthorized access by reusing the intercepted access request data is possible. Since the recording means for recording the access request data for the suspension is not required, neither the addition of the recording means nor the securing of a new recording area in the existing recording means is required, and the cost of the additional recording means and the cost of the recording means are eliminated. Since there is no problem regarding the securing of the recording capacity, the system construction, and the management cost, and there is no problem with the recording capacity, there is no need to limit the number of devices for simultaneously judging whether access is possible and correct the time difference.

[0018]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the drawings showing the embodiments. FIG. 1 is a block diagram showing the configuration of the communication system of the present invention. In the figure, reference numeral 10 denotes a communication device on the authenticated side of the present invention using a client computer. The authenticated communication device 10 is a CD-RO recording a program and data for the authenticated communication device of the present invention.
An auxiliary storage means 12 such as a CD-ROM drive for reading information such as programs and data from a recording medium 41 such as an M
And a recording unit 13 such as a hard disk for recording information such as programs and data read by the auxiliary storage unit 12 and an encryption function 101 used for encrypting various data. Then, by reading information such as programs and data from the recording means 13 and temporarily storing the information in the RAM 14 for temporarily storing the information and executing it by the CPU 11, it operates as the communication apparatus on the authentication side according to the present invention.

The communication device 10 to be authenticated further includes input means 15 such as a keyboard and a mouse, output means 16 such as a monitor and a printer, and a clock circuit 17.
Communication network 30 such as WAN and the Internet
And a communication means 18 such as a modem, a terminal adapter, and a router for connecting to the network. Communication network 3
0 is a network showing a broad concept including wired and wireless lines.

The authenticating communication device 20 of the present invention, which makes an access request from the authenticated communication device 10 via the communication network 30, has substantially the same configuration as the authenticated communication device 10, and performs authentication using a server computer. Communication device 20
Are the CPU 21, the auxiliary storage means 22, the recording means 23, R
AM 24, input means 25, output means 26, clock circuit 2
7 and a communication means 28, and operates as the authentication-side communication device of the present invention by executing the program for the authentication-side communication device of the present invention and the program read from the recording medium 42 on which information such as data is recorded. I do.

The recording means 23 has an encryption function 101
Function 20 for decrypting data encrypted by
1, and a unique information database 202 that records ID data specifying a user and a password normally stored only by the user in association with each other.

The information such as the program and data of the present invention is read from the recording medium 41 and / or 42, and is connected to the information providing server computer 50 for providing information via the communication network 30. It is also possible to download information from the recording medium 51 which stores the program of the present invention built in the computer, and record the information in the recording means 13 and / or 23.

Next, the communication system of the present invention is shown in FIG.
A description will be given based on a flowchart showing the processing of the CPU 21 of 0. First, the authenticated communication device 10 receives input of ID data and a password from a user who wants to access the authentication communication device 20 (S101). Then, the time indicated by the clock circuit 17 is read (S10
2) First time data indicating the read time is generated (S103), and the generated first time data is transmitted to the authentication-side communication device 20 (S104).

The authentication-side communication device 20 receives the first time data (S201), reads the time indicated by the clock circuit 27 (S202), and determines the difference between the read time and the time indicated by the received first time data. The generated difference data is generated (S203), and the generated difference data is transmitted to the authentication-subjected communication device 10 (S204).

The authenticated communication device 10 receives the difference data (S105), reads the time indicated by the clock circuit 17 (S106), and generates second time data indicating the read time (S107). The second time data, the received difference data, and the ID data and password received in
To generate access request data (S1).
08), and transmits the generated access request data to the authentication-side communication device 20 (S109).

The authentication-side communication device 20 receives the access request data (S205), decrypts the received access request data by the decryption function 201, and restores the second time data, difference data, ID data, and password. (S206). Then, referring to the correspondence between the ID data and the password recorded in the unique information database 202, it is determined whether or not the restored ID data and the password correspond to each other (S207).

If it is determined in step S207 that the ID data and the password correspond to each other (S20).
7: Y), the time indicated by the clock circuit 27 is read (S208), and the difference between the read time and the time indicated by the restored second time data and the difference between the restored difference data and a predetermined tolerance are determined. It is determined whether it is within the range (S209).

If it is determined in step S209 that the access request data is within the allowable range (S209: Y), the authenticated communication device 10, which is the transmission source of the access request data, is determined to be legitimate, and the access to permit access is determined. The permission signal is transmitted to the communication device 10 to be authenticated (S210).

If it is determined in step S207 that the ID data and the password do not correspond (S20)
7: N) or when it is determined in step S209 that the difference between the read time and the time indicated by the restored second time data and the difference data is outside the allowable range (S209: N), The request data is determined to be an unauthorized access request, and an access rejection signal for rejecting the access is transmitted to the communication device 10 to be authenticated (S21).
1).

In the above-described embodiment, the form in which the access request data is generated based on the time data, the difference data, the ID data, and the password has been described. However, the present invention is not limited to this form. When a device unique number is assigned, input of the ID data may be omitted by using the device unique number instead of the ID data.

[0031]

As described above in detail, in the communication system, the communication device, and the recording medium of the present invention, the time difference indicated by the respective clock circuits provided in the communication device on the authenticating side and the communication device on the authenticated side is calculated. The generated difference data is generated by the communication device on the authentication side, and the error of each clock circuit is absorbed by using the generated difference data. Therefore, the access generated by using the time data without considering the allowable range of the error time. Excellent effects are obtained, for example, authentication can be performed by request data.

Further, a communication system, a communication device,
And, in the recording medium, the recording means for recording the received request data becomes unnecessary, so neither the addition of the recording means nor the securing of a new recording area in the existing recording means is required, and the additional cost of the recording means, It does not cause the problem of securing the recording capacity of the recording means, system construction and management cost, and has no problem of the recording capacity. There are excellent effects such as the presence.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of a communication system according to the present invention.

FIG. 2 is a flowchart showing processing of the CPU of the communication device on the authentication side and the CPU of the communication device on the authentication side according to the present invention;

[Explanation of symbols]

 Reference Signs List 10 Authenticated communication device 20 Authenticated communication device 11, 21 CPU 12, 22 Auxiliary storage unit 13, 23 Recording unit 14, 24 RAM 15, 25 Input unit 16, 26 Output unit 17, 27 Clock circuit 18, 28 Communication unit Reference Signs List 30 communication network 41, 42 recording medium 101 encryption function 201 decryption function 202 unique information database

Claims (5)

[Claims] 1. A communication system comprising a plurality of communication devices, wherein a first communication device transmits access request data to a second communication device, and the second communication device determines whether or not the first communication device can access based on the received access request data. In the communication system for determining, the first communication device includes: a first clock circuit; means for generating time data indicating a time indicated by the first clock circuit; and transmitting the time data to the second communication device. Means, the second communication device comprising: a second clock circuit; a means for generating difference data indicating a difference between a time indicated by the second clock circuit and a time indicated by the received time data; To the first communication device. The first communication device further generates access request data based on the received difference data and the time indicated by the first clock circuit. And a means for transmitting the access request data to the second communication device, the second communication device further comprising: the second access device based on the received access request data and a time indicated by a second clock circuit. A communication system comprising: means for determining whether the first communication device can access the communication system. 2. A clock circuit, means for generating difference data indicating a difference between a time indicated by the clock circuit and a time indicated by an external device clock circuit provided in an external device, and transmitting the difference data to the external device Means for performing access request data based on the difference data and the time data indicating the time indicated by the external device clock circuit, and means for determining whether the external device can be accessed based on the time indicated by the clock circuit. A communication device characterized by the above-mentioned. 3. A clock circuit, means for generating time data indicating the time indicated by the clock circuit, means for transmitting the time data to an external device, and the time indicated by the clock circuit provided in the external device A means for generating access request data based on difference data indicating a time difference indicated by the time data and a time indicated by a clock circuit; and a means for transmitting the access request data to an external device. Communication device. 4. A computer-readable recording medium in which a computer having a clock circuit and communication means for communicating with an external device is recorded with a program for determining whether or not access is possible. Program code means for generating difference data indicating the difference between the time indicated by the clock circuit for the external device and the time indicated by the clock circuit, and program code means for causing a computer to transmit the generated difference data to the external device. Program code means for causing a computer to determine whether or not the external device can be accessed based on difference data and access request data based on time data indicating the time indicated by the external device clock circuit, and the time indicated by the clock circuit. Computer programs, including A computer-readable recording medium characterized by being recorded. 5. A computer-readable recording medium having recorded thereon a program for requesting an access to a computer provided with a clock circuit and a communication means for communicating with an external device, wherein the computer is provided with a clock circuit. Program code means for generating time data indicating a time to be transmitted, program code means for causing a computer to transmit the generated time data to the external device, and time and time data indicated by a clock circuit provided in the external device to the computer. Program code means for generating access request data based on the difference data indicating the time difference indicated by the clock signal and the time indicated by the clock circuit; and program code means for causing a computer to transmit the generated access request data to the external device. Computer including Recording medium readable on a computer, characterized in that are recording a program.