JP2002132728A - One-time password authentication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To display a one-time password on a portable telephone installed with JAVA. SOLUTION: The one-time password authentication system is provided with a means for generating JAVA program for displaying a one-time password for a user on the screen of a JAVA portable telephone terminal based on a one-time password display program generation request from the relevant user, a server for JAVA program download for preserving the JAVA program received from a sending means for JAVA program for a fixed period, determining the user corresponding to the download request from the user portable telephone and sending the correspondent JAVA program to that portable telephone, a means for reporting that the relevant JAVA program can be downloaded to the user after the program generation request from this user, and a means for initializing a one-time password display program on the JAVA portable telephone by a negotiation with a master managing device for the one-time password.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a one-time password authentication system using a mobile phone having a program download function, and more particularly, to a program installation for displaying a one-time password on a mobile phone and a method of executing the program.

[0002]

2. Description of the Related Art In a computer remote access system, in order to prevent unauthorized access at login,
There is a one-time password system that performs an access check with a temporary password that changes with time (called a one-time password). As a program for displaying a one-time password on a PC, a SoftToken program is known. Japanese Patent Application Laid-Open No. 2000-10927 "Authentication System and Authentication Device" discloses a one-time password inquiry system using a simplified mobile phone terminal. As a technique for downloading a program to a portable terminal, a network-compatible programming language JAVA (registered trademark) is well known.

[0003]

After installing a one-time password program on a small and lightweight PC such as a sub-notebook PC called a mobile PC, and then executing the program, the one-time password can be operated offline and portable. Although a password display device can be realized, such a mobile PC has low portability because the terminal cost is high, the terminal itself is heavy, and the operation time with a battery is short. In addition, a card incorporating one-time password logic has a short service life (2 to 5 years) due to restrictions on batteries and internal storage capacity. Also, the method of inquiring the current one-time password online using a PHS terminal cannot be used in a place where the radio wave environment is poor.

An object of the present invention is to provide a one-time password display system using a portable cellular phone equipped with JAVA, which is excellent in portability, can be used for a long time, and can operate offline. That is, a one-time password display program that runs on a JAVA-equipped mobile phone is created, downloaded to a JAVA-equipped mobile phone, the downloaded program is initialized, and after initialization, the program is offline on a JAVA-equipped mobile phone. It is to provide a system for displaying a one-time password.

[0005]

In order to achieve the above object, the present invention assigns seed information and user information to manage a one-time password of the user, and assigns user information and seed information to the user. Based on information
A means for creating a one-time password display program that can be executed on a JAVA mobile phone, and storing a one-time password display program that can be executed on a JAVA mobile phone, and managing the validity period of the program. A means for downloading a one-time password display program executable on the JAVA mobile phone in response to a request from the telephone, and notifying the user that the one-time password display program is available for download and the method of downloading the program. Means, loading the one-time password display program on the JAVA mobile phone, installing it on the JAVA mobile phone, executing the program after the initialization processing, and executing the one-time password display program on the JAVA mobile phone. One-time One-time password authentication system that has means for matching the current valid one-time password by negotiating with the password management means and displaying the current valid one-time password on the screen of the JAVA mobile phone And

[0006]

Embodiments of the present invention will be described. FIG. 1 is a configuration diagram of a one-time password authentication system using a JAVA mobile phone according to the present invention. This system includes an in-company system including a program download server 10, a secure server 20, and a business server 30 interconnected by an in-company LAN 100, and a JAVA mobile phone 60.
System, a mobile phone network 90 connecting the enterprise system and the remote system, the Internet 80, a FW (firewall) 40 which is a relay device of the network, and a GW.
(Gateway) 50. The client computer 70 is connected to the Internet 80 and has a FW for preventing unauthorized access from computers other than the specified address.
It connects to the business server 30 via 40 and executes various business applications. The client computer 70 sends the user ID and the one-time password to the business server 30 when logging in to the business server 30. Business server 30
Is the OTP (OneTime Password) of the secure server 20
It makes an inquiry to the authentication service 22, obtains a one-time password for the user ID, compares the one-time password sent from the client computer 70, and permits access if they match. An OTP program 61 is installed in the JAVA mobile phone 60, and a one-time password for the business server 30 is displayed by executing the OTP program 61.

[0007] The user sees the one-time password displayed on the JAVA mobile phone 60 and accesses the business server 30. In this way, access checks from other unauthorized users are performed. This one-time password is automatically updated and updated periodically in synchronization with the OTP program 61 and the OTP authentication service 22.

Next, generation and distribution of the OTP program 61 will be described. The user requests the administrator of the secure server 20 to create an OTP program by interview, by telephone, or by e-mail. After authenticating the requester, the administrator sends the user ID to the OTP authentication service 22.
Seed the OTP creation logic corresponding to and user ID
Specify with the value. At the same time, when the user ID and the seed are given to the OTP program generation service 23 and executed, J
An OTP program 61 operating on the AVA mobile phone 60 is generated and sent to the program download server 10. The program download server 10 has the OTP program 6
Keep 1 The administrator notifies the user of the method of downloading the OTP program 61 by activating the installation information notification service 21.

Next, the flow from creation of an OTP program to the JAVA portable telephone 60 to installation and execution will be described in detail with reference to FIG. After the requester authentication, the administrator uses the management tool on the secure server 20, assigns a user ID and a seed, and creates the OTP program 61 by the OTP program creation service 23 (step 2).
010). Next, the created OTP program 61 is sent to the download server 10. At this time, it is encrypted and sent for security. Program download server 10
Receives the OPT program 61 from the secure server 20, decrypts it with the common encryption key, saves it in the directory specified by the secure server 20 in order to respond to the download request from the JAVA mobile phone 60, and then sets the expiration date . Then, periodically check whether the expiration date has expired, and if it has expired, keep the stored OP
The T program 61 is deleted, and if there is a download request within the expiration date, it is deleted after the download is completed (step 2030).

Next, the administrator activates the installation information notification service 21 on the secure server 20. Then, a mail in which the URL which is the address of the program downloader server is described as installation information is sent to the JAVA mobile phone 60 (step 2040). In this way, the user knows that the preparation for obtaining the OTP program has been completed.

[0011] Next, the user opens the e-mail notified to the JAVA mobile phone 60 and selects the URL described therein.
And the download of the OTP program is started (step 2050). On the JAVA mobile phone 60 side, OTP
The program 61 is downloaded, expanded as an execution program on the memory, and notified to the user that the installation is completed (step 2060).

Next, the user who has received the notice of the completion of the installation of the OPT program 61 operates the OPT program 61 by pressing a program start button. Then, negotiation with the secure server 20 is performed for initialization such as timer synchronization. For this purpose, the OPT program 61 transmits an initialization request to the secure server 20 via the program download server 10 (step 207).
0). Since the JAVA program can only communicate with the server that downloaded the JAVA program, the program download server 10 relays the initialization processing request and a series of subsequent initialization communication between the JAVA mobile phone 60 and the secure server 20 (step 2080).

The secure server 20, which has received the initialization processing request from the JAVA mobile phone 60,
Notify the master time three times at one minute intervals, and then JAVA
Upon receiving the initialization processing completion time from the mobile phone 60,
The difference value between the time and the current time and the OTP timer start time are notified to the JAVA mobile phone 60 as two minutes after the current time.
Further, the countdown is performed until the start time, and when the start time is reached, the OTP timer is updated every minute (step 2090).

After receiving the master time every one minute from the secure server 20 three times, the timer error with the secure server 20 is corrected from the average value of the reception intervals measured by its own clock. Next, the correction completion time is notified to the secure server 20, and thereafter, the reference time is corrected based on the difference value notified from the secure server 20, and the countdown is performed on the received OTP timer start time (step 210).
0).

Next, when the countdown reaches 0, that is, when the OTP timer start time is reached, a one-time password is displayed. Thereafter, a one-minute timer is started, a periodic password recalculation is performed, and a different password is used each time. Is updated and displayed (step 2110).

Next, another embodiment of the installation information will be described with reference to FIG. The installation information 300 includes a USERID field and a URL field, and the USERID field describes a user ID assigned to the user. As an embodiment of the user ID notification method, OTP
Embedded in the program, allowing the user to
The form which presents ID may be sufficient. Installation information 300
The URL field describes a download server URL. In this URL, the assigned seed is described as a Query-String parameter.

Thus, it is possible to customize the seed by directly assigning a seed area to the logic of the OTP program 61 and assigning a seed area to the seed area and writing the seed there. In this way, when the seed is reassigned, the user is notified of the installation information with the changed seed value, and if the user is reinstalled, recompilation is not required, thereby saving system resources and improving response time. I can measure. In some embodiments, the seed is sent directly from the secure server after time synchronization at initialization.

Next, another embodiment of the initial processing will be described with reference to FIG. FIG. 4 shows another embodiment of the initialization process described after step 2070 in FIG.
First, in the secure server 30, the JAVA mobile phone 6
Before receiving an initialization request from 0, the OTP timer is updated every minute (step 4010). JAVA mobile phone 60
Server 30 that has received the initialization request from
In order to synchronize the OTP timer with the mobile phone 60, the current OTP timer value (Ta) being updated by the secure server 30 is returned to the JAVA mobile phone (step 4020).

Next, the JAVA mobile phone 60 receiving the message,
The OTP timer value (Ta) notified from the secure server 30 is set as its own OTP timer value, and the one-time password logic of the secure server 30 and the one-time password logic are called by the OTP timer value.
Synchronize your one-time passwords. Thereafter, the OTP timer value is automatically updated every minute (step 4030). Next, the resynchronization timer that is activated every hour issues a resynchronization request to the secure server 30 and receives the response to update the OTP timer value in the same manner as in step 4030 (step 4040). On the other hand, upon receiving the resynchronization request, the secure server 30 notifies the current OTP timer value as in step 4020 (step 4050).

[0020]

As described above, according to the present invention,
A one-time password display program can be installed on a JAVA mobile phone, and then a password that changes with time is displayed by the execution of the program. Therefore, the portability is excellent, the validity period is long, the operation cost is low, and the radio wave environment is poor. A display device for a one-time password that can operate even in an environment can be provided.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a one-time password authentication system using a JAVA mobile phone.

FIG. 2 is a sequence diagram of a one-time password authentication system using a JAVA mobile phone.

FIG. 3 is a diagram showing another embodiment of the installation information.

FIG. 4 is a diagram showing another embodiment of communication between a JAVA mobile phone and a secure server.

[Explanation of symbols]

 10 Program Download Server 20 Secure Server 21 Installation Information Notification Service 22 OTP Authentication Service 23 OTP Program Generation Service 30 Business Server 40 FW 50 GW 60 JAVA Mobile Phone 61 OTP Program 70 Client PC 80 Internet 90 Mobile Phone Network 100 Corporate LAN

 ──────────────────────────────────────────────────続 き Continued on the front page F term (reference) 5B085 AE03 BC02 5J104 AA07 KA01 KA09 KA21 MA01 NA05 NA36 PA02 5K067 AA34 BB04 EE02 EE10 EE16 FF23 GG01 GG11 HH23 HH24 KK13 KK15

Claims (9)

[Claims] 1. A user refers to a one-time password displayed on a program downloadable mobile phone,
In a one-time password authentication system in which the password is used as an access password to a computer system and a password check server checks the legitimacy of the one-time password input by the user, a program downloadable mobile phone is requested based on a request from the user. Means for creating an execution object of a program which operates on the above and displays a one-time password from the seed information and the user ID; means for downloading the execution object created by the creation means to a program downloadable mobile phone; Means for sending the execution object to the means, that the download of the execution object is enabled by the download means, and information necessary for downloading the execution object to the user. Means for knowledge, after downloading the execution object, a password authentication system characterized by comprising means for performing the initialization by replacing the password check server information. 2. The apparatus according to claim 1, wherein said download means includes means for responding to a download request from a program downloadable mobile phone and managing a period for transmitting an execution object of a one-time password display program. And a one-time password authentication system. 3. The method according to claim 1, wherein the initialization unit comprises:
A one-time password authentication system comprising means for synchronizing time with a password check server. 4. The password check server according to claim 1, wherein the password check server includes means for notifying the one-time password display program of a current position from a start value of a random sequence starting from a specific seed. Characterized one-time password authentication system. 5. The one-time password authentication device according to claim 1, wherein said initialization means includes means for negotiating a synchronization start time between the password check server and the one-time password display program. system. 6. The method according to claim 1, wherein the initialization unit includes:
A one-time password authentication system comprising: means for receiving seed information from a password check server; and means for operating a one-time password display program in accordance with the notified seed information. 7. The method according to claim 1, wherein the information notifying means to the user includes: means for transmitting an installation URL;
A one-time password authentication system comprising: means for starting download according to user designation of RL. 8. The one-time password authentication system according to claim 7, wherein said URL notification means has a function of including seed information in said URL. 9. The one-time password authentication system according to claim 1, wherein said download means includes means for mediating communication between a password check server and a one-time password display program. .