JP2002169466A - Server system, application terminal and computer readable recording medium recorded with program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To lessen the burden of an application terminal by providing a server system which carries out asymmetric cipher and decipher processing through the network relating to a system for carrying out the asymmetric cipher and decipher processing necessary for digital authentication according to the request of the application terminal. SOLUTION: A user authentication section 4 carries out the authentication of a user by using data for the user authentication received in a server communication section 3 and a cipher processing section 6 reads out the secret key of the user authenticated from a secret key data base section 5 and makes cipher processing of the digest of the message received from the application terminal 11. The server communication section 3 returns the encrypted digest.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a server type digital authentication system in which a server terminal performs asymmetric encryption / decryption processing required for digital authentication.

[0002]

2. Description of the Related Art FIG. 4 shows a digital authentication system using a conventional IC card. A certificate DB unit 8 for managing a certificate in an application terminal 11 and an encryption using a public key in the certificate are performed. It has an encryption processing unit 9 for performing processing and a decryption processing unit 10 for performing decryption. The IC card has a user authentication unit 4 for authenticating a user with a user ID and a password.
And a secret key DB unit 5 for managing a secret key, an encryption processing unit 6 for performing encryption using the secret key, and a decryption processing unit 7 for decrypting using the secret key.

Next, the operation will be described. To perform confidentiality, the public key of the confidential destination certificate is extracted from the certificate DB 8, the confidential data sent from the application 1 is encrypted by the encryption processing unit 9, and returned to the application 1.
To release confidentiality, first, user authentication is performed by the user authentication unit 4 in the IC card. Only when the authentication result is OK, the following processing can be performed. The user's secret key is extracted from the secret key DB unit 5, the confidential data sent from the application is decrypted by the decryption processing unit 7, and the application 1
To return.

[0004] In order to sign, first, user authentication is performed by the user authentication unit 4 in the IC card 15. Authentication result is OK
The following processing can be performed only when The secret key of the user is extracted from the secret key DB unit 5, the signature data sent from the application is encrypted by the encryption processing unit 6 and returned to the application 1. When verifying the signature, the public key of the certificate of the signature destination is extracted from the certificate DB unit 11, the signature data sent from the application 1 is decrypted by the decryption processing unit 10, and the decrypted data is returned to the application 1.

[0005]

A conventional digital authentication system using an IC card requires a high-performance IC card capable of performing encryption and decryption processing using a secret key in order to prevent eavesdropping of the secret key. However, there is a problem in that the IC card is required for each application terminal, and the introduction cost is high, and the processing time for encryption / decryption inside the IC card is long.

[0006] The present invention has been made to solve the above-mentioned problems, and an encryption / decryption process using a secret key is performed by a server with enhanced security.
The purpose is to eliminate the need for a C card.

[0007]

A server device according to the present invention is a server device connected via a network to an application terminal for requesting information encryption, and has the following elements. (1) a server receiving unit that receives data for user authentication and information to be encrypted from an application terminal;
(2) a user authentication unit that authenticates a user using the received user authentication data; (3) a secret key database unit that stores a secret key corresponding to the user; and (4) a user authentication unit that authenticates the user. A secret key corresponding to the user who has read the encrypted information from the secret key database, encrypting the received information to be encrypted using the read secret key, and (5) transmitting the encrypted information to the application terminal. Server transmission unit.

Further, the information to be encrypted is a digest of a message.

Further, the server device further comprises a decryption processing unit for performing decryption using the secret key.

[0010] The data for user authentication is the user I
D and the password, and the user authentication unit
User authentication is performed using D and a password.

The server device further has a certificate database unit for storing a certificate corresponding to the confidential destination, and the server receiving unit receives confidential information and a message from the application terminal. The encryption processing unit reads a certificate corresponding to the confidential destination specified by the received confidential destination information from the certificate database unit, and encrypts the received message using a public key included in the read certificate. After processing, the server transmission unit transmits the encrypted message to the application terminal.

Further, the server device further comprises a decryption processing unit for decrypting using the public key included in the certificate.

[0013] The data for user authentication is biometrics information, and the user authentication unit authenticates the user using the biometrics information.

Further, the biometrics information is fingerprint information.

An application terminal according to the present invention comprises:
An application terminal for requesting information encryption from a server device via a network, the application terminal having the following elements. (1) a client transmitting unit that transmits data for user authentication and information to be encrypted to the server device, (2) a client receiving unit that receives encrypted information from the server device, and (3) encryption. Application part that uses the obtained information.

A computer-readable recording medium having recorded thereon a program according to the present invention is a program for causing a computer serving as a server device connected via a network to an application terminal for encrypting information to execute the following processing. Is recorded on a computer-readable recording medium. (1) a process of receiving data for user authentication and information to be encrypted from an application terminal; (2) a process of authenticating a user using the received data for user authentication; Correspondingly storing the secret key,
(4) read the secret key corresponding to the authenticated user,
A process of encrypting the received information to be encrypted using the read secret key; and (5) a process of transmitting the encrypted information to the application terminal.

[0017]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiment 1 FIG. 1 is a system configuration diagram showing a case where the present invention is applied to confidentiality / signature of an application message. In FIG. 1, reference numeral 1 denotes an application that requires the function of confidentiality / signing of a message, 2 denotes a client communication unit that performs encrypted communication with a server, 3 denotes a server communication unit that performs communication with a plurality of clients, and 4 denotes a message passed from the application A user authentication unit for performing user authentication using a user ID and a password, a secret key DB unit for managing a secret key corresponding to the user, a cryptographic processing unit for performing encryption using a secret key, and a secret processing unit A decryption processing unit that performs decryption using a key, 8 is a certificate DB unit that manages a certificate, 9 is an encryption processing unit that performs encryption using a public key in the certificate, and 10 is a certificate processing unit that performs encryption. A decryption processing unit that performs decryption using the private key of the user, 11 is an application terminal operated by the user, 12 is a server terminal that receives processing from a plurality of application terminals, and 13 is a plurality of application terminals. Deployment is a terminal and a network that connects the server terminal. The application terminal 11 and the server terminal 12 are computers, and each element can execute processing by a program. Further, the program can be stored in a storage medium, and can be read by the computer from the storage medium.

Next, the operation will be described. First, the signature processing will be described. The application 1 creates a digest (hash value) of the message, and sends the user ID and password input by the user to the client communication unit 2. The client communication unit 2 encrypts the data passed from the application 1, and
Send to

The user authentication unit 4 performs user authentication based on the user ID and password in the data passed by the server communication unit 3. If the user authentication fails, the server 12
Interrupts the process and returns authentication failure to the application. If the user authentication is successful, the corresponding secret key is obtained from the secret key DB unit 5, the digest is encrypted by the encryption processing unit 6, and the digest is returned to the application 1. The application adds the encrypted digest to the message.

Next, the confidential processing will be described. The confidential destination certificate is extracted from the certificate management DB, the message is encrypted by the encryption processing unit 9 using the public key in the certificate, and the message is returned to the application 1. Application 1
Performs application processing using the encrypted message.

As described above, since the server performs the encryption / decryption processing using the secret key, the secret key is not placed on the application terminal, but is signed without the IC card at the same security level as that of the IC card.・ Privacy can be realized.

Further, since it is not necessary to attach an IC card to each application terminal, the management cost can be reduced. Further, when the IC card is lost, a procedure for reissuing the IC card is necessary. However, since the IC card is not used, such processing is not required, and the convenience for the user is improved.

Further, the part to be processed by the server can record the processing contents in a log, and can detect unauthorized user access. Further, when the user wants to stop using the server, the server can be immediately stopped by deleting the user information in the user authentication unit.

Embodiment 2 FIG. In the first embodiment,
The encryption / decryption process using the public key is performed by the application terminal. Next, an embodiment in which the server terminal performs the encryption / decryption process using the public key will be described. FIG.
Is a system configuration diagram in such a case.

In FIG. 2, reference numeral 1 denotes an application that requires a message confidentiality / signature function, 2 denotes a client communication unit that performs encrypted communication with a server, 3 denotes a server communication unit that communicates with a plurality of clients, and 4 denotes an application. A user authentication unit that performs user authentication using the user ID and password passed from the user, 5 is a secret key DB unit that manages a secret key corresponding to the user, and 6 is a secret key and a public key in a certificate. A decryption processing unit for performing decryption using a secret key or a public key in a certificate;
Is a certificate DB unit for managing certificates, 11 is an application terminal operated by a user, 12 is a server terminal receiving processing from a plurality of application terminals, and 13 is a network connecting the plurality of application terminals and the server terminal.

Next, the operation will be described. The signature processing is the same as in the first embodiment.

Next, the confidential processing will be described. The confidential information and the message are passed from the application 1 to the client communication unit 2. The client communication unit 2 passes the data passed from the application 1 to the server communication unit 3 by cryptographic communication. The corresponding certificate is extracted from the confidential information in the certificate DB unit 5, the message passed from the application by the encryption processing unit 7 is encrypted using the public key in the certificate, and the encrypted message is returned to the application 1.

As described above, since the server performs the encryption / decryption processing using not only the private key but also the public key, it is not necessary to implement the asymmetric encryption operation function having a large processing load on the application terminal. It can be easily applied to portable terminals and the like.

Further, since it is not necessary to manage certificates in the application terminal, memory can be saved. Further, when the certificate is revoked, it is sufficient to delete the certificate in the certificate management DB of the server terminal without changing the settings of the plurality of application terminals, so that the management cost can be reduced.

Embodiment 3 In the above embodiment, a user ID and a password are used for user authentication. Next, an embodiment using a fingerprint as biometrics will be described. FIG. 3 shows a system configuration unit in such a case.

In FIG. 2, reference numeral 1 denotes an application that requires a function of confidentiality and signature of a message, 2 denotes a client communication unit that performs encrypted communication with a server, 3 denotes a server communication unit that communicates with a plurality of clients, and 4 denotes an application. A user authentication unit for performing user authentication using fingerprint information passed from the user, 5 a secret key DB unit for managing a secret key corresponding to the user, and 6 a cipher using a secret key and a public key in a certificate. 7, a decryption processing unit for decrypting using a private key or a public key in a certificate, 8 a certificate DB unit for managing certificates, 11 an application terminal operated by a user, 12 is a server terminal receiving processing from a plurality of application terminals, 13 is a network connecting the plurality of application terminals and the server terminal, and 14 is collecting fingerprint information It is a fingerprint acquisition unit.

Next, the operation will be described. First, the signature processing will be described. The application 1 creates a hash of the message, and sends the fingerprint information collected from the fingerprint acquisition unit 14 to the client communication unit 2. The client communication unit 2 encrypts the data passed from the application 1 and sends it to the server communication unit 3.

User authentication is performed by the user authentication unit 4 based on the fingerprint information in the data passed by the server communication unit 3. The fingerprint information is collated with the fingerprint information registered in the user authentication unit 4, and if there is no fingerprint information for which the collation is successful, the processing in the server 12 is interrupted and the authentication failure is returned to the application 1. If the user authentication is successful, a corresponding secret key is obtained from the secret key DB unit 5 and the data of the hash value is
And returns to application 1. The application adds the encrypted hash value to the message.

Next, the confidential processing will be described. The confidential processing is the same as in the second embodiment.

As described above, stronger security can be realized by using fingerprint authentication instead of authentication using a user ID and a password. Further, since there is no need to manage fingerprint information in the application terminal, leakage of fingerprint information can be prevented only by maintaining security of the server terminal.

Also, since the matching is performed by the server terminal, by preparing a terminal capable of high-speed processing in the server, the matching by combining a plurality of biometrics can be easily realized.

[0037]

As described above, according to the present invention, since encryption / decryption using the secret key is performed at the server terminal, there is no need to put the secret key in the application terminal, and the security level is the same as that of the IC card. In addition, the signature and confidentiality can be realized without an IC card, and the introduction cost can be reduced when there are a plurality of application terminals.
There is no IC card, so there is no loss and the user's convenience is improved. Also, by authenticating the user at the server terminal, the log is taken, so that the administrator can monitor the unauthorized access and immediately stop using the user. There is an effect that can be done.

Further, by performing encryption / decryption using not only the secret key but also the public key at the server terminal, the operation function of the asymmetric encryption having a large processing load is not required, and the server terminal can be mounted on a portable terminal or the like. . Furthermore, since certificate management is not required on the application terminal side, the cost for managing a plurality of application terminals and the memory can be saved.

In addition, strong security is achieved by authenticating the user with biometrics instead of the user ID and password, and the user's convenience and the high-speed processing are realized because the user does not need to input the user ID and password. By preparing a server terminal capable of performing the above, user authentication by a combination of a plurality of biometrics can be easily realized.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a system configuration according to a first embodiment.

FIG. 2 is a block diagram showing a system configuration according to a second embodiment.

FIG. 3 is a block diagram showing a system configuration according to a third embodiment.

FIG. 4 is a block diagram showing a conventional example.

[Explanation of symbols]

1 application, 2 client communication section, 3
Server communication section, 4 user authentication section, 5 secret key DB section,
6 decryption processing unit, 7 encryption processing unit, 8 certificate DB unit,
9 encryption processing unit, 10 decryption processing unit, 11 application terminal, 12 server terminal, 13 network,
14 Fingerprint acquisition unit, 15 IC card.

──────────────────────────────────────────────────続 き Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat ゛ (Reference) H04L 9/32 H04L 9/00 673A 673D 675D (72) Inventor Naoyoshi Okazaki 2-chome, Marunouchi, Chiyoda-ku, Tokyo No. 3 Mitsubishi Electric Co., Ltd. (72) Hiroshi Nakamura 2-3-2 Marunouchi, Chiyoda-ku, Tokyo Mitsui Electric Co., Ltd. (72) Teruko Fujii 2-3-2 Marunouchi, Chiyoda-ku, Tokyo No. Mitsubishi Electric Corporation F term (reference) 5B017 AA03 BA05 BA07 CA15 CA16 5B035 AA13 BB09 BC00 CA11 5B085 AE01 AE13 AE23 AE29 BG07 5J104 AA07 AA09 AA16 EA01 EA05 KA01 KA17 LA05 MA01 NA02 NA05 PA07

Claims (10)

[Claims] 1. A server device connected to an application terminal for requesting information encryption via a network, the server device having the following elements: (1) encrypting data for user authentication from the application terminal; A server receiving unit for receiving information and
(2) a user authentication unit that authenticates a user using the received user authentication data; (3) a secret key database unit that stores a secret key corresponding to the user; and (4) a user authentication unit that authenticates the user. A secret key corresponding to the user who has read the encrypted information from the secret key database, encrypting the received information to be encrypted using the read secret key, and (5) transmitting the encrypted information to the application terminal. Server transmission unit. 2. The server device according to claim 1, wherein the information to be encrypted is a digest of a message. 3. The server device according to claim 1, further comprising a decryption processing unit that performs decryption using a secret key.
The server device according to the above. 4. The data for user authentication is a user ID and a password, and the user authentication unit uses the user ID and the password to
The server device according to claim 1, wherein user authentication is performed. 5. The server device further includes a certificate database unit for storing a certificate corresponding to the confidential destination, wherein the server receiving unit receives confidential information and a message from the application terminal. The encryption processing unit reads a certificate corresponding to the confidential destination specified by the received confidential information from the certificate database unit, and encrypts the received message using the public key included in the read certificate. The server device according to claim 1, wherein the server transmission unit transmits the encrypted message to the application terminal. 6. The server device according to claim 5, wherein the server device further includes a decryption processing unit that performs decryption using a public key included in the certificate. 7. The server device according to claim 1, wherein the data for user authentication is biometrics information, and the user authentication unit authenticates the user using the biometrics information. 8. The server device according to claim 7, wherein the biometric information is fingerprint information. 9. An application terminal for requesting a server device to encrypt information via a network, wherein the application terminal includes the following elements. (1) a client transmitting unit that transmits data for user authentication and information to be encrypted to the server device, (2) a client receiving unit that receives encrypted information from the server device, and (3) encryption. Application part that uses the obtained information. 10. A computer-readable recording medium storing a program for causing a computer serving as a server device connected via a network to an application terminal requiring information encryption to execute the following processing: (1) Application terminal , A process of receiving user authentication data and information to be encrypted, (2) a process of authenticating a user using the received user authentication data, and (3) a secret key corresponding to the user. Processing to memorize,
(4) read the secret key corresponding to the authenticated user,
A process of encrypting the received information to be encrypted using the read secret key; and (5) a process of transmitting the encrypted information to the application terminal.