JP2003242042A - Access authentication system, access authentication method, storage medium and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication method when a user accesses the content data on a client. <P>SOLUTION: This access authentication method is characterized in that it has a client specific information acquiring means to acquire client specific information specific to the downloaded environment, a client specific information writing means which encodes client specific information acquired by the client specific information acquiring means and writes it in a password file, a password extracting means which extracts the password information from the downloaded content data, a password writing means which encodes the password information extracted by the password extracting means and writes it in a password file, a first determining means to check whether or not the client specific information acquired by the client specific information acquiring means is present in the password file, and a second determining means to check whether or not the password information extracted by the password extracting means is present in the password file. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an access authentication method on a computer.

[0002]

2. Description of the Related Art When a user accesses data on a computer, it is authenticated whether or not the user has the right (access right) to access the data, and whether or not the user can access the data is authenticated according to the authentication result. There are conventional methods for determining.

For example, consider a case where content data is downloaded from an Internet server for a fee.
Content data is widely used for still images such as images.
Although this is a concept including moving images such as video and audio, it is assumed here that the data is digital data that can be used by specific application software and is owned by the operating body of the server.

Downloading is an operation of transferring content data from an Internet server to a user's environment (client). At that time, it is possible to download the content data only after paying a usage fee for the content data by some method. . A user who pays the content data usage fee and downloads the content data is called a regular user.

Although the act of distributing the content data downloaded in this way on the user side is restricted by the copyright law, it is impossible to physically prevent copying by a malicious user due to the nature of digital data.

Therefore, in order to limit the access right to the content data to the legitimate user, it is desired to authenticate whether or not the person trying to access the content data is the legitimate user.

First, there is a method of requesting the input of the password set in the content data when accessing the content data. This password will be notified to the authorized user when downloading. This is a method of permitting access if the entered password and the password set in the content data are equal, and denying access if they are not equal.

[0008] However, this method cannot prevent malicious transmission of the password and cannot be used for the purpose of restricting access, just as digital data cannot prevent malicious copying.

Further, there is a drawback in that it is very troublesome for the authorized user to manage the password for each content data. Next, there is a method of distributing an access ticket to a regular user based on user-specific information, which is described in, for example, Japanese Patent Laid-Open No. 10-308732.

Although this method is sufficient to prevent malicious copying, the user has to manage the user-specific information and the access ticket separately.

[0011]

SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances, and by utilizing the information on the environment (client) of the user, the user can access the client without any trouble. An object of the present invention is to provide an authentication method when a user accesses the content data of.

[0012]

In order to achieve the above object, the present invention provides a download means for downloading content data containing password information, and a content data holding means for holding the content data downloaded by the download means. A password file holding means for holding a password file for recording the password information, a client unique information obtaining means for obtaining client unique information unique to the downloaded environment, and the client obtained by the client unique information obtaining means Client unique information writing means for encrypting unique information and writing it in the password file; password extracting means for extracting the password information from the downloaded content data; A password writing means for encrypting the password information extracted by the word extracting means and writing it in the password file, and a first judgment for checking whether or not the client unique information obtained by the client unique information obtaining means exists in the password file. There is provided an access authentication system and the like characterized by having means and second judging means for checking whether or not the password information extracted by the password extracting means exists in the password file.

[0013]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described in detail below with reference to the drawings. First, a configuration example of the present invention will be described with reference to FIG.

1a is a server, here a computer existing on the Internet. Reference numeral 1b is a client, and here is a computer of a user who can connect to the Internet. 1c is a communication path, which is the Internet here. 1d is a plurality of content data stored in the server.

1e is a password held in each content data. Here, the password is data of an arbitrary length in which only the application software that accesses the content data knows the recording position in the content data, and it is assumed to be different for each content data.

Reference numeral 1f is client-specific information, which enables the client to be distinguished from all other clients. Here, Microsoft
File system (FA) in Windows (R)
The volume serial number used in T, FAT32, NTFS) is used.

This is a hexadecimal 8-digit number issued to the fixed storage device of the client, and can be expected to be unique for each client in the world, and rewriting by the user is usually impossible.

Next, the operation of the application software when downloading the content data will be described with reference to FIGS. 2 and 3. First, FIG. 2 is a diagram showing a configuration at the time of downloading.

2a is a server like 1a, 2b is a client like 1b, 2c is a communication path like 1c, 2d is content data like 1d, 2e is a password like 1e, 2f is client-specific information like 1f.

Reference numeral 2g is content data downloaded from the server 2a to the client 2b using the communication path 2b and is stored in the client 2b.
2h is a password included in the content data 2g. Reference numeral 2i is a password file held in the client 2b, which holds client unique information 2f and a content data password 2h. 2j, 2
Reference characters k and 2l represent application software processing means at the time of downloading.

Reference numeral 2j is a download means for transferring one of the content data 2d from the server 2a to the client 2b using the communication path 2b and storing it as the content data 2g in the client 2b.

Reference numeral 2k is a client unique information writing means for encrypting the client unique information 2f and writing the encrypted client unique information in the password file 2i.

Here, the encryption is an operation of applying an irreversible one-way function to data, and the property of the one-way function is to convert the original data from the encrypted data obtained by applying the one-way function to the original data. It is impossible to analogize, and
This means that the same encrypted data is not generated even if the one-way function is applied to separate original data.

Here, MD5 Mes is used as a one-way function.
Use the Sage-Digest Algorithm. MD5 (Message-Digest 5) is R
SAData Security, Inc. Developed by IETF (Internet Engineer)
ng Task Force's RFC (Requests)
t For Comment) 1321. MD5 is a one-way function that inputs data of arbitrary length and outputs a 128-bit long "fingerprint". It is impossible to infer the original data from the output "fingerprint", and it is separate. The same "fingerprint" is not generated from the data of.

Reference numeral 2l is a password writing means for extracting the password 2h from the content data 2d downloaded in 2j, encrypting it like 2k, and writing it in the password file 2i.

Next, FIG. 3 is a flowchart showing a procedure for downloading the application software. Step 3a is a process of downloading the content data, which corresponds to 2j in FIG. 2 and one of the content data 2d is transmitted to the server 2a using the communication path 2b.
Content data 2g
Is stored in the client 2b.

Step 3b is a process for judging whether or not a password file exists. Client 2b
If the password file 2i does not exist in step 3, step 3
Move to c. If the password file 2i already exists, the process branches to step 3d.

Step 3c is a process for creating a new password file and writing the client unique information, which corresponds to 2k in FIG. 2 and newly creates the password file 2i and acquires the client unique information 2f from the client 2b. , The acquired client unique information 2f is encrypted by MD5, and the encrypted client unique information is written in the password file 2i.

Step 3d is a process for writing the password of the content data in the password file.
2l corresponding to the password 2h, the password 2h is extracted from the content data 2g held by the client 2b, the extracted password 2h is encrypted by the MD 5, and the encrypted password is written to the password file 2i.

Next, the operation of the application software when authenticating whether or not there is an access right to the content data will be described with reference to FIGS. 4 and 5. First, FIG. 4 is a diagram showing a configuration at the time of authentication.

4a is a client like 1b and 2b, and 4b is client unique information like 1f and 2f. Although 4c is content data like 2g, it is assumed here that it is content data to be authenticated whether or not there is an access right. 4d is a password like 2h, and 4e is a password file like 2i. Reference numerals 4f and 4g represent processing procedures of application software. Reference numeral 4f is a first determining means for encrypting the client unique information 4b and comparing it with the encrypted client unique information held in the password file 4e. 4g is content data 4c to password 4d
Is a second determining means for determining whether or not there is a match with the encrypted password held in the password file 4e.

Next, FIG. 5 is a flow chart showing the procedure at the time of authenticating the access right in the application software. Step 5a is a process of determining whether or not a password file exists. If the password file 4e does not exist in the client 4a, the process branches to step 5e. Step 5 if password file 4e exists
Move to b.

Step 5b is a process for judging whether or not the correct client unique information exists in the password file, which corresponds to 4f in FIG. 4, and obtains the client unique information 4b from the client 4a and obtains the acquired client unique information 4b. Is encrypted with MD5, and the encrypted client unique information is the password file 4e.
Check if exists.

If it does not exist, it is not a password file created on the client 4a by at least this application software, and the process branches to step 5e. If it exists, it is a password file created on the client 4a by this application software, so the process proceeds to step 5c.

Step 5c is a process for judging whether or not a correct password for the content data exists in the password file, which corresponds to 4g in FIG. 4, and extracts the password 4d from the content data 4c of the client 4a, and the extracted password. 4d is encrypted by MD5, and the encrypted password is the password file 4e.
Check if exists.

If it does not exist, the content data 4c exists in the client 4a without going through the download procedure shown in FIGS. 2 and 3, so that the process branches to step 5e. If it exists, the content data 4c exists in the client 4a through the download procedure shown in FIGS. 2 and 3, so that the process proceeds to step 5d.

Step 5d is a process upon successful authentication.
Step 5e is processing when authentication fails.

Here, even if the content data downloaded on a certain client A is copied to another client B, the password file does not exist in the client B, or if the password file exists, the content data No password is recorded.

Therefore, the former case is not authenticated in step 5a, and the latter case is not authenticated in step 5c due to the nature of MD5.

Also, if both the content data downloaded on a client A and the password file existing on the client A are transferred to another client B,
Even if it is copied to the client B, since the client unique information 4b of the client B is different from the client A, it is not authenticated in step 5b due to the property of the client unique information and the property of MD5.

The contents of the password file are MD5
Is a mere number string output by the above, the original data cannot be restored due to the property of MD5, and the password file cannot be forged.

In this embodiment, the server is a computer existing on the Internet. However, the present invention is not limited to this. As long as it has a function of holding at least content data and a function of communicating with a client, other Even if you take the configuration of, generality is not lost.

In this embodiment, the client is the computer of the user who can connect to the Internet.
The present invention is not limited to this, and as long as it is operable by the user and has at least a function of holding content data and other data and a function of communicating with a server, it loses generality even if other configurations are taken. Absent.

In the present embodiment, the communication path is the Internet, but it is not limited to this, and generality is not lost as long as it is a medium such as personal computer communication, leased line, etc. in which the client and server can communicate.

In this embodiment, the volume serial number is used as the client unique information, but the present invention is not limited to this, and the MAC address of the network card, for example, can be considered. MAC (Media A
access control address is IEEE (I
nstate of Electrical an
d Electronic Engineers) consists of a manufacturer number assigned to each network card maker and a card number assigned to each network card by the network card maker, and can be expected to be unique for each network card in the world. It is possible.

Further, information other than the volume serial number and the MAC address can be used as long as the information can identify the client from all the other clients.

Although MD5 is used as the encryption method in this embodiment, the present invention is not limited to this, and encrypted data obtained by applying the one-way function to the original data is not limited to this. If it is impossible to infer the original data from the original data, and if the same encrypted data is not generated even if the one-way function is applied to separate original data, any one-way function It can be used.

In this embodiment, the example in which the download and the access authentication are performed by the same application software has been shown, but it is not necessary that the same application software is used.
Downloading may be performed by, for example, a plug-in used when browsing a web page of the server using a web browser.

In the present embodiment, the password is different for each content data, but the plurality of content data hold the same password, so that the access right to the plurality of content data can be authenticated with a single password. You can also

Although the password is included in the content data in the present embodiment, the fact that the content of the content data cannot be the same as the other content data is used,
The contents of the contents data can also be used as a password.

Further, the present invention is applied to a system composed of a plurality of devices (eg, host computer, interface device, reader, printer, etc.), but is also applied to a device composed of one device (eg, copying machine, facsimile machine). You may.

Further, the functions of the above-described embodiments are realized for a computer in an apparatus or system connected to the various devices so that the various devices are operated to realize the functions of the above-described embodiments. What is implemented by supplying the program code of software for operating the above-mentioned various devices according to the program stored in the computer (CPU or MPU) of the system or apparatus is also included in the scope of the present invention.

In this case, the program code itself of the software realizes the functions of the above-described embodiments, and the program code itself constitutes the present invention. As a transmission medium of the program code, a communication medium (a wired line such as an optical fiber or a wireless line) in a computer network (LAN, WAN such as the Internet, a wireless communication network, etc.) system for propagating and supplying the program information as a carrier wave. Etc.) can be used.

Further, means for supplying the program code to the computer, for example, a recording medium storing the program code constitutes the present invention. A flexible disk, a hard disk, an optical disk, a magneto-optical disk, a CD-ROM, a magnetic tape, a non-volatile memory card, a ROM, or the like can be used as a recording medium for storing the program code.

Further, not only the functions of the above-described embodiments are realized by executing the supplied program code by the computer, but also the OS (operating system) or the other in which the program code is operating in the computer. It goes without saying that the program code is also included in the embodiment of the present invention when the functions of the above-described embodiment are realized in cooperation with the application software of the above.

Further, after the supplied program code is stored in the memory provided in the function expansion board of the computer or the function expansion unit connected to the computer, the function expansion board or function expansion unit is instructed based on the instruction of the program code. It goes without saying that the present invention also includes a case where the CPU or the like included in the above-mentioned performs some or all of the actual processing and the functions of the above-described embodiments are realized by the processing. The computer may be a general computer as shown in FIG.

FIG. 6 is a diagram showing the internal structure of a general personal user terminal device. In FIG. 6, 1200
Is a computer PC. PC1200 is CPU1
201, which executes device control software stored in the ROM 1202 or the hard disk (HD) 1211 or supplied from the flexible disk drive (FD) 1212, and executes the system bus 1204.
Control each device connected to the.

The CPU 1201 and RO of the PC 1200
The function of each unit of the present embodiment is realized by the program stored in the M1202 or the hard disk (HD) 1211.

Reference numeral 1203 is a RAM, which functions as a main memory and a work area of the CPU 1201. A keyboard controller (KBC) 1205 is a keyboard (K
B) Control instruction input from 1209 or a device (not shown).

Reference numeral 1206 denotes a CRT controller (CRT
C) controls the display on the CRT display (CRT) 1210. 1207 is a disk controller (DK
In C), a boot program (startup program: a program for starting execution (operation) of hardware or software of a personal computer), a plurality of applications, edit files, user files, a hard disk (HD) 1211 for storing a network management program, and the like, and It controls access to the flexible disk (FD) 1212.

Reference numeral 1208 denotes a network interface card (NIC), which is a network printer, another network device, or another P device via the LAN 1220.
It exchanges bidirectional data with C. It should be noted that the shapes and structures of the respective parts shown in the above-mentioned embodiments are merely examples of the implementation in carrying out the present invention, and the technical scope of the present invention is limited by these. It should not be interpreted. That is,
The present invention can be implemented in various forms without departing from the spirit or the main features thereof.

[0062]

As described above, the download means for downloading the content data including the password information, the content data holding means for holding the content data downloaded by the download means, and the password for recording the password information Password file holding means for holding a file, client unique information obtaining means for obtaining client unique information unique to the downloaded environment, and the client unique information obtained by the client unique information obtaining means is encrypted into the password file. Client unique information writing means for writing, password extracting means for extracting the password information from the downloaded content data, and the path extracted by the password extracting means Password writing means for encrypting the password information and writing it in the password file; first judging means for checking whether or not the client unique information acquired by the client unique information acquisition means exists in the password file; and the password extraction By having the second judging means for checking whether or not the password information extracted by the means exists in the password file, it is possible to use the information on the environment (client) of the user to take all the trouble for the user. Therefore, it is possible to provide an authentication method that does not bother the user when the user accesses data or the like on the client.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration example of the present invention.

FIG. 2 is a diagram showing a configuration at the time of downloading.

FIG. 3 is a flowchart showing an operation of software of an application at the time of downloading.

FIG. 4 is a diagram showing a configuration at the time of access authentication.

FIG. 5 is a flowchart showing the operation of application software at the time of access authentication.

FIG. 6 is a diagram of a general computer.

[Explanation of symbols]

2j ... Downloading means 2k ... Client unique information writing means 2l ... Password writing means 3a to 3d ... Processing steps for downloading 4f ... first determination means 4g ... second determination means 5a to 5e ... Processing steps at the time of access authentication

Claims (6)

[Claims] 1. A download unit for downloading content data including password information, a content data holding unit for holding the content data downloaded by the download unit, and a password for holding a password file for recording the password information. File holding means, client unique information acquisition means for acquiring client unique information specific to the downloaded environment, client unique information writing by encrypting the client unique information acquired by the client unique information acquisition means, and writing it in the password file Means, password extracting means for extracting the password information from the downloaded content data, and the password information extracted by the password extracting means. Password writing means for writing the password to the password file, first judging means for checking whether or not the client unique information acquired by the client unique information acquiring means exists in the password file, and extracted by the password extracting means An access authentication system, comprising: a second judging means for checking whether password information exists in the password file. 2. The access to the plurality of content data is authenticated by the single password information, because the plurality of content data have the same password information. Access authentication system. 3. The access authentication system according to claim 1, wherein the content data itself is used as the password information instead of including the password information in the content data. 4. A step of downloading content data including password information, a step of holding the downloaded content data, a step of acquiring client-specific information peculiar to a downloaded environment, and a step of collecting the acquired client-specific information. Encrypting and writing in a password file; extracting the password information from the downloaded content data; encrypting the extracted password information and writing the password information in the password file; An access authentication method comprising: a step of checking whether the password information exists in the password file; and a step of checking whether the extracted password information exists in the password file. 5. A computer-readable storage medium that stores a program that causes a computer to implement each unit of the access authentication system according to any one of claims 1 to 3 and each step of the access authentication method according to claim 4. 6. A program for causing a computer to realize each unit of the access authentication system according to any one of claims 1 to 3 and each step of the access authentication method according to claim 4.