JP2003256372A - User authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a user authentication system for preventing illegal intrusion by a hacker to a computer system. <P>SOLUTION: The user authentication system is characterized in that a first terminal device and a second terminal device are provided for each user, and a host computer is provided with a first authentication information verification means that receives a first authentication information from the first terminal device and verifies whether the first authentication information is valid, an authentication information providing means that transmits a second authentication information to the second terminal device if the first authentication information is valid, and a second authentication information verification means that receives the second authentication information from the first terminal device and verifies whether the second authentication information is valid. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention, when accessing a host computer from a terminal device provided by a user,
The present invention relates to a system that authenticates whether a terminal device is permitted to access.

[0002]

2. Description of the Related Art Recently, with the spread of the Internet and Intranet, it has become easier to access a computer system, but the importance of user authentication is also increasing in order to maintain its security and reliability. As a method thereof, a password method is widely and generally used, and it is said that it is desirable to change the password regularly and to use it together with a disposable password in order to further enhance the security.

However, even if the password is changed regularly or used in combination with a one-time password, there is still a risk of leakage of the changed password and the password generation tool, and a user for preventing unauthorized intrusion into the system. Stronger measures for certification are desired.

[0004]

SUMMARY OF THE INVENTION In order to solve the above problems, it is an object of the present invention to provide a user authentication system for preventing unauthorized access to a computer system by a hacker.

[0005]

In order to achieve the above object, according to the invention described in claim 1, when a terminal device provided by a user accesses a host computer, whether the terminal device is permitted to access the host computer or not. A system for authentication, wherein the user includes a first terminal device and a second terminal device for each user, and the host computer communicates with the first terminal device and the second terminal device via a communication network. Connected, and the host computer receives the first authentication information from the first terminal device,
A first authentication information verification means for verifying whether the first authentication information is valid, and a second if the first authentication information is valid
Authentication information providing means for transmitting authentication information to the second terminal device, and second authentication information for receiving the second authentication information from the first terminal device and verifying whether the second authentication information is valid. At least a verification means is provided.

According to the first aspect of the present invention, even if the authentication information is leaked, it is possible to prevent unauthorized intrusion into the host computer unless the predetermined second terminal device is used.

According to a second aspect of the present invention, the authentication information providing means further generates different second authentication information at predetermined time intervals and transmits the second authentication information to the second terminal device. It is characterized by being provided.

According to the second aspect of the present invention, the authentication information generation tool can be executed by the host computer instead of the terminal device provided by the user, so that the chances of leakage of the authentication information generation tool can be reduced. Since the second authentication information is different for each authentication, it is possible to eliminate anxiety about leakage of the authentication information.

[0009]

BEST MODE FOR CARRYING OUT THE INVENTION An embodiment of the present invention will be described in detail below with reference to the drawings. FIG. 1 is a schematic diagram showing a system configuration in a user authentication system of the present invention.

As shown in FIG. 1, a user authentication system 100 includes a first terminal device 1 such as a personal computer equipped with a user, a second terminal device 2 such as a portable radio telephone, a first terminal device 1 device 1 and a second terminal device 2. The terminal device 2 includes a host computer 10 connected via the Internet 3.

The host computer 10 receives the search request from the database 20 for registering the information necessary for performing the user authentication work and the user terminal device 1, and retrieves the search result of the database 20 from the Internet 3 It is composed of a Web server 11 for transmitting via the database, a database server 12 for managing the database 20, and an application server 13 for performing business processing of user authentication business.

The database 20 is a user table 2
1 and the authentication table 22.

The user table 21 records registration information of users who access the host computer 10. In the user registration information, a user code that is a search key part, and information such as a user name, an address, a telephone number, and a registration date that belong to the data part are stored.

The authentication table 22 records the authentication information of the user who accesses the host computer 10. The authentication information includes a user code that is a search key part and first authentication information (first terminal device) that is a search key part.
And the name of the first terminal device belonging to the data section, the mail address 1 of the first terminal device, the second terminal device name, the mail address 2 of the second terminal device, the second authentication information (second terminal device), the registration date Stores and stores information such as the date. The second authentication information is generated by the authentication information generation tool and registered by the authentication information providing unit 32 described later.

Next, the processing procedure for the processing means 30 of the host computer 10 to search the database 20 in response to a request signal from the first terminal device 1 via the Internet 3 will be described in detail. FIG. 2 is a flow chart of the processing of the processing means in the host computer of the present invention, and the processing means 30 is composed of the following three means.

That is, it comprises a first authentication information verification means 31, an authentication information providing means 32 and a second authentication information verification means.

The first authentication information verification means 31 receives the first authentication information from the first terminal device 1 and verifies whether the first authentication information is valid.

The processing procedure of the first authentication information verification means 31 will be described in detail below. (1) In response to the first authentication information verification request signal from the first terminal device 1, the first authentication information verification / first authentication information input screen is transmitted to the first terminal device 1. (2) Accepting the input of the first authentication information from the first terminal device 1, and using the input first authentication information, the authentication table 2
2 is searched and authentication information is acquired. (3) When the authentication information can be acquired, the mail address 2 of the second terminal device 2 set in the authentication information is transmitted to the authentication information providing unit 32.

If the first authentication information is valid, the authentication information providing means 32 generates different second authentication information at every predetermined time and sends the second authentication information to the second terminal device 2.

The processing procedure of the authentication information providing means 32 will be described in detail below. (1) The authentication information providing unit 32 is the host computer 1
It is automatically started when the power of 0 is turned on, and waits until the mail address 2 of the second terminal device 2 is received from the first authentication information verification means 31. (2) When the weight is released, the second authentication information is generated by the authentication information generation tool using a random number, and the second
The authentication information is transmitted to the second terminal device 2 having the mail address 2.

The second authentication information verification means 33 receives the second authentication information from the first terminal device 1 and verifies whether the second authentication information is valid.

The processing procedure of the second authentication information verification means will be described in detail below. Subsequent to the processing (3) of the first authentication information verification means 31, the processing procedure of the second authentication information verification means 33 will be described in detail below. (1) In response to the second authentication information verification request signal from the first terminal device 1, the second authentication information verification / second authentication information input screen is transmitted to the first terminal device 1. (2) The input of the second authentication information received by the second terminal device 2 from the first terminal device 1 is accepted, and the authentication information providing means 3 is provided.
The input second authentication information is collated with the second authentication information generated by the authentication information generation tool using the random number in the process (2) of 2 and if the same, the host computer utilization service is started.

Although one embodiment of the present invention has been described in detail above, the present invention is not limited to this embodiment. Various modifications can be made without departing from the technical scope of the present invention.

[0024]

As described above, according to the user authentication system of the present invention, even if the authentication information is leaked, unauthorized access to the host computer can be prevented unless the predetermined second terminal device is used. Can be prevented.

Also, the authentication information generation tool can reduce the chances of leakage of the authentication information generation tool by executing the authentication information generation tool not on the terminal device provided by the user but on the host computer. Since the two pieces of authentication information are different, anxiety about leakage of the authentication information can be eliminated.

[Brief description of drawings]

FIG. 1 is a schematic diagram showing a system configuration in a user authentication system of the present invention.

FIG. 2 is a flow chart of processing of processing means in the host computer of the present invention.

[Explanation of symbols]

1 First terminal device 2 Second terminal device 3 Internet 10 Host computer 11 Web server 12 database server 13 Application server 20 databases 21 user table 22 Authentication table 30 processing means 31 First authentication information verification means 32 means for providing authentication information 33 Second authentication information verification means 100 user authentication system

Claims (2)

[Claims] 1. A system for authenticating whether a terminal device provided to a user is a terminal device permitted to access the host computer, wherein the user is a first terminal device for each user. Second
A terminal device, the host computer is connected to the first terminal device and the second terminal device via a communication network, and the host computer receives the first authentication information from the first terminal device. First authentication information verification means for receiving and verifying whether the first authentication information is valid, and authentication information for transmitting second authentication information to the second terminal device if the first authentication information is valid. A user comprising at least providing means and second authentication information verification means for receiving the second authentication information from the first terminal device and verifying whether the second authentication information is valid. Authentication system. 2. The authentication information providing means further comprises: generating different second authentication information at predetermined time intervals and transmitting the second authentication information to the second terminal device. The user authentication system according to claim 1.