JP2004013374A - Unidirectional authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To authenticate an access requester by using time information. <P>SOLUTION: A time information acquiring part 11 of an access request terminal 1 digitally signs for the time information acquired from a clock source 23 by a time information acquiring part 22 via a transmitting-receiving part 21 of an NTP server 2, and transmits the information to an access authentication server 3 together with a public key certificate issued by an authentication station system 5. The access authentication server 3 decodes the digitally signed time information by a public key, and compares the decoded time information with time information acquired from the NTP server 2, and permits access from the access request terminal 1 by the access requester when a comparing result falls within a reference time range indicated by a prescribed authentication parameter, and does not permit the access when the comparing result is out of the range. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a one-way authentication system, and more particularly to a one-way authentication system that authenticates an access requester using variable information.
[0002]
[Prior art]
An example of a conventional one-way authentication system is an authentication system using an ID and a password. In this conventional authentication system using an ID and a password, it is necessary to construct a user database in an access authentication server in advance. An example of another conventional one-way authentication system is an authentication system using a one-time password. This conventional one-time password authentication system prevents unauthorized use by changing the password each time it is accessed.
[0003]
[Problems to be solved by the invention]
As described above, in the conventional authentication system using an ID and a password, it is necessary to construct a user database in the access authentication server in advance, and thus it was not possible to prevent unauthorized use by a database administrator. Also, in this case, since the access information flowing through the communication network is a constant value, the access information is intercepted by wiretapping of the communication network, and it has been difficult to prevent unauthorized access by a third party using the access information.
[0004]
In addition, since the conventional one-time password authentication system prevents unauthorized use by changing the password each time it is accessed, it is necessary to build a user database, and a password is generated on the access requester side. It was necessary to prepare a machine. In this case, the password is randomly generated, but there is a possibility that the password generation algorithm is illegally used for disclosure.
[0005]
The present invention has been made in view of such a situation, and it is an object of the present invention to authenticate an access requester using time information and to suppress unauthorized access by a third party.
[0006]
[Means for Solving the Problems]
The one-way authentication system according to claim 1, wherein the authentication server accesses the time information transmitted from the terminal, the time being digitally signed using the secret key, and the public key corresponding to the secret key. In a one-way authentication system for authenticating a requester, a terminal includes: a first time information acquisition unit for acquiring time information; and an access request for time information acquired by the first time information acquisition unit. Signature means for performing a digital signature using the private key of the user, time information digitally signed by the signature means, and transmission means for transmitting a public key corresponding to the secret key to an authentication server, the authentication server comprising: Digitally signed time information transmitted from the receiving means, receiving means for receiving the public key, decoding means for decoding the digitally signed time information transmitted from the terminal using the public key, Second time information obtaining means for obtaining the time information, comparison means for comparing the time information decoded by the decoding means with the time information obtained by the second time information obtaining means, and a comparison result by the comparing means And determining means for determining whether or not the access by the access requestor is permitted.
The information processing apparatus may further include a time information providing server that provides time information, and the first time information obtaining means and the second time information obtaining means may obtain the time information from the time information providing server.
The comparing means compares the time information decoded by the decoding means with the time information obtained by the second time information obtaining means to obtain a time difference, and the determining means determines that the time difference is equal to a predetermined reference time. Within the range, access by the access requester can be permitted.
In addition, the public key is distributed to the access requestor together with the public key certificate for certifying the validity of the public key, and the public key certificate may further include verification means for verifying the validity of the public key certificate.
The public key certificate can be issued after examining the access requester.
The one-way authentication method according to claim 6, wherein the authentication server accesses the time information transmitted from the terminal, the time being digitally signed using the secret key, and the public key corresponding to the secret key. A one-way authentication method for authenticating a requester, wherein a terminal obtains time information by a first time information obtaining step, and performs an access request to the time information obtained in the first time information obtaining step. A digital signature using a private key of the user, a time step of digitally signing in the signature step, and a transmitting step of transmitting a public key corresponding to the private key to an authentication server, wherein the authentication server comprises a terminal Receiving the digitally signed time information transmitted from the terminal, a receiving step of receiving the public key, and decrypting the digitally signed time information transmitted from the terminal using the public key A decoding step, a second time information obtaining step of obtaining time information, a comparing step of comparing the time information decoded in the decoding step with the time information obtained in the second time information obtaining step, And a judging step of judging whether or not the access by the access requestor is permitted according to the comparison result in the comparing step.
Further, in the first time information obtaining step and the second time information obtaining step, time information can be obtained from a predetermined time information providing server that provides time information.
In the comparing step, the time information decoded in the decoding step is compared with the time information obtained in the second time information obtaining step, and the time difference is obtained. The access by the access requester can be permitted within the time range.
The public key may be distributed to the access requestor together with the public key certificate proving the validity of the public key, and the authentication server may further include a verification step for verifying the validity of the public key certificate. it can.
The public key certificate can be issued after examining the access requester.
The one-way authentication program according to claim 11, wherein the authentication server accesses the time information transmitted from the terminal using the time information when the digital signature is performed using the secret key and the public key corresponding to the secret key. A one-way authentication program for controlling a one-way authentication system for authenticating a requester, comprising: a terminal having a first time information acquiring step of acquiring time information; and a time acquired in the first time information acquiring step. A signature step of digitally signing the information using the private key of the access requester, a time step of digitally signing in the signature step, and a transmitting step of transmitting a public key corresponding to the private key to the authentication server. The authentication server performs a receiving step of receiving the digitally signed time information transmitted from the terminal, the public key, and the terminal using the public key. A decoding step of decoding the received digitally signed time information, a second time information obtaining step of obtaining time information, the time information decoded in the decoding step, and an obtaining in the second time information obtaining step And a determining step of determining whether or not the access requester can access according to the comparison result in the comparing step.
Further, in the first time information obtaining step and the second time information obtaining step, time information can be obtained from a predetermined time information providing server that provides time information.
In the comparing step, the time information decoded in the decoding step is compared with the time information obtained in the second time information obtaining step, and the time difference is obtained. The access by the access requester can be permitted within the time range.
The public key may be distributed to the access requestor together with the public key certificate proving the validity of the public key, and the authentication server may further include a verification step for verifying the validity of the public key certificate. it can.
The public key certificate can be issued after examining the access requester.
[0007]
BEST MODE FOR CARRYING OUT THE INVENTION
According to the present invention, in a process in which a server authenticates an access from a client, a communication between the access authenticator and the access requester is performed by the access requester by digitally signing the time information by the access requester. It is intended to simplify the one-way operation for the authenticator.
[0008]
FIG. 1 is a block diagram showing a configuration example of an embodiment of the one-way authentication system of the present invention. Referring to FIG. 1, the present embodiment includes an access request terminal 1, an NTP (Network Time Protocol) server 2, an access authentication server 3, a communication network 4 such as the Internet for interconnecting these, and a certificate authority. It comprises a system 5.
[0009]
The access request terminal 1 includes a time information acquisition unit 11 and a signature unit 12. The time information acquisition unit 11 acquires time information from the NTP server 2 via the communication network 4. The signature unit 12 applies a digital signature to the time information acquired by the time information acquisition unit 11, and transmits the digital information as access information to the access authentication server 3 via the communication network 4.
[0010]
The NTP server 2 includes a transmission / reception unit 21, a time information acquisition unit 22, and a clock source 23 that measures time and outputs the current time as time information. The time information obtaining unit 22 obtains reliable time information from the clock source 23 and transmits the obtained time information to the access request terminal 1 and the access authentication server 3.
[0011]
The transmission / reception unit 21 receives the request from the time information acquisition unit 11 of the access request server 1 and transmits the time information acquired from the clock source 23 to the time information acquisition unit 11 via the time information acquisition unit 22. Similarly, upon receiving a request from the time information acquisition unit 32 of the access authentication server 3, the time information acquired from the clock source 23 via the time information acquisition unit 22 is transmitted to the time information acquisition unit 32.
[0012]
The access authentication server 3 includes a time information reading unit 31, a time information obtaining unit 32, and a partner authentication unit 33. The time information reading unit 31 decodes the time information with the digital signature received from the access request terminal 1. The partner authentication unit 33 compares the time information decoded by the time information reading unit 31 with the time information obtained by the time information obtaining unit 32 from the NTP server 2, and authenticates the access requester.
[0013]
The certificate authority system 5 includes a registration unit 51 and an issuing unit 52. The registration unit 51 notifies the issuance unit 52 of a certificate issuance request based on the registration information of the user of the one-way authentication system. The issuing unit 52 issues a public key certificate in response to a certificate issuing request from the registration unit 51.
[0014]
Next, the overall operation of the present embodiment will be described with reference to the flowcharts of FIGS. 2, 3, and 4.
[0015]
First, the operation of user registration when using the one-way authentication system will be described with reference to the flowchart of FIG. The registration unit 51 of the certificate authority system 5 requests the issuance unit 52 to issue a public key certificate including user data (step A1). The issuing unit 52 of the certificate authority system 5 issues a public key certificate (step A2) and distributes it to the access requester (step A3). At this time, the person in charge of the registration authority of the certificate authority system 5 examines the access requester and issues a public key certificate when it is determined that the user is a valid user. Also, a secret key unique to the access requestor is distributed to the access requestor.
[0016]
The method of applying the issuance of the public key certificate to the issuing unit 52, the method of distributing the public key certificate to the access requester, and the method of distributing the private key to the access requester depend on the certificate authority system 5. Yes, they do not matter.
[0017]
Next, an operation in which the access request terminal 1 sends the access information to the access authentication server 3 will be described with reference to a flowchart of FIG. The time information acquisition unit 11 of the access request terminal 1 requests the transmission / reception unit 21 of the NTP server 2 for time information (Step B1). The transmission / reception unit 21 requests the time information acquisition unit 22 of the NTP server 2 for time information (step B2). The time information acquisition unit 22 acquires reliable time information from the clock source 23 and sends it to the transmission / reception unit 21 (step B3). The transmission / reception unit 21 transmits the time information to the time information acquisition unit 11 of the access request terminal 1. (Step B4).
[0018]
The time information acquisition unit 11 of the access request terminal 1 requests the signature unit 12 to perform a digital signature on the acquired time information (step B5). The signature unit 12 applies a digital signature to the time information using the secret key of the access requestor (step B6). The time information acquisition unit 11 reads the signature value (time information digitally signed using the private key of the access requestor) and the public key certificate of the access requester from the access authentication server 3 as access information. It is sent to the unit 31 (step B7).
[0019]
Next, an operation of the access authentication server 3 for determining whether or not an access request from the access request terminal 1 is permitted will be described with reference to a flowchart of FIG. First, when the time information reading unit 31 of the access authentication server 3 receives the signature value transmitted from the access request terminal 1 and the public key certificate of the access requester, the time information reading unit 31 receives the public key certificate of the access requester. The validity of the document is verified (step C1).
[0020]
Verification of the validity of the public key certificate of the access requester is performed using an algorithm published as rfc2459. The basic verification items are, for example, as follows.
(1) Is the certificate in the correct format as the public key certificate?
(2) Whether it is within the validity period described in the public key certificate (whether it is valid at the time of verification).
(3) Is the serial number of the public key certificate listed in the public key certificate revocation list issued by the certificate authority system 5?
[0021]
Next, the public key is extracted from the public key certificate, the signature value is decrypted with the public key, the time information transmitted by the access requestor is obtained (step C2), and the time information is passed to the partner authentication unit 33 (step C3). ).
[0022]
The time information acquisition unit 32 of the access authentication server 3 requests time information from the transmission / reception unit 21 of the NTP server 2 (Step C4). The transmission / reception unit 21 requests the time information acquisition unit 22 of the NTP server 2 for time information (step C5). The time information acquisition unit 22 of the NTP server 2 acquires reliable time information from the clock source 23 and sends it to the transmission / reception unit 21 (step C6). The transmission / reception unit 21 sends the time information acquisition unit 32 of the access authentication server 3 to the time information acquisition unit 32. The time information is transmitted (step C7).
[0023]
The time information acquisition unit 32 of the access authentication server 3 passes the received time information to the partner authentication unit 33 of the access authentication server 3 (Step C8). The partner authentication unit 33 accesses the time difference generated between the time information transmitted from the time information acquisition unit 11 of the access request terminal 1 and the time information received by the time information acquisition unit 32 of the access authentication server 3. Is set as an authentication parameter (step C9).
[0024]
The partner authentication unit 33 compares the time information transmitted from the access request terminal 1 with the time information obtained by the access authentication server 3, and compares the time information transmitted from the access request terminal 1 with the time information transmitted by the access authentication server 3. If the time difference generated with the time information is a value within the range of the time difference set as the authentication parameter, the access is permitted (step C10).
[0025]
As described above, according to the present embodiment, the following effects can be obtained. First, by installing a reliable certificate authority system 5 and distributing a public key certificate including user data in advance, the access authentication server 3 can identify the access requester without holding the user database. It is possible to authenticate. The reason is that the person in charge of the registrar of the trusted certificate authority system 5 issues the public key certificate after examining the access requester. This is because it can be determined whether or not there is.
[0026]
Second, by installing a reliable NTP server 2 and applying a digital signature to the time information obtained by the access request terminal 1, the signature value and the public key certificate can be used as access information that can be tampered with. Is possible. The reason is that, since encryption (digital signature) is performed using a secret key held only by the access requester using the access request terminal 1, the signature value of the time information is unique to the access requester and differs every time an access request is made. This is because only the public key extracted from the public key certificate corresponding to the private key of the access requester can decrypt the signature value. Also, since the secret key does not flow through the communication network 4, the possibility of leakage or duplication is extremely low. In addition, if the access information being transmitted has been tampered with, it cannot be decrypted and cannot be tampered with. This is because it can be detected.
[0027]
Third, the access authentication server 3 can set authentication parameters in consideration of the line speed and quality of the communication network 4. The reason is that the NTP server 2 from which the access authentication server 3 acquires the time information and the NTP server 2 from which the access request terminal 1 acquires the time information are the same, so that the time information handled by this system is strictly accurate. This is because it can be identified as a value.
[0028]
It should be noted that the configuration and operation of the above embodiment are examples, and it is needless to say that the configuration and operation can be appropriately changed without departing from the spirit of the present invention.
[0029]
【The invention's effect】
As described above, according to the one-way authentication system of the present invention, the terminal is configured such that the first time information obtaining means obtains the time information, and the signature means obtains the time obtained by the first time information obtaining means. The information is digitally signed using the private key of the access requestor, and the transmitting means transmits to the authentication server time information digitally signed by the signature means and a public key corresponding to the private key. In the authentication server, the receiving unit receives the digitally signed time information transmitted from the terminal and the public key, and the decryption unit transmits the digitally signed time information transmitted from the terminal using the public key. Decoding, the second time information obtaining means obtains time information, and the comparing means compares the time information decoded by the decoding means with the time information obtained by the second time information obtaining means, The determining means determines whether or not access by the access requestor is permitted in accordance with the comparison result by the comparing means, so that tampering of the time information and the public key is suppressed, and unauthorized access by a third party is suppressed. Can be.
In addition, a time information providing server for providing time information is further provided, and the first time information obtaining means and the second time information obtaining means obtain accurate time information from the time information providing server. It is possible to determine whether or not the access requester can access based on the time information.
The comparing means compares the time information decoded by the decoding means with the time information obtained by the second time information obtaining means to obtain a time difference, and the determining means determines that the time difference is equal to a predetermined reference time. If it is within the range, if the access by the access requestor is permitted, it is possible to determine whether or not the access by the access requestor is possible based on time information unique to the access requester and different at each access, Unauthorized access by a third party can be suppressed.
In addition, the public key is distributed to the access requestor together with the public key certificate proving the validity of the public key, and if the authentication server is further provided with a verification means for verifying the validity of the public key certificate, the authentication can be performed. The server can authenticate the access requester without maintaining a database of the access requester.
Further, if the public key certificate is issued after examining the access requester, it is possible to determine whether the access requester is a valid user by verifying the public key certificate. .
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration example of an embodiment of a one-way authentication system of the present invention.
FIG. 2 is a flowchart illustrating a procedure for registering a user.
FIG. 3 is a flowchart illustrating a procedure in which an access request terminal sends access information to an access authentication server.
FIG. 4 is a flowchart illustrating a procedure in which an access authentication server determines whether or not an access request from an access request terminal is permitted;
[Explanation of symbols]
1 access request terminal 2 NTP server 3 access authentication server 4 communication network 5 certificate authority system 11, 22, 32 time information acquisition unit 12 signature unit 21 transmission / reception unit 23 clock source 31 time information reading unit 33 partner authentication unit 51 registration unit 52 issuance Department

Claims (15)

A one-way authentication system in which an authentication server authenticates an access requester using time information transmitted from a terminal and digitally signed using a secret key and a public key corresponding to the secret key. So,
The terminal is
First time information acquisition means for acquiring the time information;
Signature means for digitally signing the time information acquired by the first time information acquisition means using a secret key of the access requestor;
The time information digitally signed by the signature unit, and a transmission unit that transmits a public key corresponding to the secret key to the authentication server,
The authentication server,
The time information digitally signed transmitted from the terminal, receiving means for receiving the public key,
Decryption means for decrypting the digitally signed time information transmitted from the terminal using the public key,
Second time information acquisition means for acquiring time information;
Comparing means for comparing the time information decoded by the decoding means with the time information obtained by the second time information obtaining means;
A one-way authentication system comprising: a determination unit configured to determine whether or not the access requestor can perform an access according to a comparison result by the comparison unit. Further comprising a time information providing server for providing the time information,
The one-way authentication system according to claim 1, wherein the first time information obtaining unit and the second time information obtaining unit obtain the time information from the time information providing server. The comparing means compares the time information decoded by the decoding means with the time information obtained by the second time information obtaining means to obtain a time difference, and the determination means determines that the time difference is The one-way authentication system according to claim 1 or 2, wherein the access by the access requester is permitted within a predetermined reference time range. The public key is distributed to the access requestor together with a public key certificate that certifies the validity of the public key, and the authentication server further includes a verification unit that verifies the validity of the public key certificate. The one-way authentication system according to claim 1, 2, or 3, wherein: The one-way authentication system according to claim 1, wherein the public key certificate is issued after examining the access requester. A one-way authentication method in which an authentication server authenticates an access requester using time information transmitted from a terminal and digitally signed using a secret key and a public key corresponding to the secret key. So,
The terminal is
A first time information acquisition step of acquiring the time information;
A signature step of digitally signing the time information acquired in the first time information acquisition step using a secret key of the access requester;
The time information digitally signed in the signature step, and a transmission step of transmitting a public key corresponding to the secret key to the authentication server,
The authentication server,
The digitally signed time information transmitted from the terminal, and a receiving step of receiving the public key;
A decryption step of decrypting the digitally signed time information transmitted from the terminal using the public key,
A second time information obtaining step of obtaining time information;
A comparing step of comparing the time information decoded in the decoding step with the time information obtained in the second time information obtaining step;
A determining step of determining whether or not the access requestor can access according to a result of the comparison in the comparing step. 7. The method according to claim 6, wherein in the first time information obtaining step and the second time information obtaining step, the time information is obtained from a predetermined time information providing server that provides the time information. One-way authentication method. In the comparing step, the time information decoded in the decoding step is compared with the time information obtained in the second time information obtaining step, a time difference is obtained, and in the determining step, 8. The one-way authentication method according to claim 6, wherein if the time difference is within a range of a predetermined reference time, the access by the access requester is permitted. The public key is distributed to the access requestor together with a public key certificate proving the validity of the public key, and the authentication server further includes a verification step of verifying the validity of the public key certificate. The one-way authentication method according to claim 6, 7, or 8, wherein: 10. The one-way authentication method according to claim 6, wherein the public key certificate is issued after examining the access requestor. A one-way authentication system in which an authentication server authenticates an access requester using time information transmitted from a terminal and digitally signed using a secret key and a public key corresponding to the secret key is used. A one-way authentication program to control,
In the terminal,
A first time information acquisition step of acquiring the time information;
A signature step of digitally signing the time information acquired in the first time information acquisition step using a secret key of the access requester;
Transmitting the time information digitally signed in the signing step and transmitting a public key corresponding to the secret key to the authentication server,
In the authentication server,
The digitally signed time information transmitted from the terminal, and a receiving step of receiving the public key;
A decryption step of decrypting the digitally signed time information transmitted from the terminal using the public key,
A second time information obtaining step of obtaining time information;
A comparing step of comparing the time information decoded in the decoding step with the time information obtained in the second time information obtaining step;
A determination step of determining whether or not the access requestor can access the document according to the comparison result in the comparison step. The method according to claim 11, wherein in the first time information obtaining step and the second time information obtaining step, the time information is obtained from a predetermined time information providing server that provides the time information. One-way authentication program. In the comparing step, the time information decoded in the decoding step is compared with the time information obtained in the second time information obtaining step, a time difference is obtained, and in the determining step, 13. The one-way authentication program according to claim 11, wherein the access by the access requester is permitted if the time difference is within a predetermined reference time range. The public key is distributed to the access requestor together with a public key certificate proving the validity of the public key, and the authentication server further includes a verification step of verifying the validity of the public key certificate. The one-way authentication program according to claim 11, 12, or 13, wherein 15. The one-way authentication program according to claim 11, wherein the public key certificate is issued after examining the access requester.

Images