JP2004118541A - Authentication processing system, authentication processing method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent unauthorized use by posing as an authorized user even when a user ID and a password are wiretapped. <P>SOLUTION: A server 10 on the Internet 30 performs authentication with the user ID and password sent from a client 20 at the first connection, in an authentication processing part 12, generates authentication information unique to the user ID in a mail transmission processing part 11 for a legal access request, registers the authentication information in an authentication information table 13, and transmits the authentication information given to mail, to the mail address of the user ID. The client 20 makes the following access request using the authentication information given to mail from the server 10, and thereafter repeats the updating of an authentication method. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an authentication processing technique based on a user ID and a password between a client and a server on a computer network, and more particularly to an authentication processing technique suitable for securely performing user authentication on the Internet.
[0002]
[Prior art]
In computer networks, particularly the Internet, authentication using a user ID and a password is used to restrict unauthorized access and use of Web contents.
[0003]
For example, a general user is connected to the Internet via a computer (server) of a contracted ISP (Internet Service Provider), and when accessing the Internet, the server of the ISP sets the ISP in advance. The user ID and password (which can be arbitrarily changed after the contract) notified at the time of the contract with the ISP are transmitted, and the server on the ISP side has the received user ID and password registered in advance corresponding to the user. Search for and authenticate.
[0004]
However, in such an authentication technique, every time a connection is made to a server, a user ID and a password are transmitted in clear text on the Internet. There is a high risk of access and unauthorized use of the system.
[0005]
As a conventional technique for addressing such a problem, for example, there is a technique disclosed in Patent Document 1.
[0006]
This Patent Document 1 discloses an access control technique that does not use a user name and a password in WWW (World Wide Web). In this technique, after successful authentication using a password, a dialog ID and a dialog ID are transmitted from a server computer. This authentication information is issued, and in the subsequent information exchange, authentication is performed using this authentication information (dialogue ID).
[0007]
More specifically, at the time of transmission from the server computer to the client computer, a dialogue ID is added after the URL (Uniform Resource Locator) portion of the link in the hypertext to be transmitted to the client computer, and the transmission is performed. At the time of transmission, when a link in the hypertext is clicked, a dialog ID is added to the URL and transmitted. According to this technique, since the user name and the password are transmitted only at the time of the first authentication, the chance of the password being eavesdropped is greatly reduced.
[0008]
However, in the technique described in Patent Document 1, the same conversation ID is continuously used without being changed until the user name and the password are again authenticated, so that the conversation ID is eavesdropped. Until the conversation ID is changed by the re-authentication using the next user name and password, another person can impersonate the user and acquire information.
[0009]
As a technique for addressing such a problem, for example, there is a technique described in Patent Document 2.
[0010]
According to the technology described in Patent Document 2, in order to reduce the possibility that a user ID and a password are eavesdropped, authentication data is changed and sent from a server to a client each time a connection is established. Request the next page with additional data.
[0011]
That is, the server authenticates the client with the user ID and the password only at the time of the first connection, then generates an authentication code and sends it to the client. When the client requests information again, the server The server sends the authentication code received from the server to the server, and the server receiving the authentication code further changes the authentication code and sends it to the client.
[0012]
As described above, according to the technology described in Patent Document 2, by changing the authentication code every time an access is performed, a person who eavesdrops on the authentication code in the middle of transmission can impersonate a legitimate user and acquire information, for example. Access can be prevented.
[0013]
[Patent Document 1]
Japanese Patent Application Laid-Open No. 09-050422 [Patent Document 2]
JP 2000-172645 A
However, according to the technology described in Patent Document 2, if a user ID and a password that flow in the clear on the Internet at the first connection are wiretapped, it is possible to impersonate a regular user permanently and use the system illegally.
[0015]
[Problems to be solved by the invention]
The problem to be solved is that the conventional technology cannot avoid unauthorized access due to eavesdropping of the user ID and password at the time of the first connection.
[0016]
SUMMARY OF THE INVENTION An object of the present invention is to solve the problems of the prior art, and to prevent unauthorized use of the system by impersonating an authorized user even when a user ID and a password are eavesdropped.
[0017]
[Means for Solving the Problems]
In order to achieve the above object, according to the present invention, when a server authenticates a user with a user ID and a password sent from an access requesting client to determine that the access is valid, the server generates authentication information unique to the user ID. In addition to registering the authentication information in the storage device in association with the user ID, a mail to which the authentication information is added is generated and transmitted to an e-mail address registered in advance in association with the user ID. The next access request is made using the authentication information attached to the sent mail, and the server receiving the authentication information from the client compares the authentication information with the authentication information registered in the storage device to perform authentication. Processing is performed. Also, when performing authentication processing based on the user ID and password at the time of the first connection, and updating the authentication information to new authentication information every time after the authentication processing, the server notifies the authentication information by e-mail only at the time of the first connection. Do.
[0018]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
[0019]
FIG. 1 is a block diagram showing a configuration example of an authentication processing system according to the present invention, FIG. 2 is a block diagram showing a hardware configuration example of the authentication processing system in FIG. 1, and FIG. It is a sequence diagram showing an example of processing operation of the system.
[0020]
2, reference numeral 21 denotes a display device such as a CRT (Cathode Ray Tube) or an LCD (Liquid Crystal Display); 22, an input device including a keyboard and a mouse; and 23, an external storage device including a HDD (Hard Disk Drive). , 24 are an information processing apparatus having a CPU (Central Processing Unit) 24a, a main memory 24b, an input / output interface 24c and the like for performing computer processing, and 25 is a CD-ROM (Compact Disc) recording programs and data according to the present invention. -An optical disk such as a read only memory (DVD) or a DVD (Digital Video Disc / Digital Versatile Disc); Programs and data drive for reading, 27 is a communication device comprising a LAN (Local Area Network) card or a modem.
[0021]
After the programs and data stored in the optical disk 25 are installed in the external storage device 23 by the information processing device 24 via the driving device 26, the programs and data are read from the external storage device 23 into the main memory 24b, and processed by the CPU 24a. Each processing unit and each function in the server 10 and the client 20 shown in FIG.
[0022]
In FIG. 1, reference numeral 10 denotes a server, reference numeral 20 denotes a client, reference numeral 30 denotes the Internet including a public network, and the server 10 has a function as a Web server or a mail server for transmitting information to the client 20 via the Internet 30, As a function of performing a processing operation according to the present invention, a mail transmission processing unit 11, an authentication processing unit 12, and an authentication information table 13 are provided. In the authentication information table 13, a password (pass1 to pass5), authentication data (000001a4c2,.・ 000005@abc.com) is registered.
[0023]
Further, the client 20 has a client program processing unit 20a (described as “client program” in the figure) including a Web browser, an e-mail program, and the like.
[0024]
In such a configuration, in the authentication processing system of the present example, when performing authentication processing based on the user ID and the password between the client 20 and the server 10 connected via the Internet 30, the client 20 and the server 10 The authentication process is performed based on the user ID and the password between the devices, and at the time of subsequent connection, the authentication process is performed using the authentication information unique to the user ID generated by the server 10 at the time of the first authentication process. Updates the new authentication information every time it connects.
[0025]
That is, the client 20 sends the user ID and the password to the server 10 at the time of the first access request, and the server 10 uses the user ID and the password sent from the access requesting client 20 to authenticate in the authentication processing unit 12. Do.
[0026]
When the server 10 determines that the request is a valid access request in the authentication processing, the server 10 generates authentication information unique to the user ID in the mail transmission processing unit 11 and associates the authentication information with the user ID in the storage device. In addition to the registration in the authentication information table 13, a mail to which the authentication information is added is generated and transmitted to a mail address registered in advance in the authentication information table 13 in association with the user ID.
[0027]
The client 20 receives the mail sent from the server 10 at the client program processing unit 20a, and makes a next access request to the server 10 using the authentication information given to the mail.
[0028]
The server 10 that has received the authentication information from the client 20 in this way performs an authentication process in the authentication processing unit 12 by comparing the authentication information from the client 20 with the authentication information registered in the authentication information table 13 in the storage device. I do. Further, the server 10 changes the authentication information in the mail transmission processing unit 11, updates the authentication information table 13, and notifies the client 20.
[0029]
Hereinafter, an operation when the client 20 acquires information (Web page) from the server 10 in the authentication processing system of the present example will be described with reference to FIG.
[0030]
First, when a page request is made from the client 20 to the server 10 (step 101), the server 10 transmits a login request page to the client 20 (steps 102 and 103).
[0031]
When the user inputs a user ID and a password from the client 20 (step 104), and sends a user ID and a password to the server 10 to request authentication (step 105), the server 10 sends the authentication information The user ID and password in the table 13 are confirmed, authentication data is created and stored in the authentication information table 13, and an authentication success page is transmitted to the client 20 (steps 106 and 107).
[0032]
Further, the server 10 adds, in the mail transmission processing unit 11, the URL for system use to which the authentication data created in step 106 has been added to the mail text, and the mail of the user acquired from the authentication information table 13. The message is transmitted to the address (steps 108 and 109).
[0033]
The user who has received the mail uses the client 20 to click on the URL with the authentication data described in the mail (step 110), and makes a page request to the server 10 (step 111).
[0034]
Then, the server 10 that has received the page request refers to the authentication information table 13 in the authentication processing unit 12, confirms that the authentication data is correct, creates new authentication data, and stores it in the authentication information table 13. Then, the page to which the new authentication data is added is transmitted to the client 20 (steps 112 and 113).
[0035]
Each time the client 20 requests the next page (step 111), the server 10 performs the processing of steps 112 and 113.
[0036]
As described above with reference to FIGS. 1 to 3, in the authentication processing technique of this example, the authentication processing is performed between the client 20 and the server 10 connected via the Internet 30 as a computer network based on the user ID and the password. When the server 10 performs the authentication, the authentication processing unit 12 performs authentication using the user ID and the password sent from the client 20 at the time of the first connection, and if the access request is valid, the mail transmission processing unit 11 performs the authentication. Authentication information unique to the user ID is generated and associated with the user ID, registered in the authentication information table 13 (storage device), and a mail to which the authentication information is added is generated. And sends it to a mail address registered in advance.
[0037]
Then, the client 20 receives the mail sent from the server 10 in the client program processing unit 20a, and makes a next access request using the authentication information given to the mail. The server 10 that has received the authentication information from the server 10 performs authentication processing in the authentication processing unit 12 by comparing the authentication information from the client 20 with the authentication information registered in the authentication information table 13 in association with the user ID. Do.
[0038]
Further, the server 10 changes the authentication information to new authentication information each time a connection is made from the client 20, and repeats updating of the authentication information table 13 and notification to the client 20. At this time, the updated authentication information is added to, for example, a Web page provided to the client 20 instead of the e-mail, and is notified.
[0039]
As described above, in this example, since the authentication information for using the system is sent by e-mail, even if the user ID and password are eavesdropped on the Internet system requiring authentication, the system is used by impersonating the authorized user. Can be prevented.
[0040]
It should be noted that the present invention is not limited to the example described with reference to FIGS. 1 to 3 and can be variously modified without departing from the gist thereof. For example, in the present embodiment, an example of the authentication processing between the server 10 and the client 20 connected via the Internet 30 has been described, but the present invention can also be applied to other computer network systems such as an intranet.
[0041]
Further, as an example of the computer configuration of the server 10 and the client 20 in the present example, a computer configuration without a keyboard or a drive device for an optical disk may be used. In this example, the optical disk is used as the recording medium, but an FD (Flexible Disk) or the like may be used as the recording medium. As for the installation of the program, the program may be downloaded and installed via a network via a communication device.
[0042]
【The invention's effect】
According to the present invention, authentication information for using the system is notified by e-mail, so even if a user ID and password are eavesdropped on a computer network that requires authentication, the system is improperly used by impersonating an authorized user. Can be prevented.
[Brief description of the drawings]
FIG. 1 is a block diagram illustrating a configuration example of an authentication processing system according to the present invention.
FIG. 2 is a block diagram illustrating a hardware configuration example of an authentication processing system in FIG. 1;
FIG. 3 is a sequence diagram illustrating an example of a processing operation of the authentication processing system in FIG. 1;
[Explanation of symbols]
10: server, 11: mail transmission unit, 12: authentication processing unit, 13: authentication information table, 20: client, 20a: client program processing unit, 21: display device, 22: input device, 23: external storage device, 24 : Information processing device, 24a: CPU, 24b: main memory, 24c: input / output interface, 25: optical disk, 26: drive device, 27: communication device, 30: Internet.

Claims (5)

A system for performing an authentication process between a client and a server connected via a computer network based on a user ID and a password,
The above server,
Authentication processing means for performing authentication with the user ID and the password sent from the client requesting access;
If the authentication processing means determines that the request is a legitimate access request, it generates authentication information unique to the user ID, registers the authentication information in the storage device in association with the user ID, and adds the authentication information to the mail. And a mail transmission processing unit for transmitting the mail to a mail address registered in advance in the storage device in association with the user ID,
The client has means for making a next access request using the authentication information given to the mail sent from the server,
An authentication processing system, wherein the server that has received the authentication information from the client performs authentication processing in the authentication processing means by comparing the authentication information with authentication information registered in the storage device. At the first connection between a client and a server connected via a computer network, an authentication process is performed based on a user ID and a password. After the authentication process, the server generates authentication information unique to the user ID and generates the authentication information. An authentication processing method in an authentication processing system for performing authentication processing of the client based on the authentication information by notifying the authentication information and updating the authentication information with new authentication information every time connection is made,
An authentication processing method, wherein the server registers a mail address in a storage device in advance in association with a user ID, and notifies the authentication information by e-mail at the first connection. An authentication processing method in a system for performing authentication processing based on a user ID and a password between a client and a server connected via a computer network,
In the above server,
Perform authentication with the user ID and the password sent from the access requesting client,
If the access request is determined to be valid in the procedure, authentication information unique to the user ID is generated and registered in the storage device in association with the user ID,
A mail with the authentication information is generated and transmitted to a mail address registered in a storage device in advance in association with the user ID,
The client makes a next access request using the authentication information given to the mail sent from the server,
An authentication processing method, wherein the server receiving the authentication information from the client performs an authentication process by comparing the authentication information with authentication information registered in the storage device. An authentication processing method according to any one of claims 2 and 3,
The computer network comprises the Internet,
An authentication processing method, wherein the server adds a URL of a Web page used by the client and the authentication information to a body of an e-mail generated at the time of the first connection, and transmits the URL to the client. A program for causing a computer to execute each processing procedure in the authentication processing method according to claim 2.

Images