JP2005018421A - Management device, service providing device, and communication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent illegal use of a service such as falsification or spoofing. <P>SOLUTION: The management device 1 authenticates the log-on of a user's terminal 4, then selects a service providing device for providing a service to the user's terminal 4 as a selected service providing device, sends authentication information 340 including an identification number, a user ID and the like and notifying the user's terminal 4 to the selected service providing device alone, and sends service provision destination information 350 including an identification number and a message digest of the authentication information 340 to the user's terminal 4. The user's terminal 4 sends authentication confirming information 360 including an identification number and a message digest to the selected service providing device based on a connection destination address of the service provision destination information 350. The selected service providing device performs the authentication processing of the user's terminal 4 using the authentication information 340 and the authentication confirming information 360, and starts service provision to the user's terminal 4 in the case where authentication can be performed correctly. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an authentication technique for preventing unauthorized use of an information service due to falsification or impersonation.
[0002]
[Prior art]
As a conventional technique, for example, in Japanese Patent Laid-Open No. 11-120141, authentication information about a user terminal is transmitted from the authentication system to the service providing system via the user terminal, and only the validity of the authentication information is evaluated. Is provided.
If such a method using means for transmitting authentication information via a user terminal is used, there is a possibility that even if the authentication information is encrypted, it is illegally used due to theft. In addition, the cipher may be decrypted if sufficient time is used, and there is a possibility of unauthorized use even by falsification.
[0003]
Furthermore, in Japanese Patent Laid-Open No. 2001-331449, authentication information about a user terminal is transmitted from the authentication system to all service providing systems, and further, authentication information for matching in the service providing system is transmitted from the authentication system to the user terminal. Authentication information for this matching is transmitted from the user terminal to a specific service providing system that the user terminal desires to use the service, and if the authentication information is matched in the specific service providing system, the service is provided if it is correct. Is done.
With such a method, there is a possibility that the user terminal is illegally used only when the user terminal is using the system against improper use by impersonation. In other words, since authentication information is transmitted to all service providing systems, a third party who impersonates a legitimate user and attempts to use it illegally must send authentication information to all service providing systems. For example, unauthorized use is possible in all service providing systems.
[0004]
[Patent Document 1]
Japanese Patent Laid-Open No. 11-120141
[Patent Document 2]
JP 2001-331449 A
[0005]
[Problems to be solved by the invention]
An object of the present invention is to solve such problems, and an object of the present invention is to prevent unauthorized use of a service due to falsification or impersonation.
[0006]
[Means for Solving the Problems]
The management device according to the present invention is:
A service requesting device for requesting the provision of a service;
Prior to service provision, multiple services are provided that perform authentication processing on whether or not access is from a legitimate service requester using predetermined authentication information, and start providing services only to authorized service requesters Connected to the device,
A management device that manages the service requesting device and the plurality of service providing devices;
An authentication processing unit that performs a predetermined authentication process on the service requesting device;
When the service requesting device is authenticated by the authentication processing unit, based on the authority granted to the service requesting device and the service content requested by the service requesting device, the service requesting device is selected from the plurality of service providing devices. A service providing apparatus selecting unit that selects a service providing apparatus that causes the service requesting apparatus to provide a service as a selected service providing apparatus;
When the service requesting device is authenticated by the authentication processing unit, when the first authentication information for notifying that the service requesting device is a legitimate service requesting source is compared with the first authentication information Second authentication information that can authenticate access from a legitimate service request source by obtaining a correlation with the first authentication information, and the second authentication information for the service requesting device. An authentication information generating unit that generates transmission destination instruction information for instructing the selection service providing apparatus to transmit;
A service providing device communication unit that transmits the first authentication information only to the selected service providing device among the plurality of service providing devices;
And a service requesting device communication unit configured to transmit the second authentication information and the transmission destination instruction information to the service requesting device.
[0007]
DETAILED DESCRIPTION OF THE INVENTION
Embodiment 1 FIG.
FIG. 1 is a diagram illustrating an overall configuration example of a communication system according to the present embodiment.
The management apparatus 1 is connected to a service providing apparatus (1) 2 and a service providing apparatus (2) 3 via a closed network (for example, a private LAN, a dedicated line network, DMZ (DeMilitized Zone), etc.) 5, and an open network ( For example, it is connected to the user terminal 4 through an open LAN, a corporate LAN, the Internet, or the like.
The service providing device (1) 2 and the service providing device (2) 3 are servers that provide a predetermined information service such as electronic payment. The service providing device (1) 2 and the service providing device (2) 3 perform authentication processing as to whether or not the access is from a legitimate service requester using predetermined authentication information prior to providing the service. Service provision is started only to the requested service requester.
In FIG. 1, two service providing apparatuses are shown for convenience of explanation, but two or more service providing apparatuses may be arranged.
The user terminal 4 is a device that requests service provision by the service providing device (1) 2 or the service providing device (2) 3, and corresponds to an example of a service requesting device.
[0008]
Next, the operation of the communication system according to the present embodiment will be outlined with reference to FIG.
In the communication system according to the present embodiment, the user terminal 4 must first access the management device 1 when receiving a service from the service providing device (1) 2 or the service providing device (2) 3. The service providing device (1) 2 or the service providing device (2) 3 cannot be directly accessed.
When there is an access from the user terminal 4, the management apparatus 1 performs logon authentication for the user terminal 4, and then, based on the authority granted to the user terminal 4 and the service content requested by the user terminal 4, the user terminal 4. The service providing apparatus that provides the service to the user is selected. Here, it is assumed that the service providing apparatus (1) 2 is selected.
Next, the management apparatus 1 generates authentication information 340 for notifying the service providing apparatus (1) 2 of the user terminal 4. This authentication information includes, for example, an identification number, a user ID, authority information, and terminal specific information (for example, the IP address of the user terminal 4). Then, the generated authentication information 340 is transmitted only to the service providing apparatus (1) 2 via the closed network 5.
Also, the service providing destination information 350 is transmitted to the user terminal 4. The service providing destination information 350 includes a connection destination address (the address of the service providing apparatus (1) 2), the same identification number as that included in the authentication information 340, and a message digest of the authentication information 340 (the authentication information 340 is converted into a one-way function. (Information obtained by data conversion).
[0009]
Next, in the user terminal 4, the authentication confirmation information 360 including the identification number and the message digest included in the service providing destination information 350 is obtained from the service providing device (1) using the connection destination address included in the service providing destination information 350. ) Send to 2.
[0010]
Next, the service providing device (1) 2 specifies the authentication information 340 and the authentication confirmation information 360 that are in a correspondence relationship with each other using the identification number as a key, and the terminal-specific information (user terminal) included in the authentication information 340 4) and the terminal specific information (the IP address of the user terminal 4) added to the authentication confirmation information 360 when transmitting the authentication confirmation information 360 are determined. If the two match, it is verified whether or not there is a correlation between the authentication information 340 and the message digest included in the authentication confirmation information 360. Specifically, a message digest of authentication information 340 is generated, and it is verified whether the generated message digest matches the message digest included in authentication confirmation information 360. If the two match, there is a correlation between the information authentication information 340 and the message digest included in the authentication confirmation information 360, so that the service providing apparatus (1) 2 allows the authentication confirmation information 360 to be The user terminal 4 that is the transmission source is authenticated as a legitimate service request source, and service provision to the user terminal 4 is started.
[0011]
The authentication information 340 transmitted from the management device 1 to the service providing device (1) 2 is information for notifying that the user terminal 4 is a legitimate service request source, and corresponds to an example of the first authentication information. To do.
The message digest transmitted from the management apparatus 1 to the user terminal 4 and transmitted from the user terminal 4 to the service providing apparatus (1) 2 is the authentication information (first authentication information) when collated with the authentication information (first authentication information). The first authentication information) is obtained as a result of the correlation, and it is possible to authenticate that the access is from a legitimate service request source, and corresponds to an example of the second authentication information.
The connection destination address transmitted from the management apparatus 1 to the user terminal 4 is information for instructing the user terminal 4 the transmission destination of the message digest (second authentication information), and is an example of the transmission destination instruction information. Equivalent to.
[0012]
Next, a configuration example of the management apparatus 1 according to the present embodiment will be described with reference to FIG.
The closed network communication unit 101 transmits / receives data to / from the service providing apparatus (1) 2 or the service providing apparatus (2) 3 via the closed network 5. The closed network communication unit 101 corresponds to an example of a service providing device communication unit.
The open network communication unit 102 transmits and receives data to and from the user terminal 4 through the open network 6. The open network communication unit 102 corresponds to an example of a service request device communication unit.
The authentication processing unit 103 performs logon authentication for the user terminal 4 when there is an access from the user terminal 4.
The user management information storage unit 104 stores information related to the user terminal 4 and stores, for example, a user ID, a password, and authority information.
The service management information storage unit 105 stores information related to the service providing device, and stores, for example, a service name, a service providing address, and authority information.
The service providing device selection unit 106 refers to the information in the user management information storage unit 104 and the service management information storage unit 105, and based on the authority granted to the user terminal 4 and the service content requested by the user terminal 4, the user terminal 4 selects a service providing apparatus that provides the service to 4.
The authentication information generation unit 107 generates authentication information 340 and service providing destination information 350 while referring to information in the user management information storage unit 104 and the service management information storage unit 105.
[0013]
Although not shown, the management apparatus 1 can be realized by a computer having a CPU such as a microprocessor, a recording unit such as a semiconductor memory or a magnetic disk, and a communication unit. The recording means stores a program that realizes the function of each component included in the management apparatus 1. The CPU reads the program to control the operation of the management apparatus 1, and the function of each component is recorded. Can be realized.
[0014]
Next, a configuration example of the service providing apparatus according to the present embodiment will be described with reference to FIG.
The closed network communication unit 201 transmits / receives data to / from the management apparatus 1 via the closed network 5.
The open network communication unit 202 transmits and receives data to and from the user terminal 4 through the open network 6.
The authentication processing unit 203 performs an authentication process for the user terminal 4. Specifically, as described above, it is determined whether or not the terminal unique information of the authentication information 340 matches the terminal unique information of the authentication confirmation information 360, and is included in the message digest and the authentication confirmation information 360 of the information authentication information 340. It is determined whether the received message digest matches.
The authentication management information storage unit 204 stores the contents of the authentication information 340 from the management apparatus 1 until the authentication confirmation information 360 is received from the user terminal 4 after receiving the authentication information 340 from the management apparatus 1. .
The service providing unit 205 provides a predetermined information service to the service request source authenticated by the authentication processing unit 203.
[0015]
Although not shown, the service providing apparatus can be realized by a computer having a CPU such as a microprocessor, a recording unit such as a semiconductor memory or a magnetic disk, and a communication unit. The recording means stores a program that realizes the function of each component included in the service providing apparatus, and the CPU controls the operation of the management apparatus 1 by reading these programs so that the function of each component can be controlled. Can be realized.
[0016]
Next, the operation of the communication system according to the present embodiment will be described with reference to FIG.
First, in step S101, the user terminal 4 connects to the management apparatus 1 as a stage before using the service.
Next, in step S <b> 102, in the management apparatus 1, the authentication processing unit 103 transmits an authentication screen from the open network communication unit 102 for the connection of the user terminal 4.
Next, in step S <b> 103, the user terminal 4 transmits logon information 310 (user ID, password) to the management apparatus 1.
[0017]
Next, in step S <b> 104, in the management apparatus 1, the authentication processing unit 103 collates the logon information 310 received from the user terminal 4 with the user management information of the user terminal 4 stored in the user management information storage unit 104. Then, logon authentication for the user terminal 4 is performed. If the authentication is correct, the authentication processing unit 103 extracts the authority information from the user management information of the user terminal 4 and passes the extracted authority information to the service providing apparatus selecting unit 106. The service providing device selection unit 106 uses this authority information to extract service names that can be used by the user terminal 4 from the service management information stored in the service management information storage unit 105 to generate menu information 320. It is transmitted from the communication unit 102. If the logon authentication by the authentication processing unit 103 is not correct, the authentication processing unit 103 transmits the authentication screen again. The service is not provided until the correct logon information 310 is transmitted.
[0018]
Next, in step S <b> 105, the user terminal 4 selects a service from the menu information 320 and transmits a service request 330 to the management apparatus 1.
In the management apparatus 1, when receiving the service request 330 from the user terminal 4, the service providing apparatus selection unit 106 uses the service management information stored in the service management information storage unit 105 based on the service name indicated in the service request 330. A service providing destination address is designated, and a service providing apparatus that allows the user terminal 4 to provide a service is selected. This selected service providing apparatus is referred to as a selected service providing apparatus.
[0019]
After the selected service providing device is selected by the service providing device selecting unit 106, the authentication information generating unit 107 generates an identification number (identifier), and the user ID and authority information stored in the user management information storage unit 104 are displayed. In addition, terminal specific information (for example, the IP address of the user terminal 4) for identifying the user terminal 4 is extracted from the packet of the service request 330 in step S105, and these identification number, user ID, authority information, and terminal specific information are extracted. The authentication information 340 is generated and transmitted from the closed network communication unit 101 to the selected service providing apparatus (S106). Note that the authentication information generation unit 107 randomly generates different numbers of identification numbers each time the user terminal is authenticated by the authentication processing unit 103.
On the other hand, in the selected service providing apparatus, the communication unit for closed network 201 receives the authentication information 340, and the authentication processing unit 203 uses the identification number included in the authentication information 340 as a key for the user ID, authority information, and terminal-specific information. Are stored in the authentication management information storage unit 204 as authentication management information, and at this point in time, preparations for service provision to the user terminal are completed.
[0020]
Further, in the management apparatus 1, the authentication information generation unit 107 determines the connection destination address (service provision address) of the selected service providing apparatus from the service management information stored in the service management information storage unit 105 according to the designation of the service providing apparatus selection unit 106. ) And a message digest of the authentication information 340 transmitted to the selected service providing apparatus in step S106 is generated, and the connection destination address and the same identification number as the authentication information 340 transmitted to the selected service providing apparatus in step S106 The service providing destination information 350 including the message digest is generated and transmitted from the open network communication unit 202 to the user terminal 4 (S107).
[0021]
Next, in step S108, the user terminal 4 automatically connects to the connection destination address of the service providing apparatus based on the service providing destination information 350 received from the management apparatus 1, and the identification included in the service providing destination information 350 is identified. The number and the message digest are transmitted as authentication confirmation information 360.
[0022]
In the selected service providing apparatus, based on the identification number of the authentication confirmation information 360 received from the user terminal 4, the authentication processing unit 203 searches the authentication management information storage unit 204 for authentication information 340 corresponding to the authentication confirmation information 360. Then, the terminal unique information is extracted from the retrieved authentication information 340, and it is verified whether or not the terminal unique information included in the packet of the authentication confirmation information 360 matches the extracted terminal unique information.
Further, the authentication processing unit 203 extracts the user ID and authority information of the authentication information 340 corresponding to the authentication confirmation information 360 from the authentication management information storage unit 204, and the identification number, user ID, authority information, terminal A message digest of unique information, that is, a message digest of authentication information 340 is generated. Thereafter, the authentication processing unit 203 verifies whether or not the message digest of the authentication confirmation information 360 received from the user terminal 4 matches the message digest of the generated authentication information 340.
[0023]
If all the above verifications are correct, the authentication processing unit 203 deletes the record (authentication information 340) for the user terminal 4 from the authentication management information, and the service providing unit 205 provides the service to the user terminal 4 according to the authority information. (S109).
On the other hand, if any one of the above verifications does not meet the condition, the service to the user terminal 4 is not provided.
[0024]
As described above, in the communication system according to the present embodiment, the authentication information 340 is transmitted to the selected service providing apparatus only in step S106 when the service request 330 is received from the user terminal 4 in step S105, thereby providing the selected service. In step S107, the management apparatus 1 transmits service provision destination information 350 to the user terminal 4, and in step S108, the user terminal 4 transmits authentication confirmation information 360 to the selected service provision apparatus. As a result, the message digest is verified in the selected service providing apparatus, and if it is correct, the service is provided.
That is, immediately after the service request 330 is transmitted from the user terminal 4, the authentication information 340 is transmitted to the selected service providing apparatus, and at the same time, the connection destination address of the selected service providing apparatus is transmitted to the user terminal 4 automatically. Since the selected service providing device is connected to the address, it is only necessary to open and wait for the authentication terminal for a short time when the user terminal indicated in the received authentication information connects (in other words, the chance of unauthorized use). (It is necessary to send correct authentication confirmation information in addition to this short time), and the possibility of unauthorized access is extremely reduced. In other words, the selected service providing apparatus waits for connection on the assumption that a connection from the user terminal is received within ten seconds after receiving the authentication information, and invalidates the authentication information if there is no connection. Unauthorized use due to impersonation can be prevented.
[0025]
In addition, the management apparatus according to the present embodiment transmits authentication information only to the selected service providing apparatus among the plurality of service providing apparatuses, and transmits authentication confirmation information to the selected service providing apparatus with respect to the user terminal. Since the instruction is issued, the situation in which the authentication information and the authentication confirmation information are matched with each other in the service providing apparatus does not occur. Therefore, unauthorized use due to impersonation or the like can be effectively prevented.
[0026]
In addition, each time the user terminal is authenticated, the management apparatus according to the present embodiment randomly generates an identification number (identifier) having a different value each time, and adds the identification number to the authentication information and the service providing destination. Since the information is generated, the identification numbers of all authentication information and service provider information (authentication confirmation information) are different, which is an effective measure against impersonation and the like, and illegal use due to impersonation can be effectively prevented.
[0027]
Embodiment 2. FIG.
In the first embodiment described above, the selection service providing apparatus receives the authentication confirmation information from the user terminal after receiving the authentication information from the management apparatus. However, in this embodiment, the selection service providing apparatus provides the selection service provision. A case will be described in which the apparatus receives authentication confirmation information from the user terminal before authentication information from the management apparatus.
[0028]
FIG. 5 is a diagram illustrating a configuration example of the management apparatus 1 according to the present embodiment.
In FIG. 5, 101 to 107 are the same as those shown in FIG.
The authentication management information storage unit 108 generates an identification number and a user ID used for generating service providing destination information after generating service providing destination information for the user terminal until generating authentication information for the selected service providing device. , Authority information and terminal specific information (IP address of the user terminal, etc.) are stored as authentication management information.
Also in this embodiment, the configuration of the service providing apparatus is the same as that in FIG. However, in the first embodiment, the authentication management information storage unit 204 stores the contents of the authentication information from the management apparatus, but in this embodiment, it is included in the contents of the authentication confirmation information and the authentication confirmation information packet. The terminal specific information is stored.
[0029]
Next, the operation of the communication system according to the present embodiment will be described with reference to FIG.
Steps S201 to S205 are the same as steps S101 to S105 of the first embodiment.
That is, the authentication processing unit 103 of the management apparatus 1 transmits an authentication screen to the connection from the user terminal 4 (S201) (S202), and the user terminal 4 transmits the logon information 310 as a response (S203). The unit 103 performs logon authentication for the user terminal 4. When the user terminal 4 is authenticated, the service providing apparatus selection unit 106 transmits menu information to the user terminal 4 (S204), and transmits a user terminal 4 service request 330 as a response (S205). The device selection unit 106 selects a selection service providing device.
[0030]
When the selected service providing apparatus is selected by the service providing apparatus selecting unit 106, in the management apparatus 1, the authentication information generating unit 107 generates service providing destination information 350. Specifically, the authentication information generation unit 107 generates an identification number (identifier), and from the service management information stored in the service management information storage unit 105 according to the designation of the service provision device selection unit 106, The connection destination address (service providing address) is extracted, and further the user ID and authority information stored in the user management information storage unit 104 are extracted, and the user terminal 4 is specified from the service request packet in step S205. Terminal specific information (for example, IP address of the user terminal 4) is extracted, a message digest of these identification number, user ID, authority information, and terminal specific information is generated, and includes a connection destination address, an identification number, and a message digest Service provider information 350 is generated. At this time, the authentication information generation unit 107 concurrently stores the identification number, user ID, authority information, and terminal specific information used for generating the service providing destination information 350 in the authentication management information storage unit 108 as authentication management information. .
[0031]
When the service providing destination information 350 is generated by the authentication information generating unit 107 in this way, it is transmitted from the open network communication unit 102 to the user terminal 4 (S206).
[0032]
Next, in step S 207, the user terminal 4 automatically connects to the connection destination address of the selected service providing apparatus based on the service providing destination information 350 received from the management apparatus 1 and is included in the service providing destination information 350. The identification number and the message digest are transmitted as authentication confirmation information 360.
[0033]
In the selected service providing apparatus, the open network communication unit 202 receives the authentication confirmation information transmitted from the user terminal.
Then, the authentication processing unit 203 stores the authentication management information using the message digest included in the authentication confirmation information and the terminal unique information (such as the IP address of the user terminal) included in the authentication confirmation information packet as an identification number. The identification number is extracted from the authentication confirmation information, and an authentication information request 370 including the identification number and requesting the management apparatus 1 to transmit the authentication information is generated, and the closed network communication unit 201 is stored. To the management apparatus 1 (S208).
[0034]
In the management apparatus 1, the closed network communication unit 101 receives the authentication information request 370 from the selected service providing apparatus.
Then, the authentication information generation unit 107 extracts the identification number from the authentication information request 370, extracts the user ID, authority information, and terminal specific information from the authentication management information based on the identification number, and identifies the identification number, user ID, authority information, Authentication information 340 including terminal-specific information is generated and transmitted from the closed network communication unit 201 to the selected service providing apparatus (S209).
Further, after transmitting the authentication information 340, the authentication information generation unit 107 deletes the record (identification number, user ID, authority information, terminal specific information) about the user terminal from the authentication management information.
[0035]
In the selected service providing apparatus, the communication unit 201 for closed network receives the authentication information from the management apparatus 1, and the authentication processing unit 203 performs authentication confirmation based on the identification number of the authentication confirmation information stored as the authentication management information. The terminal unique number included in the information packet is extracted from the authentication management information, and the terminal unique information is extracted from the authentication information received from the management apparatus 1, and whether these two terminal unique information match. To verify.
Furthermore, the authentication processing unit 203 extracts the identification number, the user ID, the authority information, and the terminal specific information from the authentication information 340, and the message digest of the identification number, the user ID, the authority information, and the terminal specific information, that is, A message digest of the authentication information 340 is generated. Thereafter, the authentication processing unit 203 verifies whether or not the message digest of the authentication confirmation information 360 stored as the authentication management information matches the message digest of the generated authentication information 340.
[0036]
If all the above verifications are correct, the authentication processing unit 203 deletes the record (authentication confirmation information 360) for the user terminal 4 from the authentication management information, and the service providing unit 205 provides a service to the user terminal 4 according to the authority information. Provide (S209).
On the other hand, if any one of the above verifications does not meet the condition, the service to the user terminal 4 is not provided.
[0037]
Thus, in the communication system according to the present embodiment, when the service request 330 is transmitted from the user terminal 4, the service providing destination information 350 is transmitted from the management apparatus 1 to the user terminal 4, and the user terminal 4 Authentication confirmation information 360 is transmitted to the selected service providing apparatus, whereby the selected service providing apparatus transmits an authentication information request 370 to the management apparatus 1, and as a result, the management apparatus 1 authenticates to the selected service providing apparatus. Information is sent.
That is, there is a chance of unauthorized use only after the management device generates service providing destination information for the user terminal until the selected service providing device receives the authentication information, and the correct authentication confirmation information is transmitted. Therefore, the possibility of unauthorized access can be extremely reduced.
[0038]
Embodiment 3 FIG.
In the present embodiment, a case will be described in which the reception time of authentication information and the reception time of authentication confirmation information are managed in the selected service providing apparatus when the method shown in the first embodiment is used.
[0039]
A configuration example of the management apparatus 1 according to the present embodiment is the same as that shown in FIG.
Also, the configuration example of the service providing apparatus is the same as that shown in FIG. 3, but in this embodiment, the authentication processing unit 203 receives the authentication information 340 when receiving the authentication information 340 from the management apparatus 1. Is stored in the authentication management information storage unit 204, and authentication processing for the user terminal 4 is performed with reference to the reception time of the authentication information 340 when the authentication confirmation information 360 is received from the user terminal 4.
[0040]
Next, the operation of the communication system according to the present embodiment will be described with reference to FIG.
Steps S301 to S306 are the same as steps S101 to S106 in FIG. Therefore, the operation after step S306 will be described.
In the selected service providing apparatus, the closed network communication unit 201 receives the authentication information 340 from the management apparatus 1, and the authentication processing unit 203 acquires the time when the authentication information 340 is received as the reception time, and the authentication information Using the identification number included in 340 as a key, the user ID, authority information, terminal specific information, and further the reception time of authentication information 340 are stored in authentication management information storage unit 204 as authentication management information. At this point in time, preparation for service provision for the user terminal is completed.
[0041]
Further, as in the first embodiment, the management apparatus 1 generates the service providing destination information 350 and transmits it to the user terminal 4 from the open network communication unit 202 (S307), and the user terminal 4 receives the first embodiment. Similarly, the authentication confirmation information 360 is transmitted to the selected service providing apparatus (S308).
[0042]
In the selected service providing apparatus, based on the identification number of the authentication confirmation information 360 received from the user terminal 4, the authentication processing unit 203 extracts terminal specific information from the authentication management information stored in the authentication management information storage unit 204, It is verified whether the terminal unique information included in the packet of the authentication confirmation information 360 matches the extracted terminal unique information.
Furthermore, in the selection service providing apparatus, the authentication processing unit 203 extracts the reception time of the authentication information 340 from the authentication management information based on the identification number of the authentication confirmation information 360 received from the user terminal 4, and extracts the authentication information 340. The time difference between the current reception time and the current time (the reception time of the authentication confirmation information 360) is calculated, and it is verified that the calculated time difference is within a normal range. Here, the normal range means, for example, within about 1 minute.
Further, the authentication processing unit 203 extracts the user ID and the authority information from the authentication management information using the identification number as a key, and a message digest of the identification number, the user ID, the authority information, and the terminal specific information, that is, the authentication information 340 Generate a message digest. Thereafter, the authentication processing unit 203 verifies whether or not the message digest of the authentication confirmation information 360 received from the user terminal 4 matches the message digest of the generated authentication information 340.
[0043]
If all the above verifications are correct, the authentication processing unit 203 deletes the record (authentication information 340 and the reception time) for the user terminal 4 from the authentication management information, and the service providing unit 205 instructs the user terminal 4 according to authority information. A service is provided (S309).
On the other hand, if any one of the above verifications does not meet the condition, the service to the user terminal 4 is not provided.
[0044]
The service providing apparatus according to the present embodiment does not provide the service to the user terminal when the time difference between the reception time of the authentication information and the reception time of the authentication confirmation information is greater than a certain value. Thus, when the user terminal that has made a service request cannot connect to the selected service providing apparatus due to some trouble, the authentication information held by the selected service providing apparatus is prevented from being illegally used.
[0045]
In the above description, both the verification of the time difference of the reception time and the verification of the message digest are performed, but as a result of the verification of the time difference of the reception time, the time difference of the reception time is normal. If it is not within the range, it may be determined not to provide the service to the user terminal without verifying the message digest.
[0046]
Embodiment 4 FIG.
In the present embodiment, a case will be described in which the service provision status to the user terminal is managed in the selected service providing apparatus when the method shown in the first embodiment is used.
[0047]
A configuration example of the management apparatus 1 according to the present embodiment is the same as that shown in FIG.
The configuration example of the service providing apparatus is the same as that shown in FIG. 3, but in the present embodiment, the authentication processing unit 203 receives the authentication information 340 from the management apparatus 1 as in the third embodiment. The reception time of the authentication information 340 is stored in the authentication management information storage unit 204 at the time of authentication, and the reception time of the authentication information 340 is referred to the user terminal 4 when the authentication confirmation information 360 is received from the user terminal 4. Perform authentication processing. Further, the authentication processing unit 203 can set a service provision flag indicating the service provision status for the user terminal 4, and that the service for the user terminal 4 has not been provided when the authentication information 340 is received from the management apparatus 1. A service provision flag is set, and authentication processing for the user terminal 4 is performed with reference to the service provision flag when the authentication confirmation information 360 is received from the user terminal 4.
[0048]
Next, the operation of the communication system according to the present embodiment will be described with reference to FIG.
Steps S401 to S406 are the same as steps S101 to S106 in FIG. Therefore, the operation after step S406 will be described.
In the selected service providing apparatus, the closed network communication unit 201 receives the authentication information 340 from the management apparatus 1, and the authentication processing unit 203 acquires the time when the authentication information 340 is received as the reception time, and the authentication information Using the identification number included in 340 as a key, the user ID, authority information, terminal specific information, and further the reception time of authentication information 340 are stored in authentication management information storage unit 204 as authentication management information. In addition, a service provision flag (status: service not provided) is set. At this point in time, preparation for service provision for the user terminal is completed.
[0049]
Further, as in the first embodiment, the management apparatus 1 generates the service providing destination information 350 and transmits it to the user terminal 4 from the open network communication unit 202 (S407), and the user terminal 4 performs the first embodiment. Similarly, the authentication confirmation information is transmitted to the selected service providing apparatus (S408).
[0050]
In the selected service providing apparatus, based on the identification number of the authentication confirmation information 360 received from the user terminal 4, the authentication processing unit 203 extracts terminal specific information from the authentication management information stored in the authentication management information storage unit 204, It is verified whether the terminal unique information included in the packet of the authentication confirmation information 360 matches the extracted terminal unique information.
Furthermore, in the selection service providing apparatus, the authentication processing unit 203 extracts the reception time of the authentication information 340 from the authentication management information based on the identification number of the authentication confirmation information 360 received from the user terminal 4, and extracts the authentication information 340. The time difference between the reception time and the current time (the reception time of the authentication confirmation information 360) is calculated, and it is verified that the calculated time difference is within a normal range. Here, the normal range means, for example, within about 1 minute.
Further, the authentication processing unit 203 refers to the service provision flag and verifies that the status of the service provision flag is not service provision.
Further, the authentication processing unit 203 extracts the user ID and the authority information from the authentication management information using the identification number as a key, and a message digest of the identification number, the user ID, the authority information, and the terminal specific information, that is, the authentication information 340 Generate a message digest. Thereafter, the authentication processing unit 203 verifies whether or not the message digest of the authentication confirmation information 360 received from the user terminal 4 matches the message digest of the generated authentication information 340.
[0051]
If all the above verifications are correct, the authentication processing unit 203 changes the status of the service provision flag of the user terminal 4 to service provided, and the service providing unit 205 provides the service to the user terminal 4 according to the authority information ( S409).
On the other hand, if any one of the above verifications does not meet the condition, the service to the user terminal 4 is not provided.
Also, if the verification of only the service provision flag is wrong (when the status of the service provision flag is already service provided when the service provision flag is referenced) and all other verifications are correct, one correct authentication check When there is another user terminal already using the service other than the user terminal that transmitted the authentication confirmation information 360 because there is a possibility of theft because the information 360 has been tried multiple times. Does not provide the service to the user terminal that has transmitted the authentication confirmation information, but also immediately stops providing the service to another user terminal that is already using the service.
[0052]
Since the service providing apparatus according to the present embodiment manages the service provision status for the user terminal using the service provision flag, even if there is an unauthorized use performed by stealing authentication confirmation information, the unauthorized use is immediately performed. There is an effect that can be detected.
[0053]
In the above description, both the verification of the time difference of the reception time and the verification of the service provision flag are performed, but only the verification of the service provision flag is performed without performing the verification of the time difference of the reception time. May be performed.
[0054]
【The invention's effect】
As described above, according to the present invention, the first authentication information is transmitted only to the selected service providing device among the plurality of service providing devices, and the second authentication information is transmitted to the selected service providing device with respect to the service requesting device. Since the second authentication information is transmitted by instructing transmission, unauthorized use due to impersonation or the like can be effectively prevented.
[Brief description of the drawings]
FIG. 1 is a diagram showing an example of the overall configuration of a communication system according to first to fourth embodiments.
FIG. 2 is a diagram showing a configuration example of a management apparatus according to the first embodiment.
FIG. 3 is a diagram illustrating a configuration example of a service providing apparatus according to the first embodiment.
4 is a diagram showing an operation example of the communication system according to Embodiment 1. FIG.
FIG. 5 is a diagram showing a configuration example of a management apparatus according to the second embodiment.
6 is a diagram showing an operation example of a communication system according to Embodiment 2. FIG.
7 is a diagram showing an operation example of a communication system according to Embodiment 3. FIG.
FIG. 8 shows an operation example of the communication system according to the fourth embodiment.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 Management apparatus, 2 Service provision apparatus (1), 3 Service provision apparatus (2), 4 User terminal, 5 Closed network, 6 Open network, 101 Closed network communication part, 102 Open network communication part, 103 Authentication processing part 104 User management information storage unit 105 Service management information storage unit 106 Service providing device selection unit 107 Authentication information generation unit 108 Authentication management information storage unit 201 Closed network communication unit 202 Open network communication unit 203 Authentication processing unit, 204 Authentication management information storage unit, 205 Service providing unit.

Claims (8)

A service requesting device for requesting the provision of a service;
Prior to service provision, multiple services are provided that perform authentication processing on whether or not access is from a legitimate service requester using predetermined authentication information, and start providing services only to authorized service requesters Connected to the device,
A management device that manages the service requesting device and the plurality of service providing devices;
An authentication processing unit that performs a predetermined authentication process on the service requesting device;
When the service requesting device is authenticated by the authentication processing unit, based on the authority granted to the service requesting device and the service content requested by the service requesting device, the service requesting device is selected from the plurality of service providing devices. A service providing apparatus selecting unit that selects a service providing apparatus that causes the service requesting apparatus to provide a service as a selected service providing apparatus;
When the service requesting device is authenticated by the authentication processing unit, when the first authentication information for notifying that the service requesting device is a legitimate service requesting source is compared with the first authentication information Second authentication information that can authenticate access from a legitimate service request source by obtaining a correlation with the first authentication information, and the second authentication information for the service requesting device. An authentication information generating unit that generates transmission destination instruction information for instructing the selection service providing apparatus to transmit;
A service providing device communication unit that transmits the first authentication information only to the selected service providing device among the plurality of service providing devices;
A management apparatus comprising: a service requesting apparatus communication unit configured to transmit the second authentication information and the transmission destination instruction information to the service requesting apparatus. The authentication information generation unit
The management apparatus according to claim 1, wherein a message digest of the first authentication information is generated as the second authentication information. The authentication information generation unit
Each time the service requesting device is authenticated by the authentication processing unit, a different identifier is generated each time, and a common identifier is used for the first authentication information and the second authentication information that have a corresponding relationship with each other. The management device according to claim 1. The authentication information generation unit
Generating the second authentication information and the destination instruction information in advance of the first authentication information;
The second authentication information and the transmission destination instruction information are transmitted from the service request apparatus communication unit to the service request apparatus, and the second authentication information is selected from the service request apparatus by the transmission destination instruction information. The first authentication information is generated based on a request from the selection service providing apparatus after the selection service providing apparatus receives the second authentication information and is transmitted to the service providing apparatus. The management apparatus according to claim 1. Connected to a given management device,
Whether the service request source is valid or not is received from the management device, the second authentication information is received from the service request source, the first authentication information and the second authentication information A service providing apparatus that performs authentication processing for a service requester using information,
When the first authentication information is received, the reception time of the first authentication information is stored,
When the second authentication information is received, a time difference between the reception time of the first authentication information and the reception time of the second authentication information is calculated, and the calculated time difference is equal to or greater than a certain value. A service providing apparatus that does not provide a service to a service requester that has transmitted the second authentication information. Connected to a given management device,
Whether the service request source is valid or not is received from the management device, the second authentication information is received from the service request source, the first authentication information and the second authentication information A service providing apparatus that performs authentication processing for a service requester using information,
When receiving the first authentication information, set a service provision flag indicating that the service is not provided to the service request source;
When the second authentication information is received, the service providing flag is referred to, and the first authentication information is compared with the second authentication information.
The service provision flag indicates that a service is not provided to a service request source, and the first authentication information and the second authentication information are obtained by collating the first authentication information and the second authentication information. When a correlation is obtained between the service request source and the service request source that transmitted the second authentication information, the service provision flag is changed to a service provided. Service providing device. The service providing apparatus includes:
If the service provision flag indicates that the service has been provided as a result of referring to the service provision flag, the service request source that transmitted the second authentication information is not provided, and the second service information is not provided. 7. The service providing apparatus according to claim 6, wherein when a service is provided to a service request source other than the service request source that has transmitted the authentication information, the service provision to the service request source is stopped. . Prior to service provision, multiple services are provided that perform authentication processing on whether or not access is from a legitimate service requester using predetermined authentication information, and start providing services only to authorized service requesters Equipment,
A management device that is connected to a service requesting device that requests service provision and the plurality of service providing devices, and that manages the service requesting device and the plurality of service providing devices;
A communication system comprising:
The management device
Perform a predetermined authentication process on the service request device,
When the service requesting device is authenticated by the authentication process, the service requesting device is selected from the plurality of service providing devices based on the authority granted to the service requesting device and the service content requested by the service requesting device. Select a service providing device that causes the requesting device to provide a service as a selected service providing device,
When the service requesting device is authenticated by the authentication process, the first authentication information for notifying that the service requesting device is a legitimate service request source and the first authentication information are collated. By obtaining a correlation with the first authentication information, the second authentication information capable of authenticating that the access is from a legitimate service request source, and the second authentication information for the service request device Generating destination instruction information for instructing the selected service providing apparatus to transmit,
The first authentication information is transmitted only to the selected service providing device among the plurality of service providing devices,
Transmitting the second authentication information and the transmission destination instruction information to the service requesting device, causing the second authentication information to be transmitted from the service requesting device to the selected service providing device according to the transmission destination instruction information;
Each of the plurality of service providing devices includes:
When the management device is selected as the selection service providing device,
Receiving the first authentication information and the second authentication information;
It is determined whether or not the transmission source of the second authentication information matches the service request apparatus notified by the first authentication information, and the first authentication information and the second authentication information are collated. And
When the transmission source of the second authentication information matches the service requesting device and a correlation is obtained between the first authentication information and the second authentication information, A communication system characterized by authenticating the service requesting device that is a transmission source as a legitimate service requesting source, and starting providing a service to the service requesting device.

Images