JP2006268719A - Password authentication system and method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform authentication even if a fault occurs in a management device that manages passwords in a centralized manner, and to improve security rather than the prior art. <P>SOLUTION: A management device 20 issues new authentication information each time it is accessed from a user terminal device 10, and newly generates a password based on the issued authentication information. The management device 20 updates a former password within a user authentication device 30 and notifies the user terminal device 10 of the newly generated password and the authentication information used for generating the password. The user terminal device 10 updates former authentication information stored in an authentication information storage means 12 when it is notified of the authentication information and the password from the management device 20. The user terminal device 10 generates the same password as one generated by the management device 20 based on authentication information in the storage means 12 when it is not notified of the authentication information and the password from the management device 20 even if access to the management device 20 is attempted. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a password authentication system, a management device provided in the password authentication system, a user terminal device provided in the password authentication system, a password authentication method, and a program.

  Conventionally, a user who uses a computer system composed of a plurality of systems has to manage a user ID and a password for each system.

  However, if each user manages the user ID and password, there is a problem that the management load of the system administrator increases when the user forgets the user ID and password, or a problem that unauthorized access due to password leakage occurs. In addition, there is a problem that security is lowered by using the same password in a plurality of systems or for a long time.

  In view of such a problem, Patent Documents 1 and 2 disclose a technology that enables single sign-on by collectively managing passwords (centralized management).

Patent Document 3 describes that passwords are changed in a batch.
Japanese Patent Laid-Open No. 2000-259566 JP 2003-050781 A JP 2002-169777 A

  However, the conventional password centralized management method as described above has a problem that authentication cannot be performed at all when a failure (such as down) occurs in a management apparatus that centrally manages passwords.

  Further, in the conventional techniques such as Patent Documents 1 and 2, a personal authentication device is required for identity verification. Also, when changing the password, it was necessary to change the password to the program that implements single sign-on. Moreover, since the password change was managed by each user, the security was low.

  In the technique of Patent Document 3, the passwords of a plurality of systems can be changed at once, but the security is low because the user changes the password by himself.

  The present invention has been made to solve the above-described problems, and can perform authentication even when a failure occurs in a management apparatus that centrally manages passwords, and has higher security than before. An object of the present invention is to provide a password authentication system that can be enhanced, a management device provided in the password authentication system, a user terminal device provided in the password authentication system, a password authentication method, and a program.

  In order to solve the above problems, a user terminal device used by a user of the present invention, a user authentication device that performs authentication processing in response to an authentication request from the user terminal device, and a password used for authentication by the user authentication device In the password authentication system comprising the password management device for managing the password, the user authentication device includes password storage means for storing and holding a password corresponding to each user terminal device, and an authentication request using a password from the user terminal device. An authentication unit configured to perform authentication by comparing the password with a corresponding password stored in the password storage unit, and the password management device includes: An authentication information issuing means for newly issuing authentication information every time it is accessed; Each time authentication information is newly issued by the authentication information issuing means, a first password generating means for newly generating a password based on the issued authentication information, and a new password by the first password generating means A password update unit that updates an old password stored in the password storage unit of the user authentication device with the generated password, a password newly generated by the first password generation unit, and generation of the password A notification means for notifying the used authentication information to the user terminal device as an access source, the user terminal device comprising: an access means for accessing the password management device; and the authentication information. Authentication information storage means for storing and holding the authentication information by the notification means of the password management device. And when the password is notified, the authentication information updating means for updating the old authentication information stored in the authentication information storage means with the notified authentication information, and access to the password management device by the access means. If the authentication information and the password are not notified from the password management device even if the attempt is made, the password management device newly uses the same method as the first password generation unit based on the authentication information stored in the authentication information storage unit. When the password is notified by the second password generation means for generating a password and the notification means of the password management device, or when the password is generated by the second password generation means, the notification or generation Authentication request for making an authentication request to the user authentication device using the password that has been set And means.

  In the password authentication system of the present invention, it is preferable that the access means of the user terminal device automatically tries to access the password management device when authentication by the user authentication device is required.

  In the password authentication system of the present invention, when the user terminal device attempts to access the password management device by the access means of the user terminal device, the user terminal device performs an input operation of a predetermined access password to the user in advance. Processing for requesting, and authentication of an access password input in response to the request, and processing for permitting an access attempt to the password management device by the access means only when the authentication is successful; It is preferable to further include preliminary authentication means for performing the above.

  In the password authentication system of the present invention, the preliminary authentication means of the user terminal device automatically requests the user to input the access password when authentication by the user authentication device is required. It is preferable to carry out the treatment.

  In the password authentication system of the present invention, the first password generation unit of the password management device receives the authentication information issued by the authentication information issuing unit and the access by the access unit of the user terminal device And generating the password on the basis of the two pieces of user-specific information acquired from the user terminal device, while the second password generating means of the user terminal device is stored in the authentication information storage means. It is preferable to generate a password based on two pieces of information: authentication information that is stored in the user terminal device and user-specific information stored in the user terminal device.

  In the password authentication system according to the present invention, the second password generation means of the user terminal device may be configured such that, even if a predetermined time elapses after the access means tries to access the password management apparatus, the password management apparatus It is preferable to generate a password when authentication information and a password are not notified from.

  The password management device of the present invention is the password management device in the password authentication system of the present invention.

  The user terminal device of the present invention is the user terminal device in the password authentication system of the present invention.

  The program of the present invention is a program for causing a computer to execute processing by the password management apparatus of the present invention.

  The program of the present invention is a program for causing a computer to execute processing by the user terminal device of the present invention.

  The password authentication method of the present invention includes a user terminal device used for a user, a user authentication device that performs authentication processing in response to an authentication request from the user terminal device, and a password used for authentication by the user authentication device. In a method for authenticating a password in a password authentication system comprising: a password management device that manages the password management device, a first step of trying to access the password management device from the user terminal device; and A second step of newly issuing authentication information in the management device; and a third step of generating a new password based on the issued authentication information each time the authentication information is newly issued; The old path stored in the user authentication device by the password newly generated by the third process A fourth process of updating the password, a password newly generated by the third process, and authentication information used to generate the password are notified to the access source user terminal device. And, when authentication information and a password are notified to the user terminal device, a sixth step of updating old authentication information stored in advance in the user terminal device with the notified authentication information; The authentication stored in the user terminal device when authentication information and password are not notified from the password management device to the user terminal device even if the user terminal device attempts to access the password management device. A seventh step of generating a new password based on the information by the same method as in the third step, and the password management; When the password is notified from the device to the user terminal device, or when the password is generated by the seventh process, the user terminal device uses the password generated by the notification or the generated password. And an eighth step of making an authentication request to the authentication device.

  In the password authentication method of the present invention, it is preferable that the first process is automatically executed when authentication by the user authentication device is required.

  In the password authentication method of the present invention, the user terminal device requests the user to input a predetermined access password before the first step, and the access terminal input in response to the request. It is preferable to execute the first process only when password authentication is executed and the authentication is successful.

  In the password authentication method of the present invention, the user terminal device may automatically perform a process of requesting the user to input the access password when authentication by the user authentication device is required. preferable.

  In the password authentication method of the present invention, in the third step, the authentication information issued in the second step and the user acquired from the user terminal device when there is an access in the first step While generating the password based on the two pieces of information, the unique information, in the seventh process, the authentication information stored in the user terminal device and the user specific information stored in the user terminal device It is preferable to generate a password based on these two pieces of information.

  In the password authentication method of the present invention, when the authentication information and the password are not notified from the password management device to the user terminal device even after a predetermined time has elapsed since the execution of the first process, It is preferable to carry out the following process.

  According to the present invention, even when a failure occurs in the password management device, the same password generation processing can be performed on the user terminal device side, and the authentication processing by the user authentication device can be realized.

  Further, since the user does not manage the password, high security can be ensured and single sign-on can be performed.

  Embodiments according to the present invention will be described below with reference to the drawings.

[First Embodiment]
FIG. 1 is a block diagram showing a configuration of a password authentication system 100 according to the first embodiment.

  As shown in FIG. 1, a password authentication system 100 according to the first embodiment includes a user terminal device 10 assigned to each user and a password centralized management for centrally managing passwords used for authentication of each user terminal device 10. A device (password management device) 20 and a user authentication device 30 that performs an authentication process in response to an authentication request from each user terminal device 10 are configured.

  The user terminal device 10, the password central management device 20, and the user authentication device 30 are connected to each other via a network such as a local area network.

  The user terminal device 10 has a centralized management device access means (access means) 11 for trying to access the password centralized management device 20 when authentication by the user authentication device 30 is required, and the centralized management device access means 11 has succeeded in access. If the authentication ID storage unit (authentication information storage unit) 12 stores and holds the authentication ID (authentication information) notified from the password central management device 20 and the authentication ID is notified from the password central management device 20, There is no response from the authentication ID update means (authentication information update means) 13 for performing the process of updating the authentication ID stored in the authentication ID storage unit 12 and the password centralized management apparatus 20 based on the notified authentication ID ( Pass from the password centralized management apparatus 20 without successful access to the password centralized management apparatus 20) A password generation unit (second password generation unit) 15 that generates a password using the authentication ID stored in the authentication ID storage unit 12 and the password central management device 20 when the password and the authentication ID are not notified. The authentication request unit 14 is configured to make an authentication request to the user authentication device 30 using the notified password or the password generated by the password generation unit 15.

  The user terminal device 10 is, for example, a personal computer or other information processing device, and functions as a CPU that performs various control operations, a ROM that stores a control program for the CPU, and a work area of the CPU. And a RAM to be configured.

  The user terminal device 10 functions as a centralized management device access unit 11, an authentication ID update unit 13, a password generation unit 15, and an authentication request unit 14 by operating according to a program stored in the ROM.

  The control program stored in the ROM of the user terminal device 10 includes an authentication program that is an application program for executing processing for receiving authentication by the user authentication device 30.

  The password centralized management device 20 receives access from the centralized management device access unit 11 of the user terminal device 10 and obtains a user ID from the user terminal device 10, and the access reception unit 21 is a user terminal device. An authentication ID issuing means (authentication information issuing means) 22 for newly issuing a random authentication ID every time an access from the 10 centralized management apparatus access means 11 is accepted, and an authentication ID is issued by the authentication ID issuing means 22 A password generation means (first password generation means) 23 that newly generates a password in accordance with a predetermined algorithm using the issued authentication ID and the user ID acquired by the access reception means 21, and the password generation means 23, the user authentication device A password update unit 27 that updates an old password stored in a password storage unit (password storage unit) 32 described later, a password storage unit 26 that stores and holds a password generated for each user, and a password generation unit 23 And a notification unit 25 that notifies the access source user terminal device 10 of the newly generated password and the authentication ID used to generate the password.

  The password central management apparatus 20 is, for example, a server computer or other information processing apparatus, and includes a CPU that performs various control operations, a ROM that stores a control program for the CPU, a work area for the CPU, and the like. And a functioning RAM.

  The password central management apparatus 20 functions as an access receiving means 21, an authentication ID issuing means 22, a password generating means 23, a password updating means 27, and a notifying means 25 by operating according to a program stored in the ROM.

  The user authentication device 30 is stored and held in the password storage unit 32 in accordance with an instruction from the password update unit 27 of the password central management device 20 and a password storage unit 32 that stores and holds a password used for authentication of each user terminal device 10. Password updating means 31 that updates the old password that is being used to a new password, and authentication means 33 that performs authentication processing in response to an authentication request from each user terminal device 10 are provided.

  The user authentication device 30 is, for example, a server computer or other information processing device, and functions as a CPU that performs various control operations, a ROM that stores a control program for the CPU, and a work area of the CPU. And a RAM to be configured.

  The user authentication device 30 functions as a password update unit 31 and an authentication unit 33 by operating according to a program stored in the ROM.

  Next, the operation of the password authentication system 100 will be described with reference to the flowcharts of FIGS.

  2 is a flowchart showing an operation flow of the user terminal device 10, FIG. 3 is a flowchart showing an operation flow of the password centralized management device 20, and FIG. 4 is a flowchart showing an operation flow of the user authentication device 30.

  In the following, an example in which authentication by the user authentication device 30 is necessary to use the user terminal device 10 will be described.

  First, a user who wants to use the user terminal device 10 activates the user terminal device 10.

  Then, since the user terminal device 10 requires authentication by the user authentication device 30 in order to use the user terminal device 10, an authentication program for executing processing for receiving authentication by the user authentication device 30 Will start automatically.

  Next, the centralized management device access means 21 of the user terminal device 10 tries to access the password centralized management device 20 in accordance with the activated authentication program (step S1 in FIG. 2). If there is no failure (such as down) in the central password management apparatus 20, this access is successful.

  The password centralized management apparatus 20 performs the process of FIG. 3 when there is an access from the user terminal apparatus 10.

  That is, first, the access receiving means 21 acquires the user ID stored and held in the user terminal device 10 from the user terminal device 10 (step S11 in FIG. 3).

  Next, the authentication ID issuing means 22 performs a process for issuing an authentication ID (step S12 in FIG. 3). Here, the authentication ID issuing means 22 issues a new random authentication ID every time it is accessed from the user terminal device 10.

  Next, the password generation unit 23 uses the authentication ID newly issued by the authentication ID issuing unit in the previous step S12 and the user ID acquired from the user terminal device 10 in the previous step S11. A new password is generated (step S13 in FIG. 3). That is, for example, the user ID and the authentication ID are scrambled to generate a password.

  Next, the password update unit 27 performs a process of updating the old password stored in the password storage unit 32 of the user authentication device 30 with the password newly generated in the previous step S13. That is, the password update unit 27 notifies the user authentication device 30 of the password newly generated in the previous step S13 and the user ID acquired in the previous step S11 (step S14 in FIG. 3).

  The user authentication device 30 that has received the notification (new password and notification of the user ID corresponding to the password) from the password update unit 27 of the password centralized management device 20 performs the process of FIG.

  First, the password update unit 31 of the user authentication device 30 updates the password stored in the password storage unit 32 of the user authentication device 30. That is, of the passwords stored in the password storage unit 32, the old password (for the same user terminal device 10) corresponding to the newly notified password is updated to the new password (step S21 in FIG. 4). .

  Next, the password update unit 31 of the user authentication device 30 notifies the password central management device 20 that the password update has been completed (step S22 in FIG. 4).

  Upon receiving the notification from the password update unit 31 of the user authentication device 30, the central password management device 20 continues the processing of FIG.

  That is, the password update unit 27 of the central password management apparatus 20 updates the old password stored in the password storage unit 26 of the central password management apparatus 20 with the new password generated in the previous step S13. That is, of the passwords stored in the password storage unit 26, the old password (for the same user terminal device 10) corresponding to the new password generated in the previous step S13 is updated to the new password (FIG. 3 step S15).

  Next, the notifying unit 25 of the central password management apparatus 20 accesses the password newly generated in the previous step S13 and the authentication ID issued in the previous step S12 for the generation of the password this time. Is notified to the access source user terminal device 10 (step S16 in FIG. 3). Specifically, for example, a password corresponding to the accessed user terminal device 10 is extracted from the passwords stored in the password storage unit 26, and the extracted password and the authentication ID used to generate the password are extracted. To the user terminal device 10.

  In the user terminal device 10 that has received the notification from the notification means 25 of the password centralized management device 20, the processing in FIG. 2 is continued.

  That is, when a new password and an authentication ID used to generate the password are notified from the password central management device 20, the user terminal device 10 determines that the password and the authentication ID have been acquired (in step S2 in FIG. 2). YES)

  Next, the authentication ID update unit 13 of the user terminal device 10 updates the old authentication ID already stored and held in the authentication ID storage unit 12 with the authentication ID newly notified from the password central management device 20 this time ( Step S3 in FIG.

  Next, the authentication request means 14 of the user terminal device 10 accesses the user authentication device 30 as an authentication request using the password newly notified from the password central management device 20 this time. In other words, the authentication request unit 14 notifies the user authentication device 30 of the user ID and the new password (step S4 in FIG. 2).

  Here, in the user terminal device 10, the password notified from the password central management device 20 is used in a state that is not disclosed to the user of the user terminal device 10. For this reason, this password is not known to the user.

  The authentication means 33 of the user authentication device 30 that has received access as an authentication request from the authentication request means 14 of the user terminal device 10 uses the password and user ID notified from the user terminal device 10 at the time of the access. I do. That is, the authentication unit 33 extracts the password corresponding to the user ID notified from the user terminal device 10 from the password storage unit 32, and the extracted password matches the password notified from the user terminal device 10. It is determined whether or not. If both passwords match, it is determined that the authentication has succeeded, whereas if they do not match, it is determined that the authentication has not succeeded.

  When the authentication is successful, the authentication unit 33 of the user authentication device 30 notifies the user terminal device 10 of the access source to that effect. Even when the authentication is not successful, the authentication unit 33 notifies the access source user terminal device 10 to that effect.

  When the authentication operation is performed according to the regular procedure shown in FIG. 2 to FIG. 4, the result of the authentication is successful, and the user terminal device 10 is notified accordingly.

  In addition, when a failure occurs in the central password management apparatus 20 when an attempt is made to access the central password management apparatus 20 from the user terminal apparatus 10 in step S1 of FIG. Since the password and the authentication ID are not notified, it is determined No in step S2 of FIG.

  In the determination in step S2, that is, in determining whether a new password and a new authentication ID have been acquired from the password central management device 20, for example, the process in step S1 (processing for attempting to access the password central management device 20) ) Is executed and a new password and a new authentication ID cannot be obtained from the password central management apparatus 20 until a predetermined time (for example, 60 seconds) elapses (step in FIG. 2). S2 is determined as No).

  When it is determined No in step S2 of FIG. 2, the password generation unit 15 of the user terminal device 10 acquires the authentication ID stored and held in the authentication ID storage unit 12 from the authentication ID storage unit 12 (FIG. 2). 2 step S5).

  Next, the password generation unit 15 of the user terminal device 10 generates a new password using the authentication ID and the user ID acquired in the previous step S5 (step S6 in FIG. 2). Here, the password generation unit 15 of the user terminal device 10 generates a password in accordance with the same algorithm (by the same method) as the password generation unit 23 of the password central management device 20.

  Next, the authentication device access unit 14 of the user terminal device 10 accesses the user authentication device 30 as an authentication request using the password newly generated by the password generation unit 15 of the user terminal device 10. That is, the authentication device access unit 14 notifies the user authentication device 30 of the user ID and the new password (step S7 in FIG. 2).

  In the user terminal device 10, the password generated by the password generation unit 15 is used in a state that is not disclosed to the user of the user terminal device 10. For this reason, this password is not known to the user.

  Here, since the password generation means 15 of the user terminal device 10 generates a password according to the same algorithm as the password generation means 23 of the password central management device 20 as described above, the password generation means 15 of the user terminal device 10. The password newly generated in step S6 in FIG. 2 is notified from the central password management device 20 to the user terminal device 10 when the previous access from the user terminal device 10 to the central password management device 20 was successful. The password is the same as the password.

  Further, at the stage of performing the authentication request in step S7 of FIG. 2, the password stored in the password storage unit 32 in the user authentication device 30 has been successfully accessed from the previous user terminal device 10 to the password centralized management device 20. The password is notified to the user authentication apparatus 30 from the central password management apparatus 20 at this time.

  That is, at this stage, the password stored in the password storage unit 32 in the user authentication device 30 is newly generated by the password generation means 15 of the user terminal device 10 in step S6 of FIG. This is the same as the password notified by the authentication device access means 14 of the user terminal device 10 in step S7 of FIG.

  Therefore, the result of the authentication by the authentication unit 33 of the user authentication device 30 is successful, and that fact is notified to the user terminal device 10.

  According to the first embodiment as described above, in the password authentication system 100, in principle (unless a failure occurs in the central password management apparatus 20), the same password is used once in the user authentication apparatus 30. Since it can only be used for authentication, long-term operation of the same password can be avoided, and thus high security can be ensured.

  As described above, in principle, in the password authentication system 100 configured such that the same password can be used only for one-time authentication by the user authentication device 30, access from the user terminal device 10 to the password central management device 20 is performed. If the password centralized management device 20 does not notify the user terminal device 10 of the password and the authentication ID even after trying the password, the user terminal device 10 uses the authentication ID stored in advance to enter the password. Since the password is generated and an authentication request is made to the user authentication apparatus 30 using the generated password, the authentication process by the user authentication apparatus can be realized even when a failure has occurred in the password management apparatus.

  In addition, since the user of the user terminal device 10 does not manage the password, high security can be ensured and single sign-on can be performed.

  Further, since the information stored and held in the user terminal device 10 is only the authentication ID and the password is not stored and held, security is further improved.

[Second Embodiment]
Next, a second embodiment will be described.

  FIG. 5 is a block diagram showing the configuration of the password authentication system 200 according to the second embodiment.

  As shown in FIG. 5, in the password authentication system 200 according to the second embodiment, the user terminal device 10 is used for authentication in order to improve security compared to the password authentication system 100 according to the first embodiment. A program execution password authentication means (preliminary authentication means) 201 is further provided.

  The password authentication system 200 according to the second embodiment is different from the password authentication system 100 according to the first embodiment only in that an authentication program execution password authentication means 201 is additionally provided. In other respects, the configuration is the same as that of the password authentication system 100 according to the first embodiment.

  The authentication program execution password authenticating means 201, when the authentication program is started, processes to request the user to input a predetermined authentication program execution password (access password), and input in response to the request The centralized password management apparatus 20 by the centralized management apparatus access means 11 is used only when the authentication program execution password is authenticated and the authentication is successful (determined that the correct authentication program execution password has been input). Allow access attempts to.

  Next, the operation in the case of the second embodiment will be described.

  FIG. 6 is a flowchart showing an operation flow of the user terminal device 10 of the password authentication system 200.

  In the following, an example in which authentication by the user authentication device 30 is necessary to use the user terminal device 10 will be described.

  First, a user who wants to use the user terminal device 10 activates the user terminal device 10.

  Then, since the user terminal device 10 requires authentication by the user authentication device 30 in order to use the user terminal device 10, an authentication program for executing processing for receiving authentication by the user authentication device 30 Will start automatically.

  Next, the authentication program execution password authentication means 201 of the user terminal device 10 displays an input screen for requesting the user to input a predetermined authentication program execution password (access password). 6 is prompted to input an authentication program execution password (step S61 in FIG. 6).

  Next, the authentication program execution password authentication means 20 of the user terminal device 10 authenticates whether or not the password input by the user is the correct authentication program execution password (step S62 in FIG. 6). .

  When the input password is correct (YES in step S62 in FIG. 6), the process proceeds to step S1, and the centralized management device access means 21 of the user terminal device 10 tries to access the password centralized management device 20 (FIG. 6). Step S1). Thereafter, the same operation as in the first embodiment is performed.

  On the other hand, if the input password is not correct (No in step S62 in FIG. 6), for example, an indication that “the input password is incorrect” is displayed on the display screen, and then the authentication program is terminated. . Therefore, access to the password central management apparatus 20 by the central management apparatus access means 11 is not executed.

  According to the second embodiment as described above, before attempting to access the password central management apparatus 20 by the central management apparatus access means 11 of the user terminal apparatus 10, a predetermined authentication program execution password (access password) is used. The centralized password management device 20 by the centralized management device access means 11 is used only when the authentication of the access password entered in response to the request is performed, and the authentication is successful. Therefore, the security can be further improved as compared with the first embodiment.

  In each of the above embodiments, an example in which authentication by the user authentication device 30 is necessary to use the user terminal device 10 has been described, but the present invention is not limited to this example, and the user terminal device 10 The configuration may be such that authentication by the user authentication device 30 is required only when specific processing is executed.

  Further, in each of the above embodiments, the password generation unit 23 of the password central management device 20 and the password generation unit 15 of the user terminal device 10 generate a password using the user ID and the authentication ID, respectively. Thus, the example in which the security is improved has been described, but the password may be generated using only the authentication ID.

It is a block diagram which shows the structure of the password authentication system 100 which concerns on 1st Embodiment. It is a flowchart which shows the flow of operation | movement of the user terminal device in the password authentication system of FIG. It is a flowchart which shows the flow of operation | movement of the password centralized management apparatus in the password authentication system of FIG. It is a flowchart which shows the flow of operation | movement of the user authentication apparatus in the password authentication system of FIG. It is a block diagram which shows the structure of the password authentication system 100 which concerns on 2nd Embodiment. It is a flowchart which shows the flow of operation | movement of the user terminal device in the password authentication system of FIG.

Explanation of symbols

10 User terminal device 11 Centralized management device access means (access means)
12 Authentication ID storage unit (authentication information storage means)
13 Authentication ID update means (authentication information update means)
14 Authentication request means 15 Password generation means (second password generation means)
20 Centralized password management device (password management device)
22 Authentication ID issuing means (authentication information issuing means)
23 Password generation means (first password generation means)
25 Notification means 27 Password update means 30 User authentication device 32 Password storage unit (password storage means)
33 Authentication means 100 Password authentication system 200 Password authentication system 201 Password authentication means for executing authentication program (preliminary authentication means)

Claims (16)

A user terminal device used by a user; a user authentication device that performs authentication processing in response to an authentication request from the user terminal device; and a password management device that manages a password used for authentication by the user authentication device. In the password authentication system,
The user authentication device includes:
Password storage means for storing and holding a password corresponding to each user terminal device;
When there is an authentication request using a password from the user terminal device, an authentication unit that performs authentication by checking the password against a corresponding password among the passwords stored in the password storage unit;
Configured with
The password management device
Authentication information issuing means for newly issuing authentication information whenever accessed from the user terminal device;
A first password generating means for newly generating a password based on the issued authentication information each time authentication information is newly issued by the authentication information issuing means;
Password update means for updating an old password stored in the password storage means of the user authentication device with a password newly generated by the first password generation means;
A notification means for notifying the access source user terminal device of the password newly generated by the first password generation means and the authentication information used to generate the password;
Configured with
The user terminal device
Access means for accessing the password management device;
Authentication information storage means for storing and holding the authentication information;
Authentication information update means for updating old authentication information stored in the authentication information storage means with the notified authentication information when the notification information and password are notified by the notification means of the password management device;
If the password management device does not notify the authentication information and the password even if the access unit attempts to access the password management device, the first information is stored based on the authentication information stored in the authentication information storage unit. Second password generation means for newly generating a password by the same method as the password generation means of
When the password is notified by the notifying unit of the password management device, or when the password is generated by the second password generating unit, the user authentication device is authenticated using the notification or the generated password An authentication request means for making a request;
A password authentication system comprising:   2. The password authentication system according to claim 1, wherein the access means of the user terminal device automatically tries to access the password management device when authentication by the user authentication device is required.   When the user terminal device attempts to access the password management device by the access means of the user terminal device, the user terminal device requests the user to input a predetermined access password in advance, and And a pre-authentication unit that performs authentication of the access password input in response to the request and permits the access unit to try to access the password management device only when the authentication is successful. The password authentication system according to claim 1.   The preliminary authentication unit of the user terminal device automatically performs a process of requesting the user to input the access password when authentication by the user authentication device is required. Item 4. The password authentication system according to item 3. The first password generation means of the password management device includes the authentication information issued by the authentication information issuing means and the user acquired from the user terminal device when accessed by the access means of the user terminal device While generating a password based on two pieces of information, unique information,
The second password generating means of the user terminal device is based on two pieces of information: authentication information stored in the authentication information storage means and user specific information stored in the user terminal device. The password authentication system according to any one of claims 1 to 4, wherein the password authentication system is generated.   When the second password generation means of the user terminal device is not notified of authentication information and password from the password management device even after a predetermined time has elapsed since the access device tried to access the password management device. The password authentication system according to claim 1, wherein a password is generated.   The said password management apparatus in the password authentication system as described in any one of Claims 1 thru | or 6.   The user terminal device in the password authentication system according to any one of claims 1 to 6.   The program for making a computer perform the process by the password management apparatus of Claim 7.   The program for making a computer perform the process by the user terminal device of Claim 8. A user terminal device used by a user; a user authentication device that performs authentication processing in response to an authentication request from the user terminal device; and a password management device that manages a password used for authentication by the user authentication device. In the method of authenticating the password in the password authentication system,
A first step of trying to access the password management device from the user terminal device;
A second step of newly issuing authentication information in the password management device each time the access is made;
A third step of generating a new password based on the issued authentication information each time the authentication information is newly issued;
A fourth step of updating an old password stored in the user authentication device with a password newly generated by the third step;
A fifth step of notifying the access source user terminal device of the password newly generated by the third step and the authentication information used to generate the password;
When authentication information and a password are notified to the user terminal device, a sixth process of updating old authentication information stored in advance in the user terminal device with the notified authentication information;
Authentication information stored in the user terminal device when authentication information and a password are not notified from the password management device to the user terminal device even if the user terminal device attempts to access the password management device. And a seventh process for generating a new password by the same method as in the third process,
When the password is notified from the password management device to the user terminal device, or when the password is generated by the seventh process, the user terminal device is used by using the notification or the generated password. An eighth step of making an authentication request to the user authentication device from:
A password authentication method comprising:   12. The password authentication method according to claim 11, wherein the first process is automatically executed when authentication by the user authentication device is required.   Prior to the first step, the user terminal device requests the user to input a predetermined access password, executes authentication of the access password input in response to the request, and executes the authentication. 12. The password authentication method according to claim 11, wherein execution of the first process is permitted only when the password is successful.   The said user terminal device performs the process which requests | requires the input operation of the said access password automatically from a user, when the authentication by the said user authentication apparatus is required. Password authentication method. In the third process, the authentication information issued in the second process and the user specific information acquired from the user terminal device when accessed in the first process are included in the two information While generating a password based on
In the seventh step, a password is generated based on two pieces of information: authentication information stored in the user terminal device and user-specific information stored in the user terminal device. The password authentication method according to any one of claims 11 to 14. The seventh process is performed when authentication information and a password are not notified from the password management apparatus to the user terminal apparatus even after a predetermined time has elapsed since the first process was performed. The password authentication method according to any one of claims 11 to 15.

Images