JP2006331204A - Authentication method and authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent a provided service from being received through spoofing. <P>SOLUTION: If the authentication state of a user to be authenticated is an unauthenticated one, an authentication proxy server requests user identification information about the user from a user terminal, and the user terminal notifies user identification information about the user including line identification information to the authentication proxy server. The authentication proxy server identifies the user and a subscriber line by the user identification information, verifies whether or not the user may use the subscriber line, and if it may be used, sets an authenticated state and notifies authentication result information indicating the successful authentication to a service server. If failing to identify the user or subscriber line by the user identification information or if finding that the user may not use the subscriber line, the authentication proxy server sends authentication result information indicating the failed authentication to the service server. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a single sign-on authentication technique in a communication network configuration in which a user is provided with a service from a service server via a communication network, and more particularly to an authentication method and an authentication system with enhanced prevention of impersonation of a legitimate user.

  Conventionally, a single sign-on technique that enables access to a plurality of Web servers on a communication network by performing a single authentication procedure is known. This single sign-on technology includes a reverse proxy type and an agent module type. The reverse proxy type is a method in which all service requests addressed to a Web server are received by a dedicated single sign-on server, and whether or not the service request can be transferred is selected according to an access list defined for each user. On the other hand, in the agent module type, the authentication status of user authentication is determined in each Web server, and if it is not authenticated, the user's access request is transferred to the single sign-on server for authentication. If the authentication is successful, a certificate is issued, and each Web server determines whether the user can access by verifying the certificate issued by the single sign-on server.

  Single sign-on systems that perform the operations described above have already been sold by various companies, and are also used in commercial services for general consumers. The Liberty Alliance project (http://www.projectliberty.org, http://www.projectliberty.org/jp/) is an open standard for ID federated single sign-on in the ID-FF (Identity Federation Framework) specification. Defines specifications.

  On the other hand, in a communication network, devices equipped with Internet Protocol Version 6 (IPv6) have been spreading in recent years. In parallel with this, an IPv6 connection service in which a fixed IPv6 address block (prefix) is assigned on the communication network side for each subscriber line is widely provided, and a user side device that enjoys this service uses the IPv6 address block. One of these addresses is used as its own address to perform communication using IPv6. RFC 2461 (http://www.ietf.org/rfc/), which is a specification prescribed in the Internet Engineering Task Force (IETF), is used as a method for notifying a user-side device of a prefix assigned on the communication network side. rfc2461.txt) is common.

  Further, in recent communication networks, optical fibers are being widely applied to subscriber lines, and it has become possible to prevent wiretapping and information alteration in the subscriber line section of the communication network.

Note that there is known an authentication system capable of realizing single sign-on that has little influence on performance when providing a service via a network (see, for example, Patent Document 1).
Japanese Patent Laying-Open No. 2005-062556

  By the way, in the conventional technology, when information (for example, password) for authenticating the user is leaked to a third party, the third party connects the user terminal to another connection point on the communication network. There is a problem in that there is a risk of impersonation of a legitimate user by a third party by successfully authenticating using authentication information obtained illegally. Especially in the single sign-on system, once impersonation of a legitimate user is performed, impersonation is effective for a large number of Web servers. Therefore, impersonation damage is easy to spread, and prevention of impersonation is a very big technical issue. .

  The present invention has been made in view of such circumstances, and associates a subscriber line connected to a communication network with a user, and utilizes this information other than the subscriber line specified for each user. An object of the present invention is to provide an authentication method and an authentication system that can prevent the use of a single sign-on system impersonating the user.

  The present invention provides a user terminal receiving service provision, a line connection device for connecting the user terminal to a communication network via a subscriber line, and providing the service to the user connected to the communication network. An authentication method in a system comprising: a service server; and an authentication proxy server that is connected to the communication network and performs authentication of the user for providing the service of the service server, wherein the user terminal is connected to the line Requesting line identification information of the subscriber line to which the user terminal is connected to the connection device, and the line connection device to identify the line of the subscriber line to which the user terminal is connected to the user terminal A step of notifying information, and when the service server receives a service provision request from the user terminal, the authentication status of the user is confirmed. Requesting authentication authorization of the user to a server, the authorization agency server requesting user identification information of the user to the user terminal, and the user terminal including the line identification information Notifying the authentication agent server of the user identification information of the user, the authentication agent server identifying the user and the subscriber line based on the user identification information, and the user Verifying whether or not the service can be used, and if the service can be used, the authentication result information indicating that the service has been authenticated is sent to the service server. Indicates that the authentication is invalid if the user or subscriber line cannot be identified based on the subscriber identification information, or if the user is unable to use the subscriber line. It characterized by having a sending a testimony result information said service server f.

The present invention provides a user terminal receiving service provision, a line connection device for connecting the user terminal to a communication network via a subscriber line, and providing the service to the user connected to the communication network. An authentication system comprising: a service server; and an authentication proxy server connected to the communication network and acting as a proxy for the user to provide the service of the service server, wherein the line connection device includes the user A means for receiving a notification request for line identification information of a subscriber line connecting the user terminal from the terminal, and transmitting the line identification information to the user terminal, wherein the user terminal includes the line connection device; A line identification information notification request for a subscriber line connected to the user terminal and receiving the line identification information notified from the line connection device; 'S identification information and means for transmitting to the authentication proxy server, wherein the authentication agent server includes means for receiving an authentication proxy request from the service server,
Means for holding and confirming the authentication status of the user, means for notifying the service server of authentication result information indicating that the user has been authenticated when the user has been authenticated, and the user being unauthenticated In this case, means for transmitting a user identification information notification request to the user terminal and receiving the user identification information notified from the user terminal, and a user and a subscriber from the user identification information Means for identifying a line; means for confirming whether the user identified from the user identification information can use the subscriber line identified from the user identification information; and If it can be used, the authentication status of the user is changed to authenticated, and authentication result information indicating that the user has been authenticated is transmitted to the service server, and the user or subscription is determined from the user identification information. Person line Authentication result information indicating that the authentication is invalid when the user identified by the user identification information cannot use the subscriber line identified by the user identification information. Means for transmitting to the service server, the service server verifies the authentication result information, and provides the service to the user terminal when the authentication result information is valid, and the authentication result information A means for notifying the user terminal that it is impossible to provide a service when invalid is provided.

  According to the present invention, it is possible to prevent the use of the single sign-on system pretending to be a user other than the subscriber line specified for each user, and to prevent impersonation of a legitimate user. The effect that can be strengthened is obtained.

  Hereinafter, an authentication system according to an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing the configuration of the embodiment. In this figure, reference numeral 1 denotes a communication network, to which a line connection device 11, a service server 12, and an authentication proxy server 13 are connected. Reference numeral 2 denotes a user terminal that receives a service provided by the service server 12. Reference numeral 3 denotes a subscriber line that connects the user terminal 2 to the communication network 1 via the line connection device 11.

  Referring to FIG. 1, in a system constituted by a communication network 1, a user terminal 2, a subscriber line 3, a line connection device 11, a service server 12 and an authentication proxy server 13, line identification information is stored in the authentication proxy server 13. A processing procedure for performing the user authentication used will be briefly described. In FIG. 1, the service server 12 requests the authentication proxy server 13 to perform authentication proxy, the authentication status of the user in the authentication proxy server 13 is unauthenticated, and the user connects the subscriber line 3. The case where it can be used will be described as an example.

  First, the user terminal 2 requests the line connection device 11 to notify the line identification information of the subscriber line 3 to which the user terminal 2 is connected (step S101). In response, the line connection device 11 notifies the user terminal 2 of the line identification information of the subscriber line 3 to which the user terminal 2 is connected (step S102). Subsequently, the user operates the user terminal 2 to request service provision from the service server 12 (step S103). In response to this, the service server 12 confirms the user authentication status. If the user authentication status is unauthenticated, the service server 12 requests the authentication proxy server 13 to perform user authentication proxy (step S104). ).

  The authentication proxy server 13 accepts this authentication request, confirms the user authentication status, and if the user authentication status is unauthenticated, requests the user terminal 2 to notify the user identification information ( Step S105). In response to this, the user terminal 2 notifies the authentication proxy server 13 of user identification information including the line identification information notified from the line connection device 11 (step S106). Upon receiving the notification of the user identification information, the authentication agent server 13 identifies the user and the subscriber line, verifies whether or not the user can use the subscriber line, and if it is available. Authentication result information indicating that authentication has been made is generated and notified to the service server 12 (step S107). The service server 12 verifies the authentication result information, and if valid, provides the service to the user terminal 2 (step S108).

  If another service server has already requested the authentication agent server 13 for an authentication agent related to the same user and the authentication state of the user in the authentication agent server 13 is already “authenticated”, the authentication agent The server 13 notifies the service server 12 of valid authentication result information without performing the authentication process. In this case, the user does not need to perform an authentication operation and can enjoy a service by so-called single sign-on.

  In the above description, the line identification information may be, for example, an IPv6 address block (prefix) that is fixedly assigned on the communication network side for each subscriber line and is notified to the user terminal by a protocol based on RFC 2461. It may be an IPv4 address dynamically assigned using DHCP (Dynamic Host Configuration Protocol; defined in RFC1541) for each subscriber line, or any identifier that can identify other subscriber lines. .

  Further, the user identification information needs to include information for uniquely identifying the user and the above-described line identification information. In addition to these, for example, to confirm the identity of the user. Information such as passwords and public key certificates may be included. Furthermore, the authentication result information needs to include the result of authentication in the authentication proxy server 13 and the user identifier, but appropriate measures (such as electronic signatures) to prevent misrepresentation, impersonation, and falsification are applied. The authentication proxy server 13 may include an authentication method and an implementation date, and may include information on the validity period of the authentication result.

  Further, the protocol for transmitting and receiving each information is arbitrary, and for example, HTTP (HTTPS) can be used. When HTTP (HTTPS) is used, steps S104 and S107 in FIG. 1 may transfer information via the user terminal 2 by HTTP redirection.

  Next, the service server 12 requests the authentication proxy server 13 for authentication, the authentication status of the user in the authentication proxy server 13 is unauthenticated, and the user can use the subscriber line 3. The operation in the case of is described with reference to the sequence diagram shown in FIG. First, the user terminal 2 requests the line connection device 11 to notify the line identification information of the subscriber line 3 to which the user terminal 2 is connected (step S201). In response, the line connection device 11 notifies the user terminal 2 of the line identification information of the subscriber line 3 to which the user terminal 2 is connected (step S202). Then, the user operates the user terminal 2 to request service provision from the service server 12 (step S203). On the other hand, the service server 12 confirms the authentication state of the user terminal 2 (step S204). If the authentication status of the user terminal 2 is unauthenticated in step S204, the service server 12 requests the authentication proxy server 13 to perform authentication of the user terminal 2 (step S205).

  When the authentication proxy server 13 receives the authentication request, the authentication state of the user terminal 2 is confirmed (step S206). If the authentication status of the user terminal 2 is unauthenticated in step S206, the authentication proxy server 13 requests user identification information from the user terminal 2 (step S207). In response to this, the user terminal 2 notifies the authentication proxy server 13 of the user identification information including the line identification information notified from the line connection device 11 (step S208). Upon receiving this user identification information, the authentication proxy server 13 identifies the user and the subscriber line, and verifies whether or not the user can use the subscriber line (step S209).

  Then, in step S209, the authentication proxy server 13 sets an authenticated state if the user can use the subscriber line (step S210), generates authentication result information indicating that the user has been authenticated, and generates a service server. 12 is notified (step S211). The service server 12 verifies the notified authentication result information (step S212). If the authentication result information is valid, the service server 12 changes to an authenticated state (step S213). Then, the service server 12 provides a service to the user terminal 2 (step S214).

  Next, details of processing operations of the service server 12 and the authentication proxy server 13 will be described with reference to FIGS. 3 and 4. FIG. 3 is a flowchart showing the operation of the service server 12 shown in FIG. FIG. 4 is a flowchart showing the operation of the authentication proxy server 13 shown in FIG.

  First, when the service server 12 receives a service request from the user terminal 2 (step S301), the service server 12 confirms the authentication status of the user (step S302). If authenticated, the service server 12 proceeds to the process of step S307. On the other hand, if unauthenticated, the service server 12 requests the authentication proxy server 13 to perform user authentication proxy (step S303).

  Upon receiving the authentication proxy request from the service server 12 (step S401), the authentication proxy server 13 confirms the user authentication status (step S402). If authenticated, the process proceeds to step S408. On the other hand, if unauthenticated, the authentication agent server 13 requests the user terminal 2 to notify the user identification information (step S403). Subsequently, the authentication agent server 13 receives the user identification information transmitted by the user terminal 2 in order to respond to this request (step S404). Then, the authentication agent server 13 identifies the user and the subscriber line 3 from the received user identification information (step S405). As a result, if the identification fails, the process proceeds to step S409.

  On the other hand, if the identification is successful, the authentication agent server 13 confirms whether or not the user identified from the user identification information can use the subscriber line identified from the user identification information (step S406). . As a result of the confirmation, if it cannot be used, the process proceeds to step S409. On the other hand, if it can be confirmed that the user is available, the authentication state of the user in the authentication proxy server 13 is changed to authenticated (step S407), and the user is authenticated to the service server 12. The authentication result information shown is notified (step S408).

  Further, the authentication proxy server 13 identifies the user and the subscriber line 3 from the received user identification information, and if the identification fails (identification failed in step S405), the use identified from the user identification information. If the user confirms whether or not the subscriber line identified from the user identification information can be used, if the user is not available (cannot be used in step S406), the service server 12 is notified of the user. Authentication result information indicating that the authentication is invalid is notified (step S409).

  Next, the service server 12 receives the authentication result information transmitted from the authentication proxy server 13 (step S304), and verifies the authentication result information (step S305). If the received authentication result information is information indicating that the authentication is invalid, the user terminal 2 is notified that the authentication has failed (step S308). On the other hand, if the received authentication result information is information indicating that authentication has been completed, the user authentication state in the service server 12 is changed to authenticated (step S306), and the service is provided to the user terminal 2. Provide (step S307).

  1 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system and executed to perform an authentication process. May be. Here, the “computer system” includes an OS and hardware such as peripheral devices. The “computer system” includes a WWW system provided with a homepage providing environment (or display environment). The “computer-readable recording medium” refers to a portable medium such as a flexible disk, a magneto-optical disk, a ROM, and a CD-ROM, and a storage device such as a hard disk built in the computer system. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

It is a block diagram which shows the structure of one Embodiment of this invention. It is a sequence diagram which shows operation | movement of the system shown in FIG. It is a flowchart which shows operation | movement of the service server 12 shown in FIG. It is a flowchart which shows operation | movement of the authentication proxy server 13 shown in FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Communication network 2 ... User terminal 3 ... Subscriber line 11 ... Line connection apparatus 12 ... Service server 13 ... Authentication agent server

Claims (2)

A user terminal that receives service provision, a line connection device that connects the user terminal to a communication network via a subscriber line, a service server that is connected to the communication network and provides a service to the user; An authentication method in a system comprising an authentication proxy server connected to the communication network and proxying the user for providing the service of the service server,
The user terminal requests line identification information of a subscriber line to which the user terminal is connected to the line connection device, and the line connection device is connected to the user terminal. Notifying the line identification information of the subscriber line,
Confirming the authentication status of the user when the service server receives a service provision request from the user terminal, and requesting the authentication proxy of the user to the authentication proxy server when not authenticated. ,
The authentication proxy server requests the user identification information of the user from the user terminal, and the user terminal notifies the authentication proxy server of the user identification information of the user including the line identification information. And steps to
The authentication agent server identifies the user and the subscriber line based on the user identification information, verifies whether or not the user can use the subscriber line, and if it is available, it is authenticated. A step of notifying the service server of authentication result information indicating that it has been authenticated after entering the state;
The authentication is invalid when the authentication proxy server cannot identify the user or the subscriber line based on the user identification information, or when the user cannot use the subscriber line. Sending authentication result information indicating to the service server;
An authentication method characterized by comprising: A user terminal that receives service provision, a line connection device that connects the user terminal to a communication network via a subscriber line, a service server that is connected to the communication network and provides a service to the user; An authentication system comprising an authentication proxy server connected to the communication network and proxying the user for providing the service of the service server,
The line connection device is:
A means for receiving a request for notification of line identification information of a subscriber line connecting the user terminal from the user terminal, and means for transmitting the line identification information to the user terminal;
The user terminal is
Means for transmitting a line identification information notification request for a subscriber line connecting the user terminal to the line connection device, and receiving the line identification information notified from the line connection device;
Means for transmitting user identification information including the line identification information to the authentication proxy server,
The authentication proxy server is:
Means for receiving an authentication proxy request from the service server;
Means for maintaining and checking the user's authentication status;
Means for notifying the service server of authentication result information indicating that the user is authenticated when the user has been authenticated;
Means for transmitting a user identification information notification request to the user terminal when the user is unauthenticated and receiving the user identification information notified from the user terminal;
Means for identifying a user and a subscriber line from the user identification information;
Means for confirming whether the user identified from the user identification information can use the subscriber line identified from the user identification information;
Means for changing the authentication state of the user to authenticated when the user can use the subscriber line, and transmitting authentication result information indicating that the user has been authenticated to the service server;
When the user or subscriber line cannot be identified from the user identification information, or when the user identified from the user identification information cannot use the subscriber line identified from the user identification information, Means for transmitting authentication result information indicating that the authentication is invalid to the service server,
The service server
The authentication result information is verified, and when the authentication result information is valid, the service is provided to the user terminal, and when the authentication result information is invalid, the service is not provided to the user terminal. An authentication system comprising: means for notifying that.

Images