JP2007241590A - Authentication system of user of a plurality of terminals, authentication server, and authentication integrating terminal - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To realize high-security-level authentication of a user of a plurality of terminals in a simple manner. <P>SOLUTION: By associating with authentication information of an authentication medium, an authentication information file 4 stores identification information of a first terminal to allow log-in, user identification information, an encryption key unique to the first terminal, identification information of a second terminal allowing the log-in, user identification information, and an encryption key unique to the second terminal. A transmission and reception means 6 receives the authentication information and authentication request information from the network-connected first terminal. An authentication means 5 retrieves the information file 4 by using the authentication information as a key, and encrypts the user identification information. When allowing an authentication request, the transmission and reception means 6 transmits the identification information of the first terminal specified by the authentication means 5, the encrypted user identification information which is associated with the first terminal, the identification information of the second terminal, and the encrypted user identification information which is associated with the second terminal. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a multi-terminal user authentication system, and in particular, is characterized by performing multi-terminal user authentication using an authentication server.

  One user may operate multiple terminals at the same time, such as operator work, but conventionally, when a user operates multiple terminals, it is common to perform user authentication for each terminal. there were. The user authentication for each terminal includes, for example, a method of accepting input of a user ID and a password for each terminal, collating with a combination of the user ID and password stored in the terminal, and performing authentication based on whether or not they match. In addition, there is a method in which a user ID and password are stored in an IC card or the like, and the user ID / password read from the reading device is compared with the stored user ID / password for authentication. However, since the authentication is performed individually, the efficiency is low, and the security level is low because of the method of collating information stored in the storage device of the terminal. In addition, since the method using an IC card or the like requires ID cards for the number of terminals, authentication takes time and management of the IC card is difficult.

According to the method disclosed in Patent Document 1 (Japanese Patent Laid-Open No. 2005-190394), when a login is accepted to one of a plurality of terminals connected via a network, the received user ID and A signal asking whether or not authentication information including the same user ID is stored is transmitted in the network, and the user is logged in to the terminal in which the authentication information including the same user ID is stored. In this method, since authentication information is stored in each terminal, there is a problem that management of the authentication information becomes complicated and the security level is low.
JP 2005-190394 A

  An object of the present invention is to realize user authentication of a plurality of terminals having a high security level by a simple method.

  The multi-terminal user authentication system according to the present invention is a multi-terminal user authentication system having a network-connected authentication server that permits login of a terminal and a first terminal, the first being connected to the network. In order to determine whether or not to permit login of the terminal and the second terminal, the identification information of the first terminal, the identification information of the user, the first terminal, which are permitted to log in, in association with the authentication information of the authentication medium The identification information of the second terminal that permits the unique encryption key and login, the identification information of the user, the authentication information file that stores the encryption key unique to the second terminal, and the authentication information from the first terminal connected to the network After transmitting / receiving means for receiving authentication request information and searching for the authentication information file using the authentication information received by the transmission / reception means as a key and identifying the corresponding authentication information Authentication means for encrypting the identification information of the user with an encryption key associated with the specified authentication information, and the transmission / reception means receives the authentication request information from the first terminal and then issues an authentication request. When permitting, the identification information of the first terminal specified by the authentication means, the identification information of the encrypted user associated with the first terminal, the identification information of the second terminal, the second terminal And the encrypted server identification information associated with the authentication server, the authentication server reading means for acquiring the user authentication information from the authentication medium, The authentication information read by the authentication medium reading means and the authentication request information are transmitted to the authentication server, the terminal identification information and the encrypted user identification information are received from the authentication server, and the terminal identification information It is characterized in that it has a first terminal and a transmitting and receiving means for transmitting identification information of the encrypted user to the second terminal of the corresponding.

  The authentication server according to the present invention is an authentication server that permits login of the first terminal and the second terminal connected to the network, and is associated with the authentication information of the authentication medium, and allows the login. Authentication information file for storing terminal identification information, user identification information, first terminal-specific encryption key and second terminal identification information permitting login, user identification information, and second terminal-specific encryption key And transmitting / receiving means for receiving authentication information and authentication request information from the first terminal connected to the network, searching the authentication information file using the authentication information received by the transmitting / receiving means as a key, and identifying the corresponding authentication information And an authentication unit that encrypts the identification information of the user with an encryption key associated with the specified authentication information. After accepting the certificate request information, when permitting the authentication request, the identification information of the first terminal specified by the authentication means, the encrypted user identification information associated with the first terminal, and the first The identification information of the second terminal and the encrypted user identification information associated with the second terminal are transmitted to the first terminal.

The authentication integrated terminal according to the present invention is an authentication integrated terminal connected to an authentication server that permits login of the terminal, which is an authentication integrated terminal that acquires user authentication information from the authentication medium, and the authentication medium The authentication information and the authentication request information read by the reading unit are transmitted to the authentication server, the terminal identification information and the encrypted user identification information are received from the authentication server, and the terminal identification information and the encryption information are received. And transmitting / receiving means for transmitting the converted user identification information to the corresponding terminal.
In addition, the corresponding terminal is identified from the terminal identification information received by the transmission / reception means, and then the designation of the terminal to which the user logs in is accepted, and the encrypted user identification for the terminal designated by the user It is characterized by transmitting information.
The authentication integrated terminal further includes a lock processing unit that receives the information indicating that the authentication medium has been removed from the authentication apparatus and then receives the information from the authentication medium reading unit and locks the control of the terminal. Further, the transmission / reception means receives the information indicating that the authentication medium has been removed from the authentication device, and then receives the information from the authentication medium reading means, and sends the terminal lock information to the corresponding terminal. It is characterized by transmitting.

  According to the multi-terminal user authentication system of the present invention, it is possible to log in and lock a plurality of terminals by attaching / detaching an authentication medium in one terminal.

Embodiment 1 FIG.
FIG. 1 is a system configuration diagram of the present embodiment. As shown in FIG. 1, in the multiple-terminal user authentication system, an authentication server 1, a terminal (first terminal, authentication integrated terminal) 2, and a terminal (second terminal) 3 are connected via a network. The terminal 2 integrates authentication of a plurality of terminals (terminal 3) as an authentication integrated terminal. In FIG. 1, only one terminal 3 is shown for simplification, but one or more terminals 3 integrated and managed by the terminal 2 can be connected to the network. A plurality of combinations of the integrated management terminal 2 and the managed terminal 3 can be connected and managed.

  In this embodiment, the terminal is literally connected to a server (which may be an authentication server or a server connected for other purposes other than the authentication server), and various services are performed by exchanging data with the server. This embodiment can be applied to both computers including a computer that performs (for example, operator work) and a computer that operates stand-alone.

  FIG. 2 is a system configuration diagram in which the configurations of the authentication server 1, the terminal 2, and the terminal 3 are described in detail. The authentication server 1 is a server that authorizes login permission / non-permission for users who log in to the terminal 2 and the terminal 3, but authentication means 5 that determines whether or not to authenticate by referring to the authentication information file 4. Transmission / reception means 6 for exchanging data with the terminal 2. The authentication information file 4 is associated with the authentication information of the authentication medium in order to determine whether or not the login of the terminal 2 and the terminal 3 is permitted, and the identification information of the terminal 2 that permits the login and the user who logs in to the terminal 2 Identification information of the terminal 2, identification information of the terminal 3 that permits login, identification information of the user who logs in to the terminal 3, and encryption key unique to the terminal 3 are stored. The authentication unit 5 searches the authentication information file 4 using the authentication information received by the transmission / reception unit 6 as a key, specifies the corresponding authentication information, and then uses the encryption key associated with the specified authentication information to The identification information of is encrypted. The transmission / reception means 6 accepts authentication information and authentication request information from the terminal 2, and when authenticating, login information (identification information of the terminal 2 specified by the authentication means 5, the terminal 2 is associated with the login information configured by the authentication means 5. The encrypted user identification information, the terminal 3 identification information, and the encrypted user identification information associated with the terminal 3). In a storage device (not shown), information for specifying the terminal 2 (integrated management terminal) and a decryption key unique to the terminal 2 are stored in association with each other.

The terminal 2 is provided with an authentication device (not shown) that reads the authentication information from the authentication medium 12, and the authentication medium reading means 11 receives the authentication information read from the authentication device. The authentication medium 12 can be composed of an IC card (contact type or non-contact), a USB flash memory, or the like, but is not limited thereto, and authentication information for each user (user identification information is used as a user's private key). Any data medium may be used as long as it has a function of storing the data signed in (1).
The transmission / reception means 7 transmits the authentication information and the authentication request information read by the authentication medium reading means 11 and encrypted by the encryption / decryption processing means 8 to the authentication server 1, and login information (a plurality of “ The terminal identification information and the encrypted user identification information ") are received, and the received terminal identification information and the encrypted user identification information are transmitted to the corresponding terminal 3.
The encryption / decryption processing unit 8 encrypts the authentication information read by the authentication medium reading unit 11 and delivers it to the transmission / reception unit 7, and decrypts the login information to the terminal 2 transmitted from the authentication server 1. It also has a function of accepting designation of a terminal to which a user logs in from identification information of a plurality of terminals included in the received login information and transmitting encrypted user identification information to the terminal 3 designated by the user. .
The login processing unit 9 performs login processing based on the login information of the terminal 2 decrypted by the encryption / decryption processing unit 8. The lock processing means 10 receives information indicating that the authentication medium 12 has been removed from the authentication medium reading means 11 and locks the control of the terminal or performs logout processing. Thereafter, the transmission / reception means 7 receives information indicating that the authentication medium 12 has been removed from the authentication device, and transmits terminal lock information to the corresponding terminal 3 that is integrated and managed.

  As described above, a plurality of terminals 3 can be configured on the network, and have the following configuration. The transmission / reception means 13 receives the encrypted login information to the terminal 3, and the encryption / decryption processing means 14 uses the encryption key (not shown) unique to the terminal 3 stored in the storage device (not shown). The login information is decrypted, and the login processing means 15 performs a login process to the terminal 3 using the decrypted login information. When the lock processing means 16 receives the lock information from the transmission / reception means 13, the lock processing means 16 performs logout or lock processing of the terminal 3.

  FIG. 7 is a diagram showing the configuration of the authentication information file 4. Corresponding to the authentication information of the authentication medium (user authentication information), the terminal identification information (computer name, terminal ID or IP address, etc.), user ID, password, terminal specific for each terminal that the user is allowed to log in to The encryption key is stored. For example, according to FIG. 7, the identification information of the terminal 2 is associated with the authentication information of the authentication medium 1, the user ID 1, the password 1, the encryption key 1, the identification information of the terminal 3, the user ID 2, the password 2, the encryption key 2,. -The identification information of the terminal n, the user ID n, the password n, and the encryption key n are stored. This means that the user who owns the authentication medium 1 is permitted to log in the terminal 2, the terminal 3,. (“Terminal 3... Terminal n” is a terminal that is integrated and managed as “Terminal 3” in FIGS. 1 and 2). In general, since the terminal to which login is permitted differs depending on the user, the terminal information (authentication information for each terminal and the encryption key of the terminal) stored in association with each authentication medium is different, and the authentication information file 4 Registration and updating are performed by the system administrator or the like from the terminal 2 or the like.

  Next, the flow of processing in the present embodiment will be described with reference to FIGS. 3 to 4 show the flow of login processing. The processing is started when the authentication medium 12 is inserted into an authentication device (not shown), and the authentication medium reading unit 11 of the terminal 2 acquires the authentication information from the authentication medium 12 and sends it to the encryption / decryption processing unit 8. Deliver (step S1). As described above, the authentication information is information for authenticating the user. The authentication information is data signed with the user's private key, a secret code, or a secret code, and is stored in the authentication information file 4. Corresponds to information. The encryption / decryption processing means 8 encrypts the passed authentication information with the encryption key unique to the terminal 2 stored in the storage device (not shown), and delivers it to the transmission / reception means 7 (step S2). The transmission / reception means 7 transmits the encrypted authentication information, information specifying the terminal 2 (computer name, terminal ID or IP address, etc.), and authentication request information to the authentication server 1 (step S3). The means 6 delivers the authentication information together with the received information specifying the terminal 2 to the authentication means 5 (step S4). The authentication means 5 identifies the decryption key of the terminal 2 based on the information identifying the terminal 2 stored in advance in the storage device, decrypts the authentication information encrypted with the decryption key, Then, comparison is made with the authentication information registered in the authentication information file 4, and it is confirmed whether it matches with any of the registered authentication information (step S5). If it matches with any of the registered authentication information, the authentication of the terminal associated with the login information up to the terminal 2, the terminal 3,. Encrypted with an encryption key, terminal 2, terminal 3... Terminal n identification information, encrypted terminal 2, terminal 3... Login information (user ID and password) corresponding to terminal n are transmitted to terminal 2. Transmit (step S6). If none of the authentication information matches in step S5, the terminal 2 is notified that the authentication information received cannot be authenticated (cannot log in) (step S11), and the process ends.

  After step S6, the transmitting / receiving means 7 of the terminal 2 receives the received identification information of the terminal 2, terminal 3... Terminal n, the encrypted terminal 2, terminal 3. ID and password) are transferred to the encryption / decryption processing means 8 (step S7), and the encryption / decryption processing means 8 performs a process of selecting a terminal that performs login processing from among the terminal 2, terminal 3,. Perform (step S8). Specifically, a terminal selection screen that prompts the user to select and display is displayed, and a selection to select a login terminal from the user is received and determined. For example, when terminal 2, terminal 3... Terminal n can log in, the screen is displayed as “Please select a terminal to log in from terminal 2, terminal 3. Can be configured to accept selections in boxes.

  When the terminal 2 is selected in step S8, the encryption / decryption processing means 8 decrypts the login information with the decryption key stored in the storage device of the terminal 2 (step S9), and the login processing means 9 logs in Based on the information, login processing of the terminal 2 is performed (step S10). When a terminal other than the terminal 2 is selected as a login terminal in step S8, the process proceeds to (1) shown in FIG. Even if one user has the authority to log in to a plurality of terminals, the terminal to be used may be limited depending on the business. However, the processing shown in steps S8, S9, and (1) makes it unnecessary for the terminal. It is possible to prevent the user from logging in and leaving the user logged in, and the security becomes strong. In addition, when the terminal for logging in is always fixed and there is no need to select from a plurality of candidates, the process shown in step S8 can be omitted.

  When the processing moves to (1) in FIG. 4 and the terminal other than the terminal 2 is selected, the encryption / decryption processing means 8 selects the identification information of the designated terminal, the login information (user ID and password), Is transmitted to the transmission / reception means 7 (step S12). The transmission / reception means 7 takes out the identification information of each terminal and specifies the terminal 3, whereby the login information (user ID and password) of the terminal is sent to each terminal 3. ) Is transmitted (step S13). The transmission / reception means 13 of the terminal 3 passes the login information to the encryption / decryption processing means 14 (step S14), and the encryption / decryption processing means 14 is stored in a storage device (not shown) of the terminal 3 The login information is decrypted with the decryption key (step S15), and the login processing means 15 performs a login process based on the decrypted login information (step S16) and ends the process. In this way, login processing to a plurality of terminals is performed by the processing illustrated in FIGS.

  In addition, although the authentication information is encrypted with the encryption key unique to the terminal 2 in step S2 and the authentication information encrypted with the decryption key unique to the terminal 2 is decrypted in step S5, the authentication server 1 and the terminal are shown. 2, the common key of the terminal 2 can be stored, and encryption and decryption processing can be performed using this common key. Further, it may be configured such that data concealment is left to the encryption process on the network, and the encryption process in step S2 and the decryption process in step S5 are not performed. It is also possible to replace the series of user authentication processes shown in steps S2 to S5 with a user authentication system using a PKI (Public Key Infrastructure) system.

  Next, the flow of logout processing will be described with reference to FIGS. When an event indicating that the authentication medium is disconnected occurs and the authentication medium reading unit 11 detects the event, the event is transferred to the lock processing unit 10 and the transmission / reception unit 7 (step S21). 6, the transmission / reception means 7 transmits a lock event to the transmission / reception means 13 of the terminal 3 (step S31). The transmission / reception means 13 of the terminal 3 transmits the received event to the lock processing means 16. (Step S32), the lock processing means 16 performs logout or lock processing of the terminal 3 (Step S33), and ends the processing. Further, after step S21, the lock processing means 10 of the terminal 2 performs logout or lock processing of the terminal 2 (step S22), and the processing on the terminal 2 side ends. The lock process is to invalidate an input without accepting an input from an input device such as a keyboard or a mouse. In the processing of step S22 and step S33, the description of logout or lock processing means that either can be selected during system design.

  Further, in the process shown in FIG. 5, an “event indicating that the authentication medium has been removed” is detected by a detection means (not shown) that detects the attachment / detachment state of the authentication device (not shown). It is generated by either detecting that the authentication medium is removed or by detecting whether the authentication medium is inserted periodically and detecting that the authentication medium is removed during the periodic monitoring.

  Further, in order to release the input lock state, the user starts again from the process of reading the authentication medium, but the flow of the lock release process is almost the same as the process shown in FIGS. Thus, when the input lock is released as a result of the verification of the authentication information, the lock release processing is performed in steps S10 and S16.

  As described above, according to the present embodiment, it is possible to log in and lock a plurality of terminals by attaching and detaching a user-specific authentication medium. Can be simultaneously performed.

  Also, login information is centrally managed in the authentication information file 4 of the authentication server 1, and after authentication, the login information is made clear to the user by performing login processing of each terminal automatically (without user input operation). In other words, an effect of increasing security related to terminal login is obtained. Further, by encrypting the login information with the terminal-specific encryption key and decrypting with the terminal-specific decryption key on the terminal side, it is possible to prevent the key information from leaking to the user and others all at once.

  In each of the above embodiments, the multi-terminal user authentication system (authentication server 1, terminal 2, terminal 3) can be realized by a computer. Although not shown, each device includes a CPU (Central Processing Unit) that executes a program.

  For example, a CPU is connected to a ROM (Read Only Memory), a RAM (Random Access Memory), a communication board, a display device, a K / B (keyboard), a mouse, an FDD (Flexible Disk Drive), and a CDD (Compact Disc) via a bus. Drive), magnetic disk device, optical disk device, printer device, scanner device and the like.

  The RAM is an example of a volatile memory. ROM, FDD, CDD, magnetic disk device, and optical disk device are examples of nonvolatile memory. These are examples of a storage device or a storage unit.

  Data and information handled by each device of the above-described embodiment are stored in a storage device or a storage unit, and are recorded and read by each unit of the device.

  The communication board is connected to a WAN (Wide Area Network) such as a LAN, the Internet, or ISDN. The magnetic disk device stores an operating system (OS), a window system, a program group, and a file group (database).

  The program group is executed by a CPU, OS, and window system.

  Each part of each of the above devices may be configured by a program that can be operated by a computer partially or entirely. Alternatively, it may be realized by firmware stored in the ROM. Alternatively, it may be implemented by software, hardware, or a combination of software, hardware, and firmware.

  The program group stores a program that causes the CPU to execute the processing described as “to means” in the description of the embodiment. These programs are created by computer languages, such as C language, HTML, SGML, and XML, for example.

  The program is stored in another recording medium such as a magnetic disk device, FD (Flexible Disk), optical disk, CD (compact disk), MD (mini disk), DVD (Digital Versatile Disk), and read by the CPU. And executed.

1 is a system configuration diagram according to Embodiment 1. FIG. FIG. 3 is a system configuration diagram according to the first embodiment and shows the configuration of each device in detail. 4 is a flowchart illustrating a flow of a multi-terminal login process in the first embodiment. 4 is a flowchart illustrating a flow of a multi-terminal login process in the first embodiment. 4 is a flowchart illustrating a flow of a multi-terminal logout process in the first embodiment. 4 is a flowchart illustrating a flow of a multi-terminal logout process in the first embodiment. 4 is a diagram showing a configuration of an authentication information file 4. FIG.

Explanation of symbols

  1 authentication server, 2 terminal (first terminal), 3 terminal (second terminal), 4 authentication information file, 5 authentication means, 6 transmission / reception means, 7 transmission / reception means, 10 lock processing means, 11 authentication medium reading means, 12 authentication medium, 16 lock processing means.

Claims (5)

A multi-terminal user authentication system that includes a network-connected authentication server that permits terminal login and a first terminal,
In order to determine whether or not to allow login of the first terminal and the second terminal connected to the network, the identification information of the first terminal that permits login is associated with the authentication information of the authentication medium, the user's An identification information, an encryption key unique to the first terminal, an identification information of the second terminal that permits login, an identification information of the user, an authentication information file storing the encryption key unique to the second terminal;
Transmitting / receiving means for receiving authentication information and authentication request information from a first terminal connected to the network;
Search the authentication information file using the authentication information received by the transmission / reception means as a key, specify the corresponding authentication information, and then encrypt the identification information of the user with the encryption key associated with the specified authentication information Authentication means for
The transmission / reception means accepts authentication request information from the first terminal, and then, when permitting the authentication request, the identification information of the first terminal specified by the authentication means, the encryption associated with the first terminal Characterized by transmitting the encrypted user identification information, the second terminal identification information, and the encrypted user identification information associated with the second terminal to the first terminal. Authentication server,
Authentication medium reading means for acquiring user authentication information from the authentication medium;
The authentication information read by the authentication medium reading means and the authentication request information are transmitted to the authentication server, the terminal identification information and the encrypted user identification information are received from the authentication server, and the terminal identification A multi-terminal user authentication system comprising: a first terminal including information and a transmission / reception unit that transmits encrypted user identification information to a corresponding second terminal. An authentication server that permits login of a first terminal and a second terminal connected to a network,
In association with the authentication information of the authentication medium, the identification information of the first terminal that permits login, the identification information of the user, the encryption key unique to the first terminal, the identification information of the second terminal that permits login, Identification information, an authentication information file storing the encryption key unique to the second terminal,
Transmitting / receiving means for receiving authentication information and authentication request information from a first terminal connected to the network;
Search the authentication information file using the authentication information received by the transmission / reception means as a key, specify the corresponding authentication information, and then encrypt the identification information of the user with the encryption key associated with the specified authentication information Authentication means for
The transmission / reception means accepts authentication request information from the first terminal, and then, when permitting the authentication request, the identification information of the first terminal specified by the authentication means, the encryption associated with the first terminal Characterized by transmitting the encrypted user identification information, the second terminal identification information, and the encrypted user identification information associated with the second terminal to the first terminal. Authentication server. An authentication integrated terminal connected to an authentication server that permits terminal login,
Authentication medium reading means for acquiring user authentication information from the authentication medium;
The authentication information read by the authentication medium reading means and the authentication request information are transmitted to the authentication server, the terminal identification information and the encrypted user identification information are received from the authentication server, and the terminal identification An authentication integrated terminal comprising: information transmitting and receiving means for transmitting information and encrypted user identification information to a corresponding terminal. The corresponding terminal is identified from the terminal identification information received by the transmission / reception means, and then the designation of the terminal to which the user logs in is accepted, and the encrypted user identification information is sent to the terminal designated by the user. The authentication integrated terminal according to claim 3, wherein the authentication integrated terminal is transmitted. A lock processing means for receiving the information from the authentication medium reading means and locking the control of the terminal after the authentication medium reading means receives the information indicating that the authentication medium is removed from the authentication device;
Further, the transmitting / receiving means receives the information indicating that the authentication medium has been removed from the authentication device, and then receives the information from the authentication medium reading means and transmits the terminal lock information to the corresponding terminal. The authentication integrated terminal according to claim 3 or 4, characterized in that:

Images