JP2008287542A - Terminal authentication system, terminal authentication method, program and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To authenticate a regular user in a short time without using special authentication information. <P>SOLUTION: By forming a virtual map on a communication network 10 and measuring a propagation time of a connection request command from a server 12a, 12b, 12c side or a client 11 side, it is authenticated whether the client 11 performing a request for access or a request for service is the previously registered client 11 or not. A position on the virtual map is specified by a virtual distance between the plurality of servers 12a, 12b, 12c and the client 11, and it is authenticated whether the client 11 is the client 11 from the previously specified position or not. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an authentication method for a communication network including a server and a client, and more particularly to a terminal authentication system, a terminal authentication method, a program, and a recording medium.

  In a service that distributes content such as video, still images, and music via a communication network, a technique has been proposed for confirming whether an individual or terminal that desires content distribution is a legitimate user (for example, Patent Documents 1 to 3).

The user's location information is accumulated in the accessed terminal, and authentication is performed by the accessed terminal collating the location information acquired by the user with the satellite positioning system. In this method, it is essential to receive radio signals from a plurality of satellites in order to obtain an accurate position. Even in outdoor reception, reception is hindered in the shadows of high-rise buildings in the city center, and the position accuracy decreases. Furthermore, in the basement and indoors, radio wave reception was completely interrupted, and location information could not be obtained.
JP 2007-4243 A JP 2006-108834 A JP 2006-252016 A

  As described above, conventionally, since it is necessary to acquire authentication information for identifying a user from the outside such as a satellite and transmit / receive the authentication information, it takes time until the authentication is received. In some cases, even legitimate users could not be authenticated because they could not be acquired.

  An object of this invention is to authenticate a regular user in a short time without using special authentication information.

  In order to achieve the above object, the present invention is characterized in that an authorized user is authenticated by using a temporal positional relationship on a communication network between a client and a server. Since a transfer delay time that is always generated when communication between the client and the server is used, a legitimate user can be authenticated in a short time without using special authentication information.

  Specifically, the terminal authentication system according to the present invention is a terminal authentication system in which a server is connected to a client through a communication network, and the server stores a round-trip transfer delay time to the client in advance. Authentication information storage means, round trip transfer delay time acquisition means for acquiring round trip transfer delay time to the client, and round trip transfer delay time acquired by the round trip transfer delay time acquisition means are stored in the authentication information storage means. Authentication information collating means for collating with the existing round-trip transfer delay time.

  Since the transfer delay time between the server and the client is used for the authentication information, the authorized user can be authenticated in a short time without using special authentication information. Furthermore, since the server acquires the round-trip transfer time to the same client, the accuracy of authentication can be improved.

  In the terminal authentication system according to the present invention, each of the servers acquires a round-trip transfer delay time to the client at a predetermined timing, and acquires a round-trip transfer delay time stored in the authentication information storage unit. It is preferable to further include an authentication information updating unit that updates the round-trip transfer delay time. By updating the verification destination of the authentication information verification unit to the latest information, it is possible to prevent impersonation of a third party.

  In the terminal authentication system according to the present invention, the round-trip transfer delay time acquisition unit acquires the round-trip transfer delay time to the client a plurality of times, and the authentication information verification unit acquires the round-trip transfer delay time acquisition unit. It is preferable that an average value of the transfer delay time is calculated, and the average value is collated with the round-trip transfer delay time stored in the authentication information storage unit. By calculating the average value of the round-trip transfer delay time, it is possible to determine that the client is a registered client even if a connection between the client and the server is established through a route different from the route at the time of registration. .

  In the terminal authentication system according to the present invention, the authentication information verification unit further calculates a variance of the round-trip transfer delay time acquired by the round-trip transfer delay time acquisition unit, and sets the variance range centered on the average value. It is preferable to collate with the round-trip transfer delay time stored in the authentication information storage means. The accuracy of authentication can be increased.

  Specifically, the terminal authentication system according to the present invention is a terminal authentication system in which two or more servers are connected to a client through a communication network, and each of the servers has a round-trip transfer delay time to the client. A round-trip transfer delay time acquisition means for acquiring, and an authentication information transmission means for transmitting the round-trip transfer delay time acquired by the round-trip transfer delay time acquisition means to a predetermined authentication server of the servers, The authentication server includes a round-trip transfer delay time receiving means for receiving a round-trip transfer delay time transmitted by the authentication information transmitting means, a virtual position on the communication network of the server and the client connected to the communication network. Are received by the authentication information storage means for storing each server and the round trip transfer delay time receiving means. When the authentication information storage means stores the reverse transfer delay time for each server and the round-trip transfer delay time stored in the authentication information storage means becomes two or more, the authentication information storage means is referred to The server position stored in the authentication information storage unit is extracted, and the client position stored in the authentication information storage unit is calculated from the extracted position and the round-trip transfer delay time, and stored in the authentication information storage unit. Authentication information collating means for collating with a stored position.

  A virtual location on the communication network is used. A virtual position on the communication network can be specified by the position of the server and the transfer delay time. By acquiring the transfer delay time and storing this position in the authentication information storage means in advance, the authentication information collating means identifies the virtual position on the communication network of the client, and the client registered in advance It can be determined whether or not. As described above, since the position of the client mapped on the virtual map formed on the communication network is used as the authentication information, the authorized user can be authenticated in a short time without using special authentication information. .

  In the terminal authentication system according to the present invention, each of the servers further includes a latest transfer delay time acquisition unit that acquires a round-trip transfer delay time to the client at a predetermined timing, and a latest transfer delay time acquisition unit. Latest transfer delay time transmission means for transmitting the acquired round-trip transfer delay time to the authentication server, and the authentication server further includes the round-trip transfer delay time transmitted by the latest transfer delay time transmission means, Authentication for calculating the position of the client using the position of the server stored in the authentication information storage means, and updating the position of the client stored in the authentication information storage means to the calculated client position It is preferable to provide information updating means. By updating the verification destination of the authentication information verification unit to the latest information, it is possible to prevent impersonation of a third party.

  In the terminal authentication system according to the present invention, the round trip transfer delay time acquisition unit acquires the round trip transfer delay time to the client a plurality of times, calculates an average value of the acquired round trip transfer delay times, and the authentication information transmission unit Preferably, the average value calculated by the round-trip transfer delay time acquisition unit is transmitted as a round-trip transfer delay time to a predetermined authentication server among the servers. By calculating the average value of the round-trip transfer delay time, it is possible to determine that the client is a registered client even if a connection between the client and the server is established through a route different from the route at the time of registration. .

  In the terminal authentication system according to the present invention, when the client further receives a transfer delay time measurement instruction transmitted from the round trip transfer delay time acquisition unit, a client response signal that transmits a response signal to the round trip transfer delay time acquisition unit The round-trip transfer delay time acquiring means further transmits a transfer delay time measurement instruction for instructing measurement of the transfer delay time to the client, and receives a response signal transmitted from the client response signal transmitting means. It is preferable to measure the time from when the transmission delay time measurement instruction is transmitted until the response signal is received. Since the round trip time from when the client sends the transmission delay time measurement instruction to when the response signal is received is measured, even if the absolute time is not guaranteed between the client and the server, the clock error between the client and the server Are offset, and the accuracy as authentication information is not impaired.

  In the terminal authentication system according to the present invention, the client receives a client measurement instruction transmission means for transmitting a transfer delay time measurement instruction for instructing measurement of a transfer delay time to the server, and a response signal transmitted by the server, Client authentication information transmitting means for measuring a time from when the client measurement instruction transmitting means transmits a transfer delay time measurement instruction until receiving a response signal, and transmitting the measured time to the server as a transfer delay time; The round trip transfer delay time acquisition unit further transmits a response signal to the client measurement instruction transmission unit upon receiving the transfer delay time measurement instruction transmitted from the client measurement instruction transmission unit, and transmits the client authentication information. It is preferable to receive the transfer delay time transmitted by the means. Since the server measures the round-trip time from when the transmission delay time measurement instruction is sent until the response signal is received, even if the absolute time is not guaranteed between the client and the server, the clock error between the client and the server Are offset, and the accuracy as authentication information is not impaired.

  In the terminal authentication system according to the present invention, it is preferable that the transfer delay time measurement instruction and the response signal include a TCP layer time stamp. By using the time stamp of the TCP layer, the round-trip transfer delay time can be measured when the TCP connection is established.

  The terminal authentication method according to the present invention is a terminal authentication method used in a terminal authentication system in which a server is connected to a client via a communication network, wherein the server acquires a round-trip transfer delay time to the client. A delay time acquisition step, and each of the servers stores the round trip transfer delay time acquired in the round trip transfer delay time acquisition step in an authentication information storage means in which the round trip transfer delay time to the client is stored in advance. Authentication information collating step for collating with the round-trip transfer delay time.

  Since the transfer delay time between the server and the client is used for the authentication information, the authorized user can be authenticated in a short time without using special authentication information. Furthermore, since the server acquires the round-trip transfer time to the same client, the accuracy of authentication can be improved.

  The terminal authentication method according to the present invention is a terminal authentication method used in a terminal authentication system in which two or more servers are connected to a client via a communication network, and a predetermined authentication server among the servers includes: A round-trip transfer delay time reception step for receiving a round-trip transfer delay time to the client acquired by each of the servers, and a round-trip transfer delay time received in the round-trip transfer delay time reception step, the authentication information transmitting means Authentication information storage step for storing each server, and communication between the server and the client connected in the communication network when two or more round-trip transfer delay times stored in the authentication information storage means Authentication information storage means in which a virtual position on the network is stored for each server The location of each server stored in the authentication information storage step is extracted with reference to the authentication information, and the location of the client stored in the authentication information storage means is calculated from the extracted location and the round-trip transfer delay time, and the authentication is performed. And an authentication information collating step for collating with a position stored in the information storage means.

  A virtual location on the communication network is used. A virtual position on the communication network can be specified by the position of the server and the transfer delay time. By acquiring the transfer delay time and storing this position in the authentication information storage means in advance, the authentication information collating means identifies the virtual position on the communication network of the client, and the client registered in advance It can be determined whether or not. As described above, since the position of the client mapped on the virtual map formed on the communication network is used as the authentication information, the authorized user can be authenticated in a short time without using special authentication information. .

  The terminal authentication program according to the present invention is a terminal authentication program for causing a computer to execute the terminal authentication method according to the present invention. By causing the computer to execute the terminal authentication program, the authorized user can be authenticated in a short time without using special authentication information.

  The storage medium according to the present invention is a computer-readable storage medium that records the terminal authentication program according to the present invention. By causing the computer to read the terminal authentication program and causing the computer to execute the program, the authorized user can be authenticated in a short time without using special authentication information.

  According to the present invention, since a client can be authenticated from anywhere as long as a communication network between the server and the client can be secured, an authorized user can be authenticated in a short time without using special authentication information.

Embodiments of the present invention will be described with reference to the accompanying drawings. The embodiment described below is an example of the configuration of the present invention, and the present invention is not limited to the following embodiment.
(Embodiment 1)
FIG. 1 is a schematic configuration diagram of a terminal authentication system according to the first embodiment. In the terminal authentication system shown in FIG. 1, servers 12 a, 12 b, and 12 c are connected to a client 11 through a communication network 10. In the present embodiment, only the client 11 is shown, but the number of clients is not limited to this. For example, it may be two or more. Moreover, although only three servers 12a, 12b, and 12c are shown in the present embodiment, the number may be two or less, or may be four or more.

  The communication network 10 is a communication network that connects the client 11 and a plurality of servers 12a, 12b, and 12c. The communication network 10 may be either a wide area network or a private network, may be wired or wireless, and may be either a public line or a dedicated line. In the present embodiment, as an example of the communication network 10, only some routers 13a, 13b, and 13c constituting the communication network 10 are shown, and others are omitted.

  The routers 13a, 13b, and 13c transfer information transmitted from the client 11 to the server 12a, 12b, or 12c. Conventionally, the processing capability of each of the routers 13a, 13b, and 13c has been low, so that the routers that pass through when sending and receiving between the client 11 and a specific server, for example, the server 12a, are often different. However, as the processing speed of routers has increased, the routers that pass through have been automatically determined. For example, when the client 11 and the server 12a transmit and receive, there is a high probability that the router 13a and the router 13b transfer information and a low probability that the information passes through the router 13c.

  The client 11 is a terminal that acquires information from the server 12 a via the communication network 10. The client 11 is a terminal that is permitted to provide information from the servers 12a, 12b, and 12c and that has completed registration in the servers 12a, 12b, and 12c. The client 11 may be a fixed terminal or a wireless terminal.

  The servers 12a, 12b, and 12c store authentication information with the client 11, and provide services to the client 11 when verification with the authentication information is established. In the present embodiment, all of the servers 12a, 12b, and 12c have a function of collating the client 11, but as an example, a case where the server 12a authenticates the client 11 will be described.

  FIG. 2 is a schematic configuration diagram illustrating an example of functions of the server. The server 12a includes an authentication information storage unit 21, a round-trip transfer delay time acquisition unit 22, and an authentication information verification unit 23. It is preferable that the server 12a further includes an authentication information update unit 34. In FIG. 2, the communication network (reference numeral 10 in FIG. 1) connecting the server 12a and the client 11 is omitted.

  The terminal authentication method according to the present embodiment is a terminal authentication method used in the terminal authentication system according to the present embodiment, and includes a round trip transfer delay time acquisition step for causing the terminal authentication system to function as the round trip transfer delay time acquisition unit 22; An authentication information verification step for causing the authentication information verification unit 23 to function. The terminal authentication method preferably further includes a latest transfer delay time update step for functioning as the authentication information update means 34 before the round-trip transfer delay time acquisition step. The terminal authentication program according to the present embodiment is a terminal authentication program for causing a computer to execute the terminal authentication method according to the present embodiment. The terminal authentication program may be recorded on a computer-readable storage medium.

  The authentication information storage unit 21 stores a round-trip transfer delay time to the client 11 in advance. When starting the information providing service to the client 11, the server 12 a acquires the transfer delay time to the client 11 and stores it in the authentication information storage unit 21. In this embodiment, the number of clients 11 is one, but in the case of two or more, the authentication information storage means 21 stores the transfer delay time with each client 11. When the server 12a further includes the authentication information update unit 34, the transfer delay time stored in the authentication information storage unit 21 is updated to the latest information.

  The round trip transfer delay time acquisition unit 22 acquires the round trip transfer delay time to the client 11 through the same route as the authentication information update unit 34. For example, when there is an access from the client 11 to the server 12 a, the round trip transfer delay time acquisition unit 22 acquires the round trip transfer delay time of the client 11. Here, the round-trip transfer delay time is the time acquired by the server 12a or the time acquired by the client 11. When the connection from the client 11 to the server 12a is set, the round trip transfer delay time acquisition unit 22 acquires the round trip transfer delay time.

  Furthermore, it is preferable that the round trip transfer delay time acquisition unit 22 acquires the round trip transfer delay time to the client 11 a plurality of times. Furthermore, it is preferable that the round-trip transfer delay time acquisition unit 22 calculates an average value of the acquired round-trip transfer delay times. By calculating the average value of the round-trip transfer delay time, even when the connection between the client 11 and the server is established through a route different from the route at the time of registration, the authentication information matching unit 23 performs the registered client 11 Can be determined.

  FIG. 3 is a sequence diagram showing a first example of a method for measuring the round-trip transfer delay time. In the first example of the method for measuring the round-trip transfer delay time, the client 11 includes client response signal transmission means. An example of a 3-way handshake in normal TCP connection establishment will be described. The client 11 transmits SYN (connection request) to the server 12a.

  Upon receiving SYN from the client 11, the server 12 a round-trip transfer delay time acquisition means transmits a transfer delay time measurement instruction for instructing measurement of the transfer delay time to the client 11. The transfer delay time measurement instruction for instructing measurement of the transfer delay time is, for example, ACK (acknowledgment) to SYN from the client 11. In this case, the round-trip transfer delay time acquisition unit of the server 12a transmits an ACK (acknowledgment) to the SYN from the client 11 and the SYN from the server 12a to the client 11.

  When the client response signal transmission unit of the client 11 receives the transfer delay time measurement instruction transmitted from the round trip transfer delay time acquisition unit of the server 12a, the client response signal transmission unit transmits a response signal to the round trip transfer delay time acquisition unit of the server 12a. For example, the client response signal transmission unit of the client 11 receives the ACK from the server 12a and transmits the ACK for SYN from the server 12a to the round-trip transfer delay time acquisition unit of the server 12a.

  The round-trip transfer delay time acquisition unit of the server 12a receives the response signal transmitted from the client response signal transmission unit. For example, the round-trip transfer delay time acquisition unit of the server 12a receives ACK from the client 11. Then, the time from when the transfer delay time measurement instruction is transmitted until the response signal is received is measured. Since the round trip time from when the client 11 transmits the transfer delay time measurement instruction to when the response signal is received is measured, even if the absolute time is not guaranteed between the client 11 and the server, the client 11 and the server The error of the clock cancels out, and the accuracy as authentication information is not impaired.

  FIG. 4 is a sequence diagram showing a second example of a method for measuring the round-trip transfer delay time. In the second example of the method for measuring the round-trip transfer delay time, the client 11 includes client measurement instruction transmission means and client authentication information transmission means. The second example of the method for measuring the round-trip transfer delay time shows an example of a 3-way handshake in establishing a TCP connection including time information.

  The client measurement instruction transmission means of the client 11 transmits a transfer delay time measurement instruction for instructing measurement of the transfer delay time to the server. For example, the client 11 transmits SYN and Time1 (time) to the server.

  When the round trip transfer delay time acquisition unit of the server 12a receives the transfer delay time measurement instruction transmitted from the client measurement instruction transmission unit, the round trip transfer delay time acquisition unit transmits a response signal to the client measurement instruction transmission unit. For example, the server 12a transmits an ACK for SYN and Time1 from the client 11, a SYN and Time2 (time) from the server 12a to the client 11.

  The client authentication information transmitting unit of the client 11 receives the response signal transmitted from the server, and measures and measures the time from when the client measurement instruction transmitting unit transmits the transfer delay time measurement instruction until the response signal is received. The time is transmitted to the server as the transfer delay time. For example, the client 11 receives ACK and Time2 from the server 12a. By receiving the ACK, the client 11 establishes a connection from the client 11 to the server 12a. Then, an ACK for SYN from the server 12a and Time3 (time) are transmitted to the server 12a.

  The round trip transfer delay time acquisition unit of the server 12a receives the transfer delay time transmitted by the client authentication information transmission unit. For example, the server 12a receives ACK and Time3 from the client 11. Note that Time1, Time2, and Time3 are time stamps when, for example, SYN is transmitted or received. The server 12a can measure the transmission time between the server 12a and the client 11 by acquiring Time1, Time2, and Time3. Since the round trip time from when the server transmits the transfer delay time measurement instruction to when the response signal is received is measured, even if the absolute time is not guaranteed between the client 11 and the server, the clocks of the client 11 and the server The accuracy of authentication information is not impaired.

  Here, in the first and second examples of the method for measuring the round trip transfer delay time described with reference to FIGS. 3 and 4, it is preferable that the transfer delay time measurement instruction and the response signal include a time stamp of the TCP layer. In the conventional measurement of transmission time, the transmission time is measured by sending a measurement packet and receiving the packet. In this case, if the measurement frequency is increased, the traffic of the measurement packet may not be ignored due to the line capacity. In this embodiment, a transmission time measurement function can be embedded in a protocol used in a TCP / IP operation indispensable on a general Internet. With almost no change to this protocol, time information is embedded in the packet as shown in FIG. 4, so that the transmission time measurement of the TCP connection and the time measurement from the client 11 are completed simultaneously when one TCP connection is established. be able to. By using the time stamp of the TCP layer, the round-trip transfer delay time can be measured when the TCP connection is established.

  The authentication information collating unit 23 shown in FIG. 2 collates the round trip transfer delay time acquired by the round trip transfer delay time acquiring unit 22 with the round trip transfer delay time stored in the authentication information storage unit 21. Since the round-trip transfer delay time changes according to the communication environment of the communication network, the authentication information collating unit 23 determines an error range in advance for each communication environment of the communication network 10 and is within the error range. Perform verification. In order to increase the accuracy of authentication, it is preferable that the authentication information collating unit 23 measures the round-trip transfer delay time a plurality of times to obtain an average value, and collates the average value. Further, the authentication information collating unit 23 calculates the variance of the round trip transfer delay time acquired by the round trip transfer delay time acquiring unit 22, and the range of the variance centering on the average value is stored in the authentication information storage unit 21. It is preferable to check with the round-trip transfer delay time. Since the transfer delay time is used as authentication information, the authorized user can be authenticated in a short time without using special authentication information. Furthermore, since the server measures the round-trip transfer time to the same client 11, the accuracy of authentication can be improved.

  The authentication information update unit 34 shown in FIG. 2 acquires the round trip transfer delay time to the client 11 at a predetermined timing, and uses the round trip transfer delay time stored in the authentication information storage unit 21 as the acquired round trip transfer delay. Update on time. Depending on the situation of the communication network 10, the transfer destinations of the routers 13a and 13b may change. In this case, the authentication information update unit 34 updates the transfer delay time stored in the authentication information storage unit 21 to the latest one, so that the accuracy of the authentication information verification unit 23 can be increased. Thereby, the impersonation of the third party can be prevented.

(Embodiment 2)
The terminal authentication system according to the present embodiment includes three or more servers 12a, 12b, and 12c in the terminal authentication system shown in FIG. 1, and at least one of these servers 12b is predetermined as an authentication server. Here, the number of authentication servers is not limited to one and may be two or more. For example, the authentication server may be defined for each group including a plurality of servers.

  FIG. 5 is a schematic configuration diagram illustrating an example of functions of the server. In the present embodiment, the server 12 a includes a round-trip transfer delay time acquisition unit 22 and an authentication information transmission unit 24. The authentication server 12b includes an authentication information storage unit 25, a round-trip transfer delay time reception unit 26, an authentication information storage unit 27, and an authentication information collating unit 28. Here, the authentication server 12b has the same configuration as the server 12a such as the round-trip transfer delay time acquisition unit 22 and the authentication information transmission unit 24, but is omitted in FIG. 5 for simplicity. With these configurations, the terminal authentication system according to the present embodiment authenticates the client 11 based on the round-trip transfer delay time acquired by the servers 12a, 12b, and 12c. In FIG. 5, the communication network (reference numeral 10 in FIG. 1) connecting the server 12a and the client 11 is omitted.

  Furthermore, the server 12a preferably further includes a latest transfer delay time acquisition unit 35 and a latest transfer delay time transmission unit 36. In this case, it is preferable that the authentication server 12b further includes an authentication information update unit 37. By further providing these configurations, the terminal authentication system can prevent spoofing of a third party by updating the verification destination of the authentication information verification unit 28 to the latest information.

  The terminal authentication method according to the present embodiment is caused to function as the terminal authentication system according to the present embodiment. The terminal authentication program according to the present embodiment is a terminal authentication program for causing a computer to execute the terminal authentication method according to the present embodiment. The terminal authentication program may be stored in a computer-readable storage medium. The terminal authentication method according to the present embodiment includes, for example, an authentication information storage step for functioning as the authentication information storage unit 25, a round-trip transfer delay time acquisition step for functioning as the round-trip transfer delay time acquisition unit 22, and authentication information An authentication information transmission step for functioning as the transmission means 24, a round-trip transfer delay time reception step for functioning as the round-trip transfer delay time reception means 26, and an authentication information storage step for functioning as the authentication information storage means 27; An authentication information verification step for causing the authentication information verification unit 28 to function and a round-trip transfer delay time acquisition step for functioning as the round-trip transfer delay time acquisition unit 22 are sequentially provided.

  Further, the terminal authentication method includes a latest transfer delay time acquisition step for causing the latest transfer delay time acquisition means 35 to function, a latest transfer delay time transmission step for causing the latest transfer delay time transmission means 36 to function, and an authentication information update. It is preferable to have an authentication information update step for functioning as the means 37 before the round trip transfer delay time acquisition step.

  When the client 11 accesses the server 12a, the round-trip transfer delay time acquisition unit 22 of the server 12a acquires the round-trip transfer delay time of the client 11. Here, the round-trip transfer delay time is the time acquired by the server 12a or the time acquired by the client 11. When the connection from the client 11 to the server 12a is set, the round trip transfer delay time acquisition unit 22 acquires the round trip transfer delay time. Then, the authentication information transmission unit 24 transmits the round trip transfer delay time acquired by the round trip transfer delay time acquisition unit 22 to a predetermined authentication server 12b among the servers 12a, 12b, and 12c.

  When the client 11 accesses the server 12a, the server 12a also acquires the round-trip transfer delay time of the client 11 by the authentication server 12b and the round-trip transfer delay time acquisition unit 22 of the server 12c. Then, each of the servers 12a, 12b, and 12c transmits the acquired round-trip transfer delay time to the authentication server 12b. Note that the notification to the other servers 12b and 12c that the client 11 has accessed the server 12a may be sent directly from the server 12a to the authentication server 12b. After the notification, the authentication server 12b may notify the server 12c.

  On the other hand, the authentication information storage means 25 of the authentication server 12b is stored in advance for each server connected to the communication network in the round-trip transfer delay time to the client 11. For example, the authentication information storage unit 25 stores a round trip transfer delay time from the server 12a to the client 11, a round trip transfer delay time from the server 12b to the client 11, and a round trip transfer delay time from the server 12c to the client 11. is doing. The stored contents are the same as the authentication information storage unit 21 of the first embodiment, when each server 12a, 12b, 12c acquires the transfer delay time to the client 11 when starting the information providing service to the client 11. It is a thing.

  The round-trip transfer delay time receiving unit 26 of the authentication server 12b receives the round-trip transfer delay time transmitted by the authentication information transmitting unit 24. The authentication information storage unit 27 of the authentication server 12b stores the round-trip transfer delay time received by the round-trip transfer delay time reception unit 26 for each of the servers 12a, 12b, and 12c including the authentication information transmission unit 24. For example, the round-trip transfer delay time transmitted from the server 12a is stored in association with the identification information of the server 12a.

  The authentication information verification unit 28 of the authentication server 12b refers to the authentication information storage unit 25 and stores the authentication information storage unit 27 when the round trip transfer delay time stored in the authentication information storage unit 27 becomes three or more. The round-trip transfer delay time of the running server is extracted, and the variance of the extracted round-trip transfer delay time is calculated. For example, when accumulating the round trip transfer delay times of the servers 12a, 12b, and 12c, the authentication information collating unit 28 refers to the authentication information storage unit 25 and extracts the round trip transfer delay times of the servers 12a, 12b, and 12c. The authentication information collating unit 28 calculates the variance of the round trip transfer delay time accumulated in the authentication information accumulating unit 27. Then, the authentication information matching unit 28 determines that the difference between the two calculated variances is within a certain range.

  If the variation in round-trip transfer delay time between each server 12a, 12b, 12c and the client 11 is within a certain range of variation in round-trip transfer delay time between the client registered in advance, each server 12a, 12b, 12c. It is possible to determine that the relative positional relationship between the client 11 and the client 11 is within a certain range. Since the transfer delay time is used as authentication information, the authorized user can be authenticated in a short time without using special authentication information. Furthermore, since it is determined whether or not the client 11 is registered in advance based on the distribution of the round-trip transfer time acquired by the server, the accuracy of authentication can be improved.

The latest transfer delay time acquisition unit 35 of the server 12a acquires the round-trip transfer delay time to the client 11 at a predetermined timing. The latest transfer delay time transmission unit 36 of the server 12a transmits the round-trip transfer delay time acquired by the latest transfer delay time acquisition unit 34 to the authentication server 12b. The round trip transfer delay time receiving unit 26 of the authentication server 12b receives the round trip transfer delay time transmitted by the latest transfer delay time transmitting unit 36 of the server 12a. The authentication information update unit 37 of the authentication server 12b acquires the round-trip transfer delay time transmitted by the latest transfer delay time transmission unit 36 and received by the round-trip transfer delay time reception unit 26, and is stored in the authentication information storage unit 25. The existing round trip transfer delay time is updated to the round trip transfer delay time transmitted by the latest transfer delay time transmitting means 36.
(Embodiment 3)

  Although the terminal authentication system shown in FIG. 5 requires three or more servers 12a, 12b, and 12c, the terminal authentication system according to the present embodiment requires two or more servers 12a, 12b, and 12c. Further, the terminal authentication system, the authentication information storage unit 25, the authentication information collating unit 28, and the authentication information updating unit 37 shown in FIG.

  FIG. 6 is an explanatory diagram of the terminal authentication system according to the present embodiment. In the system shown in FIG. 1, when the round-trip transfer delay time from the plurality of servers 12a, 12b, 12c to the client 11 is measured, the virtual position on the communication network 10 is further limited. The terminal authentication system according to the present embodiment is characterized in that this virtual position is used as authentication information.

  In a service that enables a specific function to be used by specifying a communication device, for example, a service that downloads content from a server, it is necessary to provide a service only to authorized users. There is a need to ensure that downloaded content is only used by legitimate users. In such a service, it is necessary to register a device for downloading content, and that the device is used by another unauthorized user (in this embodiment, the content is stored in another location). Is required to be used).

  In the present embodiment, the position of such a user device (client 11) on the communication network is specified at the start of service use, and the data is registered and stored. Thereafter, when the client 11 downloads the content using the service, the client 11 re-calculates the position on the communication network and compares the position at the time of use with the registered position. It can be determined whether or not the user.

  Specifically, in the present embodiment, the server 12 a includes a round-trip transfer delay time acquisition unit 22 and an authentication information transmission unit 24. The authentication server 12b includes an authentication information storage unit 25, a round-trip transfer delay time reception unit 26, an authentication information storage unit 27, and an authentication information collating unit 28. Here, the authentication server 12b includes an authentication information storage unit 21 and an authentication information transmission unit 24, which are omitted in FIG. 5 for simplicity. The round-trip transfer delay time acquisition unit 22 acquires the round-trip transfer delay time to the client 11 through the same route as the latest transfer delay time acquisition unit 35. With these configurations, the terminal authentication system according to the present embodiment enables the client 11 based on the virtual position on the communication network specified by the round-trip transfer delay time acquired by at least two of the servers 12a, 12b, and 12c. Authenticate.

  The round trip transfer delay time acquisition unit 22 preferably acquires the round trip transfer delay time to the client 11 a plurality of times, and calculates the average value of the acquired round trip transfer delay times. In this case, the authentication information transmission unit 24 transmits the average value calculated by the round trip transfer delay time acquisition unit 22 to a predetermined authentication server among the servers 12a, 12b, and 12c as the round trip transfer delay time. By calculating the average value of the round-trip transfer delay time, it is possible to determine that the client is a registered client even if a connection between the client and the server is established through a route different from the route at the time of registration. .

  The terminal authentication method according to the present embodiment is caused to function as the terminal authentication system according to the present embodiment. The terminal authentication program according to the present embodiment is a terminal authentication program for causing a computer to execute the terminal authentication method according to the present embodiment. The terminal authentication program may be stored in a computer-readable storage medium. The terminal authentication method according to the present embodiment includes, for example, an authentication information storage step for functioning as the authentication information storage unit 25, a round-trip transfer delay time acquisition step for functioning as the round-trip transfer delay time acquisition unit 22, and authentication information An authentication information transmission step for functioning as the transmission means 24, a round-trip transfer delay time reception step for functioning as the round-trip transfer delay time reception means 26, and an authentication information storage step for functioning as the authentication information storage means 27; An authentication information verification step for causing the authentication information verification unit 28 to function and a round-trip transfer delay time acquisition step for functioning as the round-trip transfer delay time acquisition unit 22 are sequentially provided.

  Further, the terminal authentication method includes a latest transfer delay time acquisition step for causing the latest transfer delay time acquisition means 35 to function, a latest transfer delay time transmission step for causing the latest transfer delay time transmission means 36 to function, and an authentication information update. It is preferable to have an authentication information update step for functioning as the means 37 before the round trip transfer delay time acquisition step.

  The authentication information storage means 25 of the authentication server 12b stores virtual positions on the communication network of the servers 12a, 12b and 12c and the client 11 connected in the communication network. The virtual position on the communication network is a position specified by the round trip transfer delay time with the client 11 on the virtual map based on the position where the position on the map such as the servers 12a, 12b, and 12c is fixed. is there. The virtual positions of the servers 12a, 12b, and 12c are, for example, positions on the actual map where the servers 12a, 12b, and 12c are arranged. When the virtual position of the client 11 is registered, the round trip transfer delay time from each server 12a, 12b, 12c to the client 11 is measured, and the position specified by the round trip transfer delay time from the server 12a, 12b, 12c 11 positions are registered. The virtual position is, for example, a position on a two-dimensional plane such as latitude and longitude, or a position on a three-dimensional space.

  The authentication information verification unit 28 of the authentication server 12b refers to the authentication information storage unit 25 and stores the authentication information storage unit 27 when the round-trip transfer delay time stored in the authentication information storage unit 27 becomes two or more. The positions of the servers 12a, 12b, and 12c are extracted, and the position of the client 11 stored in the authentication information storage unit 27 is calculated from the extracted position and the round-trip transfer delay time. For example, the authentication information collating unit 28 calculates the distance from the round-trip transfer delay time of the servers 12a, 12b, and 12c, and determines the position of the client 11 from the respective positions of the servers 12a, 12b, and 12c and the calculated distances. Identify. Here, the conversion from the round trip transfer delay time to the distance may be time integration with a constant transfer speed, or may be time integrated with a speed defined by a predetermined function. The authentication information collating unit 28 collates the calculated positions of the servers 12 a, 12 b and 12 c with the position stored in the authentication information storage unit 25. Since the round-trip transfer delay time changes according to the communication environment of the communication network 10, the authentication information collating unit 28 determines an error range in advance for each communication environment of the communication network 10 and is within the error range, for example. Verify with.

  A virtual position on the communication network can be specified by the position of the server and the transfer delay time. By acquiring the transfer delay time and storing this position in the authentication information storage unit 25 in advance, the authentication information collating unit 28 specifies the virtual position of the client 11 on the communication network and is registered in advance. It is possible to determine whether or not the client 11 is active. In this method, as long as a communication network between the server and the client can be secured, the client 11 can be authenticated from anywhere because it can be used outdoors or indoors. Further, special hardware such as a GPS receiver is not necessary, and ordinary software may be installed in the device.

  Furthermore, it is preferable that the servers 12a, 12b, and 12c further include the latest transfer delay time acquisition unit 35 and the latest transfer delay time transmission unit 36. In this case, it is preferable that the authentication server 12b further includes an authentication information update unit 37. By further providing these configurations, the terminal authentication system can prevent spoofing of a third party by updating the reference destination of the authentication information matching unit 28 to the latest information. The authentication information update unit 37 of the authentication server 12b calculates the position of the client 11 using the round-trip transfer delay time transmitted by the latest transfer delay time transmission unit and the server position stored in the authentication information storage unit. The position of the client 11 stored in the authentication information storage unit 25 is updated to the calculated position of the client 11. As a method for calculating the position of the client 11 from the round-trip transfer delay time of the servers 12a, 12b, and 12c, the same method as the authentication information collating unit 28 can be used.

  Basically, the transfer delay time cannot be obtained by one measurement. Since the state of the network changes with time, it is preferable to obtain the transfer delay time from a statistical numerical value. For this reason, a plurality of measurements are required, and since this measurement method (algorithm) is not one type, some examples can be considered.

(Example 1 of transfer delay time measurement method)
A first embodiment of a method for measuring a transfer delay time between the server 12a and the client 11 will be described with reference to FIG. A method in which when the authentication process is executed from the server 12a, the transfer delay is measured a plurality of times and then reflected in the authentication process. In this case, there are a method of measuring the transfer delay from the server and a method of measuring the transfer delay from the client 11 and transferring the result to the server 12a.

(Example 2 of transfer delay time measurement method)
A second embodiment of the method for measuring the transfer delay time between the server 12a and the client 11 will be described. Regardless of the timing at which the authentication process is performed from the server 12a, the transfer delay is measured a plurality of times at a certain time interval, and the result is reflected in the authentication process. For example, the server 12a performs measurement once per hour or once every 10 minutes. In this case, there are a method of measuring the transfer delay from the server 12a and a method of measuring the transfer delay from the client 11 and transferring the result to the server 12a.

(Third embodiment of transfer delay time measurement method)
A third embodiment of the method for measuring the transfer delay time between the server 12a and the client 11 will be described. Regardless of the timing at which the authentication process is performed from the server 12a, the traffic state between the server 12a and the client 11 is measured, and when the traffic is set in advance, the transfer delay is measured one or more times. The result is reflected in the authentication process. For example, the transfer delay is measured when the traffic is below a certain value and the communication network is free. In this case, there are a method of measuring the transfer delay from the server 12a and a method of measuring the transfer delay from the client 11 and transferring the result to the server 12a.

(Example 1 of system authentication)
A first embodiment of transfer delay time measurement and system authentication between the plurality of servers 12a, 12b and 12c and the client 11 will be described. In the first, second, and third embodiments of the transfer delay time measurement method, a plurality of servers 12a, 12b, and 12c sequentially measure the transfer delay time between each of the servers 12a, 12b, and 12c and the client 11 and are necessary for authentication. When the transfer delay time measurement is completed by a large number of servers 12a, 12b, or 12c, the entire system is finally authenticated.

(Example 2 of system authentication)
A second embodiment of the transfer delay time measurement and system authentication between the plurality of servers 12a, 12b and 12c and the client 11 will be described. In the method of measuring the transfer delay based on the third embodiment of the transfer delay time measurement method, the server 12a, 12b or 12c is used more than the number necessary for authentication, and each of the servers 12a, 12b and 12c and the client 11 is used. Are measured sequentially from the server 12a, 12b and 12c in which the traffic has been set in advance, and the transfer delay time between the client 11 and the server 12a, 12b or 12 A method of completing authentication when 12c reaches the number required for authentication.

(Example 3 of system authentication)
A third embodiment of measurement of transfer delay time and system authentication between the plurality of servers 12a, 12b and 12c and the client 11 will be described. The client 11 is authenticated by the same method as in the second embodiment of the transfer delay time measurement method. The difference from the system authentication example 2 is that the server 12a in which the traffic is set in advance while measuring the traffic between each of the servers 12a, 12b and 12c and the client 11 even after the authentication is completed. , 12b and 12c and the transfer delay time between the client 11 and the client 11 are continuously measured. By continuing this process, the client 11 connected to the communication network 10 is always a server 12a, 12b or 12c that is equal to or more than the number of servers required for authentication, and the transfer delay between each of the servers 12a, 12b and 12c and the client 11 is always performed. Time measurement can be performed and always authenticated.

  In a service for downloading content from a server, etc., it can be used for authenticating authorized users to provide services only to authorized users.

1 is a schematic configuration diagram of a terminal authentication system according to Embodiment 1. FIG. It is a schematic block diagram which shows an example of the function of a server. It is a sequence diagram which shows the 1st example of the measuring method of a round-trip transfer delay time. It is a sequence diagram which shows the 2nd example of the measuring method of a round-trip transfer delay time. It is a schematic block diagram which shows an example of the function of a server. It is explanatory drawing of the terminal authentication system which concerns on this embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Communication network 11 Client 12 Server 13 Router 21 Authentication information storage means 22 Round-trip transfer delay time acquisition means 23 Authentication information verification means 24 Authentication information transmission means 25 Authentication information storage means 26 Authentication information reception means 27 Authentication information storage means 28 Authentication information verification Means 34 Authentication information update means 35 Latest transfer delay time acquisition means 36 Latest transfer delay time transmission means 37 Authentication information update means

Claims (14)

A terminal authentication system in which a server is connected to a client via a communication network,
The server
Authentication information storage means in which a round-trip transfer delay time to the client is stored in advance;
Round-trip transfer delay time acquisition means for acquiring a round-trip transfer delay time to the client;
Authentication information collating means for collating the round-trip transfer delay time acquired by the round-trip transfer delay time acquiring means with the round-trip transfer delay time stored in the authentication information storage means;
A terminal authentication system comprising:   Each of the servers acquires a round-trip transfer delay time to the client at a predetermined timing, and updates the round-trip transfer delay time stored in the authentication information storage means to the acquired round-trip transfer delay time. The terminal authentication system according to claim 1, further comprising information updating means. The round trip transfer delay time acquisition means acquires the round trip transfer delay time to the client a plurality of times,
The authentication information collating unit calculates an average value of round-trip transfer delay times acquired by the round-trip transfer delay time acquiring unit, and compares the average value with a round-trip transfer delay time stored in the authentication information storage unit. The terminal authentication system according to claim 1 or 2.   The authentication information collating unit further calculates a variance of the round trip transfer delay time acquired by the round trip transfer delay time acquiring unit, and the range of the variance centered on the average value is stored in the authentication information storage unit. The terminal authentication system according to claim 3, wherein the terminal authentication system is collated with a round-trip transfer delay time. A terminal authentication system in which two or more servers are connected to a client via a communication network,
The servers are respectively
Round-trip transfer delay time acquisition means for acquiring a round-trip transfer delay time to the client;
Authentication information transmission means for transmitting the round-trip transfer delay time acquired by the round-trip transfer delay time acquisition means to a predetermined authentication server of the servers,
The authentication server is:
A round trip transfer delay time receiving means for receiving a round trip transfer delay time transmitted by the authentication information transmitting means;
Authentication information storage means for storing, for each server, a virtual position of the server and the client connected to the communication network on the communication network;
Authentication information storage means for storing the round-trip transfer delay time received by the round-trip transfer delay time reception means for each server;
When the round-trip transfer delay time accumulated in the authentication information storage means becomes two or more, the server information stored in the authentication information storage means is extracted by referring to the authentication information storage means, and extracted. An authentication information collating unit that calculates the position of the client stored in the authentication information accumulating unit from the position and the round trip transfer delay time, and collates with the position stored in the authentication information storage unit;
A terminal authentication system comprising: Each of the servers further includes:
Latest transfer delay time acquisition means for acquiring a round-trip transfer delay time to the client at a predetermined timing;
Latest transfer delay time transmitting means for transmitting the round-trip transfer delay time acquired by the latest transfer delay time acquiring means to the authentication server,
The authentication server further includes:
Using the round-trip transfer delay time transmitted by the latest transfer delay time transmission means and the server position stored in the authentication information storage means, the client position is calculated and stored in the authentication information storage means. 6. The terminal authentication system according to claim 5, further comprising authentication information updating means for updating the position of the client being updated to the calculated client position. The round-trip transfer delay time acquisition means acquires the round-trip transfer delay time to the client a plurality of times, calculates an average value of the acquired round-trip transfer delay time,
6. The authentication information transmitting unit transmits an average value calculated by the round trip transfer delay time acquiring unit to the predetermined authentication server of the servers as the round trip transfer delay time. Or the terminal authentication system of 6. The client further includes client response signal transmission means for transmitting a response signal to the round-trip transfer delay time acquisition means when receiving the transfer delay time measurement instruction transmitted by the round-trip transfer delay time acquisition means,
The round-trip transfer delay time acquisition means further transmits a transfer delay time measurement instruction for instructing measurement of a transfer delay time to the client, and receives a response signal transmitted from the client response signal transmission means. The terminal authentication system according to any one of claims 1 to 7, wherein a time from when the instruction is transmitted until the response signal is received is measured. The client
Client measurement instruction transmission means for transmitting a transfer delay time measurement instruction for instructing measurement of the transfer delay time to the server;
The server receives a response signal transmitted from the server, measures a time from when the client measurement instruction transmission unit transmits a transfer delay time measurement instruction to receiving a response signal, and uses the measured time as a transfer delay time. Further comprising client authentication information transmitting means for transmitting to
The round-trip transfer delay time acquisition unit further transmits a response signal to the client measurement instruction transmission unit upon receiving the transfer delay time measurement instruction transmitted from the client measurement instruction transmission unit, and transmits the client authentication information transmission unit. The terminal authentication system according to claim 1, wherein a transfer delay time is received.   The terminal authentication system according to claim 8 or 9, wherein the transfer delay time measurement instruction and the response signal include a TCP layer time stamp. A terminal authentication method used in a terminal authentication system in which a server is connected to a client via a communication network,
A round-trip transfer delay time acquisition step in which the server acquires a round-trip transfer delay time to the client;
The round trip transfer delay time acquired by each of the servers in the round trip transfer delay time acquisition step is the round trip transfer delay time stored in the authentication information storage means in which the round trip transfer delay time to the client is stored in advance. An authentication information verification step to be verified;
In order. A terminal authentication method used in a terminal authentication system in which two or more servers are connected to a client via a communication network,
A round-trip transfer delay time receiving step in which a predetermined authentication server among the servers receives a round-trip transfer delay time to the client acquired by each of the servers;
An authentication information accumulating step for accumulating the round-trip transfer delay time received in the round-trip transfer delay time receiving step for each of the servers provided with the authentication information transmitting means;
When two or more round-trip transfer delay times accumulated by the authentication information accumulation unit become two or more, virtual positions on the communication network of the server and the client connected in the communication network are stored for each server. The location of the client stored in the authentication information storage means is extracted from the extracted position and the round-trip transfer delay time for each server stored in the authentication information storage step with reference to the authentication information storage means. And an authentication information collation step for collating with a position stored in the authentication information storage means,
In order.   A terminal authentication program for causing a computer to execute the terminal authentication method according to claim 11.   A computer-readable storage medium in which the terminal authentication program according to claim 13 is recorded.

Images