JP2009003498A - Onetime password authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system for personal identification by using an easy to use onetime password. <P>SOLUTION: This onetime password authentication system comprises: an OTP generation unit for creating and displaying an onetime password by using random number information whose input has accepted and preliminary common key information; user terminal equipment for displaying the random number information received from an authentication server device, and for accepting and replying the user identification information and the onetime password; and an authentication server device for creating and replying the random number information by using the acceptance time of the access of the user terminal equipment, and for accepting the user identification information and the onetime password from the user terminal equipment, and for creating the onetime password for collation by using random number information for collation generated by using the acceptance time information and the preliminarily shared key information corresponding to the accepted user identification information, and for collating the onetime password for collation with the accepted onetime password to achieve OTP authentication. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

The present invention relates to a system for authenticating a person using a disposable password (hereinafter referred to as a one-time password) for each encryption key authentication.

In the use of modern network systems, it is increasingly important to increase the reliability of personal authentication, and the number of personal authentication methods using one-time passwords is increasing. In particular, with the increase in crime in online banking, the use of one-time passwords for login authentication on the Internet is increasing.
As a typical one-time password generation method, for example, there is a time synchronization method in which the time is synchronized between both the one-time password generator and the authentication device, and one-time passwords are generated and compared for each.
Alternatively, there is a challenge response method in which an authentication device gives a pseudo-random number (referred to as a challenge) to a using device for each authentication, generates a one-time password (referred to as a response) from the pseudo-random number using a pre-shared secret key, and compares and verifies it. .
Here, the pseudo-random number means a random number sequence obtained by calculation.

For example, in Patent Document 1, using a personally owned device (= standard credit card-shaped built-in power supply IC card; hereinafter referred to as a built-in power supply IC card) equipped with a personally owned clock, time information (= A unique time change unpredictable code (= time synchronization method one-time password; hereinafter referred to as one-time password) is generated from the current time information) and sent to the central verification computer (= authentication device). A technology is disclosed in which a one-time password is generated using the same algorithm as that of a built-in IC card with a clock synchronized with the clock of the built-in IC card, and both the one-time passwords are verified. Yes.

Also, in Patent Document 2, the authenticating device gives a random number (referred to as a challenge) to the authenticated device, encrypts the challenge with a common key (= encryption key) (referred to as a response), and sends it back. Discloses a technique for decrypting a returned response with a common key and comparing it with a challenge.
Japanese Patent Publication No. 6-507277 (page 4-5, FIGS. 1 and 3) JP2003-101530 (paragraph 0036-paragraph 0041, FIG. 4)

However, the technique disclosed in Patent Document 1 has a drawback in that authentication verification fails because both one-time passwords differ when the clock of the IC card is out of time synchronization with the clock of the authentication device.
Alternatively, the technique disclosed in Patent Document 2 has a problem in that if the number of digits of the encrypted random number (response) is long, it takes time for the user to input. On the other hand, if the number of digits of the response is short, there is a problem that the risk of analogy increases.

The present invention has been made to solve the above-described points, and an object of the present invention is to provide a system for authenticating a person using an easy-to-handle one-time password.

This invention solves the said subject by the means as described in each following aspect.
That is, the first aspect of the present invention is a system comprising an OTP generator (100), a user terminal device (300) connected to a network, and an authentication server device (500), wherein the OTP generator The machine (100) includes storage means (109) for storing pre-shared key information (191) and user identification information (192), and PIN acceptance means (110) for accepting input of random number information and PIN information. The one-time password creating means (130) for creating a one-time password using the received random number information and PIN information and the pre-shared key information (191) stored therein, and the created one-time password display unit A one-time password display means (140) for displaying on the user terminal device (300), an authentication server Random number presentation means (310) for receiving and displaying random number information from the device (500), OTP input acceptance means (320) for accepting input of user identification information and one-time password, and the accepted user identification An OTP authentication request means (330) for transmitting an OTP authentication request including information and a one-time password to an authentication server device and receiving an OTP authentication result, wherein the authentication server device (500) includes: The storage means (509) for storing the pre-shared key information (591) and the PIN information (594) associated with the user identification information (592) and the access from the user terminal device (300), Random number reply means (510) that generates and returns random number information using the access time and accepts an OTP authentication request from the user terminal device (300) TP accepting means (530), collating random number generating means (515) for generating collating random number information using the time information when the OTP authentication request is accepted, and user identification included in the accepted OTP authentication request The pre-shared key information (591) and PIN information (594) associated with the information (592) are selected, the selected pre-shared key information (591) and PIN information (594), and the generated A verification one-time password creating means (540) for creating a verification one-time password using the verification random number information, a one-time password included in the accepted OTP authentication request, and the verification one-time password And a OTP authentication means (550) for performing OTP authentication by comparing Im password authentication system.

In this way, the OTP generator generates a one-time password using the clock provided in the authentication server device, and further generates a one-time password for the authentication one-time password using the clock on the authentication server side. be able to. Thereby, it is possible to prevent an authentication failure when the clock of the one-time password generator and the clock of the authentication server device are shifted as in the conventional case. Furthermore, it is possible to prevent fraud such as generating a one-time password by setting the future time by illegally operating the clock of the one-time password generator.

OTP is an abbreviation for One Time Password. PIN is an abbreviation for Personal Identification Number.

According to a second aspect of the present invention, in the OTP generator (100), the storage means stores PIN information (194), and the received PIN information is compared with the PIN information (194) of the storage means. The one-time password authentication system according to claim 1, further comprising PIN authentication means (120) for PIN authentication.

According to the present invention,
(1) Since the time information is acquired from the authentication server device, it is possible to generate a one-time password without worrying about a time information shift.
(2) Compared to the case where a random number (for example, 7 digits) is input to the one-time password generator, even if the number of digits is the same as the random number, the random number (3 for the 4 digits) stored by the user is stored. It is possible to enter a one-time password without burdening the user.

Hereinafter, embodiments of the present invention will be described in more detail with reference to the drawings.
FIG. 1 is a diagram for explaining the outline of the one-time password authentication system 1. The one-time password authentication system 1 includes a one-time password generator (hereinafter referred to as OTP generator) 100, a user terminal device 300 and an authentication server device 500 connected to a network. The user terminal device 300 and the authentication server device 500 are connected for communication.

The OTP generator 100 includes an input means for inputting random number information. By inputting the random number information, the OTP generator 100 generates a one-time password and displays the one-time password on the display unit.
The OTP generator 100 is an electronic device controlled by a computer program. The computer program of the OTP generator 100 can add functions in C language, for example.

A user accesses the URL of the authentication server device 500 from the user terminal device 300 using a WEB browser or the like, and calls a login screen. The authentication server device 500 generates pseudorandom numbers based on the time when the user terminal device 300 has accessed, generates random number information, and displays the random number information on the login screen.
The user connects the user's PIN and the random number information displayed on the login screen to input to the OTP generator 100. The OTP generator 100 stores a PIN, user identification information, and a pre-shared key in an internal memory, and verifies the PIN input by the user. If the PIN input by the user matches the PIN stored in the internal memory, the OTP generator 100 generates a one-time password using the random number information, the PIN, the user identification information, and the pre-shared key. The OTP generator 100 displays the generated one-time password on the display unit.
The user visually confirms the one-time password displayed on the display unit of the OTP generator 100, and inputs the user identification information and the one-time password on the login screen of the authentication server device 500. The authentication server device 500 receives user identification information and a one-time password, and performs one-time password authentication (hereinafter referred to as OTP authentication).

  FIG. 3 is a detailed configuration diagram of the OTP generator 100. The OTP generator 100 includes a CPU 101, a display unit 104, an input unit 105, a memory (= storage means) 109, and a dedicated program.

The input unit 105 is a key button. The display unit 104 is an LCD or an EL. The memory 109 is a semiconductor memory or a magnetic memory.
The memory 109 stores user pre-shared key information 191, user identification information 192, and PIN 194.

  The dedicated program includes an input receiving unit 110, a PIN authentication unit 120, a one-time password creating unit 130, and a one-time password display unit 140.

The input receiving unit 110 receives input of random number information and PIN information from the input unit 105. When a user inputs PIN information and random number information, the PIN information and random number information are connected and input. Specifically, the PIN is 4 digits, the random number information is 3 digits, and 7-digit information is input.
The user only needs to add 3 digits of random numbers to the stored 4 digits of PIN and input fewer random errors than inputting 7 digits of random number information.
The PIN authentication means 120 performs PIN authentication by comparing the PIN information part from the PIN information and random number information received from the input reception means 110 with the PIN information 194 stored in the memory 109. If the PIN entered by the user is correct, authentication is successful and a one-time password is generated. If the PIN entered by the user and the PIN information 194 do not match, the authentication fails and the OTP generator 100 returns an error.

  The one-time password creating unit 130 creates a one-time password using the PIN information received from the input receiving unit 110, the random number information, and the pre-shared key information 191 stored in the memory 109. The one-time password display unit 140 displays the created one-time password on the display unit 104.

  FIG. 4 is a detailed configuration diagram of the authentication server device 500. The authentication server device 500 includes a CPU 501, a clock unit 503, a communication unit 507, a memory (= storage means) 509, and a dedicated program.

  The clock unit 503 is a clock circuit that generates time information. The communication unit 507 is a connection terminal (for example, an IP connection terminal) for communication connection with the user terminal device 300. The memory 509 is a semiconductor memory or a magnetic memory.

  A memory (= storage means) 509 stores user identification information 192 for uniquely identifying a user, pre-shared key information 591 and PIN information 594 associated with the user identification information 192.

  The dedicated program includes a random number reply unit 510, an OTP reception unit 530, a verification random number generation unit 515, a verification one-time password creation unit 540, and an OTP authentication unit 550.

The random number generation means 510 is means for generating random number information by generating a pseudo random number using the time when the user terminal device 300 accesses the authentication server device 500. Specifically, when there is an access to the authentication server device 500 from the user terminal device 300,
The random number generation means 510 generates pseudo-random numbers using the access time to the authentication server device 500 and creates random number information. Subsequently, the authentication server device 500 generates a login screen, sets random number information on the login screen, and transmits the login screen to the user terminal device 300.
The login screen includes user identification information, a one-time password input field, and a field for displaying random number information. In the field for displaying the random number information, the random number information generated by the authentication server device 500 is displayed.
The OTP accepting unit 530 receives the user identification information 192 and the one-time password input from the user in the user identification information input field and the one-time password input field of the login screen transmitted to the user terminal device 300. It is a means to accept.
At this time, the user identification information 192 and the time information when the one-time password is received are temporarily stored in the memory 509 for the one-time password generation.

  The authentication server device 500 may transmit the combination of the random number information and the PIN to the user terminal device 300 as a method. Specifically, the random number information and the combination method of the random number information and the PIN are displayed on the login screen generated by the authentication server device 500. For example, a message such as “Enter random number before PIN” or “Enter random number after PIN” is displayed. At this time, in order to determine which pattern is input, the OTP generator 100 must always add a flag indicating the pattern of the input method to the first digit or the last digit in advance.

  The verification random number generation means 515 is a means for generating a pseudo-random number for generating a one-time password, generates a pseudo-random number using time information temporarily stored in the memory 509, and generates verification random number information. Is generated.

The verification one-time password creating means 540 selects pre-shared key information 591 and PIN information 594 associated with the user identification information 192 received by the OTP receiving means 530 from the memory 509, and selects the pre-shared key information thus selected. A verification one-time password is created using 591, PIN information 594, and verification random number information.
The verification one-time password is a one-time password for verifying the one-time password received by the OTP reception unit 530.

The OTP authentication unit 550 collates the one-time password received by the OTP reception unit 530 with the collation one-time password, and performs authentication if they match.
If the one-time password received by the OTP receiving unit 530 and the one-time password for verification do not match, the time information used when generating the random number for verification is slightly advanced, and the one-time password for verification is regenerated. To do. The verification random number generation means 515 generates pseudorandom numbers by advancing the time information a little, and generates verification random number information.
The verification one-time password creation means 540 creates a verification one-time password using the newly created verification random number information, pre-shared key information 591, PIN information 594, and user identification information.
The OTP authentication unit 550 compares the regenerated one-time password for verification with the one-time password received by the OTP reception unit 530. In this manner, the OTP accepting unit 530 gradually shifts the time information received from the one-time password and the user identification information, regenerates the collation one-time password, and collates again.
If the one-time password for verification does not match the one-time password entered by the user even after going back to a predetermined time, the authentication fails and the OTP authentication unit 550 returns an error. If the one-time password for verification matches the password entered by the user, authentication succeeds.

FIG. 5 is a detailed configuration diagram of the user terminal device 300.
The user terminal device 300 includes a CPU 301, a communication unit 302, a display unit 304, an input unit 305, a memory (= storage means) 309, and a dedicated program.
The display unit 304 is an LCD or an EL. The input unit 305 is a keyboard. The communication unit 302 is a connection terminal (for example, an IP connection terminal) for communication connection with the user terminal device 500. The memory 309 is a semiconductor memory or a magnetic memory.
The dedicated program includes authentication server access means 310, OTP input reception means 320, and OTP authentication request means 330.

  The authentication server access unit 310 is specifically software such as WEB, and is a unit for accessing the authentication server device 500 connected to the same network from the user terminal device 300 through the communication unit 302. When the authentication server device 500 is accessed by the authentication server access unit 110 of the user terminal device 300, the authentication server device 500 generates a login screen and sets and transmits random number information to the user terminal device 300. The random number information is a pseudo-random number generated based on the time when the user terminal device 300 accesses the authentication server device 500.

The OTP input accepting unit 320 is a unit that accepts the user identification information and the one-time password entered by the user on the login screen transmitted from the authentication server device 500.
The OTP authentication request unit 330 sends the user identification information and the one-time password received on the login screen to the authentication server device 500, and requests the authentication server device 500 for an authentication operation.
The authentication server device 500 receives the usage identification information and the one-term password transmitted from the user terminal device 300, generates a one-time password for authentication from the reception time and the user identification information, and the user terminal device 300. Verify whether it matches the one-time password sent from. If they match, authentication succeeds.

  FIG. 2 shows the processing of the one-time password authentication system 1. A processing procedure from generation of a one-time password by the OTP generator 100 to authentication by the authentication server device 500 will be described.

First, the procedure of pseudo random number (challenge) reception processing will be described.
The user accesses the authentication server device 500 connected to the same network from the user terminal device 300 (FIG. 2 (1)).
When the authentication server device 500 receives an access from the user terminal device 300, the authentication server device 500 generates a pseudo-random number using the access reception time information, generates the random number information, and returns it to the user terminal device 300 (see FIG. 2 (2)).
Random number information returned from the authentication server device 500 is displayed on the user terminal device 300 (FIG. 2 (3)).

Next, the procedure of the one-time password generation process will be described.
When the user visually reads the random number information displayed on the user terminal device 300, connects the PIN information and the random number information, and inputs the input to the input unit 105 of the OTP generator 100, the input receiving means of the OTP generator 110 accepts PIN information and random number information input by the user (FIG. 2 (4)).
The PIN authenticating means 120 performs the personal authentication by comparing the input PIN information with the PIN 194 stored in the memory 109 (FIG. 2 (5)).
The OTP generator 100 creates a one-time password by using the random number information and PIN information received by the input receiving unit 110 and the pre-shared key information 191 stored in the memory 109. The created one-time password is displayed on the display unit 105 (FIG. 2 (6)).

Next, a procedure for one-time password authentication (hereinafter referred to as OTP authentication) processing will be described.
The user visually reads the one-time password displayed on the OTP generator 100, and the user identification information and the one-time password on the login screen transmitted from the authentication server device 500 displayed on the user terminal device 300 are displayed. When input is made in the input field, the OTP input accepting means 320 of the user terminal device 300 accepts input of a one-time password and user identification information (FIG. 2 (7)).
The OTP authentication request unit 330 transmits the one-time password and user identification information to the authentication server device 500 (FIG. 2 (8)).
The authentication server device 500 receives the one-time password and user identification information by the OTP receiving unit 530. The authentication server device 500 generates a one-time password based on the shared key information 591 and the PIN information linked to the user identification information and the random number information generated based on the access time to the authentication server device 500. The OTP authentication is performed by comparing with the one-time password transmitted from the user terminal device 300 (FIG. 2 (9)).

The figure explaining the outline of the one-time password authentication system 1 Process flow of one-time password authentication system 1 Detailed configuration diagram of the OTP generator 100 Detailed configuration diagram of authentication server device 500 Detailed configuration diagram of user terminal device 300

Explanation of symbols

1 One-time password authentication system 100 One-time password generator, hereinafter referred to as OTP generator 110 Input receiving means 120 PIN authentication means 130 One-time password creation means 140 One-time password display means 191 Pre-shared key information 192 User identification information 300 User Terminal device 310 Authentication server access means 320 OTP input reception means 330 OTP authentication request means 500 Authentication server apparatus 510 Random number generation means 530 OTP reception means 515 Verification random number generation means 540 Verification one-time password generation means 550 OTP authentication means 591 Pre-sharing Key information 594 PIN information

Claims (2)

A system comprising an OTP generator, a user terminal device connected to a network, and an authentication server device,
The OTP generator is
Storage means for storing pre-shared key information and user identification information;
PIN accepting means for accepting input of random number information and PIN information;
One-time password creation means for creating a one-time password using the received random number information and PIN information and the pre-shared key information stored therein;
One-time password display means for displaying the created one-time password on the display unit;
A generator comprising:
The user terminal device
Random number presentation means for receiving and displaying random number information from the authentication server device;
OTP input receiving means for receiving user identification information and one-time password input;
An OTP authentication request means for transmitting an OTP authentication request including the received user identification information and a one-time password to an authentication server device and receiving an OTP authentication result;
A terminal device comprising:
The authentication server device
Storage means for storing pre-shared key information and PIN information associated with user identification information;
Random number reply means for receiving random access from the user terminal device and generating random number information using the access time;
OTP accepting means for accepting an OTP authentication request from the user terminal device;
A verification random number generating means for generating verification random number information using the time information at which the OTP authentication request is received;
The pre-shared key information and PIN information (594) selected by selecting the pre-shared key information and PIN information associated with the user identification information included in the accepted OTP authentication request, and the generated A verification one-time password creating means for creating a verification one-time password using the verification random number information;
OTP authentication means for performing OTP authentication by comparing the one-time password included in the accepted OTP authentication request with the one-time password for verification;
A one-time password authentication system, comprising: a server device comprising: The OTP generator is
The storage means stores PIN information,
2. The one-time password authentication system according to claim 1, further comprising a PIN authentication unit that performs PIN authentication by comparing the received PIN information with the PIN information stored in the storage unit.

Images