JP2009122921A - Authentication information transmission system, remote access management device, authentication information relay method and authentication information relay program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform remote access to an information processing server having an optional authentication system by safely inputting authentication information even under an unreliable environment. <P>SOLUTION: This authentication information transmission system for transmitting authentication information to an information processing server being the object of remote access is provided with: a terminal for access for remotely performing access to an information processing server; equipment for authentication configured to input authentication information, and not equipped with any key logger; and a remote access management device having an auxiliary communication means for acquiring the authentication information from the equipment for authentication, and a main communication means for relaying data to be communicated between the terminal for access and the information processing server, and for converting the authentication information acquired by the auxiliary communication means into the same format of data received from the terminal for access, and for transmitting the converted authentication information to the information processing server. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an authentication information transmission system, a remote access management device, an authentication information relay method, and an authentication information relay program for transmitting authentication information input by an authentication device to an information processing server to be remotely accessed.

  With the spread of mobile devices and mobile networks, opportunities to access the company intranet from external networks such as external mobile networks are increasing. At this time, if data and programs necessary for work are stored in the mobile device, there is a risk of information leakage if the mobile device is lost, so everything necessary for the work is a mail server in the intranet. In an information processing server such as a file server or a file server, a method using remote access for accessing them from an external network has become widespread.

  For such remote access, a method using a WWW (World Wide Web) browser and a method using a screen transfer type thin client are widely used.

  However, it is not uncommon for an access terminal used for remote access to an information processing server in an intranet to be a PC (Personal Computer) provided in a public place such as an Internet cafe. May have malicious programs such as keyloggers. Therefore, when the information processing server for remote access requests authentication information for certifying the user using the access terminal, which is used for remote access authentication for authenticating remote access from the access terminal, When authentication information is input from a terminal, there is a risk that the authentication information is stolen by a key logger.

  In order to avoid such a risk, there is an authentication method for performing remote access authentication using a personal authentication device storing authentication information in an IC (Integrated Circuit) card or a USB (Universal Serial Bus) memory. .

  For example, Patent Document 1 describes a technique for performing remote access authentication using a personal authentication device connected to an access terminal during remote access. In this patent document 1, when performing remote access authentication, a personal authentication device is connected to an access terminal, and remote access authentication is requested from a main authentication device. The main authentication device acquires authentication information from the personal authentication device via the access terminal, performs remote access authentication from the personal authentication device using the acquired authentication information, and is used for access to which the personal authentication device is connected. Determines whether remote access from the terminal is possible.

Patent Document 2 describes a technique for performing remote access authentication using a mobile terminal device held by a user during remote access. In Patent Document 2, there is a relay device that relays data communicated between an access terminal and an information processing server in the manner of a proxy server. During remote access from the access terminal to the information processing server, the relay device requests input of authentication information from the mobile terminal device, and requests remote access from the information processing server using the authentication information transmitted from the mobile terminal device. The remote access authentication result transmitted from the information processing server is transmitted to the access terminal.
JP 2004-023166 A JP 2006-202052 A

  However, in a technique using a personal authentication device such as an IC card for remote access authentication as described in Patent Document 1, if there is an information processing server that does not support an authentication method using the personal authentication device, At the time of remote access to the information processing server, it is necessary to input authentication information from the access terminal, and there is a problem that the risk of leakage of authentication information by a key logger still exists.

  Also, in the technology using a mobile terminal device for remote access authentication described in Patent Document 2, the access terminal is connected to the relay device, and the information processing server performs remote access authentication from the relay device. However, there is a problem in that an information processing server having an authentication method that is not supported cannot be accessed remotely and cannot be applied to an information processing server having an arbitrary authentication method.

  An object of the present invention is to provide an authentication information transmission system, a remote access management device, an authentication information relay method, and an authentication information relay program that solve the above-described problems.

In order to achieve the above object, the authentication information transmission system of the present invention provides:
An authentication information transmission system for transmitting authentication information to an information processing server targeted for remote access,
An access terminal for remotely accessing the information processing server;
An authentication device that can input the authentication information and does not include a key logger;
Auxiliary communication means for acquiring the authentication information from the authentication device, relaying data communicated between the access terminal and the information processing server, and the authentication information acquired by the auxiliary communication means, A remote access management device comprising: main communication means for converting the data received from the access terminal into the same format as the data received from the access terminal and transmitting the data to the information processing server.

In order to achieve the above object, the remote access management device of the present invention provides:
A remote access management device for relaying authentication information to a remote access target information processing server,
Auxiliary communication means capable of inputting the authentication information and obtaining the authentication information from an authentication device not equipped with a key logger;
While relaying data communicated between the information processing server and the access terminal that remotely accesses the information processing server, the authentication information acquired by the auxiliary communication means is the same as the data received from the access terminal And a main communication means for converting to a format and transmitting to the information processing server.

In order to achieve the above object, the authentication information relay method of the present invention comprises:
An authentication information relay method performed by a remote access management device for relaying authentication information to an information processing server targeted for remote access,
Obtaining the authentication information from an authentication device capable of inputting the authentication information and not including a key logger;
Relaying data communicated between the information processing server and the access terminal that remotely accesses the information processing server, and converting the acquired authentication information into the same format as the data received from the access terminal, And a step of transmitting to the information processing server.

In order to achieve the above object, the authentication information relay program of the present invention provides:
In the remote access management device for relaying authentication information to the remote access target information processing server,
A procedure for acquiring the authentication information from an authentication device that can input the authentication information and does not include a key logger;
Relaying data communicated between the information processing server and the access terminal that remotely accesses the information processing server, and converting the acquired authentication information into the same format as the data received from the access terminal, And a procedure of transmitting to the information processing server.

  As described above, according to the present invention, when transmitting authentication information to a remote access target information processing server, the authentication information is provided not with an access terminal that may be provided with a key logger but with a key logger. Authentication information can be input safely because there is no authentication device.

  In addition, the authentication information input by the authentication device is converted into the same format as the data transmitted from the access terminal by the remote access management device and transmitted to the information processing server. Remote access to the information processing server is available.

  As a result, it is possible to input authentication information safely even in an unreliable environment and to remotely access an information processing server having an arbitrary authentication method.

  The best mode for carrying out the present invention will be described below in detail with reference to the drawings.

(First embodiment)
FIG. 1 shows the configuration of an authentication information transmission system according to the first embodiment of the present invention.

  As shown in FIG. 1, the authentication information transmission system of this embodiment transmits authentication information 140 to a remote access target information processing server (such as a mail server 131 or a WWW server 132) included in the server group 130. A remote access management apparatus 100 that operates under program control, an access terminal 110, and an authentication device 120. Each information processing server included in the server group 130 has an arbitrary authentication method.

  The access terminal 110 is an information processing apparatus used by a user of this system to remotely access information processing servers included in the server group 130.

  The authentication device 120 includes an access data storage unit 121, an input unit 122, a first communication unit 123, and a second communication unit 124, and is a device that does not include a key logger.

  The access data storage unit 121 is a unit for storing access authentication information 121 a that is used for access authentication in which the main communication unit 101 of the remote access management device 100 described later authenticates access from the access terminal 110. .

  The input unit 122 is a unit for inputting authentication information 140 used for remote access authentication in which each information processing server included in the server group 130 authenticates remote access from the access terminal 110.

  The first communication unit 123 is a unit for communicating with the auxiliary communication unit 102 of the remote access management apparatus 100 described later.

  The second communication unit 124 is a unit for communicating with the access terminal 110.

  The remote access management device 100 includes a main communication unit 101 and an auxiliary communication unit 102.

  The auxiliary communication unit 102 receives the authentication information 140 transmitted from the first communication unit 123 of the authentication device 120 and transfers it to the main communication unit 101.

  The main communication unit 101 uses the second communication unit 124 of the authentication device 120 to store the access authentication information 121a stored in the access data storage unit 121 of the authentication device 120 via the access terminal 110. Obtaining and performing access authentication from the access terminal 110. After the access authentication, data communicated between the access terminal 110 and the remote access target information processing server included in the server group 130 is relayed. Further, at the time of remote access authentication, the authentication information 140 transferred from the auxiliary communication unit 102 is converted into the same format as the data transmitted from the access terminal 110, and the remote access target included in the server group 130 is converted. Send to the information processing server.

  Note that communication between the main communication unit 101 and the access terminal 110 and communication between the auxiliary communication unit 102 and the first communication unit 123 of the authentication device 120 are performed using different communication paths.

  The operation of the authentication process in the authentication information transmission system of this embodiment will be described below with reference to the flowchart of FIG. In the following description, it is assumed that the remote access target information processing server is the mail server 131 of the server group 130.

  First, the access terminal 110 acquires the access authentication information 121a stored in the access data storage unit 121 of the authentication device 120, and transmits the acquired access authentication information 121a to the main communication unit 101. Request access authentication.

  Next, the main communication means 101 performs access authentication from the access terminal 110 using the access authentication information 121a transmitted from the access terminal 110 (step 201).

  Next, the access terminal 110 performs remote access to the mail server 131 via the main communication means 101 (step 202).

  When the mail server 131 requests the authentication information 140 used for the remote access authentication (step 203), the user inputs the authentication information 140 using the input unit 122 of the authentication device 120 (step 204), and the input authentication. Information 140 is transmitted from the first communication means 123 to the auxiliary communication means 102 (step 205).

  The auxiliary communication unit 102 transfers the authentication information 140 transmitted from the first communication unit 123 to the main communication unit 101.

  The main communication unit 101 converts the authentication information 140 transferred from the auxiliary communication unit 102 into the same format as the data transmitted from the access terminal 110 (step 206), and transmits it to the mail server 131.

  The mail server 131 uses the authentication information 140 transmitted from the main communication unit 101 to perform remote access authentication from the access terminal 110 (step 207).

  Next, the effect of this embodiment will be described.

  In this embodiment, the authentication information 140 for remote access to the mail server 131 is input from the authentication device 120 that does not have a key logger, instead of the access terminal 110 that may have a key logger. Therefore, the effect that the authentication information 140 can be input safely is obtained.

  In the present embodiment, the authentication information 140 input by the authentication device 120 is converted into the same format as the data transmitted from the access terminal 110 by the remote access management device 100 and transmitted to the mail server 131. Since it is configured, it is possible to remotely access the mail server 131 having an arbitrary authentication method.

(Second Embodiment)
FIG. 3 shows the configuration of the authentication information transmission system according to the second embodiment of the present invention.

  As shown in FIG. 3, the authentication information transmission system of the present embodiment is different from the first embodiment in that an access relay unit 340 is provided. Since the other components are the same as those in the first embodiment, the same reference numerals as those in FIG.

  The access relay means 340 is arranged between the main communication means 101 and the server group 130, and each information processing included in the server group 130 based on operation data received from the access terminal 110 via the main communication means 101. Remote access to the server is executed, and the screen data received from each information processing server is transmitted to the access terminal 110 via the main communication means 101 as a result of the remote access.

  The operation of the authentication process in the authentication information transmission system of this embodiment will be described below with reference to the flowchart of FIG. In the following description, it is assumed that the remote access target is the mail server 131 of the server group 130.

  First, the access terminal 110 acquires the access authentication information 121a stored in the access data storage unit 121 of the authentication device 120, and transmits the acquired access authentication information 121a to the main communication unit 101. And request access authentication.

  Next, the main communication means 101 performs access authentication from the access terminal 110 using the access authentication information 121a transmitted from the access terminal 110 (step 401).

  Next, the access terminal 110 remotely connects to the access relay unit 340 via the main communication unit 101 (step 402), and remotely accesses the mail server 131 by remotely operating the access relay unit 340 ( Step 403).

  Specifically, in the remote operation described above, the access terminal 110 transmits operation data such as keyboard pressing data to the access relay unit 340 via the main communication unit 101, and the access relay unit 340 The remote access is executed based on the received operation data, and the screen data received from the mail server 131 as a result of the remote access is transmitted to the access terminal 110 via the main communication means 101.

  When the mail server 131 requests authentication information 140 used for remote access authentication (step 404), screen data indicating that the authentication information 140 is requested is transmitted to the access relay unit 340, and the access relay unit 340 Is transmitted to the access terminal 110, and the access terminal 110 displays the screen data transmitted from the access relay means 340.

  When the screen data for requesting the authentication information 140 is displayed on the access terminal 110, the user inputs the authentication information 140 using the input unit 122 of the authentication device 120 (step 405), and the input authentication information. 140 is transmitted from the first communication means 123 to the auxiliary communication means 102 (step 406).

  The auxiliary communication unit 102 transfers the authentication information 140 transmitted from the authentication device 120 to the main communication unit 101.

  The main communication unit 101 converts the authentication information 140 transferred from the auxiliary communication unit 102 into the same format as the operation data transmitted from the access terminal 110 (step 407), and transmits it to the access relay unit 340.

  When the authentication information 140 is transmitted as operation data from the main communication unit 101, the access relay unit 340 acquires the authentication information 140 by executing a process based on the operation data, and sends the authentication information 140 to the mail server 131. Send.

  The mail server 131 performs remote access authentication from the access relay unit 340 using the authentication information 140 transmitted from the access relay unit 340 (step 408).

  Next, the effect of this embodiment will be described.

  In the authentication information transmission system of the present embodiment, the access terminal 110 is remotely connected to the access relay unit 340 via the main communication unit 101, and remotely accesses the mail server 131 by remotely operating the access relay unit 340. It is the composition which performs. Therefore, the user does not use an application that may be contaminated by a malicious program such as a computer virus provided in the access terminal 110, but a highly reliable application provided in the access relay unit 340. It can be used to remotely access the mail server 131. As described above, in this embodiment, in addition to the effect obtained in the first embodiment, an effect that a remote application can be performed using a secure application is obtained.

(Third embodiment)
FIG. 5 shows an authentication information transmission system configuration according to the third embodiment of the present invention.

  As shown in FIG. 5, the authentication information transmission system of this embodiment is different from the second embodiment in that each of the remote access management device 100, the access terminal 110, and the authentication device 120 is replaced by a remote device. The difference is that an access management device 500, an access terminal 510, and an authentication device 520 are provided.

  Hereinafter, differences from the second embodiment in the configuration and operation of the present embodiment will be described.

  The authentication device 520 is a device that includes an access data storage unit 521, an input unit 522, a first communication unit 523, and a second communication unit 524, and does not include a key logger.

  The first communication unit 523 is a unit for communicating with an auxiliary communication unit 502 of the remote access management device 500 described later, and the auxiliary communication unit 502 has a key for encrypting and decrypting the access authentication information 121a. A request for generating a pair (secret key 521a and public key 504a) is transmitted, and the secret key 521a transmitted from the auxiliary communication unit 502 is received.

  The access data storage unit 521 is a unit for storing the secret key 521 a transmitted from the auxiliary communication unit 502 to the first communication unit 523. Further, it is assumed that the access data storage unit 521 also stores access authentication information 121a used for access authentication from the access terminal 510 by the main communication unit 501 of the remote access management device 500 described later.

  The input unit 522 is a unit for inputting authentication information 140 used by each information processing server included in the server group 130 for remote access authentication from the access terminal 510.

  The second communication unit 524 is a unit for communicating with an access terminal 510 described later.

  The remote access management device 500 includes a key generation unit 503 and a data storage unit 504 in addition to the main communication unit 501 and the auxiliary communication unit 502.

  The key generation unit 503 receives a key pair generation request from the authentication device 520 and the main communication unit 501, and encrypts and decrypts the access authentication information 121a (a secret key 521a and a public key). 504a). The key generation unit 503 transmits the generated secret key 521a from the auxiliary communication unit 502 to the first communication unit 523 of the authentication device 520 and stores the generated public key 504a in the data storage unit 504.

  The auxiliary communication unit 502 receives the key pair generation request transmitted from the first communication unit 523 of the authentication device 520, transfers it to the key generation unit 503, and uses the secret key 521 a generated by the key generation unit 503. , To the first communication means 523. Further, the auxiliary communication unit 502 identifies whether the authentication device 520 that has transmitted the key pair generation request is an authentication device that can use the remote access management device 500.

  The main communication unit 501 obtains the access authentication information 121a encrypted by the access terminal 510 using the secret key 521a stored in the access data storage unit 521 from the access terminal 510, and acquires the obtained encryption. The encrypted access authentication information 121 a is decrypted using the public key 504 a stored in the data storage unit 504, and access authentication from the access terminal 510 is performed. The main communication means 501 counts the amount of data communicated with the access terminal 510 after access authentication. When the counted data amount reaches a certain amount, the main communication means 501 sends a new key pair (new secret key). 521b and public key 504b) generation request is transmitted. After that, after the counted amount of data reaches a certain amount, the access authentication information 121a encrypted using the secret key 521b is transmitted from the access terminal 510 even if a preset waiting time elapses. If not, the communication with the access terminal 510 is terminated.

  The access terminal 510 is an information processing apparatus that is used by a user of this system to remotely access the mail server 131. The access terminal 510 acquires the access authentication information 121a and the secret key 521a stored in the access data storage unit 521 of the authentication device 520, and encrypts the access authentication information 121a using the secret key 521a. Turn into. Further, the access terminal 510 transmits the encrypted access authentication information 121a to the main communication unit 501 and requests access authentication. Further, the access terminal 510 counts the amount of data communicated with the main communication unit 501 after access authentication. When the counted data amount reaches a certain amount, the secret key 521a stored in the access data storage unit 521 is counted. Is updated to the private key 521b. If the secret key 521a has been updated, the access terminal 510 encrypts the access authentication information 121a using the secret key 521b, transmits it to the main communication means 501, and requests access authentication again. If the secret key 521a has not been updated, the access terminal 510 ends communication with the main communication unit 501.

  The operation of the authentication process according to this embodiment will be described below with reference to the flowcharts of FIGS. In the following description, it is assumed that the remote access target is the mail server 131 of the server group 130.

  First, the operation of access authentication processing in the remote access management device 500 will be described with reference to FIG.

  First, the authentication device 520 transmits a key pair generation request from the first communication unit 523 to the auxiliary communication unit 502.

  Next, the auxiliary communication unit 502 receives the key pair generation request transmitted from the first communication unit 523 of the authentication device 520 and transfers it to the key generation unit 503.

  Next, the key generation unit 503 receives the key pair generation request transferred from the auxiliary communication unit 502, and generates a key pair (secret key 521a and public key 504a) (step 601). The key generation unit 503 stores the generated public key 504a in the data storage unit 504.

  Next, the auxiliary communication unit 502 identifies whether the authentication device 520 that has transmitted the key pair generation request is an authentication device that can use the remote access management device 500 (step 602). If the authentication device 520 is an available authentication device, the auxiliary communication unit 502 transmits the secret key 521a generated by the key generation unit 503 to the first communication unit 523 (step 603).

  Next, the main communication unit 501 uses the access authentication information 121a encrypted by the access terminal 510 using the secret key 521a stored in the access data storage unit 521 of the authentication device 520, as the access terminal. 510, the obtained encrypted access authentication information 121a is decrypted using the public key 504a stored in the data storage unit 504, and the decrypted access authentication information 121a is used. Access authentication from the access terminal 510 is performed (step 604).

  Next, the main communication unit 501 relays data communicated between the access terminal 510 and the access relay unit 340 (step 605), and counts the amount of data communicated with the access terminal 510 after access authentication. When the counted data amount reaches a certain amount (step 606), a new key pair generation request is transmitted to the key generation means 503.

  Next, the key generation unit 503 receives the key pair generation request transmitted from the main communication unit 501 and generates a new key pair (secret key 521b and public key 504b) (step 607). The key generation unit 503 transmits the generated secret key 521b from the auxiliary communication unit 502 to the first communication unit 523 (step 608), and also generates the public key 504a stored in the data storage unit 504. Update to 504b.

  Thereafter, after the amount of data communicated with the access terminal 510 reaches a certain amount, the main communication means 510 performs encryption using the secret key 521b from the access terminal 510 even if a preset waiting time elapses. If the access authentication information 121a is not transmitted, the communication with the access terminal 510 is terminated.

  Thereafter, the main communication means 501 counts the amount of data communicated with the access terminal 510 while the communication with the access terminal 510 is being performed, and every time the counted data amount reaches a certain amount, the steps after step 605 are performed. Repeat the operation.

  Next, the operation of access authentication processing in the access terminal 510 and the authentication device 520 will be described with reference to FIG.

  First, the authentication device 520 connects to the access terminal 510 using the second communication unit 524, and transmits a key pair generation request from the first communication unit 523 to the auxiliary communication unit 502 (step 701).

  Next, the authentication device 520 stores the secret key 521 a generated by the key generation unit 503 transmitted from the auxiliary communication unit 502 in the access data storage unit 521.

  Next, the access terminal 510 acquires the access authentication information 121a and the secret key 521a stored in the access data storage unit 521, encrypts the access authentication information 121a using the secret key 521a, The encrypted access authentication information 121a is transmitted to the main communication means 501 to request access authentication (step 702).

  Next, the access terminal 510 remotely connects to the access relay unit 340 via the main communication unit 501 (step 703), and remotely operates the access relay unit 340 to remotely access the mail server 131 (step 704). ).

  When the user requests authentication information 140 used for remote access authentication from the mail server 131, the user inputs the authentication information 140 using the input unit 522 of the authentication device 520 (step 2). 709), the inputted authentication information 140 is transmitted from the first communication means 523 to the auxiliary communication means 502 (step 710).

  The access terminal 510 remotely connects to the access relay unit 340 after access authentication, and counts the amount of data communicated with the main communication unit 501 while remotely accessing the mail server 131, and the counted data amount is a fixed amount. Is determined (step 705).

  If the counted data amount has not reached a certain amount, the access terminal 510 checks whether the secret key 521a of the access data storage unit 521 has been updated to the secret key 521b (step 706).

  When the secret key 521a has been updated, the access terminal 510 determines that an abnormality has occurred in communication with the main communication unit 501, and ends the communication.

  If the secret key 521a has not been updated, the access terminal 510 determines that communication with the main communication unit 501 is normal and continues communication.

  When the counted data amount reaches a certain amount, the access terminal 510 checks whether or not the secret key 521a of the access data storage unit 521 is updated to the secret key 521b (step 707).

  When the secret key 521a is updated, the access terminal 510 determines that the communication with the main communication unit 501 is normal, encrypts the access authentication information 121a using the secret key 521b, and the main communication unit 501 to request access authentication again (step 708).

  If the secret key 521a has not been updated, the access terminal 510 determines that an abnormality has occurred in communication with the main communication unit 501 and ends the communication.

  Thereafter, the access terminal 510 counts the amount of data communicated with the main communication means 501 during remote access to the mail server 131, and performs the operations after step 704 each time the counted data amount reaches a certain amount. repeat.

  Next, the effect of this embodiment will be described.

  In the authentication information transmission system of the present embodiment, the main communication unit 501 encrypts and decrypts the access authentication information 121a every time the amount of data communicated with the access terminal 510 reaches a certain amount. Each time the key pair is updated, access authentication using a new key pair is required. When access authentication using a new key pair is not performed, communication with the access terminal 510 is terminated. It has a configuration. Therefore, even when the secret key 521a is illegally copied from the access terminal 510 and used in another system, the unauthorized use is detected from the presence or absence of the update of the secret key 521a, and the communication can be terminated. It has become. As described above, in this embodiment, in addition to the effects of the first and second embodiments, an effect of detecting unauthorized access and terminating the communication can be obtained.

  The authentication information transmission system of the first to third embodiments described above is an example, and the configuration and operation thereof can be changed as appropriate without departing from the gist of the invention.

  For example, in the first to third embodiments, the authentication information 140 is input using the input unit 122 (or 522) of the authentication device 120 (or 520). The authentication stored in the storage unit 121 (or 521) and stored in the access data storage unit 121 (or 521) when the remote access target information processing server requests the authentication information 140 used for remote access authentication. The information 140 may be transmitted to the information processing server via the remote access management device 100 (or 500).

  Further, for example, in the first to third embodiments, there is only one access terminal 110 (or 510) and authentication device 120 (or 520) in the system because of the minimum configuration. The remote access management device 100 (or 500) does not require means for linking these, but the access terminal 110 (or 510) and the authentication device 120 (or 520) are connected to the remote access management device 100 (or 500). ) (For example, a database or a data storage unit 504 in the third embodiment) may be provided so that a plurality of access terminals and authentication devices can be used. .

  Next, the best mode for carrying out the present invention will be described using specific examples.

Example 1
The present embodiment is a concrete implementation of the authentication information transmission system of the second embodiment shown in FIG.

  In the present embodiment, a PC provided in a public place such as an Internet cafe is used as the access terminal 110, and the access terminal 110 is hereinafter referred to as a PC 110.

  In this embodiment, the authentication device 120 is a mobile phone in which a user certificate for certifying the user who uses the PC 110 is stored in the memory. Hereinafter, the authentication device 120 is a mobile phone. The access data storage unit 121 is referred to as a memory 121. In addition, as the information 121a for access authentication, a user certificate, a password, a device ID unique to a mobile phone, and the like can be used. In this embodiment, a user certificate is used. The information 121a is referred to as a user certificate 121a. In addition, as the second communication unit 124, for example, wired communication such as USB communication or wireless communication such as Bluetooth can be used, but in this embodiment, USB communication is used.

  In this embodiment, a PC in an intranet having a thin client server is used as the access relay unit 340. Hereinafter, the access relay unit 340 is referred to as a PC 340.

  Further, in the present embodiment, the PC 110 can acquire VNC (Virtual Network Computing: http://www.realvnc.com, etc.) well known to those skilled in the art as means for remotely connecting to the PC 340, for example. It is assumed that the PC 340 is provided with a VNC server that is a thin client server that accepts a remote connection from the PC 110.

  The operation of the authentication process in the authentication information transmission system of this embodiment will be described below. In the following description, it is assumed that the remote access target is the mail server 131 of the server group 130.

  First, the PC 110 acquires the user certificate 121 a stored in the memory 121 of the mobile phone 120 and transmits it to the main communication unit 101.

  Next, the main communication unit 101 uses the user certificate 121a transmitted from the PC 110, for example, a TLS (Transport Layer Security: TLS detailed authentication procedure) which is an access authentication procedure well known to those skilled in the art. (Refer to RFC2246 for authentication) Access authentication from the PC 110 is performed according to the protocol. In addition to TLS, password authentication, well known to those skilled in the art, and device ID information for specifying the PC 110 that can be connected in advance are registered in the main communication means 101, and the device ID sent from the PC 110 and You may make it perform access authentication by whether it corresponds.

  When the access authentication is successful, the main communication unit 101 forms a VPN (Virtual Private Network) with the PC 110.

  After the access authentication, the PC 110 communicates with the main communication means 101 via this VPN.

  Next, the PC 110 remotely connects to the PC 340 using the VNC, and remotely accesses the mail server 131 by remotely operating the PC 340.

  When the PC 110 remotely operates the PC 340, the PC 110 transmits operation data input to input means such as a keyboard and a mouse. The PC 340 executes remote access to the mail server 131 based on the received operation data, and the result The screen data transmitted from the mail server 131 is transmitted to the PC 110, and the PC 110 displays the received screen data on an output device such as a display. That is, the user is provided with a remote operation environment as if the PC 340 is directly operated on the PC 110.

  Next, when the mail server 131 performing remote access requests the authentication information 140 used for remote access authentication in order to determine whether or not mail can be acquired, the user is not the PC 110 but the input means of the mobile phone 120. Authentication information 140 is input by key input to 122. Here, it is assumed that a password is requested, and in the following, the authentication information 140 is referred to as a password 140.

  Next, the mobile phone 120 transmits the password 140 input by the user to the auxiliary communication means 102 using a communication path with a relatively low risk of eavesdropping such as a mobile phone network.

  Next, the auxiliary communication unit 102 transfers the password 140 transmitted from the mobile phone 120 to the main communication unit 101.

  Next, the main communication unit 101 converts the password 140 transferred from the auxiliary communication unit 102 into the same format as the operation data transmitted from the PC 110 and transmits it to the PC 340.

  More specifically, the password 140 is converted into a format such as operation data input to the input means of the PC 110, such as keyboard pressing data, mouse movement data, or mouse click event data, and is transmitted to the PC 340. Is done. As a result, the PC 340 can receive the operation data of the password 140 as if the password 140 had been input on the PC 110.

  Thereafter, the PC 340 transmits the password 140 to the mail server 131, and the mail server 131 performs remote access authentication from the PC 340 using the password 140 transmitted from the PC 340.

  In this embodiment, when the password 140 is requested, the password 140 is input from the input unit 122 of the mobile phone 120. However, the password 140 is stored in the memory 121 of the mobile phone 120 in advance. When the password 140 is requested, for example, the password transmission operation is assigned to one of the keys that are the input means 122 of the mobile phone 120, and the password stored in the memory 121 is pressed by pressing the key. 140 may be transmitted to the auxiliary communication means 102. In this way, since the password 140 is not directly input by the input means 122 of the mobile phone 120, not only can the labor of inputting the password 140 be reduced, but also the snooping when the password 140 is input can be prevented. The effect of becoming is obtained.

(Example 2)
The present embodiment is a concrete implementation of the authentication information transmission system of the third embodiment shown in FIG.

  In this embodiment, it is assumed that a PC provided in a public place such as an Internet cafe is used as the access terminal 510, and the access terminal 510 is hereinafter referred to as a PC 510. Further, since it is necessary to perform an operation necessary for access authentication on the PC 510, an access authentication program for causing the PC 510 to perform an operation necessary for access authentication needs to be executed on the PC 510. Here, an access authentication program is stored in advance in the access data storage means 521 of the authentication device 520, a USB memory, or the like, and is connected to the PC 510 for remote access, and the access authentication is performed on the PC 510. It is assumed that access authentication is requested to the main communication means 501 by executing the program for the above.

  In this embodiment, a mobile phone in which a user certificate that proves a user using the PC 510 is stored in the memory as the authentication device 520. In the following description, the authentication device 520 is a mobile phone. The access data storage unit 521 is referred to as a memory 521. In this embodiment, a user certificate is used as the information 121a for access authentication. Hereinafter, the information 121a for access authentication is referred to as a user certificate 121a. In this embodiment, USB communication is used as the second communication means 524.

  In this embodiment, as in the first embodiment, the access relay unit 340 is referred to as a PC 340, and the PC 510 uses a VNC as a unit for remotely connecting to the PC 340.

  The operation of the authentication process in the authentication information transmission system of this embodiment will be described below. In the following description, it is assumed that the remote access target is the mail server 131 of the server group 130.

  First, the mobile phone 520 transmits a key pair generation request to the auxiliary communication unit 502.

  Next, the auxiliary communication unit 502 transfers the key pair generation request transmitted from the mobile phone 520 to the key generation unit 503.

  Next, the key generation unit 503 receives the key pair generation request transferred from the auxiliary communication unit 502 and generates a key pair.

  Next, the auxiliary communication unit 502 identifies whether the mobile phone 520 that has transmitted the key pair generation request is an authentication device that can use the remote access management device 500. It is assumed that identification data such as a device ID and a telephone number for identifying the mobile phone 520 is stored in advance in a storage device such as the data storage unit 504 included in the remote access management device 500.

  When the mobile phone 520 that has transmitted the key pair generation request is an available authentication device, the key generation unit 503 transmits the secret key 521a from the auxiliary communication unit 502 to the mobile phone 520, and the mobile phone 520 Stores the received secret key 521 a in the memory 521.

  It is assumed that communication between the mobile phone 520 and the auxiliary communication unit 502 is performed using a communication channel such as a mobile phone network with relatively little risk of eavesdropping.

  Next, the PC 540 acquires the private key 521a and the user certificate 121a stored in the memory 521 of the mobile phone 520, and encrypts the user certificate 121a using the private key 521a.

  Next, the PC 510 transmits the encrypted user certificate 121a to the main communication unit 501 and requests access authentication.

  The main communication unit 501 decrypts the encrypted user certificate 121a transmitted from the PC 510 using the public key 504a stored in the data storage unit 504, and uses the decrypted user certificate 121a. , Access authentication from the PC 510 is performed.

  It is assumed that an arbitrary authentication method that can use the public key method is used for the access authentication performed by the main communication unit 501.

  When the access authentication is successful, the main communication unit 501 forms a VPN with the PC 510 as in the first embodiment. After the access authentication, the PC 510 communicates with the main communication unit 501 via this VPN, remotely connects to the PC 340 using the VNC, and remotely accesses the mail server 131 by remotely operating the PC 340. Since the subsequent remote access operation to the mail server 131 is the same as that in the first embodiment, the description thereof is omitted.

  Next, the operation after access authentication will be described.

  First, the operation in the remote access management device 500 will be described.

  After the access authentication, the main communication unit 501 uses the key generation unit 503 to generate a new key pair every time the amount of data communicated with the PC 510 reaches a certain amount.

  Every time a new key pair (secret key 521b and public key 504b) is generated, the key generation unit 503 transmits the secret key 521b from the auxiliary communication unit 502 to the mobile phone 520 and is stored in the data storage unit 504. The existing public key 504a is updated to the public key 504b.

  After that, the main communication means 501 transmits the user certificate 121a encrypted with the private key 521b from the PC 510 even if the preset waiting time elapses after the counted data amount reaches a certain amount. If not, the communication with the PC 510 is terminated.

  Next, operations in PC 510 and mobile phone 520 will be described.

  After the access authentication, the mobile phone 520 updates the secret key 521a stored in the memory 521 to the received secret key 521b every time the secret key 521b is received from the auxiliary communication unit 502.

  The PC 510 counts the amount of data communicated with the main communication means 501, and every time the counted data amount reaches a certain amount, the secret key 521a stored in the memory 521 of the mobile phone 520 is updated to the secret secret 521b. Make sure that

  If the secret key 521a has been updated, the PC 510 encrypts the access authentication information 121a using the secret key 521b, transmits it to the main communication means 501, and requests access authentication again.

  If the secret key 521a has not been updated, the PC 510 determines that an abnormality has occurred in communication with the main communication unit 501 and ends the communication.

  Note that the remote access management apparatus 100 (or 500) of the present invention, in addition to the one realized by dedicated hardware as described above, stores a program for realizing its function in the remote access management apparatus 100 (or 500). The remote access management device 100 (or 500) may read and execute the program recorded on the recording medium that can be read by the remote access management device. The recording medium readable by the remote access management device 100 (or 500) includes a recording medium such as a floppy disk, a magneto-optical disk, and a CD-ROM, and a hard disk device built in the remote access management device 100 (or 500). Refers to a storage device. Furthermore, the recording medium readable by the remote access management apparatus 100 (or 500) is dynamically stored in the remote access management apparatus 100 (or 500) for a short period of time as in the case of transmitting a program via the Internet. Such as a volatile memory that holds a program for a certain period of time.

  The present invention can be used for the purpose of transmitting authentication information to an information processing server.

It is a block diagram which shows the structure of the authentication information transmission system of the 1st Embodiment of this invention. It is a flowchart explaining operation | movement of the authentication process in the authentication information transmission system shown in FIG. It is a block diagram which shows the structure of the authentication information transmission system of the 2nd Embodiment of this invention. It is a flowchart explaining operation | movement of the authentication process in the authentication information transmission system shown in FIG. It is a block diagram which shows the structure of the authentication information transmission system of the 3rd Embodiment of this invention. 6 is a flowchart for explaining the operation of access authentication processing in the remote access management device shown in FIG. 5. 6 is a flowchart for explaining an operation of access authentication processing in the access terminal and the authentication device shown in FIG. 5.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Remote access management apparatus 101 Main communication means 102 Auxiliary communication means 110 Access terminal 120 Authentication apparatus 121 Access data storage means 121a Information for access authentication 122 Input means 123 First communication means 124 Second communication means 130 Server group 131 Mail server 132 WWW server 140 Authentication information 340 Access relay means 500 Remote access management device 501 Main communication means 502 Auxiliary communication means 503 Key generation means 504 Data storage means 504a, 504b Public key 510 Access terminal 520 Authentication device 521 Access data Storage means 521a, 521b Private key 522 Input means 523 First communication means 524 Second communication means

Claims (10)

An authentication information transmission system for transmitting authentication information to an information processing server targeted for remote access,
An access terminal for remotely accessing the information processing server;
An authentication device that can input the authentication information and does not include a key logger;
Auxiliary communication means for acquiring the authentication information from the authentication device, relaying data communicated between the access terminal and the information processing server, and the authentication information acquired by the auxiliary communication means, An authentication information transmission system comprising: a remote access management device comprising: main communication means for converting data received from an access terminal into the same format as that of data received from the access terminal and transmitting the data to the information processing server.   The authentication information transmission according to claim 1, wherein the remote access management device uses different communication paths for communication between the main communication unit and the access terminal and communication between the auxiliary communication unit and the authentication device. system.   Remote access to the information processing server is performed between the main communication means and the information processing server, and executes remote access to the information processing server based on operation data received from the access terminal via the main communication means. The authentication information transmission system according to claim 1, further comprising an access relay unit that transmits the screen data received from the information processing server to the access terminal via the main communication unit.   The authentication device includes the access data storage unit that stores the authentication information in advance, and is stored in the access data storage unit in response to a transmission request for the authentication information from the information processing server. The authentication information transmission system according to claim 1, wherein the authentication information is transmitted to the auxiliary communication unit. The remote access management device is:
A secret key and a public key for encrypting and decrypting access authentication information used for access authentication for authenticating access from the access terminal are generated, and the secret key is generated from the auxiliary communication means to the authentication device. A key generation means for transmitting to
Data storage means for storing the public key;
The authentication device stores the access authentication information and the secret key transmitted from the auxiliary communication unit in the access data storage unit,
The access terminal encrypts the access authentication information using the secret key stored in the access data storage means and transmits the encrypted information to the main communication means,
The main communication means decrypts the encrypted access authentication information transmitted from the access terminal using the public key stored in the data storage means, and After the access authentication, every time the amount of data communicated with the access terminal reaches a certain amount, a new secret key and a public key are generated using the key generation means, and the new secret key is generated. A key is transmitted from the auxiliary communication means to the authentication device, and the public key stored in the data storage means is updated to the new public key,
The authentication device updates the secret key stored in the access data storage means to the new secret key transmitted from the auxiliary communication means,
After the access authentication, the access terminal uses the new secret key to update the access authentication when the secret key is updated each time the amount of data communicated with the main communication means reaches the predetermined amount. Information for encryption is transmitted to the main communication means, and if the secret key has not been updated, the communication with the main communication means is terminated,
The main communication means transmits the access authentication information encrypted from the access terminal within a predetermined waiting time after the amount of data communicated with the access terminal reaches the predetermined amount. The access authentication from the access terminal is performed again, and the encrypted access authentication information is not transmitted from the access terminal even when the waiting time elapses. The authentication information transmission system according to claim 4, wherein communication with the access terminal is terminated. The authentication device is a mobile phone,
The authentication information transmission system according to claim 1, wherein the auxiliary communication unit uses a mobile phone network as a communication path with the authentication device. A remote access management device for relaying authentication information to a remote access target information processing server,
Auxiliary communication means capable of inputting the authentication information and obtaining the authentication information from an authentication device not equipped with a key logger;
While relaying data communicated between the information processing server and the access terminal that remotely accesses the information processing server, the authentication information acquired by the auxiliary communication means is the same as the data received from the access terminal And a main communication means for converting to a format and transmitting to the information processing server.   The remote access management apparatus according to claim 7, wherein different communication paths are used for communication between the main communication unit and the access terminal and communication between the auxiliary communication unit and the authentication device. An authentication information relay method performed by a remote access management device for relaying authentication information to an information processing server targeted for remote access,
Obtaining the authentication information from an authentication device capable of inputting the authentication information and not including a key logger;
Relaying data communicated between the information processing server and the access terminal that remotely accesses the information processing server, and converting the acquired authentication information into the same format as the data received from the access terminal, And a step of transmitting to the information processing server. In the remote access management device for relaying authentication information to the remote access target information processing server,
A procedure for acquiring the authentication information from an authentication device that can input the authentication information and does not include a key logger;
Relaying data communicated between the information processing server and the access terminal that remotely accesses the information processing server, and converting the acquired authentication information into the same format as the data received from the access terminal, An authentication information relay program that executes a procedure for transmission to an information processing server.

Images