JP2010277144A - User authentication system, user terminal, log authentication server, user authentication method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce the burden on a user during user authentication and the operating cost of a service provider. <P>SOLUTION: A user terminal 1 includes a storage unit 10 that stores an access log including information on services used by a user after user authentication, a service request unit 11 that sends a network connection request to a log authentication server 2, and an access log response unit 12 that responds to a response request from the log authentication server 2 based on the access log stored in the storage unit 10. The log authentication server 2 includes a storage unit 20 storing an access log for every user, a response request unit 21 providing a predetermined response request to the user terminal 1, and a log authentication unit 22 that performs user authentication by determining whether or not the response from the user terminal 1 satisfies the condition requested in the response request, based on the access log of the user of the user terminal 1 stored in the storage unit 20. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a technique for authenticating a user who intends to use a network service from an access log recorded when the network service provider or network administrator used the previous network service in a network system.

  In recent years, leakage of confidential information due to unauthorized access has become a problem. For example, if various confidential information held by a company is leaked to the outside, a large amount of money must be borne for guarantee. Furthermore, there is a high probability that public trust will be lost in an instant. Therefore, authentication during network access becomes very important.

In conventional user authentication, a user terminal is often specified by a user ID and a password transmitted from the user terminal.
As a user authentication method that does not use a password, there is a user authentication method that uses a digital signature (for example, see Non-Patent Document 1). In the user authentication method using the digital signature, the digital signature distributed from the network service provider is stored in the user terminal. In the next user authentication, the user terminal presents the digital signature to the device on the network service provider side. The device on the network service provider side verifies the presented digital signature and identifies the user terminal.

Transport Layer Security (TLS) Protocol Version 1.1, Request For Comment (RFC) 4346, Internet Engineering Task Force (IETF), <http: // www. ietf. org / rfc / rfc4346. txt>, 2006

  In the case of a user authentication method using a password, if a short character string password is set, there is a risk that a third party will impersonate the user by analogizing the password. Therefore, in order to ensure the safety of user authentication using a password, it is necessary to periodically update the password, and the user has to store a new password each time. It is a heavy burden for the user to periodically update and store the password in this manner.

  On the other hand, since the user authentication method using a digital signature has a lower risk of impersonation than the authentication method using a password, the level of security can be improved. Moreover, since it is not necessary for the user to memorize, the burden on the user is small. However, since an expiration date is generally set for a digital signature, the network service provider must periodically perform digital signature reissuance processing for all users, which increases the operation cost. there were.

  The present invention has been made in order to solve the above-described problems, and is a user authentication system, a user terminal, a log authentication server, a user authentication method, and a user authentication system that can reduce the burden on the user and the operation cost of the service provider in user authentication. The purpose is to provide a program.

  The user authentication system of the present invention includes a user terminal that makes a service use request and a log authentication server that performs user authentication of the user terminal, and the user terminal includes access information including a service used by the user after the user authentication. A first storage means for storing a log; and a response corresponding to a response request from the log authentication server when the network authentication request is transmitted to the log authentication server for user authentication. And an access log response means based on the access log stored in the storage means, wherein the log authentication server is connected to the network from the second storage means for storing the access log for each user and the user terminal. When a request is received, response request means for making a predetermined response request to the user terminal, and transmitted from the user terminal Log authentication means for performing user authentication by determining whether an answer satisfies a condition requested in the answer request based on an access log of a user of the user terminal stored in the second storage means; It is characterized by having.

Further, in one configuration example of the user authentication system of the present invention, the response request means of the log authentication server randomly lists service information included in the access log of the user of the user terminal that transmitted the network connection request. The response request is transmitted to the user, and the access log response means of the user terminal is included in the list transmitted from the log authentication server based on the access log stored in the first storage means. The information of the service to be sorted is rearranged in time series, the rearranged list is transmitted as the answer to the log authentication server, and the log authentication means of the log authentication server is stored in the second storage means Based on the access log of the user of the user terminal, the service information included in the list transmitted from the user terminal is displayed in time series. The determination to whether Tsu is characterized in that to perform user authentication.
Also, in one configuration example of the user authentication system of the present invention, the response requesting means of the log authentication server includes service information included in the access log of the user of the user terminal that has transmitted the network connection request, and the access log of the user A list of service information included in the access log other than that is sent to the user as the answer request, and the access log response means of the user terminal is stored in the first storage means. Based on the access log, the service information included in the list transmitted from the log authentication server is determined for each information to determine whether the information is registered as an access log, and the determination result is used as the answer to the log authentication server And the log authentication means of the log authentication server transmits the user terminal stored in the second storage means. Of the basis of the access log of the user, is characterized in that for determining to user authenticates whether the correct determination result transmitted from the user terminal.

  Further, the present invention provides the user terminal in a user authentication system including a user terminal that makes a service use request and a log authentication server that performs user authentication of the user terminal, after user authentication by the log authentication server Corresponding to a response request from the log authentication server when storing a storage means for storing an access log including information on a service used by a user and sending a network connection request to the log authentication server for user authentication And an access log response unit that makes an answer based on an access log registered in the storage unit.

  Further, the present invention is the log authentication server in a user authentication system including a user terminal that makes a service use request and a log authentication server that performs user authentication of the user terminal, and is used by a user after user authentication. Storage means for storing an access log including service information for each user, reply request means for making a predetermined reply request to the user terminal when receiving a network connection request from the user terminal, and the user terminal Log authentication means for performing user authentication by determining whether or not an answer transmitted from a request satisfies the condition requested by the answer request based on an access log of the user of the user terminal stored in the storage means It is characterized by having.

  The user authentication method of the present invention includes a network connection request transmission procedure in which a user terminal transmits a network connection request to a log authentication server, and when the log authentication server receives a network connection request from the user terminal. An answer request procedure for making a predetermined answer request to the user terminal and an answer corresponding to the answer request from the log authentication server by the user terminal based on the access log stored in the first storage means The access log response procedure to be performed and whether or not the log authentication server satisfies whether the response transmitted from the user terminal satisfies the condition requested in the response request is stored in the second storage unit And a log authentication procedure for performing user authentication by making a determination based on an access log of a user of the terminal.

The present invention is also a user authentication method in a user authentication system including a user terminal that makes a service use request and a log authentication server that performs user authentication of the user terminal, wherein the user terminal has the log authentication When an attempt is made to receive a user authentication by sending a network connection request to the server, an access log response for performing an answer corresponding to the answer request from the log authentication server based on the access log of the user registered in the storage means A procedure is provided.
The present invention is also a user authentication method in a user authentication system comprising a user terminal that makes a service use request and a log authentication server that performs user authentication of the user terminal, wherein the log authentication server includes the user An answer request procedure for making a predetermined answer request to the user terminal when a network connection request is received from the terminal, and a condition that the log authentication server requests the answer sent from the user terminal in the answer request And a log authentication procedure for performing user authentication by determining whether or not the above condition is satisfied based on the access log of the user of the user terminal stored in the storage means.
The user terminal program of the present invention is characterized by causing a computer to function as each means of the user terminal.
The log authentication server program of the present invention is characterized by causing a computer to function as each means of the log authentication server.

  According to the present invention, the user terminal makes an answer corresponding to the answer request from the log authentication server based on the access log stored in the first storage means, and the log authentication server sends the answer sent from the user terminal. Is determined based on the access log of the user of the user terminal stored in the second storage means to determine whether or not the condition requested by the response request is satisfied. This eliminates the need to periodically change passwords and reissue digital signatures required for user authentication, thereby reducing the operating cost of a service provider or network administrator attempting user authentication. Further, according to the present invention, the user does not need to be aware of the access log update and does not need to store a password or the like, so the burden on the user in user authentication can be reduced. In the present invention, since access logs related to a plurality of services are recorded in the user terminal and the log authentication server, the access logs have various contents, making it difficult for a third party to forge the access logs. Therefore, safe user authentication can be realized. In the present invention, more reliable user authentication can be realized by using an existing authentication technique (password authentication or digital signature authentication) in combination.

  In the present invention, it is possible to prevent a third party from reading the contents of the access log by hashing at least the information of the service used by the user in the access log.

  In the present invention, it is possible to prevent a third party from reading the contents of the access log by encrypting at least information on the service used by the user in the access log.

  Further, in the present invention, by managing the access log by combining the terminal ID, it can be ensured that the access log and the user terminal are associated with each other, so it is possible to prevent spoofing due to theft of the access log.

It is a block diagram which shows the structure of the user authentication system which concerns on the 1st Embodiment of this invention. It is a sequence diagram which shows operation | movement of the user authentication system which concerns on the 1st Embodiment of this invention. It is a block diagram which shows the structure of the user authentication system which concerns on the 2nd Embodiment of this invention. It is a figure which shows the information memorize | stored in the memory | storage part of a user terminal in the user authentication system which concerns on the 2nd Embodiment of this invention. It is a figure which shows the information memorize | stored in the memory | storage part of a log authentication server in the user authentication system which concerns on the 2nd Embodiment of this invention. It is a sequence diagram which shows the operation | movement at the time of log authentication of the user authentication system which concerns on the 2nd Embodiment of this invention. It is a sequence diagram which shows the operation example at the time of access log registration of the user authentication system which concerns on the 2nd Embodiment of this invention. It is a sequence diagram which shows another operation example at the time of access log registration of the user authentication system which concerns on the 2nd Embodiment of this invention. It is a block diagram which shows the structure of the user authentication system which concerns on the 3rd Embodiment of this invention. It is a sequence diagram which shows the operation | movement at the time of log authentication of the user authentication system which concerns on the 3rd Embodiment of this invention. It is a block diagram which shows the structure of the user authentication system which concerns on the 4th Embodiment of this invention. It is a sequence diagram which shows the operation | movement at the time of log authentication of the user authentication system which concerns on the 4th Embodiment of this invention. It is a sequence diagram which shows the operation | movement at the time of log authentication of the user authentication system which concerns on the 5th Embodiment of this invention. It is a sequence diagram which shows the operation | movement at the time of log authentication of the user authentication system which concerns on the 6th Embodiment of this invention. It is a sequence diagram which shows the operation | movement at the time of log authentication of the user authentication system which concerns on the 7th Embodiment of this invention. It is a block diagram which shows the structure of the user authentication system which concerns on the 8th Embodiment of this invention. It is a block diagram which shows the structure of the user authentication system which concerns on the 9th Embodiment of this invention. It is a block diagram which shows the structure of the user authentication system which concerns on the 10th Embodiment of this invention. It is a block diagram which shows the structure of the service server which concerns on the 11th Embodiment of this invention. It is a sequence diagram which shows the operation | movement at the time of the access log registration of the user authentication system which concerns on the 11th Embodiment of this invention. It is a block diagram which shows the structure of the user authentication system which concerns on the 12th Embodiment of this invention.

[First Embodiment]
Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing the configuration of the user authentication system according to the first embodiment of the present invention.
The user authentication system responds to a service use request from a user terminal 1 that makes a service use request, a log authentication server 2 that performs user authentication of the user terminal 1, and a user terminal 1 that has received user authentication by the log authentication server 2. A service server 3 that provides a service to the user terminal 1, and a network 4 that connects the user terminal 1, the log authentication server 2, and the service server 3 to each other.

  The user terminal 1 includes a storage unit 10 that stores an access log including information on services used by the user after user authentication, a service request unit 11 that transmits a network connection request to the log authentication server 2, and a log authentication server 2 And an access log response unit 12 that performs an answer corresponding to the response request based on the access log stored in the storage unit 10. The access log stored in the storage unit 10 is updated every time the user of the user terminal 1 uses a service provided from the service server 3.

  The log authentication server 2 includes a storage unit 20 that stores an access log for each user, an answer request unit 21 that makes a predetermined answer request to the user terminal 1 when receiving a network connection request from the user terminal 1, A log for performing user authentication by determining whether an answer transmitted from the user terminal 1 satisfies a condition requested by the answer request based on an access log of the user of the user terminal 1 stored in the storage unit 20 And an authentication unit 22. Similar to the user terminal 1, the access log stored in the storage unit 20 is updated each time the user of the user terminal 1 uses a service provided from the service server 3.

Next, the operation of the user authentication system of this embodiment will be described with reference to FIG. The service request unit 11 of the user terminal 1 who wants to use the service provided by the service server 3 on the network 4 transmits a network connection request message to the log authentication server 2 (step S1).
When the response request unit 21 of the log authentication server 2 receives the network connection request message from the user terminal 1, the response request unit 21 transmits a response request message for making a predetermined response request to the requesting user terminal 1 (step S2). .

When the service request unit 11 of the user terminal 1 receives the response request message from the log authentication server 2, it passes this response request message to the access log response unit 12. The access log response unit 12 creates an answer message corresponding to the answer request message based on the access log stored in the storage unit 10 and passes it to the service request unit 11 (step S3).
The service request unit 11 transmits the reply message passed from the access log response unit 12 to the log authentication server 2 (step S4).

The log authentication unit 22 of the log authentication server 2 determines whether or not the answer message transmitted from the user terminal 1 satisfies the condition requested by the answer request message, and the user of the user terminal 1 stored in the storage unit 20. Based on the access log (step S5). When the answer message transmitted from the user terminal 1 satisfies the condition requested by the answer request message, the log authentication unit 22 determines that the user of the user terminal 1 is a valid user.
If the user authentication is successful, the log authentication unit 22 transmits a network connection response message to the user terminal 1 (step S6).

  In the present embodiment, the user access log is information unique to the user and is updated each time the user accesses without being aware of the user, and is always in the latest state. In the present embodiment, the user terminal 1 makes an answer corresponding to the answer request from the log authentication server 2 based on the access log stored in the storage unit 10, and the log authentication server 2 is transmitted from the user terminal 1. The user authentication is performed by determining whether or not the answer satisfies the condition requested in the answer request based on the access log of the user of the user terminal 1 stored in the storage unit 20. Since it is no longer necessary to periodically change passwords and reissue digital signatures, which was necessary for conventional user authentication, the operating costs of service providers or network administrators who perform user authentication can be reduced. . In the present embodiment, the user does not need to be aware of the access log update and does not need to store a password or the like, so that the burden on the user in user authentication can be reduced. In this embodiment, since access logs related to a plurality of services are recorded in the user terminal 1 and the log authentication server 2, the access logs have various contents, making it difficult for a third party to forge the access logs. Therefore, secure user authentication can be realized.

[Second Embodiment]
Next, a second embodiment of the present invention will be described. FIG. 3 is a block diagram showing the configuration of the user authentication system according to the second embodiment of the present invention. In the present embodiment, the first embodiment will be described more specifically.
The user authentication system includes a user terminal 100, a log authentication server 200, a service server 300, and a network 400 that connects the user terminal 100, the log authentication server 200, and the service server 300 to each other.

As illustrated in FIG. 3, the user terminal 100 includes a service request unit 101, a log registration unit 102, a log extraction unit 103 serving as an access log response unit, and a storage unit 104.
The user terminal 100 is connected to the network 400 by wire or wireless and has a function of transmitting and receiving data. Further, the user terminal 100 records the service used by the user terminal 100 in the access log. Further, the user terminal 100 has a function of extracting and transmitting an access log corresponding to the request when an access log is requested from the log authentication server 200. Each user terminal 100 is given a terminal ID that can uniquely identify the terminal.

  FIG. 4 is a diagram illustrating information stored in the storage unit 104 of the user terminal 100. The storage unit 104 of the user terminal 100 stores a user ID (UID) for uniquely identifying the user of the user terminal 100, a terminal ID (TID), and an access log (LOG). The user ID is a user ID for the log authentication server 200. The user ID for each service server 200 is unified with the user ID for the log authentication server 200. The access log is a log in which a list of services used by the user terminal 100 after user authentication is recorded. Specific examples of the items of the access log include the time when the user terminal 100 accesses, the URL (Uniform Resource Locators) of the access destination, and the like.

As illustrated in FIG. 3, the log authentication server 200 includes a request relay unit 201, a log registration unit 202, a log authentication unit 203, and a storage unit 204. The request relay unit 201 and the log authentication unit 203 constitute an answer request unit.
The log authentication server 200 is a server that processes user authentication of the user terminal 100 that uses a service provided by the service server 300 on the network 400. The log authentication server 200 has a proxy function, manages a session of the user terminal 100 after user authentication, and has a function of recording an access log to the service server 300.

FIG. 5 is a diagram showing information stored in the storage unit 204 of the log authentication server 200. In the storage unit 204 of the log authentication server 200, a user ID (UID _server ) for uniquely identifying a user of the managed user terminal 100, a terminal ID (TID _server ) of the managed user terminal 100, and The access log (LOG _server ) of the managed user terminal is stored in association with each user. In the present embodiment, retention of the terminal ID is not an essential constituent requirement. When the log authentication server 200 holds the terminal ID, the network administrator needs to register the terminal ID in the log authentication server 200 in advance offline. Note that the access log recorded / held by the user terminal 100 and the access log related to the user terminal 100 recorded / held by the log authentication server 200 may not completely match. For example, there may be a time lag between the user terminal 100 and the log authentication server 200.

As illustrated in FIG. 3, the service server 300 includes a service providing unit 301 and a user authentication request unit 302.
The service server 300 is a server that provides various services via the network 400 to the user terminal 100 that has received user authentication by the log authentication server 200. Further, the service server 300 has a function of requesting user authentication to the log authentication server 200 as necessary when there is an access from the user terminal 100 that has not received user authentication.

Next, the operation of the user authentication system of this embodiment will be described. FIG. 6 is a sequence diagram showing an operation at the time of log authentication of the user authentication system.
The service request unit 101 of the user terminal 100 that wants to use the service provided by the service server 300 on the network 400 first transmits a network connection request message to the log authentication server 200 (step S100).

When the request relay unit 201 of the log authentication server 200 receives a network connection request message from the user terminal 100, the request relay unit 201 transmits a message requesting a user ID and information regarding an access log to the requesting user terminal 100 ( Step S101).
When the service request unit 101 of the user terminal 100 receives a request message from the log authentication server 200, the service request unit 101 requests the log extraction unit 103 to acquire a user ID and an access log. Upon receiving this request, the log extraction unit 103 acquires the user ID and access log from the storage unit 104 and passes them to the service request unit 101 (step S102).

The service request unit 101 transmits a log authentication request message including the user ID and the access log passed from the log extraction unit 103 to the log authentication server 200 (step S103).
When receiving the log authentication request message from the user terminal 100, the request relay unit 201 of the log authentication server 200 extracts the user ID and the access log from the log authentication request message and passes them to the log authentication unit 203 for matching the access logs. Request sex determination (user authentication). The log authentication unit 203 compares the access log of the user terminal 100 passed from the request relay unit 201 with the access log of the user terminal 100 stored in the storage unit 204 to perform user authentication (step S104). ).

In the present embodiment, the user terminal 100 transmits all held access logs to the log authentication server 200.
The log authentication unit 203 refers to the storage unit 204 based on the user ID passed from the request relay unit 201, acquires an access log corresponding to the user ID, and passes the acquired access log and the request relay unit 201. The access log transmitted from the user terminal 100 is consistent with the access log of the user terminal 100 stored in the storage unit 204. The user of the user terminal 100 is determined to be a valid user.

  As described above, the access time included in the access log may be shifted between the user terminal 100 and the log authentication server 200. Therefore, the log authentication unit 203 determines that the difference between the access time included in the access log of the user terminal 100 and the access time included in the access log of the user terminal 100 stored in the storage unit 204 is within a predetermined allowable time range. If this is the case, it is determined that this deviation is allowed and the contents of the access logs match. A condition relating to the determination of whether the access log is consistent within a range of time deviation is stored in advance in the storage unit 204 of the log authentication server 200. The log authentication unit 203 determines whether the access log transmitted from the user terminal 100 and the access log of the user terminal 100 stored in the storage unit 204 of the log authentication server 200 are consistent according to this condition. . It goes without saying that the access destination URL included in the access log is a matching condition that it is completely matched.

If the access logs match and the user authentication is successful, the request relay unit 201 transmits a network connection response message to the user terminal 100 (step S105).
Next, the operation at the time of access log registration after network connection will be described with reference to FIG. After receiving the network connection response message from the log authentication server 200, the service request unit 101 of the user terminal 100 that intends to use the service provided by the service server 300 requests the log registration unit 102 to register the access log. . Upon receiving this request, the log registration unit 102 registers an access log including the current time (access time) and the access destination URL indicating the location of the service to be used in the storage unit 104 (step S110).

Subsequently, the service request unit 101 transmits a service use request message including the registered access time, access destination URL, and user ID stored in the storage unit 104 to the log authentication server 200 (step S111). .
When receiving the service use request message from the user terminal 100, the request relay unit 201 of the log authentication server 200 extracts the access time, the access destination URL, and the user ID from the service use request message and passes them to the log registration unit 202. . The log registration unit 202 registers the access log including the access time and the access destination URL in association with the user ID in the storage unit 204 (step S112).

Subsequently, the request relay unit 201 performs proxy processing, that is, processing for transferring the service use request message received from the user terminal 100 to the service server 300 (steps S113 and S114).
When the service providing unit 301 of the service server 300 receives the service use request message from the log authentication server 200, the service providing unit 301 sends the service requested by the service use request message to the user via the request relay unit 201 of the log authentication server 200. This is provided to the terminal 100 (steps S115, S116, S117).

  In the example of FIG. 7, the log authentication server 200 registers the access log included in the service use request message from the user terminal 100, but the access log corresponding to the response from the service server 300 is stored in the log authentication server 200. And the user terminal 100 may be registered. FIG. 8 is a sequence diagram showing the operation at the time of such registration.

  The processes in steps S120, S121, S122, and S123 in FIG. 8 are the same as steps S111, S113, S114, and S115 in FIG. The request relay unit 201 of the log authentication server 200 relays the service provided from the service server 300 and provides it to the user terminal 100 (steps S124 and S126). At this time, the request relay unit 201 passes the access time, the access destination URL, and the user ID extracted from the service use request message transmitted in step S120 to the log registration unit 202. The log registration unit 202 registers the access log including the access time and the access destination URL and the user ID in the storage unit 204 in association with each other (step S125).

When service provision from the service server 300 is started, the service request unit 101 of the user terminal 100 requests the log registration unit 102 to register an access log. Upon receiving this request, the log registration unit 102 registers an access log including the access time and the access destination URL transmitted in step S120 in the storage unit 104 (step S127).
As described above, in the present embodiment, the effects described in the first embodiment can be obtained.

  In the present embodiment, the matching condition is that the access log transmitted from the user terminal 100 and the access log of the user terminal 100 stored in the storage unit 204 of the log authentication server 200 completely match. However, instead of using such an all-matching method, a partial matching method, a time series rearrangement method, a URL errata table method, or a combination thereof, for example, time series rearrangement is used. A method and a URL errata table method can be used in combination. Needless to say, all these matching checks are automatically processed.

  When the partial match method is used, the log authentication unit 203 of the log authentication server 200 includes an access log transmitted from the user terminal 100 and an access log of the user terminal 100 stored in the storage unit 204 of the log authentication server 200. If part of the contents match, it is determined that the access logs are consistent. Also in this case, the log authentication unit 203 determines that the difference between the access time included in the access log of the user terminal 100 and the access time included in the access log of the user terminal 100 stored in the storage unit 204 is a predetermined allowable time. In the range, it is assumed that the contents of the access logs match. The partial match of contents means that, for example, if a predetermined number of access logs match, it is determined that the access logs are consistent.

  In the case of the partial match method, it is determined that the access log matches if any part of the content of the access log matches, or the access log is consistent if the time difference is within the range. The condition relating to the determination as to whether or not it is determined is stored in the storage unit 204 of the log authentication server 200 in advance. The log authentication unit 203 determines whether the access log transmitted from the user terminal 100 and the access log of the user terminal 100 stored in the storage unit 204 of the log authentication server 200 are consistent according to this condition. .

When the time series rearrangement method is used, the service request unit 101 of the user terminal 100 transmits a log authentication request message including the user ID to the log authentication server 200.
The request relay unit 201 of the log authentication server 200 extracts the user ID from the received log authentication request message and passes it to the log authentication unit 203. The log authentication unit 203 refers to the storage unit 204 based on the user ID passed from the request relay unit 201, acquires an access log corresponding to the user ID, and all access destination URLs included in the acquired access log Alternatively, a part of access destination URLs is listed in a state in which the time series are separated and passed to the request relay unit 201. The request relay unit 201 transmits the list of access destination URLs to the user terminal 100 that is the log authentication request source.

  The service request unit 101 of the user terminal 100 passes the received list to the log extraction unit 103. Based on the access log stored in the storage unit 104, the log extraction unit 103 rearranges the access destination URLs included in the received list in time series. The service request unit 101 transmits the sorted list to the log authentication server 200.

  The request relay unit 201 of the log authentication server 200 passes the list received from the user terminal 100 to the log authentication unit 203. The log authentication unit 203 refers to the storage unit 204 based on the user ID extracted from the log authentication request message, acquires an access log corresponding to the user ID, and is passed from the access log and the request relay unit 201 The list is collated, and if the access destination URL included in the list received from the user terminal 100 is in time series, it is determined that the access logs are consistent. In this way, the consistency of the access log can be determined using the time series rearrangement method.

When the URL errata method is used, the service request unit 101 of the user terminal 100 transmits a log authentication request message including the user ID to the log authentication server 200.
The request relay unit 201 of the log authentication server 200 extracts the user ID from the received log authentication request message and passes it to the log authentication unit 203. The log authentication unit 203 refers to the storage unit 204 based on the user ID passed from the request relay unit 201, acquires an access log corresponding to the user ID, and has another user ID different from the user ID. Access logs of other user terminals are acquired, a list in which some access destination URLs included in these access logs are mixed is created and passed to the request relay unit 201. The request relay unit 201 transmits the list of access destination URLs to the user terminal 100 that is the log authentication request source.

  The service request unit 101 of the user terminal 100 passes the received list to the log extraction unit 103. Based on the access log stored in the storage unit 104, the log extraction unit 103 determines for each access destination URL whether the access destination URL included in the received list is registered as an access log. The service request unit 101 transmits the determination result for each access destination URL to the log authentication server 200.

  The request relay unit 201 of the log authentication server 200 passes the determination result received from the user terminal 100 to the log authentication unit 203. The log authentication unit 203 refers to the storage unit 204 based on the user ID extracted from the log authentication request message, acquires an access log corresponding to the user ID, and is passed from the access log and the request relay unit 201 The determination result is collated to determine whether the determination result of the user terminal 100 is correct. The log authentication unit 203 correctly determines that the access destination URL extracted from the access log of the user terminal 100 as the log authentication request source is included in the access log of the user terminal 100, and extracts it from the access logs of other user terminals 100. If it is correctly determined that the access destination URL is not included in the access log of the user terminal 100 of the log authentication request source, it is determined that the access logs are consistent. Thus, the consistency of the access log can be determined using the URL errata table method.

  In the URL errata table method, when the log authentication unit 203 creates a list, the access log mixed in the list may not be an access log of another user terminal. For example, a dummy access log (URL) is listed. May be mixed. However, the access log mixed in the list needs to have the URL of the access destination (that is, provide a service). The reason is that the dummy access destination URL is not easily determined to be incorrect.

Further, in the case of the time series rearrangement method and the URL errata table method, conditions relating to determination such as how many access destination URLs are listed are stored in advance in the storage unit 204 of the log authentication server 200.
As described above, in all of the case matching method, the part matching method, the time series sorting method, and the URL errata table method, conditions regarding determination are stored in advance in the storage unit 204 of the log authentication server 200. This condition may be defined for each user, for each set of user and user terminal, for each service, or for each combination thereof.

  In the present embodiment and subsequent embodiments, when a trouble such as communication disconnection occurs, the access log registered in the user terminal 100 is not registered in the log authentication server 200 depending on the timing of the trouble. The situation happens. Even in such a case, when the time series rearrangement method or the URL errata method is used in log authentication, the access log to be subject to log authentication is selected from the access logs possessed by the log authentication server 200. Therefore, even if the access log registered in the user terminal 100 is not registered in the log authentication server 200, the authentication is not affected. Therefore, when the reliability of the network between the user terminal 100 and the log authentication server 200 is low, trouble can be avoided by taking a measure of using the time series rearrangement method or the URL errata table method.

  Further, in a situation where the access log registered in the user terminal 100 is not registered in the log authentication server 200, when the partial match method is used, the access log that should be correct in the user terminal 100 is the log authentication. A situation occurs in which the server 200 determines that it is not correct. In this case, a rule is set such that if the access log held by the log authentication server 200 is all included in the access log sent from the user terminal 100, the authentication is determined to be OK. Thus, trouble can be avoided.

  In this embodiment, the amount of access log to be transmitted is not described, but the access log from the previous user authentication to immediately before the current user authentication is transmitted to the log authentication server 200. Alternatively, an access log from when the user terminal 100 accesses the service server 300 for the first time until immediately before the current user authentication may be transmitted to the log authentication server 200. When the access log from the previous user authentication to immediately before the current user authentication is transmitted to the log authentication server 200, whether the access log necessary for the user authentication has been sufficiently collected by both the user terminal 100 and the log authentication server 200 A function of determining In order to determine whether the access log necessary for user authentication has been sufficiently collected by both the user terminal 100 and the log authentication server 200, for example, when the log authentication server 200 transmits a message requesting an access log to the user terminal 100 , Information on the condition that “the number of access logs is N or more” is stored in the message, and log authentication is performed to determine whether or not the access log transmitted from the user terminal 100 in accordance with this information satisfies the condition that the number is N or more. The server 200 may determine. In addition, when the access log from when the user terminal 100 first accesses the service server 300 to immediately before the current user authentication is transmitted to the log authentication server 200, the access log can be enormous, so the access log is compressed. Then, it may be transmitted to the log authentication server 200.

  Further, the log authentication server 200 may leave only the latest N access logs for each user terminal 100 in the storage unit 204, or may access logs for a predetermined period such as the last month for each user terminal 100. May be left in the storage unit 204. Similarly, the user terminal 100 may leave only the N access logs from the latest in the storage unit 104, or leave only the access logs for a predetermined period such as the last month in the storage unit 104. Also good.

  Note that the access destination in the first and second embodiments and the following embodiments refers to the URL of the access destination regardless of the service server. Therefore, the service server 3,300 may be one or plural. Although the case where there are a plurality of service servers 300 is not described in the present embodiment, the user terminal 100 and the log authentication server 200 may hold the access logs in time series regardless of the service servers. Good.

  Further, the log extraction unit 103 of the user terminal 100 extracts an access log corresponding to a service (access destination URL) to be used from the storage unit 104 and transmits the access log to the log authentication unit 203, and the log authentication unit 203 of the log authentication server 200. When trying to authenticate the user terminal 100, the access log corresponding to the access destination URL included in the service use request message from the user terminal 100 is extracted from the storage unit 204 to determine the consistency of the access log. It may be. However, the access log transmitted from the user terminal 100 to the log authentication server 200 does not need to be limited to only the log of the URL of the service to be used (the service server 300 to be used in the future). For example, when the user terminal 100 wants to use a service of a service server 300, the access log of another service server 300 is transmitted instead of only the access log of the service server 300 to the log authentication server 200. Needless to say.

[Third Embodiment]
Next, a third embodiment of the present invention will be described. FIG. 9 is a block diagram showing a configuration of a user authentication system according to the third embodiment of the present invention. In the present embodiment, the first embodiment will be described more specifically.
The user authentication system according to the present embodiment includes a user terminal 100a, a log authentication server 200a, a service server 300, and a network 400.

The user terminal 100a includes a service request unit 101a, a log registration unit 102a, a log extraction unit 103, a storage unit 104, and a hash calculation unit 105.
The log authentication server 200a includes a request relay unit 201a, a log registration unit 202a, a log authentication unit 203, a storage unit 204, and a hash calculation unit 205. The request relay unit 201a and the log authentication unit 203 constitute an answer request unit.

  The configuration of the service server 300 is the same as that of the second embodiment. This embodiment is different from the second embodiment in that the access destination URL in the access log stored in the storage units 104 and 204 is hash-calculated as described later.

Next, the operation of the user authentication system of this embodiment will be described. FIG. 10 is a sequence diagram showing an operation at the time of log authentication of the user authentication system.
The processing in steps S200, S201, S202, S203, S204, and S205 in FIG. 10 is the same as steps S100, S101, S102, S103, S104, and S105 in FIG. 6 described in the second embodiment. The detailed explanation is omitted.

  The difference from the second embodiment is that the request relay unit 201a of the log authentication server 200a requests information related to the hashed access log to the user terminal 100a in step S201, and the user terminal 100a in steps S202 and S203. The access destination URL in the access log acquired from the storage unit 104 and transmitted to the log authentication server 200a is hash-calculated in advance, and the log authentication unit 203 of the log authentication server 200a checks the consistency of the access log in step S204. The access destination URL in the access log acquired from the storage unit 204 at the time of determination is also pre-hashed.

Next, an operation when registering an access log after connecting to the network will be described. Since the flow of processing at the time of access log registration is the same as that of the second embodiment, it will be described with reference to FIGS.
The difference from the second embodiment is that when the user terminal 100a attempts to register an access log in steps S110 and S127, the access destination URL in the access log is hashed, and log authentication is performed in steps S112 and S125. When the server 200a tries to register an access log, the access destination URL in the access log is hashed.

  The log registration unit 102 a of the user terminal 100 a passes the access destination URL to the hash calculation unit 105 when attempting to register an access log. The hash calculation unit 105 generates a hash value from the access destination URL using a predetermined hash function, and passes it to the log registration unit 102a. The log registration unit 102a registers an access log including the access time and the hash value in the storage unit 104 (Steps S110 and S127).

  The request relay unit 201a of the log authentication server 200a extracts the access time, the access destination URL, and the user ID from the service use request message transmitted from the user terminal 100a and passes them to the log registration unit 202a. The log registration unit 202 a passes the access destination URL to the hash calculation unit 205. The hash calculation unit 205 generates a hash value from the access destination URL using the same hash function as the function used by the hash calculation unit 105 and passes the hash value to the log registration unit 202a. The log registration unit 202a registers the access log including the access time and the hash value and the user ID in the storage unit 204 in association with each other (steps S112 and S125).

  In the present embodiment, the same effects as those of the second embodiment can be obtained. In the present embodiment, the hash value generated from the access log by the user terminal 100a is transmitted to the log authentication server 200a during log authentication, so that the contents of the access log cannot be read by a third party. Can do.

  Also in this embodiment, as an access log consistency determination method, any of the all-match method, partial match method, time-series sorting method, URL errata table method, or a combination thereof is used. For example, a time series rearrangement method and a URL errata table method can be used in combination. Since these methods are the same as those in the second embodiment except that the access destination URL in the access log is hash-calculated, detailed description thereof will be omitted.

[Fourth Embodiment]
Next, a fourth embodiment of the present invention will be described. FIG. 11 is a block diagram showing a configuration of a user authentication system according to the fourth embodiment of the present invention. In the present embodiment, the first embodiment will be described more specifically.
The user authentication system according to the present embodiment includes a user terminal 100b, a log authentication server 200b, a service server 300, and a network 400.

The user terminal 100b includes a service request unit 101b, a log registration unit 102b, a log extraction unit 103, a storage unit 104, and an encryption processing unit 106.
The log authentication server 200b includes a request relay unit 201b, a log registration unit 202b, a log authentication unit 203, a storage unit 204, and an encryption processing unit 206. The request relay unit 201b and the log authentication unit 203 constitute an answer request unit.

  The configuration of the service server 300 is the same as that of the second embodiment. This embodiment is different from the second embodiment in that the access destination URL in the access log stored in the storage units 104 and 204 is encrypted as will be described later.

Next, the operation of the user authentication system of this embodiment will be described. FIG. 12 is a sequence diagram showing an operation at the time of log authentication of the user authentication system.
The processes in steps S300, S301, S302, S303, S304, and S305 in FIG. 12 are the same as steps S100, S101, S102, S103, S104, and S105 in FIG. 6 described in the second embodiment. The detailed explanation is omitted.

  The difference from the second embodiment is that the request relay unit 201b of the log authentication server 200b requests information related to the access log encrypted in step S301 to the user terminal 100b, and the user terminal 100b in steps S302 and S303. The access destination URL in the access log acquired from the storage unit 104 and transmitted to the log authentication server 200b is encrypted in advance, and the log authentication unit 203 of the log authentication server 200b confirms the consistency of the access log in step S304. The access destination URL in the access log acquired from the storage unit 204 at the time of determination is also encrypted in advance.

Next, an operation when registering an access log after connecting to the network will be described. Since the flow of processing at the time of access log registration is the same as that of the second embodiment, it will be described with reference to FIGS.
The difference from the second embodiment is that the access destination URL in the access log is encrypted when the user terminal 100b attempts to register the access log in steps S110 and S127, and log authentication is performed in steps S112 and S125. The point is that the access destination URL in the access log is encrypted when the server 200b attempts to register the access log.

  When registering the access log, the log registration unit 102b of the user terminal 100b acquires the terminal ID from the storage unit 104 and passes the terminal ID and the access destination URL to the encryption processing unit 106. The encryption processing unit 106 generates an encrypted value obtained by encrypting the access destination URL using the terminal ID as a common key, and passes the encrypted value to the log registration unit 102b. The log registration unit 102b registers an access log including the access time and the encryption value in the storage unit 104 (steps S110 and S127).

  The request relay unit 201b of the log authentication server 200b extracts the access time, the access destination URL, and the user ID from the service use request message transmitted from the user terminal 100b and passes them to the log registration unit 202b. The log registration unit 202b refers to the storage unit 204 based on the user ID passed from the request relay unit 201b, extracts the terminal ID corresponding to the user ID, and encrypts the terminal ID and the access destination URL. To 206. The encryption processing unit 206 generates an encrypted value obtained by encrypting the access destination URL using the terminal ID as a common key, and passes the encrypted value to the log registration unit 202b. The log registration unit 202b registers the access log including the access time and the encrypted value and the user ID in the storage unit 204 in association with each other (steps S112 and S125).

  In the present embodiment, the same effects as those of the second embodiment can be obtained. In the present embodiment, the encryption value generated from the access log by the user terminal 100b during log authentication is transmitted to the log authentication server 200b, so that the contents of the access log cannot be read by a third party. Can do.

  Also in this embodiment, as an access log consistency determination method, any of the all-match method, partial match method, time-series sorting method, URL errata table method, or a combination thereof is used. For example, a time series rearrangement method and a URL errata table method can be used in combination. Since these methods are the same as those in the second embodiment except that the access destination URL in the access log is encrypted, detailed description thereof will be omitted.

[Fifth Embodiment]
Next, a fifth embodiment of the present invention will be described. Also in the present embodiment, the configuration of the user authentication system is the same as that of the second embodiment, and will be described using the reference numerals in FIG. In the second embodiment, holding the terminal ID is not an indispensable component, but the present embodiment is different from the second embodiment in that the terminal ID is stored in the storage units 104 and 204. . FIG. 13 is a sequence diagram showing an operation at the time of log authentication of the user authentication system of this embodiment.

The process in step S400 in FIG. 13 is the same as step S100 in FIG. 6 described in the second embodiment.
When the request relay unit 201 of the log authentication server 200 receives a network connection request message from the user terminal 100, the request relay unit 201 sends a message requesting a user ID, a terminal ID, and information regarding an access log to the requesting user terminal 100. Transmit (step S401).

  When the service request unit 101 of the user terminal 100 receives the request message from the log authentication server 200, the service request unit 101 requests the log extraction unit 103 to acquire the user ID, the terminal ID, and the access log. Upon receiving this request, the log extraction unit 103 acquires the user ID, terminal ID, and access log from the storage unit 104 and passes them to the service request unit 101 (step S402).

The service request unit 101 transmits a log authentication request message including the user ID, terminal ID, and access log passed from the log extraction unit 103 to the log authentication server 200 (step S403).
When receiving the log authentication request message from the user terminal 100, the request relay unit 201 of the log authentication server 200 extracts the user ID, the terminal ID, and the access log from the log authentication request message and passes them to the log authentication unit 203. Request access log consistency judgment (user authentication).

The log authentication unit 203 refers to the storage unit 204 based on the user ID and terminal ID passed from the request relay unit 201, acquires an access log corresponding to the user ID and terminal ID, and acquires the acquired access log and request The access log delivered from the relay unit 201 is compared, and when the contents of the access log match, the access log transmitted from the user terminal 100 and the access log of the user terminal 100 stored in the storage unit 204 Are matched and it is determined that the user of the user terminal 100 is a valid user (step S404).
If the access logs match and the user authentication is successful, the request relay unit 201 transmits a network connection response message to the user terminal 100 (step S405).

Next, an operation when registering an access log after connecting to the network will be described. Since the flow of processing at the time of access log registration is the same as that of the second embodiment, it will be described with reference to FIGS.
The difference from the second embodiment is that when the log authentication server 200 tries to register an access log in steps S112 and S125, the access log, the user ID, and the terminal ID are associated and registered in the storage unit 204. It is. That is, when the request relay unit 201 of the log authentication server 200 receives the service use request message from the user terminal 100, the log registration unit 202 extracts the access time, the access destination URL, and the user ID from the service use request message. To pass. The log registration unit 202 refers to the storage unit 204 based on the user ID passed from the request relay unit 201, acquires a terminal ID corresponding to the user ID, and an access log including an access time and an access destination URL The user ID and the terminal ID are associated and registered in the storage unit 204 (steps S112 and S125).

  According to the present embodiment, the same effect as that of the second embodiment can be obtained. Also, in this embodiment, by managing the access log by combining the terminal ID, it can be ensured that the access log and the user terminal are linked, so that it is possible to prevent spoofing due to access log theft. Become.

Also in this embodiment, as an access log consistency determination method, any of the all-match method, partial match method, time-series sorting method, URL errata table method, or a combination thereof is used. For example, a time series rearrangement method and a URL errata table method can be used in combination.
When using the all-matching method or the partial matching method, the log authentication unit 203 of the log authentication server 200 may obtain the user ID transmitted from the user terminal 100 and the access log corresponding to the terminal ID from the storage unit 204. .

When the time series rearrangement method is used, the service request unit 101 of the user terminal 100 transmits a log authentication request message including the user ID and the terminal ID to the log authentication server 200.
The request relay unit 201 of the log authentication server 200 extracts the user ID and terminal ID from the received log authentication request message and passes them to the log authentication unit 203. The log authentication unit 203 refers to the storage unit 204 based on the user ID and terminal ID passed from the request relay unit 201, acquires an access log corresponding to the user ID and terminal ID, and includes the access log in the acquired access log All access destination URLs or some of the access destination URLs are listed in a time-sequential state and passed to the request relay unit 201. The request relay unit 201 transmits the list of access destination URLs to the user terminal 100 that is the log authentication request source.

  The service request unit 101 of the user terminal 100 passes the received list to the log extraction unit 103. Based on the access log stored in the storage unit 104, the log extraction unit 103 rearranges the access destination URLs included in the received list in time series. The service request unit 101 transmits the sorted list to the log authentication server 200.

  The request relay unit 201 of the log authentication server 200 passes the list received from the user terminal 100 to the log authentication unit 203. The log authentication unit 203 refers to the storage unit 204 based on the user ID and terminal ID extracted from the log authentication request message, acquires an access log corresponding to the user ID and terminal ID, and the access log and request relay The list passed from the unit 201 is collated, and if the access destination URL included in the list received from the user terminal 100 is in time series, it is determined that the access logs are consistent. In this way, the consistency of the access log can be determined using the time series rearrangement method.

When the URL errata method is used, the service request unit 101 of the user terminal 100 transmits a log authentication request message including the user ID and the terminal ID to the log authentication server 200.
The request relay unit 201 of the log authentication server 200 extracts the user ID and terminal ID from the received log authentication request message and passes them to the log authentication unit 203. The log authentication unit 203 refers to the storage unit 204 based on the user ID and terminal ID passed from the request relay unit 201 and acquires an access log corresponding to the user ID and terminal ID, and is different from this user ID. Access logs of other user terminals having different user IDs are acquired, a list in which some access destination URLs included in these access logs are mixed is created and passed to the request relay unit 201. The request relay unit 201 transmits the list of access destination URLs to the user terminal 100 that is the log authentication request source.

  The service request unit 101 of the user terminal 100 passes the received list to the log extraction unit 103. Based on the access log stored in the storage unit 104, the log extraction unit 103 determines for each access destination URL whether or not the access destination URL included in the received list is registered as an access log. The service request unit 101 transmits a determination result for each access destination URL to the log authentication server 200.

  The request relay unit 201 of the log authentication server 200 passes the determination result received from the user terminal 100 to the log authentication unit 203. The log authentication unit 203 refers to the storage unit 204 based on the user ID and terminal ID extracted from the log authentication request message, acquires an access log corresponding to the user ID and terminal ID, and the access log and request relay The determination result passed from the unit 201 is collated to determine whether or not the determination result of the user terminal 100 is correct. The log authentication unit 203 correctly determines that the access destination URL extracted from the access log of the user terminal 100 as the log authentication request source is included in the access log of the user terminal 100, and extracts it from the access logs of other user terminals 100. If it is correctly determined that the access destination URL is not included in the access log of the user terminal 100 of the log authentication request source, it is determined that the access logs are consistent. Thus, the consistency of the access log can be determined using the URL errata table method.

[Sixth Embodiment]
Next, a sixth embodiment of the present invention will be described. Also in the present embodiment, the configuration of the user authentication system is the same as that of the third embodiment, and will be described using the reference numerals in FIG. In the third embodiment, holding the terminal ID is not an indispensable component, but the present embodiment is different from the third embodiment in that the terminal ID is stored in the storage units 104 and 204. . FIG. 14 is a sequence diagram showing an operation at the time of log authentication of the user authentication system of the present embodiment.

The process in step S500 in FIG. 14 is the same as step S200 in FIG. 10 described in the third embodiment.
When the request relay unit 201a of the log authentication server 200a receives the network connection request message from the user terminal 100a, the request relay unit 201a sends the user ID, the hashed terminal ID, and information about the access log to the requesting user terminal 100a. The requested message is transmitted (step S501).

  When receiving the request message from the log authentication server 200a, the service request unit 101a of the user terminal 100a requests the log extraction unit 103 to acquire the user ID and the hashed access log. Upon receiving this request, the log extraction unit 103 acquires the user ID and access log from the storage unit 104 and passes them to the service request unit 101a (step S502). As will be described later, this access log includes a hash value generated from the terminal ID and the access destination URL.

The service request unit 101a transmits a log authentication request message including the user ID and the access log passed from the log extraction unit 103 to the log authentication server 200a (step S503).
When receiving the log authentication request message from the user terminal 100a, the request relay unit 201a of the log authentication server 200a extracts the user ID and the access log from the log authentication request message and passes them to the log authentication unit 203 for matching the access logs. Request sex determination (user authentication).

The log authentication unit 203 refers to the storage unit 204 based on the user ID passed from the request relay unit 201a, acquires an access log corresponding to the user ID, and passes the acquired access log and the request relay unit 201a. If the access logs match, the access log transmitted from the user terminal 100a matches the access log of the user terminal 100a stored in the storage unit 204. Then, it is determined that the user of the user terminal 100a is a valid user (step S504). At this time, the access log acquired from the storage unit 204 includes a hash value generated from the terminal ID and the access destination URL as will be described later.
When the access logs match and the user authentication is successful, the request relay unit 201a transmits a network connection response message to the user terminal 100a (step S505).

Next, an operation when registering an access log after connecting to the network will be described. Since the flow of processing at the time of registering the access log is the same as that of the third embodiment, it will be described with reference to FIGS.
The third embodiment is different from the third embodiment in that when the user terminal 100a attempts to register an access log in steps S110 and S127, the terminal ID and the access destination URL in the access log are hashed, and steps S112 and S125. When the log authentication server 200a attempts to register an access log, the terminal ID and the access destination URL in the access log are hashed.

  When registering the access log, the log registration unit 102a of the user terminal 100a acquires the terminal ID from the storage unit 104 and passes the terminal ID and the access destination URL to the hash calculation unit 105. The hash calculation unit 105 generates a hash value from the terminal ID and the access destination URL using a predetermined hash function, and passes the hash value to the log registration unit 102a. The log registration unit 102a registers an access log including the access time and the hash value in the storage unit 104 (Steps S110 and S127).

  The request relay unit 201a of the log authentication server 200a extracts the access time, the access destination URL, and the user ID from the service use request message transmitted from the user terminal 100a and passes them to the log registration unit 202a. The log registration unit 202a refers to the storage unit 204 based on the user ID passed from the request relay unit 201a, acquires the terminal ID corresponding to the user ID, and is passed from the acquired terminal ID and the request relay unit 201a. The access destination URL is passed to the hash calculation unit 205. The hash calculation unit 205 generates a hash value from the terminal ID and the access destination URL using the same hash function as the function used by the hash calculation unit 105 and passes the hash value to the log registration unit 202a. The log registration unit 202a registers the access log including the access time and the hash value and the user ID in the storage unit 204 in association with each other (steps S112 and S125).

  In the present embodiment, the same effect as that of the third embodiment can be obtained. Also in the present embodiment, as the access log consistency determination method, any of the all-matching method, the partial matching method, the time-series sorting method, and the URL errata table method can be used. Since these methods are the same as those in the second embodiment except that the terminal ID and the access destination URL are hash-calculated, detailed description thereof will be omitted.

[Seventh Embodiment]
Next, a seventh embodiment of the present invention will be described. Also in the present embodiment, the configuration of the user authentication system is the same as that of the fourth embodiment, and will be described using the reference numerals in FIG. In the fourth embodiment, holding the terminal ID is not an indispensable component, but the present embodiment is different from the fourth embodiment in that the terminal ID is stored in the storage units 104 and 204. . FIG. 15 is a sequence diagram showing an operation at the time of log authentication of the user authentication system of the present embodiment.

The processing in step S600 in FIG. 15 is the same as that in step S300 in FIG. 12 described in the fourth embodiment.
When the request relay unit 201b of the log authentication server 200b receives a network connection request message from the user terminal 100b, the request relay unit 201b encrypts the request source user terminal 100b using the user ID and the public key of the log authentication server 200b. A message requesting information on the converted terminal ID and access log is transmitted (step S601).

  When receiving the request message from the log authentication server 200b, the service request unit 101b of the user terminal 100b requests the log extraction unit 103 to acquire the user ID and the encrypted access log. Upon receiving this request, the log extraction unit 103 acquires the user ID and the access log from the storage unit 104 and passes them to the service request unit 101b (step S602). As will be described later, this access log includes an encrypted value obtained by encrypting the terminal ID and the access destination URL.

The service request unit 101b transmits a log authentication request message including the user ID and the access log passed from the log extraction unit 103 to the log authentication server 200b (step S603).
When receiving the log authentication request message from the user terminal 100b, the request relay unit 201b of the log authentication server 200b extracts the user ID and the access log from the log authentication request message and passes them to the log authentication unit 203 to match the access logs. Request sex determination (user authentication).

The log authentication unit 203 refers to the storage unit 204 based on the user ID passed from the request relay unit 201b, acquires an access log corresponding to the user ID, and passes the acquired access log and the request relay unit 201b. If the access log contents match, the access log transmitted from the user terminal 100b matches the access log of the user terminal 100b stored in the storage unit 204. Then, it is determined that the user of the user terminal 100b is a valid user (step S604). At this time, the access log acquired from the storage unit 204 includes an encrypted value obtained by encrypting the terminal ID and the access destination URL as will be described later.
When the access logs match and the user authentication is successful, the request relay unit 201b transmits a network connection response message to the user terminal 100b (step S605).

Next, an operation when registering an access log after connecting to the network will be described. Since the flow of processing at the time of access log registration is the same as that of the fourth embodiment, it will be described with reference to FIGS.
The difference from the fourth embodiment is that the access destination URL in the access log is encrypted when the user terminal 100b attempts to register the access log in steps S110 and S127, and log authentication is performed in steps S112 and S125. The point is that the access destination URL in the access log is encrypted when the server 200b attempts to register the access log.

  When registering the access log, the log registration unit 102b of the user terminal 100b acquires the terminal ID from the storage unit 104 and passes the terminal ID and the access destination URL to the encryption processing unit 106. Using the public key of the log authentication server 200b, the encryption processing unit 106 generates an encrypted value obtained by encrypting the terminal ID and the access destination URL, and passes the encrypted value to the log registration unit 102b. The log registration unit 102b registers an access log including the access time and the encryption value in the storage unit 104 (steps S110 and S127).

  The request relay unit 201b of the log authentication server 200b extracts the access time, the access destination URL, and the user ID from the service use request message transmitted from the user terminal 100b and passes them to the log registration unit 202b. The log registration unit 202b refers to the storage unit 204 based on the user ID passed from the request relay unit 201b, extracts the terminal ID corresponding to the user ID, and encrypts the terminal ID and the access destination URL. To 206. Using the public key of the log authentication server 200b, the encryption processing unit 206 generates an encrypted value obtained by encrypting the terminal ID and the access destination URL, and passes the encrypted value to the log registration unit 202b. The log registration unit 202b registers the access log including the access time and the encrypted value and the user ID in the storage unit 204 in association with each other (steps S112 and S125).

  In the present embodiment, the same effect as in the fourth embodiment can be obtained. Also in the present embodiment, as the access log consistency determination method, any of the all-matching method, the partial matching method, the time-series sorting method, and the URL errata table method can be used. Since these methods are the same as those in the second embodiment except that the terminal ID and the access destination URL are encrypted, detailed description thereof will be omitted.

  The user terminal 100b may encrypt the access destination URL using the terminal ID as a common key, and the log authentication server 200b may decrypt using the terminal ID.

  In the third embodiment, the fourth embodiment, the sixth embodiment, and the seventh embodiment, a hashed or encrypted access log is registered in the storage units 104 and 204 of each device. However, the main purpose of hashing and encrypting the access log is to prevent the access log from being wiretapped on the communication path. Therefore, the plaintext access log is registered in the storage units 104 and 204 of each device, and when the access log needs to be transmitted for authentication, the necessary plaintext access log is extracted and then extracted. A plain text access log may be sent after being hashed or encrypted.

  In the third embodiment, the fourth embodiment, the sixth embodiment, and the seventh embodiment, when the collation method is the time series rearrangement method, the user terminals 100a and 100b receive Access destination URLs included in the list are sorted by time and transmitted to the log authentication servers 200a and 200b. However, if the access destination URL is encrypted in advance, the encryption processing at the time of transmission can be omitted. The response to the authentication servers 200a and 200b is not a little faster. Therefore, the access log registered in the storage units 104 and 204 may be composed of the access time and the encrypted access destination URL. That is, only the access destination URL may be encrypted and registered.

[Eighth embodiment]
Next, an eighth embodiment of the present invention will be described. FIG. 16 is a block diagram showing a configuration of a user authentication system according to the eighth embodiment of the present invention. In the present embodiment, more specific examples of the second to eighth embodiments will be described. In FIG. 16, the configuration of the user authentication system is described using the reference numerals of FIG. 3 described in the second embodiment. However, the configuration of FIG. 16 is applied to the third to eighth embodiments. Is also possible.

  In this embodiment, the log authentication server 200 is installed in the corporate network 500 to which the user terminal 100 belongs. Communication between the user terminal 100 and the log authentication server 200 is performed via the corporate network 500, and communication between the log authentication server 200 and the service server 300 is performed via the corporate network 500 and the external network 600. . Since the operation of the authentication system is the same as in the second to eighth embodiments, description thereof is omitted.

  In this embodiment, in order for the log authentication server 200 to determine whether the user terminal 100 may access the external network 600 outside the corporate network 500, the user terminal 100 is connected to the service servers A1 to A4, for example. Use the access log when accessing any (or some). The service server in this embodiment is a so-called ordinary WEB server that provides a service without user authentication.

[Ninth Embodiment]
Next, a ninth embodiment of the present invention will be described. FIG. 17 is a block diagram showing a configuration of a user authentication system according to the ninth embodiment of the present invention. In the present embodiment, more specific examples of the second to eighth embodiments will be described. In FIG. 17, the configuration of the user authentication system is described using the reference numerals of FIG. 3 described in the second embodiment, but the configuration of FIG. 17 is applied to the third to eighth embodiments. Is also possible.

  In the present embodiment, in the initial state, the user terminal 100 is connected to the corporate network 500 as shown in FIG. FIG. 17 shows a case where the user goes home with the user terminal 100 and tries to receive the service of the service server 300 from the home network 700. Communication between the user terminal 100 and the log authentication server 200 is performed via the home network 700, the external network 600, and the corporate network 500, and communication between the log authentication server 200 and the service server 300 is performed via the corporate network. 500 and the external network 600. Since the operation of the authentication system is the same as in the second to eighth embodiments, description thereof is omitted.

  In the present embodiment, when there is a service server in the corporate network 500 and the user terminal 100 wants to use this service server, the user authentication by the access log including the URL of the service server must be passed. This rule is an example of a rule for user authentication.

[Tenth embodiment]
Next, a tenth embodiment of the present invention will be described. FIG. 18 is a block diagram showing a configuration of a user authentication system according to the tenth embodiment of the present invention. In the present embodiment, more specific examples of the second to eighth embodiments will be described. In FIG. 18, the configuration of the user authentication system is described using the reference numerals of FIG. 3 described in the second embodiment, but the configuration of FIG. 18 is applied to the third to eighth embodiments. Is also possible.

  In the present embodiment, the user terminal 100, the log authentication server 200, and the service server 300 are connected to each other via the external network 800. Communication between the user terminal 100 and the log authentication server 200 is performed via the external network 800, and communication between the log authentication server 200 and the service server 300 is also performed via the external network 800. Since the operation of the authentication system is the same as in the second to eighth embodiments, description thereof is omitted.

  In the present embodiment, assuming that the access destination known by the log authentication server 200 is, for example, the service servers A1, A2, A3, and A4, the user terminal 100 is one of the service servers A1 to A4 (or any number). If the access log at the time of access is OK, it is possible to access other service servers.

  In this embodiment, the log authentication servers 200, 200a, and 200b grasp in advance which access destination can authenticate the user. The request relay units 201, 201a, and 201b of the log authentication servers 200, 200a, and 200b are access destinations that the log authentication servers 200, 200a, and 200b grasp in the processing of steps S101, S201, S301, S401, S501, and S601. The user terminal 100, 100a, 100b is requested to send only the access log related to.

  Further, as is clear from the second to eighth embodiments, the user terminals 100, 100a, 100b can record access logs of all access destinations. However, the log authentication servers 200, 200a, and 200b can record only the access log of only the access destination that can perform single sign-on in the processes of steps S112 and S125. Therefore, the log authentication servers 200, 200a, and 200b use all or part of the access log related to only the access destination that can perform single sign-on for user authentication in the processing of steps S104, S204, S304, S404, S504, and S604.

[Eleventh embodiment]
Next, an eleventh embodiment of the present invention will be described. FIG. 19 is a block diagram showing a configuration of a service server according to the eleventh embodiment of the present invention.
The service server 300a of this embodiment is obtained by adding a log registration request unit 303 to the service server 300.

  FIG. 20 is a sequence diagram showing an operation when registering an access log according to the present embodiment. Here, it is assumed that the user terminal 100 and the log authentication server 200 have the configuration described in the second embodiment. The service request unit 101 of the user terminal 100 that intends to use the service provided by the service server 300 requests the log registration unit 102 to register the access log after receiving the network connection response message from the log authentication server 200. . Upon receiving this request, the log registration unit 102 registers an access log including the access time and the access destination URL in the storage unit 104 (step S700).

Subsequently, the service request unit 101 transmits a service use request message including the registered access time and access destination URL to the service server 300a (step S701).
When receiving the service use request message from the user terminal 100, the log registration request unit 303 of the service server 300a extracts the source IP address, that is, the IP address of the user terminal 100 from the service use request message, The access destination URL is extracted, and an access log registration request message including the IP address of the user terminal 100, the access time, and the access destination URL is transmitted to the log authentication server 200 (step S702).

  When receiving the service use request message from the user terminal 100, the request relay unit 201 of the log authentication server 200 extracts the IP address, access time, and access destination URL of the user terminal 100 from the service use request message, and registers the log. To the unit 202. In the case of the present embodiment, the log authentication unit 203 of the log authentication server 200 registers the IP address of the user terminal 100, the user ID, and the terminal ID in the storage unit 204 during user authentication.

  The log registration unit 202 refers to the storage unit 204 based on the IP address of the user terminal 100 passed from the request relay unit 201, acquires a user ID and a terminal ID corresponding to this IP address, and requests relay unit The access log including the access time and access destination URL passed from 201, and the acquired user ID and terminal ID are associated and registered in the storage unit 204 (step S703). However, for example, when the terminal ID is not used as in the second embodiment, the access log and the user ID may be associated with each other and registered in the storage unit 204.

  On the other hand, the service providing unit 301 of the service server 300a provides the user terminal 100 with the service requested by the service use request message from the user terminal 100 (step S704).

  In the present embodiment, even if the log authentication server 200 does not have a proxy function (that is, the log authentication server 200 is not disposed between the user terminal 100 and the service server 300a), the access log of the user terminal 100 Can be registered in the log authentication server 200.

[Twelfth embodiment]
Next, a twelfth embodiment of the present invention will be described. FIG. 21 is a block diagram showing a configuration of a user authentication system according to the twelfth embodiment of the present invention. In the present embodiment, in addition to the configuration described in the ninth embodiment, the service server 300 is also present in the corporate network 500. Since the operation of the authentication system is the same as that of the ninth embodiment, detailed description thereof is omitted.

  Note that the method of registering the access log to the service server 300 in the corporate network 500 in the storage unit 204 of the log authentication server 200 is related to the location (the corporate network 500 or the home network 700) where the user terminal 100 exists. First, there are methods described in the second to eighth embodiments in which the service server 300 in the corporate network 500 is accessed via the proxy of the log authentication server 200. As another method, when the user terminal 100 exists in the corporate network 500, after the user authentication by the log authentication server 200 is performed, the user terminal 100 and the service server 300 in the corporate network 500 are There is a method described in the eleventh embodiment in which direct access is performed and the access log is registered in the log authentication server 200 using the log registration request unit of the service server 200.

[Thirteenth embodiment]
Next, a thirteenth embodiment of the present invention will be described. Table 1 shows policies relating to user authentication in the first to twelfth embodiments.

  The log authentication server shows the correspondence between the service requested from the user terminals 1, 100, 100a, and 100b and the information requested (or information to be presented) to the user terminals 1, 100, 100a, and 100b in the authentication to the service. 2, 200, 200a, and 200b are stored in advance. Table 1 shows the correspondence between services requested from the user terminals 1, 100, 100a, and 100b, information requested (or information to be presented) to the user terminals 1, 100, 100a, and 100b, and methods used for user authentication. Showing the relationship. Such a correspondence relationship may be further stored in association with each user and for each set of user and user terminal. In addition, the variation of the correspondence relationship is not limited to that in Table 1. Information required for the user terminals 1, 100, 100a, and 100b (or information to be presented) may be appropriately combined with the applied method.

  Although the first to thirteenth embodiments do not describe how much access logs the user terminals 1, 100, 100a, 100b transmit, this time since the last user authentication. An access log immediately before user authentication may be transmitted to the log authentication servers 2, 200, 200 a, 200 b, or from when the user terminals 1, 100, 100 a, 100 b first accessed the service server 3, 300. The access log up to immediately before the current user authentication may be transmitted to the log authentication servers 2, 200, 200a, and 200b. When the access log from the previous user authentication to immediately before the current user authentication is transmitted to the log authentication server 2, 200, 200a, 200b, the access log necessary for the user authentication is transmitted to the user terminal 1, 100, 100a, 100b. And means for determining whether or not the log authentication servers 2, 200, 200 a, and 200 b are sufficiently collected. Further, when the user terminal 1, 100, 100a, 100b transmits the access log from when the user terminal 1, 100, 100a, 100b accesses the service server 3,300 for the first time to immediately before the current user authentication to the log authentication server 2, 200, 200a, 200b, Since the log capacity can be enormous, the user terminals 1, 100, 100a, 100b may compress the access log and send it to the log authentication servers 2, 200, 200a, 200b.

  In addition, the log authentication servers 2, 200, 200a, and 200b may leave only the latest N access logs in the storage unit 204 for each user terminal 1, 100, 100a, and 100b. Only the access log for the most recent month may be left in the storage unit 204 for each 1,100, 100a, 100b. Similarly, the user terminals 1, 100, 100 a, 100 b may leave only the latest N access logs in the storage units 10, 104, or store only the access logs for the last one month in the storage units 10, 104. You may make it leave to 104.

  Although the access log extraction processing is not described in the first to thirteenth embodiments, the user terminals 1, 100, 100a, 100b and the log authentication servers 2, 200, 200a, 200b are service servers. You may make it hold | maintain an access log in time series irrespective of. The log extraction unit 103 of the user terminals 1, 100, 100a, 100b extracts an access log corresponding to a service (access destination URL) to be used from the storage unit 104 and performs log authentication of the log authentication servers 2, 200, 200a, 200b. When the log authentication unit 203 attempts to authenticate the user terminals 1, 100, 100a, and 100b, the access destination URL included in the service use request message from the user terminals 1, 100, 100a, and 100b is transmitted to the unit 203. May be extracted from the storage unit 204 to determine the consistency of the access log. However, it is needless to say that the access log transmitted from the user terminal 1, 100, 100a, 100b to the log authentication server 2, 200, 200a, 200b need not be limited to the log of the URL of the service to be used.

In the first to thirteenth embodiments, in addition to user authentication using an access log, more reliable user authentication can be realized by using an existing authentication technique (password authentication or digital signature authentication). Is possible.
In the first to thirteenth embodiments, the log authentication servers 2, 200, 200a, and 200b may be managed by either the network service provider or the network administrator.

  In the first to thirteenth embodiments, the log authentication servers 2, 200, 200a, and 200b relay service use requests from the user terminals 1, 100, 100a, and 100b. , 300 may receive a service use request from the user terminal 1, 100, 100a, 100b, the user authentication request unit 302 may request the log authentication server 2, 200, 200a, 200b for user authentication. .

  In the first to thirteenth embodiments, the log authentication server and the service server are separated. However, the present invention is not limited to this, and the log authentication server and the service server may be integrated. .

In the first to thirteenth embodiments, how to associate and store an access log group necessary for authentication to a service has not been described. A street method is conceivable.
(A) If the service domain and the domain in the URL of the access log match, the access log corresponds to the service.
(B) A correspondence relationship between a service and a domain or URL corresponding to the service is stored in advance for each service. It is assumed that an access log having a URL included in the stored correspondence relationship corresponds to the service.

  The log authentication servers 2, 200, 200 a, and 200 b store in advance correspondence rules such as the above (A) or (B). The log authentication servers 2, 200, 200a, and 200b identify the policy corresponding to the service use request from the user terminals 1, 100, 100a, and 100b from the relationship shown in Table 1 described in the thirteenth embodiment. According to this policy, information is requested or presented to the user terminals 1, 100, 100a, 100b (steps S2, S101, S201, S301, S401, S501, S601), and then the access log corresponding to the service When the user is identified, the above-mentioned rules are referred to, the access log necessary for user authentication is identified and acquired, and the user authentication is performed. At this time, the information stored in the storage unit 204 of the log authentication server 200 shown in FIG. 5 may be stored in a set obtained by further adding information for identifying the service, and the correspondence relationship in FIG. By referring to the service, the service corresponding to the access log may be specified.

  Each of the user terminal, log authentication server, and service server of the first to thirteenth embodiments is realized by a computer having a CPU, a storage device, and an external interface, and a program for controlling these hardware resources. can do. In such a computer, a program for realizing the user authentication method of the present invention is provided in a state of being recorded on a recording medium such as a flexible disk, a CD-ROM, a DVD-ROM, or a memory card. The CPU of each device writes the program read from the recording medium to the storage device, and executes the processes described in the first to thirteenth embodiments according to the program.

  The present invention can be applied to a technique in which a network service provider or a network administrator authenticates a user who intends to use a network service.

  DESCRIPTION OF SYMBOLS 1,100,100a, 100b ... User terminal, 2,200, 200a, 200b ... Log authentication server, 3,300, 300a ... Service server, 4,400 ... Network, 10, 20, 104, 204 ... Storage part, 11 , 101, 101a, 101b ... service request unit, 12 ... access log response unit, 21 ... answer request unit, 22, 203 ... log authentication unit, 102, 102a, 102b, 202, 202a, 202b ... log registration unit, 103 ... Log extraction unit, 105, 205 ... Hash operation unit, 106, 206 ... Encryption processing unit, 201, 201a, 201b ... Request relay unit, 301 ... Service providing unit, 302 ... User authentication request unit, 303 ... Log registration request unit , 500 ... corporate network, 600, 800 ... external network, 700 ... home network.

Claims (10)

A user terminal that makes a service use request;
A log authentication server for performing user authentication of the user terminal,
The user terminal is
First storage means for storing an access log including information on services used by the user after user authentication;
When sending a network connection request to the log authentication server to receive user authentication, an answer corresponding to the answer request from the log authentication server is stored in the access log stored in the first storage means. And an access log response means based on
The log authentication server is:
Second storage means for storing an access log for each user;
An answer request means for making a predetermined answer request to the user terminal when receiving a network connection request from the user terminal;
Whether the answer transmitted from the user terminal satisfies the condition requested in the answer request is determined based on the access log of the user of the user terminal stored in the second storage unit. A user authentication system comprising log authentication means for performing authentication. The user authentication system according to claim 1,
The response requesting means of the log authentication server transmits to the user as the response request a list of service information included in the access log of the user of the user terminal that transmitted the network connection request,
The access log response means of the user terminal rearranges the service information included in the list transmitted from the log authentication server in time series based on the access log stored in the first storage means. Send the list after replacement to the log authentication server as the answer,
Based on the access log of the user of the user terminal stored in the second storage unit, the log authentication unit of the log authentication server stores information on services included in the list transmitted from the user terminal in time series A user authentication system for performing user authentication by determining whether or not The user authentication system according to claim 1,
The response requesting means of the log authentication server mixes service information included in the access log of the user of the user terminal that transmitted the network connection request and service information included in the access log other than the access log of the user. Sent to the user as the response request,
Whether the access log response unit of the user terminal is registered as an access log based on the access log stored in the first storage unit, as service information included in the list transmitted from the log authentication server. Determine whether or not for each information, and send the determination result to the log authentication server as the answer,
The log authentication unit of the log authentication server determines whether the determination result transmitted from the user terminal is correct based on the access log of the user of the user terminal stored in the second storage unit. A user authentication system characterized by performing user authentication. The user terminal in a user authentication system comprising a user terminal that makes a service use request and a log authentication server that performs user authentication of the user terminal,
Storage means for storing an access log including information on services used by the user after user authentication by the log authentication server;
Access to send a response corresponding to a response request from the log authentication server based on an access log registered in the storage means when transmitting a network connection request to the log authentication server for user authentication A user terminal comprising log response means. The log authentication server in a user authentication system comprising a user terminal that makes a service use request and a log authentication server that performs user authentication of the user terminal,
Storage means for storing, for each user, an access log including information on services used by the user after user authentication;
An answer request means for making a predetermined answer request to the user terminal when receiving a network connection request from the user terminal;
User authentication is performed by determining whether an answer transmitted from the user terminal satisfies the condition requested in the answer request based on an access log of the user of the user terminal stored in the storage unit. And a log authentication server. A network connection request transmission procedure in which the user terminal transmits a network connection request to the log authentication server;
An answer request procedure for making a predetermined answer request to the user terminal when the log authentication server receives a network connection request from the user terminal;
An access log response procedure in which the user terminal performs an answer corresponding to the answer request from the log authentication server based on the access log stored in the first storage means;
Based on the access log of the user of the user terminal stored in the second storage means, the log authentication server determines whether the response transmitted from the user terminal satisfies the condition requested in the response request. And a log authentication procedure for performing user authentication after determination. A user authentication method in a user authentication system including a user terminal that makes a service use request and a log authentication server that performs user authentication of the user terminal,
When the user terminal sends a network connection request to the log authentication server to receive user authentication, an access corresponding to the response request from the log authentication server is accessed by the user registered in the storage means. A user authentication method comprising an access log response procedure based on a log. A user authentication method in a user authentication system including a user terminal that makes a service use request and a log authentication server that performs user authentication of the user terminal,
An answer request procedure for making a predetermined answer request to the user terminal when the log authentication server receives a network connection request from the user terminal;
The log authentication server determines whether or not the response transmitted from the user terminal satisfies the condition requested in the response request based on the access log of the user of the user terminal stored in the storage unit. And a log authentication procedure for performing user authentication.   A user terminal program for causing a computer to function as each means of the user terminal according to claim 4.   6. A log authentication server program for causing a computer to function as each means of the log authentication server according to claim 5.

Images