JP2015226137A - Terminal authentication method using client certificate, terminal authentication system, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make it possible to apply user authentication using an arbitrary client certificate to actual network service, without presupposing development of infrastructure in actual society.SOLUTION: A server accepts, from a user terminal, user temporary registration including a client certificate including a public key of a user and destination information on the user; stores the public key and the destination information in a database; transmits key information to the user on the basis of the destination information included in the user temporary registration; and accepts definitive registration based on the key information from the user to complete the definitive registration. When a user whose definitive registration has completed tries to use network service, the server performs authentication of a user terminal on the basis of a public key of the user stored in the database. A destination of message service ensuring that persons excluding a user cannot read a message is used as destination information on the user.

Description

  The present invention relates to user authentication in a network service such as a web service, and more particularly, to a method, system, and program capable of authenticating a user terminal using a self-signed client certificate.

  When providing a network service such as a web service to a user, it is necessary to confirm whether the person or terminal accessing the network service server is a genuine user or user terminal. is there. Confirming that the user is a genuine user or user terminal and authenticating the user or user terminal is called user authentication. As a conventional method for user authentication, the following methods are known.

  As a first method, an ID (identification information) for identifying each user and a password corresponding to the ID are registered in advance in the network service, and the user's ID and a password that only the user knows are registered. There is a method for authenticating a user by correctly presenting a set. However, user authentication based on ID and password has a problem that it is vulnerable to a brute force attack and a list type attack.

  As a second method, an ID for identifying each user and an address of a message service (for example, an e-mail address or a social network service (SNS: SNS)) that ensures that a message other than the user cannot confirm the message. social network service) direct mail address, etc.) in advance in a network service such as a web service, and when the user ID is presented, the message service address registered for that user is only once. Used when the user's ID and the disposable password sent in a message addressed to an address that can only be received by the user are correctly presented as a set. There is a way to authenticate a person. User authentication with a disposable password using a message service is more resistant to brute force attacks and list-type attacks than methods that rely on IDs and passwords, but message authentication with network services such as web services is possible each time authentication is performed. The problem is that it occurs and is complicated.

  As a third method, there is a method using a client certificate based on public key cryptography. In this method, a client certificate corresponding to each user is distributed to the user in advance and stored in a terminal used by the user, and SSL (secure socket layer) / TSL (translator) The user corresponding to the ID stored in the client certificate is authenticated by verifying the client certificate presented to the network service according to a secure protocol sequence represented by port layer security (transport layer security). . This method authenticates the user and uses the client certificate stored in the terminal, so the terminal that the user intends to use is also authenticated. Can also be considered. In the method using the client certificate based on the public key encryption, it is necessary to confirm whether or not the client certificate presented to the network service is the property of the correct user corresponding to the ID stored in the client certificate. This confirmation is important, as shown below, for example using a framework based on PKI (public key infrastructure) or using a framework of PGP (pretty good privacy). Has been done.

  (1) In the case of being based on PKI, a CA (certificate authority) that is trusted by the public uses an official certificate such as a driver's license offline, and the user's identity Confirmation is performed by signing the client certificate, which is the user's public key certificate, with the CA private key as a proof of identity verification. In the PKI trust model, when a user stamps his / her seal on a paper document, is the seal imprinted by the seal certificate issued by the mayor of the municipality surely based on the user's seal? It is similar to confirming. In this case, the real seal corresponds to the user's private key, the seal stamp corresponds to the user's public key, and the seal certificate showing the seal stamp is signed with the municipal mayor's secret key. Correspond to the letter. In practice, when operating PKI, a plurality of CAs are provided, and the highest-level (first level) root CA authenticates one or more second-level CAs, and each second-level CA It is common to construct a certification path by applying a plurality of CAs to a tree-like hierarchical structure, such as authenticating one or more CAs at the third level.

  (2) In the case of using the PGP framework, it is referred to as “mediator 1 confirmed by the service provider, broker 2 confirmed by the broker 1,..., User N confirmed by the broker N”. As a proof that there is a chain of identity verification called a so-called “ring of trust”, it is confirmed by a chain of signatures by each intermediary for the client certificate by the intermediary's private key. The circle of trust is based on the establishment of a mutual support trust relationship among the participants in the circle of trust, and is not a hierarchical structure with a specific participant at the top.

  In the user authentication using the client certificate as described above, based on the PKI or PGP trust model, the client certificate such as the CA signature in the PKI or the intermediary signature in the PGP is used by a trusted third party. , Verifying the validity of the client certificate. As specific implementation examples, in the case of using PKI, mod_ssl (see http://www.modssl.org/) which is an extension function of the Apache web server and opensl (http: // www) which is a PKI encryption tool. In combination with PGP, mod_gnutls (HYPERLINK "http://www.outoforder.cc/projects/apache/mod_gnutls/ There is a combination of GnuTLS (see http://gnutls.org/) which is a PGP encryption tool. If the client certificate cannot be verified based on PKI or PGP, it is assumed that the user has created a forged client certificate that borrows another person's ID that is not necessarily the user's own ID and presented it to the network service. However, the network service side cannot confirm whether the client certificate is genuine or counterfeit, and the use of the service by impersonation is permitted. Therefore, in authentication using a client certificate, it is important to verify the client certificate based on PKI or PGP.

  Authentication using a client certificate is resistant to brute force attacks and list attacks unlike ID and password authentication, and is not complicated unlike a method using a disposable password using a message service. However, in order to authenticate with a client certificate when providing a network service, all users who use the network service must possess a client certificate that can be verified with the network service. There's a problem.

  Even if each user of a network service such as a web service has a certificate corresponding to PKI, the network service must sign the user's client in order to verify the client certificate of the user. It is necessary to have a CA root certificate that is in a mutual authentication relationship with the CA that has signed the client certificate or the CA that has signed the client certificate. However, in reality, building mutual authentication relationships among a large number of CAs has not been realized due to problems such as infrastructure operation costs, and the user holds a client certificate that can be verified by the network service. There is a problem that we cannot expect it. Further, even when each user of the network service has a certificate corresponding to PGP, in order for the network service to verify the client certificate of the user, the user and the network service are connected. A circle of trust must be derived. It is clear from the above-mentioned PKI that introduces a trust relationship with CA as an intermediary so that a chain of trust can be surely found in view of the difficulty in reliably finding this circle of trust. As described above, when PGP is used, there is a problem that the user cannot be expected to hold a verifiable client certificate, as compared with the case where PKI is used.

ITU-T X. 509 (Information technology-Open systems interconnection-The Directory: Public-key and attribute certificate frameworks), International Telecommunication Union, October 2012, pp. 21-31 Simson Garfinkel, translated by Kazuhiko Yamamoto, “PGP encrypted mail and electronic signature”, O'Reilly Japan, April 1996, pp. 235-237, (ISBN4-900900-02-8)

  As described above, user authentication using a client certificate has an advantage that it is safer than a method using an ID and a password and less complicated than a method using a message service and a disposable password. However, user authentication using client certificates is based on an infrastructure that is not yet fully developed in the real world, in which users are prepared with client certificates that can be mutually authenticated with network services. However, there is a problem that it is difficult to apply to network services for a wide range of users.

  An object of the present invention is to provide a terminal authentication method and a terminal authentication system that apply user authentication using a client certificate to an actual network service without assuming infrastructure development in an actual society.

  The terminal authentication method according to the present invention is a terminal authentication method in a network service, in which a server receives a user temporary certificate including a client certificate including a user public key and user destination information from a user terminal. Accepts registration, stores public key and destination information in database, and when accepting user temporary registration, server sends key information to user based on destination information included in user temporary registration And that the server accepts the main registration from the user based on the key information, records that the main registration is completed for the user in the database, and the main registration is recorded in the database. When a user tries to use a network service, the server uses the user's public key stored in the database to Has a carrying out the testimony, the destination information of the user, the other user is information message services that are collateral can not verify the message destination.

  The terminal authentication system of the present invention is a terminal authentication device that performs authentication of a user terminal in a network service, and stores a destination information, a public key, and a registered flag for each user for each user, A temporary registration receiving unit that receives a user temporary registration including a user certificate including a user public key and user destination information from a user terminal, and stores the public key and destination information in a database; When the temporary user registration is accepted, the key information is transmitted to the user based on the destination information included in the temporary user registration, the main registration from the user based on the key information is accepted, and the user is registered in the database. When the main registration department that sets the registered flag and a user who has the registered flag set in the database wants to use the network service A terminal authentication unit that authenticates the user terminal based on the public key of the user stored in the database, and the destination information of the user may not be able to confirm a message other than the user This is information on the destination of the secured message service.

  In network services such as web services, the user's own temporary registration and the main registration mechanism using the confirmation e-mail after provisional registration are generally used in existing systems. The user authentication method is only a method of combining an ID and a password, and has a problem that a brute force attack is weak against a list type attack. In contrast, the present invention provides an authentication mechanism that is strong against brute force attacks and list-type attacks by bringing in authentication using a client certificate to the authentication part using the ID and password in this known user registration mechanism Is realized.

  The present invention combines authentication by a message service that ensures that a message other than the user cannot confirm the message and authentication by a client certificate. Since the message infrastructure itself such as e-mail has permeated the world sufficiently, according to the present invention, it is possible to perform complicated procedures without waiting for the development of a social infrastructure for mutual authentication of client certificates. In this case, terminal authentication can be performed using an arbitrary client certificate including a self-signed client certificate already held by the user.

It is a sequence diagram explaining the terminal authentication method of one embodiment of the present invention. It is a block diagram which shows the structure of the terminal authentication apparatus which performs the terminal authentication method shown in FIG. It is a sequence diagram explaining the terminal authentication method of another embodiment of this invention. It is a block diagram which shows the structure of the terminal authentication apparatus which performs the terminal authentication method shown in FIG.

  Next, preferred embodiments of the present invention will be described with reference to the drawings. FIG. 1 shows a terminal authentication procedure in an embodiment of the present invention. Here, a server 12 that provides a network service such as a web service is provided, and terminal authentication when the user terminal 11 tries to access the server 12 will be described.

  Assume that the user terminal 11 stores a pair of private key 21 and public key 22, and in particular, the public key 22 is included in the client certificate 24. Here, the client certificate 24 is used for authentication when the network service provided by the server 12 is used, and even if it is a self-signed certificate, it is a regular authentication in a reliable public key infrastructure (PKI). The certificate may be a certificate signed by a CA (CA) or a certificate signed by another user according to the PGP framework. In addition, the user of the user terminal 11 has an address of a message service (for example, an e-mail address or a direct mail address of a social network service (SNS)) that ensures that a message cannot be confirmed by anyone other than the user. Assume that it is assigned as a message destination. In the illustrated example, the message destination is foo@example.com.

  In the terminal authentication method of the present embodiment, a user who intends to use a network service using the user terminal 11 first performs temporary user registration with the server 12. In the temporary user registration, the user terminal 11 presents the stored client certificate 24 and message destination to the server 12. The server 12 is provided with an authentication database 14 used for authentication of users and user terminals. The authentication database 14 displays, for each user, an ID of the user ("user ID" in the figure). ), The message destination of the user, the client certificate and public key of the user terminal used by the user, the key information used for the main registration (shown as “main registration key” in the figure), and the main registration Can be stored (in the figure, "Registered flag") indicating that the process has been completed. Upon receiving the user temporary registration from the user terminal 11, the server 12 stores the user ID of the user, the message destination, the client certificate, and the public key in the authentication database 14, and the next book The main registration key 23 used in the registration process is set. The main registration key 23 is key information that only a user can know, and is, for example, a secret network address (specifically, URL (Uniform Resource Locator)) used for main registration or a secret passcode used for main registration.

  After receiving the user temporary registration and registering the message destination, client certificate, and the like in the authentication database 14, the server 12 is guaranteed that the message cannot be confirmed by anyone other than the user in order to encourage the main registration by the user. Through the message sending system 13 that provides the message service (specifically, for example, an e-mail system realized by an e-mail server), the message destination described above is an address used by the user in the message sending system 13. In contrast, a registration confirmation message 25 including the main registration key 23 is sent. The user who has received the registration confirmation message 25 accesses the server 12 using the main registration key 23, which is key information that only the user can know, performs the main user registration, and uses the user ID in the authentication database 14. Activate the user's account identified in. When the user main registration is completed, the server 12 sets a main registration completed flag for the user in the authentication database 14. This set of the registered flag is equivalent to recording that the server 12 has performed the identity verification at the same level as the identity verification of the message address for the client certificate of the user terminal 11. As a result, the client certificate 24 of the user terminal 11 is used for authentication of the user terminal in the server 12 as a client certificate that has been verified equivalent to the CA signature in PKI or the signature verification of the mediator in PGP. become able to.

  After the main registration, whenever the user terminal 11 accesses the server 12 and tries to use the network service, the server 12 performs general terminal authentication using the public key. For example, in response to the challenge presented by the server 12, the user terminal 11 returns a signature (response) signed by the private key 21 and a client certificate 24 used for pre-registration corresponding to the private key 21, Instead of verifying the signature of the client certificate, the server 12 checks whether the received client certificate 24 matches the client certificate already registered in the authentication database 14 for the user, and then There is an authentication method such as verifying a response signature with the public key 22 in the client certificate 24.

  When introducing a client certificate to be used for terminal authentication, the service provider of the network service needs to be able to verify the client certificate. In the conventional method, mutual authentication between the CA signature (in the case of PKI) or personal signature (in the case of PGP) signed in the client certificate and the CA signature or personal signature held by the service provider side can be reliably derived. Where infrastructure development is necessary, there is a problem that it is difficult to realize such infrastructure development at present due to problems such as operation costs. On the other hand, in the conventional client authentication mechanism, the method of this embodiment changes “verification of signature of client certificate” to “confirmation of presence / absence of registration using message base”. It is to be replaced. As a result, in this embodiment, the network service is provided by the user, including the self-signed client certificate, by a method that can be easily implemented without waiting for the infrastructure for mutual authentication of CA signatures and personal signatures. By using an arbitrary client certificate that cannot be mutually authenticated with the signature owned by the user, an authentication mechanism that is strong against brute force attacks and list attacks is constructed. In the method of the present embodiment, an address of a message service in which it is ensured that a message other than the user cannot confirm the message is used, but such message service is used only once at the time of the main registration, There is no complication like the authentication method using the message service and the disposable password.

  Furthermore, in the case of the authentication method of the present embodiment, the information stored in the server 12 regarding the user is only the public key and the message address, and both are information that is assumed to be disclosed and used. That is, in the present embodiment, unlike the authentication using the user ID and the password, the service provider side does not need to have the secret information tied to the individual. This is also an advantage in the operation of the server 12.

  FIG. 2 shows a configuration of a terminal authentication apparatus capable of implementing the terminal authentication method shown in FIG. The terminal authentication device 30 may be configured as a part of a server that provides a network service such as a web service, or provided separately from a server that provides the network service itself when providing the network service. It may be configured as an authentication server. The terminal authentication device 30 is connected to the user terminal 11 via the network 10. The network 10 is provided with a message sending system 13 such as an electronic mail system. The user terminal 11 stores a pair of private key 21 and public key 22 as shown in FIG. 1, and the public key 22 is included in the client certificate 24.

  The terminal authentication device 30 relates to a storage unit 31 that holds the authentication database 14 described above, a temporary registration reception unit 32 that performs temporary registration processing, a main registration unit 33 that performs main registration processing, and a user who has completed main registration. And a terminal authentication unit 34 that authenticates the user terminal 11 when using the network service. The temporary registration receiving unit 32 receives user temporary registration including the client certificate 24 including the user's public key 22 and the user's message destination from the user terminal 11, and sets the public key 22 and the message destination. Store in the authentication database 14. The main registration unit 33 is notified by the temporary registration receiving unit 32 that the user temporary registration has been received, and when such notification is received, the main registration key 33 is sent to the message destination via the message sending system 13. The registration confirmation message is transmitted, and the main registration from the user based on the main registration key is received, and the main registration completed flag is set for the user in the authentication database 14. The terminal authentication unit 34 is based on the public key 22 of the user stored in the authentication database 14 when a user whose main registration flag is set in the authentication database 14 tries to use the network service. The user terminal 11 is authenticated by a general public key authentication procedure.

  By the way, it is expected that a PKI infrastructure will be established in the future. In such a maintenance process, it is preferable that the authentication method based on the present invention and the authentication method using the PKI infrastructure can coexist. FIG. 3 shows a terminal authentication method according to another embodiment of the present invention, which can coexist with authentication based on PKI. Here, in the example shown in FIG. 1, the client certificate issued by a regular CA in the PKI infrastructure that is in mutual authentication relationship with the server 12, in other words, the PKI infrastructure that the server 12 can trust is used. Assume that the described message destination is included.

  When the user terminal 11 presents the stored client certificate 24 and message destination to the server 12 in the temporary user registration, the server 12 first has the client certificate 24 and the server 12 It is determined whether or not it can be verified by a trusted PKI-based regular CA signature. If it cannot be verified, the user ID of the user, the message destination, the client certificate, and the public key are stored as in the example shown in FIG. Execute the registration process.

  On the other hand, when the presented client certificate 24 can be verified, the message destination acquired from the client certificate 24, the client certificate, and the public key are stored in the authentication database 14. Since the client certificate 24 has already been verified by the PKI infrastructure, the server 12 omits the main registration process on the assumption that the main registration has been completed by provisional registration. Therefore, the main registration completed flag is immediately set (indicated by “Re” in the figure) without setting the main registration key (indicated by “n / a” in the figure). In this case, the user can immediately use the network service without performing the main registration by the registration confirmation message.

  FIG. 4 shows the configuration of a terminal authentication apparatus capable of implementing the terminal authentication method shown in FIG. In the terminal authentication apparatus 30, the client certificate 24 presented from the user terminal 11 is verified by a trusted CA signature in a PKI infrastructure that can be trusted with respect to the terminal authentication apparatus shown in FIG. A certificate determination unit 35 for determining whether the certificate is a client certificate is further provided. The certificate determination unit 35 is notified from the temporary registration reception unit 32 that the user temporary registration has been received, and when such notification is received, the temporarily registered client certificate is verified by the signature of the legitimate CA. If it is verified by a legitimate CA signature, the message destination is extracted from the presented client certificate and stored in the authentication database 14 and the main registration flag is set. In this case, the main registration process by the main registration unit 33 is not executed. When the client certificate has not been verified with a legitimate CA signature, the certificate determination unit 35 notifies the main registration unit 33 that provisional registration has been accepted, and the main registration unit 33 receives the notification and the main registration unit 33 Execute the registration process. The terminal authentication unit 34 operates in the same manner as that shown in FIG.

  The terminal authentication device 30 shown in FIGS. 2 and 4 can be configured as dedicated hardware, but the functions of the terminal authentication device 30 can be achieved by using a general-purpose computer including a microprocessor, a memory, a communication interface, and the like. It can also be realized by executing a computer program to be executed on this computer. When the terminal authentication device 30 is realized by executing a program on a computer, the authentication database 14 is stored and stored in a memory constituting the computer.

DESCRIPTION OF SYMBOLS 10 Network 11 User terminal 12 Server 13 Message sending system 14 Authentication database 21 Private key 22 Public key 23 Main registration key 24 Client certificate 25 Registration confirmation message 30 Terminal authentication apparatus 31 Memory | storage part 32 Temporary registration reception part 33 Main registration part 34 Terminal authentication part 35 Certificate judgment part

Claims (6)

A terminal authentication method in a network service,
The server accepts a user temporary registration including a user certificate including the user's public key and the user's destination information from the user terminal, and stores the public key and the destination information in a database. When,
When receiving the user temporary registration, the server transmits key information to the user based on the destination information included in the user temporary registration; and
The server accepts a main registration from the user based on the key information, and records that the main registration is completed for the user in the database;
When a user who records that the main registration is completed in the database tries to use the network service, the server is based on the public key of the user stored in the database. Authenticating user devices,
The terminal authentication method, wherein the destination information of the user is information on a destination of a message service in which it is ensured that messages other than the user cannot confirm the message.   The server, when the client certificate of the user received from the user terminal is a client certificate verified by a signature of a regular certificate authority in a public key infrastructure that the server can trust 2. The terminal authentication method according to claim 1, wherein the registration of the user is completed in the database without transmitting the key information and accepting the main registration. A terminal authentication device for authenticating a user terminal in a network service,
A database storing destination information, public key, and registered flag for each user,
A temporary registration accepting unit that accepts a user temporary registration including a client certificate including a public key of the user and the destination information of the user from a user terminal, and stores the public key and the destination information in a database. When,
When the user temporary registration is accepted, the key information is transmitted to the user based on the destination information included in the user temporary registration, and the main registration from the user based on the key information is accepted. A main registration unit for setting the registered flag for the user in the database;
When a user whose registered flag is set in the database intends to use the network service, the user terminal is authenticated based on the public key of the user stored in the database. A terminal authentication unit to perform,
And the destination information of the user is information on a destination of a message service in which it is ensured that a message cannot be confirmed by anyone other than the user. A certificate determination unit for determining whether the client certificate of the user received from the user terminal is a client certificate verified by a signature of a regular certificate authority in a public key infrastructure that can be trusted In addition,
When the client certificate of the user is verified by the signature of the regular certificate authority, the certificate determination unit does not transmit the key information to the main registration unit and accept the main registration. The terminal authentication apparatus according to claim 3, wherein the registered flag is set for the user. In a computer used for user terminal authentication in network services,
A process of accepting a user temporary registration including a user certificate including a user public key and the user destination information from a user terminal, and storing the public key and the destination information in a database;
A process of transmitting key information to the user based on the destination information included in the user temporary registration when the user temporary registration is received;
A process of accepting a main registration from the user based on the key information and recording the completion of the main registration for the user in the database;
A process of authenticating the user terminal based on the public key of the user when a user whose completion of the main registration is recorded in the database intends to use the network service;
And the destination information of the user is information on a destination of a message service in which it is ensured that a message cannot be confirmed by anyone other than the user.   The computer determines whether the user's client certificate received from the user terminal is a client certificate verified by a signature of a valid certificate authority in a public key infrastructure that can be trusted. If the client certificate is verified by the signature of the regular certificate authority, the registration is completed at the user in the database without transmitting the key information and accepting the main registration. The program according to claim 5, wherein a program for recording the information is executed.

Images