JP2016131311A - User terminal, server device, communication system, communication method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a user terminal capable of achieving robust communication against impersonation.SOLUTION: A user terminal communicating with a server device includes a user temper-resistant hardware for storing user private information that is server public information published by the server device, a response transmission unit for signing a response to a challenge transmitted from the server device, by using user secret information, and transmitting the signed response to the server device, and a server signature verification unit for verifying the processing result signed by the server device, by using the server secret information, that is an object of secret management by the server device and stored in a server temper-resistant hardware included in the server device, by the server public information.SELECTED DRAWING: Figure 2

Description

  The present invention relates to authentication technology in the field of information communication, and relates to a user terminal that communicates with a server device, a server device that communicates with a user terminal, a communication system that includes the user terminal and the server device, a communication method that is executed by the user terminal and the server device, and a program. .

  Recently, spoofing actions such as unauthorized logins have frequently occurred. As spoofing attacks, (1) "Theft of authentication secret information" such as key logger and certificate theft, (2) "Inference of authentication secret information" such as brute force attack and password list attack, (3) MITM There is a “post-authentication transaction takeover (tampering)” such as an attack (Man In The Middle Attack). Conventional ID / PW authentication, biometric authentication, SMS authentication, and hardware token authentication are disclosed in Non-Patent Document 1, for example. A conventional authentication method using a random number table is disclosed in Non-Patent Document 2, for example. Conventional telephone authentication (authentication using a telephone number notification) is disclosed in Non-Patent Document 3, for example. For example, Non-Patent Document 4 is disclosed as a conventional authentication method using a PIN code. A conventional transaction signature method is disclosed in Non-Patent Document 5, for example. Patent Document 1 discloses a conventional authentication technique for storing its own private key in an IC card.

JP 2012-22214 A

Post-On Co., Ltd., “SMS authentication service (personal authentication via SMS, seamless SMS transmission)”, [online], Post-On Co., Ltd. [searched on January 9, 2015], Internet <URL: http: //www.post-on.co.jp/sms-auth/> Trend Micro Co., Ltd., “Five Tips for Using Internet Banking with Confidence—The Key to Preventing Leakage of Authentication Information”, [online], August 7, 2014, Trend Micro Co., Ltd., [January 2015 9 Day search], Internet <URL: http://www.is702.jp/special/1627/> Hirohiko Kurokawa, Naoko Shigematsu, Haruhiko Fujii, Tetsuya Nakagawa, “Telelogin: Two-factor two-path authentication technology using calling number notification function”, [online], May 2008, Nippon Telegraph and Telephone Corporation, [Heisei 27 January 9th year search], Internet <URL: http://www.ntt.co.jp/journal/0805/files/jn200805042.pdf> Takashi Hara, “Disabling Password List Attack, UK Venture Landing with New Authentication System”, [online], October 30, 2014, Nikkei BP Co., Ltd. [Search January 9, 2015], Internet <URL: http://itpro.nikkeibp.co.jp/atcl/column/14/346926/102400086/> Hiten Japan Co., Ltd. “Countermeasures against fraudulent remittance-Reduce the risk of fraudulent remittance by MITB using OCRA-specific OTP tokens”, [online], Hiten Japan Co., Ltd., [January 9, 2015 search], Internet < URL: http://www.ftsafe.co.jp/solutions/ocra_mitb>

  In the prior art, the spoofing attacks (1) to (3) may not be sufficiently prevented. In the following, an example in which (3) “takeover (falsification of post-authentication transaction)” cannot be sufficiently prevented among the problems of the prior art will be described with reference to FIG. FIG. 1 is a diagram illustrating an example in which hijacking of a post-authentication transaction cannot be prevented. In this example, it is assumed that there are a user terminal 91, an attacker terminal 92, and a server device 93. The server device 93 is a device that provides an Internet banking service to the user terminal 91. The user terminal 91 uses the Internet banking service provided by the server device 93 to make a transfer request for a predetermined amount to the user's account. In a predetermined storage area of the user terminal 91, it is assumed that server public information that is information disclosed by the server device 93 and information for verifying the signature of the server device 93 is stored. It is assumed that server secret information 932 that is information that is secreted by the server device 93 and is used for a signature of the server device 93 is stored in a predetermined storage area of the server device 93.

  The attacker terminal 92 first falsifies the server public information stored in the user terminal 91. Assume that the attacker terminal 92 possesses counterfeit server secret information 922 that can generate a signature that can be verified with the falsified server public information 912. The attacker terminal 92 receives (intercepts) a transfer request to the user account from the user terminal 91 and transmits a transfer request (false transfer request) to the attacker's account to the server device 93. The server device 93 receives a fake transfer request from the attacker terminal 92, executes the transfer process, and signs the processing result using the server secret information 932. The attacker terminal 92 receives the processing result with the signature from the server device 93, generates a fake processing result indicating that the transfer processing to the user account has been executed instead of the processing result, and the fake processing result On the other hand, the forgery server secret information 922 is signed, and the signed fake processing result is transmitted to the user terminal 91.

  The user terminal 91 receives the signed fake processing result, and verifies the fake processing result signature with the falsified server public information 912. Since the server public information 912 has been falsified so that the signature attached to the fake processing result can be verified, the verification process ends normally. Therefore, the user does not notice that an illegal transfer has been executed.

  Conventionally, public information (public key) such as server public information is securely distributed by a trusted third party (TTP). Therefore, it is difficult to tamper the server public information at the time of distribution. However, the server public information after distribution may be subjected to the falsification attack as described above, and the spoofing attack may not be sufficiently prevented.

  Therefore, an object of the present invention is to provide a user terminal capable of realizing robust communication against a spoofing attack.

  The user terminal of the present invention is a terminal that communicates with the server device, and includes user tamper resistant hardware, a response transmission unit, and a server signature verification unit.

  The user tamper resistant hardware stores user secret information that is information that is secretly managed by the user terminal, and server public information that is information disclosed by the server device. The response transmission unit signs a response, which is a response to the challenge transmitted from the server device, using the user secret information, and transmits the signed response to the server device. The server signature verification unit uses the server secret information stored in the server tamper-resistant hardware included in the server device, which is information secretly managed by the server device. Verify by information.

  According to the user terminal of the present invention, it is possible to realize communication robust against a spoofing attack.

The figure which shows the example which cannot prevent the hijacking of the transaction after authentication. 1 is a block diagram illustrating a configuration of a communication system according to a first embodiment. FIG. 3 is a sequence diagram illustrating an operation of the communication system according to the first embodiment. The figure which shows the example which applied the communication system of Example 1 to online banking. The figure which compares the performance of this invention and a prior art.

  Hereinafter, embodiments of the present invention will be described in detail. In addition, the same number is attached | subjected to the structure part which has the same function, and duplication description is abbreviate | omitted.

  Since there are the above-mentioned problems in the prior art, the communication system according to the first embodiment solves these problems and makes the act of impersonation difficult. The first important point of the communication system according to the first embodiment is that the signature and the secret information and public information used for the verification are stored only in the tamper resistant hardware. Tamper resistant hardware is hardware that has improved ability to prevent reading confidential data by unauthorized means. Specific examples of tamper resistant hardware include a SIM card (Subscriber Identity Module Card), an IC chip, and a HSM (Hardware Security Module). As a result, it is possible to effectively prevent the “stealing authentication secret information” problem caused by storing secret information used for authentication in the user terminal or the server device.

  Secondly, the random number used for the secret information is set to a sufficiently long bit length. As a result, it is possible to effectively prevent the “estimation of secret information for authentication” problem due to reuse or use of secret information that can be guessed. Although details will be described later, in the case of the present invention, since an authentication method using an ID password is not used, it is difficult to guess secret information for authentication.

  The third is to use user public information and user secret information as a pair, and server public information and server secret information as a pair. As a result, it is possible to effectively prevent the problem of “takeover (falsification) of the processing result after authentication” due to unverification of the processing after authentication and falsification of public information.

  Hereinafter, the communication system according to the first embodiment will be described with reference to FIGS. 2 and 3. FIG. 2 is a block diagram illustrating a configuration of the communication system 1 according to the present embodiment. FIG. 3 is a sequence diagram showing the operation of the communication system 1 of the present embodiment. As shown in FIG. 2, the communication system 1 of the present embodiment includes a user terminal 10 and a server device 20. Although only one user terminal 10 and one server device 20 are illustrated in FIG. 2, the server device 20 is usually configured to communicate with a plurality of user terminals 10. Therefore, the communication system 1 of the present embodiment may be configured to include a plurality of user terminals 10 and one server device 20, or may be configured to include a plurality of user terminals 10 and a plurality of server devices 20. May be. The user terminal 10 and the server device 20 are communicably connected through a network.

  As shown in FIG. 2, the user terminal 10 includes a user tamper resistant hardware 11, a challenge receiving unit 12, a response transmitting unit 13, and a server signature verifying unit 14. The server device 20 includes a server tamper resistant hardware 21, a challenge transmission unit 22, a user signature verification unit 23, an execution processing unit 24, and a processing result transmission unit 25. The user tamper resistant hardware 11 can be, for example, the aforementioned SIM card or IC chip. The server tamper resistant hardware 21 can be, for example, the aforementioned HSM. The user tamper-resistant hardware 11 stores user secret information 111 that is information that is secretly managed by the user terminal 10 and server public information 112 that is information disclosed by the server device 20. The server tamper resistant hardware 21 stores user public information 211 that is information disclosed by the user terminal 10 and server secret information 212 that is information that is secretly managed by the server device 20.

  When performing authentication, first, the challenge transmission unit 22 of the server device 20 transmits a challenge to the corresponding user terminal 10 (S22).

  The challenge receiving unit 12 of the corresponding user terminal 10 receives the challenge from the server device 20 (S12). The response transmission unit 13 signs the response, which is a response to the challenge, using the user secret information 111, and transmits the signed response to the server device 20 (S13).

  The user signature verification unit 23 of the server device 20 receives the signed response from the user terminal 10 and verifies the signed response with the user public information 211 (S23). The execution processing unit 24 of the server device 20 executes the process requested from the user terminal 10 (S24). The processing result transmission unit 25 of the server device 20 signs the processing result indicating the result of the processing executed in step S24 using the server secret information 212, and transmits the signed processing result to the user terminal 10 (S25). ).

  The server signature verification unit 14 of the user terminal 10 receives the signed processing result from the server device 20, and verifies the signed processing result with the server public information 112 (S14).

  As described above, the communication system 1, the user terminal 10, and the server device 20 according to the present embodiment are robust against “theft of authentication secret information” because the secret information stored in the tamper resistant hardware is used. Also, tamper-resistant hardware is prepared for each of the user terminal 10 and the server device 20, and a pair of the user public information 211 and the user secret information 111 and a pair of the server public information 112 and the server secret information 212 are distributed. Since it is stored in the tamper resistant hardware, it is robust against “takeover (falsification) of processing result after authentication” as shown in FIG. For example, in the communication system 1, the user terminal 10, and the server device 20 of the present embodiment, it is difficult to execute falsification of the server public information illustrated in FIG. Further, if the RSA encryption method is used to generate a key used for signature and verification and the random numbers used for the user secret information 111 and the server secret information 212 are sufficiently long (for example, 2048 bits or more), “authentication secret information” Communication that is robust against "guess".

Hereinafter, an example in which the communication system 1 of the present embodiment is applied to an online banking system using OpenAM (reference non-patent document 1) and SAML (reference non-patent document 2) will be described with reference to FIG. FIG. 4 is a diagram illustrating an example in which the communication system 1 according to the present embodiment is applied to online banking.
(Reference Non-Patent Document 1: "OpenAM Project", [online], January 6, 2015 (Last Published), Forge Rock Community, [Search January 6, 2015], Internet <URL: http: / /openam.forgerock.org/>)
(Reference Non-Patent Document 2: "saml xml.org", [online], OASIS, [searched on January 6, 2015], Internet <URL: http://saml.xml.org/saml-specifications>)

  In the example of FIG. 4, the online banking system 200 including the service provider device 201 and the ID provider server device 202 functions as the server device 20 of the present embodiment. As shown in this example, the configuration requirements of the server device 20 may be distributed among a plurality of devices. First, the user terminal 10 accesses the service provider server device 201 and requests a service (service request). Next, the service provider server apparatus 201 redirects to the ID provider server apparatus 202 and makes an authentication request (redirects to IdP and authentication request). Next, two-factor authentication is performed using the procedure of this embodiment. First, the user terminal 10 performs a user signature using the user secret information stored in the SIM card. The ID provider server device 202 verifies that the user terminal 10 is a valid user by using the user public information, and performs authentication (corresponding to user authentication, steps S22, S12, S13, and S23). Thereafter, existing ID password authentication using OpenAM is performed.

  The ID provider server device 202 generates an assertion that is a result of user authentication, and redirects it to the service provider server device 201 (assertion transmission). The service provider server apparatus 201 checks the contents of the assertion and confirms that the request is from a valid user, and then provides a service using the procedure of this embodiment. The service provider server device 201 performs server signature on the processing result using the server secret information in order to prove that it is a legitimate server. The user terminal verifies with the server public information and confirms that the service provider server device 201 is a valid server device (service provision, corresponding to steps S25 and S14).

  Referring to FIG. 5, a specific example of a spoofing attack, the present invention, and a conventional attack countermeasure technique are compared. FIG. 5 is a diagram comparing the performances of the present invention and the prior art. The check mark in FIG. 5 indicates that the countermeasure technique is resistant to the corresponding attack. As shown in FIG. 5, it can be seen that the present invention is more robust against numerous spoofing attacks than the prior art.

<Supplementary note>
The apparatus of the present invention includes, for example, a single hardware entity as an input unit to which a keyboard or the like can be connected, an output unit to which a liquid crystal display or the like can be connected, and a communication device (for example, a communication cable) capable of communicating outside the hardware entity. Can be connected to a communication unit, a CPU (Central Processing Unit, may include a cache memory or a register), a RAM or ROM that is a memory, an external storage device that is a hard disk, and an input unit, an output unit, or a communication unit thereof , A CPU, a RAM, a ROM, and a bus connected so that data can be exchanged between the external storage devices. If necessary, the hardware entity may be provided with a device (drive) that can read and write a recording medium such as a CD-ROM. A physical entity having such hardware resources includes a general-purpose computer.

  The external storage device of the hardware entity stores a program necessary for realizing the above functions and data necessary for processing the program (not limited to the external storage device, for example, reading a program) It may be stored in a ROM that is a dedicated storage device). Data obtained by the processing of these programs is appropriately stored in a RAM or an external storage device.

  In the hardware entity, each program stored in an external storage device (or ROM or the like) and data necessary for processing each program are read into a memory as necessary, and are interpreted and executed by a CPU as appropriate. . As a result, the CPU realizes a predetermined function (respective component requirements expressed as the above-described unit, unit, etc.).

  The present invention is not limited to the above-described embodiment, and can be appropriately changed without departing from the spirit of the present invention. In addition, the processing described in the above embodiment may be executed not only in time series according to the order of description but also in parallel or individually as required by the processing capability of the apparatus that executes the processing. .

  As described above, when the processing functions in the hardware entity (the apparatus of the present invention) described in the above embodiments are realized by a computer, the processing contents of the functions that the hardware entity should have are described by a program. Then, by executing this program on a computer, the processing functions in the hardware entity are realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used. Specifically, for example, as a magnetic recording device, a hard disk device, a flexible disk, a magnetic tape or the like, and as an optical disk, a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only). Memory), CD-R (Recordable) / RW (ReWritable), etc., magneto-optical recording medium, MO (Magneto-Optical disc), etc., semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory), etc. Can be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, a hardware entity is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

Claims (8)

A user terminal that communicates with a server device,
User tamper-resistant hardware that stores user secret information that is information that is secretly managed by the user terminal and server public information that is information disclosed by the server device;
A response that is a response to the challenge transmitted from the server device is signed using the user secret information, and a response transmission unit that transmits the signed response to the server device;
Using the server secret information stored in the server tamper-resistant hardware provided in the server device, which is information secretly managed by the server device, the processing result signed by the server device is expressed by the server public information. A server signature verification unit to verify;
User terminal including A server device that communicates with a user terminal,
Server tamper-resistant hardware that stores user public information that is information disclosed by the user terminal and server secret information that is information secretly managed by the server device;
A response signed by the user terminal is verified by the user public information using the user secret information stored in the user tamper resistant hardware provided in the user terminal, which is information secretly managed by the user terminal. A user signature verification unit,
A processing result indicating a result of processing executed by the server device, signed using the server secret information, and a processing result transmitting unit that transmits the signed processing result to the user terminal;
Server device including A communication system including a user terminal and a server device,
The user terminal is
User tamper-resistant hardware that stores user secret information that is information that is secretly managed by the user terminal and server public information that is information disclosed by the server device;
A response that is a response to the challenge transmitted from the server device is signed using the user secret information, and a response transmission unit that transmits the signed response to the server device;
A server signature verification unit that verifies the processing result signed by the server device using server secret information that is information secretly managed by the server device, using the server public information,
The server device
Server tamper resistant hardware for storing user public information that is information disclosed by the user terminal and the server secret information;
A user signature verification unit that verifies the signed response with the user public information;
A processing result transmitting unit that signs the processing result indicating the result of the processing executed by the server device using the server secret information, and transmits the signed processing result to the user terminal;
A communication system including: A communication system according to claim 3,
A communication system that uses an RSA encryption method to generate a key used for the signature and the verification, and uses a random number used for the user secret information and the server secret information with a data size of 2048 bits or more. A communication method executed by a user terminal that communicates with a server device,
The user terminal is
User tamper resistant hardware for storing user secret information that is information that the user terminal manages confidentially and server public information that is information disclosed by the server device;
Signing a response that is a response to the challenge transmitted from the server device using the user secret information, and transmitting the signed response to the server device;
Using the server secret information stored in the server tamper-resistant hardware provided in the server device, which is information secretly managed by the server device, the processing result signed by the server device is expressed by the server public information. The steps to verify
The communication method to execute. A communication method executed by a server device communicating with a user terminal,
The server device
Server tamper-resistant hardware that stores user public information that is information disclosed by the user terminal and server secret information that is information secretly managed by the server device,
A response signed by the user terminal is verified by the user public information using the user secret information stored in the user tamper resistant hardware provided in the user terminal, which is information secretly managed by the user terminal. And steps to
Signing the processing result indicating the result of the processing executed by the server device using the server secret information, and transmitting the signed processing result to the user terminal;
The communication method to execute. A communication method executed by a user terminal and a server device,
The user terminal is
User tamper resistant hardware for storing user secret information that is information that the user terminal manages confidentially and server public information that is information disclosed by the server device;
Signing a response, which is a response to the challenge sent from the server device, using the user secret information, and sending the signed response to the server device,
The server device
Server tamper-resistant hardware that stores user public information that is information disclosed by the user terminal and server secret information that is information secretly managed by the server device,
Verifying the signed response with the user public information;
A process result indicating a result of the process executed by the server device is signed using the server secret information, and the signed process result is transmitted to the user terminal;
The user terminal is
A communication method for executing a step of verifying the signed processing result with the server public information.   A program for causing a computer to function as the user terminal according to claim 1.

Images