JP2022052469A - Authentication system, authentication element file, server, leakage detection method, and program - Google Patents

Abstract

To lower the risk that information accessed according to an authentication element file is stolen when the authentication element file is used for authentication.SOLUTION: An authentication element file includes a program which causes a computer to function as an operation detection unit which detects that the authentication element file was operated or an alert transmission unit which transmits an alert when operation of the authentication element file is detected by the operation detection unit.SELECTED DRAWING: Figure 2

Description

The present invention relates to a technique for performing authentication using a file as an authentication element in cyber security.

In recent years, cyber attacks have been increasing, and there are various methods for cyber security as countermeasures. For example, there is a technique called Deception.

A deception in cyber security is a cyber attack countermeasure that detects, delays, and defends an attack by deceiving or deceiving an attacker who has launched a cyber attack.

In addition, there is multi-factor authentication as a cyber security method. Multi-factor authentication is an authentication method that requires a user to have multiple types of authentication elements for identity verification required to obtain access authority. There are three types of authentication elements used in multi-factor authentication: what the user knows (knowledge information), what the user has (possession information), and the user's own characteristics (ecological information).

Japanese Unexamined Patent Publication No. 2019-140573

There are cases where files are used as an element of "what you have (possession information)" of multi-factor authentication. This file is, for example, a file assuming that the bit string of the file itself is used as a key. Hereinafter, for convenience, this file will be referred to as a "key file". Since the "key file" uses a file as an authentication element, it may be called an "authentication element file". The "key file" is an example of the "authentication factor file".

In recent years, there have been many incidents in which an attacker invades an in-house system / PC and steals confidential information from a local PC or file server, and it is not always safe to use a key file as proof of possession. It can not be said.

Moreover, since it is easy to duplicate a key file in many environments, it is difficult to distinguish between regular use and unauthorized use of the key file. Moreover, it is difficult to detect the leakage of the key file. If the leakage of the key file cannot be detected, the risk of the information accessed by the key file being stolen increases.

The present invention has been made in view of the above points, and provides a technique capable of reducing the risk of information being stolen by the authentication element file when the authentication element file is used for authentication. With the goal.

According to the disclosed technology, an authentication requesting device that sends an authentication factor file,
An authentication system including an authentication device that performs authentication using the authentication element file.
The authentication element file is provided with an authentication system which is a file in a format that makes the description contents in the authentication element file appear meaningful to a person other than the owner of the authentication element file.

According to the disclosed technology, when the authentication factor file is used for authentication, the technology that makes it possible to reduce the risk of the information accessed by the authentication factor file being stolen is provided.

It is an overall block diagram of the system in embodiment of this invention. It is a functional block diagram of the key file (program) in Example 2. FIG. It is a sequence diagram of the process in Example 2. FIG. It is a functional block diagram of the server 400 in Example 3. FIG. It is a sequence diagram of the process in Example 3. FIG. It is a functional block diagram of the server 500 in Example 4. FIG. It is a sequence diagram of the process in Example 4. FIG. It is a figure which shows the hardware configuration example of the apparatus.

Hereinafter, embodiments of the present invention (the present embodiments) will be described with reference to the drawings. The embodiments described below are merely examples, and the embodiments to which the present invention is applied are not limited to the following embodiments.

In this embodiment, by using a key file in a file format that is not normally expected to be used as a key file as one of the authentication elements, a third party (especially a malicious attacker) when the key file is leaked. It aims to reduce the risk that the leaked key file will be used as an authentication factor.

Further, in the present embodiment, the leakage of the key file is detected by the file operation of a third party (particularly a malicious attacker) for the key file as a trigger or the use of the information obtained by the file operation as a trigger. I'm supposed to do it.

Any of the above measures can reduce the risk of the information accessed by the key file being stolen. Hereinafter, the present embodiment will be described more specifically.

In the present embodiment, the key file is an example of "what you have (possession information)" in multi-factor authentication, and as its original function, the bit string of the "file" as the key file is the user (or user). It is supposed to be used as information for authenticating (terminal). However, it is not limited to this. Also, the key file may be used for authentication using one authentication element instead of multi-factor authentication.

(System configuration example)
FIG. 1 shows an example of a system configuration according to the present embodiment. In FIG. 1, the user terminal 100 and the data management device 200 are shown as an example of an authentication system that performs authentication using a key file held by the user terminal 100. The user terminal 100 may be referred to as an authentication request device, and the data management device 200 may be referred to as an authentication device.

Further, the attacker terminal 300 is a terminal that steals and holds the key file held in the user terminal 100. Since the attacker terminal 300 is connected to a network such as the Internet, it can communicate with each of the server 400, the server 500 (Software as a Service), and the administrator terminal 600 via the network. The server 400, the server 500 (Software as a Service), and the administrator terminal 600 are shown as examples of devices constituting the system for detecting the leakage of the key file.

The server 400 is, for example, a computer that stores information to be accessed. The information to be accessed may be false information for deceiving an attacker. The server 500 (Software as a Service) is a computer that provides services as a Service. The administrator terminal 600 is a computer that displays alerts and the like.

The user terminal 100 is, for example, a terminal such as a smartphone or a PC, and the data management device 200 is a server that stores information to be accessed (eg, a password). The data management device 200 may be a virtual machine on the cloud. The user terminal 100 and the data management device 200 are connected by a network and can communicate with each other.

Here, an example is shown in which the user terminal 100 accesses the data management device 200 connected by the network and acquires information, but this is an example. The user terminal 100 may be provided with a function corresponding to the data management device 200. In that case, the communication between the user terminal 100 and the data management device 200 described below may be regarded as the communication inside the user terminal 100.

The user terminal 100 has a key file generation unit 110, an authentication request unit 120, and a key file storage unit 130. The data management device 200 has an authentication unit 210 and a data storage unit 220. The user terminal 100 has a key file as "what it has (possession information)" in multi-factor authentication.

For example, in the user terminal 100, the key file generation unit 110 generates a key file, and the generated key file is stored in the key file storage unit 130. At the time of key file generation, the key file may be sent to the data management device 200, and the key file may be registered in the data management device 200 as authentication information of the user terminal 100. Further, the data management device 200 may generate a key file and transmit the key file to the user terminal 100.

As will be described later, since the key file in the present embodiment has a general file format whose contents seem to be meaningful, for example, a general PC or the like is provided as a key file generation unit 110. Various applications (word processor application, table calculation application, presentation application, file compression application, etc.) can be used. A file created by a word processor application, a spreadsheet application, a presentation application, or the like may be referred to as a "document file".

(Example of normal operation)
First, with reference to FIG. 1, an operation example when the key file is correctly used as an authentication element will be described.

When the user terminal 100 acquires the information stored in the data storage unit 220 of the data management device 200, the authentication request unit 120 of the user terminal 100 reads the key file from the key file storage unit 130 and reads the key file. Is transmitted to the data management device 200.

In the data management device 200, when the authentication unit 210 confirms (authenticates) that the key file is the possession information of the user (user terminal 10), the authentication unit 210 reads the information from the data storage unit 220 and transmits it to the user terminal 100. ..

Further, when the information stored in the data storage unit 220 is encrypted by the key file, the authentication unit 210 decrypts the encrypted information with the key file, and when the decryption is successful, the decryption is performed. The information may be transmitted to the user terminal 100. The fact that the encrypted information could be decrypted by the key file held by the user terminal 100 is an example of successful authentication of the user terminal 100.

In the above example, only the key file is used as the authentication factor for information acquisition, but this is just an example. In addition to the key file, authentication may be performed using a password, ID, PIN number, or the like. Further, in addition to the key file, fingerprint authentication or face authentication may be performed.

Hereinafter, Examples 1 to 4 will be described as more specific examples. The first embodiment is an example of reducing the risk that the key file is used as an authentication factor when the key file is leaked from the user terminal 100 to a third party (eg, the attacker terminal 300). Examples 2 to 4 are examples of detecting the leakage of the key file. In addition, Examples 1 to 4 can be carried out in an appropriate combination. Further, in the second to fourth embodiments, it is assumed that the key file described in the first embodiment is used.

(Example 1)
Example 1 includes the following Examples 1-1 to 1-3.

<Example 1-1>
In the first embodiment, as the key file used in the user terminal 100 and the data management device 200 shown in FIG. 1, a file in a format that is not normally expected to be used as a key file is used. That is, the key file generation unit 110 generates a file in a format that is not normally expected to be used as a key file.

Files in formats that are not normally expected to be used as key files include, for example, password-encrypted compressed files (eg zip files), password-locked Office files (document files), PDF files, etc. be. These files are examples of files in a format that makes the contents of the key file appear meaningful to anyone other than the owner of the key file.

<Example 1-2>
In addition, the file name of the key file may include content that the attacker is interested in (eg, server information, authentication information).

<Example 1-3>
In addition, the contents of the key file (example: sentences in the word processor document file) are the contents that the attacker is interested in (example: server information such as URL, authentication information such as ID and password, credit card number, account number). May be included.

By including the contents of interest of the attacker in the file name and the contents of the file as in Examples 1-2 and 1-3, the contents of the key file are interested rather than the existence of the key file as an authentication element. Can be turned.

By using the key files described in the above Examples 1-1 to 1-3, the key file itself has meaning for the owner (user of the user terminal 100), but the contents of the key file have meaning for others. Can be made to look like having. Therefore, when the key file is leaked, the risk that the key file is used as one of the authentication elements can be reduced, and as a result, the risk that the information accessed by the key file is stolen can be reduced. It is also possible to improve the effect of making the contents seem more important and the effect of delaying access to information by applying password encryption to the file.

Examples 1-1 to 1-3 may be carried out individually, or any two or all of them may be carried out in combination. All of the key files described in Examples 1-1 to 1-3 can be generated by the key file generation unit 110 of the user terminal 100.

The key file described in the first embodiment may be called a misdirection file. Further, a file in which the leak detection function described in the following Examples 2 to 4 is added to the key file described in the first embodiment may be referred to as a misdirection file with a leak detection function.

Hereinafter, Examples 2 to 4 will be described as examples of detecting the leakage of the key file by using the file operation and the information obtained by the file operation as a trigger.

In each of the second to fourth embodiments, it is assumed that the key file described in the first embodiment is used. In other words, it is assumed that when an attacker illegally obtains a key file, it does not recognize the key file as an authentication element, but recognizes that the contents are meaningful and opens the key file. is doing. However, in each of Examples 2 to 4, the key file described in Example 1 is not limited to being used.

(Example 2: Detection by a program with a notification function)
Next, Example 2 will be described. In the second embodiment, the key file generation unit 110 generates a key file incorporating a program with a notification function. The embedded program may be a script, a macro, or another program.

FIG. 2 shows a configuration example of the key file 10 in the second embodiment. The configuration shown in FIG. 2 may be regarded as the configuration of the program incorporated in the key file. More specifically, FIG. 2 shows a functional configuration realized by the program by a terminal (computer) on which the program is executed.

As shown in FIG. 2, the key file 10 has an operation detection unit 11 and an alert transmission unit 12. The operation detection unit 11 detects an operation on the key file 10 on the terminal in which the key file 10 is held (eg, a double-click operation with a mouse to open the key file 10). The alert sending unit 12 sends an alert (alarm message) to the administrator terminal 600 with the detection of the operation on the key file 10 by the operation detecting unit 11 as a trigger.

An operation example of the second embodiment will be described with reference to the sequence diagram of FIG. Here, it is assumed that the key file 10 is leaked from the user terminal 100 and the attacker terminal 300 holds the key file 10.

In S101, the key file 10 is operated on the attacker terminal 300. As a result, the operation detection unit 11 detects the operation, the alert transmission unit 12 generates an alert (S102), and the alert is transmitted to the administrator terminal 600 (S103).

In S104, an alert is displayed on the display of the administrator terminal 600. As a result, the user (administrator) of the administrator terminal 600 can determine that the key file 10 has leaked. In S104, for example, the information of the original owner of the key file 10, the IP address and the physical position (if available) of the attacker terminal 300 in which the key file 10 is illegally operated may be displayed.

(Example 3: Detection by access to the server)
Next, Example 3 will be described. In the third embodiment, the key file generation unit 110 generates a key file in which server information (example: URL) that is a place for storing information (for example, authentication information such as a password) that an attacker intends to steal is generated. .. The server information may be described in the key file, or the server information may be included in the name of the key file.

In the third embodiment, the server 400 in the system configuration of FIG. 1 is the place where the information is stored. The information actually placed on the server 400 may be fake authentication information, not true authentication information. The server 400 monitors the access to the server 400, determines that the key file has leaked when there is an access, and sends an alert. The server 400 is, for example, a Web server or a file server published on the Internet.

FIG. 4 shows an example of the functional configuration of the server 400 in the third embodiment. As shown in FIG. 4, the server 400 has an access detection unit 410, an alert transmission unit 420, and a data storage unit 430.

The access detection unit 410 detects access to the server 400 based on the server information described in the key file. The alert sending unit 12 sends an alert (alarm message) to the administrator terminal 600 with the detection of access to the server 400 by the access detecting unit 410 as a trigger. The data storage unit 430 stores, for example, fake authentication information.

An operation example of the third embodiment will be described with reference to the sequence diagram of FIG. Here, it is assumed that the key file is leaked from the user terminal 100 and the attacker terminal 300 holds the key file.

In S201, the key file is opened on the attacker terminal 300, and the attacker confirms the location of the authentication information. Here, as an example, it is assumed that access information (URL, etc.) to the server 400 is described as a storage location.

The attacker intends to illegally acquire the authentication information, and in S202, for example, clicks the URL to access the server 400.

When the access detection unit 410 of the server 400 detects access to the server 400 in S203, the alert transmission unit 420 generates an alert (S204) and transmits the alert to the administrator terminal 600 (S205).

In S206, an alert is displayed on the display of the administrator terminal 600. As a result, the user (administrator) of the administrator terminal 600 can determine that the key file has leaked. In S206, for example, the information of the original owner of the key file, the IP address and the physical position (if available) of the attacker terminal 300 in which the key file is illegally operated may be displayed.

(Example 4: Detection by attempting to log in to the service)
Next, Example 4 will be described. In the fourth embodiment, the key file generation unit 110 generates a key file in which authentication information for using the service provided by SaaS is described. SaaS is software (application) provided in the cloud. An example of a SaaS service is a free email service (eg, Gmail®).

The authentication information described in the key file is, for example, authentication information such as an ID and a password for using the SaaS mail service. The authentication information is the authentication information of a dummy account for deceiving an attacker.

In the fourth embodiment, the server 500 in the system configuration of FIG. 1 provides the SaaS service. The authentication information is registered in the server 500, and when a login attempt using the authentication information is detected, a login notification is sent to the administrator terminal 600.

FIG. 6 shows an example of the functional configuration of the server 500 in the third embodiment. As shown in FIG. 6, the server 500 has a login detection unit 510 and a login notification unit 520.

The login detection unit 510 detects a login based on the authentication information described in the key file. The login notification unit 520 sends login notification information for notifying that login is being attempted to the administrator terminal 600, triggered by the detection of a login attempt by the login detection unit 510.

The function of detecting a login attempt and giving a login notification as described above is a function generally provided in a SaaS mace service or the like.

An operation example of the fourth embodiment will be described with reference to the sequence diagram of FIG. Here, it is assumed that the key file is leaked from the user terminal 100 and the attacker terminal 300 holds the key file.

In S301, the key file is opened on the attacker terminal 300, and the attacker confirms the authentication information of the SaaS service (eg, mail service).

The attacker tries to log in to the service (that is, the server 500) by using the authentication information described in the key file in S302 in order to use the authentication information illegally. Here, for example, an ID and a password are input to a Web page displayed on the attacker terminal 300 by the server 500, and a transmission operation is performed.

In S303, when the login detection unit 510 of the server 500 detects a login attempt to the server 500, the login notification unit 520 gives a login notification (S304).

In S305, an alert is displayed on the display of the administrator terminal 600. As a result, the user (administrator) of the administrator terminal 600 can determine that the key file has leaked. The alert displayed in S305 may be the login notification information itself of the SaaS service, or may be the information clearly stating that the key file has been leaked.

In S305, for example, the information of the original owner of the key file, the IP address and the physical position (if available) of the attacker terminal 300 in which the key file is illegally operated may be displayed.

(Hardware configuration example)
The user terminal 100, the data management device 200, the attacker terminal 300, the server 400, the server 500, and the administrator terminal 600 (collectively referred to as "devices") are all generated by, for example, causing a computer to execute a program. realizable. This computer may be a physical computer or a virtual machine in the cloud.

That is, the device can be realized by executing a program corresponding to the processing performed by the device using hardware resources such as a CPU and a memory built in the computer. The above program can be recorded on a computer-readable recording medium (portable memory, etc.), stored, and distributed. It is also possible to provide the above program through a network such as the Internet or e-mail.

FIG. 8 is a diagram showing an example of the hardware configuration of the computer. The computer of FIG. 8 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, which are connected to each other by a bus BS, respectively. Of these, some devices may not be provided. For example, a device that does not display may not be provided with the display device 1006.

The program that realizes the processing in the computer is provided by, for example, a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed in the auxiliary storage device 1002 from the recording medium 1001 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, and may be downloaded from another computer via the network. The auxiliary storage device 1002 stores the installed program and also stores necessary files, data, and the like.

The memory device 1003 reads and stores the program from the auxiliary storage device 1002 when the program is instructed to start. The CPU 1004 realizes the function related to the device according to the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network. The display device 1006 displays a GUI (Graphical User Interface) or the like by a program. The input device 1007 is composed of a keyboard, a mouse, buttons, a touch panel, and the like, and is used for inputting various operation instructions. The output device 1008 outputs the calculation result.

(Effect of embodiment)
According to the technique described above, when the key file is leaked, it is possible to avoid or delay the use of the key file as an authentication factor. In addition, leakage of the key file can be detected. Therefore, the risk of the information accessed by the key file being stolen can be reduced.

(Summary of embodiments)
This specification discloses at least the authentication system, the authentication element file, the server, the leak detection method, and the program of each of the following items.
(Section 1)
An authentication request device that sends an authentication factor file, and
An authentication system including an authentication device that performs authentication using the authentication element file.
The authentication element file is an authentication system that is a file in a format that makes the description contents in the authentication element file appear meaningful to a person other than the owner of the authentication element file.
(Section 2)
The authentication system according to item 1, wherein the authentication element file is a password-encrypted compressed file or a password-locked document file.
(Section 3)
The authentication factor file used in the authentication system described in paragraph 1 or 2.
(Section 4)
An authentication factor file containing a program, the program of which is a computer.
Operation detection unit that detects that the authentication factor file has been operated,
An alert sending unit that sends an alert when the operation detection unit detects that the authentication factor file has been operated.
Authentication element file to function as.
(Section 5)
A server for detecting the leakage of authentication factor files.
An access detection unit that detects access to the server based on the information described in the authentication factor file, and
A server including an alert sending unit that sends an alert when the access is detected by the access detecting unit.
(Section 6)
It is a leak detection method for detecting the leakage of the authentication element file used for authentication in the authentication system.
As the authentication element file, a file containing authentication information for using the service provided on the network is used.
A leak detection method that sends a login notification to an administrator terminal when a server that provides the service detects a login attempt using the authentication information.
(Section 7)
A program for making a computer function as a server for detecting leakage of an authentication factor file, and the computer is used as a server.
An access detection unit that detects access to the server based on the information described in the authentication factor file.
An alert sending unit that sends an alert when the access is detected by the access detecting unit,
A program to function as.

Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and changes can be made within the scope of the gist of the present invention described in the claims. It is possible.

10 Key file 11 Operation detection unit 12 Alert transmission unit 100 User terminal 110 Key file generation unit 120 Authentication request unit 130 Key file storage unit 200 Data management device 210 Authentication unit 220 Data storage unit 300 Attacker terminal 400 Server 410 Access detection unit 420 Alert sending unit 430 Data storage unit 500 Server 510 Login detection unit 520 Login notification unit 600 Administrator terminal 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU
1005 Interface device 1006 Display device 1007 Input device 1008 Output device

Claims (7)

An authentication request device that sends an authentication factor file, and
An authentication system including an authentication device that performs authentication using the authentication element file.
The authentication element file is an authentication system that is a file in a format that makes the description contents in the authentication element file appear meaningful to a person other than the owner of the authentication element file. The authentication system according to claim 1, wherein the authentication element file is a password-encrypted compressed file or a password-locked document file. The authentication factor file used in the authentication system according to claim 1 or 2. An authentication factor file containing a program, the program of which is a computer.
Operation detection unit that detects that the authentication factor file has been operated,
An alert sending unit that sends an alert when the operation detection unit detects that the authentication factor file has been operated.
Authentication element file to function as. A server for detecting the leakage of authentication factor files.
An access detection unit that detects access to the server based on the information described in the authentication factor file, and
A server including an alert sending unit that sends an alert when the access is detected by the access detecting unit. It is a leak detection method for detecting the leakage of the authentication element file used for authentication in the authentication system.
As the authentication element file, a file containing authentication information for using the service provided on the network is used.
A leak detection method that sends a login notification to an administrator terminal when a server that provides the service detects a login attempt using the authentication information. A program for making a computer function as a server for detecting leakage of an authentication factor file, and the computer is used as a server.
An access detection unit that detects access to the server based on the information described in the authentication factor file.
An alert sending unit that sends an alert when the access is detected by the access detecting unit,
A program to function as.

Images