JP4372403B2 - Authentication system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a system for performing authentication through a network. In particular, the present invention relates to a personal authentication system in which a security device has a function necessary for authentication on the user side.
[0002]
[Prior art]
A server that provides a service using a network provides a specific service to a specific user and performs user management. Therefore, the user proves his / her identity when using the server service. This is authentication.
Currently, the server issues a unique authentication ID and password to the user, and when the user uses the service, the authentication ID and password (hereinafter, the authentication ID and password are referred to as ID / password) are entered. Authentication methods that confirm the identity of the person are the mainstream.
In recent years, an IC card authentication method has been developed in which an ID / password is stored in a security device such as an IC card, and the user manages the card. A security device such as an IC card has high security because it cannot read internal authentication information (in this case, ID / password) by unauthorized means.
Since the network is open and open, there are many security issues. One of the threats is “spoofing” in which a third party steals the user's own ID / password, and the third party impersonates the user and receives services from the server. In order to prevent this threat, there is a defensive measure using a public key cryptosystem that is difficult to decipher mathematically.
In the public key cryptosystem, a secret key and a public key are paired, and what is encrypted with the secret key is a public key, and what is encrypted with the public key can be decrypted only with the secret key. This private key / public key pair is called a public key pair or a private key pair.
By using this public key method, “spoofing” can be prevented. To further enhance security, a certificate authority that issues an electronic certificate that proves that the public key belongs to the user is introduced.
It is very useful to use a tamper-resistant security device as a means for storing these public key pairs and electronic certificates.
JP-A-2001-306519 discloses a system that takes advantage of this security device. This system describes that an authentication system independent of client terminals can be constructed by setting up a mediation server on the network.
[0003]
[Problems to be solved by the invention]
In the above ID / password method that does not use a security device, it is necessary to select a password that is frequently and difficult to remember in order to increase security.
This can be cumbersome to manage, and most users use a simple password that is easy to remember, or even if a difficult password is set, the user may note the password where it can be seen by a third party. .
For this reason, passwords are easy to be seen by malicious third parties, which is a big security issue.
In the system of the above publication, when authentication is performed with a server on the network, if the client side needs some function for authentication, user authentication can be used only at a specific client terminal. The portability of security devices has been compromised.
Therefore, it is an object of the present invention to provide an authentication system that does not depend on a client terminal and can be used even when different authentication methods are adopted for individual servers.
[0004]
[Means for Solving the Problems]
In order to achieve the above object, the present invention provides a security device having a processing device and a storage device, in which user authentication data related to a specific user is recorded, a server for providing various services to the specific user, and the security In an authentication system including a security device using terminal that can exchange data with a device and can be connected to the server via a network, the security device requires a user side for the server to authenticate a specific user. The function is installed. .
Further, the function is a function necessary for converting the user authentication data into a data format to be authenticated by the server.
[0005]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail.
FIG. 1 is a block diagram of an authentication system using a security device which is one embodiment of the present invention.
Here, an IC card is taken as an example of the security device.
A server 1 that provides some service can be connected to an IC card using terminal 3 through a network 2.
The IC card using terminal 3 is connected to the IC card reader / writer 4 regardless of whether it is external or internal.
The IC card 5 held by the user can exchange data with the IC card using terminal 3 via the IC card reader / writer 4.
[0006]
FIG. 2 is a block diagram showing the configuration of the server 1.
A server 1 that authenticates a user and provides a specific service to the user has an external interface 13 for performing data communication with the processing device 11, the storage device 12, and the IC card using terminal 3 via the network 2.
The storage device 12 stores an application program storage unit 121 in which a random number generation application 1211 used in the authentication procedure of the present embodiment and an application 1212 for decrypting encrypted information are stored, and information on a user who provides a service For example, a user information registration database 1221 containing a user's public key and its electronic certificate, a user ID / password as user authentication data, and a digital certificate issued by a trusted third party The application data storage unit 122 having a server public key 1223, a private key 1222, and an electronic certificate 1224, and a control program 123 functioning as an OS.
[0007]
FIG. 3 shows the structure of the IC card using terminal 3 shown in FIG.
The IC card using terminal 3 of this embodiment includes a processing device 31, such as a microprocessor, and an external interface 33 that connects the storage device 32, the network 2, and the IC card 4.
The storage device 32 stores a control program 321 that functions as an OS.
Since the network using terminal 3 in the system of the present invention is for simple data transmission, the structure is simple.
[0008]
FIG. 4 shows the structure of the IC card 5 shown in FIG.
The IC card 5 of this embodiment transfers data between a processing device 51 such as a microprocessor, a storage device 52 such as an EEPROM or a flash memory, and a device such as the IC card reader / writer 4 shown in FIG. And so on.
The storage device 52 includes an application storage unit 521 that stores functions necessary for authentication performed by the server 1, an application data unit 522 that stores various data, and a control program 523 such as an OS.
In this embodiment, the application storage unit 521 stores an application 5211 for encrypting authentication information (in this case, ID / password) to be transmitted to the server, and the application data unit 522 stores information on a plurality of servers. User information DB5221 that records user information issued from each server to cope with, for example, the public key of the server, the user authentication data issued by the server, the user ID and password, and the like A public key 5223, a private key 5222, and an electronic certificate 5224 of a user with an electronic certificate issued by a three-party organization are stored.
Note that functions necessary for authentication performed by the server 1 include, for example, an application for repeatedly transmitting authentication information to the server a plurality of times in addition to the application for encrypting the authentication information.
[0009]
5 to 7 show the operation procedure of the authentication system according to the embodiment of the present invention.
FIG. 5 shows the registration work performed before receiving the service of the server 1. A user who wants to use the service provided by the server 1 makes a registration application to a certificate authority that is a trusted third party (step 701).
The certificate authority strictly examines the registered contents of the user, and if there is no error or ineligible part, the certificate authority issues an electronic certificate attached with a private key pair unique to the user as a proof (step 702).
The issued private key pair and electronic certificate are held in the IC card 5.
At the same time, the server 1 also registers its site information with the certificate authority (step 703), and the certificate authority examines the contents registered in the server 1, and if appropriate, an electronic certificate with a private key pair unique to the server 1 attached. Issue a certificate (step 704).
The issued private key pair and electronic certificate are held in the storage device 12.
Next, the user performs user registration with respect to the server 1 that provides a service requiring authentication (step 705). What is registered is the user's electronic certificate, the user's public key, and the like.
If the server 1 determines that the service can be provided by confirming the electronic certificate or public key, which is the registered content of the user, the server 1 issues an ID / password for user-specific authentication and It is sent to the user together with the public key (step 706).
The user holds all issued information in the IC card 5.
[0010]
FIG. 6 is a sequence diagram showing an authentication operation of the IC card 5, the IC card using terminal 3, and the server 1 in the present invention.
The user who has completed user registration uses the IC card using terminal 3 with the IC card 5 attached thereto, and issues a service start request to the server 1 (step 801).
Although it is transmitted accurately through the IC card using terminal 3, since the IC card using terminal 3 simply sends the transmitted data to both the IC card 5 and the server 1 as it is, no particular description will be given hereinafter.
The server 1 prepares for user authentication and returns an authentication start response to the IC card 5 (step 802). At this time, the server 1 specifies a function necessary for authentication performed by the server 1 (for example, an encryption processing program for the server 1) in this response, and asks whether the IC card 5 has the specified function. Include.
Although it is transmitted through the IC card using terminal 3 accurately, the IC card using terminal 3 simply sends the sent data to both the IC card 5 and the server 1 as it is. There is no particular description about the intermediary.
The IC card 5 determines whether there is a function necessary for authentication performed by the server 1 according to a response from the server 1 (step 803), and if not, obtains a necessary function from the server 1. Details will be described later.
If there is, the server 1 is notified that the preparation for starting authentication is completed (step 804).
Upon receiving the notification, the server 1 generates a random number necessary for authentication (step 805).
Subsequently, the generated random number is transmitted to the IC card 5 (step 806).
[0011]
The IC card 5 encrypts the user-specific authentication ID / password stored in the user information DB and the transmitted random number using the user's private key (step 807).
Further, encryption processing is performed using the public key of the server 1 (step 808).
The IC card 5 attaches the user ID to the encrypted information and transmits it to the server 1 (step 809).
The server 1 decrypts the encrypted information in step 808 using its own secret key.
Then, the necessary user public key is extracted from the user registration information DB 1221 from the attached user ID, and the encrypted information encrypted in step 807 is decrypted (step 810).
The server 1 extracts a random number from the decrypted information and verifies whether it matches the random number transmitted by itself.
Further, an ID / password is extracted from the same information, and the ID / password is compared with the ID / password extracted from the user registration information DB 1221 to authenticate the user (step 811).
Finally, the IC card using terminal is notified of the completion of user authentication (step 812).
As a result, the user can receive the service from the server 1 (step 813).
[0012]
FIG. 7 is a sequence diagram showing operations performed by the IC card 5 and the server 1 in order to obtain a function necessary for authentication.
In the present embodiment, in consideration of the case where there is no encryption processing application that is a function that must be stored in the IC card 5, necessary functions are downloaded from the server 1 as shown in FIG.
The IC card 5 issues a download request for functions necessary for the encryption process to the server 1 via the IC card using terminal 3 (step 901).
In response to this request, the server 1 notifies the IC card 5 of information related to the function such as time and size required for downloading the function (step 902).
The IC card 5 determines from the received information whether or not the function can be downloaded. If it is possible, the IC card 5 notifies the server 1 that the function can be accepted and makes a download start request (step 903).
The server 1 starts downloading functions (step 904).
When the function download is completed successfully, the IC card 5 transmits a notification of completion to the server 1 (step 905).
[0013]
【The invention's effect】
As described above, according to the present invention, since the IC card has functions and data such as a processing application used for authentication, it becomes possible to receive services of individual servers without depending on a specific IC card using terminal. .
Further, even when a function such as a processing application used for authentication is not in the IC card, the versatility of the IC card is improved by downloading from the server.
[Brief description of the drawings]
FIG. 1 is a diagram showing a basic configuration of a system targeted by the present invention.
FIG. 2 is a diagram illustrating a configuration of a server.
FIG. 3 is a diagram showing a configuration of an IC card using terminal.
FIG. 4 is a diagram showing a configuration of an IC card.
FIG. 5 is a diagram showing a pre-registration procedure in the embodiment of the present invention.
FIG. 6 is a sequence diagram showing an authentication connection procedure in the embodiment of the present invention.
FIG. 7 is a diagram showing a procedure for downloading functions necessary for authentication in the embodiment of the present invention.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 Server 2 Network 3 IC card utilization terminal 4 IC card reader / writer 5 IC card 11, 31, 51 Processing device 12, 32, 52 Storage device 13, 33 External interface unit 53 Interface unit 121, 521 Application program storage unit 122, 522 Application data storage unit 1211 Random number generation process 1212 Decryption process 1221 User information registration DB
1222 Server private key 1223 Server public key 1224 Electronic certificate 5211 Encryption processing 5221 User information DB
5222 User private key 5223 User public key 5224 Electronic certificate

Claims (3)

E Bei a security device which records user authentication data about the user, and a plurality of servers that provide services to the user, the security device using a terminal connected via the and the server and the network exchanges of the security device and data The server performs authentication of the user on the server side in cooperation with the security device, and is an authentication system that can cope with a case where different authentication methods are adopted for each of the plurality of servers,
The security device is equipped with a function required on the user side for the server to authenticate the user ,
When the server receives a service start request from the security device using terminal, the server includes a question as to whether the security device has a function necessary for authentication performed by the server in a response to start authentication. Queries the security device for the required functionality,
The security device that receives the authentication start response downloads the necessary function from the server via the security device using terminal when the security device does not have the necessary function . The authentication system according to claim 1,
The authentication system is a function necessary for converting the user authentication data into a data format to be authenticated by the server. The authentication system according to claim 1 or 2,
An authentication system, wherein the function is a data encryption processing function.

Images