JP4671686B2 - Network file system and authentication method - Google Patents

Description

  The present invention relates to a network file system and an authentication method for mounting a file on a disk connected via a network on a file system of a terminal device.

  There is known a network file system that uses a disk drive device connected to an external information processing device (server side) as an external storage device of another information processing device (terminal side) connected via a network (for example, a patent) Reference 1).

In the network file system as described above, for example, login authentication using a user ID and a password is used to manage access rights for using the disk drive device. In such login authentication, when using the network file system, the user ID and password are transmitted from the information processing device on the terminal side to the information on the server side to perform login processing, and the correct password for the user ID is transmitted. Only when the use of the network file system is allowed.
JP 2000-10838 A

  By the way, in login authentication using a user ID and password, authentication information (user ID and password) is leaked or an account for a system that the user originally does not want is created by "spoofing" disguised as the original authentication server. There is a possibility that you will fall back.

  The present invention has been made in view of the above-described problems, and an object of the present invention is to provide a network file system and an authentication method that can contribute to improving the reliability of login authentication.

  In order to solve the above problems, the present invention provides a network file service when a file service providing unit arranged on a communication network provides a network file service that lends a storage area of the file service providing unit to a user. Registration means for issuing a welcome ID corresponding to the device ID of the mobile phone terminal to the mobile phone terminal in response to a registration request from the user to use, and registering the device ID and welcome ID in the authentication information database, and providing a file service Means for managing login to the means, when the user first accesses the file service providing means by the information utilization terminal for using the network file service, the welcome ID corresponding to the device ID of the user is Terminals used and authentication Obtained from broadcast database, and a log management unit to match these.

In the above invention, the welcome ID is a pair of a registration-side character string arbitrarily selected on the registration means side and a user-side character string arbitrarily set by the user in correspondence with the registration-side ID. In the registration process, when there is an access from a mobile phone terminal, the registration means is notified of the device ID of the mobile phone terminal and generates a registration side character string of a welcome ID corresponding to the device ID. The registration side character string is transmitted to the mobile phone terminal, the mobile phone terminal sets the user side character string corresponding to the registration side character string, and the registration side character string and the user side character string are set. The character string is returned as a welcome ID to the registration means, and the registration means stores the combination of the device ID and the returned welcome ID. The login management means refers to the authentication information database, acquires the registration-side character string and the user-side character string that are the welcome ID corresponding to the device ID, and stores the registration-side character string of the welcome ID as information. The information utilization terminal receives the registration-side character string and determines whether the registration-side character string registered in the information utilization terminal matches the received registration-side character string. If they match, the user-side character string is transmitted to the login management means, and the login management means authenticates with the user-side character string transmitted from the information use terminal .

  According to the present invention, at the time of user registration, the server side and the user side arbitrarily set a welcome ID to be paired from a device other than the information use terminal such as a mobile phone, and when logging in, Since the welcome ID is mutually authenticated, it is possible to prevent not only impersonation on the user side but also impersonation by a malicious server.

  In the above invention, the information use terminal includes an authentication information holding means for holding the device ID of the user's mobile phone terminal and a welcome ID issued to the mobile phone terminal; And a login control means for comparing the welcome ID received from the login management means with the welcome ID stored in the authentication information holding means and continuing the login process only if they match. Is preferred.

  In the above invention, it is preferable that the storage area of the file service providing means is automatically incorporated in the information using terminal by a plug-in downloaded from the communication network.

  In the present invention, since the login process is not continued on the information processing terminal side unless the login management means transmits the welcome ID corresponding to the device ID from the information use terminal to the information use terminal, the login management means prevents impersonation of the login management means. It can contribute to the improvement of the certainty of authentication.

  Embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a configuration of a network file system according to the present embodiment.

  For example, as shown in FIG. 1, the network file system according to the present embodiment has authentication information in response to a request from a mobile phone terminal 3 connected via a mobile communication network including a network 1, a base station 2, and the like. A registration server 10 for registering a network, a network file server 20 for providing a network file service, an information use terminal 30 for use of a service provided by the registration server 10 connected via the network 4, and a network file system. And a plug-in providing server 40 that provides plug-ins to be used.

  The registration server 10 includes a connection processing unit 11 that controls communication with the network 1, a UID detection unit 12 that detects a device ID (UID) unique to each mobile phone terminal 3, such as a telephone number and a device identification number, and the like. A registration processing unit 13 that executes user account registration processing, a WID generation unit 14 that generates and issues a different welcome ID (WID) for each UID, and an authentication information holding unit 15 that holds authentication information (UID 15a and WID 15b) And.

  The registration processing unit 13 includes, for example, a Web server 13 a serving as a front end for the Web browser of the mobile phone terminal 3 and a mail server 13 b that transmits mail to the mobile phone terminal 3.

  The network file server 20 includes a disk 21 for storing user data, a file service providing unit 22 for providing a network file service realized by, for example, the CIFS protocol, the NFS protocol, the FTP protocol, or the WebDAV protocol, and the network 4. A connection processing unit 23 that controls communication with each other, an authentication information database 24 that stores authentication information for each user, and a login management unit 25 that executes login processing.

  A predetermined storage area (user area A, user area B,...) Is allocated to the disk 21 for each user, and is lent to the user.

  The information use terminal 30 is composed of a general-purpose information processing apparatus such as a personal computer, for example, and a web browser that uses a web service provided by the connection processing unit 31 that controls communication with the network 4 and the web server 42. 32, a disk drive device (physical disk) 34, a removable disk 35, and a file system 36 that manages the physical disk 34, the removable disk 35, and the like.

  The file system 36 can handle the user area provided by the network file service provided by the network file server 20 as the virtual drive 37 of the information use terminal 30. For this purpose, the file system 36 includes a plug-in 50 that defines virtual drive processing, an authentication information holding unit 60 that holds authentication information, and the like.

  The plug-in providing server 40 holds a plug-in 41 for using the network file service, and the web server 42 can provide the plug-in 41 to the information use terminal 30 or the like.

  The plug-in 50 includes a login processing unit 51 that executes a login process for the login management unit 25, and a file service client 52 that uses a network file service provided by the file service providing unit 22. The plug-in 50 can be acquired from a predetermined address (URL) corresponding to the Web server 42 by the Web browser 32, for example. This URL is notified to the user in the registration process in the registration server 10, for example.

  The authentication information holding unit 60 is configured to hold, for example, a UID 61, a WID 62, a password (P / W) 63, and a cookie 64. The UID and WID are set by the user after the registration process is completed. For example, the password is set when the login process is performed for the first time. The cookie is provided from the login management unit 25 when the login process is performed for the first time, and is stored in the authentication information holding unit 60 when the user selects holding.

  In the network file system configured as described above, a user who intends to use a network file service first accesses the Web server 13a of the registration server 10 from, for example, the user's mobile phone terminal 3, and the user name, address, A telephone number, a mobile phone number, a mail address of the mobile phone terminal 3, a fee payment method, etc. are input. At this time, for example, as shown in FIG. 2, the mobile phone terminal 3 notifies the registration server 10 of a unique UID for each mobile phone terminal 3 (S1).

  This UID is detected by the UID detection unit 12 and supplied to the WID generation unit 14 via the Web server 13a. The WID generation unit 14 generates a registration-side character string of a unique welcome ID (WID) for each UID and supplies it to the Web server 13a.

  This welcome ID is composed of a pair of a registration-side character string arbitrarily selected on the registration means side and a user-side character string arbitrarily set by the user in correspondence with the registration-side ID. For example, the registration-side character string is “mountain”, and the character string associated with the registration-side character string by the user, for example, “river”. These “mountain” and “river” are paired to form a WID. .

  The Web server 13a generates a message notifying the registered character string of the WID addressed to the mobile mail address input by the user, and causes the mail server 13b to transmit the message to the mobile phone terminal 3 (S2). At this time, the Web server 13 a may notify the address of the Web server 42 of the plug-in providing server 40. In the present embodiment, the WID registration side character string is notified to the user by e-mail, but may be notified on a Web page, for example.

  The user who is notified of the registration-side character string sets a user-side character string corresponding to the registration-side character string, and registers the registration-side character string and the user-side character string as a set as a WID. Reply to the server 10 side.

  In response to this reply, the Web server 13a stores the combination of the UID 15a stored in the authentication information holding unit 15 and the returned WID 15b (registration side character string and user side character string) in the authentication information database 24 ( S3). Thereby, it will be in the state in which the login management part 25 can perform the login process corresponding to the said UID.

  When the registration process is completed, the user operates the web browser 32 to access the address of the web server 42. The plug-in 41 is configured as an ActiveX plug-in, for example, and the Web server 42 transmits the plug-in 41 in response to an access from the Web browser 32. When the plug-in 41 is received, the web browser 32 adds the plug-in 50 to the file system 36. As a result, the network file system can be used.

  Before executing the login process for the first time, the user sets the registered welcome ID (WID: registration-side character string and user-side character string) and the device ID (UID) of the mobile phone terminal 3 in the information use terminal 30. . Thereafter, when the network file service is used for the first time, the login processing unit 51 sets a password.

  Specifically, as shown in FIG. 3, for example, first, the login processing unit 51 notifies the login management unit 25 of the UID (S11). In response to this, the login management unit 25 refers to the authentication information database 24 to obtain the WID (registration side character string and user side character string) corresponding to the UID, and uses the WID registration side character string of the information utilization terminal 30. It transmits to the login processing unit 51. On the information use terminal 30 side, when the registration side character string is received, the login processing unit 51 refers to the authentication information holding unit 60, and the registration side character string of the registered WID 62 and the registration received from the login management unit 25. It is determined whether the side character strings match.

  In step S12, if they do not match, the login processing unit 51 does not perform subsequent login processing. If they match, the user-side character string is transmitted from the login processing unit 51 to the login management unit 25, and collation is performed in the login management unit 25 (S12).

  If this is the first login process after this verification, the user is requested to input a password (P / W), and the input P / W is transmitted to the login management unit 25. When the already registered P / W 63 is used in the second and subsequent login processes, the P / W 63 is transmitted to the login management unit 25 (S13).

  If it is the first login process, the login management unit 25 registers the P / W from the information use terminal 30 in the authentication information database 24, generates a cookie for identifying each information use terminal 30, and uses the information. It transmits to the login process part 51 of the terminal 30 (S14). When accepting the cookie, the login processing unit 51 stores the cookie in the authentication information holding unit 60 and notifies the login management unit 25 that the cookie is accepted (S15). Upon receiving this notification, the login management unit 25 registers the previously transmitted cookie in the authentication information database 24. As a result, in the subsequent login process, the login process can be executed by transmitting a cookie.

  Thereafter, the file service client 52 requests file information from the file service providing unit 22 (S16). The file service providing unit 22 transmits information on the file in the area allocated to the user on the disk 21 to the file service client 52 (S17). In response to this, the file service client 52 mounts the area allocated on the disk 21 as the virtual drive 37 of the information use terminal 30.

  In this network file system, as described above, the login processing unit 51 transmits a UID to the login management unit 25, the login management unit 25 transmits a WID corresponding to the UID to the information use terminal 30, and this WID is registered in advance. As long as the WID notified from the server 10 does not match, the login processing unit 51 does not continue the login process. Therefore, for example, as shown in FIG. 4, when the login management unit 25 does not transmit the WID, or, for example, as shown in FIG. 5, the WID from the login management unit 25 matches the WID notified from the registration server 10 in advance. If not, the login processing unit 51 does not continue the login process. For this reason, impersonation by an unauthorized login management means can be prevented, which can contribute to the reliability of login authentication.

  Further, in this network file system, since the mail notifying the WID is addressed to the mail address of the mobile phone terminal 3, the possibility of information leakage is reduced as compared with the case of addressing to a normal mail address on the Internet. be able to. For this reason, it can contribute to the improvement of security.

  When the cookie 64 is already registered in the authentication information holding unit 60, for example, as shown in FIG. 4, the login processing unit 51 transmits cookie instead of UID and P / W during the login processing. It is only necessary to do (S41). Upon receiving the cookie, the login management unit 25 checks the authentication information database 24, acquires the user UID corresponding to the cookie, and notifies the information use terminal 30 that the authentication has been successful if the cookie is normal. (S42).

  Thereafter, as in S16 and S17 in FIG. 3 described above, the file service client 52 requests file information from the file service providing unit 22 (S43), and the file service providing unit 22 Information on the file in the area allocated to the user is transmitted to the file service client 52 (S44). In response to this, the file service client 52 mounts the area allocated on the disk 21 as the virtual drive 37 of the information use terminal 30.

  In the above-described embodiment, an example in which the UID of the mobile phone terminal 3 is detected by the WID generation unit 14 has been described. However, the mobile phone number registered in the Web server 13a may be used as the UID. In this case, the UID detection unit 12 may not be provided.

It is a block diagram which shows the structural example of the network file system which concerns on embodiment of this invention. It is a sequence diagram which shows the example of the registration process in the said network file system. It is a sequence diagram which shows the example of the login process in the said network file system. It is a sequence diagram which shows the example of the login process in the said network file system. It is a sequence diagram which shows the example of the login process in the said network file system. It is a sequence diagram which shows the example of the login process in the said network file system.

Explanation of symbols

3 ... mobile phone terminal 10 ... registration server 12 ... UID detection unit 13 ... registration processing unit 14 ... WID generation unit 20 ... network file server 21 ... disk 22 ... file service providing unit 24 ... authentication information database 25 ... login management unit 30 ... Information use terminal 32 ... Web browser 36 ... File system 50 ... Plug-in 51 ... Login processing part 52 ... File service client 60 ... Authentication information holding part

Claims (5)

A system for providing a network file service that lends a storage area of the file service providing means to a user by a file service providing means arranged on a communication network,
The welcome ID corresponding to the device ID of the mobile telephone terminal in response to the registration request from the user to use the network file services issued to the mobile telephone terminal, and registers the device ID and welcome ID in the authentication information database registration Means,
Means for managing login to the file service providing means, when the user first accesses the file service providing means by an information use terminal for using the network file service; Login management means for acquiring a corresponding welcome ID from the information using terminal and the authentication information database, and collating them,
The welcome ID is composed of a pair of a registration side character string arbitrarily selected on the registration means side and a user side character string arbitrarily set by the user corresponding to the registration side ID. ,
During the registration process,
When there is an access from the mobile phone terminal, the registration means is notified of the device ID of the mobile phone terminal, generates the registration-side character string of the welcome ID corresponding to the device ID, and the registration-side character Send a column to the mobile phone terminal,
The mobile phone terminal sets the user-side character string corresponding to the registration-side character string, and uses the registration-side character string and the user-side character string as a set as the welcome ID. Reply to the means,
The registration means stores a combination of the device ID and the returned welcome ID,
At login,
The information utilization terminal notifies the login means of the device ID,
The login management means refers to the authentication information database, acquires a registration-side character string and a user-side character string that are the welcome ID corresponding to the device ID, and uses the registration-side character string of the welcome ID as the information Send it to your device,
The information use terminal receives the registration-side character string, determines whether the registration-side character string registered in the information use terminal and the received registration-side character string match, If so, send the user side string to the login management means,
The network file system according to claim 1, wherein the login management means performs authentication based on the user-side character string transmitted from the information using terminal . The information using terminal is
An authentication information holding means for holding a welcome ID issued to a device ID and addressed to the mobile phone terminal of the user of the mobile telephone terminal,
A device ID transmitting means for transmitting a device ID to the login management means at the time of login;
A login control unit that compares the welcome ID received from the login management unit with a welcome ID stored in the authentication information holding unit and continues the login process only when they match with each other. 2. The network file system according to 1.   The network file system according to claim 1, wherein the storage area of the file service providing means is automatically incorporated in the information using terminal by a plug-in downloaded from the communication network. A method of providing a network file service that lends a storage area of the file service providing means to a user by a file service providing means arranged on a communication network,
Depending on the registration request from the user, which utilizes the network file service, by the registration means, and step (1) to issue a welcome ID corresponding to the device ID of the mobile telephone terminal addressed to the portable telephone terminal,
Registering a welcome ID corresponding to the device ID in an authentication information database (2);
When the user accesses the file service providing means for the first time by the information using terminal for using the network file service, the information management terminal uses a login management means to provide a welcome ID corresponding to the user's device ID. And obtaining from the authentication information database and collating them (3),
The welcome ID is composed of a registration-side character string arbitrarily selected on the registration means side and a user-side character string arbitrarily set by the user in correspondence with the registration-side ID.
In the step (1), when there is an access from the mobile phone terminal, the registration means is notified of the device ID of the mobile phone terminal and generates the registration side character string of the welcome ID corresponding to the device ID. The registration-side character string is transmitted to the mobile phone terminal, and the mobile phone terminal sets the user-side character string corresponding to the registration-side character string, and the registration-side character string and the user-side character A character string that is a set of columns is returned to the registration means as the welcome ID,
In the step (2), the registration means stores a combination of the device ID and the returned welcome ID,
In step (3),
The information utilization terminal notifies the login means of the device ID,
The login management means refers to the authentication information database, acquires a registration-side character string and a user-side character string that are the welcome ID corresponding to the device ID, and uses the registration-side character string of the welcome ID as the information Send it to your device,
The information use terminal receives the registration-side character string, determines whether the registration-side character string registered in the information use terminal and the received registration-side character string match, If so, send the user side string to the login management means,
The authentication method , wherein the login management means performs authentication by using the user side character string transmitted from the information using terminal . In step (3),
A step in which the user registers the device ID and welcome ID information use terminal used for the use of the service,
Transmitting the device ID from the information utilization terminal to a login management means;
The login management means acquiring the welcome ID corresponding to the device ID from the information use terminal from the authentication information database and transmitting it to the information use terminal;
The authentication method according to claim 4, further comprising a step of continuing a login process only when the welcome ID matches the welcome ID registered in the information using terminal.

Images