JP5322144B2 - Terminal authentication system, terminal authentication method, program, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To authenticate a normal user in a short time without using special authentication information. <P>SOLUTION: By forming a virtual map on a communication network 10 and measuring the propagation time of a connection request command from servers 12a, 12b, 12c side or a client 11 side, a client 11 having requested access or services is authenticated whether or not the client 11 is previously registered. Furthermore, the location on the virtual map is specified by the virtual distance between the plurality of servers 12a, 12b, 12c and the client 11, and it is authenticated whether or not the client 11 is from a previously specified location. <P>COPYRIGHT: (C)2009,JPO&amp;INPIT

Description

  The present invention relates to an authentication method for a communication network including a server and a client, and more particularly to a terminal authentication system, a terminal authentication method, a program, and a recording medium.

  In a service that distributes content such as video, still images, and music via a communication network, a technique has been proposed for confirming whether an individual or terminal that desires content distribution is a legitimate user (for example, Patent Documents 1 to 3).

The user's location information is accumulated in the accessed terminal, and authentication is performed by the accessed terminal collating the location information acquired by the user with the satellite positioning system. In this method, it is essential to receive radio signals from a plurality of satellites in order to obtain an accurate position. Even in outdoor reception, reception is hindered in the shadows of high-rise buildings in the city center, and the position accuracy decreases. Furthermore, in the basement and indoors, radio wave reception was completely interrupted, and location information could not be obtained.
JP 2007-4243 A JP 2006-108834 A JP 2006-252016 A

  As described above, conventionally, since it is necessary to acquire authentication information for identifying a user from the outside such as a satellite and transmit / receive the authentication information, it takes time until the authentication is received. In some cases, even legitimate users could not be authenticated because they could not be acquired.

  An object of this invention is to authenticate a regular user in a short time without using special authentication information.

  In order to achieve the above object, the present invention is characterized in that an authorized user is authenticated by using a temporal positional relationship on a communication network between a client and a server. Since a transfer delay time that is always generated when communication between the client and the server is used, a legitimate user can be authenticated in a short time without using special authentication information.

Specifically, the terminal authentication system according to the present invention is a terminal authentication system in which a plurality of servers and clients with synchronized clock frequencies are connected by a communication network including a plurality of routers, and the server includes: Authentication information storage means for storing a transfer delay time between the client and the server in advance, and a transfer delay time between the client and the server when the traffic falls below a preset constant value The transfer delay time acquisition means for acquiring the transfer delay time acquired by the transfer delay time acquisition means is compared with the transfer delay time stored in the authentication information storage means, and acquired by the transfer delay time acquisition means. The transfer delay time is within the error range of the transfer delay time stored in the authentication information storage means, and the transfer delay time By the number of transfer delay time to get the time acquiring unit has become a predetermined number, and authentication information collation means for authenticating that the said client that the client is registered,
Is provided.

  Since the transfer delay time between the server and the client is used for the authentication information, the authorized user can be authenticated in a short time without using special authentication information. Furthermore, since the server acquires the transfer delay time to the same client, the accuracy of authentication can be improved.

That the clock frequency is synchronized means that the frequency counted by the clock of the server or client is synchronized. As a result, the server or client whose clock frequency is synchronized is clocked at the same period.
That the time is synchronized means that the absolute times of the clocks possessed by the server or the client coincide. As a result, the server or client with synchronized time keeps the same time.

  In the terminal authentication system according to the present invention, each of the servers acquires the transfer delay time at a predetermined timing, and sets the transfer delay time stored in the authentication information storage means to the acquired transfer delay time. It is preferable to further include authentication information updating means for updating. By updating the verification destination of the authentication information verification unit to the latest information, it is possible to prevent impersonation of a third party.

In the terminal authentication system according to the present invention, the transfer delay time acquisition unit acquires the transfer delay time a plurality of times,
Preferably, the authentication information collating unit calculates an average value of transfer delay times acquired by the transfer delay time acquiring unit, and compares the average value with a transfer delay time stored in the authentication information storage unit. . By calculating the average value of the round-trip transfer delay time, it is possible to determine that the client is a registered client even if a connection between the client and the server is established through a route different from the route at the time of registration. .

  In the terminal authentication system according to the present invention, the authentication information verification unit further calculates a variance of the transfer delay time acquired by the transfer delay time acquisition unit, and sets the range of the variance centered on the average value as the variance range. It is preferable to collate with the transfer delay time stored in the authentication information storage means. The accuracy of authentication can be increased.

Specifically, the terminal authentication system according to the present invention is a terminal authentication system in which two or more servers and clients synchronized in clock frequency are connected by a communication network including a plurality of routers. Transfer delay time acquiring means for acquiring a transfer delay time between the client and the server when the traffic falls below a predetermined value , and the transfer delay acquired by the transfer delay time acquiring means, respectively. Authentication information transmitting means for transmitting a time to a predetermined authentication server of the servers, wherein the authentication server further receives a transfer delay time transmitted by the authentication information transmitting means. A delay time receiving means; and a server and a client connected to the communication network. Authentication information storage means for storing the location for each server, authentication information storage means for storing the transfer delay time received by the transfer delay time reception means for each server, and transfer stored by the authentication information storage means The error of the transfer delay time stored in the authentication information storage unit when the transfer delay time acquired by the transfer delay time acquisition unit is referred to the authentication information storage unit when there are two or more delay times. Authentication for authenticating that the client is a registered client because the transfer delay time acquired by the transfer delay time acquisition means is a predetermined number. Information collating means.

  A virtual location on the communication network is used. A virtual position on the communication network can be specified by the position of the server and the transfer delay time. By acquiring the transfer delay time and storing this position in the authentication information storage means in advance, the authentication information collating means identifies the virtual position on the communication network of the client, and the client registered in advance It can be determined whether or not. As described above, since the position of the client mapped on the virtual map formed on the communication network is used as the authentication information, the authorized user can be authenticated in a short time without using special authentication information. .

  In the terminal authentication system according to the present invention, each of the servers further includes a latest transfer delay time acquisition unit that acquires the transfer delay time at a predetermined timing, and a transfer delay acquired by the latest transfer delay time acquisition unit. Latest transfer delay time transmission means for transmitting time to the authentication server, and the authentication server further stores the transfer delay time transmitted by the latest transfer delay time transmission means and the authentication information storage means. Authentication information updating means for calculating the position of the client using the position of the server being updated and updating the position of the client stored in the authentication information storage means to the calculated position of the client. Is preferred. By updating the verification destination of the authentication information verification unit to the latest information, it is possible to prevent impersonation of a third party.

  In the terminal authentication system according to the present invention, the transfer delay time acquiring unit acquires the transfer delay time a plurality of times, calculates an average value of the acquired transfer delay times, and the authentication information transmitting unit includes the transfer delay time. It is preferable that the average value calculated by the acquisition unit is transmitted as a transfer delay time to a predetermined authentication server among the servers. By calculating the average value of the transfer delay time, it is possible to determine that the client is a registered client even when a connection between the client and the server is established through a route different from the route at the time of registration.

  In the terminal authentication system according to the present invention, the transfer delay time acquisition unit transmits an instruction to transmit the time of the client to the client, and calculates a time difference between the time of the client received from the client and the time of the server. Measure and acquire the time difference as a transfer delay time from the client to the server. When the client receives an instruction to transmit the time of the client from the transfer delay time acquisition unit, the client sends the transfer time to the transfer delay time acquisition unit. It is preferable to provide client response signal transmission means for transmitting the time of the client. Since the clock frequency is synchronized between the client and the server, the reproducibility of the measured value of the transfer delay time is good.

  In the terminal authentication system according to the present invention, when the transfer delay time acquisition unit receives an instruction to transmit the server time from the client, the transfer delay time acquisition unit transmits the server time to the client, and the server receives the server The time difference between the time of the client and the time of the client is transmitted to the client, and acquired as a transfer delay time from the server to the client from the time difference, and the client sends an instruction to the server to transmit the time of the server Client measurement instruction transmission means for transmitting, client authentication information transmission means for receiving the server time from the server, measuring a time difference between the server time and the client time, and transmitting the time difference to the server Are preferably provided. Since the clock frequency is synchronized between the client and the server, the reproducibility of the measured value of the transfer delay time is good.

  In the terminal authentication system according to the present invention, it is preferable that communication in the TCP layer is performed between the server and the client, and a TCP layer time stamp is included in the acknowledgment signal (ACK). By using the time stamp of the TCP layer, the transfer delay time can be measured when the TCP connection is established.

  In the terminal authentication system according to the present invention, it is preferable that the server and the client are synchronized in time. When the time is synchronized, the transfer delay time at the absolute time is guaranteed.

A terminal authentication method according to the present invention is a terminal authentication method used in a terminal authentication system in which a plurality of servers and clients whose clock frequencies are synchronized are connected to each other via a communication network including a plurality of routers. A transfer delay time acquisition step in which the server that is equal to or less than a set fixed value acquires a transfer delay time between the server and the client, and a transfer delay acquired by the server in the transfer delay time acquisition step The time is compared with the transfer delay time stored in the authentication information storage means in which the transfer delay time between the server and the client is stored in advance, and the transfer delay time acquired by the transfer delay time acquisition means is By being within the error range of the transfer delay time stored in the authentication information storage means, and the transfer delay By the number of transfer delay time obtained between acquisition step becomes a predetermined number, has an authentication information collation step of authenticating said client is a client that has been registered in order.

  Since the transfer delay time between the server and the client is used for the authentication information, the authorized user can be authenticated in a short time without using special authentication information. Furthermore, since the server acquires the transfer delay time to the same client, the accuracy of authentication can be improved.

A terminal authentication method according to the present invention is a terminal authentication method used in a terminal authentication system in which two or more servers and clients having synchronized clock frequencies are connected by a communication network including a plurality of routers. Of which the predetermined authentication server receives the transfer delay time between the server and the client acquired by the server when each traffic is equal to or less than a predetermined value set in advance. A receiving step; an authentication information storing step for storing the transfer delay time received in the transfer delay time receiving step for each of the servers provided with the authentication information transmitting means; and a transfer delay time stored in the authentication information storing means is 2 When there are more than two, the server and the client connected in the communication network The transfer delay time acquired in the transfer delay time acquisition step is stored in the authentication information storage step with reference to the authentication information storage means in which the virtual position of the client on the communication network is stored for each server. And that the client is a registered client when the number of transfer delay times acquired in the transfer delay time acquisition step reaches a predetermined number. Authentication information collating step.

  A virtual location on the communication network is used. A virtual position on the communication network can be specified by the position of the server and the transfer delay time. By acquiring the transfer delay time and storing this position in the authentication information storage means in advance, the authentication information collating means identifies the virtual position on the communication network of the client, and the client registered in advance It can be determined whether or not. As described above, since the position of the client mapped on the virtual map formed on the communication network is used as the authentication information, the authorized user can be authenticated in a short time without using special authentication information. .

  The terminal authentication program according to the present invention is a terminal authentication program for causing a computer to execute the terminal authentication method according to the present invention. By causing the computer to execute the terminal authentication program, the authorized user can be authenticated in a short time without using special authentication information.

  The storage medium according to the present invention is a computer-readable storage medium that records the terminal authentication program according to the present invention. By causing the computer to read the terminal authentication program and causing the computer to execute the program, the authorized user can be authenticated in a short time without using special authentication information.

  According to the present invention, since a client can be authenticated from anywhere as long as a communication network between a server and a client can be secured, a regular user can be authenticated in a short time without using special authentication information.

Embodiments of the present invention will be described with reference to the accompanying drawings. The embodiment described below is an example of the configuration of the present invention, and the present invention is not limited to the following embodiment.
(Embodiment 1)
FIG. 1 is a schematic configuration diagram of a terminal authentication system according to the first embodiment. In the terminal authentication system shown in FIG. 1, servers 12 a, 12 b, and 12 c are connected to a client 11 through a communication network 10. In the present embodiment, only the client 11 is shown, but the number of clients is not limited to this. For example, it may be two or more. Moreover, although only three servers 12a, 12b, and 12c are shown in the present embodiment, the number may be two or less, or may be four or more.

  The communication network 10 is a communication network that connects the client 11 and a plurality of servers 12a, 12b, and 12c. The communication network 10 may be either a wide area network or a private network, may be wired or wireless, and may be either a public line or a dedicated line. In the present embodiment, as an example of the communication network 10, only some routers 13a, 13b, and 13c constituting the communication network 10 are shown, and others are omitted.

  The routers 13a, 13b, and 13c transfer information transmitted from the client 11 to the server 12a, 12b, or 12c. For example, when the client 11 and the server 12a transmit and receive, the router 13a and the router 13b transfer information.

  The client 11 is a terminal that acquires information from the server 12 a via the communication network 10. The client 11 is a terminal that is permitted to provide information from the servers 12a, 12b, and 12c and that has completed registration in the servers 12a, 12b, and 12c. The client 11 may be a fixed terminal or a wireless terminal.

  The servers 12a, 12b, and 12c store authentication information with the client 11, and provide services to the client 11 when verification with the authentication information is established. In the present embodiment, all of the servers 12a, 12b, and 12c have a function of collating the client 11, but as an example, a case where the server 12a authenticates the client 11 will be described.

  FIG. 2 is a schematic configuration diagram illustrating an example of functions of the server. The server 12 a includes an authentication information storage unit 21, a transfer delay time acquisition unit 22, and an authentication information verification unit 23. It is preferable that the server 12a further includes an authentication information update unit 34. In FIG. 2, the communication network (reference numeral 10 in FIG. 1) connecting the server 12a and the client 11 is omitted.

  The terminal authentication method according to the present embodiment is a terminal authentication method used in the terminal authentication system according to the present embodiment, and includes a transfer delay time acquisition step for causing the device to function as the transfer delay time acquisition unit 22, authentication information An authentication information collating step for causing the collating unit 23 to function. In the terminal authentication method, it is preferable to further include a latest transfer delay time update step for functioning as the authentication information update means 34 before the transfer delay time acquisition step. The terminal authentication program according to the present embodiment is a terminal authentication program for causing a computer to execute the terminal authentication method according to the present embodiment. The terminal authentication program may be recorded on a computer-readable storage medium.

  The authentication information storage means 21 stores a transfer delay time between the server 12a and the client 11 in advance. When starting the information providing service to the client 11, the server 12 a acquires the transfer delay time with the client 11 and stores it in the authentication information storage unit 21. In this embodiment, the number of clients 11 is one, but in the case of two or more, the authentication information storage unit 21 stores the transfer delay time between each client 11. When the server 12a further includes the authentication information update unit 34, the transfer delay time stored in the authentication information storage unit 21 is updated to the latest information.

  The transfer delay time acquisition unit 22 acquires the transfer delay time with the client 11 through the same route as the authentication information update unit 34. For example, when the client 11 accesses the server 12a, the transfer delay time acquisition unit 22 acquires the transfer delay time with the client 11. Here, the transfer delay time is the time acquired by the server 12a or the time acquired by the client 11. When the connection from the client 11 to the server 12a is set, the transfer delay time acquisition unit 22 acquires the transfer delay time.

  Furthermore, it is preferable that the transfer delay time acquisition unit 22 acquires the transfer delay time with the client 11 a plurality of times. Furthermore, it is preferable that the transfer delay time acquisition unit 22 calculates an average value of the acquired transfer delay times. By calculating the average value of the transfer delay time, even when the connection between the client 11 and the server is established through a route different from the route at the time of registration, the authentication information collating unit 23 performs the registered client 11 Can be determined.

  FIG. 3 is a sequence diagram showing a first example of a method for measuring a transfer delay time. In the first example of the method for measuring the transfer delay time, the client 11 includes client response signal transmission means. An example of a 3-way handshake in normal TCP connection establishment will be described. The client 11 transmits SYN (connection request) to the server 12a.

  When receiving the SYN from the client 11, the transfer delay time acquisition unit of the server 12 a transmits an instruction to transmit the time of the client 11 to the client 11. The instruction to transmit the time of the client 11 may be, for example, an ACK (acknowledgment) for SYN from the client 11. In this case, the transfer delay time acquisition unit of the server 12a transmits an ACK (acknowledgment) to the SYN from the client 11 and the SYN from the server 12a to the client 11.

  When the client response signal transmission unit of the client 11 receives an instruction to transmit the time of the client 11 from the transfer delay time acquisition unit of the server 12a, the client response signal transmission unit transmits the time of the client 11 to the transfer delay time acquisition unit of the server 12a. Alternatively, the client response signal transmission unit of the client 11 receives the ACK from the server 12a, and transmits the ACK for SYN from the server 12a and the time of the client 11 to the transfer delay time acquisition unit of the server 12a.

  The transfer delay time acquisition unit of the server 12a receives the ACK from the client 11 and the time of the client 11. Then, the time difference between the time of the client 11 and the time of the server 12a is measured and acquired as the transfer delay time. Even if time synchronization is not established between the client 11 and the server 12a, the transfer delay time can be obtained with good reproducibility because the client 11 and the server 12a are synchronized in clock frequency. If the time synchronization is established between the client 11 and the server 12a, the same transfer delay time is guaranteed whether measured by the server 12a or the client 11.

  FIG. 4 is a sequence diagram showing a second example of the method for measuring the transfer delay time. In the second example of the method for measuring the transfer delay time, the client 11 includes a client measurement instruction transmission unit and a client authentication information transmission unit. The second example of the method for measuring the transfer delay time shows an example of a 3-way handshake in establishing a TCP connection including time information.

  The client measurement instruction transmission means of the client 11 transmits an instruction to transmit the server time to the server. For example, the client 11 may transmit an instruction to transmit the time of the SYN and the server to the server, or may use SYN as an instruction to transmit the time of the server.

  When the transfer delay time acquisition unit of the server 12a receives an instruction to transmit the server time from the client measurement instruction transmission unit, the transfer delay time acquisition unit transmits the time of the server 12a to the client measurement instruction transmission unit. Alternatively, the server 12a transmits an ACK to the SYN from the client 11, the SYN from the server 12a, and the time of the server 12a to the client 11.

  The client authentication information transmission unit of the client 11 receives the server time from the server 12a, the client measurement instruction transmission unit measures the time difference between the server 12a time and the client 11 time, and transmits the measured time difference to the server. To do. Alternatively, the client 11 receives ACK and SYN from the server 12a and the time of the server 12a. By receiving the ACK, the client 11 establishes a connection from the client 11 to the server 12a. Then, an ACK for SYN from the server 12a and a time difference between the time of the server 12a and the time of the client 11 are transmitted to the server 12a.

  The transfer delay time acquisition unit of the server 12a receives the time difference from the client authentication information transmission unit. Alternatively, the server 12a receives an ACK and a time difference from the client 11. The server 12a acquires the time difference as the transfer delay time from the server 12a to the client 11. Even if time synchronization is not established between the client 11 and the server 12a, the transfer delay time can be obtained with good reproducibility because the client 11 and the server 12a are synchronized in clock frequency. If the time synchronization is established between the client 11 and the server 12a, the same transfer delay time is guaranteed whether measured by the server 12a or the client 11.

  Here, in the first and second examples of the method for measuring the transfer delay time described with reference to FIGS. 3 and 4, a TCP layer time stamp is added to the response signal (ACK) between the server and the client. It is preferable to include. In the conventional measurement of the transfer delay time, the transfer delay time is measured by sending a measurement packet and receiving the packet. In this case, if the measurement frequency is increased, the traffic of the measurement packet may not be ignored due to the line capacity. In this embodiment, a transfer delay time measurement function can be embedded in a protocol used in a TCP / IP operation indispensable on a general Internet. By embedding time information in the packet with almost no change in this protocol, the transmission time measurement of the TCP connection and the time measurement from the client 11 can be completed simultaneously when one TCP connection is established. By using the time stamp of the TCP layer, the transfer delay time can be measured when the TCP connection is established.

  The authentication information collating unit 23 shown in FIG. 2 collates the transfer delay time acquired by the transfer delay time acquiring unit 22 with the transfer delay time stored in the authentication information storage unit 21. Since the transfer delay time varies depending on the communication environment of the communication network, the authentication information collating unit 23 determines an error range in advance for each communication environment of the communication network 10 and collates it by being within the error range. I do. In order to increase the accuracy of authentication, it is preferable that the authentication information collating unit 23 measures the transfer delay time a plurality of times to obtain an average value, and collates the average value. Further, the authentication information collating unit 23 calculates the variance of the transfer delay time acquired by the transfer delay time acquiring unit 22, and the range of the variance centered on the average value is stored in the authentication information storage unit 21. It is preferable to check the transfer delay time. Since the transfer delay time is used as authentication information, the authorized user can be authenticated in a short time without using special authentication information. Furthermore, since the server measures the transfer delay time with the same client 11, the accuracy of authentication can be improved.

  The authentication information update unit 34 shown in FIG. 2 acquires the transfer delay time with the client 11 at a predetermined timing, and uses the transfer delay time stored in the authentication information storage unit 21 as the acquired transfer delay time. Update to Depending on the situation of the communication network 10, the transfer destinations of the routers 13a and 13b may change. In this case, the authentication information update unit 34 updates the transfer delay time stored in the authentication information storage unit 21 to the latest one, so that the accuracy of the authentication information verification unit 23 can be increased. Thereby, the impersonation of the third party can be prevented.

(Embodiment 2)
The terminal authentication system according to the present embodiment includes three or more servers 12a, 12b, and 12c in the terminal authentication system shown in FIG. 1, and at least one of these servers 12b is predetermined as an authentication server. Here, the number of authentication servers is not limited to one and may be two or more. For example, the authentication server may be defined for each group including a plurality of servers.

  FIG. 5 is a schematic configuration diagram illustrating an example of functions of the server. In the present embodiment, the server 12 a includes a transfer delay time acquisition unit 22 and an authentication information transmission unit 24. The authentication server 12b includes an authentication information storage unit 25, a transfer delay time reception unit 26, an authentication information storage unit 27, and an authentication information collating unit 28. Here, the authentication server 12b has the same configuration as the server 12a such as the transfer delay time acquisition unit 22 and the authentication information transmission unit 24, but is omitted in FIG. 5 for simplicity. With these configurations, the terminal authentication system according to the present embodiment authenticates the client 11 based on the transfer delay times acquired by the servers 12a, 12b, and 12c. In FIG. 5, the communication network (reference numeral 10 in FIG. 1) connecting the server 12a and the client 11 is omitted.

  Furthermore, the server 12a preferably further includes a latest transfer delay time acquisition unit 35 and a latest transfer delay time transmission unit 36. In this case, it is preferable that the authentication server 12b further includes an authentication information update unit 37. By further providing these configurations, the terminal authentication system can prevent spoofing of a third party by updating the verification destination of the authentication information verification unit 28 to the latest information.

  The terminal authentication method according to the present embodiment is caused to function as the terminal authentication system according to the present embodiment. The terminal authentication program according to the present embodiment is a terminal authentication program for causing a computer to execute the terminal authentication method according to the present embodiment. The terminal authentication program may be stored in a computer-readable storage medium. The terminal authentication method according to the present embodiment includes, for example, an authentication information storage step for functioning as the authentication information storage unit 25, a transfer delay time acquisition step for functioning as the transfer delay time acquisition unit 22, and an authentication information transmission unit. Authentication information transmitting step for functioning as 24, transfer delay time receiving step for functioning as transfer delay time receiving means 26, authentication information accumulating step for functioning as authentication information accumulating means 27, and authentication information collating means The authentication information collation step for functioning as 28 and the transfer delay time acquisition step for functioning as transfer delay time acquisition means 22 are sequentially provided.

  Further, the terminal authentication method includes a latest transfer delay time acquisition step for causing the latest transfer delay time acquisition means 35 to function, a latest transfer delay time transmission step for causing the latest transfer delay time transmission means 36 to function, and an authentication information update. It is preferable to have an authentication information update step for functioning as the means 37 before the transfer delay time acquisition step.

  When the client 11 accesses the server 12a, the transfer delay time acquisition unit 22 of the server 12a acquires the transfer delay time with the client 11. Here, the transfer delay time is a time difference between the time of the server 12a and the time of the client 11 acquired by the server 12a, or a time difference between the time of the client 11 acquired by the server 12a and the time of the server 12a. When the connection from the client 11 to the server 12a is set, the transfer delay time acquisition unit 22 acquires the transfer delay time. Then, the authentication information transmitting unit 24 transmits the transfer delay time acquired by the transfer delay time acquiring unit 22 to a predetermined authentication server 12b among the servers 12a, 12b, and 12c.

  When the client 11 accesses the server 12a, the server 12a also acquires the transfer delay time of the client 11 by the authentication server 12b and the transfer delay time acquisition unit 22 of the server 12c. Then, each of the servers 12a, 12b, and 12c transmits the acquired transfer delay time to the authentication server 12b. Note that the notification to the other servers 12b and 12c that the client 11 has accessed the server 12a may be sent directly from the server 12a to the authentication server 12b. After the notification, the authentication server 12b may notify the server 12c.

  On the other hand, the authentication information storage means 25 of the authentication server 12b is stored in advance for each server connected to the communication network in the transfer delay time with the client 11. For example, the authentication information storage unit 25 includes a transfer delay time between the server 12a and the client 11, a transfer delay time between the server 12b and the client 11, and a transfer delay time between the server 12c and the client 11. , Remember. The stored contents are the same as the authentication information storage means 21 of the first embodiment, when each server 12a, 12b, 12c is the transfer delay time with the client 11 when the information providing service to the client 11 is started. Is obtained.

  The transfer delay time receiving unit 26 of the authentication server 12 b receives the transfer delay time from the authentication information transmitting unit 24. The authentication information accumulating unit 27 of the authentication server 12b accumulates the transfer delay time received by the transfer delay time receiving unit 26 for each of the servers 12a, 12b, and 12c including the authentication information transmitting unit 24. For example, the transfer delay time transmitted from the server 12a is stored in association with the identification information of the server 12a.

  The authentication information verification unit 28 of the authentication server 12b stores the authentication information storage unit 27 with reference to the authentication information storage unit 25 when the transfer delay time stored in the authentication information storage unit 27 becomes three or more. The transfer delay time of the server being extracted is extracted, and the variance of the extracted transfer delay times is calculated. For example, when accumulating the transfer delay times of the servers 12a, 12b, and 12c, the authentication information collating unit 28 refers to the authentication information storage unit 25 and extracts the transfer delay times of the servers 12a, 12b, and 12c. The authentication information collating unit 28 calculates the variance of the transfer delay time accumulated in the authentication information accumulating unit 27. Then, the authentication information matching unit 28 determines that the difference between the two calculated variances is within a certain range.

  If the variation in transfer delay time between each server 12a, 12b, 12c and client 11 is within a certain range of variation in transfer delay time between clients registered in advance, each server 12a, 12b, 12c and client It can be determined that the relative positional relationship on the 11 communication networks is within a certain range. Since the transfer delay time is used as authentication information, the authorized user can be authenticated in a short time without using special authentication information. Furthermore, since it is determined whether or not the client 11 is registered in advance based on the distribution of the transfer delay time acquired by the server, the accuracy of authentication can be improved.

  The latest transfer delay time acquisition unit 35 of the server 12a acquires the transfer delay time with the client 11 at a predetermined timing. The latest transfer delay time transmission unit 36 of the server 12a transmits the transfer delay time acquired by the latest transfer delay time acquisition unit 35 to the authentication server 12b. The transfer delay time receiving unit 26 of the authentication server 12b receives the transfer delay time transmitted by the latest transfer delay time transmitting unit 36 of the server 12a. The authentication information update unit 37 of the authentication server 12b acquires the transfer delay time transmitted by the latest transfer delay time transmission unit 36 and received by the transfer delay time reception unit 26, and the transfer stored in the authentication information storage unit 25. The delay time is updated to the transfer delay time transmitted by the latest transfer delay time transmitting means 36.

(Embodiment 3)
The terminal authentication system shown in FIG. 5 requires three or more servers 12a, 12b, and 12c. However, the terminal authentication system according to the present embodiment requires two or more servers. Further, the terminal authentication system, the authentication information storage unit 25, the authentication information collating unit 28, and the authentication information updating unit 37 shown in FIG.

  FIG. 6 is an explanatory diagram of the terminal authentication system according to the present embodiment. In the system shown in FIG. 1, when the transfer delay time between the plurality of servers 12a, 12b, 12c and the client 11 is measured, the virtual position on the communication network 10 is further limited. The terminal authentication system according to the present embodiment is characterized in that this virtual position is used as authentication information.

  In a service that enables a specific function to be used by specifying a communication device, for example, a service that downloads content from a server, it is necessary to provide a service only to authorized users. There is a need to ensure that downloaded content is only used by legitimate users. In such a service, it is necessary to register a device for downloading content, and that the device is used by another unauthorized user (in this embodiment, the content is stored in another location). Is required to be used).

  In the present embodiment, the position of such a user device (client 11) on the communication network is specified at the start of service use, and the data is registered and stored. Thereafter, when the client 11 downloads the content using the service, the client 11 re-calculates the position on the communication network and compares the position at the time of use with the registered position. It can be determined whether or not the user.

  Specifically, in the present embodiment, the server 12 a includes a transfer delay time acquisition unit 22 and an authentication information transmission unit 24. The authentication server 12b includes an authentication information storage unit 25, a transfer delay time reception unit 26, an authentication information storage unit 27, and an authentication information collating unit 28. Here, the authentication server 12b includes an authentication information storage unit 21 and an authentication information transmission unit 24, which are omitted in FIG. 5 for simplicity. The transfer delay time acquisition unit 22 acquires the transfer delay time with the client 11 via the same route as the latest transfer delay time acquisition unit 35. With these configurations, the terminal authentication system according to the present embodiment causes the client 11 to be based on the virtual position on the communication network specified by the transfer delay time acquired by at least two of the servers 12a, 12b, and 12c. Certify.

  Moreover, it is preferable that the transfer delay time acquisition unit 22 acquires the transfer delay time with the client 11 a plurality of times, and calculates the average value of the acquired transfer delay times. In this case, the authentication information transmission unit 24 transmits the average value calculated by the transfer delay time acquisition unit 22 to a predetermined authentication server among the servers 12a, 12b, and 12c as the transfer delay time. By calculating the average value of the transfer delay time, it is possible to determine that the client is a registered client even when a connection between the client and the server is established through a route different from the route at the time of registration.

  The terminal authentication method according to the present embodiment is caused to function as the terminal authentication system according to the present embodiment. The terminal authentication program according to the present embodiment is a terminal authentication program for causing a computer to execute the terminal authentication method according to the present embodiment. The terminal authentication program may be stored in a computer-readable storage medium. The terminal authentication method according to the present embodiment includes, for example, an authentication information storage step for functioning as the authentication information storage unit 25, a transfer delay time acquisition step for functioning as the transfer delay time acquisition unit 22, and an authentication information transmission unit. Authentication information transmitting step for functioning as 24, transfer delay time receiving step for functioning as transfer delay time receiving means 26, authentication information accumulating step for functioning as authentication information accumulating means 27, and authentication information collating means The authentication information collation step for functioning as 28 and the transfer delay time acquisition step for functioning as transfer delay time acquisition means 22 are sequentially provided.

  Further, the terminal authentication method includes a latest transfer delay time acquisition step for causing the latest transfer delay time acquisition means 35 to function, a latest transfer delay time transmission step for causing the latest transfer delay time transmission means 36 to function, and an authentication information update. It is preferable to have an authentication information update step for functioning as the means 37 before the transfer delay time acquisition step.

  The authentication information storage means 25 of the authentication server 12b stores virtual positions on the communication network of the servers 12a, 12b and 12c and the client 11 connected in the communication network. The virtual position on the communication network is a position specified by the transfer delay time with the client 11 on the virtual map based on the position where the position on the map such as the servers 12a, 12b, and 12c is fixed. It is. The virtual positions of the servers 12a, 12b, and 12c are, for example, positions on the network where the servers 12a, 12b, and 12c are arranged. When the virtual position of the client 11 is registered, the transfer delay time between each server 12a, 12b, 12c and the client 11 is measured, and the position specified by the transfer delay time from the server 12a, 12b, 12c is determined as the client. 11 positions are registered. The virtual position is, for example, a position on a two-dimensional plane such as latitude and longitude, or a position on a three-dimensional space.

  The authentication information verification unit 28 of the authentication server 12b stores the authentication information storage unit 27 with reference to the authentication information storage unit 25 when the transfer delay time stored in the authentication information storage unit 27 becomes two or more. The positions of the servers 12a, 12b and 12c are extracted, and the position of the client 11 stored in the authentication information storage means 27 is calculated from the extracted position and the transfer delay time. For example, the authentication information matching unit 28 calculates the distance from the transfer delay times of the servers 12a, 12b, and 12c, and specifies the position of the client 11 from the respective positions of the servers 12a, 12b, and 12c and the calculated distances. To do. Here, in the conversion from the transfer delay time to the distance, the time integration may be performed while the transfer speed is constant, or the speed defined by a predetermined function may be time integrated. The authentication information collating unit 28 collates the calculated positions of the servers 12 a, 12 b and 12 c with the position stored in the authentication information storage unit 25. Since the transfer delay time varies depending on the communication environment of the communication network 10, the authentication information collating unit 28 determines an error range in advance for each communication environment of the communication network 10 and is within the error range, for example. Perform verification.

  A virtual position on the communication network can be specified by the position of the server and the transfer delay time. By acquiring the transfer delay time and storing this position in the authentication information storage unit 25 in advance, the authentication information collating unit 28 specifies the virtual position of the client 11 on the communication network and is registered in advance. It is possible to determine whether or not the client 11 is active. In this method, as long as a communication network between the server and the client can be secured, the client 11 can be authenticated from anywhere because it can be used outdoors or indoors. Further, special hardware such as a GPS receiver is not necessary, and ordinary software may be installed in the device.

  The servers 12a, 12b, and 12c preferably further include a latest transfer delay time acquisition unit 35 and a latest transfer delay time transmission unit 36. In this case, it is preferable that the authentication server 12b further includes an authentication information update unit 37. By further providing these configurations, the terminal authentication system can prevent spoofing of a third party by updating the reference destination of the authentication information matching unit 28 to the latest information. The authentication information update means 37 of the authentication server 12b calculates the position of the client 11 using the transfer delay time transmitted by the latest transfer delay time transmission means and the server position stored in the authentication information storage means, The position of the client 11 stored in the authentication information storage unit 25 is updated to the calculated position of the client 11. As a method for calculating the position of the client 11 from the transfer delay time between the servers 12a, 12b, and 12c, the same method as the authentication information collating unit 28 can be used.

  Basically, the transfer delay time cannot be obtained by one measurement. Since the state of the network changes with time, it is preferable to obtain the transfer delay time from a statistical numerical value. For this reason, a plurality of measurements are required, and since this measurement method (algorithm) is not one type, some examples can be considered.

(Example 1 of transfer delay time measurement method)
A first embodiment of a method for measuring a transfer delay time between the server 12a and the client 11 will be described with reference to FIG. A method in which when the authentication process is executed from the server 12a, the transfer delay time is measured a plurality of times and then reflected in the authentication process. In this case, there are a method in which the server measures the transfer delay time and a method in which the client 11 measures the transfer delay time and transfers the result to the server 12a.

(Example 2 of transfer delay time measurement method)
A second embodiment of the method for measuring the transfer delay time between the server 12a and the client 11 will be described. Regardless of the timing at which the authentication process is performed from the server 12a, the transfer delay is measured a plurality of times at a certain time interval, and the result is reflected in the authentication process. For example, the server 12a performs measurement once per hour or once every 10 minutes. In this case, there are a method in which the server 12a measures the transfer delay time and a method in which the client 11 measures the transfer delay time and transfers the result to the server 12a.

(Third embodiment of transfer delay time measurement method)
A third embodiment of a method for measuring a transfer delay time between the server 12a and the client 11 will be described. Regardless of the timing at which the authentication process is performed from the server 12a, the traffic state between the server 12a and the client 11 is measured, and the transfer delay time is set once or a plurality of times when the traffic is in a preset state. Measure and reflect the result in the authentication process. For example, the transfer delay time is measured when the traffic falls below a certain value and the communication network is free. In this case, there are a method in which the server 12a measures the transfer delay time and a method in which the client 11 measures the transfer delay time and transfers the result to the server 12a.

(Example 1 of system authentication)
A first embodiment of transfer delay time measurement and system authentication between the plurality of servers 12a, 12b and 12c and the client 11 will be described. In the first, second, and third embodiments of the transfer delay time measurement method, the plurality of servers 12a, 12b, and 12c sequentially measure the transfer delay time between each of the servers 12a, 12b, and 12c and the client 11 to perform authentication. When the transfer delay time measurement is completed by the number of servers 12a, 12b or 12c necessary for the authentication, the entire system is finally authenticated.

(Example 2 of system authentication)
A second embodiment of the transfer delay time measurement and system authentication between the plurality of servers 12a, 12b and 12c and the client 11 will be described. In the method of measuring the transfer delay time based on the third embodiment of the transfer delay time measurement method, the servers 12a, 12b, and 12c are used by the number of servers 12a, 12b, or 12c more than necessary for authentication, and the client 11 The server 12a is measured from the transfer delay time between each of the servers 12a, 12b, and 12c in which the traffic is set in advance and the client 11 while measuring the traffic between the servers 12a and 12b. , 12b or 12c completes authentication when the required number for authentication is reached.

(Example 3 of system authentication)
A third embodiment of the transfer delay time measurement and system authentication between the plurality of servers 12a, 12b and 12c and the client 11 will be described. The client 11 is authenticated by the same method as in the second embodiment of the transfer delay time measurement method. Unlike Example 2 of system authentication, even after the authentication is completed, the traffic is set in advance while measuring the traffic between each of the servers 12a, 12b and 12c and the client 11 sequentially. The point is that the transfer delay time between each of the servers 12a, 12b and 12c and the client 11 is continuously measured. By continuing this process, the client 11 connected to the communication network 10 is always a server 12a, 12b or 12c that is equal to or more than the number of servers required for authentication, and the transfer delay between each of the servers 12a, 12b and 12c and the client 11 is always performed. Time measurement can be performed and always authenticated.

  In a service for downloading content from a server, etc., it can be used for authenticating authorized users to provide services only to authorized users.

1 is a schematic configuration diagram of a terminal authentication system according to Embodiment 1. FIG. It is a schematic block diagram which shows an example of the function of a server. It is a sequence diagram which shows the 1st example of the measuring method of transfer delay time. It is a sequence diagram which shows the 2nd example of the measuring method of transfer delay time. It is a schematic block diagram which shows an example of the function of a server. It is explanatory drawing of the terminal authentication system which concerns on this embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Communication network 11 Client 12 Server 13 Router 21 Authentication information storage means 22 Transfer delay time acquisition means 23 Authentication information collation means 24 Authentication information transmission means 25 Authentication information storage means 26 Transfer delay time reception means 27 Authentication information storage means 28 Authentication information collation 28 Means 34 Authentication information update means 35 Latest transfer delay time acquisition means 36 Latest transfer delay time transmission means 37 Authentication information update means

Claims (15)

A terminal authentication system in which a plurality of servers and clients having synchronized clock frequencies are connected by a communication network including a plurality of routers,
The server
Authentication information storage means for storing in advance a transfer delay time between the client and the server;
A transfer delay time acquisition means for acquiring a transfer delay time between the client and the server when the traffic falls below a predetermined constant value ;
The transfer delay time acquired by the transfer delay time acquisition unit is compared with the transfer delay time stored in the authentication information storage unit, and the transfer delay time acquired by the transfer delay time acquisition unit is stored in the authentication information storage unit. The client is registered because it is within the error range of the stored transfer delay time and when the number of transfer delay times acquired by the transfer delay time acquisition means reaches a predetermined number. Authentication information verification means for authenticating that the client is
A terminal authentication system comprising:   Each of the servers further includes authentication information updating means for acquiring the transfer delay time at a predetermined timing and updating the transfer delay time stored in the authentication information storage means to the acquired transfer delay time. The terminal authentication system according to claim 1. The transfer delay time acquisition means acquires the transfer delay time a plurality of times,
The authentication information collating unit calculates an average value of transfer delay times acquired by the transfer delay time acquiring unit, and compares the average value with a transfer delay time stored in the authentication information storage unit. The terminal authentication system according to claim 1 or 2.   The authentication information collating unit further calculates a variance of the transfer delay time acquired by the transfer delay time acquiring unit, and the range of the variance centered on the average value is stored in the authentication information storage unit. The terminal authentication system according to claim 3, wherein the terminal authentication system is collated with a transfer delay time. A terminal authentication system in which two or more servers and clients having synchronized clock frequencies are connected by a communication network including a plurality of routers,
The servers are respectively
A transfer delay time acquisition means for acquiring a transfer delay time between the client and the server when the traffic falls below a predetermined constant value ;
Authentication information transmitting means for transmitting the transfer delay time acquired by the transfer delay time acquiring means to a predetermined authentication server of the servers,
The authentication server further includes:
A transfer delay time receiving means for receiving a transfer delay time transmitted by the authentication information transmitting means;
Authentication information storage means for storing, for each server, a virtual position of the server and the client connected to the communication network on the communication network;
Authentication information storage means for storing the transfer delay time received by the transfer delay time reception means for each server;
When there are two or more transfer delay times stored in the authentication information storage means, the transfer delay time acquired by the transfer delay time acquisition means is referred to the authentication information storage means with reference to the authentication information storage means. The client is registered because it is within the error range of the stored transfer delay time and when the number of transfer delay times acquired by the transfer delay time acquisition means reaches a predetermined number. Authentication information verification means for authenticating that the client is
A terminal authentication system comprising: Each of the servers further includes:
Latest transfer delay time acquisition means for acquiring the transfer delay time at a predetermined timing;
Latest transfer delay time transmitting means for transmitting the transfer delay time acquired by the latest transfer delay time acquiring means to the authentication server,
The authentication server further includes:
Using the transfer delay time transmitted by the latest transfer delay time transmission means and the server position stored in the authentication information storage means, the client position is calculated and stored in the authentication information storage means. 6. The terminal authentication system according to claim 5, further comprising authentication information updating means for updating the position of the client that has been updated to the calculated position of the client. The transfer delay time acquisition means acquires the transfer delay time a plurality of times, calculates an average value of the acquired transfer delay times,
The authentication information transmitting unit transmits the average value calculated by the transfer delay time acquiring unit to the predetermined authentication server of the servers as the transfer delay time. The terminal authentication system described in 1. The transfer delay time acquisition means transmits an instruction to transmit the client time to the client, measures a time difference between the client time received from the client and the server time, and determines the time difference from the client. Obtained as the transfer delay time to the server,
The client includes a client response signal transmission unit configured to transmit the time of the client to the transfer delay time acquisition unit when receiving an instruction to transmit the time of the client from the transfer delay time acquisition unit. Item 8. The terminal authentication system according to any one of Items 1 to 7. When the transfer delay time acquisition unit receives an instruction to transmit the time of the server from the client, the transfer delay time acquisition unit transmits the time of the server to the client, and the server time received by the client and the time of the client Send the time difference to the client, and obtain the transfer delay time from the server to the client from the time difference,
The client
Client measurement instruction transmission means for transmitting an instruction to transmit the time of the server to the server;
Client authentication information transmitting means for receiving the server time from the server, measuring a time difference between the server time and the client time, and transmitting the time difference to the server;
The terminal authentication system according to any one of claims 1 to 7, further comprising:   10. The terminal authentication system according to claim 8, wherein communication at the TCP layer is performed between the server and the client, and a time stamp of the TCP layer is included in the acknowledgment signal (ACK). .   The terminal authentication system according to claim 1, wherein the server and the client are synchronized in time. A terminal authentication method used in a terminal authentication system in which a plurality of servers and clients having synchronized clock frequencies are connected by a communication network including a plurality of routers,
A transfer delay time acquisition step in which the server whose traffic has become equal to or less than a preset fixed value acquires a transfer delay time between the server and the client;
The server compares the transfer delay time acquired in the transfer delay time acquisition step with the transfer delay time stored in the authentication information storage means in which the transfer delay time between the server and the client is stored in advance. The transfer delay time acquired by the transfer delay time acquisition means is within the error range of the transfer delay time stored in the authentication information storage means, and the transfer delay acquired in the transfer delay time acquisition step An authentication information matching step for authenticating that the client is a registered client when the number of times has reached a predetermined number;
In order. A terminal authentication method used in a terminal authentication system in which two or more servers and clients having synchronized clock frequencies are connected by a communication network including a plurality of routers,
A transfer in which a predetermined authentication server among the servers receives a transfer delay time between the server and the client acquired by the server when each traffic is equal to or less than a predetermined value set in advance. A delay time receiving step;
An authentication information accumulating step for accumulating the transfer delay time received in the transfer delay time receiving step for each of the servers provided with the authentication information transmitting means;
When two or more transfer delay times stored in the authentication information storage unit become two or more, virtual positions on the communication network of the server and the client connected in the communication network are stored for each server. The transfer delay time acquired in the transfer delay time acquisition step is within the error range of the transfer delay time stored in the authentication information storage step, and the transfer delay time An authentication information collating step for authenticating that the client is a registered client because the number of transfer delay times acquired in the acquiring step is a predetermined number;
In order.   A terminal authentication program for causing a computer to execute the terminal authentication method according to claim 12 or 13.   The computer-readable storage medium which recorded the terminal authentication program of Claim 14.

Images