JP5373852B2 - Authentication system and authentication method - Google Patents

Description

  The present invention relates to an authentication system and an authentication method.

  In recent years, with the increase in services, passwords used for authentication are centrally managed in a plurality of servers.

  For example, Patent Document 1 proposes a system including a plurality of servers and a management server that centrally manages a plurality of passwords corresponding to each of the plurality of servers. In this system, when a user desires to use one of a plurality of servers, when the management server confirms the identity of the user, the management server authenticates the server that the user desires to use, A server desired to be used is made available to the user.

Japanese Patent Laid-Open No. 2000-259566

  By the way, in recent years, cloud computing has rapidly spread. However, a server that constitutes cloud computing has a problem that processing is slower than a server tuned for the purpose of realizing individual functions in order to provide versatility.

  In addition, since cloud computing handles a large amount of data that increases without limit, new servers are sequentially connected. From these points, when multiple servers are used in cloud computing, as a result, multiple servers that are physically located are used, resulting in a delay in access between the multiple servers. There is a risk that. In addition, when servers are arranged at physically separated positions, the possibility of passing through other servers at the time of access increases, so that security may be lowered.

  As described above, when an authentication system corresponding to a plurality of servers is constructed using cloud computing, it is required that processing can be executed without delay.

  An object of the present invention is to provide an authentication system and an authentication method in which security is strong and processing related to authentication is difficult to delay even when cloud computing is used.

  (1) An authentication system comprising a user terminal and a plurality of servers connected to be communicable with the user terminal, wherein the user terminal accepts an authentication request from a user for an authentication request to any of the plurality of servers. And means for encrypting authentication data with a secret key when the authentication request is accepted by the authentication request accepting means, and the user ID of the user and the authentication data encrypted. Authentication information transmitting means for transmitting to a server corresponding to the authentication request, and each of the plurality of servers includes authentication information storage means for storing the user ID and a public key corresponding to the user ID, and the user The authentication information receiving means for receiving the user ID and the encrypted authentication data from the terminal, and the authentication information receiving means Corresponding to the user ID, with the public key stored in the authentication information storage means, the decryption trial means for trying to decrypt the received authentication data, and the encrypted trial received by the decryption trial means An authentication system comprising: an authenticating unit that authenticates the user terminal when the authentication data can be decrypted.

  In the authentication system of (1), when the user terminal accepts the authentication request by the authentication request accepting means, the encryption means encrypts the authentication data using the secret key, and the authentication information sending means sends the user ID and the user ID. The encrypted authentication data is transmitted to the server corresponding to the authentication request. In addition, the server attempts to decrypt the received authentication data using the public key stored in the authentication information storage unit corresponding to the user ID received by the authentication information receiving unit by the decryption trial unit. Assume that the user terminal succeeds in authentication when the authentication data encrypted by the decryption trial means can be decrypted.

  In this way, the server is assumed to have successfully authenticated the user terminal in response to the decryption of the encrypted authentication data received from the user terminal based on the public key stored in the server. Therefore, authentication can be performed without accessing another server during authentication. Also, the server authenticates with the public key without performing password verification. Here, since it is difficult to estimate the password based on the public key, the authentication system can maintain security even when the public key is leaked from the server to a third party. . Therefore, even if the authentication system of (1) is a case where cloud computing is used, the security can be strengthened and the processing related to authentication can be hardly delayed.

  (2) The authentication request accepting unit accepts the authentication request by accepting the server address, user ID, and password as authentication information from the user, and based on the password accepted by the authentication request accepting unit. The apparatus further comprises terminal side key generation means for generating the secret key, the encryption means encrypts authentication data with the secret key generated by the terminal side key generation means, and the authentication information transmission means includes: The authentication system according to (1), wherein the user ID of the user and the encrypted authentication data are transmitted to a server corresponding to the address.

  In the authentication system of (2), the secret key is generated based on the password received by the authentication request accepting unit, and the authentication data is encrypted by the secret unit using the secret key. Therefore, since it is not necessary to store the secret key in the user terminal, it is possible to prevent leakage of the secret key due to loss of the user terminal or the like.

  (3) The authentication system further includes a password management server communicably connected to the user terminal and the plurality of servers, and the password management server receives the user ID and the password from the user terminal. Registration information receiving means for receiving as registration information, and server-side key generation for generating a secret key and a public key based on a password included in the registration information in response to receiving the registration information by the registration information receiving means And public key distribution means for distributing the public key generated by the server side key generation means and the user ID included in the registration information received by the registration information receiving means to each of the plurality of servers. The authentication system according to (2).

  In the authentication system of (3), the password management server receives the user ID and password from the user terminal as registration information by the registration information receiving means, and the registration information receiving means by the registration information receiving means by the server side key generation means. In response to the reception, a secret key and a public key are generated based on the password included in the registration information, and received by the public key distribution unit by the public key generated by the server side key generation unit and the registration information reception unit. The user ID included in the registered information is distributed to each of the plurality of servers.

  As described above, the authentication system (3) does not transmit the password received from the user terminal to the server by the password management server. Can be.

  (4) The password management server includes a change information receiving unit that receives the user ID and the password as change information from the user terminal, and the server-side key generation unit receives the change information by the change information receiving unit. The authentication system according to (3), wherein the secret key and the public key are generated based on a password included in the change information in response to reception.

  In the authentication system of (4), the password management server receives the user ID and password as change information from the user terminal by the change information receiving means, and the change information receiving means by the server side key generating means. In response to the reception, a secret key and a public key are generated based on the password included in the change information.

  As described above, since the password management server does not transmit the password from the password management server to the server even when the password is updated at the user terminal, the risk of eavesdropping or the like at the time of password delivery is eliminated even when the password is updated. Thus, security can be strengthened.

  (5) An authentication method executed in an authentication system comprising a user terminal and a plurality of servers connected to be communicable with the user terminal, wherein the user terminal authenticates one of the plurality of servers from the user. An authentication request receiving step for receiving a request; an encryption step for encrypting authentication data with a secret key when the authentication request is received in the authentication request receiving step; and the user ID of the user encrypted An authentication information transmitting step of transmitting authentication data to a server corresponding to the authentication request, wherein each of the plurality of servers stores the user ID and a public key corresponding to the user ID. Storage means for receiving the user ID and the encrypted authentication data from the user terminal Certificate information receiving step, and a decryption trial step of trying to decrypt the received authentication data with the public key corresponding to the user ID received in the authentication information receiving step and stored in the authentication information storage means; An authentication method for executing an authentication step in which the user terminal succeeds in authentication when the received encrypted data for authentication can be decrypted in the decryption trial step.

  According to such a method, the same effect as in (1) can be expected by performing the method.

  ADVANTAGE OF THE INVENTION According to this invention, even if it is a case where cloud computing is utilized, it can provide the authentication system and the authentication method with which security is strong and the process regarding authentication is hard to delay.

It is a figure which shows the function outline | summary of the authentication system which concerns on this embodiment. It is a flowchart which shows the flow of a process which registers user information in the authentication system which concerns on this embodiment. It is a flowchart which shows the flow of the process which changes user information in the authentication system which concerns on this embodiment. It is a flowchart which shows the flow of the process which authenticates in the authentication system which concerns on this embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[Function configuration]
FIG. 1 is a diagram showing a functional outline of an authentication system 1 according to the present embodiment. The authentication system 1 includes a password management server 2, a plurality of content servers 3, and a user terminal 4.
In the authentication system 1, the password management server 2 is communicably connected to a plurality of content servers 3 and user terminals 4 via a communication network N. The user terminal 4 is connected to a plurality of content servers 3 through a communication network N so as to be communicable. Although only one content server 3 is shown in FIG. 1, it is assumed that a plurality of content servers 3 are actually connected to the communication network N.

  This embodiment is applied to a computer (password management server 2, a plurality of content servers 3, and a user terminal 4) and its peripheral devices. Each unit in the present embodiment is configured by hardware included in a computer and its peripheral devices, and software that controls the hardware.

  The hardware includes a storage unit, a communication device, a display device, and an input device in addition to a CPU (Central Processing Unit) as a control unit. Examples of the storage unit include a memory (RAM: Random Access Memory, ROM: Read Only Memory, etc.), a hard disk drive (HDD: Hard Disk Drive), and an optical disk (CD: Compact Disc, DVD: Digital Versatile Drive, etc.). It is done. Examples of the communication device include various wired and wireless interface devices. Examples of the display device include various displays such as a liquid crystal display and a plasma display. Examples of the input device include a keyboard and a pointing device (mouse, tracking ball, etc.).

  The software includes a computer program and data for controlling the hardware. The computer program and data are stored in the storage unit, and are appropriately executed and referenced by the control unit. The computer program and data can be distributed via a communication line, or can be recorded on a computer-readable medium such as a CD-ROM and distributed.

  The password management server 2 includes a first storage unit 23 that stores a program (not shown) for executing the functions of the present invention, a first control unit 24 that controls each function related to the password management server 2, Is provided.

The first storage unit 23 includes a first authentication information DB 231 in addition to the various programs described above.
The first authentication information DB 231 stores a user ID and a password corresponding to the user ID in association with each other.

  The first control unit 24 includes a registration information receiving unit 241 as a registration information receiving unit, a change information receiving unit 242 as a change information receiving unit, a server side key generating unit 243 as a server side key generating unit, and a public key And a public key distribution unit 244 as distribution means.

  The registration information receiving unit 241 receives a user ID and a password from the user terminal 4 as registration information.

  The change information receiving unit 242 receives the user ID and password from the user terminal 4 as change information.

The server-side key generation unit 243 generates a secret key and a public key based on the password included in the registration information in response to the registration information receiving unit 241 receiving the registration information. Further, in response to the change information received by the change information receiving unit 242, a secret key and a public key are generated based on the password included in the change information.
For example, the server side key generation unit 243 generates a secret key and a public key using a key generation algorithm that is a publicly known technique. Here, the server-side key generation unit 243 obtains the secret key and the public key from the key generation algorithm by inputting the password included in the registration information for the key generation algorithm.

  The public key distribution unit 244 has a plurality of public keys generated by the server-side key generation unit 243 and registration information received by the registration information reception unit 241 or user IDs included in the change information received by the change information reception unit 242. To each of the content servers 3.

  Each of the plurality of content servers 3 includes a second storage unit 33 that stores a program (not shown) for executing the function of the present invention, and a second control unit that comprehensively controls each function related to the plurality of content servers 3. 34.

The second storage unit 33 includes a second authentication information DB 331 in addition to the various programs described above.
The second authentication information DB 331 stores a user ID and a public key corresponding to the user ID in association with each other.

  The second control unit 34 includes a storage control unit 341, an authentication information receiving unit 342 as an authentication information receiving unit, a decryption trial unit 343 as a decryption trial unit, and an authentication unit 344 as an authentication unit.

  The storage control unit 341 receives the user ID distributed from the password management server 2 and the public key corresponding to the user ID, and stores them in the second authentication information DB 331 in association with each other.

  The authentication information receiving unit 342 receives a user ID and encrypted authentication data from the user terminal 4.

  The decryption trial unit 343 extracts the public key corresponding to the user ID received by the authentication information receiving unit 342 from the second authentication information DB 331. Then, it tries to decrypt the received authentication data with the extracted public key.

  The authentication unit 344 assumes that the user terminal 4 has succeeded in authentication when the decrypted trial unit 343 can decrypt the received encrypted authentication data.

The user terminal 4 includes an operation unit 41, a display unit 42, and a third control unit 44.
The operation unit 41 is implemented by, for example, a keyboard and a pointing device (mouse, tracking ball, etc.).
The display unit 42 is mounted by various displays such as a liquid crystal display and a plasma display.

  The third control unit 44 comprehensively controls each function related to the user terminal 4. The third control unit 44 includes a registration information transmission unit 441, a change information transmission unit 442, an authentication request reception unit 443 as an authentication request reception unit, a terminal side key generation unit 444 as a terminal side key generation unit, and an encryption An encryption unit 445 serving as an encryption unit and an authentication information transmission unit 446 serving as an authentication information transmission unit.

  The registration information transmission unit 441 receives the address of the user information registration page of the password management server 2 from the user via the operation unit 41. Then, the registration information transmission unit 441 receives a user information registration page from the password management server 2 corresponding to the received address. Then, the registration information transmission unit 441 displays a user information registration page on the display unit 42 and accepts input of a user ID and a password. Then, the registration information transmission unit 441 receives registration of the user ID and password from the user in the password management server 2 via the operation unit 41. Then, the registration information transmission unit 441 transmits the user ID and password received from the user to the password management server 2.

  The change information transmission unit 442 receives the address of the user information change page of the password management server 2 from the user, and receives the user information change page from the password management server 2 corresponding to the address. Then, the change information transmission unit 442 receives a user ID and a password from the user via the operation unit 41. Then, the change information transmission unit 442 transmits the user ID and password received from the user to the password management server 2.

  The authentication request receiving unit 443 receives an authentication request from the user. Specifically, the authentication request receiving unit 443 receives the address of the authentication page of the content server 3 from the user, and receives the authentication page from the content server 3 corresponding to the address. Then, the authentication request receiving unit 443 displays an authentication page on the display unit 42 and receives an input of a user ID and a password. Then, the authentication request receiving unit 443 receives the authentication request by receiving the address, the user ID, and the password of the content server 3 from the user via the operation unit 41.

  The terminal-side key generation unit 444 generates a secret key and a public key based on the password in response to reception of the user ID and password by the authentication request reception unit 443. The generation of the secret key and the public key is performed by the same method as the generation of the secret key and the public key in the password management server 2.

  The encryption unit 445 encrypts the authentication data with the secret key generated by the terminal-side key generation unit 444 in response to the authentication request reception unit 443 receiving the authentication request.

  The authentication information transmission unit 446 transmits the user ID and the encrypted authentication data to the content server 3 corresponding to the address.

[flowchart]
Next, the flow of processing in the authentication system 1 will be described.
FIG. 2 is a flowchart showing a flow of processing for registering user information in the authentication system 1 according to the present embodiment.

  In step S <b> 1, the third control unit 44 (registration information transmission unit 441) of the user terminal 4 requests acquisition of the user information registration page of the password management server 2 from the user via the operation unit 41.

In step S <b> 2, the first control unit 24 (registration information receiving unit 241) of the password management server 2 accepts an acquisition request for a user information registration page from the user terminal 4.
In step S <b> 3, the first control unit 24 (registration information receiving unit 241) of the password management server 2 transmits the user information registration page received in step S <b> 2 to the user terminal 4.

  In step S <b> 4, the third control unit 44 (registration information transmission unit 441) of the user terminal 4 receives the user information registration page transmitted from the password management server 2 in step S <b> 3 and displays it on the display unit 42.

In step S <b> 5, the third control unit 44 (registration information transmission unit 441) of the user terminal 4 receives an input of a user ID and a password from the user via the operation unit 41.
In step S <b> 6, the third control unit 44 (registration information transmission unit 441) of the user terminal 4 transmits the user ID and password received from the user to the password management server 2 as registration information.

In step S7, the first control unit 24 (registration information receiving unit 241) of the password management server 2 receives the registration information transmitted in step S6.
In step S8, the first control unit 24 (registration information receiving unit 241) of the password management server 2 associates the user ID included in the registration information received in step S7 with the password corresponding to the user ID, and performs the first authentication. It memorize | stores in information DB231.

In step S9, the first control unit 24 (server-side key generation unit 243) of the password management server 2 receives the registration information in step S7 and, based on the password included in the registration information, discloses the secret key and the public key. Generate a key.
In step S10, the first control unit 24 (public key distribution unit 244) of the password management server 2 uses the public key generated in step S9 and the user ID included in the registration information received in step S7 as a plurality of contents. Delivered to each server 3.

  In step S11, the second control unit 34 (storage control unit 341) of the content server 3 receives the user ID distributed in step S10 and the public key corresponding to the user ID, and receives the user ID and the public key. Are stored in the second authentication information DB 331 in association with each other.

  FIG. 3 is a flowchart showing a flow of processing for changing user information in the authentication system 1 according to the present embodiment.

  In step S <b> 21, the third control unit 44 (change information transmission unit 442) of the user terminal 4 requests acquisition of the user information change page of the password management server 2 from the user via the operation unit 41.

In step S <b> 22, the first control unit 24 (change information receiving unit 242) of the password management server 2 receives a user information change page acquisition request from the user terminal 4.
In step S23, the first control unit 24 (change information receiving unit 242) of the password management server 2 transmits the user information change page received in step S22 to the user terminal 4.

  In step S24, the third control unit 44 (change information transmission unit 442) of the user terminal 4 receives the user information change page transmitted from the password management server 2 in step S21 and causes the display unit 42 to display it.

In step S <b> 25, the third control unit 44 (change information transmission unit 442) of the user terminal 4 receives an input of a user ID and a password from the user via the operation unit 41.
In step S <b> 26, the third control unit 44 (change information transmission unit 442) of the user terminal 4 transmits the user ID and password received from the user to the password management server 2 as change information.

In step S27, the first control unit 24 (change information receiving unit 242) of the password management server 2 receives the change information transmitted in step S26.
In step S28, the first control unit 24 (change information receiving unit 242) of the password management server 2 associates the user ID included in the change information received in step S27 with the password corresponding to the user ID, and performs the first authentication. It memorize | stores in information DB231.

In step S29, the first control unit 24 (server-side key generation unit 243) of the password management server 2 receives the change information in step S27 and, based on the password included in the change information, releases the secret key and the public key. Generate a key.
In step S30, the first control unit 24 (public key distribution unit 244) of the password management server 2 uses the public key generated in step S29 and the user ID included in the change information received in step S27 as a plurality of contents. Delivered to each server 3.

  In step S31, the second control unit 34 (storage control unit 341) of the content server 3 receives the user ID distributed in step S30 and the public key corresponding to the user ID, and receives the user ID and the public key. Are stored in the second authentication information DB 331 in association with each other.

  FIG. 4 is a flowchart showing a flow of processing for performing authentication in the authentication system 1 according to the present embodiment.

  In step S <b> 41, the third control unit 44 (authentication request receiving unit 443) of the user terminal 4 requests acquisition of the authentication page of the content server 3 from the user via the operation unit 41.

In step S <b> 42, the second control unit 34 (authentication information receiving unit 342) of the content server 3 receives an authentication page acquisition request from the user terminal 4.
In step S43, the second control unit 34 (authentication information receiving unit 342) of the content server 3 transmits the authentication page received in step S42 to the user terminal 4.

In step S44, the third control unit 44 (authentication request receiving unit 443) of the user terminal 4 receives the authentication page of the content server 3 corresponding to the address received from the user from the content server 3, and displays the display unit 42. To display.
In step S <b> 45, the third control unit 44 (authentication request receiving unit 443) of the user terminal 4 receives an input of a user ID and a password from the user via the operation unit 41.

In step S46, the third control unit 44 (terminal-side key generation unit 444) of the user terminal 4 receives the user ID and password from the user in step S45, and based on the password, the secret key and the public key Is generated.
In step S47, the third control unit 44 (encryption unit 445) of the user terminal 4 encrypts the authentication data using the secret key generated in step S46.

  In step S48, the third control unit 44 (authentication information transmission unit 446) of the user terminal 4 obtains the authentication page in step S41 based on the user ID received in step S45 and the authentication data encrypted in step S47. Transmit to the requested content server 3.

  In step S <b> 49, the second control unit 34 (authentication information receiving unit 342) of the content server 3 receives the user ID and the encrypted authentication data from the user terminal 4.

  In step S50, the second control unit 34 (decryption trial unit 343) of the content server 3 acquires the public key corresponding to the user ID received in step S49 from the second authentication information DB 331, and uses the public key in step S49. Attempts to decrypt the received encrypted authentication data. When the decryption is successful (step S50: YES), the second control unit 34 (decryption trial unit 343) of the content server 3 moves the process to step S51. If the decryption is not successful (step S50: NO), the second control unit 34 (decryption trial unit 343) of the content server 3 moves the process to step S52.

In step S51, the second control unit 34 (authentication unit 344) of the content server 3 assumes that the user terminal 4 has been successfully authenticated, and transmits a page indicating that the authentication has been successful to the user terminal 4. Thereafter, the content is transmitted from the content server 3 to the user terminal 4.
In step S52, the second control unit 34 (authentication unit 344) of the content server 3 assumes that the user terminal 4 has failed in authentication, and transmits a page indicating that the authentication has failed to the user terminal 4.

In step S53, the third control unit 44 of the user terminal 4 receives the page related to the authentication result transmitted from the content server 3 in step S51 or step S52.
In step S54, the third control unit 44 of the user terminal 4 causes the display unit 42 to display a page related to the authentication result received in step S53.

  As described above, according to the present embodiment, in the authentication system 1, when the user terminal 4 receives the user ID and password from the authentication request receiving unit 443 by the terminal-side key generation unit 444, the secret key is based on the password. And the public key, and the encryption unit 445 encrypts the authentication data with the secret key generated by the terminal-side key generation unit 444, and the authentication information transmission unit 446 encrypts the user ID and the authentication data. The data is transmitted to the corresponding content server 3. In addition, the content server 3 attempts to decrypt the received authentication data using the public key stored in the second authentication information DB 331 corresponding to the user ID received by the authentication information receiving unit 342 by the decryption trial unit 343. When the authentication unit 344 can decrypt the authentication data encrypted by the decryption trial unit 343, it is assumed that the user terminal 4 has been successfully authenticated.

  In this way, the content server 3 authenticates the user terminal 4 in response to the decryption of the encrypted authentication data received from the user terminal 4 based on the public key stored in the content server 3. Therefore, authentication can be performed without accessing the password management server 2 at the time of authentication. Further, the content server 3 performs authentication using the public key without performing password verification. Here, since it is difficult to estimate the password based on the public key, the authentication system 1 maintains security even when the public key is leaked from the content server 3 to a third party. be able to. Therefore, even if the authentication system 1 uses cloud computing, security can be strengthened and processing related to authentication can hardly be delayed.

  In the authentication system 1, the password management server 2 receives the user ID and password as registration information from the user terminal 4 by the registration information reception unit 241, and the registration information reception unit 241 by the server side key generation unit 243. In response to receiving the registration information according to, a secret key and a public key are generated based on the password included in the registration information, and the public key generated by the server-side key generation unit 243 by the public key distribution unit 244; The user ID included in the registration information received by the registration information receiving unit 241 is distributed to each of the plurality of content servers 3.

  As described above, the authentication system 1 does not transmit the password received by the password management server 2 from the user terminal 4 to the content server 3, thereby eliminating the risk of eavesdropping and the like at the time of passing the password and strengthening the security. Can be.

  In the authentication system 1, the password management server 2 receives the user ID and password as change information from the user terminal 4 by the change information reception unit 242, and the change information reception unit 242 by the server side key generation unit 243. In response to receiving the change information, the private key and the public key are generated based on the password included in the change information.

  Thus, the authentication system 1 does not transmit the password from the password management server 2 to the content server 3 even when the password is updated in the user terminal 4. Therefore, even when the password is updated, the authentication system 1 can eliminate the risk of eavesdropping and the like at the time of passing the password, and can strengthen the security.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. The effects described in the embodiments of the present invention are only the most preferable effects resulting from the present invention, and the effects of the present invention are limited to those described in the embodiments of the present invention. is not.

  In the present embodiment, the authentication system 1 including the computers of the password management server 2, the content server 3, and the user terminal 4 has been described as an example. However, the present invention is not limited to the system, and each computer has various functions. The present invention can also be applied to a method for executing the program, a program for causing a computer to execute various functions, and a storage medium storing the program.

DESCRIPTION OF SYMBOLS 1 Authentication system 2 Password management server 3 Content server 4 User terminal 23 1st memory | storage part 24 1st control part 33 2nd memory | storage part 34 2nd control part 41 Operation part 42 Display part 43 3rd control part 231 1st authentication information DB
241 Registration information reception unit 242 Change information reception unit 243 Server side key generation unit 244 Public key distribution unit 331 Second authentication information DB
341 Storage control unit 342 Authentication information reception unit 343 Decryption trial unit 344 Authentication unit 441 Registration information transmission unit 442 Change information transmission unit 443 Authentication request reception unit 444 Terminal side key generation unit 445 Encryption unit 446 Authentication information transmission unit

Claims (3)

An authentication system comprising a user terminal, a plurality of servers connected to be communicable with the user terminal, and a password management server connected to be communicable with the user terminal and the plurality of servers ,
The user terminal is
An authentication request accepting unit that accepts an authentication request by accepting an address, a user ID, and a password of the plurality of servers as authentication information from a user ;
Terminal-side key generation means for generating a secret key based on the password received by the authentication request reception means;
An encryption unit that encrypts authentication data with the secret key generated by the terminal-side key generation unit when the authentication request is received by the authentication request reception unit;
Authentication information transmitting means for transmitting the user ID of the user and the encrypted data for authentication to a server corresponding to the address ;
The password management server
Registration information receiving means for receiving the user ID and the password as registration information from the user terminal;
A server-side key generation unit that generates a secret key and a public key based on a password included in the registration information in response to receiving the registration information by the registration information reception unit;
Public key distribution means for distributing the public key generated by the server side key generation means and the user ID included in the registration information received by the registration information reception means to each of the plurality of servers,
Each of the plurality of servers is
Authentication information storage means for storing the user ID distributed from the password management server and a public key corresponding to the user ID;
Authentication information receiving means for receiving the user ID and the encrypted data for authentication from the user terminal;
Corresponding to the user ID received by the authentication information receiving means, decryption trial means for trying to decrypt received authentication data with the public key stored in the authentication information storage means;
An authentication system comprising: an authentication unit that determines that the user terminal has been successfully authenticated when the received encrypted data for authentication can be decrypted by the decryption trial unit. The password management server
Furthermore, it has change information receiving means for receiving the user ID and the password as change information from the user terminal,
The server-side key generation means generates the secret key and the public key based on a password included in the change information in response to the change information received by the change information receiving means.
The authentication system according to claim 1 . An authentication method executed in an authentication system comprising: a user terminal; a plurality of servers connected to be communicable with the user terminal; and a password management server connected to be communicable with the user terminals and the plurality of servers. And
The user terminal is
An authentication request accepting step for accepting an authentication request from a user by accepting any address, user ID, and password of the plurality of servers as authentication information ;
A terminal-side key generation step for generating a secret key based on the password received by the authentication request reception step;
An encryption step of encrypting authentication data with the secret key generated by the terminal-side key generation step when the authentication request is received in the authentication request reception step;
An authentication information transmission step of transmitting the user ID of the user and the encrypted data for authentication to a server corresponding to the address ; and
The password management server
A registration information receiving step for receiving the user ID and the password as registration information from the user terminal;
A server-side key generation step for generating a secret key and a public key based on a password included in the registration information in response to receiving the registration information in the registration information reception step;
Executing the public key generated in the server-side key generation step and the public key distribution step of distributing the user ID included in the registration information received in the registration information reception step to each of the plurality of servers,
Each of the plurality of servers is
Authentication information storage means for storing the user ID and the public key corresponding to the user ID distributed from the password management server ;
An authentication information receiving step of receiving the user ID and the encrypted data for authentication from the user terminal;
Corresponding to the user ID received in the authentication information receiving step, a decryption trial step for trying to decrypt the received authentication data with the public key stored in the authentication information storage means;
An authentication method for executing, in the decryption trial step, an authentication step in which the user terminal succeeds in authentication when the received encrypted authentication data can be decrypted.

Images