JP5455858B2 - Client-server type authentication system using authentication token - Google Patents

Description

  The present invention relates to an enhanced function of a client server type authentication system that uses a certificate as an authentication means.

  Conventionally, as a client server type authentication system, password authentication or authentication using a certificate is generally used. In an authentication system using a certificate, a certificate issued by an administrator at the authentication server machine (actually, data is sometimes referred to as “certificate” hereinafter) is stored at the authentication server machine. The certificate is stored in a medium such as a USB (Universal Serial Bus) memory (referred to as “authentication token”), and authentication is performed by connecting the medium to a client machine.

  Usually, an administrator needs to directly operate an authentication server machine located in an isolated place such as a server room in order to issue a certificate. If the administrator has the authority to enter the server room where the authentication server machine is located, or if the server room is in the immediate vicinity of the administrator, it is easy to operate the authentication server machine directly. . However, if you are an administrator who does not have the authority to enter the server room (if it takes a long time to apply for entry authority or if you are a temporary administrator), or if the server room is physically remote, It is difficult to operate the machine directly.

  Therefore, Patent Document 1 proposes a system that issues a certificate easily and without lowering the security level without directly operating an authentication server machine by an administrator with regard to an authentication system using a certificate. Specifically, the authentication server machine stores in advance administrator information including the validity / invalidity of the administrator regarding the certificate issuing authority and the login restriction at the time of the invalidation. When a certificate issuance request is sent from the machine that can be operated directly) to the authentication server machine, the authentication server machine sends the certificate to the administrator machine and associates the certificate with the administrator who issued the issuance request. And remember. Thereafter, the administrator issues a certificate to the user (ie, stores the certificate in an authentication token and distributes it). When the authentication server machine receives a certificate from the user's client machine that uses the authentication token, it queries the administrator information associated with the certificate to determine validity / invalidity. If disabled, login restriction is performed.

JP 2009-122793 A

  However, since the authentication token in the system of Patent Document 1 is simply a certificate stored in a medium such as a USB memory, the certificate is copied to another medium by a malicious person and used illegally. There is a possibility that.

  After it is discovered that the certificate has been used illegally, the administrator can invalidate the certificate to prevent subsequent unauthorized use. However, legitimate users may not know the fact that their certificate was used illegally. In that case, you may be hesitant that the authentication token is no longer available without your knowledge. Furthermore, it is necessary for the administrator to issue a new certificate, that is, to have a new certificate stored in the authentication token, which takes time and effort.

  Also, when reissuing a certificate, simply connecting a medium such as a USB memory to the administrator machine used by the administrator, and if the user and certificate are already stored as an authentication token, the user is authenticated. The function may be activated and a new certificate may not be issued.

  An object of the present invention is to further improve the system of Patent Document 1. In other words, a function for preventing unauthorized use as described above is provided by adding a function for issuing a certificate only to an authentication token registered in advance as a unique individual and a function for permitting only authentication of the authentication token. For the purpose. It is another object of the present invention to provide a function that prevents an authentication token authentication function from being activated when an administrator machine issues and uses an authentication token certificate.

In order to achieve the above object, a client server type authentication system using an authentication token according to the present invention includes an authentication server machine for authenticating a user, and a client machine connected to the authentication server machine via a network and used by the user. Client server type authentication having an administrator machine connected to the authentication server machine via a network and used by an administrator, and an authentication token having individual identification information as a medium for storing issued certificates System.
The authentication server machine is configured to associate individual identification information of the authentication token transmitted from the administrator machine with certificate issuance information for the authentication token in association with each other in the device management DB, and the administrator machine Means for associating user information relating to the user transmitted from the user and a certificate issued to the user in a user management DB, and storing the user information and the authentication token storing the certificate. In response to an authentication request from the connected client machine, means for confirming whether or not individual identification information of the authentication token included in the authentication request is registered in the device management DB, and individual identification of the authentication token Only when information is registered, user information and certificate included in the authentication request are stored in the user management DB. Provided that a means for confirming whether to match the user information and the certificate, and means for permitting authentication only when the user information and the certificate matches.
The administrator machine transmits means for registering individual identification information of a connected unregistered authentication token and certificate issuance information for the authentication token to the authentication server machine, and the connected authentication token is registered. The authentication server machine is inquired whether the certificate issuance information for the authentication talk can be issued or not, and the authentication token is already registered and can be issued from the authentication server machine. Only when a reply that information can be issued is received, a certificate for the specified user is issued for the authentication token, and the user information of the specified user and the issued certificate are authenticated. Means for storing in a token; and means for transmitting the user information and the issued certificate to be stored in the authentication server machine.

  In the above system, the administrator machine further includes means for enabling a certificate issuance mode to be enabled by the authentication server machine before connecting the authentication token to be inquired to the authentication server machine. It is preferable that the certificate can be issued only when the certificate issuance mode is set to be valid.

As described above, according to the client server type authentication system using the authentication token of the present invention, the following effects can be obtained.
A certificate can be issued only for an authentication token in which individual identification information that can be identified as a unique individual is registered in advance. Accordingly, it is possible to prevent unauthorized use by copying only the certificate or user information to another authentication token having different individual identification information.

  Further, the administrator machine can issue the authentication token certificate from the administrator machine by switching in advance from the function of authenticating the authentication token to the function of issuing the authentication token certificate.

It is a block diagram of the client server type | mold authentication system by an authentication token of this invention. It is a block diagram of user management DB (database) of FIG. It is a block diagram of device management DB (database) of FIG. It is a flowchart of the process which issues a certificate to an authentication token. It is a flowchart of the process which issues a certificate to an authentication token. It is a flowchart of the authentication process by an authentication token.

A mode for carrying out the present invention will be described in detail with reference to the drawings showing examples.
FIG. 1 is a schematic configuration diagram of a client-server type authentication system using an authentication token according to the present invention.
In FIG. 1, a client machine 101 and an authentication server machine 103 are connected to a network 104. There are not only one client machine 101 but a plurality of client machines 101, each of which is connected to the authentication server machine 103 via the network 104, and can transmit mutual information. It is assumed that each client machine 101 has no specifically determined user, or one or a plurality of determined users.

  Similarly, an administrator machine 102 and an authentication server machine 103 are connected to the network 105. The administrator machine 102 is for the administrator to operate the authentication server machine 103 disposed in an isolated location such as a server room from the outside of the server room with administrator authority.

  The authentication server machine 103 can be implemented by a computer into which a server program is installed, and the client machine 101 and the administrator machine 102 can be implemented by an appropriate personal computer that functions as a terminal.

  FIG. 1 shows two authentication tokens 106 and 107 as an example of an authentication token used in the present system. These are media for storing issued certificates, for example, USB memories. When the authentication tokens 106 and 107 are connected to the client machine 101 in a state where a predetermined certificate is stored, it is possible to log in as a user in accordance with the set security policy. Hereinafter, the “authentication token” without a sign is used to represent a broad concept of authentication tokens including the specific authentication tokens 106 and 107 shown in FIG. 1 and other authentication tokens.

  The authentication server machine 103 stores each processing means (not shown) for executing functions of the present invention including means for issuing a certificate to an authentication token and user authentication means using the authentication token, and information related to the functions of the present invention. A user management DB (database) 108 and a device management DB (database) 109 are provided. In the user management DB 108, information related to the user of the client machine 101 and a certificate issued to the user are registered for each user. In the device management DB 109, information related to the registered authentication token is registered for each authentication token.

  FIG. 2 is a configuration diagram showing an example of the definition contents and information of the user management DB 108 provided in the authentication server machine 103 of FIG. Information about each user who uses the client machine 101 of FIG. 1 is described.

  The user management DB 108 includes, as data items, a user name 201, certificate data 202, and a security policy 203, and each piece of information is stored in association with each other. The user name 201 stores the user name of each user. The certificate data 202 stores identification information of each user, which is a substantial certificate. The security policy 203 stores security restriction information such as whether or not the user can take out after the user is authenticated, that is, permitted to log in.

  This user management DB 108 is used to verify the user name and certificate stored in the authentication token when the client machine 101 requests authentication from the authentication server machine 103 in order to log in using the authentication token. . If the user management DB 108 matches the user name stored in the authentication token and the verification result of the certificate, the user is successfully logged in. If the verification results do not match, the user fails to log in.

  FIG. 3 is an overview of the definition contents and information of the device management DB 109 provided in the authentication server machine 103 in FIG. 1, and describes information for uniquely identifying the individual authentication tokens 106 and 107 in FIG.

  The device management DB 109 includes, as data items, an identification ID 301 and an issue / non-issue 302, and each piece of information is stored in association with each other. The identification ID 301 stores information for identifying each of the authentication tokens 106 and 107 in FIG. 1 as a unique individual, that is, individual identification information. Here, the individual identification information of the authentication token is information that is inherently stored in the medium of each authentication token and cannot be rewritten or copied. The issuance / non-issuance 302 stores issuance / non-execution information that sets whether or not a certificate can be issued for the authentication token described in the identification ID 301. As an example, for the authentication token 106 in FIG. 1, individual identification information “id106” is stored in the identification ID 301 and “possible” is stored in the issuance permission / inhibition 302, and for the authentication token 107 in FIG. The information “id107” stores “impossible” in the issue permission / inhibition 302.

  The device management DB 109 is referred to when the administrator machine 102 issues a certificate to the registered authentication tokens 106 and 107 to check whether the authentication tokens 106 and 107 are issued. Further, when the client machine 101 makes an authentication request to the authentication server machine 103 in order to log in using the authentication token, the client machine 101 is referred to confirm whether or not the authentication token is registered.

  4A and 4B are flowcharts of processing executed by the administrator machine 102 and the authentication server machine 103, in which an unregistered authentication token is registered and a certificate is issued for the registered authentication token. It is. In the latter half of this process, the process branches depending on the setting contents of the certificate issuance information of the authentication token 106 and the authentication token 107 shown in FIG. In the following description, reference numerals in FIGS. 1 to 3 are also referred to.

  First, the administrator logs in to the administrator machine 102, and an unregistered authentication token is connected to the administrator machine 102 by the administrator (step 401). The individual identification information of the authentication token and the certificate issuance information are transmitted from the administrator machine 102 to the authentication server machine 103, and the authentication server machine 103 registers these information in association with each other in the device management DB 109 ( Step 402).

  Next, the administrator machine 102 remotely logs in to the authentication server machine 103, and the authentication server machine 103 is temporarily given authority to issue a certificate (step 403).

  Again, the administrator connects the authentication token to the administrator machine 102 (step 404). At that time, the process branches depending on whether or not the administrator machine 102 is set to enable the certificate issuing mode by the authentication server machine 103 (step 405). When the certificate issuance mode is set to be valid, login authentication is not performed for the authentication server machine 103 even if an authentication token is connected. As a result, a certificate can be issued for the authentication token. Therefore, when issuing a certificate for an authentication token, it is necessary to set the certificate issuing mode to be valid for the administrator machine 102 from the authentication server machine 103 in advance (before connecting the authentication token). There is. Note that the authentication server machine 103 also includes means for setting the certificate issuing mode of the administrator machine 102 to invalid from a state where the certificate issuing mode is set to valid.

  If the certificate issuance mode is set to invalid in step 405, login authentication is performed on the authentication server machine 103 as an authentication token (step 407). Thereafter, the process is irrelevant to the present invention.

  On the other hand, if the certificate issuance mode is set to be valid in step 405, a certificate can be issued for the authentication token (step 406). When the certificate is issued to the authentication token in the authentication server machine 103 instead of the administrator machine 102, it is not necessary to set the certificate issuance mode to be valid.

  Next, the administrator machine 102 inquires of the authentication server machine 103 whether or not the individual identification information of the connected authentication token is registered in the device management DB 109 (step 408). The authentication server machine 103 refers to the device management DB 109, and if the individual identification information of the authentication token has been registered in the identification ID 301, the authentication server machine 103 replies to the administrator machine 102.

  Subsequently, the administrator machine 102 inquires of the authentication server machine 103 whether or not a certificate can be issued for the authentication token (step 409). The authentication server machine 103 refers to the device management DB 109 and replies to the administrator machine 102 if “possible” is registered in the issue possibility 302 corresponding to the identification ID 301 of the authentication token. Based on this, the administrator machine 102 issues a designated user certificate to the authentication token (step 410). For example, when the authentication token 106 is connected, “id 106” has already been registered in the identification ID 301 of the device management DB 109, and “possible” is registered in the issue permission / inhibition 302, so that the certificate is successfully issued. In the designation of the user, for example, when “yamada” of the user name 201 is designated as a user, “yamada” and a certificate corresponding thereto are stored in the authentication token 106 and also stored in the user management DB 108.

  In this way, the authentication token stores information on the designated user and information on the issued certificate. At the same time, these user information and certificate information are transmitted to the authentication server machine 103, and the authentication server machine 103 stores the certificate in the certificate data 202 associated with the user name 201 of the user management DB 108. At this time, if data already exists in the certificate data 202, the data is overwritten.

  If neither of the above step 408 and step 409 is satisfied, the certificate issuance fails and the process is terminated (step 411). For example, when the authentication token 107 is connected, “id107” is registered in the identification ID 301, but “impossible” is registered in the issue permission / non-permission 302, so the certificate issuance to the authentication token 107 has failed. To do.

  FIG. 5 is a flowchart of a process executed by the client machine 101 and the authentication server machine 103 and performing authentication using an authentication token. 1 illustrates processing for connecting and authenticating the authentication token 106 to the client machine 101 in FIG.

  First, the authentication token 106 is connected to the client machine 101 in FIG. 1 (step 501). In this authentication token 106, a certificate has already been issued and stored. Information (individual identification information, user name, certificate) stored in the authentication token 106 is transmitted to the authentication server machine 103 together with the authentication request. Next, the authentication server machine 103 refers to the device management DB 109 and confirms whether the individual identification information of the authentication token 106 is registered. (Step 502).

  If another authentication token that is not the authentication token 106 is connected and the individual identification information is not registered in the device management DB 109, authentication by the authentication token fails and the process ends (step 504). For example, suppose that it is attempted to connect and authenticate another authentication token in which the same certificate as the authentication token 106 is copied by some means. However, since the individual identification information of this other authentication token is not registered in the device management DB 109, the authentication process using this other authentication token fails due to this process.

  In this embodiment, since the individual identification information of the authentication token 106 is registered in the device management DB 109, the authentication server machine 103 permits authentication by the authentication token 106 and further refers to the user management DB 108. Then, the user name and certificate stored in the authentication token 106 are collated with the user name 201 and certificate data 202 registered in the user management DB 108 (step 503). If the collated results do not match, authentication by the authentication token 106 fails and the authentication process ends (step 507). If the collated results match, the authentication token 106 is successfully authenticated (step 506).

  DESCRIPTION OF SYMBOLS 101 ... Client machine, 102 ... Administrator machine, 103 ... Authentication server machine, 104 ... Network, 105 ... Network, 106 ... Authentication token, 107 ... Authentication token, 108 ... User management DB, 109 ... Device management DB

Claims (2)

An authentication server machine for authenticating a user; a client machine connected to the authentication server machine via a network and used by a user; an administrator machine connected to the authentication server machine via a network and used by an administrator; A client-server type authentication system having an authentication token which is a medium for storing issued certificates and has individual identification information,
The authentication server machine is:
Means for associating the individual identification information of the authentication token transmitted from the administrator machine with the certificate issuance information for the authentication token in association with the device management DB;
Means for associating user information related to the user transmitted from the administrator machine with a certificate issued to the user in a user management DB;
In response to an authentication request from the client machine connected to the authentication token storing the user information and the certificate, individual identification information of the authentication token included in the authentication request is registered in the device management DB. Means to check whether or not
Only when the individual identification information of the authentication token is registered, it is confirmed whether the user information and certificate included in the authentication request match the user information and certificate stored in the user management DB. Means,
Means for permitting authentication only when the user information and the certificate match,
The administrator machine is
Means for transmitting the individual identification information of the connected unregistered authentication token and the certificate issuance permission / prohibition information for the authentication token so as to be registered in the authentication server machine;
The authentication server machine is inquired whether or not the connected authentication token has been registered and whether or not the certificate issuance information for the authentication talk can be issued. Only when a reply is received that the registration has been made and the issue / prohibition information can be issued, a certificate for the designated user is issued, and the user information of the designated user and the issued certificate are Means for storing in the authentication token;
And a means for transmitting the user information and the issued certificate to be stored in the authentication server machine.   The administrator machine further comprises means for enabling a certificate issuing mode to be set by the authentication server machine before connecting the authentication token to be inquired to the authentication server machine. 2. The client server type authentication system using an authentication token according to claim 1, wherein the certificate can be issued only when a certificate issuance mode is set to be valid.

Images