JP6084258B2 - Authentication system and display program - Google Patents

Description

  The present invention relates to an authentication technique for authenticating a communication terminal connected to a communication network such as the Internet, and more particularly to a technique for rejecting an unauthorized authentication request using a mechanical login program.

  2. Description of the Related Art Conventionally, a so-called list-type attack is known as one of methods for illegally logging in to an Internet website or the like.

  A list-type attack is where a fraudster illegally obtains a large number of user IDs and passwords used for login authentication of a certain website, and uses those user IDs and passwords to receive login authentication for other websites. It is an unauthorized login method that tries to do so. If a legitimate user uses the same user ID and password for a plurality of websites, there is a risk of unauthorized login by this list type attack.

  Such a list-type attack is generally performed by causing a computer to execute a mechanical login program. This mechanical login program mechanically executes login authentication requests for a large number of user IDs and passwords on various websites at high speed. By using a mechanical login program, a fraudster can automatically attempt a large number of unauthorized accesses in a short time.

  As a technique for rejecting an authentication request using a mechanical login program, for example, those described in Patent Documents 1 and 2 below are known.

Patent Document 1 includes a capture (CAPTCHA).
An authentication technique referred to as is disclosed. In this authentication technique, an arbitrary character string is displayed on the authentication web page of the communication terminal that requested authentication, and the user of the communication terminal is prompted to manually input the character string. At this time, by displaying the character string in a form that can be identified by a human but not by a computer character recognition program, a mechanical authentication request by a mechanical login program can be rejected (Patent Literature). 1).

  Further, in Patent Document 2, a jigsaw puzzle is displayed on the login authentication page, and the user of the communication terminal is allowed to solve the jigsaw puzzle, thereby rejecting the mechanical authentication request by the mechanical login program (Patent Document). 2 paragraph [0077], FIG. 8 (c), etc.).

Special table 2014-515516 gazette Japanese Patent Laying-Open No. 2015-109097

  However, the authentication technique (capture) of Patent Document 1 has a drawback in that it is difficult for legitimate users to use because the input character string may be difficult for humans to read.

  Similarly, the authentication technique of Patent Document 2 has a drawback that it is not convenient for a legitimate user because the jigsaw puzzle must be solved each time.

  It is an object of the present invention to provide a web authentication system and an authentication program that can reject a mechanical authentication request by a mechanical login program without increasing a user's operation burden.

The invention of claim 1 is an authentication system for preventing a communication terminal from receiving authentication from a web server without executing processing for displaying an authentication page on a browser , wherein a character string is used as a first authentication key. a key storage unit for storing a second authentication key generated by performing processing, when said communication terminal requests an authentication to the web server, and displays the authentication page on a display unit of the communication terminal A display process; a calculation process for generating a third authentication key from the first authentication key by automatically executing the character string processing process; and a return process for returning the third authentication key. the program to be executed by the browser of the terminal, the transmission processing unit for transmitting the authentication page display program addressed to the communication terminal, the third authentication key received from the communication terminal before If there is a match with the second authentication key stored in the key storage unit, characterized in that the authentication system and a comparison processing unit to determine that the display program is executed.

  According to a second aspect of the present invention, in addition to the configuration of the first aspect, the first authentication key is embedded in the display program or in data transmitted along with the display program. It is transmitted to a communication terminal.

  According to a third aspect of the present invention, in addition to the configuration of the first or second aspect, the authentication page includes an input field for a user ID and a password, and the return processing of the display program is input to the input field. The third authentication key is returned together with the user ID and the password that have been sent.

The invention according to claim 4 is a display program for preventing a communication terminal from receiving authentication from a web server without executing processing for displaying an authentication page on a browser, wherein the communication terminal is connected to the web server. When the authentication is requested, the authentication system according to any one of claims 1 to 3 automatically transmits the display process for displaying the authentication page on the display unit of the communication terminal and the character string processing process. Thus, a calculation program for generating a third authentication key from the first authentication key and a return process for returning the third authentication key are set as a display program for causing the browser of the communication terminal to execute. Features.

  According to the first and fourth aspects of the present invention, the second authentication key stored in the key storage unit is compared with the third authentication key automatically calculated by the browser of the communication terminal executing the display program. Authentication process. Therefore, a communication terminal that does not execute the display program cannot receive authentication from this authentication system. Here, usually, the mechanical login program does not execute the display program. Therefore, according to the first and fourth aspects of the invention, an unauthorized authentication request (for example, an authentication request for a list type attack) by many mechanical login programs can be rejected.

  It is also conceivable for fraudsters to develop and use a mechanical login program that can execute a display program. Even in this case, however, the development cost of the mechanical login program has increased and the processing speed (that is, within a unit time). The number of times authentication requests can be made is reduced, thereby making it difficult to perform fraudulent acts.

  Furthermore, according to the invention of claim 1, since the third authentication key is automatically calculated by the communication terminal executing the display program, the operation burden on the authorized user is not increased.

  According to the invention of claim 2, the first authentication key is transmitted to the communication terminal in a state embedded in the display program or data transmitted accompanying the display program. The mechanical login program needs to find out the first authentication key from the display program. For this reason, according to the invention of claim 2, the development cost of the mechanical login program can be increased and the processing speed can be lowered, thereby making it difficult to perform an illegal act. On the other hand, since the operation for inputting the first authentication key to the communication terminal is unnecessary for the authorized user, the operation burden does not increase.

  According to the invention of claim 3, since the authentication system receives the third authentication key together with the user ID and password entered on the authentication page, the user ID used for the mechanical authentication request by the mechanical login program. Even if the password is a legitimate one obtained illegally, the authentication can be rejected.

It is a conceptual diagram which shows the network structure which concerns on Embodiment 1 of this invention. It is a conceptual diagram for demonstrating operation | movement of the authentication system which concerns on the same Embodiment 1. FIG. 4 is a schematic flowchart for explaining the operation of the authentication system according to the first embodiment. 4 is a schematic flowchart for explaining the operation of the authentication system according to the first embodiment. 4 is a schematic flowchart for explaining the operation of the authentication system according to the first embodiment.

Embodiment 1 of the Invention
Embodiment 1 of the present invention will be described below with reference to FIGS.

  FIG. 1 is a conceptual diagram showing the network configuration of the first embodiment.

  As shown in FIG. 1, in the network 100 according to the first embodiment, the web server 200 and the communication terminal 300 are communicatively connected via the Internet 400.

  The web server 200 corresponds to the “authentication system” of the present invention, and includes a web authentication unit 210 and a web page distribution unit 220.

  The web authentication unit 210 includes a key generation unit 211, a database 212, and a comparison processing unit 213.

  The key generation unit 211 generates a first authentication key using, for example, a pseudo random number or a random number generator. The first authentication key is, for example, a character string (may include numbers and symbols).

  Then, the key generation unit 211 generates a second authentication key by applying a character string processing process prepared in advance to the first authentication key.

  The content of the character string processing process is not particularly limited, and is always the same from the first authentication key regardless of whether the character string processing process is performed by the web authentication unit 210 or the browser of the communication terminal 300. Any process that can generate the second authentication key may be used. For example, the character string processing process may be an arithmetic process using a cryptographic hash function such as SHA (Secure Hash Algorithm) -1, or the first authentication key may be exclusively logically expressed with a specific character string. Processing that performs a sum operation may be used.

  The contents of the character string processing process can be changed as appropriate. By making it possible to change the contents of the character string processing process, it is possible for an unauthorized person to make it difficult to develop a mechanical login program corresponding to the character string processing process. Furthermore, the contents of the character string processing process may be changed for each authentication process.

  The generated first authentication key is sent to the web page distribution unit 220. On the other hand, the second authentication key obtained by the above-described character string processing is sent to the database 212.

  The database 212 corresponds to the “key storage unit” of the present invention, and temporarily stores the second authentication key received from the key generation unit 211. In addition, the database 212 receives the third authentication key from the comparison processing unit 213, and searches for a second authentication key that matches the third authentication key (described later).

  The comparison processing unit 213 receives a third authentication key (described later) generated from the communication terminal 300 from the web page distribution unit 220. Subsequently, the database 212 is requested to search for a second authentication key that matches the third authentication key. When the second authentication key that matches the third authentication key is found from the database 212, the comparison processing unit 213 determines that the authentication is successful, and obtains the second authentication key from the database 212. At the same time, the authentication is notified to the web page distribution unit 220 (described later).

  Web page distribution unit 220 corresponds to the “transmission processing unit” of the present invention, and distributes a web display program to communication terminal 300. The web display program is a program for displaying a web page on the screen of the communication terminal 300 and is executed by the web browser 310 of the communication terminal 300. This web display program can be described using, for example, HTML (HyperText Markup Language). The web page distributed by the web page distribution unit 220 includes a login authentication page.

  The login authentication page web display program includes an input field 320 for allowing the user of the communication terminal 300 to input a user ID, an input field 330 for allowing the user to input a password, and these input fields 320 and 330. The login button 340 for transmitting the input character string is displayed on the display screen of the communication terminal 300.

  Further, the web display program for the login authentication page includes a program code for causing the communication terminal 300 to execute a character string processing process and generating a third authentication key from the first authentication key. The contents of the character string processing process are the same as the character string processing process of the key generation unit 211 described above. Therefore, when the web display program is normally executed, the third authentication key is the same character string as the second authentication key generated by the character string processing of the key generation unit 211.

  In addition, the web page distribution unit 220 embeds a first authentication key to be subjected to the character string processing process in the web display program for the login authentication page or the data distributed along with the web display program. The position for embedding the first authentication key may be anywhere as long as the script in the web display program can be accessed. For example, the first authentication key can be embedded in a description part that defines a document structure or a description part that defines a style.

  In addition, the web display program for the login authentication page includes a program code for transmitting the third authentication key to the web page distribution unit 220 of the web server 200. In the first embodiment, the third authentication key is displayed in the form tag for transmitting the user ID and password input in the input fields 320 and 330 to the web server 200, and the non-display data (input type is set). stored as "hidden" data). An example of this form tag description is shown below.

<form action = "/ login" mehtod = "post" name = "loginForm">
<input type = "hidden" name = "_ token" value = "fF7eg6CSD3d636d"/>
<input type = "text" name = "user_id"/>
<input type = "password" name = "password"/>
<input id = "submit" type = "image" src = "img / img / login.gif" value = "login"/>
</ form>
In addition, the web page distribution unit 220 receives the user ID, password, and third authentication key from the communication terminal 300, and performs an authentication process as described below.

  The communication terminal 300 may be any communication device that can access the web server 200 via the Internet 400, such as a personal computer, a mobile phone, a smartphone, or a tablet terminal. For example, a web browser 310 is installed in the communication terminal 300 of the authorized user as application software. The web browser 310 may be anything as long as it can execute the web display program as described above, and a conventional one can be used as it is.

  Next, the overall operation of the network according to the first embodiment will be described with reference to FIGS.

  First, the user of the communication terminal 300 accesses the web server 200 by operating the web browser 310. Then, a page request signal for requesting distribution of a desired web page (that is, transmission of a web display program corresponding to the web page) is transmitted to the web page distribution unit 220 of the web server 200 (step S201 in FIG. 2). reference).

  Upon receiving this page request signal, the web page distribution unit 220 transmits an authentication key request signal to the web authentication unit 210 (see step S202 in FIG. 2).

  When receiving the authentication key request signal, the key generation unit 211 of the web authentication unit 210 performs the following processing (see FIG. 3).

  First, when receiving the authentication key request signal (see step S301 in FIG. 3), the key generation unit 211 generates a first authentication key (see step S302 in FIG. 3). As described above, the first authentication key can be generated using, for example, a pseudo random number, but other methods may be used.

  Subsequently, the key generation unit 211 generates a second authentication key by performing a character string processing process using the first authentication key (see step S303 in FIG. 3).

  Further, the key generation unit 211 determines a timeout time for authentication using the second authentication key, and stores the second authentication key and the timeout time in the database 212 (see step S304 in FIG. 3). Note that the generation time of the second authentication key may be stored in the database 212 instead of the timeout time.

  After that, the key generation unit 211 transmits the first authentication key to the web page distribution unit 220 (see step S305 in FIG. 3 and step S203 in FIG. 2).

  Upon receiving the first authentication key from the web authentication unit 210, the web page distribution unit 220 embeds the first authentication key in a login authentication page web display program (described above) prepared in advance. And the web page delivery part 220 transmits the web display program to the communication terminal 300 (refer step S204 of FIG. 2).

  The communication terminal 300 causes the web browser 310 to execute this web display program. Thereby, the web browser 310 displays a login authentication page on the display screen of the communication terminal. As described above, this login authentication page includes the input field 320 for user ID, the input field 330 for password, and the login button 340 (see FIG. 1).

  In addition, when the web browser 310 executes the web display program, the third authentication key is generated as described above (described above). The program for generating the third authentication key may be executed when the login authentication page is displayed (that is, when the input fields 320 and 330 and the login button 340 are displayed). You may perform at the timing (after-mentioned) that the user operated the login button 340. FIG.

  Thereafter, when the user of the communication terminal 300 operates the login button 340 after inputting the user ID and password in the input fields 320 and 330, the authentication information including the user ID, the password, and the third authentication key is displayed on the web. It is transmitted to the server 200 (see step S205 in FIG. 2). Note that the password input in the input field 330 may be transmitted after being encrypted using a cryptographic hash function or the like.

  Upon receiving this authentication information, the web server 200 performs the following processing (see FIGS. 4 and 5). 4 shows the operation of the web page distribution unit 220, and FIG. 5 shows the operation of the comparison processing unit 213 provided in the web authentication unit 210.

  When receiving the authentication information (see step S401 in FIG. 4), the web page distribution unit 220 checks whether the user ID and password stored in the authentication information are correct (see step S402 in FIG. 4).

  If the user ID and password are incorrect, the web page distribution unit 220 determines that authentication has failed and performs processing for rejecting login of the communication terminal 300 (see step S403 in FIG. 4). Through this process, the communication terminal 300 is notified that login has been refused (see step S208 in FIG. 2).

  On the other hand, if the user ID and password are correct in step S402, the web page distribution unit 220 stores the third authentication key in the authentication confirmation request and transmits it to the web authentication unit 210 (step S404 in FIG. 4, FIG. 4). 2 step S206).

  When receiving the authentication confirmation request (see step S501 in FIG. 5), the comparison processing unit 213 extracts the third authentication key from the acceptance confirmation request. Subsequently, the comparison processing unit 213 requests the database 212 to search for a second authentication key that matches the third authentication key (see step S502 in FIG. 5).

  If the second authentication key that matches the third authentication key does not exist (see step S503 in FIG. 5), the comparison processing unit 213 informs the web page distribution unit 220 that the authentication has failed. Notification is made (see step S504 in FIG. 5 and step S207 in FIG. 2). Even when the second authentication key that matches the third authentication key is searched, if the search time exceeds the timeout time (described above), it is determined that the authentication has failed, The second authentication key and timeout time are deleted from the database 212. If the generation time of the second authentication key is stored in the database 212 instead of the timeout time, it may be determined that the authentication has failed when the elapsed time from the generation to the search exceeds a predetermined time. .

  On the other hand, when the second authentication key that matches the third authentication key is confirmed and the elapsed time since the generation of the second authentication key is within a predetermined time, the comparison processing unit 213 The second authentication key and the timeout time (or generation time) are deleted from the database 212 (see step S505 in FIG. 5), and the web page distribution unit 220 is notified that the authentication has been successful (step S506 in FIG. 5). , See step S207 in FIG. 2).

  When receiving the notification from the web authentication unit 210, the web page distribution unit 220 determines the success / failure of the authentication from the notification (see step S405 in FIG. 4). When it is determined that the authentication has failed, the web page distribution unit 220 performs a process for rejecting the login of the communication terminal 300 (see step S406 in FIG. 4). Through this process, the communication terminal 300 is notified that login has been refused (see step S208 in FIG. 2).

  On the other hand, when it is determined in step S405 that the authentication is successful, the web page distribution unit 220 generates a session key for the communication terminal 300 (see step S407 in FIG. 4) and transmits the session key to the communication terminal 300. Transmit (see step S408 in FIG. 4 and step S208 in FIG. 2). With this session key, login to the communication terminal 300 is permitted, and session management after login is performed.

  As described above, in the first embodiment, the second authentication key stored in the key generation unit 211 and the third computation automatically calculated by the web browser 310 of the communication terminal 300 executing the web display program. Login authentication is performed by comparing with the authentication key. For this reason, the communication terminal 300 that does not execute the web display program cannot receive authentication. Here, usually, the mechanical login program does not execute the web display program. Therefore, according to this embodiment, an unauthorized authentication request (for example, an authentication request for a list-type attack) by many mechanical login programs can be rejected.

  It is also conceivable for fraudsters to develop and use a mechanical login program that can execute a web display program. Even in this case, however, the development cost of the mechanical login program and the processing speed (that is, unit time) The number of times authentication requests can be made is reduced, thereby making it difficult to perform fraudulent acts.

  Furthermore, according to the first embodiment, since the third authentication key is automatically calculated by the communication terminal 300 executing the web display program, the operation burden on the user of the communication terminal 300 is not increased. .

  Further, according to the first embodiment, the first authentication key is transmitted to the communication terminal 300 in an embedded state in the web display program, so that the mechanical login program of the communication terminal 300 is the first authentication key. It is necessary to search for one authentication key in the web display program. For this reason, according to the first embodiment, the development cost of the mechanical login program can be increased and the processing speed can be lowered, thereby making it difficult to perform an illegal act.

  On the other hand, since the operation for inputting the first authentication key to the communication terminal is unnecessary for the authorized user, the operation burden does not increase.

  In addition, according to the first embodiment, the web server 200 receives the third authentication key together with the user ID and password input on the authentication page, so that it is used for a mechanical authentication request by the mechanical login program. Even if the obtained user ID and password are legitimate ones obtained illegally, the authentication can be rejected.

  In the first embodiment, the case where the authentication technique of the present invention (authentication technique by comparing the second and third authentication keys) is used in combination with the authentication technique based on the user ID and password has been described as an example. However, the authentication technique of the present invention may be used in combination with other authentication techniques, or may be used alone.

DESCRIPTION OF SYMBOLS 100 Network 200 Web server 210 Web authentication part 211 Key production | generation part 212 Database 213 Comparison processing part 220 Web page delivery part 300 Communication terminal 310 Web browser 320,330 Input field 340 Login button 400 Internet

Claims (4)

An authentication system for preventing a communication terminal from receiving authentication from a web server without executing processing for displaying an authentication page on a browser,
A key storage unit for storing the second authentication key generated by performing the character string processing on the first authentication key;
When the communication terminal requests authentication from the web server, the display process of displaying the authentication page on the display unit of the communication terminal and the character string processing process are executed automatically from the first authentication key. A program for causing the browser of the communication terminal to execute a calculation process for generating a third authentication key and a return process for returning the third authentication key is sent to the communication terminal as the authentication page display program. A transmission processing unit to transmit;
A comparison processing unit that determines that the display program has been executed when the third authentication key received from the communication terminal matches the second authentication key stored in the key storage unit;
An authentication system comprising:   The authentication system according to claim 1, wherein the first authentication key is transmitted to the communication terminal in a state of being embedded in the display program. The authentication page includes input fields for user ID and password, and
The return process of the display program is a process of returning the third authentication key together with the user ID and the password input in the input field.
The authentication system according to claim 1 or 2, characterized in that. A display program for preventing a communication terminal from receiving authentication from a web server without executing processing for displaying an authentication page on a browser,
When the communication terminal requests authentication from the web server, it is transmitted from the authentication system according to any one of claims 1 to 3 ,
A display process for displaying the authentication page on the display unit of the communication terminal; an arithmetic process for generating a third authentication key from the first authentication key by automatically executing the character string processing process; A display program for causing the browser of the communication terminal to execute a return process for returning the authentication key .

Images