JP6817707B2 - Authentication system, communication device and authentication data application method - Google Patents

Description

The present invention relates to an authentication system, a communication device, and an authentication data application method, and more particularly to an authentication system, a communication device, and an authentication data application method that holds authentication data in a communication device and performs authentication.

Generally, IEEE (Institute of Electrical and Electronics Engineers) 802.1X authentication, which is a user authentication method, and MAC (abbreviation, "Media Access Control") address authentication, which is a terminal authentication method, are performed on the network. The function is realized by providing an independent authentication server in.

However, in recent years, with the improvement in the performance of communication devices such as routers and switching hubs, a method in which the functions of authentication servers are distributed and implemented in those communication devices to perform authentication processing (hereinafter referred to as "local authentication"). ) Is being adopted by an increasing number of networks. In local authentication, data used for authentication processing is stored in a storage device in a communication device, and the authentication processing is performed by referring to the data.

As a technique related to local authentication, in the technique described in Patent Document 1, the setting information held in advance in the router corresponding to the USB (abbreviation of "Universal Serial Bus") device connected to the router is used. Then, some of the router functions such as the packet filter can be temporarily disabled only for the period when the USB device is connected. In addition, it is possible to eliminate the possibility that a person other than the administrator uses the management screen of the router to change the settings unintentionally by the administrator.

In the technique described in Patent Document 2, a new wireless network is automatically constructed only during the period when the media (corresponding to the USB device) is connected to the management terminal constituting the wireless network. Then, the terminal that newly accesses the access points constituting the wireless network receives the connection to the new network. Then, after the use of the new network of the new terminal is completed, the new network is canceled by removing the media from the management terminal. As a result, the new network does not continue to exist after the end of use of the new network of the new terminal, and the user only has to insert and remove the media into the management terminal, so that the operation effort can be reduced. ..

Japanese Unexamined Patent Publication No. 2012-147214 JP-A-2009-253466

However, in local authentication, authentication data used for authentication processing, such as setting information related to authentication operation and information on a terminal to be authenticated, is stored in a storage device in a communication device instead of an independent authentication server. As a result, if the authentication data is tampered with, the impact on the user's business operations will be prolonged (for example, the business will be stopped until the administrator recovers the authentication data in the communication device), or the device will be stolen. There is a problem that the risk of leakage of terminal information is increasing.

Furthermore, from the viewpoint of enhancing security, the operation of communication devices is strictly carried out by the administrator. Therefore, even if it is a minor setting change related to data other than the authentication data, it is necessary to request the work from the administrator, and there is a problem that the setting change of the communication device cannot be easily performed.

Further, Patent Documents 1 and 2 describe technologies for reducing security risks such as falsification of authentication data in communication devices (that is, devices corresponding to routers or access points) and leakage of terminal information. There is no description.

An object of the present invention is an authentication system, a communication device, and a communication device capable of prolonging the influence of falsification of authentication data on a user's business operation and reducing security risks such as leakage of terminal information due to device theft. The purpose is to provide a method for applying authentication data.

The authentication system of the present invention
A terminal including a terminal control means that generates an encryption key and stores the encrypted authentication data obtained by encrypting the authentication data using the encryption key in a connected portable storage device.
When the portable storage device in which the encryption authentication data is stored is connected, a decryption key is generated, the encryption authentication data is decrypted using the decryption key, and the decrypted decryption authentication data is obtained. Is stored in the temporary storage means, and includes a communication device including a control means for authenticating the terminal by using the decryption authentication data stored in the temporary storage means.

Further, the communication device of the present invention is
When a portable storage device in which the encryption authentication data is stored is connected, a decryption key for decrypting the encryption authentication data is generated, and the decryption key is used to decrypt the encryption authentication data. The decrypted decryption authentication data is stored in the temporary storage means, and the terminal is authenticated using the decryption authentication data stored in the temporary storage means.

Further, the terminal of the present invention is
An encryption key is generated, and the encryption authentication data obtained by encrypting the authentication data using the encryption key is stored in the connected portable storage device.

Moreover, the method of applying the authentication data of the present invention is:
An encryption key is generated, and the first encryption authentication data obtained by encrypting the first authentication data using the encryption key is stored in the first portable storage device.
A first decryption key for decrypting the first encryption authentication data is generated, and the first decryption key is generated.
The first decryption key is used to decrypt the first encryption authentication data stored in the first portable storage device.
The decrypted first decryption authentication data is stored in the temporary storage means, and the terminal is authenticated using the first decryption authentication data stored in the temporary storage means.

The present invention has an effect that it is possible to prolong the influence on the business operation of the user due to falsification of authentication data and reduce security risks such as leakage of terminal information due to theft of a device.

It is a block diagram which shows the 1st Embodiment of this invention. It is a block diagram which shows the structure of the terminal 30 in 1st Embodiment. It is a figure which shows an example of the authentication table 122 in 1st Embodiment. It is a figure which shows an example of the authentication operation setting table 123 in 1st Embodiment. It is a flowchart which shows the operation of the terminal 30 in 1st Embodiment. It is a flowchart which shows the operation of the communication apparatus 10 in 1st Embodiment. It is a flowchart which shows the operation of the communication apparatus 10 in the 2nd Embodiment of this invention. It is a block diagram which shows the 3rd Embodiment of this invention.

Next, an embodiment of the present invention will be described in detail with reference to the drawings.

[First Embodiment]
FIG. 1 is a block diagram showing a first embodiment of the present invention.

Referring to FIG. 1, the system includes a communication device 10, a USB device 20 to which unique identification information for identifying each device is assigned, and at least one terminal 30 connected to the communication device 10 via a network 40. including. The network 40 connecting the communication device 10 and the terminal 30 may be a wired network, a wireless network, or a network in which they are combined. Interface identification information is assigned to the network interface unit (not shown) of the communication device 10 connected to the network 40.

Data (hereinafter referred to as "authentication data") such as setting information related to authentication operation and information of the terminal to be authenticated, which is used when the communication device 10 authenticates the terminal 30, is encrypted and stored in the USB device 20. To.

The terminal 30 connects to the communication device 10 via the network 40, and further connects to an external network (not shown) such as the Internet via the communication device 10. Further, the terminal 30 has a function of encrypting the authentication data and storing it in the USB device 20. The function of encrypting the authentication data and storing it in the USB device 20 may be possessed by another terminal that is not connected to the network 40 and operates independently.

The communication device 10 includes a control unit 11, a temporary storage unit 12, a USB interface unit 13, and a terminal authentication unit 14. Unique identification information (for example, serial number, MAC address, etc.) for identifying each communication device 10 is assigned to the communication device 10.

The control unit 11 generates a decryption key 121 for decrypting the authenticated authentication data stored in the USB device 20. The control unit 11 includes a storage device (not shown) for storing the program and at least one processor (not shown) for reading the program into the memory and executing an instruction.

The temporary storage unit 12 is, for example, a volatile memory and can store data, but when the power of the communication device 10 is turned off, the stored information is also lost. Further, the temporary storage unit 12 stores the decryption key 121, the authentication table 122 decrypted by the decryption key 121, and the authentication operation setting table 123. Here, the authentication table 122 and the authentication operation setting table 123 correspond to the authentication data.

A USB device 20 is connected to the USB interface unit 13, and data stored in the connected USB device 20 is exchanged. The USB interface unit 13 is configured so that the USB device 20 can be connected and disconnected. Further, the USB interface unit 13 registers in advance the identification information of at least one USB device that is permitted to connect to the communication device 10 in a predetermined storage location (not shown) of the communication device 10.

The terminal authentication unit 14 performs an authentication process of the terminal 30 using the authentication data included in the authentication table 122 and the authentication operation setting table 123.

FIG. 2 is a block diagram showing a terminal 30 in the present embodiment.

Referring to FIG. 2, the terminal 30 includes a terminal control unit 31, a temporary storage unit 32, a USB interface unit 33, and an input / output unit 34.

The terminal control unit 31 has a function of generating an encryption key 321 used when encrypting the authentication data used when the communication device 10 authenticates the terminal 30. The terminal control unit 31 includes a storage device (not shown) for storing a program and at least one processor (not shown) for reading the program into a memory and executing an instruction.

The temporary storage unit 32 is, for example, a volatile memory and can store data, but when the power of the terminal 30 is turned off, the stored information is also lost. Further, the temporary storage unit 32 stores the encryption key 321 and the encryption authentication table 322 and the encryption authentication operation setting table 323 in which the authentication data is encrypted. Hereinafter, the encryption authentication table 322 and the encryption authentication operation setting table 323 are collectively referred to as "encryption authentication data".

A USB device 20 is connected to the USB interface unit 33, and data stored in the connected USB device 20 is exchanged. The USB interface unit 33 is configured so that the USB device 20 can be connected and disconnected.

An input / output device (not shown) provided with a keyboard or the like for the user to input information and a display screen or the like for displaying the information to the user is connected to the input / output unit 34.

FIG. 3 is a diagram showing an example of the authentication table 122 in the present embodiment.

Referring to FIG. 3, the authentication table 122 includes a rejection flag field, a user identification field, a password field, and a MAC address field. Then, one record included in the authentication table 122 indicates data used by the communication device 10 at the time of authentication of one terminal 30.

In the rejection flag column, information indicating whether or not to reject the connection of the terminal authenticated by the record is registered. If "1" is registered in the rejection flag field, the terminal indicated by the record is denied connection.

In the user identification field, information for identifying the user who uses the terminal indicated by the record is registered.

In the password field, the password set by the user who uses the terminal indicated by the record is registered.

In the MAC address field, the MAC address assigned to identify the terminal indicated by the record is registered.

For example, referring to the record in the first line of FIG. 3, "1" is registered in the rejection flag column, "user01" is registered in the user identification column, and "pass01" is registered in the password column. "01:02:03:04:05:06" is registered in the MAC address field. That is, the user who uses the terminal whose MAC address is indicated by "01:02:03:04:05:06" has the user identification information "user01" and the password "pass01". It turns out that the terminal connection is refused.

FIG. 4 is a diagram showing an example of the authentication operation setting table 123 in the present embodiment.

Referring to FIG. 4, the authentication operation setting table 123 includes an invalid flag column, an interface identification column, a function column, and a value column. The records included in the authentication operation setting table 123 indicate parameters that define the operation of the communication device 10 at the time of authentication.

In the invalid flag column, information indicating whether or not the authentication operation indicated by the record is invalid is registered. When "1" is registered in the invalid flag column, it indicates that the authentication operation indicated by the record is not executed.

In the interface identification field, interface identification information that identifies the network interface unit on which the authentication operation indicated by the record is executed is registered. That is, the parameter of the record is used in the authentication operation of the network interface unit indicated by the interface identification information registered in the interface identification field.

Information indicating the content of the authentication operation indicated by the record is registered in the function column.

In the value column, the setting value for the function used in the authentication operation indicated by the record is registered.

For example, referring to the record in the first line of FIG. 4, nothing is registered in the invalid flag column, and "wireless LAN01" (LAN is an abbreviation for "Local Area Network") is registered in the interface identification column. The "maximum number of supplicants" is registered in the function column, and "30" is registered in the value column. That is, it can be seen that the value set for the maximum number of supplicants is 30 when the communication device 10 executes the authentication process using the wireless LAN interface to which the identification information of the wireless LAN 01 is assigned.

Next, the operation of the terminal 30 will be described with reference to the flowchart of FIG.

FIG. 5 is a flowchart showing the operation of the terminal 30 when the authentication data is encrypted and stored in the USB device 20.

Referring to FIG. 5, first, the terminal control unit 31 first identifies the communication device 10 (for example, serial number, MAC address, etc.) input from the input / output device (not shown) via the input / output unit 34. The encryption key 321 is generated based on the above. Then, the terminal control unit 31 stores the generated encryption key 321 in the temporary storage unit 32 (step S101).

Next, the terminal control unit 31 uses the encryption key 321 based on the information indicating the authentication data input from the input / output device (not shown) via the input / output unit 34, and uses the encryption key 321 to perform the encryption authentication table 322. And the encryption authentication operation setting table 323 are generated. Then, the terminal control unit 31 stores the generated encryption authentication table 322 and the encryption authentication operation setting table 323 in the temporary storage unit 32 (step S102). Here, the information indicating the authentication data input from the input / output device (not shown) via the input / output unit 34 is each item of the authentication table 122 shown in FIG. 3 and the authentication operation setting table 123 shown in FIG. It is the information corresponding to.

Next, the terminal control unit 31 stores the encryption authentication table 322 and the encryption authentication operation setting table 323 in the USB device 20 via the USB interface unit 33 (step S103). In this way, the encrypted authentication data is stored in the USB device 20.

The terminal control unit 31 may directly store the generated encryption authentication table 322 and the encryption authentication operation setting table 323 in the USB device 20 without storing them in the temporary storage unit 32.

Next, the operation of the communication device 10 will be described with reference to the flowchart of FIG.

Referring to FIG. 6, first, the control unit 11 instructs the terminal authentication unit 14 to reject the connection of all the terminals 30 (step S201).

Next, the control unit 11 inquires whether or not the USB device 20 is connected to the USB interface unit 13 (step S202).

When there is a reply from the USB interface unit 13 that the USB device 20 is not connected (when "NO" in step S202), the control unit 11 returns to the start of this flowchart and starts from the process of step S201. repeat.

When the USB interface unit 13 responds that the USB device 20 is connected (when “YES” in step S202), the control unit 11 determines in advance the identification information of the USB device 20. It is determined whether or not it is included in each identification information of the USB device registered in the storage location (not shown) of the USB device that allows connection to the communication device 10 (step S203).

When the identification information of the USB device 20 is not included in each identification information of the USB device permitted to connect to the communication device 10 registered in advance in a predetermined storage location (not shown) (in step S203, ". In the case of "NO"), the control unit 11 returns to the start of this flowchart and repeats from the process of step S201.

When the identification information of the USB device 20 is included in each identification information of the USB device that is registered in advance in a predetermined storage location (not shown) and is permitted to connect to the communication device 10 (in step S203, ". In the case of "YES"), the control unit 11 inquires the USB interface unit 13 whether or not the encrypted authentication data is stored in the connected USB device 20 (step S204).

When there is a reply that the encrypted authentication data is not stored in the connected USB device 20 (in the case of "NO" in step S204), the control unit 11 returns to the start of this flowchart and steps. The process of S201 is repeated.

When there is a reply that the encrypted authentication data is stored in the connected USB device 20 (when "YES" in step S204), the control unit 11 indicates the identification information (identification information indicating the communication device 10). For example, the decryption key 121 is generated based on the serial number, MAC address, etc.). Then, the control unit 11 stores the generated decryption key 121 in the temporary storage unit 12 (step S205). The decryption key 121 is generated by the same algorithm as the encryption key 321 and based on the same identification information. Therefore, the data encrypted with the encryption key 321 can be decrypted with the decryption key 121.

Next, the control unit 11 obtains the encryption authentication data (that is, the encryption authentication table 322 and the encryption authentication operation setting table 323) stored in the USB device 20 via the USB interface unit 13. Then, the control unit 11 decrypts the obtained encryption authentication data by using the decryption key 121 (step S206).

The control unit 11 confirms whether or not the decoding can be performed normally (step S207), and if the decoding cannot be performed normally (when “NO” in step S207), the control unit 11 returns to the start of this flowchart and steps. The process of S201 is repeated. On the other hand, if the authentication can be normally performed (in the case of "YES" in step S207), the control unit 11 stores the decrypted authentication table 122 and the authentication operation setting table 123 in the temporary storage unit 12. Then, the control unit 11 instructs the terminal authentication unit 14 to cancel the connection refusal of all terminals and start the terminal authentication using the authentication table 122 and the authentication operation setting table 123 (step S208).

After that, the terminal authentication unit 14 uses the authentication data included in the authentication table 122 and the authentication operation setting table 123 to perform the authentication process of the terminal 30 to be connected via the network 40. That is, the terminal authentication unit 14 acquires the MAC address of the terminal 30 to be connected and searches the MAC address field of the record included in the authentication table 122 shown in FIG. When there is a record with the same MAC address, the terminal authentication unit 14 determines whether or not "1" is registered in the rejection flag column of the record. When "1" is registered in the refusal flag field, the terminal authentication unit 14 rejects the connection of the terminal 30. If the rejection flag field is blank, the terminal authentication unit 14 uses the value in the user identification field and the value in the password field to perform user authentication processing for the user who uses the terminal 30.

Further, the terminal authentication unit 14 acquires the interface identification information indicating the network interface unit to which the network 40 used by the terminal 30 to be connected is connected. Then, the terminal authentication unit 14 is registered in the value column of the record in which the same identification information as the acquired interface identification information is registered in the interface identification column among the records included in the authentication operation setting table 123 shown in FIG. The authentication operation is performed using the function of the set value.

As described above, in the present embodiment, the influence on the business operation of the user due to the falsification of the authentication data used when the communication device 10 authenticates the terminal 30 is prolonged, and the terminal information is leaked due to the theft of the device. It has the effect of reducing the risk.

The reason is that the terminal control unit 31 of the terminal 30 generates the encryption key 321 and stores the encryption authentication data generated by using the encryption key 321 in the USB device 20. Next, the control unit 11 of the communication device 10 generates the decryption key 121 based on the same identification information as the terminal control unit 31. Then, the control unit 11 decrypts the encryption authentication data of the USB device 20 using the generated decryption key 121 and stores it in the temporary storage unit 12. After that, the terminal authentication unit 14 uses the decrypted authentication data for the authentication process of the terminal 30.

That is, even if the authentication data of the communication device 10 is falsified due to unauthorized access or the like, the control unit 11 can simply restart the communication device 10 (for example, turn the power off and then on again) and connect the USB device 20. , The encryption authentication data stored in the USB device 20 is decrypted and applied. As a result, the terminal authentication unit 14 can restart the authentication process using the normal authentication data without waiting for the recovery work by the administrator. Further, even if the terminal 30 or the USB device 20 is stolen, the authentication data stored in the device is encrypted, so that there is no concern about information leakage. Further, even if the communication device 10 is stolen, the decrypted authentication data is held in the temporary storage unit 12, and the authentication data is lost when the power is turned off, so that there is no concern about information leakage.

[Second Embodiment]
Next, a second embodiment of the present invention will be described.

Since the configuration of this embodiment is the same as that of the first embodiment shown in FIGS. 1 to 4, the description thereof will be omitted.

The operation of the present embodiment will be described below, but the points different from the operation of the first embodiment will be mainly described.

FIG. 7 is a flowchart showing the operation of the communication device 10 of the present embodiment. Note that FIG. 7 is a flowchart in which the process of step S309 is added to the flowchart of the first embodiment shown in FIG.

Referring to FIG. 7, first, the control unit 11 instructs the terminal authentication unit 14 to reject the connection of all the terminals 30 (step S301).

Next, the control unit 11 inquires whether or not the USB device 20 is connected to the USB interface unit 13 (step S302).

When the USB interface unit 13 responds that the USB device 20 is not connected (when “NO” in step S302), the control unit 11 determines the USB device 20 for a predetermined time. Inquires to the USB interface unit 13 whether or not is newly connected (step S309).

If there is an answer that the USB device 20 is connected within a predetermined time (when “YES” in step S309), the control unit 11 proceeds to step S303.

If there is no answer that the USB device 20 is connected within a predetermined time (in the case of "NO" in step S309), the control unit 11 returns to the start of this flowchart and repeats from the process of step S301. ..

On the other hand, when there is a reply from the USB interface unit 13 that the USB device 20 is connected in step S302 (when "YES" in step S302), the control unit 11 identifies the USB device 20. It is determined whether or not the information is included in each identification information of the USB device that is registered in advance in a predetermined storage location (not shown) and is permitted to connect to the communication device 10 (step S303).

After that, as in the first embodiment, the control unit 11 has the identification information of the USB device 20 registered in advance in a predetermined storage location (not shown), and the encrypted authentication data is stored in the USB device 20. Is stored, the decryption key 121 is generated to decrypt the encryption authentication data stored in the USB device 20.

Then, the control unit 11 instructs the terminal authentication unit 14 to start terminal authentication using the decrypted authentication table 122 and the authentication operation setting table 123.

As described above, in addition to the effect of the first embodiment, the present embodiment has an effect that a user other than the administrator can safely and easily change the authentication data only by exchanging the USB device.

The reason is that even if the USB device 20 is removed from the communication device 10, the control unit 11 continues terminal authentication using the authentication data at the time of removal until a predetermined predetermined time elapses. Let me. Then, if the USB device 20 storing the encryption authentication data is connected within a predetermined time, the encryption authentication data is automatically decrypted and applied to the communication device 10.

[Third Embodiment]
Next, a third embodiment including the basic configuration of the first embodiment of the present invention will be described.

FIG. 8 is a block diagram showing the present embodiment.

Referring to FIG. 8, the system of this embodiment includes a communication device 50 and at least one terminal 70 connected to the communication device 50. The communication device 50 and the terminal 70 are configured so that a portable storage device (not shown) can be connected and disconnected.

In the portable storage device, authentication data used when the communication device 50 authenticates the terminal 70 is encrypted and stored.

The communication device 50 includes a control unit 51 that stores the decryption key 511 and a temporary storage unit 52 that stores the decryption authentication data 521 decrypted by the decryption key 511.

The terminal 70 includes a terminal control unit 71 that stores the encryption key 711 and the encryption authentication data 712 encrypted by the encryption key 711.

The terminal control unit 71 generates the encryption key 711. Next, the terminal control unit 71 encrypts the authentication data using the generated encryption key 711, and generates the encrypted authentication data 712. Then, the terminal control unit 71 stores the generated encryption authentication data 712 in the portable storage device connected to the terminal 70.

The control unit 51 generates a decryption key 511 when the above-mentioned portable storage device is connected to the communication device 50. Then, the control unit 51 uses the generated decryption key 511 to decrypt the encryption authentication data 712 stored in the portable storage device, and generates the decryption authentication data 521. Then, the control unit 51 stores the generated decryption authentication data 521 in the temporary storage unit 52. After that, the control unit 51 authenticates the terminal 70 by using the decryption authentication data 521 stored in the temporary storage unit 52.

As described above, in the present embodiment, as in the first embodiment, the influence of falsification of the authentication data used when the communication device 50 authenticates the terminal 70 on the business operation of the user is prolonged, and the device is stolen. It has the effect of reducing security risks such as leakage of terminal information.

The reason is that the encrypted authentication data 712 generated by the terminal control unit 71 is stored in a portable storage device (not shown). Then, the control unit 51 decrypts the encryption authentication data 712 stored in the portable storage device by using the generated decryption key 511. After that, the control unit 51 uses the decrypted decryption authentication data 521 for the authentication process of the terminal 70.

That is, even if the authentication data is falsified due to unauthorized access or the like, the control unit 51 can be made portable simply by restarting the communication device 50 (for example, turning the power off and then on again) and connecting the portable storage device. The encrypted authentication data 712 stored in the storage device is decrypted and applied. As a result, the control unit 51 can restart the authentication process using the normal authentication data without waiting for the recovery work by the administrator. Further, even if the terminal 70 or the portable storage device is stolen, the authentication data stored in the device is encrypted, so that there is no concern about information leakage. Further, even if the communication device 50 is stolen, the decrypted decryption authentication data 521 is held in the temporary storage unit 52, and the authentication data is lost when the power is turned off, so that there is a concern about information leakage. There is no.

10 Communication device 11 Control unit 12 Temporary storage unit 13 USB interface unit 14 Terminal authentication unit 20 USB device 30 Terminal 31 Terminal control unit 32 Temporary storage unit 33 USB interface unit 34 Input / output unit 40 Network 50 Communication device 51 Control unit 52 Temporary storage Unit 70 Terminal 71 Terminal control unit 121 Decryption key 122 Authentication table 123 Authentication operation setting table 321 Encryption key 322 Encryption authentication table 323 Encryption authentication operation setting table 511 Decryption key 521 Decryption authentication data 711 Encryption key 712 Encryption authentication data

Claims (7)

A terminal including a terminal control means, an input means, and a terminal that generates an encryption key and stores the encrypted authentication data obtained by encrypting the authentication data using the encryption key in a connected portable storage device.
When the portable storage device in which the encryption authentication data is stored is connected, a decryption key is generated, the encryption authentication data is decrypted using the decryption key, and the decrypted decryption authentication data is obtained. Is stored in the temporary storage means, and the communication device including the control means for authenticating the terminal by using the decryption authentication data stored in the temporary storage means is provided .
The authentication data and the identification information assigned to the communication device for generating the encryption key are input from the input means.
The terminal generates the encryption key based on the input identification information.
Authentication system. Authentication system according to claim 1 wherein the encryption key and the decryption key generated based on specific the identification information for identifying each assigned to the communication device. The control means uses the authentication data for authentication of the terminal even if the portable storage device is removed when the terminal is authenticated using the decryption authentication data.
If the second portable storage device is connected before the predetermined time elapses, the second encryption authentication data stored in the second portable storage device is decrypted. The decryption key of 2 is generated, the second decryption key is used to decrypt the second encryption authentication data, and thereafter, the decrypted second decryption authentication data is used to decrypt the terminal. Authenticate and
If the second portable storage device is not connected by the elapse of a predetermined time, the terminal is not authenticated.
The authentication system according to claim 1 or 2. When the authentication data of the terminal is encrypted with the encryption key and a portable storage device stored as the encryption authentication data is connected, a decryption key for decrypting the encryption authentication data is generated, and the decryption key is used. Control to decrypt the encrypted authentication data by using, store the decrypted decryption authentication data in the temporary storage means, and authenticate the terminal by using the decryption authentication data stored in the temporary storage means. Including means
The control means uses the authentication data for authentication of the terminal even if the portable storage device is removed when the terminal is authenticated using the decryption authentication data.
If the second portable storage device is connected before the predetermined time elapses, the second encryption authentication data stored in the second portable storage device is decrypted. The decryption key of 2 is generated, the second decryption key is used to decrypt the second encryption authentication data, and thereafter, the decrypted second decryption authentication data is used to decrypt the terminal. Authenticate and
If the second portable storage device is not connected by the elapse of a predetermined time, the terminal is not authenticated.
Communication device. Unique identification information for identifying each is assigned, and the decryption key is generated based on the identification information.
The communication device according to claim 4. In the terminal provided with the input means, the first authentication data and the identification information assigned to the communication device for generating the encryption key are input from the input means.
In the terminal, an encryption key is generated based on the input identification information, and the first encryption authentication data obtained by encrypting the first authentication data using the encryption key is stored in the first portable storage. Store in the device
In the communication device, the first decryption key for decrypting the first encryption authentication data is generated, and the first decryption key is used to store the first decryption key in the first portable storage device. The first encryption authentication data is decrypted, the decrypted first decryption authentication data is stored in the temporary storage means, and the first decryption authentication data stored in the temporary storage means is used. Authenticate the terminal
Authentication data application method. Even if the first portable storage device is removed while the terminal is being authenticated using the first decryption authentication data in the communication device, the first method is used to authenticate the terminal. Using authentication data,
If the second portable storage device is connected before a predetermined time has elapsed, the second encrypted authentication data stored in the second portable storage device in the communication device. A second decryption key for decrypting the data is generated, the second decryption key is used to decrypt the second encryption authentication data, and thereafter, the decrypted second decryption authentication data is used. Use to authenticate the terminal and
If the second portable storage device is not connected by the elapse of a predetermined time, the communication device does not authenticate the terminal.
The authentication data application method according to claim 6.

Images