JPH11340967A - Authentication information generating method, verification method, verification system and recording medium recording program to execute this method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication information generating method where only a secret key of a server side is employed for information to be reserved by the server side so as to economize the system, and to provide a verification method, its system and the recording medium recording a program to execute the method. SOLUTION: A WWW browser 10 sends 1st position information to a server 20, the server acquires 2nd position information and a 1st client address from 1st position information, generates 1st authentication information from the 2nd position information, the 1st client address and the secret key with a unidirectional function, sends 1st client information that is a combination of the 1st authentication information and the 2nd position information to a client. The client sends the 2nd client information to the server, the server acquires a 2nd client address and 3rd position information from 3rd client information, generates 2nd authentication information based on the 3rd position information, the 2nd client address and the secret key with the unidirectional function, collates the 1st and 2nd authentication information to verify the validity and sends correct object information when they are valid.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION The present invention relates to a server of a WWW system represented by the Internet or an intranet, in which when information is acquired, information must be acquired once using information paid out from the server side. Authentication information creation method that is effective when giving the constraint that
For the verification method and the same device, especially when there is information that needs to be acquired before acquiring certain information, effective authentication information is created when there is a restriction on reference such that specific information is not referenced unless reference is made Method,
The present invention relates to a verification method, an apparatus, and a recording medium on which a program for executing the method is recorded.

[0002]

2. Description of the Related Art In the prior art, as to whether or not the information is passed through reference to certain information, for example, at the time of the first information reference, a value which cannot be easily inferred, such as a random number, is assigned to the next position information. Verification is performed by a method such as whether or not a value given at the next information reference can be found by searching from a list of random number values issued so far.

With reference to FIG. 19, the prior art will be described. In FIG. 19, reference numeral 10 denotes a WWW browser of a client, and 11 denotes a URI (URI) used for acquiring first information.
-1) (character string indicating the location of information) and 12 are URIs used for obtaining the second information, and URIs (URI-2) and 13 included in the information obtained by obtaining the first information
Is the result information obtained by acquiring the second information, and 20 is W
A WW server, 22 is a URI synthesizing device that synthesizes a URI from a basic URI character string and authentication information, 23 is a basic URI indicating the information position of the second information acquisition by itself, and 27 is a U
A URI separating device that separates the basic URI and the authentication information by an operation reverse to that of the RI synthesizing device 22, 281 and 282 each is one of information corresponding to the basic URI 23,
The target information (1) and (2), 29 transmitted when the authentication information matches, is a control for returning either the target information (1) 281 or the target information (2) 282 to the WWW browser 10. Device, 61 is a random number generator, 6
2 is a random number management table, and 63 is a search device.

In FIG. 19, when position information (URI-1) 11 is sent from a client 10, corresponding position information (basic URI) 23 and a random number
Is synthesized by the synthesizing device 22 and sent to the client 10 as new position information (URI-2) 12. At the same time, it is also stored in the random number management table 62.

Next, when the client 10 accesses the server 20 using the position information 12 obtained from the server, the client 10 separates the basic position information 23 and the random number from the position information 12. Thereafter, the search device 63 searches the random number management table 62, and the control device 29 determines whether the target information (1) 281 or the target information (2) 282 corresponding to the position information 23 according to whether or not a random number is found. Is returned as the result information 13.

[0006]

In the conventional method described above, it is necessary to store random numbers for the maximum allowable reference interval, and when the reference interval is long or the number of references per unit time is large, Has a problem that storage is difficult.
Further, when it is desired to guarantee this reference relationship among a plurality of servers, it is necessary to share this management table among a plurality of servers, which requires a large-scale mechanism and is uneconomical.

[0007] The present invention has been made in view of the above,
The purpose is to record the authentication information creation method, the verification method, the same device and the program for implementing the same method, which are economical by using only the server-side secret key as the information to be stored on the server side. It is to provide a recording medium.

[0008]

According to a first aspect of the present invention, there is provided a hyperlink system comprising a client and a server, wherein a second position information included in the first position information of the client is provided. The gist is to generate authentication information from the position information and the client address from the second position information, the client address and the secret key by a one-way function, and synthesize the authentication information and the second position information.

According to the first aspect of the present invention, the second position information, the client address and the secret key are obtained from the second position information and the client address contained in the first position information of the client by a one-way function. Since the authentication information is generated from the server and the authentication information and the second location information are combined, the information to be stored on the server side is only the secret key, so that the storage cost is not required and the economy can be achieved.

The present invention described in claim 2 is the same as the claim 1.
In the invention described in the above, the processing for generating the authentication information includes:
The authentication information is generated by a one-way function from a value obtained by subtracting a correction time from a current time, the second location information, the client address and a secret key, and the synthesizing process includes the authentication information, the second location information The gist is to synthesize a value obtained by subtracting the correction time from the current time.

According to the present invention, the authentication information is generated by a one-way function from the value obtained by subtracting the correction time from the current time, the second position information, the client address and the secret key. , And the value obtained by subtracting the correction time from the second position information and the current time.

Further, according to the present invention, in a hyperlink system including a client and a server, a client address included in the client information obtained by combining the first authentication information and the first position information of the client. And generating second authentication information from the first location information, the client address, and the secret key using a one-way function from the second location information and collating the first authentication information and the second authentication information. The gist of this is to verify the legitimacy.

According to the third aspect of the present invention, a one-way function is obtained from the client address and the second location information included in the client information obtained by combining the first authentication information and the first location information of the client. Generates the second authentication information from the first location information, the client address, and the secret key, and stores the second authentication information on the server side in order to verify the validity by collating the first authentication information and the second authentication information. The information to be used is only the secret key, so that no storage cost is required and the economy can be achieved.

According to a fourth aspect of the present invention, in the third aspect, the client information includes a value obtained by subtracting a correction time from a current time, and the processing for generating the second authentication information is performed in one direction. Generating second authentication information from a value obtained by subtracting a correction time from the current time by a function, the first position information, the client address, and a secret key;
The gist of the matching process is to verify the validity by comparing the first authentication information and the second authentication information.

According to the present invention, the client information includes a value obtained by subtracting the correction time from the current time, a value obtained by subtracting the correction time from the current time by a one-way function, first position information, The second authentication information is generated from the client address and the secret key, and the authenticity is verified by comparing the first authentication information and the second authentication information.

According to a fifth aspect of the present invention, in a hyperlink system comprising a client and a server, the client transmits first position information to the server, and the server transmits the first position information to the second position information from the first position information. And the first client information is obtained from the second position information, the first client address, and the secret key by a one-way function, and the first authentication information and the first client information are obtained. An authentication information generating step of generating first client information obtained by combining the second position information and transmitting the first client information to a client;
The client sends the second client information to the server, and the server obtains the second client address and the third position information from the third client information, and obtains the third position information, the second position information by a one-way function. Generating second authentication information from the client address and the secret key of
The gist of the present invention is to provide an information providing step of collating the first authentication information and the second authentication information, verifying the validity, and transmitting correct target information when valid.

According to the present invention, the client transmits the first position information to the server, and the server acquires the second position information and the first client address from the first position information. From the second location information, the first client address and the secret key using a one-way function,
, And transmits first client information obtained by combining the first authentication information and the second position information to the client, the client transmits the second client information to the server, and the server transmits the third client information to the server. The second client address and the third location information are obtained from the client information, the second authentication information is generated from the third location information, the second client address and the secret key by a one-way function, and the first authentication is performed. Since the information and the second authentication information are collated, the validity is verified, and the correct target information is transmitted when valid, the information to be stored on the server side is only the secret key, and no storage cost is required. Can be achieved.

Further, the present invention described in claim 6 provides the invention according to claim 5.
In the invention described above, the first client information includes a value obtained by subtracting a correction time from a first current time, the second client information includes a value obtained by subtracting a correction time from a second current time, The processing for generating the first authentication information is performed based on a value obtained by subtracting a correction time from a first current time by a one-way function, the second position information, the first client address, and a secret key. Produces
The processing for generating the second authentication information is performed by subtracting a correction time from the second current time using a one-way function, the third position information, the second client address, and a secret key. The gist is to generate authentication information of

According to the present invention, the first client information includes a value obtained by subtracting the correction time from the first current time, and the second client information includes a value obtained by subtracting the correction time from the second current time. Generating the first authentication information from the value obtained by subtracting the correction time from the first current time by the one-way function, the second position information, the first client address, and the secret key. The function generates second authentication information from a value obtained by subtracting the correction time from the second current time, third position information, a second client address, and a secret key.

According to a seventh aspect of the present invention, in a hyperlink system including a client and a server, position information acquiring means for acquiring second position information from first position information of the client; Client address acquisition means for acquiring a client address from the first location information; authentication information generation means for generating authentication information from the second location information, the client address and a secret key by a one-way function; The present invention has a synthesizing unit for synthesizing the second position information.

According to the present invention, the second position information is obtained from the first position information of the client,
Obtaining a client address from the first position information of the client, generating authentication information from the second position information, the client address and the secret key by a one-way function, and synthesizing the authentication information and the second position information; The information to be stored on the server side is only the secret key, so that the storage cost is not required and the economy can be achieved.

The present invention described in claim 8 provides the present invention according to claim 7.
In the invention described in the above, the authentication information generating means has means for generating the authentication information from a value obtained by subtracting a correction time from a current time by a one-way function, the second position information, the client address, and a secret key. Is the gist.

According to the present invention, authentication information is generated from a value obtained by subtracting a correction time from a current time by a one-way function, second position information, a client address, and a secret key.

According to a ninth aspect of the present invention, there is provided a hyperlink system comprising a client and a server, wherein the first client information obtained by combining the first authentication information and the first position information of the client is used as the first client information. Client address obtaining means for obtaining a first client address, and the first client information from the first client information.
Position information obtaining means for obtaining position information of the first, second, and third authentication information from the first position information, the first client address, and the secret key using a one-way function; And verification means for verifying the second authentication information and the second authentication information.

According to the ninth aspect of the present invention, the first client address is obtained from the first client information obtained by combining the first authentication information and the first location information of the client, and the first client address is obtained. First position information is obtained from the client information, second authentication information is generated from the first position information, the first client address and the secret key by a one-way function, and the first authentication information and the second authentication are obtained. Since the information is collated, the only information to be stored on the server side is the secret key, so that no storage cost is incurred and economy can be achieved.

According to a tenth aspect of the present invention, in the ninth aspect of the present invention, the position information obtaining means subtracts the correction time from the current time of the client, the third authentication information, and the first position information. A means for acquiring a second client address and a second position information from the second client information combined, wherein the authentication information generating means subtracts a correction time from the current time by a one-way function. Means for generating fourth authentication information from the second position information, the second client address and the secret key, wherein the collation means outputs the third authentication information and the fourth authentication information The gist of the present invention is to have means for checking.

According to the tenth aspect of the present invention, the value obtained by subtracting the correction time from the current time of the client, the third authentication information, and the second client information obtained by combining the first position information with the second client information are used. And the second location information is obtained, and the fourth authentication information is generated from the value obtained by subtracting the correction time from the current time by the one-way function, the second location information, the second client address and the secret key. ,
The third authentication information and the fourth authentication information are collated.

Further, according to the present invention, in a hyperlink system comprising a client and a server, second position information and a client address are obtained from the first position information of the client, and are obtained by a one-way function. The gist is that authentication information is generated from the second position information, the client address and the secret key, and an authentication information creation program for synthesizing the authentication information and the second position information is recorded on a recording medium.

According to the eleventh aspect of the present invention, the second position information and the client address are obtained from the first position information of the client, and the second position information, the client address and the secret key are obtained by a one-way function. Since the authentication information is generated from the authentication information and the authentication information creation program for synthesizing the authentication information and the second position information is recorded on the recording medium, the distribution of the authentication information can be improved by using the recording medium.

[0030] According to a twelfth aspect of the present invention, in the invention of the eleventh aspect, the processing for generating the authentication information includes a value obtained by subtracting a correction time from a current time, the second position information, the client address and The authentication information is generated from a secret key by a one-way function, and the synthesizing process includes, on a recording medium, an authentication information creation program for synthesizing the authentication information, the second position information, and a value obtained by subtracting a correction time from a current time. It shall be recorded.

According to the twelfth aspect of the present invention, the authentication information is generated by a one-way function from a value obtained by subtracting the correction time from the current time, the second position information, the client address and the secret key. Since the authentication information creating program for synthesizing the second position information and the value obtained by subtracting the correction time from the current time is recorded on the recording medium, the distribution of the authentication information creating program can be improved by using the recording medium.

According to a thirteenth aspect of the present invention, there is provided a hyperlink system comprising a client and a server, wherein the client address and the first address are obtained from the client information obtained by combining the first authentication information and the first location information of the client. 2, obtaining second authentication information from the first position information, the client address, and the secret key by a one-way function, and comparing the first authentication information and the second authentication information. Accordingly, the gist of the present invention is to record a verification program for verifying correctness on a recording medium.

According to the thirteenth aspect of the present invention, the client address and the second position information are obtained from the client information obtained by combining the first authentication information and the first position information of the client, and the one-way function is obtained. Generates a second authentication information from the first position information, the client address, and the secret key, and records a verification program for verifying the validity by comparing the first authentication information and the second authentication information on the recording medium. Therefore, the distribution of the recording medium can be improved by using the recording medium.

Further, according to a fourteenth aspect of the present invention, in the invention of the thirteenth aspect, the client information includes a value obtained by subtracting a correction time from a current time, and the processing for generating the second authentication information includes: A second authentication information is generated from a value obtained by subtracting a correction time from the current time by a one-way function, the first position information, the client address and a secret key, and the collation processing includes the first authentication information and the second authentication information. The gist is to record a verification program for verifying the validity by collating the second authentication information on a recording medium.

According to the present invention, the client information includes a value obtained by subtracting the correction time from the current time, and the processing for generating the second authentication information is performed by using a one-way function from the current time to the correction time. Is generated, the second authentication information is generated from the first location information, the client address, and the secret key, and the collation processing corrects the first authentication information and the second authentication information by collating the first authentication information and the second authentication information. Is recorded on a recording medium, the distribution of the program can be improved by using the recording medium.

[0036]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing the configuration of the first embodiment of the present invention, and FIG. 2 is a diagram showing the configuration of the authentication information generation device 50 used in FIG. 1 and 2, reference numeral 10 denotes the WWW of the client.
The browser 11 has a URI (UR) used for acquiring the first information.
I-1) (character string indicating the location of information) and 12 are URIs used for acquiring the second information, and URIs (URI-2), 1 included in the information acquired by the first information acquisition
3 is the result information obtained by acquiring the second information, 20 is the WWW server, 21 is the WWW viewed from the WWW server 20
An address acquiring device 22 for acquiring the address of the client, which is the browser 10, is a URI synthesizing device that synthesizes a URI from a basic URI character string and authentication information, ie, W
A URI synthesizing device that synthesizes basic position information and authentication information that the WW server 20 gives to the client WWW browser 10 to generate new position information. The URI synthesizing device 23 is a basic URI that indicates an information position of the second information acquisition by itself. Reference numeral 26 denotes a collation device for collating whether or not two pieces of authentication information match, and when one is a set, collation for determining whether or not the other authentication information matches any one of the sets. Device, 2
Reference numeral 7 denotes a URI separating device that separates a basic URI, which is basic position information, and authentication information from the synthesized position information by an operation reverse to that of the URI synthesizing device 22, and 281 and 282 each represent one of information corresponding to the basic URI 23. And the target information sent when the authentication information matches (1)
And (2) and 29 receive the collation result of the collation device 26 and receive the target information (1) 281 or the target information (2) 282
Which returns any of the information to the WWW browser 10, that is, 2 corresponding to the basic position information and the collation result.
A control device for selecting one of the two pieces of information, 41 is the address of the WWW browser 10 obtained by the address obtaining device 21, that is, a partner address, and 44 is an authentication information character string obtained as a result of calculation, that is, authentication information. , 50 are authentication information generation devices that calculate authentication information 44 from the input of the destination address 41 and the basic URI 23, and 51 is a secret key that is a fixed value closed in the WWW server 20, that is, stored in the WWW server 20, The secret key 54 that cannot be obtained is a one-way function for which it is easy to calculate the output value from the input value, but it is extremely difficult to obtain the input value from the output value.

Next, the operation of the first embodiment configured as described above will be described. First, in the first access, the WWW browser 10 accesses the location information (URI-1) 11 of the information that must be referred to first on the server 20.
Is sent to the server 20. The server 20 stores location information (U
At the same time as selecting the basic URI 23 according to the RI-1) 11, the basic URI 23 is sent to the authentication information generating device 50 together with the client address information obtained from the address obtaining device 21,
Generate authentication information. In the authentication information generation device 50, FIG.
As shown in the figure, the secret key 51 held inside, the client address 41 and the position information to be sent (basic UR
I) 23 to a one-way function 54 to obtain authentication information 44. Returning again to FIG. 1, new position information (URI-2) 12 is generated by synthesizing the obtained authentication information 44 and position information (basic URI) 23 with the URI synthesizing device 22,
Send to WWW browser 10.

The WWW browser 10 sends the given position information (URI-2) 12 to the server 20 again to obtain necessary information. The server 20 sends the client address information obtained by the address obtaining device 21 and the basic URI 23 obtained by the location information (URI) decomposing device 27 to the authentication information generating device 50, as before,
Get new credentials. The matching device 26 compares the obtained new authentication information with the authentication information previously attached on the server side obtained by the position information (URI) decomposing device 27. Basic location information (URI) 2 according to the result of collation
Either the target information (1) 281 or the target information (2) 282 corresponding to 3 is returned to the WWW browser 10 by the control device 29 and becomes the result information 13.

That is, in the first embodiment described above,
WW based on the location information sent by WWW browser 10
The result obtained by giving the one-way function 54 the basic position information corresponding to the W server 20, the client address information obtained from the address acquisition device 21, and the secret key 51 at the same time, that is, the authentication information and the basic position information Is synthesized by the URI synthesizing device 22 and the result is sent to the WWW browser 10. The WWW browser 10 accesses the server 20 again with the position information sent from the WWW server 20, and
0 indicates the location information given from the WWW browser 10 as a UR
The result obtained by simultaneously giving the one-way function 54 the basic position information obtained by decomposing by the I decomposing device 27, the client address information obtained by the address obtaining device 21, and the secret key, that is, new authentication information and URI decomposition The old authentication information obtained by the device 27 is compared with the matching device 26, and one of the two pieces of target information corresponding to the basic position information is sent to the client, depending on whether the two match or not match. I do.

Next, a specific example of the first embodiment shown in FIGS. 1 and 2 will be described with reference to FIGS. FIG. 3 is a diagram showing a configuration of a specific example corresponding to the embodiment shown in FIGS. 3, reference numeral 100 denotes a client WWW browser having a frame display function, which corresponds to the client WWW browser 10 of FIG.
1. A WWW server corresponding to the WWW server 20 and operated by the script interpreting mechanism, 201 is an address acquisition device corresponding to the address acquisition device 21 of FIG. 1, and 202 is FIG.
, Which specifically interprets the character string after “?” Attached after the URI and substitutes it for a variable. Reference numeral 203 denotes a WWW server 200.
2 is a syntax interpreting and executing device that interprets and executes the syntax of the script possessed by.
A one-way function having a function of generating authentication information of a fixed length from two long character strings, 300 is a variable management device that manages variables of the WWW server 200, and 301 is stored in a variable separated by the address acquisition device 201. The IP address 302, which is the address information to be stored, corresponds to the secret key 51 in FIG. 2 and is held as a constant, and the secret key whose value does not change, 303 stores a value corresponding to the basic URI 23 in FIGS. URI0 variable, 304 is a MAC variable that stores the authentication information finally generated, 305 is a mac variable that stores the authentication information extracted from the argument separated by the argument separation device 202, and 306 is the authentication result of the execution of the script interpretation. An authOK variable 401 indicating whether or not the processing has been performed normally, is first requested to be obtained from the WWW browser 100, and the frame is determined. A script for outputting HTML defined as a frame definition script created so as to add authentication information to one of two frames, and 402 is fetched as one of the frames presented in the frame definition script 401. Frame contents (1), 403, which are static HTML files, are contents taken in as one of the frames defined by the frame definition script 401, and receive and inspect authentication information as an argument of the URI. And a frame content (2) script for changing the display content according to the result.

Next, referring to FIG. 4 to FIG.
The operation of the specific example of the embodiment will be described. The first URI requested by the WWW browser 100 is “/main.html”
Reference numeral 401 denotes an HTML frame defined therein. The WWW browser 100 receives the description and performs an operation of displaying the contents of the frame. “/Ad.html” 402 and “/val.html” 403 are defined as contents displayed in the frame. Since the first embodiment is a part from the frame definition content 401 to the acquisition of the frame content content 403, the operation of this part will be described with reference to the drawings.

First, the WWW browser 100 requests the WWW server 200 to acquire the frame definition content 401 based on the operation of the user or the like. The WWW server 200 is a special server. Among the requested contents, the one whose line starts with “.” (Period) is regarded as a command and executed, and at the same time, the syntax interpretation for returning the content to the WWW browser 100 is executed. It has a device 203. Further, each time there is a request from the WWW browser 100, the address acquisition device 201 acquires the address of the WWW browser 100 and stores it in the IP address storage area 301 of the variable management device 300. Also, the variable management device 300
Is preliminarily embedded with a secret key value 302 unique to the WWW server 200 (FIG. 4).

According to a request from the WWW browser 100, the frame definition content 401 is stored in the WWW server 20.
In the first command, “/val.html” is stored as a value in the variable “URI0” 303 of the variable management device 300 (FIG. 5).

The instruction on the next line specifies the IP address 301 of the WWW browser 100 and the secret key 3 of the WWW server 200.
02 and the value 303 of URI0 are combined into a character string and given to the hash function 204. The obtained hash value is "MAC
Variable 304 (FIG. 6).

For the syntax interpretation execution device 203, the rest is sent to the WWW browser 100 almost as it is while developing the variables as normal contents. The variable expansion replaces the part of {variable name} with the value of the variable. As a result, H defining the frame
A TML sentence is generated, and the URI of one frame is “/ a
d.html '', and the other is expanded with the variable `` /val.htmI?ma
c = 5f2f3b52 ”(FIG. 7).

The WWW browser 100 to which the HTML describing the frame definition has been sent automatically accesses the WWW server 200 again in order to acquire the contents of the frame. First, since the content corresponding to “/ad.html” does not have a command statement or an instruction of variable expansion, it is WWW as it is.
It is sent to the browser 100 (FIG. 8).

On the other hand, when "/val.html?mac=5f2f3b52" is sent from the WWW browser 100 to the WWW server 200, the address acquisition device 201 acquires and stores the address as in FIG. Then, “? Mac = 5f2f3b52” given as an argument to the URI is separated from the URI by the argument separating device 202 and the variable management device 30
0 is stored as “mac variable” 305. And
The syntax interpretation execution device 203 receives the URI “/val.html” and starts executing the corresponding content 403 (FIG. 9).

Thereafter, by the same processing as in FIGS. 5 and 6,
The authentication code is calculated and stored in the “MAC variable” 304.

Next, the authentication code 305 passed through the WWW browser 100 and the authentication code 304 generated this time
If they match, "Access OK" is displayed, and if they do not match, "Access denied" is displayed.
Return to 0 (FIG. 10).

Secret key 3 stored in WWW server 200
Since the third party who does not set the value of “02” cannot calculate the correct authentication code value, the configuration of the content 403 (of which “AccessOK” portion) cannot be obtained unless the content passes through the content in its own server is used. It becomes possible.

Next, a second embodiment of the present invention will be described with reference to FIGS. The second embodiment differs from the first embodiment in that time information is taken into account. 11 and 12, the same components as those in FIGS. 1 and 2 are denoted by the same reference numerals, and description thereof will be omitted. Only different components will be described. 24 is a correction time (0) device that outputs only zero as a correction time value, 2
Reference numeral 5 denotes a correction time set device that outputs a correction value set consisting of integer values from zero to a fixed value as a correction time value. Reference numeral 43 denotes a mere value of the correction time (0) 24 or a set of correction values based on the correction time set 25. A certain time correction information 52 is a subtraction device for subtracting the offset information with respect to the time, that is, a subtraction device for subtracting the time correction information 43 from the time information 53. When the time correction information is a set, the result is also a set. Reference numeral 53 denotes a time information device for taking out the current time as an integer value for each fixed unit, and is time information such as an integer value which increases by 1 every 10 seconds. In the second embodiment, when the time correction information 43 is a set, the authentication information 44 is a set of the number of elements corresponding to the obtained authentication information. The authentication information generation device 50 has a partner address 41, a basic URI2
3. The authentication information 44 is calculated from the input of the time correction information 43. When the time information among the input values is a set value, the one-way function 54 also sets the obtained result as a set value of the corresponding number of elements.

Next, the operation of the second embodiment configured as described above will be described. Location information (URI-1)
In the first access based on 11, a new correction time 24 is added to the authentication information generation device 50. In this case, the correction time is zero. Authentication information generation device 50 shown in FIG.
Then, the given partner address 41 and location information (basic U
RI) 23, the value obtained by subtracting the time correction information 43 from the current time information 53 by the subtraction device 52, and the secret key 51 of the server.
Is given to the one-way function 54 to obtain the authentication information 44. After that, as in the first embodiment, the position information 23 and the authentication information 4
4 is sent to the WWW browser 10 and sent to the server 20 again, the URI is decomposed into the position information 23 and the authentication information 44 by the URI decomposing device 27, and the position information 23 and the address The address information obtained by the acquisition device 21 and the correction time set 25 are additionally provided to the authentication information generation device 50.

The authentication information generation device 50 generates the authentication information 44 in the same manner as the authentication information generation in the first access, but the authentication information 44 corresponds to the number of the given plurality of correction time sets 25. Generate And the collation device 2
6 is sent to the URI decomposing device 2
7 is compared with the authentication information separated by 7, and if there is one match, it is regarded as a match. Thereafter, similarly to the first embodiment, the control device 29 causes the target information (1) 281 or the target information (2) 28 corresponding to the position information 23 to be displayed.
2 is sent to the client as result information 13.

That is, in the above-described embodiment, the WW
In the calculation of the first authentication information in the W server 20, the WW
Based on the location information sent by the W browser 10, the server simultaneously stores the corresponding basic location information, the client address information obtained from the address acquisition device 21, and the time information 53 obtained from the clock device in addition to the secret key. The result obtained by giving to the direction function 54, that is, the authentication information and the basic position information are synthesized by the URI synthesizing device 22, and in the second authentication information calculation in the server, the server sends the result based on the position information sent by the client. In addition to the corresponding basic position information, the client address information obtained from the address obtaining device 21, and the secret key, a plurality of corrected times obtained from the corrected time collecting device 25 are subtracted from the time information 53 obtained from the clock device. A plurality of time information obtained by simultaneously giving each of the plurality of pieces of time information obtained by the subtraction by the device 52 to the one-way function 54. The result, that is, the new authentication information is compared with the old authentication information obtained by the URI decomposing device 27 by the matching device 26, and whether one of the new authentication information matches the old authentication device or not is determined. In response, one of the two pieces of target information corresponding to the basic position information is sent to the client.

Next, a specific example of the second embodiment shown in FIGS. 11 and 12 will be described with reference to FIGS.
FIG. 13 is a diagram showing the configuration of a specific example corresponding to the embodiment shown in FIGS. 13, the same components as those in FIG. 3 are denoted by the same reference numerals, and the description thereof will be omitted. Only different components will be described. Reference numeral 307 denotes a variable in which the current time is stored, that is, a current time variable. The stored variable is a time at which the syntax interpretation execution device 203 starts operating. Here, the current time variable in units of one minute, 308 is the current time variable 3
A time calculation variable for temporarily storing the time calculated from 07, and an offset variable 309 for temporarily storing the difference between the current time and the target time.

Next, the operation of the specific example of the second embodiment will be described with reference to FIGS. WWW
In response to a request from the browser 100, the WWW server 20
0, the address acquisition device 201 acquires the browser address and stores it in the IP address storage portion 301 of the variable management device 300 (equivalent to FIG. 4). In the next step, the value “/val.html” is substituted for the variable URI0 (similar to FIG. 5).

In the case of the present embodiment, the current time 307 is assigned to the time variable 308 as the next processing (FIG. 14). When calculating the authentication code, the IP address 301, the secret key 302, the value of the time variable 308, which is the current time, and the value 303 of the URI 0 variable are combined to form the one-way function 204.
Is stored in the MAC variable 304 (FIG. 1).
5).

In the subsequent operation, similarly to the first embodiment, finally, the acquisition of “/val.html” 403 is requested according to the HTML generated from the frame definition information 401.

The execution of the first command sentence of “/val.html” 403 is the same as in FIG. 9 of the first embodiment. However, it is assumed that the current time 307 holds the time when there is a request from the WWW browser 100.

In the next line, the authentication success flag “authOK”
The value of 306 is cleared to zero (FIG. 16).

Next, the process is repeated with the value of the “offset variable” 309 being 0 to 3 under the control by the “for statement”. First, the case where the offset value is 0 is executed, and zero is substituted into the “offset variable” 309. As a result, the value of the “time variable” 308 becomes “1” which is the same as the current time 307.
5:24 ". And as before, "time variable"
The authentication code including the value of 308 is calculated by the one-way function 204. However, when passed at the same time as the URI,
Does not match the value 305 stored in the variable (see FIG. 1).
7).

In the next stage, “offset variable” 309 is set to 1
Is substituted and the same calculation is performed, and “15:23” is set in the “time variable” 308. The authentication code generated as a result is assigned to the “MAC variable” 304 and compared with the “mac variable” 305. Since the values match, “authO”
“1” is set to the “K variable” 306 (FIG. 18).

Similarly, the same operation is performed when the “offset variable” 309 is 2 or 3. Eventually, "authOK
The value of the “variable” 306 remains 1, and the result of “Access OK” is returned to the WWW browser 100 based on the determination by the next If statement.

In this case as well, as in the first embodiment, the content “AccessOK” of the final content 403 which should be displayed is obtained unless the access to the first “/main.html” 401 is performed. Can not. Further, in the case of the second embodiment, access to “/val.html” is performed within a fixed time (3 minutes in this embodiment) after access to “/main.html” 401 is performed. If not, there will be a restriction that access will not be possible forever.

As described above, according to the present invention, the server provides information to a valid client without storing authentication information other than the secret key in the server. Generate authentication information, send the new location information and the authentication information to the client, the client holds the location information created by the server, and when the information is needed, the client sends the authentication information to the server, and The authentication information is generated and verified by collating the authentication information, and the server provides the information to a legitimate client.

That is, in the present invention, authentication information is generated by a one-way function from a client address visible from the server, a secret key placed on the server side, and reference location information (URI), and is synthesized with the location information. In the case of verification at the time of access from the client, authentication information is generated in the same way and it is determined whether the reference is valid by comparing it with the attached authentication information . Therefore, the information to be stored on the server side is only the secret key on the server side, so that the storage cost is not required. Further, even if the reference relationship has no expiration date, the time information is not included, so that only the secret key may be stored.

When the reference relationship has an expiration date, time information is included in a part of the authentication information. Then, when performing verification, a reference relationship that is valid only for a certain period of time is compared with authentication information including a value obtained by subtracting a plurality of offset values prepared in consideration of a validity period from current time information. Can also be defined.

[0068]

As described above, according to the present invention,
Unauthorized use of the service by an unauthorized link to valuable information can be prevented. For example, if an attempt is made to provide free information by displaying advertisements and valuable information such as corporate information at the same time using a frame screen, financial damage may occur if only the valuable information is linked without permission. Can be prevented beforehand. In this case, for example, as described above, a predetermined effect can be obtained by attaching the authentication code on the frame definition screen and verifying the authentication code when displaying valuable information in the frame. Also,
For example, even if a third party describes HTML that directly loads the content in the frame, the same IP
Except in the case where a person having an address accesses the information, no other person can access it, so that it is possible to effectively prevent the frame from being captured.

Further, according to the present invention, the order of the presentation information can be observed. That is, information that must be presented prior to presenting information on a certain page, for example, when it is desired to obtain an agreement on the conditions of use before downloading software, the method of the present invention may be used to obtain certain information. Unless after presentation, it is guaranteed that the next information will not be presented. Moreover, since the second information presentation is required within a certain period after the first information presentation, the present invention can be applied to information that needs to be presented as needed.

Further, according to the present invention, session information can be held. That is, in the case of content that is established in a conversation between the user and the server, it is not desirable to jump into a screen during the conversation due to security. In order to maintain such session information consisting of a chain of a plurality of screens, by ordering the second information presentation receiving the first information presentation result of the present invention, it is possible to prevent jumping into a screen in the middle. .

Furthermore, according to the present invention, the storage area on the WWW server can be reduced. In other words, the use of the authentication code eliminates the need for storing keyword information on the server, which is required in the conventional method, thereby eliminating the need for storage area reduction and storage area management. Authentication can now be performed.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a configuration of a first exemplary embodiment of the present invention.

FIG. 2 is a diagram showing a configuration of an authentication information generation device used in the embodiment shown in FIG.

FIG. 3 is a diagram showing a configuration of a specific example corresponding to the embodiment shown in FIGS. 1 and 2;

FIG. 4 is a diagram showing an operation of the specific example shown in FIG. 3;

FIG. 5 is a diagram showing the operation of the specific example shown in FIG. 3;

6 is a diagram showing the operation of the specific example shown in FIG.

FIG. 7 is a diagram showing the operation of the specific example shown in FIG. 3;

FIG. 8 is a diagram showing the operation of the specific example shown in FIG. 3;

FIG. 9 is a diagram showing the operation of the specific example shown in FIG. 3;

FIG. 10 is a diagram showing the operation of the specific example shown in FIG. 3;

FIG. 11 is a block diagram illustrating a configuration of a second exemplary embodiment of the present invention.

FIG. 12 is a diagram showing a configuration of an authentication information generation device used in the embodiment shown in FIG.

FIG. 13 is a diagram showing a configuration of a specific example corresponding to the embodiment shown in FIGS. 11 and 12;

FIG. 14 is a diagram showing the operation of the specific example shown in FIG.

FIG. 15 is a diagram showing the operation of the specific example shown in FIG.

FIG. 16 is a diagram showing the operation of the specific example shown in FIG.

FIG. 17 is a diagram showing the operation of the specific example shown in FIG.

FIG. 18 is a diagram showing the operation of the specific example shown in FIG.

FIG. 19 is a diagram showing a configuration of a conventional technique.

[Explanation of symbols]

 Reference Signs List 10 WWW browser (client) 11, 12 URI 20 WWW server 21 Address acquisition device 22 URI synthesis device 23 Basic URI 24 Correction time 25 Correction time set 26 Verification device 27 URI decomposition device 29 Control device 44 Authentication information 50 Authentication information generation device 51 Secret key 52 subtraction device 53 time information 54 one-way function

Claims (14)

[Claims] In a hyperlink system comprising a client and a server, second position information is obtained from first position information of a client, and authentication information is obtained from the second position information and a secret key by a one-way function. Produces
A method for creating authentication information, comprising combining the authentication information and the second position information. 2. The processing for generating the authentication information includes generating the authentication information by a one-way function from a value obtained by subtracting a correction time from a current time, the second position information, and the secret information. The authentication information creating method according to claim 1, wherein a value obtained by subtracting a correction time from the authentication information, the second position information, and a current time is combined. 3. In a hyperlink system including a client and a server, second position information is obtained from the client information obtained by combining the first authentication information and the first position information of the client, and the one-way function is used. A verification method comprising: generating second authentication information from the first position information and secret information; and verifying the validity by comparing the first authentication information and the second authentication information. 4. The client information includes a value obtained by subtracting a correction time from a current time, and the processing of generating the second authentication information includes: a value obtained by subtracting the correction time from the current time by a one-way function; Generating second authentication information from the location information and the secret information of the first,
4. The verification method according to claim 3, wherein the authentication information is verified by comparing the authentication information of the second authentication information with the second authentication information. 5. A hyperlink system comprising a client and a server, wherein the client sends first location information to the server, and the server sends the first location information to the second location information and the first client address from the first location information. And generates first authentication information from the second location information, the first client address and the secret key by a one-way function, and obtains the first authentication information and the second authentication information.
Generating the first client information by combining the position information of the first and the second client information to the client; transmitting the second client information to the server by the client; Obtaining a second client address and third location information from the client information; generating a second authentication information from the third location information, the second client address and a secret key by a one-way function; A verification method, comprising: collating the first authentication information and the second authentication information, verifying the validity, and transmitting correct target information when valid. 6. The first client information includes a value obtained by subtracting a correction time from a first current time, and the second client information includes a value obtained by subtracting a correction time from a second current time. The processing for generating the first authentication information is performed based on a value obtained by subtracting a correction time from a first current time by a one-way function, the second position information, the first client address, and a secret key. And a process of generating the second authentication information includes a value obtained by subtracting a correction time from the second current time by a one-way function, the third position information, the second client address, and a secret key. 6. The verification method according to claim 5, wherein the second authentication information is generated from the second authentication information. 7. In a hyperlink system including a client and a server, a position information acquisition unit for acquiring second position information from first position information of the client, and the second position information and An authentication information generating apparatus, comprising: authentication information generating means for generating authentication information from secret information; and synthesizing means for synthesizing the authentication information and the second position information. 8. The authentication information generating means includes means for generating the authentication information from a value obtained by subtracting a correction time from a current time by a one-way function, the second position information and secret information. The authentication information creation device according to claim 7. 9. A client address for obtaining a first client address from first client information obtained by combining first authentication information and first location information of a client in a hyperlink system including a client and a server. Acquiring means, position information acquiring means for acquiring the first position information from the first client information, and second position information from the first position information, the first client address and the secret key by a one-way function. A verification apparatus comprising: authentication information generation means for generating authentication information; and verification means for verifying the first authentication information and the second authentication information. 10. The second client address based on a value obtained by subtracting the correction time from the current time of the client, the third authentication information, and the second client information obtained by combining the first position information. And a means for acquiring second position information, wherein the authentication information generating means has a value obtained by subtracting a correction time from the current time by a one-way function, the second position information, the second client address and 10. The apparatus according to claim 9, further comprising: means for generating fourth authentication information from a secret key; and wherein said collating means comprises means for collating said third authentication information and said fourth authentication information. Verification device. 11. A hyperlink system comprising a client and a server, wherein the first
The second position information and the client address are obtained from the position information of the second position information and the second position information is obtained by a one-way function.
A recording medium recording a program for executing an authentication information creating method, wherein authentication information is generated from the client address and the secret key, and the authentication information and the second position information are combined. 12. The processing for generating the authentication information includes a value obtained by subtracting a correction time from a current time, the second position information,
The authentication information is generated by a one-way function from the client address and the secret information, and the synthesizing process synthesizes the authentication information, the second position information, and a value obtained by subtracting a correction time from a current time. Claim 1
A recording medium on which a program for executing the authentication information creating method according to 1 is recorded. 13. A hyperlink system comprising a client and a server, wherein the first
Client information and second position information are obtained from the client information obtained by combining the authentication information and the first position information, and a second authentication is performed from the first position information, the client address and the secret information by a one-way function. A recording medium on which a program for executing a verification method characterized by generating information and verifying correctness by comparing the first authentication information and the second authentication information is provided. 14. The client information includes a value obtained by subtracting a correction time from a current time, and the processing for generating the second authentication information includes a value obtained by subtracting the correction time from the current time by a one-way function; Generating second authentication information from the first location information, the client address and the secret information, and verifying the validity by comparing the first authentication information and the second authentication information with each other. 14. A recording medium on which a program for executing the verification method according to claim 13 is recorded.