WO2000068806A1 - Authenticating/managing apparatus - Google Patents

Abstract

When signals of data and applications are sent/received through communications between a server and a client, as long as the computer of the communication party has clocking means for clocking constantly at regular clocking intervals the same as that on the accessed side and a common clock device, an inherent time generating device for clocking constantly at the same clocking intervals by the clocking means during the period from a start point date (QB0) to an end point date (QE0) preset by the computer of the communication source is provided, and hence, for example, a temporal space of the inherent time generating device provided on the accessed side is defined between the accessing and accessed sides. As the temporal transition in the common temporal space conducted by one another, the sending and receiving times and the time passages between the sending times and the receiving times of the signals send and received in the past are included in the sent/received signals, thereby indicating the existence in the temporal space shown in the figure of the computer of the communication party.

Description

 Akira Itoda Authentication and management equipment

 Technical field

 The present invention is applicable to Internet, intranet, LAN, etc.

—On authentication / management devices that mutually authenticate and manage various data transmitted and received between computers in a network. Background art

 Conventionally, regarding the security in a computer network environment, generally, an encryption method that requires the establishment of a CA (Certification AUTHORITY) by a third party and a password method that involves the memory operation of the user have been adopted. Known, these are intended to identify the communication partner and to protect the privacy of data creators. In such a network environment, users enter a large number of passwords each time they access equipment, access applications, access files, access data, or access domains. An operation to receive the authentication was required, and the storage of the passcode was managed under the memory of the user, and was periodically updated as necessary.

 For example, an application provided via a network is installed on a computer, and the user of the application used is a valid license holder in addition to the product ID of the application. The fact that a user ID for authenticating with the application provider is required when the application is started for the first time and the ID registration procedure by the user of the application itself is indispensable. is there.

Also, in addition to the above-mentioned tasks such as ID registration from the application provider, the user of the application may provide a password for the application user himself / herself to the application user or the application user. Depending on the intention of the administrator of the organization to which the user of the application belongs (for example, the company, organization, or other owner who purchased the application), a 4- to 8-digit password may be set from time to time, and the actual user Each time you started the service, you had to enter that password.

 Such passwords must not be written down on paper or the like, be composed of numbers and symbols that are memorized by human intention and are hard to guess by others, and after a certain period of time, Strict rules such as updating to new ones are imposed, and these obligations, which are not practically executable even by the above managers, are of course legal as well as the application user's obligations. Or it is imposed voluntarily.

 In fact, the authentication of the product ID, the user ID, and the password must be performed by the user of the application in each application installed on the computer.

 However, in the current computer environment, it is common for about 5 to 10 applications to be installed on average, and in the future, application transactions will be relatively easily transacted via communication means. If this happens, the user of the application will have to manage and update the ID and password for all distributed applications and data, which is extremely complicated. However, when delivering such application data overnight, even through the above CA station, expect the security of the network security to be fair and fair as a third party CA station. In that case, its reliability is always questionable. In addition, if the CA as a third-party organization is a private company, there will always be questions about the permanence of its existence, and if the CA is interrupted, its reliability in the network will increase. Things can collapse.

The present invention has been made in view of the above-described circumstances, and has been developed in consideration of security in a network environment. P 0/02449

-3-In order to achieve protection and privacy protection within a certain allowable range, application and data user responsibilities and responsibilities can be significantly reduced, and in addition, administrator responsibilities and responsibilities can be significantly reduced. Is what you do.

 That is, the present invention relates to a “property time generation device and an authentication device using the device” and W 098/4 4 3 2 1 related to W〇97 / 2074 proposed by the applicant earlier. The “authentication data issuing system based on the unique time and the storage medium for the authentication data issued by the issuing system, and the authentication data authentication system” in “0. It has been applied to the environment and has been developed.It does not require that a third-party CA station be installed on the network, and does not repeatedly use a password for storage operation. The purpose is to implement mutual authentication of various types of data via a node, and to realize security protection and privacy protection. Disclosure of the invention

 The present invention requires that the registration and management of the above-mentioned ID, which is an indispensable element of security protection and privacy protection, and the setting and management of a pass password be performed mainly by humans in computer network communication. Instead, it is realized by a unique and inorganic processing procedure performed by a computer as a machine.

Specifically, according to the present invention, between each computer connected by a communication line, at the access side performing the communication access and the accessed side receiving the communication access, at least the computer of the accessed side starts at a certain date and time. From the beginning to the end of the hourly interval from a certain date and time to the end, a device for generating a unique time that is constantly clocked by the clock means at the same clock interval is set, and the computer on the access side is set. In addition, a time-measuring device for clocking the elapsed time constantly at the same time interval as the eigen-time generating device set in the computer on the access side by the clock means is set, and at least the In the computer on the side, the time period from the beginning to the end is changed by the eigen- A time-space that progresses at the same time interval as the clocking device set on the other computer, repeats mutual communication between the accessing computer and the accessing computer multiple times, and the accessing computer in the accessing computer When the signal of the receiving computer and the signal of transmitting the signal to the accessing computer at the accessed computer are clocked by the unique time generation device, the access computer receives the signal from the accessing computer. The timing of the transmission of the transmitted signal and the reception of the signal received from the accessed computer by the accessing computer are clocked by a timing device. Is exchanged between the accessing computer and the accessed computer, and the The change of each time data exchanged with the access-side computer is sequentially stored or recorded as the time transition in the spatio-temporal time clocked by the unique-time generation device of the access-side computer, and the communication partner By storing or updating the authentication data relating to the computer on the access side, and by using the authentication data in accessing the computer on the access side by the access side, authentication of the computer on the access side is performed. Authentication and management device. BRIEF DESCRIPTION OF THE FIGURES

 FIG. 1 is a diagram showing a communication process indicating the progress of initial authentication among processes for performing mutual authentication between a server and a client based on an authentication / management device according to an embodiment of the present invention.

 FIG. 2 is a diagram showing a communication process indicating the progress of normal authentication among processes for performing mutual authentication between a server and a client based on the authentication / management device according to one embodiment of the present invention.

 FIG. 3 is a diagram showing a communication process indicating the progress of normal authentication among processes for performing mutual authentication between a server and a client based on an authentication management device according to an embodiment of the present invention. .

FIG. 4 is a diagram showing a service based on an authentication management apparatus according to an embodiment of the present invention. FIG. 7 is a diagram showing a process in which a client acquires a time and space defined by a device for generating a specific time of a server in initial authentication in a process of performing mutual authentication between a server and a client.

 FIG. 5 is an explanatory diagram showing the progress shown in FIG. 4 in a time and space shared by a server and a client on a network.

 FIG. 6 is a diagram showing changes in the content of data transmitted and received between the server and the client in the process of initial authentication.

 FIG. 7 is a view similar to FIG. 4 showing a process of transmitting and receiving each data shown in FIG. 6 between the server and the client during the initial authentication.

 FIG. 8 is an explanatory diagram showing a process of transmitting and receiving each data shown in FIG. 7 in a time space shared by a server and a client on a network. FIG. 9 is a diagram similar to FIG. 7, showing the generation and contents of data to be transmitted and received in the initial authentication process.

 FIG. 10 is an explanatory diagram showing each initial authentication data C 1 and S 1 in a time space shared by a server and a client on the network. FIG. 8 is a diagram similar to FIG. 7, showing the generation and contents of data transmitted and received in the process.

 FIG. 11 is a diagram showing a state where each authentication item is converted into a unique numerical value and replaced with seconds.

 FIG. 12 is a flowchart showing each step of the initial authentication in the server and the client authentication / management device.

 FIG. 13 is a block diagram showing a configuration of a combination of a server and a client that perform mutual authentication.

 FIG. 14 is a network diagram showing an environment to which the authentication / management device according to the embodiment is applied.

 FIG. 15 is a diagram showing the concept of the unique time proposed earlier by the applicant. FIG. 16 is an explanatory diagram illustrating the concept of the eigentime proposed earlier by the applicant in time and space.

Fig. 17 shows the spatio-temporal distribution of mutual communication between computers on the network existing in the spatio-temporal network in Fig. 16. 02

 FIG. 6 is a diagram showing a cloth state.

 FIG. 18 is an explanatory diagram explaining the authentication principle of the present invention in communication between a server and a client. BEST MODE FOR CARRYING OUT THE INVENTION

 "Premise"

 First, before explaining the authentication / management device proposed by the applicant, a clock built into a normal personal computer (hereinafter simply referred to as a personal computer), a facsimile, a telephone, a communication karaoke device, and other multimedia devices. The concept of time of the device will be described as a premise.

 Atomic clocks (cesium clocks) are currently known as the clocks that can measure the seconds most accurately. Atomic clocks are clocks that sequentially control the emission of radiation corresponding to the transition between the two hyperfine levels of the ground state of the cesium-133 atom, with a period of 9 19 2 6 3 17 7 0 1 second. It is said to have an accuracy of one hundred millionth of a second. Since the time obtained by integrating seconds with an atomic clock and the obtained time actually fluctuates, international cooperation has been made to average the values of atomic clocks around the world to obtain atomic time that is almost ideal. ing. The atomic time obtained in this way is called international atomic time (temps atomic international, TAI), and the international atomic time is measured starting at 0:00:00 on January 1, 1958.

Thus, the value of one second is currently controlled by the internationally defined atomic time, while universal time is known as a value representing the length of a day. In Universal Time, the mean sun transits (midnight) on the prime meridian at 0 ° longitude passing through the former Greenwich Observatory in the United Kingdom at 2:00 pm, and 12 hours before and after midnight, and two days a day. It is determined as 4 hours and is sometimes called Greenwich Mean Time by convention. Prior to the discovery of fluctuations in the Earth's rotation speed, this universal time was the basis of standard time, but today, universal time is considered to be a value representing the angle of the Earth's rotation, and the length of the current day In addition, the time is measured and set according to coordinated universal time (UTC). Coordinated Universal Time is the atomic time in which leap seconds have been adjusted to be within 0.9 seconds of Earth's astronomical universal time. In Coordinated Universal Time, the time interval with seconds as the basic unit is the same as the international atomic time, and the time is approximately the same as the universal time. In addition, in the majority of the world, the Gregorian calendar uses the length of the clock to indicate that the average year is 365 days and that every leap year is 365 days. Has been adopted. This is based on the fact that the Earth's orbital period (Sunday) with respect to the sun is 365.242.22 days, and the approximate value of 365.24.25 days is 1 sun year. The year was decided.

 In determining the year and day due to such natural astronomical cycles (the Earth's revolution and rotation), for example, the Earth's rotation speed is not always constant, but is affected by fluctuations in the earth's axis and seasonal fluctuations. The length of the day has changed slightly. In addition, since the Earth's rotation speed tends to decrease slightly, there will be a slight difference between the atomic time, which is constantly calculated by the atomic clock, and the universal time, which is determined based on astronomical operations. For this reason, when the difference between the two becomes 0.9 seconds or more, the work of leap seconds to insert or remove 1 second on the last second of June 30 or 1 February 31 is performed and adjusted . In addition, it plans to have no leap years in the coming hundreds of years and plans to make adjustments.

By the way, time management on the earth is performed based on the concept of date and time based on the Coordinated Universal Time, the International Atomic Time, and the Gregorian calendar, but almost all PCs and multimedia devices currently on the market are used. In addition, a clock device (clock device) based on the Coordinated Universal Time and the Gregorian calendar and a calendar function are built in. In other words, as long as these devices are started on the basis of a computer, a CPU is always built in, and the CPU is required to have some kind of clocking means in setting the cycle of the arithmetic processing operation. For this reason, such devices incorporate quartz or some other oscillator (usually built into the CPU), and further divide the time-dependent oscillation state of the oscillator by the natural frequency per second of each oscillator. This value is further integrated, and 1 second → 1 minute (60 seconds) — 1 hour (3,600 seconds) — 1 day (86, 400 seconds) is set. It has a built-in clock device that can display minutes and seconds on a clock. In addition, for equipment, the service life of the equipment A calendar based on the Gregorian calendar for the year 10 and beyond is built in as software (it may be built into the CPU itself as hardware) and clocked as described above. 24 hours are sequentially accumulated, and the corresponding date can be displayed. The present invention pays attention to the fact that each device incorporating a microcomputer has the current time and power render corresponding to such a universal time, and exists on a network, and stores these universal time (standard time of each country) and calendar. It is possible to authenticate and manage the held devices.

 For this reason, the authentication / management device according to the present invention is not limited to being applied to a network computer having a communication function, but includes a facsimile, a telephone, a cash dispenser, a communication karaoke device, an electronic payment terminal,

It can be set for CATV terminals, home information appliances, and other multimedia devices.

 Further, the authentication / management apparatus according to the present invention is configured such that each domain, each server, and each client assigned to a role are assigned to each computer on the network as shown in FIG. It is possible to authenticate and manage each node and various types of data passing through the nodes. That is, as shown in FIG. 14, the authentication / management apparatus according to the present invention includes a personal computer connected to the intranet in the company, a personal computer connected to the Internet, and a personal computer connected to the intranet. It is also possible to perform authentication and management of each personal computer.

 "Principle of the present invention"

Next, the principle of the present invention will be described with reference to FIGS. 15 to 18. As shown in Fig. 15, the “property generation device” according to WO97 / 22047, proposed earlier by the applicant, starts at the start time QB0 and ends at the end time QE0. The present invention relates to a device for clocking a finite time Q constantly from the beginning to the end by means of a clock. Fig. 16 shows the concept of clocking in terms of the time and space of the “eigen-time generator” set by a certain combination. In other words, the generation device of this specific time Diffuses free space by 360 degrees in the radial direction, forming a constant area, and counts a finite time (eigentime) constantly from the start date and time QB0 to the end date and time QE0 Is what you do. In the space-time as a closed space from the start date and time QB0 to the end date and time QE0 defined in this way, the current date and time Now is included, and the communication performed between other computers at each date and time is as follows. Each feature will be described.

 (1) When a network space for communicating with a plurality of computers is included in the time space thus defined, the network space is a closed space defined by a specific time. It becomes space.

 (2) In this network space, if the electric signal speed (communication speed) does not change, distance and time are equivalent (distance = communication speed X time).

 (3) In this network space, each network computer (communication partner computer) that performs communication at each point in time as a communication partner in the space at each communication point as shown in FIG. 16. Localization is possible.

 (4) The communication at each point in time that is scattered is always one-to-one at the same point in time, and this can be regarded as one point in the specific amount of time Q.

 (5) Digital information, such as data and applications, transmitted and received with the computer of the communication partner moves at the electric signal speed (communication speed) in the network space.

 (6) The transmission and reception of digital information performed in this space-time must be performed via any route (router, etc.) to a specific communication partner when the network is, for example, a web. Become.

In addition, the network computer related to the communication partner should exist in this space-time, in which communication is repeated multiple times with the communication partner, and the space-time is shared. The reception time of the specific communication data from the user and the transmission time of the specific communication data to the other party can be used as mutual authentication data unique to the other party. That is, this authentication data is obtained by transmitting the communication data transmitted from the other party a plurality of times in the past at the current time, the previous time, the last time and the previous time, and It is generated by modifying it sequentially based on a specific protocol, and it is possible to specify a specific communication partner in the eigen-time system with higher accuracy and higher accuracy. If these are represented in a diagram, by repeating transmission and reception of communication data with a specific communication partner as shown in FIG. 17, it is possible to obtain a time-space like UP1, UP2 and UPn. The location of the other computer can be specified, and reliable authentication can be performed.

 In other words, in the communication between two computers in the space-time (eigentime system) from the start date / time QB0 to the end date / time QE0, the following features exist in addition to the features (1) to (6) above. I do.

 (7) The transmission timing of the access side that performs communication access always exists before (in the past) in the specific time system, the reception timing of the accessee side that receives the communication access.

 Looking at this feature (7) in the communication between the server (S RV: A) and the client (CLT: B) shown in Fig. 18, the signal from the server at the time of reception of the signal U 1 at the timing R sl The timing S s 1 when transmitting the signal VI toward the client to U 1 is between the timing S c 1 when transmitting the signal U 1 and the timing R c 1 when receiving the signal VI on the client side. Will exist in the eigentime system P at. That is, in the eigen-time system P, the timings R s1 and S s 1 on the server side and the elapsed time P s1 between them are the same as the elapsed time P el of the timings Sc 1 and R cl on the client side. Will always exist. Thereafter, in the communication performed in the second and third times, for example, the elapsed time Ps2 and the timings Rs2 and Ss2 always exist in the elapsed time zone Pc2. The time Ps3 and the timings Rs3 and Ss3 always exist in the elapsed time zone Pc3.

On the other hand, from the timing R c 1 when the signal VI is received on the client side, the timing Sc 2 when the signal U 2 is transmitted to the server for this signal VI is determined when the signal V 1 is transmitted on the server side. At the timing S s1 and the timing R s2 at the time of reception of the signal V 2. That is, in the eigentime system P, The timings Rc1 and Sc2 on the client side and the elapsed time Wc1 between them always exist in the elapsed time zone Ws1 of the evening Ssl and Rs2 on the server side. . In the communication repeated thereafter, for example, the elapsed time Wc2 and the timings Rc1 and Ss2 always exist in the elapsed time zone Ws2.

 As described above, in the communication performed between the client and the server, the server receives the signal U from the previous time when the signal U was received from the client side, and changes the signal V toward the current client. The amount of elapsed time of the specific time from the time when the signal U was transmitted to the server on the client side to the time when the signal V was received from the server side this time It must be smaller than the elapsed time of the eigentime.

 On the other hand, the elapsed time of the specific time from the timing when the client received the signal V from the previous server to the timing when the signal U was transmitted to the server this time is determined by the server. It is assumed that the amount of elapse of the eigentime from the timing of the previous transmission of the signal V to the client to the timing of the reception of the signal u from the client this time is always small.

In the case of transmitting and receiving signals such as data and abbreviated data in a plurality of times of communication between the server and the client, the signals transmitted and received between the access side and the accessed side include a unique time system. If the transmission timing of each signal of the other party in the past, the reception timing of the signal transmitted from the other party, and the amount of time of the other party between these timings are included in the communication partner in Even at such a computer, the start date and time QB 0 set by the communication source, as long as a clock means and a common clock device that clock the clock at least at the same clock interval as the accessed side are provided. From the end point to the end date and time QE 0 with the same clocking interval (e.g., a measuring unit in seconds). Generator between is the same state as that set. Thus, between the access side and the accessed side, for example, Then, the spatio-temporal of the generating device of the set specific time is defined (of course, the same generating device may be set on the access side, and the same spatio-temporal may be defined). As the time transition in the common space-time performed with the other party, include the transmission time (transmission timing) and reception time (reception timing) of each signal performed in the past, and the time lapse between the transmission time and the reception time. Thus, the existence of the other computer in space and time as shown in Fig. 17 becomes clear. That is, at each of these time points transmitted from the other party (for example, in FIG. 18, each transmission timing S cl, S c 2, S c 3 and each reception timing R on the client side of each signal transmitted and received by the server in the past) cl, Rc2, Rc3), or over time (eg, the server recognizes Pc1, Pc2, Pc3 and Wcl, Wc2), or The change in time and data generated based on the time becomes a unique existence of the computer in the time and space shown in FIG. 17, and the time data change in communication with these specific computers is sequentially stored, or By recording it, it can be saved as authentication data for the communication partner of the communication partner. Further, by storing and updating these data successively in each successive communication, the computer of the communication partner can be more accurately authenticated in the time and space shown in Fig. 17.

 By applying the principle of the present invention, it is possible for computers of communication partners in various computer networks shown in FIG. 14 to be authenticated and managed without requiring a certificate authority. An authentication / management device according to a specific application example will be described below with reference to the embodiments shown in FIGS. 1 to 13. Note that the present invention is not limited to such an embodiment, and it goes without saying that various embodiments and examples can be applied and set based on the above principle.

 "Specific embodiments"

The authentication / management apparatus according to the present embodiment is set and used in each computer connected to the network as shown in FIG. 14, but is used between the nodes connected in this way. Communication is shown in Fig. 13. Is performed based on the present apparatus set in the computer. That is, for example, the communication between the server 1 and the client 2 shown in FIG. 13 is performed based on the authentication / management device 3 set for each of these nodes, and the communication between the server 1 and the client 2 is respectively performed. Device 4, CPU 5, clock 6 (calendar based on the Gregorian calendar) and clock device 7 for clocking universal time (coordinated universal time and the standard time set for the country based on this), ROM 7, hard disk, This is where the memory 8 composed of CD_R, MD, etc. is built. Server 1 and client 2 are provided with keyport 9.

 "Initial authentication"

 The authentication / management device 3 set in each computer is in an intercommunication state between the computers existing on the network, and in a communication start state with a communication partner related to a specific node, the authentication management device 3 corresponds to the communication partner. It consists of the steps to be set, and the steps to authenticate and manage the node associated with the communication partner and various data passing through the node in the communication state with the same communication partner thereafter ( Claims 8 and 10).

 First, each step A to F set in the authentication / management device 3 of the server 1 and each step a to f set in the authentication / management device 3 of the client 2 are shown in FIG. Fig. 1 illustrates the process of server 1 authenticating and managing client 2 or client 2 authenticating and managing server 1 using the example of communication between each node of server 1 and client 2 shown in Fig. 1. -It will be described based on FIG.

 First, in the initial authentication procedure between the server 1 and the client 2 shown in FIG. 1, a prior open access is performed from the transmitting and receiving device 4 of the client 2 to the transmitting and receiving device 4 of the server 2. When the server 1 is a distributor of software and data such as application software, music data, video data, financial data, technical data, etc., the contents are indexed by item.

Client 2 downloads the information related to the index display, and downloads and purchases software and software related to the necessary items. JP 0/02449

 -14-If Client 2 wishes, Client 2 accesses Server 1 again and confirms the "connection OK" of Server 1 (see Fig. 1).

 Through such open access, access is made from Client 2 to the server for the formal initial authentication procedure, and the transmission / reception device 4 of Client 2 is directed to the transmission / reception device 4 of Server 2 for the application. The signal will be transmitted (see Fig. 1). Conventionally, when applying for distribution of applications and data via such a network, the server 1 sends the client 2 on the connection screen to the node 2 for node (client 2) node identifier (for example, the serial number of the eighty one software). , Date of manufacture, etc.), a unique numerical value t (commonly known as product ID) set to define the usage contract, a unique numerical value u (user ID, etc.) specified in the license agreement for the application in the server 1 The client 2 is required to input a unique numerical value V (such as a password) specified in a contract for browsing an application file in the server 1 and the like. 1 prompts Client 2 for the same input, and Client 2 responds to the request on the input screen by using arbitrary numbers, symbols, and characters. The t~ V, so that the entering in keys board 9 of the client 2 side.

 Further, in the embodiment, an arbitrary amount for the client 2 to download the application II data in the server 1 is also input as the data w. The data t to w input on the client 2 side in this way are received as the authentication items t to w in FIG. 11 by the transmission / reception device 4 on the server 1 side, and the authentication / management device 3 on the server 1 The transmitted authentication items t to w are replaced with the corresponding unique numerical values t 1 to w 1 based on the protocol set by the server 1 (refer to the unique numerical values in FIG. 11). .

In such an initial authentication procedure, in the server 1 receiving the “open access” shown in FIG. 1, in the initial setting management step A of the server 1 shown in FIG. 12, a power rendering device based on the Gregorian calendar of the server 1 is set. With reference to the force render date and the clock device 7 (clock device that clocks hours, minutes and seconds based on Coordinated Universal Time), a certain date From the beginning QB O to the ending QE O in the interim time zone as the ending QE O, a device for generating a specific time for constantly ticking the total ticking value Q by the ticking means 7 is preset. In the embodiment, the setting is set to start QB 0 at 00: 00: 0 am on January 1, 1999, and set to end QE 0 at 12:00:00 p.m. on February 9, 1999. The value Q (86, 400 seconds x 40 days) converted from the period in seconds is used as the clocking gross value. Each of these fixed numerical values (Q, QB0, QEO: 1st 1 Is shared between server 1 and client 2 as authentication item Q shown in Fig. 11, and is supplied from server 1 to client 2 (for example, mail-installed) or transmitted. (SVR Now transmission in Fig. 1). Thus, each value (Q, QB0, QE0) supplied or transmitted to the client 2 is transmitted to the authentication / management device 3 by the initial setting management step a in the authentication / management device 3 on the client 2 side. On the client 2 side as well, the total clock value Q from the initial QB 0 to the final QE 0 is constant by the clock unit 7 by the clock unit 7 in the same way as the clock unit 7 on the server 1 side. An eigentime generator that clocks in is set. Therefore, a time space is established in the server 1 and the client 2 that shares the beginning QB 0 and the ending QE 0 (initial setting management steps A and a).

Thus, as shown in FIGS. 1 to 3, between the server 1 (upper drawing) and the client 2 (lower drawing), rightward in the drawing (FIG. 1 → FIG. 2 → FIG. 3). An evolving spatiotemporal space is defined, and signals are sent and received multiple times between the two parties during the initial authentication procedure. First, the first “application” access is sent from client 2 to server 1. In the initial authentication procedure, the management device 3 performs the authentication in the initial setting management step B (see FIG. 12 and claim 8) while receiving the “application” signal from the client 2 in the initial authentication procedure. Generate basic data X. The authentication basic data X is obtained by dividing the absolute value Q of the inter-hourly time zone (QB 0 → QE 0) by 2 by dividing the total time value Q of the generator of the unique time by 2, and obtaining the client 2 When the first application sent to server 1 is received from R 0, it is generated by subtracting the value obtained by subtracting QB 0 at the beginning of the interim period. 0/02449

 -16-Yes (see Equation 1). In other words, the data X generated in this way has a time R0 in the space-time reception in the communication with the client 2 in the server 1, and has a value in seconds.

 "Formula 1"

 X = Q ÷ 2-(R 0 -QB 0)

 In generating the above basic authentication data X, numerical data unique to client 2 relating to the transmission destination, that is, unique numerical data tl or wl shown in FIG. 11 is used. The data tl or wl is replaced with a value in seconds (from t2 to w2), and each of the replacement data t2 to w2 is replaced with a value calculated based on the above formula 1 according to the protocol set by the server 1. Alternatively, the basic authentication data X may be generated by adding, subtracting, or performing variable processing. Further, the replacement data t2 to w2 may be stored in the memory 8 corresponding to the authentication basic data X.

The authentication basic data X thus generated is transmitted from the transmitting / receiving device 4 on the server 1 to the transmitting / receiving device 4 on the client 2 side based on the initial setting management step B on the server side in FIG. (See FIG. 1). However, the data X is transmitted to the point of time of cBO on the client 2 side. As a result, the following steps b1 and b2 in the authentication / management device 3 on the client 2 side are executed.

 bl, the first application is sent from the client side to the server side.b2, on the server side computer, the absolute value Q of the above time interval is divided by 2, and from this value, the client side When the initial application sent to the client is received by the client side, the initial period of the interim zone QB0 is subtracted from R0 by subtracting the value obtained by subtracting the value, and the basic authentication data X is generated from the server side. Receive

In the initial setting management step c of the management device 3 based on the initial setting management step b2, the authentication basic data X received from the server 1 is received. The received basic authentication data X is added to the value obtained by subtracting the beginning QB 0 of the interim zone from the time between the two and the initial authentication data C 1 of the client 2 is calculated and generated. / 02449

 (See Equation 2).

 "Formula 2"

 C 1 = X + A

 ※ Eight: ^ ー ς? Β ο

 The initial authentication data C1 generated in this way is transmitted from the transmitting / receiving device 4 of the client 2 to the transmitting / receiving device 4 of the server 1 by the initial setting management step c, and the authentication / management device 3 of the server 1 is initialized. The setting management step C confirms that the transmission was received at the time point of sR0 (see FIGS. 1 and 12). Step C of the server has the following operations.

 C, regarding the basic authentication data X generated based on the initial setting management step B and transmitted to the client side, when the transmitted data X is received by the client side computer c B0 from time to time The basic authentication data X is added to the value obtained by subtracting QB0 from the initial stage of the initial calculation, and the client-side initial authentication data C1 is calculated by the client-side computer, and the initial authentication data C1 is received from the access side. Do

 At this stage, in the authentication / management device 3 of the server 1, in the initial setting management step D, the received initial authentication data C2 of the client 2 is authenticated. The authentication is as follows.When the client 2 receives the basic authentication data X generated by the server 1 earlier in the initial authentication data C 1 on the client 2 side, c B 0 indicates when the server 1 receives the first application. It is calculated whether or not the initial authentication data C 1 exists in the time domain between s R 0 and the reception time, and the authentication is performed based on the following formulas 3 to 5.

 "Formula 3"

 C 1≤ X + (s R 0-Q B 0)

 "Formula 4"

 C 1≥ X + (s R 0-R 0)

 "Formula 5"

 X≤ C 1≤ S 1

* In Equation 5, X is the time when the data X is transmitted from the server to the client, and S 1 is the time when the next data is transmitted S 1 Expressions 3 to 5 can be expressed as decomposition expressions as in the following Expressions 6 and 7.

 "Formula 6"

 X + (c B 0-Q B 0) ≤ X + (s R 0-Q B 0)

 "Formula 7"

 X + (c B 0-Q B 0) ≥ X + (s R O— R O)

 Based on the above equations (for example, Equations 6 and 7), the authentication of the client 2 as the communication partner by the data C 1 is performed in the initial setting management step D in the authentication / management device 3 of the server 1. (See Fig. 1 and Fig. 12). When viewed from the client 2 side, the initial setting management step D is represented by the following initial setting management step d.

 d. In the initial setting management step c, when receiving from the client side and receiving to the server side s Receiving on the client side the basic authentication data X included in the initial authentication data C 1 received in R 0 The server computes whether or not time c B 0 exists in the time region between R 0 when the first application is received on the server side and R s when the initial authentication data C 1 is received, and the client on the server side. Authenticate the side

 Next, in the initial setting management step E, the authentication / management device 3 of the server 1 generates the initial authentication data S 1 of the server 1 to be transmitted to the client 2. This data S1 is generated by subtracting the authentication basic data X generated in the initial authentication management step B from the initial authentication data C1 received from the client 2 side, and further adding the initial authentication data C1 to this value. (See Equation 8).

 "Equation 8"

 S 1 = C 1 + Y

 * Y = C 1-X

The initial authentication data S 1 of the server 1 thus generated is transmitted from the transmitting / receiving device 4 of the server 1 to the transmitting / receiving device 4 of the client in the initial setting management step E, and the authentication / authentication of the client 2 is performed. The management device 3 received the transmission at the time of c R 0 in the initial setting management step e. 0/02449

 -19-Make sure that (see Fig. 1 and Fig. 12). That is, this initial setting management step e has the following operation.

 e. In the initial setting management step d, the server-side transmitted and authenticated initial authentication data c1 is subtracted from the basic authentication data generated in the initial setting management step b2—X, and the initial authentication data is added to this value. The server generates initial authentication data S 1 on the server side by adding C 1, and is transmitted from the server side and receives the initial authentication data S 1 on the client side.

At this stage, in the authentication / management device 3 of the client 2, in the initial setting management step F, the received initial authentication data S1 of the server 1 is authenticated. The authentication is generated in the initial setting management step d before being included in the initial authentication data S 1, and when the server 1 receives the initial authentication data C 1 transmitted from the client 2 to the server 1 s R 0 Is calculated in the time domain between the time when the client 2 receives the basic authentication data X c B 0 and the time when the initial authentication data overnight C 1 c c RO is calculated. The authentication is performed based on the URL.

 "Formula 9"

 S 1≥ C 1

 "Formula 10"

 S 1≤ C 1 + (c R 0-c B 0) + A

 "Formula 1 1"

 C 1≤ S 1≤ C 2

 * In Equation 11, C 1 is the time when the data C 1 is transmitted from the client to the server, and C 2 is the time when the next data C 2 is transmitted. Equations 12 and 13 below are obtained.

 "Formula 1 2"

 C 1 + Y≥ C 1

 "Formula 1 3"

 C 1 + Y ≤ C 1 + (c R 0-c Β 0) + A

Based on each of the above equations (for example, Equations 1 and 2), communication using data S 1 Authentication of the server 1 as the partner is executed in the authentication of the client 2 ′ in the initial setting management step ί by the management device 3 (see FIGS. 1 and 12). When this step f is viewed from the server 1 side, it is the following initial setting management step F.

 F. Initial authentication data S 1 generated based on the initial setting management step E, transmitted to the client side, and received by the client side c When the initial authentication data S 1 received at Ro, the client included in the data S 1 When the client receives the initial authentication data C1 sent from the client to the server, s R0 receives the basic authentication data X at the client, and receives cB0 and the initial authentication data C1. Calculate whether or not it exists in the time domain between time c R 0 and authenticate the server side on the client side

 In this way, the mutual communication between the server 1 and the client 2 is repeated a plurality of times, mutual node authentication is performed, and the initial authentication shown in FIG. 1 is completed. Further, in the authentication of the client 2, the management device 3 transmits authentication data C 2 for normal authentication to cause the server 1 to perform the authentication of the client 2 at the next communication with the server 1. Generated. The authentication data C 2 is generated by subtracting c BO from the previous reception of the basic authentication data X at the time of reception of the previous authentication data S 1 at the client 2 at the reception of the previous authentication data S 1 at the client 2. (See Fig. 2, Equation 14).

 "Number 1 4"

 C 2 = S 1-(c R 0-c B 0)

 For example, the generated normal authentication data C2 is stored in the memory 8 as authentication data of the client 2 when the server 1 is requested to deliver specific software and data.

 Next, in order to clarify the initial authentication procedure performed in this way in the time transition in the space-time (QB0-QE0) set by the unique time generation device of the server 1, Referring to FIG. 10 to FIG.

The spatio-temporal time from the initial QB0 to the final QE0 set by the eigentime generator of server 1 is represented by distance and time components as shown in Figs. 4 and 5. The more defined client 2 located at point B in time and space will perform the first open access (A 1 in Fig. 4) to server 1 at point A. In the server 1, as shown in FIG. 4, after the first access is received (A2 in FIG. 4), the generation device of the unique time of the server 1 clocks for the client 2 having made the access. Obtains the current time of server 1 (A3, S RV / Now: QB0 → Now), and sends the concept of the unique time of server 1 including SRVZNow (QB0—QE0) to client 2. (A4 in Fig. 4: S RVZNow transmission). Client 2 receives the concept of the unique time (A5 in FIG. 4: S RVZNow reception in FIG. 4), installs this concept on the authentication / management device 3 of Client 2, and then sends it to Server 1. The application is transmitted (A6 in Fig. 4: initial request), and the server 1 receives the request (A7 in Fig. 4: request reception). Here, the server 1 generates the basic authentication data X based on the generation formula of the basic authentication data X shown in Fig. 4 (A8 in Fig. 4: X generation), and generates the generated basic authentication data X. To the client 2 (A9 in Fig. 4: X transmission). Client 2 receives the basic authentication data X (A10 in FIG. 4: X reception). The state in which the data X is received is, as shown in FIG. 5, the point A and the point B where the server 1 and the client 2 correspond one-to-one in the same time and space. Therefore, in the subsequent mutual communication, based on the authentication basic data X, the server 1 and the client 2 mutually authenticate the communication partner in the same time and space.

Thereafter, the basic authentication data X received by the client 2 (A10 in FIG. 9: received) is used to generate the initial authentication data C1 on the client side by the generation formula of the initial authentication data C1 shown in FIG. (A11 in Fig. 9). Then, the initial authentication data C1 is transmitted to the server 1 (A12 in FIG. 9: C1 transmission) and received by the server 1 (A13 in FIG. 9: C1 reception). Subsequently, after performing the authentication of the initial authentication data C1, the server 1 generates the initial authentication data S1 on the server side based on the data C1 using the generation formula shown in FIG. 9 (see FIG. 9). A1 4). The generated initial authentication data S1 is transmitted from server 1 to client 2 (A15 in Fig. 9: S1 transmission). / JPOO / 02449

 -22-, and is received by Client 2 (A16 in Fig. 9: S1 reception).

Based on the received initial authentication data S 1, the client 2 generates data C 2 for normal authentication to be transmitted to the next server 1 (A 17 in FIG. 9). The basic authentication data X between Server 1 and Client 2 and their transition are as shown in Fig. 6. It is clear from such a change that the basic data X for authentication is exchanged with the data X at the initial authentication stage every time the mutual communication is performed. ) Is performed after the authentication, and the time data c 1 thus generated is added to the hourly amount Y (C 1 -X) in the eigen-time system on the server 1 side. Later, a time de S 1 is generated. Subsequently, the client 2 calculates the time-to-time amount (c R) in the eigen-time system on the client 2 side from the received time data 1.

The subtraction of 0-cB0) is performed after the authentication, and the time data C2 for the next authentication with the server 1 is generated at the end of the initial authentication.

As shown in Fig. 10, the point at which each generated authentication data (X-C1-S1) is transmitted and received between client 2 and server 1 is point A (server side) and point B (Client side), and it will be scattered in the spatiotemporal space of Fig. 10. 7 and 8, the server 1 side (computer at point A in FIGS. 7 and 8) and the client 2 side (point B in FIGS. 7 and 8) The time of transmission / reception of each signal (open access, application, transmission / reception of each data) with the computer (timer) is the time and space (QB 0—QE 0) of the unique time generation device set on the server 1 At the same time (see Figure 8). That is, from the beginning of these initial authentication procedures, transmission B 1 → transmission B 2 → transmission B 3 — reception B 4 transmission B 5 → reception B 6 — CPU processing B 7 (generation of S 1) → transmission B 8 → reception B 9—Each time to end and to (see Figure 7) will be scattered at point A or point B in the shared spatio-temporal space shown in Figure 8 and confirm this point with each other By authenticating the computer of the communication partner Becomes possible.

 In this way, in this embodiment, the server 1 as the accessed side transmits or supplies the time and space defined by the unique time generation device of the server 1 to the client 2 as the access side. However, the time is shared by the clocking device 7 of the client 2 at the time of initial authentication and the force rendering device 6 (for example, B1, B4, B5, and B9 in FIG. 7). The time data based on the (time point) may be transmitted from the client 2 to the server 1, and based on the time data, the server may associate each time point with the time and space defined by the generator of the specific time. Further, in the embodiment, the mutual authentication between the server 1 and the client 2 is enabled, but the computer (client 2) of the communication partner may be authenticated only by the server 1 based on each time data transmitted and received.

 "Normal authentication"

 Based on Fig. 1 above, after the initial authentication between Server 1 and Client 2 has been completed, if Client 2 specifically wants to distribute application data to Server 1, Fig. 2 and The access related to normal authentication shown in Fig. 3 is executed. In the case of normal authentication access, first, open access shown in Fig. 2 is executed, and after Client 2 obtains the permission of Server 1, Client 2 issues the previous initial authentication to Client 1 to Server 1 Send data C2.

 The authentication of the server 1 and the management device 3 authenticate the received authentication data C2 of the client 2 side. The authentication is performed when the client 2 receives the initial authentication data S 1 generated by the server 1 earlier in the authentication data C 2 at the destination c R 0, and when the server 1 receives the initial authentication data C 1 s. It is calculated whether or not it exists in the time domain between R 0 and the reception time s R 1 of the authentication data C 2, and the authentication is performed based on the following formulas 15 to 17.

 "Formula 1 5"

 C 2≤ S 1

`` Formula 1 6 J P 0/02449

 -24-C 2-((S VR / Now)-(c R O)) ≥ ((S I-(s R l one s R O)) one ((s R O—B e f ore S ND: X))

 "Formula 1 7"

 S 1≥C 2≤ S 2 → 0≤ ((C on n e c t OK) (D i s c o n n e c t))-((S VR / N ow)-(c R O)) ≤ 1

 Expressions 15 to 17 can be expressed as decomposition expressions 18 to 20 as follows.

 "Formula 1 8"

 S 1-(c R 0-c B 0) ≥ S 1

 "Formula 1 9"

 S 1-(c R O-c B O)-((S VRZNow)-(c R 0)) ≥ S 1-(s R l-s R O)-((s R O -B e f ore S ND: X))

 "Formula 20"

 0≤ ((C on n e c t OK)-(D i s c o n n e c t))-

((S VRZN ow)-(c R 0)) ≤ 1

 Based on the above formulas (for example, formulas 18 to 20), normal authentication of the client 2 as a communication partner based on the data C2 is executed by the authentication / management device 3 of the server 1. Along with this, server 1 can deliver ordered applications and data to client 2.

 Next, the authentication / management device 3 of the server 1 transmits the data to the corresponding client 2 side, and generates authentication data S2 for performing the normal authentication of the client 2 next time. This data S 2 is generated from s R 1 when receiving the authentication data C 2 received from the client 2 side and s R 0 when receiving the initial authentication data C 1 transmitted from the previous client 2 side. It is determined by adding the authentication data C2 to this value (see Equation 21).

 "Formula 2 1 j

S 2 = C 2 + (s R l-s RO) The authentication data S2 of the server 1 thus generated is transmitted from the transmitting / receiving device 4 of the server 1 to the transmitting / receiving device 4 of the client 2, and the authentication / management device 3 of the client 2 transmits the authentication data S2. Confirm that the reception of the data was performed at the time point of cR1 (see Fig. 2).

 At this stage, the authentication / management device 3 of the client 2 authenticates the received authentication data S2 of the server 1 side. The authentication is embedded in the authentication data S 2, and when the server 2 receives the authentication data C 2 previously transmitted from the client 2 to the server 1 s R 1 is the initial value on the client 2 side When the authentication data S 1 is received c R 0 and when the authentication data C 2 is received c R 1 It is calculated whether or not it belongs to the time domain, and the authentication is performed based on the following formulas 22 to 24. ing.

 "Formula 2 2"

 S 2≥ C 2

 "Formula 2 3"

 S 2≤C 2 + (c l-c R O) + (c R 0-SND: C l)

"Formula 24"

 C 2≤ S 2≥C 3

 * In Equation 24, C 2 is the data transmitted from the client to the server when sending C 2, and C 3 is the time when the next data C 3 is sent. Equations 25 and 26 are obtained.

 "Equation 25"

 C 2 + (s R 1-s R 0) ≥ C 2

 "Formula 2 6"

 C 2 + (s R 1-s R 0) ≤ C 2 + (c R l— c R O) + (c R O

-SND: C1)

 Based on the above formulas (for example, formulas 25 and 26), the authentication of the server 1 as the communication partner by the data S2 is executed by the authentication device 3 of the client 2.

Furthermore, in the authentication / management device 3 of the client 2, the next server Authentication data C3 for normal authentication for causing server 1 to authenticate client 2 when communicating with server 1 is generated. The generation of the authentication data C3 is performed by subtracting cR0 when receiving the initial authentication data S1 two times before from the reception cR1 at the time of receiving the previous authentication data S2 at the client 2, and setting this value to the initial value. It is generated by subtracting it from the authentication data S2 (see Fig. 2).

 "Formula 2 7"

 C 3 = S 2-(c R 1-c R 0)

 The generated normal authentication data C3 is further stored in the memory 8 as the authentication data of the client 2 when the server 1 requests the server 1 for the distribution of software or data next time, for example.

 In the second normal authentication access, the open access shown in Fig. 2 or 3 is executed first, and after Client 2 obtains the permission of Server 1, Client 2 obtains the permission of Server 1. The client-side authentication data C3 generated last time is transmitted to.

 The authentication of the server 1 and the management device 3 authenticate the received authentication data C3 of the client 2 side. The authentication is performed when the client 1 receives the authentication data S 2 previously generated by the server 1 before the server 1 side receives the authentication data C 2 at the server 1 side. It calculates whether or not it exists in the time domain between sRl and the time of receiving the authentication data C3 sR2, and performs the authentication based on the following equations 28 to 30.

 "Formula 2 8"

 C 3≤ S 2

 "Equation 2 9"

 C3-(SVR / Now)-(cR1) ≥ S2-(sR2-sR1)-(sRl-BeforeSND: Sl)

 "Formula 3 0 j

S 2≥C 3≤ S 3 → 0≤ ((Connect OK)-(D isconnect))-((S VR / Now)-(c R l)) ≤ 1 Expressions 28 to 30 can be expressed by the following expressions 31 to 33 when expressed by decomposition expressions.

 "Formula 3 1"

 S 2-(c R l-c R O) ≤ S 2

 "Formula 3 2"

 S 2-(c R l — c RO)-(SVR / Now) one (c R l) ≥ S 2-(s R 2-s R 1) one (s R l-B efore S ND: S l ) `` Formula 3 3 J

 0≥ ((Conn ect OK)-(Disconnect)) One ((SVR / Now- (cRl)) ≤ 1

 Based on the above formulas (for example, formulas 31 to 33), normal authentication of the client 2 as the communication partner based on the data C3 is executed by the authentication / management device 3 of the server 1. Along with this, server 1 can deliver the ordered application data to client 2 to client 2.

 Next, the authentication / management device 3 of the server 1 transmits the data to the corresponding client 2 side, and generates authentication data S3 for performing the normal authentication of the client 2 next time. This data S 3 is generated by subtracting s R 1 when receiving the authentication data C 2 transmitted from the previous client 2 side from s R 2 when receiving the authentication data C 3 received from the client 2 side. , And the authentication data C 3 is added to this value (see Equation 34).

"Formula 3 4 J

 S 2 = C 3 + (s R 2-s R 1)

 Y = C 1 — X

 The authentication data S 3 of the server 1 thus generated is transmitted from the transmission / reception device 4 of the server 1 to the transmission / reception device 4 of the client 2, and the authentication / management device 3 of the client 2 receives the transmission data. Confirm that the procedure was performed at the time point of cR2 (see Fig. 3).

At this stage, authentication of Client 2 '' —Authentication of the authentication data S 3 on the side 1 is performed. The authentication is internal to the authentication server S 3, and the authentication data transmitted from the client 2 to the server 1 last time is received at the server 1 side of the server C 3 s R 2 is the client 2 side It is calculated whether or not it belongs to the time domain between the reception of the authentication data S 2 at the time of reception of the authentication data c R l and the reception of the authentication data C 3 at the time c R 2, based on the following formulas 35 to 39. Authentication is performed.

 "Formula 3 5"

 S 3≥ C 1

 "Formula 3 6"

 S 3 ≤ C 3 + (c R 2-c R 1) + (c R l-S ND: C 2)

"Formula 3 7"

 C 2≤ S 2≥C 3

 * In Equation 37, C3 is the time when the data C3 is transmitted from the client to the server, and C4 is the time when the next data C4 is transmitted.Equations 35 to 37 can be expressed by decomposition equations. Equations 38 and 39 below.

 "Formula 3 8"

 C 3 + (s R 2-s R 1) ≥ C 3

 "Equation 3 9"

 C 3 + (s R 2-s R l) ≤C 3 + (c R 2-c R 1) + (c R 1

-SND: C2)

 Based on the above formulas (for example, formulas 38 and 39), the authentication of the server 1 as the communication partner by the data S3 is executed by the authentication / management device 3 of the client 2.

 Furthermore, the authentication of Client 2 ''

Authentication data C4 for normal authentication for causing server 1 to authenticate client 2 when communicating with server 1 is generated. The authentication data C 4 is generated by subtracting c R 1 when the authentication data S 2 was received two times before from the reception c R 2 when the previous authentication data S 3 was received at the client 2 at the reception when the previous authentication data S 3 was received. Generated by subtracting from data S 3 (Fig. 3 See).

 "Formula 40"

 C 4 = S 3-(s R 2-c R 1)

 The generated normal authentication data C4 is further stored in the memory 8 as authentication data of the client 2 when the server 1 requests the server 1 for the distribution of software or data next time. As shown in Figs. 2 and 3, the transition of the time data in the normal authentication shown in Figs. 2 and 3, C2 → S2 → C3 → S3 → C4, is as follows. After the authentication, the time data S2 is generated by adding the time-to-time amount (sR1-sR0) of the eigen-time system in the server 1, and the time data S2 generated in this manner is On the Client 2 side, the subtraction of the time-to-hour amount (cRl—cRO) of the eigentime system at Client 2 is performed after the authentication. In this way, the transition of data from the initial authentication to the normal authentication is based on the basic authentication data X, and adds or subtracts the time-to-hour data of the unique time system at the time of reception or transmission of the computer in mutual communication. Therefore, it will be changed.

In this way, client 2 and server 1 communicate with each other to achieve more accurate mutual authentication, and are shared by client 2 and server 1 and set simultaneously in seconds. Using Q enables mutual authentication in a computer network environment. In other words, the authentication data itself transmitted by the authentication / management device 3 is obtained by replacing the embodied inorganic number with seconds, and the specified number to be stored like a conventional password. Are different. In addition, this authentication data as a time identifier contains the time of each access (communication time and reception time in the communication history) performed between the communication parties during the set period Q negotiated between the communication parties. Therefore, the more reliable the intercommunication, the higher its reliability.On the other hand, even if a third party obtains this data at some point, it is stored as Q (QB or QE) as a constituent element or between the communicating parties. It is impossible to analyze even past communication histories, and eavesdropping itself becomes completely meaningless. Therefore, the communication partner device is Authentication can be reliably performed, and it can be easily built into any computer device that holds a clocking device and calendar device.The authentication and management device 3 on the server 1 side is initially supplied Alternatively, the transmitted authentication basic data X is stored in the memory 8 and the authentication data (S 1 → S 2 → S 3 ... S n) whose accuracy is improved in each subsequent communication is stored in the memory 8 and sequentially updated. The time data will be deleted as necessary. For example, if the computer of the communicating party violates the contract (online fraud, payment failure, other breach of contract), the time data and the accompanying data (t2 to w2, no. 11 See Fig. 1).

In addition, if the authentication and management device described above is used, a huge amount of data can be divided and transmitted multiple times to the same communication partner, or extremely confidential data (such as electronic money) Money data, diplomatic communication documents, in-house documents, etc.) can be transmitted as digital data embedded in the time data, or transmitted along with it. It can be distributed and saved to many clients, and can be used as a data backup function. In such a data backup, when a certain server distributes and saves data to a large number of clients, second replacement is performed according to the present invention for a huge amount of data, and this is performed by a protocol set by the server. Assuming that transmissions are distributed to each client every specified second period, each client alone understands the contents of the transmitted data even if the analysis is performed. Therefore, it is possible to achieve secret sharing and maintenance for a while. If this kind of secret sharing of data is used, even if a failure or disaster occurs in a certain node on the network, the data is kept in a distributed state, and these data will be sent from all destinations at a later date. By replying, the data is accumulated, and by decoding, the data can be reconstructed, and the risk distribution against data loss can be achieved. In the above embodiment, the value clocked by each clocking device 7 of the server 1 and the client 2 is the second specified in the universal time, but the second and the integrated value of the second are used here. The value of the set period Q includes the concept of 100-second units, 100-second units, etc., and it means that the second specified in Coordinated Universal Time is used as the dimension. .

 In the above-described embodiment, the period Q between the start date / time QB and the end date / time QE is set using the force renderer 6 and the clocking device 7 in the server 1, but the period Q in the initial setting management step A is set. The setting of seconds corresponding to does not simply mean setting the period on the calendar, but the applicant has already proposed in the PCT patent application related to WO97 / 22047 `` Eigentime generator ''. This is a concept that includes period data in seconds from a certain starting point to a certain ending point in a clocking device that clocks from a certain starting point to an ending point specified in. It relates to the means for setting and measuring the period of time that can be measured in seconds by means of a clock that can be clocked on a constant.

Further, in the above embodiment, based on the first open access received by the transmitting / receiving device 4 of the server 1 (see FIG. 1), the calendar device 6 and the clock device 7 are referred to, The access time R 0 during the setting period Q is set by the generator itself, but the data related to the communication date and time for the corresponding node (Client 2) is set in such open access time (reception time). The date and time of transmission to the corresponding node, the date and time of new creation of a data file based on communication with the corresponding node (Client 2), the date and time of update of the data file, or a selective combination of these dates and times. In other words, the node on the accessed side (server 1) may be configured with the corresponding node. If the unique date and time caused by the mutual communication can be captured by referring to the calendar device 6 and the clock device 7 or as a single unit of the unique time generation device as the lapse of seconds in the set period Q In the authentication / management device 3 according to the above embodiment, the / 2

Although the generation of the evening X 1 is performed based on the formula, the generation of the evening X is not limited to this, and each received numerical value (t 2 to w 2) May be created by arbitrarily adding, subtracting, multiplying, or dividing according to the protocol set by the node (server 1). In short, it is only necessary that the unique data transmitted from the access side and various data resulting from the communication access from the access side be included in or correspond to the generated time data. In addition, the hidden code 規定 defined by the server 1, the data to be distributed and stored in each of the communicating clients 2, and the data to be confidentially transmitted to the client 2 can also be included. Industrial applicability

 In the authentication / management apparatus 3 according to the present invention, the operating means has been described mainly on the authentication / management apparatus 3 set on the server 1 side as a computer. As shown in Fig. 3, it can be set on the client 2 side as well, and it is also possible to perform authentication when this client 2 communicates with other clients, as shown in Fig. 14. Servers, clients, domains and other computers can be set up and used. Therefore, there is no longer a need for a third-party authentication organization such as CA, which has the advantage that mutual authentication in a network environment can be performed extremely easily. In addition, facsimile, fixed and mobile phones, cash dispensers, communication karaoke equipment, mopile terminals, electronic settlement terminals, CATV terminals, home information appliances, house automation terminals, etc. It can be installed on any built-in device, and data processing such as electronic payment, billing, and remote control can be reliably performed between the access side and the accessed side.

Claims

 The scope of the claims

Between the computers connected by the communication line, the access side that performs the communication access and the accessee that receives the communication access, at least the computer of the accessee must start at a certain date and time and end at a certain date and time. From the beginning to the end of the intermittent zone, a device for generating a specific time that is constantly clocked by the clock means at the same clock interval is set, and the computer on the access side is set on the computer on the accessed side. A time-measuring device is set by the time-measuring means with a constant time interval having the same time interval as that of the unique time generating device, and at least in the computer on the accessed side by the unique time generating device A timing device that is set on the computer on the access side from time to time from the beginning to the end Defines a space-time that travels at the same time interval as

The communication between the accessing computer and the accessed computer is repeated a plurality of times. When the accessed computer receives a signal from the accessing computer, and when the accessed computer receives a signal from the accessed computer to the accessed computer. The transmission time is clocked by the unique time generation device, and the signal transmitted from the computer on the access side to the computer on the accessed side and the signal received from the computer on the accessed side by the computer on the accessed side The reception of the time is clocked by a timekeeping device, and the time data of the time points and the progress of each time are transmitted and received between the computer on the access side and the computer on the access side.

A change of each time data exchanged with the computer on the access side is sequentially stored or recorded as a time transition in a time space which is clocked by the generation device of the unique time of the accessed computer, and the communication partner The access-side computer is authenticated by storing or updating it as authentication data relating to the access-side computer according to the above, and using the authentication data in the access-side computer access to the accessed-side computer. Certifications · Management device.

 2. In claim 1, the timing device set in the access-side computer has the same date and time as the generation device of the specific time set in the accessed-side computer, starting at a certain date and time and ending at a certain date and time. From the beginning to the end of the period, the time is set to be a constant time generating device that is constantly clocked by the clocking means at the same clock interval, and the specific time generating device is supplied from the accessed side, Alternatively, the authentication is transmitted from the accessed user and is set in the computer on the access side, and the access-side computer also defines a time and space that travels in the same time interval at the same time interval. · Management equipment.

 3. In claim 1 or 2, both the clocking means of the device for generating the unique time set on the accessed computer and the clocking means of the clocking device set on the computer on the accessing side are both in universal time. An authentication / management device that always clocks specified seconds.

4. In claim 1, the clocking device set in the computer on the access side is a clock device provided with a calendar device based on the Coordinated Universal Time and the Gregorian calendar, and the clock device on the access side transmitted to the computer on the accessed side. The time data relating to the computer is data based on the hour, minute, and second clocked by the clock device, and the accessed computer sets the received data based on the received hour, minute, and second in the accessed computer. Authentication / management device equipped with a device that replaces the time transition in the spatio-temporal time that is generated by the device that generates the unique time.

5. The authentication / management device according to any one of claims 1 to 4, wherein the time data exchanged between the accessed computer and the accessed computer is different between the accessed computer and the accessed computer. The communication is repeated several times, and in the spatio-temporal time that is generated by the generator of the specific time set in the accessed computer,

At least when the accessed computer receives the signal from the accessed computer at least the last time the accessed computer receives the signal from the accessed computer, and transmits the signal to the accessed computer at this time. The amount of time on the accessed side that leads to

 The access-side computer elapses from the time when the access-side computer transmitted the signal to the accessed-side computer last time to when the access-side computer received the signal transmitted from the accessed-side computer. Between the amount

 The time-delay based on the time-space is compared between the access-side transmission time and the access-side reception time in the time-space, the access-side transmission time, the access-side reception time, or the access-side time-lapse amount is included. An authentication / management device that authenticates the accessing computer based on whether or not it is authorized.

 6. In claim 1, the time of receiving the first application access from the accessing computer to the accessed computer at the receiving computer is set to the accessed computer. Recognition is performed based on the time elapsed by the unique time generation device, and the basic authentication data is set according to the elapsed time, and the set authentication basic data is subsequently transmitted between the computer on the access side and the computer on the accessed side. An authentication and management device that is used as the basic numerical value of time data generated for mutual authentication in communication.

 7. The method according to claim 6, wherein the generation of the data on the access side or the computer on the accessed side based on the basic authentication data is performed in the basic authentication data exchanged between the computers in the mutual communication. An authentication / management device that performs addition or subtraction of data on time points at the time of reception or transmission of communications performed by the computer with the other computer.

8. The authentication / management device according to claim 3, which is set in each computer in the computer network and mutually authenticates and manages each node of the computers and various types of data passing through the nodes. , To the accessed node,

A. A certain date and time is set as the beginning QB 0 and a certain date and time is set as the end QE 0, which is generated by the generator of the unique time set in the accessed computer. A time interval is set on the accessing computer as well, and the starting and ending QB 0 and the ending QE 0 are shared between the accessing side and the accessed side. Initial setting management step A that defines a time and space that is constantly clocked by time means,

 B, Divide the absolute value Q of the above interim time zone by 2, and subtract the start time of the interim time zone QB 0 from R 0 when receiving the first application transmitted from the access side to the accessed side. Initial value management step B for generating authentication basic data X by subtracting the value and transmitting the authentication basic data X to the node on the access side.

 C, for the basic authentication data X generated based on the initial setting management step B and transmitted to the access side, when the transmitted data X is received at the computer on the access side. The basic authentication data X is added to the value obtained by subtracting QB0, and the initial authentication data on the access side is calculated by the computer on the access side, and the initial authentication management for receiving the initial authentication data C1 from the access side is performed. Step C,

D, when receiving from the access side and receiving to the accessed side s When receiving on the access side the basic authentication data X included in the initial authentication data C 1 received at R 0 c B 0 is the receiving side An initial setting management step D for calculating whether or not it exists in the time domain between the time of receiving the first application R 0 and the time of receiving the initial authentication data C 1 s R 0, and authenticating the access-side node;

 E. In the initial setting management step D, the basic authentication data X generated in the initial setting management step B is subtracted from the initial authentication data C1 received and authenticated from the access side, and the initial authentication data is added to this value. An initial setting management step E for generating the initial authentication data S 1 of the accessed side by adding the overnight C 1 and transmitting the initial authentication data S 1 to the node of the access side;

F, generated based on the initial setting management step E, transmitted to the access side, and received by the access side c Initial data S 1 received at R 0 When the receiving side receives the initial authentication data C 1 transmitted from the accessing side to the accessed side during the data transmission S 1 to the accessed side, the receiving side receives the basic authentication data X on the accessing side. The initial setting management step F is performed to calculate whether or not it exists in the time domain between the time c B 0 and the time c R 0 when the initial authentication data C 1 is received, and to authenticate the node on the access side on the access side. When,

 An authentication and management device comprising:

 9. In claim 8, the initial authentication data S1 generated based on the initial setting management step E is used as time data for accessing to the accessed side and receiving authentication from the next time, or based on the time. An authentication / management device that stores or records as time data related to basic data, and stores or updates the data as authentication data on the access side of communication performed sequentially with the accessed side.

 10. The authentication / management device according to claim 3, which is set on each computer in the computer network and mutually authenticates and manages various data of the computer nodes and various data passing through the nodes. On the side node,

 a. The access-side computer sets the time interval between the times when the generator of the specific time set in the computer to be accessed clocks, the certain date and time is the beginning QB0, and the certain date and time is the end QE0. Is also sent from the accessed side or set by receiving the supply, the starting and ending QB 0 and the ending QE 0 are shared on the accessing side and the accessed side, and the time zone from the beginning QB 0 to QE 0 An initial setting management step a that defines a time space that is constantly clocked by clock means,

 b 1, Initial setting management step b 1 for sending the first application from the access side to the accessed node,

b 2, At the accessee's computer, the absolute value Q of the above time interval is divided by 2, and this value is used when the accessee receives the first application sent from the accessor to the receiver. The initial period of the interim zone QB 0 is subtracted from R 0 and the value obtained by subtracting it is subtracted to generate the basic authentication data X. An initial setting management step b2 for receiving the basic authentication data X from the node on the side;

 c, for the basic authentication data X received based on the initial setting management step b2, when the access side computer receives the received data X, the value obtained by subtracting the start time QB0 of the interim time zone from B0. The basic authentication data X is added to calculate the initial authentication data C 1 on the access side, and the initial authentication management step c for transmitting the initial authentication data C 1 to the accessed node,

 d, during the initial setting management step c, when transmitted by the access side and received by the accessed side s When the access side receives the basic authentication data X contained in the initial authentication data C 1 received by R 0 c B It is calculated whether or not 0 exists in the time region between the time R 0 when the first application is received on the accessed side and the time s R 0 when the initial authentication data C 1 is received. In the initial setting management steps d and e for initializing the nodes, the initial setting management step d sends the authenticated initial authentication data c1 to the accessee side, and the authentication basis generated in the initial setting management step b2 from the authenticated initial authentication data c1. The data X is subtracted, and the above-mentioned initial authentication data C 1 is added to this value to generate the initial authentication data S 1 of the accessed side at the accessed side, transmitted from the accessed side, and transmitted by the accessed side node. An initial setting management step e for receiving the initial authentication data S 1,

 f, generated at the initial setting management step e, transmitted to the access side, and received by the access side.c The initial authentication data S1 received at R0 is received from the access side inherent in the data S1. S R 0 when receiving the initial authentication data C 1 transmitted to the accessed side at the accessed side, when receiving the basic authentication data X at the access side c B 0 and when receiving the initial authentication data C 1 c R 0 An initial setting management step f for calculating whether or not the access-side node exists in the time domain, and authenticating the access-side node on the access side;

 An authentication and management device comprising:

11. In claim 10, generated based on the initial setting management step e. From the next time, the initial authentication data SI is stored or recorded as time data for accessing the accessed side and receiving authentication, or as time data relating to the basic data, and sequentially stores the data with the accessed side. Authentication / management device that decides to save or update the authentication data on the access side of communication performed between them.

1/1 8 Fig. 1

2/1 8 Fig. 2

3 Z 1 8

Fig. 3

 41 424 344 454 647 484 950 51 525 354 555 657 585 960 61 626 364 C3 certification type>

 C3≤S2

 C3- (SVR / Now) one (cR1) ≥S2— (sR2—sR1) one (sRI -Before SND: S1) S2≥C3≤S3- → 0≤ ((ConectOK) one (Disconnect))-((SVR / Now) one (cRI)) ≤ 1

 S2- (cR1 -cR0) ≤S2

 S2- (cR1 -cRO)-(SVR / Now)-(cR1) ≥

 S2— (sR2-sR1) — (sRI-Before SND: S1)

 0≤ ((ConectOK) -1 (Disconnect))-((SVR / Now) -1 (cR1)) ≤ 1

QEO settings

*: QE0 = Q + QB0

 K S3 certification type>

 S3≥C3

 S3≤C3 + (cR2-cR1) + (cR1--SND: C2)

 C2≤S2≥C3

 Disassembly of the above S3 certification formula>

 C3 + (sR2-sR1) ≥C3

C3 + (sR2-sR1) ≤C3 + (cR2-c1) + (cR1-one SND: C2)

1

 * Time and distance are equivalent 01

[SEE basic data: X

n

\

00

1

 0

<Basic authentication data and authentication data at the time of initial authentication>

 Communication 1 Communication 2 Communication 3 Μί 4 Communication 5 Communication 6

 SRV X transmission C1 reception / SI generation S1 transmission

 CLT X reception / C1 generation C1 transmission S1 reception / C2 generation

\ 6

Distance (QEO) Start ~ * Transmit B1—Receive B2 → Transmit B3—Receive B4—Transmit B5 → Receive B6—CPU processing B7 → Transmit B8—Receive Β9 · → End

Start Reception Β2 Transmission Β3 Reception Β6 Transmission Β8 End

Ko: 1'-tutor <A>

-0

CO

Ko: futa <B>

 Transmission B1 Reception Β4 Transmission

 Reception Β9

Time (QE0)

QB0

Distance> <Formula for e-side initial authentication data c1>:

 QEO C1 = X + (X received one SRV / ow)

 S-side initial authentication data: S1 generation formula>:

 S1 = C1 + (C1 received one request I received)

A4: SRV / Now transmission

 A3: Acquire SRV / Now A7: Request

 A2: Initial reception << Reception Reception A9: X transmission A13: C1 reception A15: S1 transmission

 SRV / Combu ~ $

 A8: X generation-A14: S1 generation

 <Point A>

 O

00

CLT / Computer

 <Point B> —►

 A1: First time A5: SRV / Now A6: First time A10: X received A12: C1 sent A16: S1 received ffi

 A11: C1 generated A17: C2 generated

QE0 <time>

OB0

2/1 8

2 Figure

Server side client II

3/1 8

 Fig. 3

 S e r v e C I i e n t 2

00

\ Four 5/1 8

 5 Figure

 Q = i 'time limit (special time [¾]

Q

O Start point H End point H

Distance Time = Q H

o

H i