WO2006003725A1

WO2006003725A1 - Web server authentication system capable of performing web access point authentication (wapa)

Info

Publication number: WO2006003725A1
Application number: PCT/JP2004/013973
Authority: WO
Inventors: Akihiko Narita
Original assignee: Akihiko Narita
Priority date: 2004-07-01
Filing date: 2004-09-15
Publication date: 2006-01-12
Also published as: JP2007279775A

Abstract

There are included a server authentication system incorporated in a web server; a client terminal; and an authentication information registration server for storing authentication information. The web server includes browsing request receiving means for receiving a browsing request and a server authentication request from the client terminal; authentication information checking means for checking the web server authentication information for the authentication information registration server; authentication information receiving means for receiving authentication information as checked; authentication information adding means for adding the authentication information to web contents; and web content transmitting means for transmitting the web contents to the client terminal. The authentication information registration server stores the authentication information and the user identification information.

Description

Web Access point authentication (WAPA) enabled web server authentication system

The present invention relates to web server authentication systems.

Background art

book

In recent years, the spread of the Internet has been remarkable, and this has led to security problems. For this reason, it is one of the important security measures to confirm the safety of the website.

Patent Document 1 Japanese Unexamined Patent Application Publication No. 2003-337797

Patent Document 2 Japanese Patent Application Laid-Open No. 2002-373080

For example, in Japanese Patent Application Laid-Open No. 2003-337797 “We b site safety authentication system, method and program”, a program of a provider (I SP) conducts site safety survey, stores safety in a database, and the browser of a user In response to this, a system has been proposed to inform this degree of security information.

Also, in Japanese Patent Laid-Open No. 2 ◦ 03 30 080 "Client's Server 'System", in a system for downloading contents from a server to a mobile phone, it is possible to determine whether the appropriate game delivery file etc. has been received from the appropriate server. A system has been proposed to perform an authentication check. In JP 2002-140309 “Service system”, data delivery between server and client is performed through a data relay device, and a system is proposed in which the server provides a service to the client. The management server is connected to the relay server during data connection, and is used to

— Although authentication information is managed, and it is described that data will be distributed between the client and server after authenticating the server, but the client does not particularly authenticate the web server. Disclosure of the invention

Today, it is possible to use a number of techniques to assist web server authentication of who is accessing web servers. However, such technology can not prevent end users from accessing unauthenticated websites. For example, a hacker may create a home banking 'web page that is spoofed just like a real home banking · web page with the purpose of stealing mouth-in and pass-word information, and an end user attempts to access it. There is.

Computer technology is getting more complex every day, but the complexity of Internet 'security issues outweighs this. Furthermore, it may be difficult to understand the existence of the security problem itself before trying to understand the risks involved and their solutions.

As an example, we will describe the problems that can be solved using the conventional ATM (ATM).

If you want to use ATM, you must first find ATM. A T

As M is installed in large numbers in most urban areas, you can easily find it by looking for ATM signs. Once you find the ATM, you can usually easily operate it by inserting the ATM card and entering the PIN number. Figure 1 shows an illustration of an end user operating an ATM.

The appearance and feel of the ATM itself differs depending on the installation location. You probably won't usually wonder if ATM is credible or not. A T M may display “Error” or “Out of Service”. Such problems are rarely reported to banks, except when ATMs do not return ATMs. However, if the ATM is not reliable, as shown in Fig. 2, after recording the card information and PIN number, the card is returned and only "Error" is displayed on the display. There is a possibility.

There are even more sophisticated tactics, such as hackers transferring "mediator" information collected in real ATMs. In such a case, as shown in FIG. The car can make it appear as if the ATM transaction is complete to the end user and withdraws a large amount of cash.

Fraud shown in Figures 2 and 3 can be prevented if the end user has access to ATM authentication technology. In fact, it is unlikely that hackers will make a fake ATM and put it well in a public place.

However, since the website is digital, it can be more easily faked than ATM. Today, as described below, hacking methods are known that can reroute Internet access 'end traffic'. Hackers can carry out all these scams more carefully and anonymously than at ATM. Web 'Access Point Certification (WAPA) is a technology that recognizes and certifies websites for the end user.

The purpose of the knocker is to trick the end user and let the fake website created by the hacker enter confidential information. This can be done fairly easily depending on the web application.

Currently, in public places, Internet access via wireless access points called hotspots is available. Hotspots are usually commercial services that provide high-speed wireless internet access in public places such as coffee shops, train stations, and airports. Using mopile devices capable of wireless communication (802.l i b), users can check e-mails at the airport or purchase movie tickets from a coffee shop. The hot-selling hotspot restricts the use of the service to only its customers by self-certification by the end user. This is done by entering a username and password on the hotspot web page that is initially displayed when you start the web browser after connecting to the hotspot.

In the hot spot connection method, as shown in Fig. 4, the mopile equipment is configured to connect to a specific wireless network. This can be done by configuring the mopile device to connect to a specific SSID. S S ID (service setting identification) is the name of a wireless network. When the mopile device tries to make a wireless connection, an access port with the same S S I ID as the S S I D configured in the mobile device

3 Find an int. If an access point with the wrong SSID is found, the access point is rejected and continues searching for another access point with the correct SSID. If multiple access points with the same exact SSID are found, connect with the access point providing the best signal in order to perform the best wireless connection. The signal strength of all 800. lib radio access points is regulated by the FCC (Federal Communications Commission) to 30 milliwatts.

In theory, a hacker could set up a wireless access point with higher signal strength and the same SSID as the hotspot at the same hotspot location. This setting allows all hotspot users to be forced to connect to a wireless access point set up by a hacker without the end user being aware. The hacker provides a web page that mimics the hotspot authentication screen and stores all usernames and passwords. If the login name and password are entered, the user may be a bit creative, with an error message such as "Hotspot is currently unavailable. It seems to be deceived. This is similar to the ATM example of Figure 2 shown in Section 2.

Nowadays, setting up this type of web application is easy, for example, by using the Airsnarf free tool called Shraoo Gnorapé, which you can submit to http://airsnarf.shmoo.com/. be able to.

Even more sophisticated smart hackers can keep end users using Hotspots as normal, having all traffic to their Web server turned into Hotspots. Using this method, hackers can see everything an end-user does.

For example, if an end user is accessing his home banking, a hacker can steal information during access. This is similar to the ATM example shown in Figure 2 of Section 2. By using these methods to hacker hotspots, hackers can at least steal usernames and passwords for connecting to hotspots. This is the hot spot It was possible to prevent if the end user could authenticate whether the server was genuine or not.

By using a technique called URL spoofing, it is possible to transfer users to fake websites.

For example, the user clicks on a link labeled http: 〃 ww. Visa, com. In fact, the user is transferred to http: 〃 www. Hacker — web_site.com. By using a special code embedded in UR L, it is possible to look around the browser and display it as http: 〃 www.visa, com, but in practice it is http: // ww. hacker—web— site, com web page is displayed. A URL spoofing link will be sent to the end user using the worm mail. With just a little system engineering, users seem to be able to access the fake web pages and enter their username Z pass information.

The previous hotspot 'hacking example used to transfer end users to a hacker's website using wireless signals. It is also possible to transfer end users to another web site on the LAN.

Access to a particular website is achieved by entering the appropriate URL of the particular website into the browser.

For example, to access the Yahoo! website, the user enters a URL such as http: www. Yahoo, com / in the browser. Such a URL name is actually an alias (alias definition) of a network address (IP address) such as "66.218.70.48". Usually, it is difficult to store such network addresses, so there is a service that automatically converts URL names to network addresses. DNS (Domain Name Server) maintains a table of domain names and network addresses. Because there are many DNS servers on the Internet, each computer is configured to use a specific DNS server when converting URL names to network addresses. .

In theory, by changing the network address entered in the DNS server, the end user is automatically forwarded to access the spoofed web server. It is possible to In order to do this, hackers need to hack DNS servers. This is not uncommon but not impossible.

Besides this, on the end user's computer, adjust the DNS settings in the "c: \ windows \ system 32 \ drivers \ etc \ hosts" file to the DNS server of the knocker. There is a way to reconfigure. Such reconfiguration can be done using malicious code, or even system engineering. Hackers reconfigure home page 's network' s network address so that confidential information such as home banking 'site' s home banking makes itself disguised as all access to home banking without being noticed by end users. It can be forcibly transferred to a web page. Again, after entering your login name and password, if you see an error message such as "Now home banking is not available. Please connect after a while." End users tend to be deceived. This is similar to the ATM example shown in FIG.

A more advanced and clever hacker can even change all the traffic to your fake home banking 'web server into a real home banking · website route. Using this method, hackers can see everything end users do on this website. This is similar to the ATM example shown in FIG. Hackers can use these websites' hacking methods to at least steal user names and passwords for websites that deal with confidential information. This theft could be prevented if the user could authenticate whether the web server was real.

In addition, many companies today interact with customers over the Internet. Most of these companies invest a great deal of money and effort in securing their own web server over the Internet. The good news is that there are a number of techniques for data encryption, such as various user authentication, and using such techniques can help to significantly improve the security of the power system. Companies can use such technology to know who is accessing their server and to protect data on the web server. However, such security solutions do not use Web Access Point Authentication (WAPA). These security solutions help protect the web server from hackers, but more precisely, they protect end users directly from hackers. Solutions such as encryption used in Internet communications (eg WEP, SSH) only protect data when intercepted by hackers. User authentication can only prove itself and does not authenticate the web server to the end user. That is, none of these technologies protect users from WAPA hackers.

Today, products or technologies aimed at authenticating web servers to end users are not known to the market. Currently, web authentication is only performed by web servers. For example, a web server can perform access control using the Administrator, or Access Z user management software to authenticate who is accessing the web server. However, this technology can not be used by a user to authenticate a web server as genuine. Means to solve the problem

Therefore, in the present invention, it is an object of the present invention to provide Web's Access Point Authentication (WAPA), which is a new Internet technology that solves the above various problems and provides web server certification to end users. I assume.

Web. Access point authentication is not just traditional web server authentication, but it helps the end user authenticate that the web server is authentic before sending secret information such as username and password. Purpose. The targeted application is a web service that initially requires the user to enter secret information such as a username and password, such as a hotspot wireless access point, a home banking 'website, etc. Includes service.

Web. Access Point Authentication (WAPA) is a client server. The For example, the server component resides on a web server, and the client component is, for example, an Acti V e X (TM) control. This provides an easy-to-use method for end users to prove that a web server is real or fake. The central authentication algorithm is implemented based on the public key cryptogram algorithm.

In order to solve the above problems, in the invention according to claim 1,

A server authentication system provided on a web server for performing web server authentication when accessing any server connected to a network through a browser,

A browsing request receiving unit for receiving a web content browsing request and a server authentication from a client terminal accessing the web server, and a certification request;

The authentication information registration server, which is set for each web server and stores authentication information for authenticating the web server, responds to a browse request from the client terminal and a server authentication request to authenticate the web server. Authentication information query means for querying information;

Authentication information receiving means for receiving the authentication information when there is authentication information of the web server as a result of the inquiry to the authentication information registration server;

Authentication information adding means for adding the received authentication information to the web content in response to the web content browsing request and the server authentication request from the client terminal, and transmitting the web content added with the authentication information to the client terminal It is characterized in that it is a web server authentication system provided with a web content transmission means.

Further, in order to solve the above-mentioned problems, in the invention according to claim 2, the web server is provided to perform web server authentication when accessing any server connected to the network through a browser. A system comprising: a server authentication system; a client terminal for accessing the web server; and an authentication information registration server configured for each web server and storing authentication information for authenticating the web server. There,

The web server is Browsing request receiving means for receiving a web content browsing request and a server authentication request from a client terminal accessing the web server;

The authentication information registration server, which is set for each web server and stores authentication information for authenticating the web server, is queried for authentication information of the web server in response to a browse request from the client terminal and a server authentication request. Authentication information inquiry means to

Authentication information adding means for adding received authentication information to the web content in response to a web content browsing request and a server authentication request from the client terminal; web content with the authentication information attached to the client terminal It is equipped with a web content sending means to send,

The authentication information registration server is a web server authentication system that stores at least authentication information for authenticating the web server and user identification information for each user who uses the server authentication system at the client terminal. It is characterized by

Further, in order to solve the above problems, in the invention according to claim 3, the client terminal includes an authentication request transmitting unit that transmits a server authentication request to the web server together with a web content browsing request;

It is characterized in that it is a web server authentication system provided with server public key storage means for storing the public key for each web server.

In order to solve the above problems, in the invention according to claim 4, the server authentication request transmitted from the client terminal and received by the browse request receiving means at the web server is a user of the server authentication system. In particular, it is a web server authentication system according to any of claims 1 to 3, which contains identification information.

Further, in order to solve the above problems, in the invention according to claim 5, the server authentication request transmitted from the client terminal and received by the browse request receiving means in the web server is the web server. Said server certification It is characterized in that it is the web server authentication system according to any one of claims 1 to 4, which includes a response request whether or not it has a certification system.

Further, in order to solve the above problems, in the invention according to claim 6, when the authentication information inquiry means inquires the authentication information registration server of authentication information of the web server, the user The web server authentication system according to any one of claims 1 to 5, which transmits a query request including identification information.

Further, in order to solve the above-mentioned problems, in the invention according to claim 7, the authentication and proof information inquiry means is set for each web server, and is stored in advance corresponding to the user identification information. The web server authentication system according to claim 6, wherein the authentication information of the web server is queried based on the user identification information.

Further, in order to solve the above-mentioned problems, in the invention according to claim 8, the authentication of the web server which is set for each web server and stored in advance corresponding to the user identification information In the information, the authentication information for each user generated at the client terminal is encrypted using the public key of the user, and then encrypted using the public key of the web server, and then the authentication information information is encrypted. Web server authentication system described in any of claims 1 to 7, which is stored by web server registration registered with the registration server.

In order to solve the above problems, in the invention according to claim 9, when a client terminal accesses any web server, the web is included in the server authentication request transmitted from the client terminal. If the web server has the server authentication system, the web server responds to the request to determine whether the server has the server authentication system or not, and the web server has the server authentication system. It is characterized in that it is a web server authentication system according to any one of claims 5 to 8, which does not respond when that is not the case.

Moreover, in order to solve the above-mentioned subject, in invention of Claim 10, When the client terminal stores the public key of the web server for decrypting the authentication information added to the web content, the authentication added to the web content received from the web server is stored. The web server authentication system according to any one of claims 1 to 9, wherein the information is decrypted using a secret key of a user who uses the client terminal to determine the legitimacy of the authentication information. It is considered special.

In order to solve the above problems, in the invention according to claim 11, when it is determined that the authentication information is not valid, a warning is displayed in the client terminal. It is characterized in that it is the web server authentication system described in 0.

In order to solve the above problems, in the invention according to claim 12, the client terminal stores the public key of the web server for decrypting the authentication information attached to the web content. If the web server is equipped with the server authentication system, the response is sent to the user, and the user of the client terminal is made to select whether or not to register the web server. The web server authentication system according to any one of claims 1 0 or 1 1. Effect of the invention

According to the present invention, it is possible to provide Web Access Point Authentication (WAPA), which is a new Internet technology that provides web server certification to end users.

Web access point authentication is not just a conventional web server authentication, but it is used to authenticate whether the web server is genuine before transmitting secret information such as a username and password. It is intended to help the user. The targeted application is a web service that initially requires the user to enter confidential information such as a username and password, which includes services such as hotspot wireless access points, home banking and websites. . This provides an easy-to-use method for end users to prove that a web server is real or fake. The core authentication algorithm is realized based on the public key encryption algorithm. Brief description of the drawings

FIG. 1 is a diagram showing a conventional example.

FIG. 2 is a diagram showing a conventional example.

FIG. 3 is a diagram showing a conventional example.

FIG. 4 is a diagram showing a conventional example.

FIG. 5 is a system configuration diagram showing an example of the basic configuration of the system of the present invention.

FIG. 6 is a diagram showing a representative example of a server authentication pattern using the system of the present invention.

FIG. 7 is a flowchart showing an example of the basic process flow of the system of the present invention.

FIG. 8 is a flowchart showing an example of the basic processing flow of the system of the present invention.

FIG. 9 is a flowchart showing an example of the basic process flow of the system of the present invention.

FIG. 10 is a flowchart showing an example of the basic processing flow of the system of the present invention.

FIG. 11 is a flowchart showing an example of the basic processing flow of the system of the present invention.

FIG. 12 is a flow chart showing an example of the basic process flow of the system of the present invention.

FIG. 13 is a flowchart showing an example of the basic processing flow of the system of the present invention.

FIG. 14 is a flowchart showing an example of the basic processing flow of the system of the present invention. FIG. 15 is a flowchart showing an example of the basic process flow of the system of the present invention.

FIG. 16 is a flowchart showing an example of the basic processing flow of the system of the present invention.

FIG. 17 is a flow chart showing an example of the basic process flow of the system of the present invention.

FIG. 18 is a flowchart showing an example of the basic process flow of the system of the present invention.

FIG. 19 shows a flow chart showing an example of the basic process flow of the system of the present invention.

FIG. 20 is a flowchart showing an example of the basic processing flow of the system of the present invention.

FIG. 21 is a flow chart showing an example of the basic processing flow of the system of the present invention.

FIG. 22 is a flow chart showing an example of the basic process flow of the system of the present invention.

FIG. 23 is a flowchart showing an example of the basic process flow of the system of the present invention.

FIG. 24 is a flowchart showing an example of the basic process flow of the system of the present invention. BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

The system of the present invention is a server authentication system provided in a web server for performing web server authentication when accessing any server connected to a network via a browser.

In other words, a web browser set to use the system of the present invention It is one bar.

Also, the system of the present invention includes a server authentication system provided on a web server for performing web server authentication when accessing any of the servers connected to the network via a browser, and accessing the web server. The system is configured to include a client terminal and an authentication information registration server which is set for each web server and stores authentication information for authenticating the web server.

That is, it is configured by any web server set to use the system of the present invention, and an authentication information registration server that operates in cooperation with this and stores authentication information for each web server.

Also, a public key server is provided that stores the public key of each web server in a usable state for the user. The public key server causes the user to store the public key for each web server in the local database in the client terminal using the public key for each web server, and to register authentication information for each server in the authentication information registration server. Is for server registration processing. As a user terminal for connecting to the server system of the present invention, a computer terminal such as a personal computer or a workstation is usually used. In addition, the user terminal includes a wireless communication terminal such as a mobile phone equipped with a browser function capable of connecting to the Internet, a portable information terminal, an internet TV, a game device, a video conference system, and other network connection functions. It may include a wide range of appliances such as home appliances. The computer terminal includes control means, storage means, input means, output means, display means and the like. It also has the function of connecting to a computer network represented by the Internet and sending and receiving data, and is usually equipped with a browser, e-mail software, application programs such as a word processor, and an operating system (OS). is there.

The server is connected to a network represented by the Internet. The network is usually assumed to be the Internet, but a network form connected by a leased line, a corporate LAN, a corporate LAN, a WAN, etc. The form of communication line used widely includes the form of wired communication and wireless communication widely, and it includes the form using satellite communication, B 1 uetooth, etc. The web server authenticated in the system of the present invention stores content data and application programs for accessing from the user terminal, and the content data is displayed on the WEB such as HTMLL file and XLL file. Data files and data files displayed on mobile phones etc. that can access the WEB site such as C--H TML files. In addition, it stores character data files, audio data files, image data files, moving image data files, animation data files, and various other content data that are displayed or output by being inserted into these files. It is possible.

First, I will explain about the web server.

A web server using the system of the present invention includes browsing request receiving means for receiving a web content browsing request and a server authentication request from a client terminal accessing the web server.

A web content browsing request is a generally known browsing request that sends an HTML request by entering a URL or clicking a hyperlink using a browser.

Here, in the system of the present invention, together with the web content browsing request, a server authentication request for proving the legitimacy of the server is included.

In addition, the server authentication request transmitted from the client terminal and received by the browse request receiving unit at the web server includes the user identification information of the server authentication system.

The server authentication request can be included in the HTTP GET request sent from the client to the server authentication system compatible server, and more preferably, the server authentication request further includes the server authentication system user ID of the client. There is.

According to yet another preferred embodiment, the server authentication request is separate from the TC GET request separately from the HTTP GET request sent from the client to the server authentication system enabled server. It can be made to be included in the data transmitted / received by the socket communication between the client and the server using P communication, and more preferably, the server authentication request further includes the server authentication system user ID of the client. Socket (Socket) is an abstracted interface for creating TCPZIP application, and performs communication by the procedure of creating a socket, connecting to a server, communicating with a server, and destroying a socket. A socket is used to perform data communication using a send / receive program between com- puters in the same way as an output file's input program.

System calls used for TCP communication are known: socket O socket creation, connect O socket connection, read O data reception, write O data transmission, close O socket deletion etc. on the client side, socket O socket creation on the server side, bind () Socket registration, listenO socket connection preparation, acceptO socket connection wait, readO data reception, writeO data transmission, closeO socket erase, etc. are known.

Before communication starts, both the client and server first create a socket, one side of the server waits for a communication connection request from the client, the client side sends a communication connection request to the server side, and the server socket Once a communication connection has been established between the client's sockets, data transmission and reception will begin.

Among the above system calls, socketO generates a socket, and the server side uses three system calls of bindO, listenO, and acceptO to put a socket in a connection waiting state. The client side creates a socket by socketO, sends a connection request to the server by connectO, and after connecting, writes data to the socket via writeO system call to each socket and sends it to the other side. Reading the socket through the readO system call allows you to receive the data sent by the other party. Repeat transmission and reception of data by writeO and readO system calls until communication is completed. Communication ends when either of them executes the closeO system call and disconnects the communication connection.

More preferably, the server authentication request transmitted from the client terminal and received by the browse request receiving means at the web server is the web server. It includes a response request as to whether or not one is equipped with the server authentication system. A response request sends a web content browsing request from the user terminal, and checks whether the web server that is attempting to browse is compatible with the web 'access point certification (WA PA) which is the system of the present invention. Response request.

When a client terminal accesses any of the web servers, the server authentication request included in the server authentication request sent from the client terminal is a response to the response request as to whether the web server has the server authentication system or not. If the web server is equipped with the server authentication system, the response is responded, and if the web server does not have the server authentication system, the response is not returned.

Next, the web server is set for each web server, and the authentication information registration server storing authentication information for authenticating the web server is responded to the browse request from the client terminal and the server authentication request. A web server is provided with authentication information inquiry means for inquiring authentication information.

The authentication information inquiry means transmits an inquiry request including the user identification information to the authentication information registration server, which is a database server having registered authentication information, when the authentication information of the web server is inquired. The user identification information is, for example, a user ID of the system of the present invention.

The authentication information is preferably authentication information for each user corresponding to the user identification information of the server authentication system, which is included in the server authentication request transmitted from the client terminal.

As authentication information for each user, the user performs server registration processing described later on the client terminal, and generates authentication information for each user using the public key for each server and, preferably, the public key for each user. It is registered.

Further, also in communication between the web server and the authentication information registration server, necessary data can be transmitted / received by socket communication using the above-mentioned TCP communication. '

Next, the web server, as a result of the query to the authentication information registration server, The authentication information receiving means is provided to receive the authentication information when there is authentication information of the server.

The authentication information inquiring means inquires, based on the user identification information, authentication information of the web server which is set for each web server and stored in advance corresponding to the user identification information.

If there is the corresponding authentication information as a result of the inquiry, the authentication information is received by the web server.

Next, the web server is provided with authentication information addition means for adding the received authentication information to the password in response to the web content browsing request and the server authentication request from the client terminal.

The data format of the authentication information can adopt various data formats, for example, digital certificates, and other data formats.

Preferably, the authentication information of the web server, which is set for each web server and stored in advance corresponding to the user identification information, is the authentication information for each user generated at the client terminal. It is stored by web server registration registered in the authentication information registration server after encryption using a public key, and subsequent identification using a public key of the web server.

The authentication information is added by adding data to the HTML file and other web contents to make the data file that the browser can interpret and display on the client terminal of the user. For example, it can be displayed as image data etc. such as a server certificate.

In addition, if the per-user authentication information is generated by double encryption using the per-web server public key and the per-user public key, decryption is performed using the web server's secret key, Enable to enable decryption at the client terminal of the user with a secret key.

Next, the web server includes web content transmitting means for transmitting the web content to which the authentication information is added to the client terminal.

The web content transmission unit is configured to perform authentication according to the web content browsing request. The web content to which the information is added is transmitted to the client terminal of the user in the same manner as normal web content browsing.

Also, according to another preferred embodiment, appending of authentication information is not to add data to the HTM L file and other web contents, but separately from the client using TCP communication. Data transmitted from the web server to the client terminal can be made to include authentication information by socket communication between the servers.

Next, the authentication information registration server will be described.

The authentication information registration server is an authentication information registration server that stores authentication information for each of the processing servers, which operates in cooperation with one of the web servers set to use the system of the present invention. Preferably, the authentication information registration server is a data base server provided for each web server using the system of the present invention.

The authentication information registration server stores at least authentication information for authenticating the web server, and user identification information for each user who uses the server authentication / certification system at the client terminal.

Next, the client terminal will be described.

The client terminal is provided with an authentication request transmission means for transmitting a server authentication request to the web server together with a web content browsing request. The authentication request is a request to prove the legitimacy of the server as described above, and further checks whether the system of the present invention is compatible with the Web access point certification and certification (WA PA). Includes a request for a response.

The authentication request transmission function for transmitting these requests may be added to, for example, a normal browser. It may be a browser dedicated to the system of the present invention.

Also, the client terminal is provided with server public key storage means for storing the public key for each of the web servers. The server public key storage means is a local database that allows the user to store the public key for each web server at the client terminal. Web server registration from a public key server By downloading the corresponding public key and registering the authentication information for each server in the authentication information registration server, the server public key storage means, which is a local database, performs the public key when server registration processing is performed. Remember.

If the client terminal stores the public key of the web server for decrypting the authentication information attached to the web content, the client terminal receives the authentication information attached to the web content received from the web server. It decrypts using the secret key of the user to use, and determines the legitimacy of the authentication information. If it is determined that the authentication information is not valid, a warning such as a warning is displayed on the client terminal is output.

In addition, the client terminal does not store the public key of the web server for deciphering the authentication and certification information attached to the web content, in which case the web server is the server authentication system. If the client is used, the user is made to select whether or not to register as a web server, as well as to that effect.

The basic process flow of the present invention will be described below. The flow of the process shown here is an example, and is not limited to this, and various applications and modifications are possible.

The following is a description of the general transactions that the WAPA technology performs to authenticate the web server as appropriate.

FIGS. 7 to 24 are flowcharts showing an example of the basic process flow of the present invention.

First, referring to FIG. 7 and FIG. 8, for the real server equipped with the Web 'access point authentication (WA PA) of the present invention system, WAPA correspondence not registered in the server is performed. The process when accessing from the client terminal is explained.

This is because a web 'access point certification (WA PA) -enabled client does not have this server registered, so it is considered as an unknown site. This is the process when an access point authentication (WA PA) compliant web server is attempted.

For Web access point authentication (WAP A) client terminals, it is preferable to give the user an option as to whether or not to register the web server. When the user approves this, the client terminal performs registration processing of a queue access point authentication (WAP A) -compatible buffer server described later. When the server registration process is completed, the Web 'Access Point Authentication (WAP A) compliant client will be able to authenticate the Web' Access Point Certification (WA P A) compliant Web server in the subsequent transactions.

Referring to FIG. 7, the client terminal queries the server public key storage means (oral database) to find out that the web server is unregistered.

The client terminal sends a request for browsing, which is a request for browsing, to the web server. This request includes a response request whether the web server has a server authentication system.

In the case of the web server, since it is a server authentication system compatible server, a response message indicating that the web server is compatible with the server authentication system is included in the requested HTML file.

Next, the web server sends the HTML page to the client terminal compatible with the server authentication system.

At the client terminal, the user is given the option of registering a web server compatible with the server authentication system via the browser. Note that no alert is generated because it is a valid server.

FIG. 8 is a flow chart showing an example in which data necessary for server authentication is transmitted / received by TCP communication using a socket in communication between a client and a server as described above.

Next, referring to FIGS. 9 and 10, for the real server provided with the web access point certification (WA PA) of the present invention, the server corresponding to the registered WA PA is supported. Explanation of processing when accessed from client terminal Do.

This is the process when a Web 'Access Point Authentication (WAP A) compatible client attempts to access a Web' Access Point Authentication (WAP A) Web server that is already registered with the client.

The client provides the server with the user ID of the system of the invention to initiate an authentication transaction. At the server, the user

Extract based on D and return to the client terminal. The client terminal decrypts the authentication information package using the user's private key to prove that it is sent from a real server.

Referring to FIG. 9, the client terminal searches for the appropriate server authentication system user ID in the local database.

The client terminal sends an HTML request, which is a browsing request, to the server authentication / certification compatible web server. This request further includes the server authentication system user ID of the user at the client terminal. Upon receiving the browse request including the server authentication request, the web server compatible with the system of the present invention verifies the server authentication system user ID of the client.

The server queries the credential registration server for the user ID of the client user. The authentication information registration server searches for appropriate authentication information based on the user ID of the client. Next, the authentication information registration server sends the extracted authentication information to the server authentication system compatible web server.

In the web server corresponding to the server authentication and certification system,

H Include the authentication information in the TML page. From the web server, send an HTML page to the server authentication system compatible client.

Next, in the client terminal, in order to determine the legitimacy of the web server corresponding to the server authentication system, the client terminal uses the secret key to decrypt the authentication information, and the legitimacy of the web server. Prove. This process is performed by comparing the decrypted information with its local copy to see if there is a match. If the decrypted information matches, the server authentication system compliant server is authenticated by the client and its related information is displayed on the browser.

FIG. 10 is a flow chart showing an example in which the above processing is performed to transmit and receive data necessary for server authentication by TCP communication using a socket in communication between a client and a server, as described above.

Next, referring to FIG. 11 and FIG. 12, the web which has not been registered with the real server which does not have the web access point authentication (WAPA) which is the system of the present invention. 'We will explain the processing when accessing from Access Point Authentication (WAPA) compatible client terminal.

This is the process when a Web Access Point Authentication (WAPA) -enabled client attempts to access a real Web server that does not use Web Access Point Authentication (WAPA).

In order to determine whether the web server is compatible with Web 'Access Point Authentication (WAPA) WAP A, Web' Access Point Authentication (WAPA) Supported client terminal, Web 'Access Point Authentication (WAPA) compliant response Send a request to the web server.

Since the Web server can not authenticate because it does not use Web Access Point Authentication (WAPA), the client terminal does not perform any authentication, and does not issue an alert or generate any warning.

Referring to FIG. 11, the client terminal queries the local database to find out that the web server has not been registered.

Send an HTTP GET request, which is a browsing request, from the client terminal to the relevant web server. This request further includes a server authentication system response request whether the web server has a server authentication system. Since the web server does not have a server authentication system, it simply ignores this server authentication system compliance request.

The web server returns the requested HTML file without responding to the server authentication system support request. Since there is no signature package, authentication of the web server is not possible, and no warning is generated because the web server is not registered with the client.

FIG. 12 is a flow chart showing an example in which the above processing is performed to transmit and receive data necessary for server authentication by TCP communication using a socket in communication between a client and a server as described above.

Next, referring to FIGS. 13 and 14, for a real server not equipped with Web 'Access Point Authentication (WAPA), which is the system of the present invention, the server registered with the WA PA corresponding client is registered. We will explain the processing when accessing from the terminal.

This is a scenario where a Web 'Access Point Authentication (WAPA) -enabled client attempts to access a real server that does not have Web Access Point Authentication (WAPA).

This can happen due to unknown reasons when a real server becomes web 'access point authentication (WAPA) invalid.

Such a case is because even though the server information is registered with the Web 'Access Point Authentication (WAPA) client, the server can not return any Web' Access Point Authentication (WAPA) related information to the client. It should do something similar to a disguised web server. Fraud alerts need to be displayed on Web 'Access Point Authentication (WAPA) client terminals.

Referring to FIG. 13, at the client terminal, based on the website visited, the user ID of the appropriate server authentication system is searched in the local database.

The client sends an HTTP GET request, which is a browsing request, to the web server. This request also includes the user ID of the client's server authentication system.

Since the web server does not have the server authentication system of the present invention, the user ID of the client server authentication system is simply ignored.

The web server makes a request without responding to any server authentication system Send the HTML page

On the client terminal, the client displays a fraud alert because the registered web server could not send back the appropriate server authentication system authentication information.

FIG. 14 is a flowchart showing an example of data transmission / reception required for server authentication by TCP communication using a socket in communication between a client and a server as described above. .

Next, referring to FIGS. 15 and 16, the web 'access point authentication not registered in the server of the present invention is performed on the impersonation server equipped with the web' access point authentication (WAPA). (WAPA) The following describes the processing when a client terminal accesses it.

This is because the Web 'Access Point Authentication (WAPA) compliant client has not registered the server, so the Web' Access Point Certification (WAPA) compliant site is regarded as an unknown site regardless of its authenticity. This is a processing scenario when an attempt is made to access a fake web server.

A Web. Access Point Authentication (WAPA) -enabled client gives the user the option of registering the web server. When the user approves this, the client terminal performs registration processing of the Web 'access point authentication (WA PA) -enabled web server. The detailed transaction regarding registration of server information to the 'AP' access point authentication (W APA) client will be described later. When the registration procedure is completed, the Web 'Access Point Authentication (W APA) compliant client terminal will be able to authenticate the Web' Access Point Certification (WA A PA) compliant Web server in the subsequent transactions.

Referring to FIG. 15, the client terminal queries the local database, and finds that the corresponding web server is unregistered.

Send an HTTP GET request, which is a browsing request, from the client terminal to the relevant web server. In response to this request, the server authentication system corresponding response for checking whether the web server has the server authentication / certification system of the present invention or not. The request is included.

The web server constructs a fake server acknowledgment, certificate system acknowledgment message and incorporates it into the requested HTML file. Then, the Web server sends an HTML page to the server authentication system compatible client.

At the client terminal, the user is given the option of registering the web server.

Authentication of the web server is impossible. Since this web server is not registered with the client, no alert is generated.

FIG. 16 is a flow chart showing an example in which the above processing is performed to transmit and receive data necessary for server authentication by TCP communication using a socket in communication between a client and a server, as described above.

Next, referring to FIG. 17 and FIG. 18, for the spoofed server equipped with the web access point authentication (WA PA) which is the system of the present invention, the server WA has not been registered with the server. The process in the case of access from a PA compatible client terminal will be described.

This is the process when an attempt is made to access a spoofed web server impersonating a server that supports Web access point authentication (WAP A) -enabled client power and E. access point authentication (WAP A).

Because the spoofed web server does not have the proper authentication information package for each user, it may return an error to the client terminal or may try to return a bad authentication package. In either case, the client terminal displays a fraud alert.

Referring to FIG. 17, the client terminal searches for the appropriate server authentication and certification system user ID in the local database. +

Send a request for browsing, which is a browsing request, from the client terminal to the corresponding web server compatible with the server authentication system. This request also includes the user ID of the client's server authentication system.

The impersonation server corresponding to the server authentication system of the present invention confirms the user ID of the client, constructs a false authentication package, and requests the false authentication information. In the HTML page.

In the impersonation server corresponding to the server authentication system, HTML page is sent to the server authentication system corresponding client.

The client terminal receives the web content and decrypts the authentication information using the client's secret key to determine the legitimacy of the web server compatible with the server authentication system. Prove the legitimacy of the site. This is done by comparing the decrypted information with its local copy to see if there is a match.

Since the decrypted information does not match, at the client terminal, the web server is classified as a disguised website. The client terminal issues a fraud alert to the user and displays relevant information in the browser.

FIG. 18 is a flowchart showing an example of data transmission / reception required for server authentication by TCP communication using a socket in communication between a client and a server as described above.

Next, with reference to FIGS. 19 and 20, the system of the present invention, web 'access not certified as a server, is not registered to the disguised server not equipped with web access point authentication (WAPA). Describes the process when accessing from a point authentication (WAPA) compatible client terminal.

This is the process when a Web 'Access Point Authentication (WAPA) -enabled client attempts to access a fake Web server that does not use Web.Access Point Authentication (WAPA).

In order to determine whether the web server is compatible with Web 'Access Point Authentication (WAPA), Web' Access Point Authentication (WAPA) compatible client corresponds to Web 'Access Point Acknowledgment, Certificate (WAPA). The Web server sends a response request whether or not it is "^".

The web server can not be authenticated because it does not support web access point authentication (WAPA). Therefore, the client terminal does not perform any authentication and does not generate an alert.

Referring to FIG. 19, the client terminal queries the local database. In any case, know that the web server is unregistered.

A browsing request is sent from the client terminal, but an HTTP GET request is sent to the relevant web server. This request further includes a response request corresponding to a server authentication system for checking whether the web server is equipped with the server-one authentication system of the present invention.

Since the spoofed web server does not have the server authentication system of the present invention, it simply ignores the response request corresponding to the server authentication system.

The spoofed web server does not respond to the server authentication system response request and returns the requested HTML file.

Because there is no credential package, server authentication is not possible. The alert is not generated because the web server is not registered with the client and the web server does not have a server authentication system.

FIG. 20 is a flow chart showing an example in which the above processing is performed to transmit and receive data necessary for server authentication by TCP communication using a socket in communication between a client and a server, as described above.

Next, referring to FIG. 21 and FIG. 22, with respect to the impersonation server not equipped with the web access point authentication (WAPA) which is the system of the present invention, the web 'access point authentication registered in the server is WA PA) The process when accessing from a compatible client terminal is explained.

This is the process when a Web 'Access Point Authentication (WAPA) -enabled client attempts to access a fake server that does not have Web Access Point Authentication (WAPA).

This can happen due to unknown reasons when a real web server is disabled for web 'access point authentication (WAPA).

Even though the server information is registered with the Web 'Access Point Authentication (WA PA) client, such a server can not return any Web' Access Point Authentication (WAP A) related information to the client. The case should do something similar to a fake web server. Web's access point certification (WA PA) client terminal, display fraud alert There is a need to.

Referring to FIG. 21, at the client terminal, the user ID of the appropriate server authentication system is searched in the local database.

Send an HTTP GET request, which is a browsing request, from the client terminal to the relevant web server. This request also includes the user ID of the client's server authentication system.

The spoofed web server simply ignores the client's user ID since it does not have the server authentication system of the present invention.

Since the spoofed web server does not have the server authentication system of the present invention, it simply sends the requested HTML page.

The client displays a fraud alert because the registered web server can not send back the appropriate authentication information.

FIG. 22 is a flow chart showing an example in which the above processing is performed to transmit and receive data necessary for server authentication and authentication by TCP communication using a socket in communication between a client and a server, as described above.

Next, referring to FIG. 23, according to the system of the present invention, the real server with the Web 'Access Point Authentication (WAPA) is registered with the Web' Access Point Authentication (WAPA) compatible client terminal to the browser. Describe the server registration process to be performed.

Web Access Point Authentication (WAPA) authentication is performed using a public key encryption algorithm.

The implementation of public key encryption requires management of public and private keys between the sender and the receiver. As part of this authentication, a Web 'Access Point Authentication (W APA) enabled browser must maintain a list of public keys for Web' Access Point Authentication (WAPA) enabled web servers in a local database. ,.

This procedure is designed to allow clients to use the web's access point authentication (WAP A) enabled web server's public key and a web's access point authentication (WAPA) enabled web browser with a dedicated web server that can authenticate by default. The It can be done securely by downloading it from a Cesspoint certification (WA PA) public key server.

Referring to FIG. 23, a web server supporting server authentication system is registered in the client terminal.

The client terminal requests a signed public key of the server authentication system compatible web server from the public key server.

The public key server searches for the appropriate signed public key of the server authentication system compatible web server. The public key server then sends the signed server public key of the server authentication system Web server to the client terminal.

At the client terminal, the authentication information of the user is generated, and this information is encrypted using the client's public key, and then this encrypted information is stored in the server server supporting the server authentication system. Use your public key to sign again. The client terminal sends this doubly encrypted authentication information to the corresponding web server compatible with the server authentication system.

The web server receives the authentication information of the user transmitted from the client terminal, transmits it to the database server which is a server for uniform authentication, and stores it in association with the user ID.

Next, with reference to FIG. 24, a process of registering a public key from a Web 'access point authentication (WAP A) compatible web server will be described.

Web. Access Point Authentication (WAP A) authentication is performed using public key cryptography algorithms.

Web. Access Point Authentication (WA PA) A dedicated Web 'Access Point Authentication (WA PA) to securely and securely transmit the public key of the Web server to a Web' Access Point Authentication (WAPA) compatible client terminal. Use a public key server. It is desirable that the public key stored on the public key server be accompanied by a recording option if it can be signed by a third party certification authority owner to ensure public key authentication. .

Referring to FIG. 24, the web server generates a combination of public key and private key. Then, the web server sends the public key to the third party certification authority holder's system.

In the certification authority owner's system which is a third party organization, prove the legitimacy of the web server and sign the public key of the web server. Next, the signed public key is directly transmitted from the third party certification authority holder's system to the public key server of the system of the present invention.

The public key server receives the signed public key and stores it in association with the identification information identifying the web server so that it can be used by the server authentication system compatible client.

It is desirable that the public key server notify the owner of the web server that the public key is available at the client terminal.

By the above processing, the web server is regarded as a web server compatible with the server authentication system, and the user can register the web server using the browser of the client terminal. Industrial applicability

As described above in detail, according to the present invention, it is possible to provide web access point authentication (WAA), which is a new Internet technology for providing web server certification to end users.

Claims

1. A server authentication system provided in a web server for performing web server authentication when accessing any server connected to the network through a browser,

View web content from a client terminal accessing the web server

Browsing request receiving means for receiving a browsing request and a server authentication request;

The authentication information registration server, which is set for each web server and stores authentication information for performing authentication and certification of the web server, requests browsing information from client terminals to the authentication information registration server.

3⁄4 car

To query the authentication information of the web server in response to the server and server authentication request

Proof information inquiry means,

Authentication information adding means for adding the received authentication information to the web content in response to a web content browsing request and a server authentication request from the client terminal; web content with the authentication information added to the client terminal Web server authentication system characterized in that it has a web content transmission means to transmit.

2. A server authentication system provided on the group server to perform web server authentication when accessing any server connected to the network through a browser, a client terminal for accessing the web server, and a web server And a certification information registration server that stores certification information for performing certification of the web server, the web server comprising:

A browsing request receiving unit for receiving a web content browsing request and a server authentication request from a client terminal accessing the web server;

The authentication information registration server, which is set for each web server and stores authentication information for authenticating the web server, responds to a browsing request from the client terminal and a server authentication / certification request to the authentication information registration server. Authorization to query authentication information, Proof information inquiry means,

Authentication information adding means for adding the received authentication information to the web content in response to a web content browsing request and a server authentication request from the client terminal; web content with the authentication information added to the client terminal It is equipped with a web content sending means to send,

The web server is characterized in that the authentication information registration server stores at least authentication information for authenticating the web server and user identification information for each user who uses the server authentication system in the client terminal. Certification system.

3. The client terminal includes authentication request transmitting means for transmitting a server authentication request to the web server together with a web content browsing request;

A web server authentication system, comprising: server public key storage means for storing a public key for each web server.

4. The server authentication request transmitted from the client terminal and received by the browse request reception unit in the web server includes a user identification information of the server authentication system, and the server authentication request is characterized in that 1 to ³ Web server accreditation, certification system described in any of the.

5. The server authentication request transmitted from the client terminal and received by the browsing request receiving means at the web server includes a response request as to whether the web server includes the server-one authentication system. The web server authentication system according to any one of claims 1 to 4, characterized in.

6. The authentication information inquiry means transmits an inquiry request including the user identification information when inquiring the authentication information of the web server to the authentication information registration server. The web server authentication system according to any one of 1 to 5.

7. The authentication information inquiry unit is set for each web server, and the web server is stored in advance corresponding to user identification information. The web server authentication system according to Claim 6, wherein the first authentication information is queried based on the user identification information.

8. The authentication information of the web server which is set for each web server and stored in advance corresponding to the user identification information is the authentication information for each user generated at the client terminal as the public key of the user. , And then encrypted using the public key of the web server, and then stored by the web server registration registered in the authentication information registration server. The web server authentication system according to any one of ~ 7.

9. When a client terminal accesses any web server, it responds to the response request for whether the web server includes the server authentication system, which is included in the server-one authentication request sent from the client terminal. The Web server responds when the Web server includes the server authentication system, and does not respond when the Web server does not include the server authentication system. A buzzer according to any of the ranges 5 to 8. The certification system.

If the public key of the web server for decrypting the authentication information added to the web content is stored in the client terminal, the web terminal received from the web server is attached to the web content received from the web server. The authentication information according to any one of claims 1 to 9, wherein the authentication information is deciphered using a secret key of a user who uses the client terminal, and the legitimacy of the authentication information is determined. Server authentication, certification system.

The web server authentication system according to claim 10, wherein a warning is displayed on the client terminal if it is determined that the authentication information is not valid.

1 2. The client terminal does not store the public key of the web server for decrypting the authentication information attached to the web content, in which case the web server includes the server authentication system In this case, the client terminal responds as well, and asks the client terminal whether to register as a web server. The web server and authentication system according to any one of claims 10 or 11, characterized in that the user is selected.