JP2019020902A - Authentication server, authentication core system, authentication system, and authentication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication technique capable of suppressing a burden of communication processing with high security while being simple operation. An authentication server transmits a first token to a first terminal requesting access to an application server, is transmitted from a second terminal capable of LTE communication, and is transmitted via an EPC. The second token is received, it is determined whether the first token and the second token match, and if the first token and the second token match, the LTE related to the second terminal from the EPC Information that acquires LTE user information that identifies communication users, and that the LTE user information is permitted to log in to the application user information database that identifies users who are permitted to access the application server. If it is determined whether or not the LTE user information is permitted to log in to the application user information database, a login permission is sent to the application server to allow an access request from the first terminal. .. [Selection diagram] Fig. 2

Description

  The present invention relates to an authentication server, an authentication core system, an authentication system, and an authentication method.

  In order to prevent unauthorized access, a strong security authentication method is required. On the other hand, generally used authentication methods require input of a password, biometric authentication information, etc., and often require complicated operations.

  Patent Document 1 discloses an authentication system that employs push authentication in which at least two terminals are combined. This aims to realize authentication by simple operation while enhancing security.

Japanese Patent No. 6104439

  In the authentication system as disclosed in Patent Document 1, the reliability of authentication depends on the terminal ID, which is identification information unique to the terminal. Such a terminal ID has a limit in prevention of impersonation, and if it is impersonated, there is a possibility that security is lowered.

  The present invention provides an authentication technique that can achieve both a simple authentication operation and high security.

  The authentication server of the present invention transmits the first token to the first terminal that requests access to the application server, is transmitted from the second terminal capable of LTE communication, and is transmitted via the EPC. 2 tokens are received, it is determined whether or not the first token and the second token match, and when the first token and the second token match, the EPC receives the second token. LTE user information specifying a user of LTE communication related to the second terminal is acquired, and the LTE user information is stored in an application user information database that specifies a user permitted to access the application server. It is determined whether login is permitted or not, and the LTE user information is permitted to log in to the application user information database. If the information that is relative to the application server sends a login authorization to allow access request from the first terminal.

  The authentication method implemented by the authentication server of the present invention transmits a first token to a first terminal that requests access to an application server, is transmitted from a second terminal capable of LTE communication, and passes through an EPC. Receiving the second token transmitted in step S4, determining whether the first token and the second token match, and if the first token and the second token match, An application user who acquires LTE user information for specifying a user of LTE communication related to the second terminal from the EPC, and for which the LTE user information specifies a user permitted to access the application server. It is determined whether or not login to the information database is permitted, and the LTE user information is a database of the application user information. If the information that login to have been permitted, to the application server sends a login authorization to allow access request from the first terminal.

  The authentication technique of the present invention can further improve the safety and suppress the burden of communication processing while suppressing the burden of user operation.

1 is a schematic diagram of an authentication system according to an embodiment of the present invention. The sequence diagram which shows the sequence which the authentication system of embodiment performs.

  Hereinafter, specific embodiments of a communication method according to the present invention will be described in detail with reference to the drawings. The prior art described in Patent Document 1 realizes a simple authentication method that does not require input of knowledge authentication information other than identification information such as a user ID and a card ID, property authentication information, and biometric information at the time of authentication. The purpose is to do. Also, when push authentication is requested, a push ID is generated and transmitted to the first terminal and the second terminal, and the push ID via the first terminal and the push ID via the second terminal are collated. The purpose is to realize a strong security authentication method.

  However, in the above prior art, the reliability of authentication depends on the terminal ID that is unique identification information of the second terminal 4. Such a terminal ID has a limit in the defensive measures against impersonation (for example, duplication of the MAC address of another person's terminal), and there still remains a concern about safety in the sense that the possibility of impersonation to some extent cannot be denied.

  In addition, since there is a possibility that a push notification to the second terminal 4 triggered by the operation of the first terminal 3 may occur at an arbitrary timing, the second terminal 4 is always permitted to log in. Communication is necessary to maintain the state made. This may lead to an increase in communication burden such as an increase in communication sequence and communication cost.

  FIG. 1 is a schematic diagram of an authentication system 100 according to an embodiment of the present invention, which realizes the solution of the problems as described above. The illustrated authentication system 100 is only one embodiment, and the authentication system to which the present invention is applied is not limited to such a form. The authentication system 100 according to the embodiment includes a first terminal 10, a second terminal 20, an application server (AP server) 30, an authentication server 40, and an EPC (Evolved Packet Core) 50. Further, the authentication server 40 and the EPC 50 constitute an authentication core system 60. In the present specification, the “server” includes not only one server but also a plurality of servers.

  As the first terminal 10 and the second terminal 20, any appropriate terminal such as a PC, a smartphone, a tablet terminal, a terminal including an IC card reader / writer, a terminal capable of communicating with a portable terminal, or the like can be used. Here, at least the second terminal 20 is capable of LTE (Long Term Evolution) communication, and performs communication under an LTE communication system that uses LTE protocol data (specifically, packet data) as a communication protocol. It is a terminal. LTE is a further speed-up of the third generation mobile communication standard (3G) established by 3GPP (Third Generation Partnership Project), and is called 3.9G or 4G.

  The second terminal 20 has a photographing device (camera) having a photographing function. The imaging device may be incorporated in the second terminal 20 or may be connected to the second terminal 20 separately from the second terminal 20.

  The application server (AP server) 30 is a server that stores an application (site or the like) that a user requests access using the first terminal 10, and is installed by a provider that provides a service by the application. After the authentication according to the present embodiment, the first terminal 10 can substantially access the application server 30.

  The authentication server 40 is a server that performs authentication. In this embodiment, the authentication server 40 determines (authenticates) whether or not a terminal that attempts to log in to the application server 30 is permitted to access, thereby preventing unauthorized access. Is to do. The application server 30 is often installed by the service provider described above. The application server 30 and the authentication server 40 may be provided integrally.

  The authentication server 40 includes an authentication processing unit 41 and a user information management unit 42. The authentication processing unit 41 is a control unit that bears the main part of the authentication processing by the authentication server 40. The user information management unit 42 uses an application provided by the user of the authentication system 100, particularly the application server 30, not an ID unique to each terminal (for example, a physical address such as the MAC address of the terminal). Information (application user information) that identifies users who are permitted to access the server 30 in advance is stored and managed. That is, the user information management unit 42 functions as a database of application user information. The user information here includes, for example, IMSI (International Mobile Subscriber Identity), telephone number, and other contractor information (such as a unique ID uniquely assigned for the authentication system). The line ID (customer ID) to be provided is included.

  The EPC 50 is a core network standardized by Release 8 of 3GPP, and is established at the same time as LTE established by 3GPP, and can accommodate various wireless accesses. The EPC 50 includes an S-GW (Serving Gateway) 51, a P-GW (Packet Data Network-Gateway) 52, an API (Application Programming Interface) providing unit 53, an AAA server (Triple Aserver) 54, and an HSS (Home). Subscriber Server) 55 and MME (Mobility Management Entity) 56 are included. However, the EPC 50 is not limited to such a configuration, and may include other incidental elements.

  The S-GW 51 and the P-GW 52 constitute, for example, an ESPG (EPC Serving and PDN Gateway) that processes transmission of U-plane data that is user data. The S-GW 51 is a packet gateway that accommodates the 3GPP access system and transmits data. The P-GW 52 is a gateway that performs IP address assignment, packet transfer, and the like at a connection point with an external network (PDN).

  The MME 56 is a logical node that is connected to the S-GW 51, accommodates an access point connected to the EPC 50, and provides mobility control and the like, and includes mobility control such as location registration, paging, handover, and bearer (data transmission path). ) Is established or deleted.

  The HSS 55 is a subscriber management database in LTE, and is a database for registering LTE user information for specifying a user who subscribes to an LTE communication service and uses the LTE communication. The HSS 55 also manages user contract information, authentication information, location information, and the like as LTE user information together with a line ID and the like. The MME 56 performs user authentication based on the authentication information notified from the HSS 55. Such LTE user information is generally stored in a SIM (Subscriber Identity Module) attached to the second terminal 20 or the like, and identifies a user who uses the LTE communication system.

  The AAA server 54 is connected to the P-GW 52 and controls access to resources such as a database based on authentication, and includes RADIUS (Remote Authentication Dial In User Service) and the like. The AAA server 54 functions as an IP address issuing unit that issues (assigns) an IP address to each terminal, and stores the telephone number and / or IMSI of each terminal in association with the IP address. In particular, the AAA server 54 holds at least the IP address of the second terminal 20 used by the user of LTE communication (for example, registered when the user subscribes to the LTE communication service), and does not hold the IP address. Different from HSS55. The AAA server 54 functions as a database of LTE user information like the HSS 55. As will be described later, the LTE user information registered in the LTE user information database including the AAA server 54 and the HSS 55 is registered in the user information management unit (application user information database) 42 of the authentication server 40. It has application user information and a common information format (various line IDs, etc.), which can be compared.

  The API providing unit 53 plays a role of an interface related to the exchange of information between the authentication processing unit 41 of the authentication server 40 and the AAA server 54 and the HSS 55 of the EPC 50. In particular, the API providing unit 53 first queries the AAA server 54 for the IP address of the second terminal 20 received from the authentication server 40.

  FIG. 2 is a sequence diagram illustrating a sequence executed by the authentication system 100 according to the embodiment. First, the user attempts a login request to access the application site to be provided to the application server 30 using the first terminal 10 such as a PC (step S101). Upon receiving this request, the application server 30 notifies the authentication server 40 by notifying this login request (step S102). The authentication processing unit 41 of the authentication server 40 generates a first token for login and transmits it to the first terminal 10 that is the login request source (step S103). The token here corresponds to a one-time password generated by a device such as the authentication server 40 and usable only for one-time authentication processing, and means information necessary for authentication.

  The first terminal 10 that has received the first token converts the token into a display format, such as a QR code (registered trademark), which can be read by an external photographing device and the like, and displays it on the display screen (step). S104). The user reads and captures the displayed QR code or the like using the photographing device of the second terminal 20 such as a smartphone, and stores the first token in the second terminal 20 (step S105). The second terminal 20 transmits substantially the same second token to the EPC 50 based on the photographed first token (step S106).

  The S-GW 51 and the P-GW 52 of the EPC 50 transmit the received second token together with the IP address of the second terminal 20 to the authentication server 40 (step S107). The authentication processing unit 41 of the authentication server 40 generates the second token transmitted from the second terminal 20 and transmitted via the EPC 50 (see step S106), and is transmitted to the first terminal 10 by itself. It is determined whether or not the first token (see step S103) matches (step S108). When the first token and the second token match, the authentication processing unit 41 requests user information of the second terminal 20 that has transmitted the second token in step S106, particularly LTE user information. The inquiry to be transmitted is transmitted to the EPC 50 together with the IP address of the second terminal 20 (step S109).

  The API providing unit 53 of the EPC 50 that has received the inquiry has registered the LTE user information corresponding to the received IP address of the second terminal 20 in the AAA server 54 and the HSS 55 that are LTE user information databases. An inquiry is made as to whether or not (step S110). Here, the API providing unit 53 inquires of the AAA server 54 that holds the IP address for the IP address received from the authentication server 40 (the HSS 55 does not hold the IP address). Here, in the user information management unit 42 of the authentication server 40, a telephone number is registered as application user information, and in the AAA server 54, as LTE user information corresponding to the IP address, 1) a telephone number, Or, 2) Assume a case where IMSI is registered.

  In the case of 1), the API providing unit 53 can acquire a telephone number based on the IP address. The API providing unit 53 transmits the acquired telephone number to the authentication server 40 in step S111 described later, whereby the authentication server 40 refers to the telephone number registered in the user information management unit 42 and confirms the login permission. Therefore, step S110 ends here.

  On the other hand, in the case of 2), the API providing unit 53 cannot acquire the telephone number even if it can acquire the IMSI only by making an inquiry to the AAA server 54, and step S112 described later becomes impossible.

  Therefore, in the case of 2), from the inquiry to the AAA server 54, the API providing unit 53 first acquires the IMSI corresponding to the IP address, and then uses the IMSI as the LTE user information registered in the HSS 55. Get a phone number. With this acquired telephone number, the processing after step S111 becomes possible as will be described later.

  The types of application user information of the user information management unit 42 and the types of LTE user information of the AAA server 54 are as follows.

Application user information of user information management unit 42 (A) telephone number, (B) IMSI, (C) other contractor information LTE user information of AAA server 54 (1) Telephone Number, (2) IMSI

  In the above assumption, when the combination of (A) and (1) or the combination of (B) and (2) exists in the authentication core system 60, the API providing unit 53 refers to the HSS 55. Instead, the acquired telephone number or IMSI may be transmitted to the authentication server 40. The combination of the application user information type of the user information management unit 42 and the LTE user information type of the AAA server 54 is arbitrary, and if both have a common type (phone number or IMSI), the API providing unit 53 may transmit the telephone number or IMSI acquired by referring only to the AAA server 54 to the authentication server 40. The processing of this part depends on the implementation of registration of user information in the user information management unit 42 and the AAA server 54, and the processing method of the API providing unit 53 may be changed as necessary.

  As described above, when the LTE user information (phone number or IMSI) corresponding to the IP address of the second terminal 20 is acquired from the LTE user information database (AAA server 54 and HSS 55), the API providing unit 53 The LTE user information is transmitted to the authentication server 40 (response to step S109) (step S111). Upon receiving the LTE user information, the authentication processing unit 41 of the authentication server 40 inquires of the user information management unit (application user information database) 42 about the LTE user information, and at least the LTE user information is It is confirmed whether or not the information is permitted to log in to the user information management unit 42 (or registration itself in the user information management unit 42) (step S112). When the user information management unit 42 confirms the login permission of the inquired LTE user information (or registration of the LTE user information in the user information management unit 42) (step S113), the authentication processing unit 41 A login permission for permitting an access request (login request) from the first terminal 10 is transmitted to the server 30 (step S114). The application server 30 that has received the login permission displays the screen after login, that is, redirects the first terminal 10 to the screen after login (step S115). As a result, the user can access the application server 30 using the first terminal 10.

  In the present invention, the EPC manages user information (LTE user information) of the second terminal that transmits the token, and authentication is executed based on the LTE user information and application user information. Therefore, according to the present invention, it is possible to eliminate the authentication process depending on the terminal ID unique to the terminal, particularly the unique ID of the second terminal, and it is possible to perform authentication more safely.

  In the present invention, since the authentication server starts authentication upon reception of a token transmitted from the second terminal, it is possible to delete the push notification to the second terminal, and reduce the communication sequence and communication cost. It becomes possible to do.

  Therefore, according to the present invention, it is possible to improve the safety and suppress the burden of communication processing while suppressing the burden of user operation by the authentication by the token through the two terminals.

  In addition, this invention is not limited to embodiment mentioned above, A deformation | transformation, improvement, etc. are possible suitably. In addition, the material, shape, dimension, numerical value, form, number, arrangement location, and the like of each component in the above-described embodiment are arbitrary and are not limited as long as the present invention can be achieved.

  ADVANTAGE OF THE INVENTION According to this invention, the authentication technique which can suppress the burden of communication processing with high safety | security can be provided, though it is easy operation.

10 First terminal 20 Second terminal 30 Application server (AP server)
40 Authentication Server 41 Authentication Processing Unit 42 User Information Management Unit (Application User Information Database)
50 EPC
51 S-GW
52 P-GW
53 API providing unit 54 AAA server (LTE user information database)
55 HSS (LTE user information database)
56 MME
60 Authentication Core System 100 Authentication System

Claims (7)

An authentication server,
Sending a first token to a first terminal requesting access to an application server;
Receiving a second token transmitted from a second terminal capable of LTE communication and transmitted via EPC;
Determining whether the first token and the second token match;
When the first token and the second token match, obtain LTE user information specifying the user of LTE communication related to the second terminal from the EPC;
Determining whether the LTE user information is information permitted to log in to a database of application user information for identifying a user permitted to access the application server;
If the LTE user information is information that allows login to the application user information database, a login permission for permitting an access request from the first terminal is transmitted to the application server. ,
Authentication server.   An authentication core system including the authentication server according to claim 1 and the EPC. The authentication core system according to claim 2,
The authentication server sends the IP address of the second terminal to the EPC;
The EPC determines whether or not the LTE user information corresponding to the IP address is registered in a database of the LTE user information,
When the LTE user information is registered in the LTE user information database, the EPC transmits the LTE user information corresponding to the IP address to the authentication server.
Authentication core system. An authentication core system according to claim 3,
An authentication core system, wherein the LTE user information database includes an AAA server that holds at least an IP address of the second terminal. An authentication core system according to claim 4,
The authentication core system, wherein the LTE user information database further includes an HSS. The authentication core system according to any one of claims 2 to 5, the first terminal, the second terminal, and the application server,
The second terminal is capable of photographing the first token displayed by the first terminal, and transmits the second token to the EPC based on the photographed first token. system. An authentication method performed by an authentication server,
Sending a first token to a first terminal requesting access to an application server;
Receiving a second token transmitted from a second terminal capable of LTE communication and transmitted via EPC;
Determining whether the first token and the second token match;
When the first token and the second token match, obtain LTE user information specifying the user of LTE communication related to the second terminal from the EPC;
Determining whether the LTE user information is information permitted to log in to a database of application user information for identifying a user permitted to access the application server;
When the LTE user information is permitted to log in to the database of the application user information, a login permission for permitting an access request from the first terminal is transmitted to the application server.
Authentication method.

Images