JPH10285155A - User authentication method - Google Patents

Abstract

(57) [Problem] To provide an authentication method in which the number of communications between a server and a user processing device at the time of authentication is reduced, and the server does not need to hold information necessary for authentication during authentication. SOLUTION: The user processing device generates a random number R, and constructs a challenge C by linking the random number R with data S that is shared by the server and the user processing device and that is invalid for use by a third party. , Challenge C is encrypted and response K
(C), and sends the random number R and the response K (C) to the server. The server concatenates the shared data S and the random number R to form a challenge C.
The result C ′ obtained by decoding (C) is compared with the challenge C.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a server / client system comprising a server connected by a communication line and a plurality of user processing devices, wherein the server receives a request for access from the user processing device. The present invention relates to a user authentication method capable of reducing the number of times of communication and storage capacity required for authentication in user authentication for verifying whether or not the processing device has an access right.

[0002]

2. Description of the Related Art Conventionally, in user authentication when a user processing device requests access to a server, a server requests a password from the user processing device in response to an access request from the user processing device. A password method has been used in which a password is transmitted to a server, and the server performs authentication by comparing the password received from the user processing device with a previously registered password. The password method has a problem that a password transmitted from a user processing device to a server is eavesdropped on an intermediate communication line, and the eavesdropped password can be reused to easily impersonate another person. A challenge / response method has been used as a method for solving this problem.

[0003]

In the above challenge / response method, in response to an access request from a user processing device, a server generates a challenge using a random number and transmits the challenge to the user processing device, and the user processing device issues the challenge. A response is generated by encryption and transmitted to the server, and authentication is performed by comparing the result of the server decrypting the response with the challenge.

Therefore, in the above challenge / response method, the number of times of communication between the server and the user processing device for performing authentication is three, and the server transmits a challenge to the user processing device and then sends a response to the user processing device. The challenge had to be held in an internal storage area until it was received from the processing device.

In view of the above problems, an object of the present invention is to reduce the number of times of communication between a server and a user processing device for performing authentication, and store information necessary for authentication from challenge transmission to response reception in the server. An object of the present invention is to provide a user authentication method that does not need to be stored.

[0006]

In order to achieve the above object, the present invention provides a server / client system comprising a server connected by a communication line and a plurality of user processing devices, wherein the server is the user processing device. When receiving an access request from the server, in the user authentication in which the server verifies the presence or absence of the access right of the user processing device, the server and the user processing device include means for mutually transferring information related to authentication, The server or the user processing device includes means for generating a random number R, and the user processing device obtains data S shared by the server and the user processing device and invalid for use by a third party. Means for linking the shared data S and the random number R to form a challenge C; Means for generating a response K (C) to the server, wherein the server obtains data S shared by the server and the user processing device and invalid for use by a third party; Means for linking the shared data S and the random number R to form a challenge C; means for decoding the response K (C); and a result C ′ obtained by decoding the response K (C) and the challenge C Means for comparing.

In the user processing device, the random number generating means generates a random number R, and the shared data obtaining means obtains data S shared by the server and the user processing device and invalid for use by a third party. A challenge forming unit that connects the shared data S and the random number R to form a challenge C; a response generating unit encrypts the challenge C to generate a response K (C); R and the response K (C) are transmitted to the server.

[0008] When the server receives the random number R and the response K (C) from the user processing device, the shared data acquisition means causes the server and the user processing device to share the data and prevent use by a third party. To obtain invalid data S, the challenge forming unit connects the shared data S and the random number R received from the user processing device to form a challenge C, and the response decoding unit receives the invalid data S from the user processing device. The response K (C) is decrypted to generate a decryption result C ′, and the challenge comparison unit compares the decryption result C ′ with the challenge C. If they match, it is determined that the authentication is successful, and if they do not match, it is determined that the authentication has failed. I do.

[0009]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Next, embodiments of the present invention will be described with reference to the drawings.

For example, a case where the present invention is applied to a network system including a server and a user processing device connected by the Internet will be described as an example.

In the Internet environment, a communication protocol called an IP protocol is used. The IP protocol uses globally unique address information for identifying a communication entity called an IP address. At the time of communication, two entities involved in communication need to know each other's IP address. In some cases, the IP address is temporarily assigned to the user processing device by a dial-up router in a connection mode or the like, but a third party uses the IP address at least during communication between the user processing device and the server. In this case, since the communication cannot be performed correctly, the IP address of the user processing device is shared between the server and the user processing device in the present invention and has a requirement of data S that is invalid for use by a third party. It is.

FIG. 1 is a block diagram of a first embodiment of the present invention. In the figure, 10 is a user processing device, 1
Reference numeral 1 denotes a server, which is connected by a communication line 12. The user processing device 10 includes a transfer unit 101, a random number generation unit 102, a shared data acquisition unit 103, a challenge configuration unit 104, and a response generation unit 105. The server 11 includes a transfer unit 111, a shared data acquisition unit 113, a challenge configuration unit 114
, A response decrypting means 115 and a challenge comparing means 116.

FIG. 2 is a flowchart showing one embodiment of the first aspect of the present invention. Random number generating means 1 of user processing device 10
02 generates a random number R (201), the shared data obtaining means 103 obtains the IP address IPu of the user processing device 10 (203), and the challenge configuring means 104
By connecting the address IPu and the random number R to challenge C
(205), the response generation means 105 encrypts the challenge C to generate a response K (C) (207), and the transfer means 101 transmits the random number R and the response K (C) via the communication line 12. To the server 11 (209).

When the server 11 receives the random number R and the response K (C) from the user processing device 10, the shared data obtaining means 113 obtains the IP address IPu of the user processing device 10 (211), and the challenge forming means 114 connects the IP address IPu and the random number R received from the user processing device 10 to form a challenge C (213), and the response decrypting means 115 converts the response K (C) received from the user processing device 10 The decryption is performed to generate a decryption result C ′ (215), and the challenge comparison unit 116 compares the decryption result C ′ with the challenge C (217).

FIG. 3 is a block diagram of a second embodiment of the present invention. In the figure, 10 is a user processing device, 1
Reference numeral 1 denotes a server, which is connected by a communication line 12. The user processing device 10 includes a transfer unit 101, a shared data acquisition unit 103, a challenge configuration unit 104,
Response generation means 105. The server 11 further includes a transfer unit 111, a random number generation unit 112, a shared data acquisition unit 113, a challenge configuration unit 114
, A response decrypting means 115 and a challenge comparing means 116.

FIG. 4 is a flowchart showing one embodiment of the second aspect of the present invention. The transfer means of the user processing device 10 transmits an access request to the server 11 via the communication line 12 (401). When the server 11 receives the access request from the user processing device 10, the random number generation means 112 generates a random number R (411), and the transfer means 111 transmits the random number R to the user processing device 10 via the communication line 12. (413). When the user processing device 10 receives the random number R from the server 11, the shared data obtaining unit 103 obtains the IP address IPu of the user processing device 10 (4
03), the challenge constructing means 104 constructs a challenge C by linking the IP address IPu and the random number R received from the server (405), and the response generating means 105 encrypts the challenge C and responds to the response K
(C) is generated (407), and the transfer means 101 transmits the random number R and the response K (C) to the server 11 via the communication line 12. (409).

When the server 11 receives the random number R and the response K (C) from the user processing device 10, the shared data obtaining means 113 obtains the IP address IPu of the user processing device 10 (415), and the challenge forming means 114 connects the IP address IPu and the random number R received from the user processing device 10 to form a challenge C (417), and the response decrypting means 115 converts the response K (C) received from the user processing device 10 The decryption is performed to generate a decryption result C ′ (419), and the challenge comparison unit 116 compares the decryption result C ′ with the challenge C (421).

In the above description, the IP address IPu of the user processing device is used as data S shared by the server and the user processing device and invalid for use by a third party.
But the data S shared by the server and the user processing device and invalid for use by a third party is a user I
It is not limited to the P address IPu.

The algorithm used for encrypting the challenge C and decrypting the response K (C) uses a pair of different keys for encryption and decryption even in a common key cryptosystem in which the same key is used for encryption and decryption. Public key cryptosystem.

[0020]

As described above, according to the present invention,
In the user authentication when the user processing device requests access to the server, it is possible to reduce the number of times of communication between the server and the user processing device for performing authentication. It is not necessary to hold information necessary for authentication until reception. That is, in the challenge / response method according to the related art, the random number transmitted from the server is encrypted to generate a response, whereas in the user authentication method according to the present invention, the server and the user processing device are connected. In order to generate a response by encrypting data that is concatenated with data that is shared and invalid for use by a third party and generate a response, the random number and the response sent from the user processing device to the server are intercepted. If you try to reuse it incorrectly, authentication will fail. Therefore, the response is generated based on the random number generated by the user processing device, and the random number and the response are transmitted from the user processing device to the server.
It is possible to reduce the number of times authentication information communication was performed to one. Also, in the method of generating a random number on the server and transmitting it to the user processing device, by attaching the random number to the response transmitted from the user processing device to the server, the server side does not need to hold the random number, thereby reducing storage capacity and This has the effect of simplifying processing.

[Brief description of the drawings]

FIG. 1 is a block diagram of one embodiment of the present invention.

FIG. 2 is a flowchart showing one embodiment of the first embodiment of the present invention.

FIG. 3 is a block diagram of a second embodiment of the present invention.

FIG. 4 is a flowchart showing one embodiment of the second embodiment of the present invention.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 10 User processing apparatus 101 Transfer means 102 Random number generation means 103 Shared data acquisition means 104 Challenge construction means 105 Response generation means 11 Server 111 Transfer means 112 Random number generation means 113 Shared data acquisition means 114 Challenge construction means 115 Response decryption means 116 Challenge comparison means 12 Communication line

Claims (3)

[Claims] 1. A server / client system comprising a server connected by a communication line and a plurality of user processing devices, wherein when the server receives an access request from the user processing device, the server is the user processing device. In the user authentication for verifying whether or not the user has the access right, the user processing device generates a random number R, and the data S shared by the server and the user processing device and invalid for use by a third party. A challenge C is configured by concatenating the random number R with the challenge C, the challenge C is encrypted to generate a response K (C), and the random number R and the response K (C) are transmitted to the server. The shared data S and the random number R are connected to form a challenge C, and the result C ′ obtained by decoding the response K (C) and the challenge User authentication method characterized by comparing the di C. 2. A server / client system comprising a server connected by a communication line and a plurality of user processing devices, wherein when the server receives an access request from the user processing device, the server is connected to the user processing device. In the user authentication for verifying whether or not the user has the access right, the user processing device transmits an access request to the server, and the server generates a random number R and transmits the random number R to the user processing device. The server C and the user processing device share the data S that is invalid for use by a third party and the random number R to form a challenge C. The challenge C is encrypted and the response K ( C), and sends the random number R and the response K (C) to the server. A challenge C by combining the data S and the random number R, and comparing the challenge C with a result C ′ obtained by decoding the response K (C). 3. The user authentication method according to claim 1, wherein the data S is an IP address in an Internet environment.