JP4820342B2 - User authentication method, user authentication apparatus, program, and recording medium - Google Patents

Description

  The present invention relates to a user authentication technique for performing user authentication, and more particularly to a single sign-on technique.

  When using a plurality of Web sites that require user authentication, the user usually has to enter authentication information (ID, password, etc.) that differs for each Web site into a terminal device and the like to be authenticated. However, this requires complicated authentication information management and authentication procedures.

  There is a single sign-on (SSO) technique as a conventional technique for solving such a problem. This technology is a technology that eliminates the need for authentication processing for each Web site by passing the result of authentication once performed to a plurality of Web sites. That is, in the case of a system using the single sign-on technology, a user can use a plurality of Web sites with only one authentication.

  The processing procedure when such a single sign-on technique is realized by SAML (Security Assertion Markup Language) (for example, see Non-Patent Document 1) is as follows, for example.

1. The user device accesses the authentication server device through the network, shows authentication information to the authentication server device, and receives authentication from the authentication server device.
2. A user device accesses a target server device for providing a service through a network.
3. The target server device accesses the authentication server device through the network, and acquires an authentication result from the authentication server device.
4). Thereafter, the user device can use the target server device through the network.
OASIS (Organization for the Advancement of Structured Information Standards), “Assertions and Protocol for the OASIS Security Assertion Markup Language (SAML)”, [online], May 31, 2002, [Search June 5, 2007] , Internet <URL: http://www.oasis-open.org/committees/security/#documents>

  However, in the conventional single sign-on model using SAML, there is a risk that the authentication information is wiretapped by a third party.

  That is, as described above, in the conventional single sign-on technology based on SAML, first, the user apparatus must access the authentication server apparatus through the network and present authentication information to the authentication server apparatus. However, in the case of an insecure network such as the Internet, when the user device presents authentication information to the authentication server device through the network, the authentication information may be intercepted by a third party. In addition, encryption technology can be used to prevent such wiretapping, but complicated processing for encryption processing is required. It can also be assumed that the security of encryption will be reduced by the realization of quantum computers, the development of new algorithms, and the like. Such a problem is not limited to the single sign-on technology based on SAML. The single sign-on technology requires that the user device accesses the authentication server device through the network and presents authentication information to the authentication server device. It is common.

  The present invention has been made in view of these points, and an object of the present invention is to provide a single sign-on technology that can physically prevent a risk that authentication information is wiretapped by a third party.

  In the present invention, the input unit, which is the user interface of the user authentication device, accepts input of authentication information. The authentication processing unit of the user authentication device uses this authentication information to perform authentication processing of a user who uses a user device configured in another housing, generates authentication result information indicating the authentication processing result, and generates the authentication result. Output information. The transmission unit of the user authentication device transmits this authentication result information, and this authentication result information is received by the reception unit of the target server device. Then, the permission unit of the target server device that has received the authentication result information permits communication of service information between the target server device and the user device.

  According to the present invention, it is possible to realize a single sign-on technology that can physically prevent a risk that the authentication information is wiretapped by a third party.

  The best mode for carrying out the present invention will be described below with reference to the drawings.

〔Basic principle〕
<Basic configuration>
First, the basic configuration of the present invention is illustrated.
FIG. 1 is a conceptual diagram illustrating the configuration of a user authentication system 1 having the basic configuration of the present invention. The user authentication system 1 in the example of FIG. 1 includes a user device 10, a user authentication device 20, and a target server device 30 that are communicably connected via a network 40. Here, the user apparatus 10 is an apparatus for the user to receive provision of service information. The user authentication device 20 is a device that is configured in a separate housing from the user device 10 and performs user authentication of a user who uses the user device 10, and includes an input unit 21, an authentication processing unit 22, and a transmission unit that are user interfaces. 23. The target server device 30 is a device that provides service information to the user device 10.

<Basic processing>
Next, basic processing of the present invention will be exemplified.
First, authentication information is input to the input unit 21 which is a user interface of the user authentication device 20 (authentication information input process). Next, the authentication processing unit 22 of the user authentication device 20 uses this authentication information to perform authentication processing of a user who uses the user device 10 configured in another housing, and obtains authentication result information indicating the authentication processing result. Generate and output the authentication result information (authentication result information generation process). Next, the transmission unit 23 of the user authentication device 20 transmits authentication result information (authentication result information transmission process). The authentication result information is transmitted to the target server device 30 through the network 40 and received by the receiving unit 31 of the target server device 30 (authentication result information receiving process). After that, the permission unit 32 of the target server device 30 that has received the authentication result information permits service information communication between the target server device 30 and the user device 10 (permission process), and the user device 10 through the network 40. Provide service information to

<Basic features>
As described above, the user inputs authentication information to the input unit 21 that is a user interface of the user authentication device 20, and the user authentication device 20 uses this authentication information and the user device is configured in another casing. The authentication process of the user who uses 10 is performed. In this case, the authentication information is used for authentication processing without going through the network 40. Therefore, the authentication information is not intercepted by a third party on the network 40.

  In addition, authentication result information indicating the result of the authentication process performed by the user authentication device 20 is sent to the target server device 30, and the target server device 30 to which the authentication result information is sent includes the target server device 30, the user device 10, Communication of service information between them. In the case of this method, the user authentication device can perform user authentication processing for a plurality of target server devices. As a result, a single sign-on function can be realized.

  Furthermore, the user authentication device 20 is configured in a separate housing from the user device 10. Therefore, the user who possesses the user authentication device 20 can use any device as the user device 10.

[First Embodiment]
Next, a first embodiment of the present invention will be described.

<Configuration>
FIG. 2 is a conceptual diagram illustrating the overall configuration of the user authentication system 100 according to the first embodiment. FIG. 3 is a block diagram illustrating a detailed configuration of the user device 110. FIG. 4 is a block diagram illustrating a detailed configuration of the user authentication device 120. FIG. 5 is an external view illustrating a specific example of the user authentication device 120. FIG. 6 is a block diagram illustrating a detailed configuration of the target server device 130.

  As illustrated in FIG. 2, the user authentication system 100 according to this embodiment includes a user device 110, a user authentication device 120, and a target server device 130 configured to be able to communicate with each other via a network 140. In FIG. 2, only one user device 110, one user authentication device 120, and one target server device 130 are illustrated, but at least one of the user device 110, the user authentication device 120, and the target server device 130 is two or more. An existing configuration may be used.

  As illustrated in FIG. 3, the user device 110 in this example includes an input unit 111, an output unit 112, a transmission unit 113, a reception unit 114, a communication processing unit 115, a storage unit 116, and a control unit that controls the entire user device 110. 117. The user device 110 in this example includes an input device such as a keyboard, input keys, a mouse and a touch panel, an output device such as a display and a speaker, a CPU (Central Processing Unit), a RAM (Random Access Memory), and a ROM (Read Only Memory). A predetermined program (such as an OS [Operating System] or an application program such as a Web browser) is read into a known computer composed of, and the like, and the CPU executes these programs. Moreover, as a well-known computer which comprises the user apparatus 110, a personal computer, PDA (Personal Digital Assistant) terminal device, a mobile telephone terminal device etc. can be illustrated, for example.

  As illustrated in FIG. 4, the user authentication device 120 of this example includes an input unit 121, an output unit 122, a transmission unit 123, a reception unit 124, a communication processing unit 125, an authentication processing unit 126, a signature generation unit 127, and a storage unit. 128 and a control unit 129 for controlling the entire user authentication device 120. The input unit 121 and the output unit 122 are user interfaces, respectively. That is, the input unit 121 is a component that transmits information input by the user to the user authentication device 120 without going through the network. The output unit 122 is a component that the user authentication device 120 outputs information to the user without going through the network. The user authentication device 120 of this example is a predetermined computer that includes a keyboard, input keys, an input device such as a mouse and a touch panel, an output device such as a display, a speaker, and a vibration device, a CPU, a RAM, a ROM, and the like. The program is read and the CPU executes the program. Examples of known computers constituting such a user authentication device 120 include a personal computer, a PDA terminal device, and a mobile phone terminal device. However, in this embodiment, an example in which the user authentication device 120 is configured using a mobile phone terminal device that is a mobile communication terminal device is shown as an example. In this case, the input key corresponds to the input unit 121, and the liquid crystal screen corresponds to the output unit 122 (FIG. 5).

  As illustrated in FIG. 6, the target server device 130 in this example includes a reception unit 131, a transmission unit 132, a communication processing unit 133, an authentication result verification unit 134, a permission unit 135, a storage unit 136, and the entire target server device 130. And a control unit 137 for controlling. The target server device 130 in this example is configured by reading a predetermined program into a known computer including a CPU, RAM, ROM, and the like, and executing these programs by the CPU. Moreover, as a well-known computer which comprises the target server apparatus 130, a server machine etc. can be illustrated, for example.

  Note that the user device 110, the user authentication device 120, and the target server device 130 are devices configured as separate bodies and are physically separated from each other.

<User authentication process>
Next, user authentication processing according to this embodiment will be described.
First, as a pre-process of the user authentication process, the first secret key is securely stored in the storage unit 128 of the user authentication device 120, and the first public key is stored in the storage unit 136 of the target server device 130. Here, the first secret key and the first public key are asymmetric key pairs of a public key cryptosystem such as RSA. User authentication processing is performed on the premise of such preprocessing.

  7 and 8 are sequence diagrams for explaining the user authentication processing of the first embodiment. The user authentication process according to the first embodiment will be described below with reference to these drawings.

  First, the user device 110 accesses the target server device 130 through the network 140 and transmits a login request to the target server device 130. Then, the communication processing unit 133 of the target server device 130 (FIG. 6) outputs the address input instruction information to the transmission unit 132, and the transmission unit 132 transmits the address input instruction information to the user device 110 through the network 140. The receiving unit 114 of the user device 110 (FIG. 3) receives the address input instruction information, the communication processing unit 115 sends the address input instruction information to the output unit 112, and the output unit 112 receives the address input instruction information. Is output (step S1).

  The “address input instruction information” is instruction information that prompts the user to input user authentication device address information that is address information (destination information) of the user authentication device 120. The address input instruction information is displayed, for example, as a pop-up window on the display that is the output unit 112 of the user device 110. FIG. 9A is a diagram illustrating address input instruction information displayed as a pop-up window 200. The address input instruction information in this example includes a message “Please enter your Mobile IdP URL”, a user authentication device address information input field 201, and “OK” and “Cancel” button display sections. 202 and 203.

  The user who perceives the output address input instruction information inputs the user authentication device address information to the input unit 111 of the user device 110 (FIG. 3) (step S2). For example, in the case of the example of FIG. 9A, the user uses the input unit 111 to input user authentication device address information of the user authentication device 120 that can be used in the input field 201 of the pop-up window 200, and clicks “OK”. "Button display section 202 is turned on (clicked or the like).

  The input user authentication device address information is temporarily stored in the storage unit 116. The communication processing unit 115 reads out the user authentication device address information from the storage unit 116, and combines it with service request information (including service request contents) and user device address information which is address information (destination information) of the user device 110. The data is sent to the transmission unit 113. The transmission unit 113 transmits service request information, user authentication device address information, and user device address information to the target server device 130 via the network 140 (step S3). This transmission is performed as an HTTP request, for example.

  These pieces of information are received by the receiving unit 131 of the target server device 130 (FIG. 6) (step S4) and sent to the communication processing unit 133. The communication processing unit 133 stores the transmitted user authentication device address information and user device address information in the storage unit 136. In addition, the communication processing unit 133 generates session information corresponding to the service request information (step S5), and stores the session information in the storage unit 136 in association with the service request information.

  Next, the communication processing unit 133 reads out user authentication device address information, session information, and user device address information from the storage unit 136. Then, the communication processing unit 133 sends these to the transmission unit 132 together with the authentication request information (for example, “authnReq” command) and the target server device address information that is the address information (destination information) of the target server device 130. The transmission unit 132 transmits the authentication request information, user authentication device address information, target server device address information, and session information to the user device 110 whose destination is specified by the user device address information via the network 140 (step S6). ). Specifically, the transmission unit 132 uses, for example, information including authentication request information, target server device address information, and session information as an HTTP redirect response in which an address indicated by the user authentication device address information is designated as a redirect destination. 110.

  These pieces of information are received by the receiving unit 114 of the user device 110 (FIG. 3) (step S7) and temporarily stored in the storage unit 116 by the communication processing unit 115. Then, the communication processing unit 115 sends the user device address information, the authentication request information read from the storage unit 116, the target server device address information, and the session information to the destination by the user authentication device address information read from the storage unit 116. Is transmitted to the specified user authentication device 120 (step S8). This transmission is performed, for example, as an HTTP redirect.

  Authentication request information, target server device address information, session information, and user device address information are received by the receiving unit 124 of the user authentication device 120 (FIG. 4) (step S9). The received target server device address information, session information, and user device address information are stored in the storage unit 128 by the communication processing unit 125. Also, using this as a trigger, the authentication processing unit 126 outputs input instruction information from the output unit 122 which is a user interface (step S10).

  The “input instruction information” is instruction information that prompts the user to input “authentication information” necessary for user authentication. In the example of this embodiment, information for instructing input of selection information as to whether or not to perform user authentication is output as “input instruction information”. It should be noted that the input instruction information may be any information such as an image, a moving image, sound, and vibration. FIG. 9B is an example of the input instruction information output from the output unit 122. The input instruction information in this example is an image 210 having a message “Are you sure you want to send the authentication result?” And button displays 211 and 212 for “Yes” and “No”.

  A user who perceives the output input instruction information inputs authentication information to the input unit 121 of the user authentication device 120, which is a user interface (step S11 / authentication information input process). “Authentication information” in the example of this embodiment is selection information as to whether or not to perform user authentication. For example, when the input instruction information is the image 210 illustrated in FIG. 9B, the user uses the input unit 121 to select the “Yes” button display unit 211 or the “No” button display unit 212. .

  The authentication information input to the input unit 121 is sent to the authentication processing unit 126. The authentication processing unit 126 according to the present embodiment generates authentication result information indicating that the user authentication is successful on the condition that the authentication information is “selection information indicating that user authentication is performed”, and the authentication result information Is stored in the storage unit 128 (step S12 / authentication result information generation process). This is based on the fact that the user is in an environment where information can be input to the input unit 121 of the user authentication device 120 (for example, the user possesses the user authentication device 120). You are authenticating something.

  Next, the signature generation unit 127 reads the first secret key and the authentication result information from the storage unit 128, and the signature information obtained by encrypting the information including the authentication result information using the first secret key by the public key cryptosystem. And the signature information is stored in the storage unit 128 (step S13 / signature information generation process). Thereafter, the communication processing unit 125 reads the user device address information, the authentication result information, the signature information, the session information, and the target server device address information from the storage unit 128 and sends them to the transmission unit 123. The transmission unit 123 transmits the authentication result information, the signature information, the session information, and the target server device address information to the user device 110 whose destination is specified by the user device address information via the network 140 (Step S14 / certification result information). Transmission process). Specifically, for example, a FORM tag for POSTing authentication result information, signature information, and session information with the destination server device address information as a destination is included in the HTTP response. FIG. 10 is a diagram illustrating such an HTTP response description. In the example of FIG. 10, target server device address information 221 that is a POST destination, authentication result information (including signature information) 222, session information 223, and authentication result information 224 are described as elements of the FORM tag. In addition, HTTP response elements may be data-compressed or text-encoded with Base64 or the like. The authentication result information (including signature information) 222 in the example of FIG. 10 is an example in which the authentication result information and the signature information corresponding thereto are Base64 encoded.

  The transmitted authentication result information, signature information, session information, and target server device address information are received by the receiving unit 114 of the user device 110 (FIG. 3) (step S15). These pieces of information are stored in the storage unit 116 by the communication processing unit 115. Further, the communication processing unit 115 reads the authentication result information, the signature information, the session information, and the target server device address information from the storage unit 116, and the transmission unit 113 specifies the destination server whose destination is specified by the target server device address information. Authentication result information, signature information, and session information are transmitted to the device 130 (step S16). Specifically, the transmission unit 113, for example, POSTs the FORM of the HTTP response illustrated in FIG.

  Authentication result information, signature information, and session information are received by the receiving unit 131 of the target server device 130 (FIG. 6) (step S17 / authentication result information receiving process), and the communication processing unit 133 stores them in the storage unit 136. To do.

  Next, the authentication result verification unit 134 reads the first public key, the authentication result information, and the signature information from the storage unit 136, decrypts the signature information using the first public key, and outputs the decryption result and the authentication result information. Compare. The authentication result verification unit 134 verifies the signature information by this comparison, determines the validity of the authentication result information, and outputs the determination result (step S18 / authentication result verification process). This determination result is input to the permission unit 135. Here, when this determination result is a determination result (verification failure) that the authentication result information is not valid (step S19), the permission unit 135 rejects the login of the user device 110 (step S20). On the other hand, when this determination result is a determination result (verification pass) that the authentication result information is valid (step S19), the permission unit 135 permits the login of the user device 110 (step S21 / permission process). The communication of service information between the target server device 130 and the user device 110 is permitted.

  When the communication of the service information is permitted, the communication processing unit 133 reads the user device address information and the service request information associated with the session information from the storage unit 136. Then, the communication processing unit 133 specifies service information corresponding to the service request specified by the service request information. The transmitting unit 132 transmits the specified service information to the user device 110 specified by the user device address information via the network 140 (step S22).

<Features of this embodiment>
In the case of this embodiment, the user can present authentication information necessary for the user recognition process to the user authentication device 120 without using the network 140. Therefore, the authentication information is not intercepted by a third party on the network 140.

  The user authentication process is performed by the user authentication apparatus 120, and the authentication result is used by the target server apparatus 330, thereby realizing a single sign-on function.

  Furthermore, the user authentication device 120 is configured in a separate housing from the user device 110. Therefore, a user who possesses the user authentication device 120 can use any device as the user device 110.

  Further, in this embodiment, the user's validity can be confirmed on the basis that the user can perceive input instruction information and input authentication information via the user interface of the user authentication device 120. Therefore, it is possible to confirm the legitimacy of the user without performing complicated personal authentication processing such as a password (see FIG. 9 and the like).

[Second Embodiment]
Next, a second embodiment of the present invention will be described.
This embodiment is a modification of the first embodiment, in which a trusted certificate issuing server device issues a public key certificate for each target server device, and the user authentication device has a private key corresponding to the public key certificate. It is characterized in that the signature information of the authentication result information is generated by using (authority delegation method). Below, it demonstrates centering around difference with 1st Embodiment, and abbreviate | omits description about the matter which is common in 1st Embodiment.

<Configuration>
FIG. 11 is a conceptual diagram illustrating the overall configuration of the user authentication system 300 of the second embodiment. FIG. 12 is a block diagram illustrating a detailed configuration of the user device 310. FIG. 13 is a block diagram illustrating a detailed configuration of the user authentication device 320. FIG. 14 is a block diagram illustrating a detailed configuration of the target server device 330. FIG. 15 is a block diagram illustrating a detailed configuration of the certificate issuing server device 340. In these drawings, portions common to the configuration of the first embodiment are denoted by the same reference numerals as in the first embodiment, and the description is simplified.

  As illustrated in FIG. 11, the user authentication system 300 according to this embodiment includes a user device 310, a user authentication device 320, a target server device 330, and a certificate issuing server device 340 configured to be able to communicate with each other via a network 140. In FIG. 11, only one target server device 330 is shown, but actually a plurality of target server devices are communicably connected to the network 140. Further, in FIG. 11, only one user device 310, one user authentication device 320, and one target server device 330 are illustrated, but at least one of the user device 310, the user authentication device 320, and the target server device 330 is two or more. An existing configuration may be used.

  As illustrated in FIG. 12, the user device 310 in this example includes an input unit 111, an output unit 112, a transmission unit 113, a reception unit 114, a communication processing unit 315, a storage unit 116, and a control unit that controls the entire user device 110. 117. The user device 310 of this example is also configured by a predetermined program being read into a known computer and the CPU executing these programs.

  As illustrated in FIG. 13, the user authentication device 320 of this example includes an input unit 121, an output unit 122, a transmission unit 123, a reception unit 124, a communication processing unit 325, an authentication processing unit 126, a signature generation unit 127, and a storage unit. 128, a control unit 129 that controls the entire user authentication device 120, and a key pair generation unit 321. The input unit 121 and the output unit 122 are user interfaces, respectively. The user authentication device 320 in this example is also configured by a predetermined program being read into a known computer and the CPU executing these programs. In this embodiment, the user authentication device 320 is configured using a mobile communication terminal device as an example.

  As illustrated in FIG. 14, the target server device 330 in this example includes a reception unit 131, a transmission unit 132, a communication processing unit 333, an authentication result verification unit 134, a permission unit 135, a storage unit 136, and the entire target server device 330. It has a control unit 137 and a public key certificate verification unit 331 for controlling. The target server device 330 in this example is also configured by a predetermined program being read into a known computer and the CPU executing these programs.

  As illustrated in FIG. 15, the certificate issuing server device 340 in this example includes a receiving unit 341, a transmitting unit 342, a communication processing unit 343, a public key certificate generating unit 344, a storage unit 345, and a certificate issuing server device 340. And a control unit 346 for controlling the whole. The certificate issuing server device 340 is configured by a predetermined program being read into a known computer and the CPU executing these programs. An example of a known computer that configures the certificate issuing server device 340 is a server machine. The certificate issuing server device 340 is managed and operated by a reliable certification authority.

  Note that the user device 310, the user authentication device 320, the target server device 330, and the certificate issuing server device 340 are devices that are configured separately and are physically separated from each other.

<Public key certificate storage processing>
Next, processing until the certificate issuing server device 340 issues a public key certificate for each target server device and stores the public key certificate in the user device 310 (public key certificate storage processing) will be described.

  It is assumed that the user authentication device 320 is registered in advance in the certificate issuing server device 340 as preprocessing of the public key certificate storage processing of this embodiment. Further, it is assumed that the storage unit 128 of the user authentication device 320 stores a user identifier for identifying the user and a target server device identifier for identifying the target server device 330 to receive service provision. Further, it is assumed that the second secret key of the public key cryptosystem is securely stored in the storage unit 345 of the certificate issuing server device 340. Further, it is assumed that the second public key corresponding to the second secret key is stored in the storage unit 136 of the target server device 330. The public key certificate storage process of the present embodiment is executed under such a premise.

  FIG. 16 is a sequence diagram for explaining public key certificate storage processing according to the second embodiment. Hereinafter, the public key certificate storage processing of this embodiment will be described with reference to this figure.

  First, for example, when the application software of the user authentication device 320 is activated, the user authentication device 320 transmits authentication information such as an ID and a password to the certificate issuing server device 340, and the certificate issuing server The user authentication device 320 is authenticated by the device 340 (step S101).

  Next, the key pair generation unit 321 of the user authentication device 320 (FIG. 13) generates a first public key and a first secret key that are asymmetric key pairs of the public key cryptosystem, and stores them in the storage unit 128. (Step S102). Next, the communication processing unit 325 reads the first public key, the target server device identifier, and the user identifier from the storage unit 128, and generates certificate issuance request information including these pieces of information. The certificate issuance request information and the user authentication device address information of the user authentication device 320 are transmitted to the transmission unit 132, and from there to the certificate issuance server device 340 via the network 140 (step S103).

  The certificate issuance request information and the user authentication device address information are received by the receiving unit 341 of the certificate issuing server device 340 (FIG. 15) (step S104) and stored in the storage unit 345 by the communication processing unit 343. Is done. In response to this, the public key certificate generation unit 344 reads the second secret key, the first public key included in the certificate issuance request information, the target server device identifier, and the user identifier from the storage unit 345. . Then, the public key certificate generation unit 344 encrypts the information including the first public key, the target server device identifier, and the user identifier using the second secret key by the public key encryption method, A public key certificate for each target server device including the public key, the target server device identifier, and the user identifier is generated and stored in the storage unit 345 (step S105). Next, the communication processing unit 343 reads the user authentication device address information and the public key certificate from the storage unit 345 and sends them to the transmission unit 342. The transmission unit 342 transmits the public key certificate via the network 140 to the user authentication device 320 whose destination is specified by the user authentication device address information (step S106). The public key certificate is received by the receiving unit 124 of the user authentication device 320 (FIG. 13) (step S107), and the communication processing unit 325 stores the public key certificate in the storage unit 128.

<User authentication process>
Next, user authentication processing according to this embodiment will be described.
FIG. 17 is a sequence diagram for describing user authentication processing according to the second embodiment. Hereinafter, the user authentication process of the second embodiment will be described with reference to FIG.

  First, the user device 310, the user authentication device 320, and the target server device 330 execute the processes of steps S1 to S13 of the first embodiment. After the processing in step S13, the communication processing unit 325 of the user authentication device 320 (FIG. 13) reads from the storage unit 128 user device address information, authentication result information, signature information, session information, target server device address information, and public key. The certificate is read and sent to the transmission unit 123. The transmission unit 123 transmits the authentication result information, the signature information, the session information, the target server device address information, and the public key certificate to the user device 310 whose destination is specified by the user device address information through the network 140 (Step S123). S114). Specifically, for example, a FORM tag for POSTing authentication result information, signature information, and session information with the destination server device address information as a destination is included in the HTTP response. Specifically, for example, a FORM tag for POSTing authentication result information, signature information, and session information with the destination server device address information as a destination is included in the HTTP response. FIG. 18 is a diagram illustrating such an HTTP response description. In the example of FIG. 18, target server device address information 221 that is a POST destination, authentication result information (including signature information) 222, session information 223, and public key certificate 225 are described as elements of the FORM tag. In addition, HTTP response elements may be data-compressed or text-encoded with Base64 or the like.

  The transmitted authentication result information, signature information, session information, target server device address information, and public key certificate are received by the receiving unit 114 of the user device 310 (FIG. 12) (step S115). The data is stored in the storage unit 116 by the communication processing unit 315. Then, the communication processing unit 315 reads the authentication result information, the signature information, the session information, the target server device address information, and the public key certificate from the storage unit 116, and the transmission unit 113 receives the destination by the target server device address information. Authentication result information, signature information, session information, and a public key certificate are transmitted to the identified target server device 330 (step S116). Specifically, the transmission unit 113, for example, POSTs the HTTP response FORM in FIG.

  The authentication result information, the signature information, the session information, and the public key certificate are received by the receiving unit 131 of the target server device 330 (FIG. 14) (step S117), and the communication processing unit 333 stores them in the storage unit 136. .

  Next, the public key certificate verification unit 331 reads the public key certificate and the second public key from the storage unit 136. Then, the public key certificate verification unit 331 verifies the public key certificate using the second public key, determines whether the public key certificate is valid, and outputs the determination result ( Step S118). This determination result is input to the permission unit 135. If a determination result indicating that the public key certificate is not valid is output (step S119), the permission unit 135 rejects the login (step S120).

  On the other hand, if it is determined that the public key certificate is valid (step S119), the authentication result verification unit 134 then stores the authentication result information, signature information, and public key certificate from the storage unit 136. One public key is read, the signature information is verified using the first public key, the validity of the authentication result information is determined, and the determination result is output (step S121). This determination result is input to the permission unit 135. Here, when this determination result is a determination result (verification failure) that the authentication result information is not valid (step S122), the permission unit 135 rejects the login of the user device 110 (step S123). On the other hand, when the determination result is a determination result (verification pass) that the authentication result information is valid (step S122), the permission unit 135 permits the login of the user device 110 (step S124), and the target server Communication of service information between the device 130 and the user device 110 is permitted.

  When the communication of the service information is permitted, the communication processing unit 133 reads the user device address information and the service request information associated with the session information from the storage unit 136. Then, the communication processing unit 133 specifies service information corresponding to the service request specified by the service request information, and the transmission unit 132 sends the service information to the user device 310 specified by the user device address information. On the other hand, it transmits through the network 140 (step S125).

<Features of this embodiment>
As described above, in this embodiment, the certificate issuing server device 340 issues a public key certificate for each target server device, and the user authentication device 320 generates authentication result information, its signature information, and its signature information. The used public key certificate is transmitted to the target server device 330. Therefore, even if the user authentication device 320 is lost or the model is changed, a new user authentication device 320 has to be used, and the user performs processing (S101 to S107) with the certificate issuing server device 340. ), It is possible to sign on a plurality of target server devices.

  Further, the public key certificate of the present embodiment includes a ciphertext obtained by encrypting information including the target server device identifier of the target server device 330 and the first public key using the second secret key of the certificate issuing server device, This is a public key certificate for each target server device having the first public key. Each target server device verifies the public key certificate using its own target server device identifier. In other words, the public key certificate of this embodiment passes verification only on a specific target server device. Thereby, it is possible to reduce a risk that an eavesdropped public key certificate is misused for a plurality of target server devices.

[Third Embodiment]
Next, a third embodiment will be described. This embodiment is a modification of the second embodiment. The difference from the second embodiment is only that the public key certificate storage process is executed during the user authentication process. Only the differences from the second embodiment will be described below.

<Configuration>
This is the same as in the second embodiment. The description is omitted here.

<User authentication process>
FIG. 19 is a sequence diagram for describing user authentication processing according to the third embodiment. Hereinafter, the user authentication processing of this embodiment will be described with reference to this figure.

  First, the user device 310, the user authentication device 320, and the target server device 330 execute the processes of steps S1 to S9 of the first embodiment. Thereafter, the signature generation unit 127 of the user authentication device 320 determines whether there is a public key certificate that can be used in the storage unit 128 (step S131). Here, when there is no public key certificate that can be used in the storage unit 128, the user authentication device 320 and the certificate issuing server device 340 execute the processing of steps S101 to S107 of the second embodiment. On the other hand, when there is a public key certificate that can be used in the storage unit 128, the user device 310, the user authentication device 320, and the target server device 330 perform steps S10 to S13 of the first embodiment and the second embodiment. Steps S114 to S125 are executed.

[Fourth Embodiment]
Next, a fourth embodiment of the present invention will be described.
Normally, a mobile phone terminal device has a function of transmitting an HTTP request to a device on the network and receiving an HTTP response from the device, but in response to an HTTP request transmitted from a device on the network, the HTTP response Is not provided. Therefore, when the user authentication device of the first to third embodiments is configured by a normal mobile phone terminal device, it is necessary to devise a communication method between the user device and the user authentication device.

  In this embodiment, this problem is solved by providing a relay server device (relay server method). Although this relay server method can be applied to any of the first to third embodiments, an example in which the relay server method is applied to the first embodiment will be described below as an example.

<Configuration>
FIG. 20 is a conceptual diagram illustrating the overall configuration of the user authentication system 500 of the fourth embodiment. FIG. 21 is a block diagram illustrating a detailed configuration of the user device 510. FIG. 22 is a block diagram illustrating a detailed configuration of the user authentication device 520. FIG. 23 is a block diagram illustrating a detailed configuration of the relay server device 550. Note that, in these drawings, portions common to the above-described embodiments are denoted by the same reference numerals as those of the above-described embodiments, and description thereof is omitted.

  As shown in FIG. 20, the user authentication system 500 of this embodiment includes a user device 510, a user authentication device 520, a target server device 130, and a relay server device 550 that are communicably connected via a network 140.

  As shown in FIG. 21, the difference between the user device 510 of the fourth embodiment and the user device 110 of the first embodiment is that the communication processing unit 115 is replaced with a communication processing unit 515. As shown in FIG. 22, the difference between the user authentication device 520 of the fourth embodiment and the user authentication device 120 of the first embodiment is that the communication processing unit 125 is replaced with a communication processing unit 525. . The user authentication device 520 of the present embodiment is configured by a mobile phone terminal device or the like, and has a function of transmitting an HTTP request to a device on the network and receiving an HTTP response from the device. It does not have a function to return an HTTP response to an HTTP request sent from the device.

  As illustrated in FIG. 23, the relay server device 550 of this example includes a receiving unit 551, a transmitting unit 552, a communication processing unit 553, a storage unit 554, and a control unit 555 that controls the entire relay server device 550. The relay server device 550 of this example is configured by reading a predetermined program into a known computer and executing these programs by the CPU. Moreover, as a well-known computer which comprises the relay server apparatus 550, a server machine etc. can be illustrated, for example.

<User authentication process>
Next, user authentication processing according to this embodiment will be described.
First, as a pre-process of the user authentication process, the first secret key is securely stored in the storage unit 128 of the user authentication device 120, and the first public key is stored in the storage unit 136 of the target server device 130. Further, the user device address information of the user device 510 is stored in the storage unit 128 of the user authentication device 520.

  24 and 25 are sequence diagrams for explaining user authentication processing according to the fourth embodiment. The user authentication process according to the fourth embodiment will be described below with reference to these drawings.

  First, for example, when the user authentication device 520 (FIG. 22) is activated, the communication processing unit 525 transmits a user authentication device identifier that is an identifier of the user authentication device 520 and a user authentication device address of the user authentication device 520. Send to part 123. The transmission unit 123 transmits the information as an HTTP request to the relay server device 550 via the network 140 (step S201). As the user authentication device identifier, for example, a mail address or a telephone number of the user authentication device 520 can be exemplified.

  The receiving unit 551 of the relay server device 550 receives the HTTP request and sends it to the communication processing unit 553 (step S202). The communication processing unit 553 assigns a port number to the user device 510 (Step S203), and stores the port number, the user authentication device identifier, and the user authentication device address in the storage unit 554 in association with each other (Step S203). S204).

  Thereafter, as in the first embodiment, the user device 510 accesses the target server device 130 through the network 140, and the output unit 112 of the user device 510 uses the address input instruction information based on the information transmitted from the target server device 130. Is output (step S205). The user who perceives the output address input instruction information inputs the user authentication device address information to the input unit 111 of the user device 510 (FIG. 21) (step S206). Note that the user authentication device address information of this embodiment includes relay server device address information that is address information (destination information) of the relay server device 550 and a user authentication device identifier of the user authentication device 520.

  The input user authentication device address information (relay server device address information + user authentication device identifier) is temporarily stored in the storage unit 116. The communication processing unit 515 reads the user authentication device address information from the storage unit 116 and transmits it together with service request information (including service request contents) and user device address information which is address information (destination information) of the user device 510. Send to part 113. The transmission unit 113 transmits service request information, user authentication device address information, and user device address information to the target server device 130 via the network 140 (step S207). This transmission is performed as an HTTP request.

  Similar to steps S4 and S5 of the first embodiment, these pieces of information are received by the target server device 130 (step S208), and session information is generated and stored (step S209). Thereafter, the target server device 130 returns authentication request information, target server device address information, user authentication device address information, and session information to the user device 510 as an HTTP response (step S210). These pieces of information are received by the receiving unit 114 of the user device 510 (FIG. 21) (step S211), and are temporarily stored in the storage unit 116 by the communication processing unit 515.

  Then, the communication processing unit 515 performs user authentication on its own user device address information, authentication request information read from the storage unit 116, target server device address information, session information, and user authentication device identifier of the user authentication device address information. It transmits to the relay server device 550 whose destination is specified by the relay server device address information of the device address information (step S212). This transmission is performed as an HTTP request, for example.

  The transmitted information is received by the receiving unit 551 of the relay server device 550 (FIG. 23) (step S213) and sent to the communication processing unit 553. The communication processing unit 553 temporarily stores the sent authentication request information, target server device address information, and session information in the storage unit 554. Further, the communication processing unit 553 searches the storage unit 554 for a port number associated with the sent user authentication device identifier, and stores the user authentication device identifier and the user authentication device address corresponding to the port number. (Step S214). Further, the communication processing unit 553 reads authentication request information, target server device address information, and session information from the storage unit 554. Then, the transmission unit 552 transmits the authentication request information, the target server device address information, and the session information as the HTTP response of the HTTP request in step S201 to the user authentication device 520 whose destination is specified by the user authentication device address ( Step S215).

  This HTTP response is received by the receiving unit 124 of the user authentication device 520 (FIG. 22) and sent to the communication processing unit 525 (step S216). Thereafter, the user device 510, the user authentication device 520, and the target server device 130 execute the processes of steps S10 to S22 of the first embodiment. Also, the relay server device 550 (FIG. 23) deletes the mutually associated user authentication device identifier, user authentication device address, and port number from the storage unit 554 (step S217).

<Features of this embodiment>
As described above, in this embodiment, communication between the user device 510 and the user authentication device 520 is performed via the relay server device 550. Therefore, the user authentication device 520 has a function of transmitting an HTTP request to a device on the network and receiving an HTTP response from the device, like a mobile phone terminal device, but is transmitted from a device on the network. The user device 510 makes an authentication request to the user authentication device 520 and acquires the authentication result information from the user authentication device 520 even if the HTTP request is not provided with a function of returning an HTTP response. Can do.

[Fifth Embodiment]
Next, a fifth embodiment of the present invention will be described.
In the previous embodiments, the user needs to input user authentication device address information to the user device (see step S2 and the like). However, there are cases where the user knows some destination information of the user authentication device, but it is not user authentication device address information. For example, the user knows the electronic mail address of the user authentication device, but does not know the IP address of the user authentication device that is dynamically assigned, and the user authentication device address information is an IP address.

  In this embodiment, the user authentication apparatus is caused to transmit user authentication apparatus address information (destination information transmission process), and the user apparatus receives the user authentication apparatus address information (destination information reception process). Then, the user device designates a destination by the user authentication device address information, and transmits authentication request information to the user authentication device. Thereby, even if a user does not know user authentication apparatus address information, the user apparatus can make a user authentication apparatus perform an authentication process.

  Such a method is applicable to the above-described embodiments. However, a case where this method is applied to the first embodiment will be described below as an example.

<Configuration>
The user authentication system of the present embodiment has a configuration in which the user device 110 of the first embodiment is replaced with a user device 610, the user authentication device 120 is replaced with a user authentication device 620, and the target server device 130 is replaced with a target server device 630. It is.

  FIG. 26 is a block diagram illustrating a detailed configuration of the user device 610 according to the fifth embodiment. FIG. 27 is a block diagram illustrating a detailed configuration of the user authentication device 620. FIG. 28 is a block diagram illustrating a detailed configuration of the target server device 630.

  As shown in FIG. 26, the user device 610 of the present embodiment is obtained by replacing the communication processing unit 115 of the user device 110 of the first embodiment with a communication processing unit 615. As shown in FIG. 27, the user authentication device 620 of this embodiment is obtained by replacing the communication processing unit 125 of the user authentication device 120 of the first embodiment with a communication processing unit 625. As shown in FIG. 28, the target server device 630 of the present embodiment is obtained by replacing the communication processing unit 133 of the target server device 130 of the first embodiment with a communication processing unit 633.

<User authentication process>
Next, user authentication processing according to this embodiment will be described.

  FIG. 29 is a sequence diagram for describing user authentication processing according to the fifth embodiment. Hereinafter, the user authentication process of the fifth embodiment will be described with reference to FIG. In the following description, differences from the first embodiment will be mainly described, and description of portions common to the first embodiment will be omitted.

  First, as in the first embodiment, the user device 610 accesses the target server device 630 via the network 140, and the output unit 112 of the user device 610 uses the address input instruction information based on the information transmitted from the target server device 630. Is output (step S301). However, the address input instruction information of this embodiment is information for instructing input of an email address of the user authentication device (hereinafter referred to as “user authentication device email address information”). Note that the user authentication device address information of this embodiment is destination information different from the user authentication device e-mail address information. For example, URL address, IP address, etc. are the user authentication device address information of this embodiment.

  The user who perceives the output address input instruction information inputs the user authentication device e-mail address information to the input unit 111 of the user device 610 (FIG. 26) (step S302). The input user authentication device e-mail address information is temporarily stored in the storage unit 116. The communication processing unit 515 reads out the user authentication device e-mail address information from the storage unit 116 and uses it together with service request information (including service request contents) and user device address information that is address information (destination information) of the user device 610. To the transmission unit 113. The transmission unit 113 transmits the service request information, the user authentication device e-mail address information, and the user device address information to the target server device 630 through the network 140 (step S303). This transmission is performed as an HTTP request, for example.

  These pieces of information are received by the receiving unit 131 of the target server device 630 (FIG. 28) (step S304) and sent to the communication processing unit 133. The communication processing unit 133 stores the user authentication device e-mail address information and the user device address information in the storage unit 136. Further, the communication processing unit 133 generates session information corresponding to the service request information (step S305), and stores the session information in the storage unit 136 in association with the service request information.

  Next, the communication processing unit 133 reads user authentication device e-mail address information, target server device address information, and session information from the storage unit 136. Then, the communication processing unit 133 generates an e-mail including the destination server device address information and the session information in the contents and destined for the user authentication device e-mail address information. This electronic mail is transmitted from the transmission unit 132 (step S306).

  The e-mail including the target server device address information and the session information is received by the receiving unit 124 of the user authentication device 620 through the network 140 (step S307), and further stored in the storage unit 128 from the communication processing unit 625. The Next, the communication processing unit 625 reads the target server device address information and the session information from the storage unit 128 and sends the target server device address information, the session information, and its own user authentication device address information to the transmission unit 123. The transmission unit 123 transmits user authentication device address information and session information to the target server device 630 whose destination is specified by the target server device address information via the network 140 (step S308). These pieces of information are received by the receiving unit 131 of the target server device 630 (FIG. 28) and stored in the storage unit 136 by the communication processing unit 633.

  Thereafter, the same processing as the steps S6 to S22 of the first embodiment (such as authentication processing by the user authentication device) is executed.

<Features of this embodiment>
In this embodiment, the user knows the e-mail address information of the user authentication device, but the user device can cause the user authentication device to perform an authentication process even if it is not the user authentication device address information.

[Sixth Embodiment]
Next, a sixth embodiment of the present invention will be described.
Similar to the fifth embodiment, this embodiment also causes the user authentication device to transmit user authentication device address information (destination information transmission process), and the user device receives the user authentication device address information (destination information reception process). In this form, the device designates a destination by the user authentication device address information and transmits authentication request information to the user authentication device. However, in the sixth embodiment, even when the user does not know the destination information of the user authentication device at all by causing the user authentication device to read information (two-dimensional barcode such as a QR code) output from the user device. Applicable form. Note that the method of this embodiment is also applicable to the above-described embodiments. However, the case where the system of this embodiment is applied to the first embodiment will be described below as an example.

<Configuration>
In the user authentication system of this embodiment, the user device 110 of the first embodiment is replaced with the user device 710, the user authentication device 120 is replaced with the user authentication device 720, and the target server device 130 is replaced with the target server device 730. It is a configuration.

  FIG. 30 is a block diagram illustrating a detailed configuration of the user device 710 according to the sixth embodiment. FIG. 31 is a block diagram illustrating a detailed configuration of the user authentication device 720. FIG. 32 is a block diagram illustrating a detailed configuration of the target server device 730.

  As illustrated in FIG. 30, a user device 710 according to the present embodiment is obtained by replacing the communication processing unit 115 of the user device 110 according to the first embodiment with a communication processing unit 715. Further, as shown in FIG. 31, the user authentication device 720 of this embodiment replaces the communication processing unit 125 of the user authentication device 120 of the first embodiment with a communication processing unit 725, and adds an image input unit 721 such as a camera. It is a thing. As shown in FIG. 32, the target server device 730 of this embodiment is obtained by replacing the communication processing unit 133 of the target server device 130 of the first embodiment with a communication processing unit 733.

<User authentication process>
Next, user authentication processing according to this embodiment will be described.

  FIG. 33 is a sequence diagram for describing user authentication processing according to the sixth embodiment. The user authentication process according to the sixth embodiment will be described below with reference to this figure. In the following description, differences from the first embodiment will be mainly described, and description of parts common to the first embodiment will be omitted.

  First, the communication processing unit 715 of the user device 710 (FIG. 30) sends service request information and user device address information to the transmission unit 113, and the transmission unit 113 transmits these to the target server device 730 via the network 140 ( Step S401).

  These pieces of information are received by the receiving unit 131 of the target server device 730 (FIG. 32) (step S402), sent to the communication processing unit 133, and temporarily stored in the storage unit 136. Further, the communication processing unit 133 generates session information corresponding to the transmitted service request information (step S403), and stores the session information in the storage unit 136 in association with the service request information.

  Next, the communication processing unit 133 reads the session information from the storage unit 136, and generates QR code information including this and the target server device address information of itself. In addition, the communication processing unit 133 reads the user device address information from the storage unit 136 and sends the user device address information and the QR code information to the transmission unit 132. The transmission unit 132 transmits a QR code through the network 140 to the user device 710 whose destination is specified by the user device address information (step S404).

  The QR code is received by the receiving unit 114 of the user device 710 (step S405), and further sent from the communication processing unit 715 to the output unit 112. The output unit 112 displays the QR code indicated by the QR code information (step S406).

  The displayed QR code is read by the image input unit 721 of the user authentication device 720 (FIG. 31), and the session information and target server device address information specified by the QR code are sent to the communication processing unit 725 (step). S407). The communication processing unit 725 temporarily stores these in the storage unit 128.

  Next, the communication processing unit 725 reads the session information and the target server device address information from the storage unit 128, and the target server whose destination is specified by the target server device address information is its user authentication device address and session information. It is transmitted to the device 730 (step S408). The transmitted user authentication device address and session information are received by the receiving unit 131 of the target server device 730 (FIG. 32) and stored in the storage unit 136 by the communication processing unit 733.

  Thereafter, the same processing as the steps S6 to S22 of the first embodiment (such as authentication processing by the user authentication device) is executed.

<Features of this embodiment>
In this embodiment, even when the user does not know the destination information of the user authentication device at all, the user device can cause the user authentication device to perform an authentication process.

[Other communication methods]
Hereinafter, a communication method between the user apparatus and the user authentication apparatus other than the fourth to sixth embodiments will be exemplified.
FIG. 34 is a conceptual diagram illustrating an example in which the user device 110 and the user authentication device 120 are locally connected, and the user device 110 and the target server device 130 are connected through the global network 840. Such a configuration may be used. As a local connection method between the user device 110 and the user authentication device 120, for example, a connection using a USB (Universal Serial Bus) cable, an electromagnetic wave communication connection (Felica or the like), an infrared communication connection, or a PAN (Personal Area Network) connection is used. Etc. can be illustrated.

  Also, the DNS server device is arranged on the network, and the IP address of the user authentication device is associated with the user authentication device address information (URL, etc.) by the DynamicDNS method (standard technology), and the user device and the user authentication device communicate with each other. May be.

  Further, as a modified example of the sixth embodiment, a code number that can be recognized by the user is used instead of the QR code, and the user uses the code number output from the user device instead of causing the user authentication device to read the QR code. It is good also as a structure input into a user authentication apparatus.

[Other variations, etc.]
The present invention is not limited to the embodiment described above. For example, in each of the above-described embodiments, the signature information is added to the authentication result information, but the configuration may be such that the signature information is not added to the authentication result information.

  In the second embodiment, the ciphertext obtained by encrypting the information including the first public key, the target server device identifier, and the user identifier using the second secret key by the public key cryptosystem, the first public key, and the purpose A public key certificate including a server device identifier and a user identifier is generated. However, the public key certificate may be generated without using the user identifier, or the public key certificate may be generated using other information instead of or in addition to the user identifier.

  In the second embodiment, the target server device uses the second public key included in the target server device, the ciphertext included in the public key certificate, the first public key, the target server device identifier, and the user identifier. The public key certificate was verified. However, the target server device uses the second public key and target server device identifier included in the target server device, the ciphertext included in the public key certificate, the first public key, and the user identifier, and Verification may be performed. In this case, it is not necessary for the public key certificate to include the target server device identifier.

  Further, in each of the above-described embodiments, “selection information on whether or not to perform user authentication” is exemplified as the authentication information input to the user authentication device and used for the authentication process. However, passwords, biometric authentication information, or the like may be used as authentication information, or a combination of these and “selection information for whether or not to perform user authentication” may be used as authentication information. In this case, the user authentication device executes an authentication process corresponding to each authentication information.

  Further, the present invention may be implemented in a form combining the above-described embodiments.

  Needless to say, other modifications are possible without departing from the spirit of the present invention. In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary.

  Further, when the above-described configuration is realized by a computer, processing contents of functions that each device should have are described by a program. The processing functions are realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. The computer-readable recording medium may be any medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory. Specifically, for example, the magnetic recording device may be a hard disk device or a flexible Discs, magnetic tapes, etc. as optical disks, DVD (Digital Versatile Disc), DVD-RAM (Random Access Memory), CD-ROM (Compact Disc Read Only Memory), CD-R (Recordable) / RW (ReWritable), etc. As the magneto-optical recording medium, MO (Magneto-Optical disc) or the like can be used, and as the semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory) or the like can be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

  A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads a program stored in its own recording medium and executes a process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).

  In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

  As an application field of the present invention, for example, a single sign-on system in a field that requires a highly secure authentication technology such as Internet banking or Internet transaction can be exemplified.

FIG. 1 is a conceptual diagram illustrating the configuration of a user authentication system having the basic configuration of the present invention. FIG. 2 is a conceptual diagram illustrating the overall configuration of the user authentication system of the first embodiment. FIG. 3 is a block diagram illustrating a detailed configuration of the user apparatus according to the first embodiment. FIG. 4 is a block diagram illustrating a detailed configuration of the user authentication device according to the first embodiment. FIG. 5 is an external view showing a specific example of the user authentication device of the first embodiment. FIG. 6 is a block diagram illustrating a detailed configuration of the target server device according to the first embodiment. FIG. 7 is a sequence diagram for explaining user authentication processing according to the first embodiment. FIG. 8 is a sequence diagram for explaining user authentication processing according to the first embodiment. FIG. 9A is a diagram illustrating address input instruction information displayed as a pop-up window. FIG. 9B shows an example of the input instruction information output from the output unit which is a user interface. FIG. 10 is a diagram illustrating a description of an HTTP response. FIG. 11 is a conceptual diagram illustrating the overall configuration of the user authentication system of the second embodiment. FIG. 12 is a block diagram illustrating a detailed configuration of a user device according to the second embodiment. FIG. 13 is a block diagram illustrating a detailed configuration of the user authentication device. FIG. 14 is a block diagram illustrating a detailed configuration of the target server device. FIG. 15 is a block diagram illustrating a detailed configuration of the certificate issuing server device. FIG. 16 is a sequence diagram for explaining public key certificate storage processing according to the second embodiment. FIG. 17 is a sequence diagram for describing user authentication processing according to the second embodiment. FIG. 18 is a diagram illustrating an HTTP response description. FIG. 19 is a sequence diagram for describing user authentication processing according to the third embodiment. FIG. 20 is a conceptual diagram illustrating the overall configuration of the user authentication system of the fourth embodiment. FIG. 21 is a block diagram illustrating a detailed configuration of a user apparatus according to the fourth embodiment. FIG. 22 is a block diagram illustrating a detailed configuration of the user authentication device according to the fourth embodiment. FIG. 23 is a block diagram illustrating a detailed configuration of the relay server device according to the fourth embodiment. FIG. 24 is a sequence diagram for describing user authentication processing according to the fourth embodiment. FIG. 25 is a sequence diagram for describing user authentication processing according to the fourth embodiment. FIG. 26 is a block diagram illustrating a detailed configuration of a user apparatus according to the fifth embodiment. FIG. 27 is a block diagram illustrating a detailed configuration of the user authentication device according to the fifth embodiment. FIG. 28 is a block diagram illustrating a detailed configuration of a target server device according to the fifth embodiment. FIG. 29 is a sequence diagram for describing user authentication processing according to the fifth embodiment. FIG. 30 is a block diagram illustrating a detailed configuration of a user apparatus according to the sixth embodiment. FIG. 31 is a block diagram illustrating a detailed configuration of a user authentication device according to the sixth embodiment. FIG. 32 is a block diagram illustrating a detailed configuration of a target server device according to the sixth embodiment. FIG. 33 is a sequence diagram for describing user authentication processing according to the sixth embodiment. FIG. 34 is a conceptual diagram illustrating an example in which a user device and a user authentication device are locally connected, and the user device and the target server device are connected through a global network.

Explanation of symbols

1, 100, 300, 500, 800 User authentication system 10, 110, 310, 510, 610, 710 User device 20, 120, 320, 520, 620, 720 User authentication device 30, 130, 330, 630 Target server device

Claims (2)

A user authentication method,
An input unit which is a user interface of the user authentication device, an authentication information input process for receiving an input of authentication information;
The authentication processing unit of the user authentication device performs authentication processing of a user who uses a user device configured in another housing using the authentication information, generates authentication result information indicating the authentication processing result, and generates the authentication An authentication result information generation process for outputting result information;
An authentication result information transmission process in which the transmission unit of the user authentication device transmits the authentication result information;
An authentication result information receiving process in which the receiving unit of the target server device receives the authentication result information;
The permission unit of the target server device that has received the authentication result information permits a service information communication between the target server device and the user device, and
I have a,
A signature generation unit of the user authentication device generates a signature information of the authentication result information using a first secret key of the user authentication device, and outputs the signature information;
The authentication result verification unit of the target server device verifies the signature information of the authentication result information using the first public key corresponding to the first secret key, and determines whether or not the authentication result information is valid And an authentication result verification process for outputting the determination result,
The signature information generation process is as follows:
A process executed between the authentication result information generation process and the authentication result information transmission process;
The authentication result information transmission process is as follows:
In addition to the authentication result information, the process further transmits the signature information,
The authentication result information receiving process is as follows:
In addition to the authentication result information, the process further receives the signature information,
The verification result verification process
A process executed between the authentication result information reception process and the authorization process;
The above authorization process
When the authentication result information is determined to be valid by the authentication result verification process, the permission unit of the target server device permits communication of service information between the target server device and the user device. process der is,
The user authentication method is:
Each destination server device having a ciphertext obtained by encrypting information including the identifier of the destination server device and the first public key using the second secret key of the certificate issuing server device, and the first public key A public key certificate storage process for storing the public key certificate of the user authentication device in the storage unit of the user authentication device,
The public key certificate verification unit of the target server device verifies the public key certificate using the second public key corresponding to the second secret key and the identifier of the target server device, and the public key certificate A public key certificate verification process for determining whether the certificate is valid and outputting the determination result,
The authentication result information transmission process is as follows:
In addition to the authentication result information and its signature information, the process of transmitting the public key certificate,
The authentication result information receiving process is as follows:
In addition to the authentication result information and its signature information, the process of receiving the public key certificate,
The public key certificate verification process
A process executed between the authentication result information reception process and the authentication result verification process;
The verification result verification process
Whether the authentication result information is valid by verifying the signature information of the authentication result information using the public key of the public key certificate determined to be valid in the public key certificate verification process Is a process of determining and outputting the determination result.
The user authentication method characterized by the above-mentioned. A user authentication method,
An input unit which is a user interface of the user authentication device, an authentication information input process for receiving an input of authentication information;
The authentication processing unit of the user authentication device performs authentication processing of a user who uses a user device configured in another housing using the authentication information, generates authentication result information indicating the authentication processing result, and generates the authentication An authentication result information generation process for outputting result information;
An authentication result information transmission process in which the transmission unit of the user authentication device transmits the authentication result information;
An authentication result information receiving process in which the receiving unit of the target server device receives the authentication result information;
Permitting unit of the authentication result information the target server device receiving includes a permission step of permitting the service information communication between the target server device and the user device,
An authentication request information transmission process in which the transmission unit of the user device transmits authentication request information to the user authentication device;
An authentication request information receiving process in which the receiving unit of the user authentication device receives the authentication request information;
In response to the reception of the user authentication device receives the authentication request information, the output unit is a user interface of the user authentication device, possess an input instruction information output step of outputting the input instruction information, and
The authentication information input process is as follows:
A process executed between the input instruction information output process and the authentication result information generation process;
The authentication result information transmission process is as follows:
The transmission unit of the user authentication device is a process of transmitting the authentication result information to the user device,
The authentication result information receiving process is as follows:
Receiver of the target server device, Ri process der for receiving the authentication result information sent from the user device,
The user authentication method is:
A destination information transmission process in which the transmission unit of the user authentication device transmits user authentication device address information that is destination information of the user authentication device;
A receiving part of the user device comprises a destination information receiving process for receiving the user authentication device address information;
The authentication request information transmission process is as follows:
The transmission unit of the user device is a process of designating a destination by the user authentication device address information and transmitting the authentication request information to the user authentication device.
The user authentication method characterized by the above-mentioned.

Images