JP6438256B2 - Terminal device, authentication server, authentication system, authentication method, and authentication program - Google Patents

Description

  The present invention relates to a terminal device that transmits confidential information, an authentication system, an authentication server, an authentication method, and an authentication program.

Conventionally, when a user accesses a service site via a network from a browser of a terminal device, the entered ID and password are checked against registration information by an authentication server, and the user is authenticated as a legitimate member. The
In this case, the authentication server issues authentication information for specifying the user and stores the authentication information in a browser cookie (HTTP cookie). Then, for the second and subsequent accesses to the same site, the terminal device transmits the authentication information stored in the cookie to the authentication server, thereby saving the user from input (for example, Patent Document 1). reference).

FIG. 5 is a diagram showing a flow of user authentication using a conventional cookie.
When the user inputs an ID and password in the terminal device (Device) (1), authentication information (Cookie Key) is issued in the authentication server (WebServer) (2) and stored in the browser cookie via an HTML file. (3). When the terminal device designates a URL and accesses the authentication server, authentication information associated with this URL is automatically added (4). As a result, the authentication server identifies the user based on the authentication information, and provides a service (HTML page) unique to the identified user (5).

  In addition, the browser includes a plurality of storage areas including the above-described cookies. For example, a method for providing a service using a local storage (local storage) included in a browser compatible with HTML5 has been proposed (for example, Patent Documents). 2 and 3).

JP-T-2003-527646 JP 2014-085812 A JP 2012-069087 A

  By the way, the information in the cookie has a risk of leakage due to an access attack from the outside. For this reason, it is required to periodically update the cookie by allowing the user to re-enter the ID and password (for example, once every two weeks).

  An object of the present invention is to provide a terminal device, an authentication server, an authentication system, an authentication method, and an authentication program that can safely transmit confidential information to a specific destination.

  A terminal device according to the present invention is a terminal device for storing confidential information that can be transmitted to a specific destination, and a command for transmitting the confidential information and a transmission in which at least a part of the confidential information is described A first storage unit that stores a script and limits the use of the transmission script to execution, and a transmission processing unit that transmits the confidential information to the transmission destination by executing the transmission script.

  The first storage unit may be a browser cache.

  The other part of the confidential information is stored in a second storage unit where at least the domain of the access source is restricted, and the instruction reads the other part of the confidential information from the second storage unit, The entire confidential information may be transmitted to the transmission destination.

  The address of the transmission destination is stored in a second storage unit where at least the domain of the access source is limited, and the instruction reads the address of the transmission destination from the second storage unit and transmits the confidential information It may be for transmission to a previous address.

  The second storage unit may be a local Storage defined in HTML5.

  The transmission script may further describe the destination address.

  The instructions may be for encrypting and transmitting the confidential information.

  The confidential information may be authentication information that identifies a user of the terminal device, and the transmission destination may be an authentication server that authenticates the validity of the user based on the authentication information.

  An authentication server according to the present invention is an authentication server that authenticates the legitimacy of a user of the terminal device using authentication information, and generates the authentication information and transmits the authentication information to the authentication server. A generation unit that generates a transmission script for the terminal device, a storage script for storing the transmission script, and the transmission script in a first storage unit whose use of the script is limited to execution in the terminal device; A first transmission unit that transmits to the terminal device, and a second transmission unit that activates the transmission script to transmit the activation script for activating the transmission script to the terminal device in response to access from the terminal device And comprising.

  The generation unit may generate second authentication information in association with the first authentication information after receiving the first authentication information from the terminal device.

  The generation unit may generate the authentication information in association with the terminal specific information after receiving the terminal specific information from the terminal device.

  The generation unit may generate a random value as the authentication information.

  The authentication server may accept and store information associated with old and new authentication information when the authentication information of the same user is regenerated.

  An authentication system according to the present invention is an authentication system including an authentication server that authenticates the legitimacy of the user by authentication information that identifies the user, and a terminal device that transmits the authentication information to the authentication server, the authentication server Generates the authentication information, generates a transmission script for transmitting the authentication information to the authentication server, stores the transmission script, and the transmission script in a predetermined storage area in the terminal device. A first transmission unit that transmits a storage script to the terminal device, and a second transmission unit that transmits a start script for starting the transmission script to the terminal device in response to an access from the terminal device. A first storage unit that limits the use of the stored script to execution; A storage processing unit that executes the storage script and stores the transmission script in the first storage unit; and a transmission that executes the activation script to activate the transmission script and transmits the authentication information to the authentication server. A processing unit.

  An authentication method according to the present invention is an authentication method in which an authentication server authenticates the legitimacy of a user of a terminal device, wherein the authentication server generates authentication information for specifying the user, and the authentication information is A generation step for generating a transmission script for transmission to the authentication server, and a storage script for the authentication server to store the transmission script and the transmission script in a predetermined storage area in the terminal device to the terminal device. A first transmission step of transmitting; a storage step in which the terminal device executes the storage script; and the transmission script is stored in a first storage unit whose use of the script is limited to execution; and the authentication server includes: In response to access from the terminal device, an activation script for activating the transmission script is sent to the terminal device. Including a second transmission step of signal, the terminal device starts the transmission script executes the start script, and a third transmission step of transmitting the authentication information to the authentication server, the.

  An authentication program according to the present invention is an authentication program for authenticating the legitimacy of a user of a terminal device by an authentication server, wherein the authentication server generates authentication information for specifying the user, and the authentication information Generating a transmission script for transmitting the transmission script to the authentication server, the transmission script for the authentication server and a storage script for storing the transmission script in a predetermined storage area in the terminal device, A first transmission step of transmitting to a device; a storage step in which the terminal device executes the storage script; and storing the transmission script in a first storage unit limited to execution of the script; and the authentication An activation script for the server to activate the transmission script in response to access from the terminal device. A second transmission step of transmitting a message to the terminal device; a third transmission step of transmitting the authentication information to the authentication server by the terminal device executing the activation script to activate the transmission script; , Execute.

  According to the present invention, confidential information can be safely transmitted to a specific destination.

It is a figure which shows the function structure of the authentication system which concerns on embodiment. It is a figure which shows the flow of a process at the time of the first access to the authentication server which concerns on embodiment. It is a figure which shows the flow of a process when accessing the authentication server which concerns on embodiment after 2nd time. It is a figure which shows the tolerance with respect to the attack from the outside of the authentication system which concerns on embodiment. It is a figure which shows the flow of the user authentication using the conventional cookie.

Hereinafter, an example of an embodiment of the present invention will be described.
The security technology layer includes an OS layer, a hardware layer, an application layer, and the like. The present invention corresponds to a security technology in the application layer. This embodiment is particularly suitable for preventing a third party from acquiring confidential information by the action of a third party script executed on the browser.

FIG. 1 is a diagram illustrating a functional configuration of an authentication system 1 according to the present embodiment.
The authentication system 1 includes an authentication server 10 and a terminal device 20, and authenticates the legitimacy of the user of the terminal device 20 by the authentication server 10 based on authentication information that identifies the user.

The authentication server 10 is an information processing apparatus including a generation unit 11, a first transmission unit 12, a second transmission unit 13, an authentication unit 14, and a storage unit 15 (third storage unit). .
The terminal device 20 is an information processing device that includes a first storage unit 21, a second storage unit 22, a storage processing unit 23, and a transmission processing unit 24 (third transmission unit). Each of these functional units is implemented by, for example, a browser application for using a Web service. The terminal device 20 may be a mobile terminal such as a mobile phone, a smartphone, or a tablet terminal used by a single user, for example.

The generation unit 11 generates authentication information for specifying a user in response to the first access from the terminal device 20 and generates a transmission script for transmitting the authentication information from the terminal device 20 to the authentication server. To do. The transmission script describes authentication information, an address of the authentication server, and a command for transmitting the authentication information to this address.
The authentication information is generated by the following procedure, for example.

(1) After receiving the first authentication information (for example, ID and password) from the terminal device 20, the generation unit 11 associates the first authentication information with the second authentication information (ID and KEY). Generate. Note that the ID in the second authentication information may be different from the ID of the first authentication information. The KEY (authentication key) is generated based on the ID.
(2) After receiving the terminal specific information from the terminal device 20, the generation unit 11 generates authentication information (ID and KEY) in association with the terminal specific information.
(3) The generation unit 11 generates random values (ID and KEY) as authentication information.

The first transmission unit 12 transmits the transmission script generated by the generation unit 11 and the storage script for storing the transmission script in a predetermined storage area in the terminal device 20 to the terminal device 20.
The second transmission unit 13 transmits an activation script for activating the transmission script to the terminal device 20 in response to the second and subsequent accesses from the terminal device 20.
Note that the transmission script, the storage script, and the instruction script may be, for example, JavaScript (registered trademark). Further, any two or all three of the transmission script, the storage script, and the instruction script may be integrated.

  The authentication unit 14 verifies the authentication information generated by the generation unit 11 and the authentication information received from the terminal device 20 and authenticates that the user of the terminal device 20 is valid.

The storage unit 15 stores information related to services provided to each user in association with the authentication information of each user.
Furthermore, when the same user authentication information is regenerated for a plurality of terminal devices 20 due to model change or the like, the storage unit 15 receives and stores information associated with old and new authentication information. For example, the authentication server 10 identifies a plurality of pieces of authentication information of the same user by linking with an ID and a password or issuing a group ID based on a group designation input.

  The first storage unit 21 is a storage area in which the use of the stored script is limited to the execution of this script, and is, for example, a browser cache. An access method other than execution is restricted or prohibited for the script stored in the first storage unit 21. That is, the script stored in the first storage unit 21 has a property that, when accessed, executes a command in the script and cannot acquire data in the script from the outside. This prevents a third party from acquiring the authentication information and falsifying the destination address.

  The second storage unit 22 is a storage area in which at least the domain of the access source is limited, and is, for example, a local Storage defined in HTML5. The local Storage is restricted in origin (“protocol: // domain name: port number”) and cannot be accessed (data storage and retrieval) from an attacker's domain different from the authentication server.

The storage processing unit 23 executes the storage script received from the authentication server 10 and stores the transmission script in the first storage area 21.
Further, the storage processing unit 23 may store a part of the authentication information read by the transmission script in the second storage area. Thereby, execution of the transmission script by a third party is suppressed.

The transmission processing unit 24 executes the transmission script via the activation script, and transmits the authentication information to the authentication server 10 specified by the URL included in the transmission script.
Here, the transmission processing unit 24 may encrypt the authentication information using a transmission script and transmit it using a predetermined protocol.

  FIG. 2 is a diagram illustrating a processing flow at the time of the first access to the authentication server 10 according to the present embodiment.

When the user inputs an ID and password in the terminal device 20 and logs in (1), the authentication server 10 generates authentication information (for example, ID and KEY) based on or regardless of the input ID and password (2). ).
At this time, a session key for guaranteeing the same session is issued and stored in a browser cookie via an HTML file. Note that the mechanism for guaranteeing the same session is not limited to this, and an existing technology can be used.

  The transmission script A including at least part of the generated authentication information (for example, ID), the URL of the authentication server 10, and a command for transmitting the authentication information from the terminal device 20 to the authentication server 10 executes the storage script B By doing so, it is stored in the first storage unit 21 (browser cache). Further, the remaining part of the authentication information (for example, KEY) is stored in the second storage unit 22 (HTML5 local Storage) (3).

  FIG. 3 is a diagram showing a flow of processing when the authentication server 10 according to the present embodiment is accessed for the second time and thereafter.

  When the user designates a URL on the terminal device 20 and accesses the authentication server 10 without inputting an ID and password (1), the authentication server 10 generates an activation script C for activating the transmission script A as an HTML file. It is transmitted to the terminal device 20 above or accompanying the HTML file (2).

When the terminal device 20 accesses the transmission script A stored in the first storage unit 21 (browser cache) by executing the startup script C, the transmission script A is executed (3).
When the terminal device 20 acquires a part of the authentication information (for example, KEY) stored in the second storage unit 22 (HTML5 localStorage) by the transmission command described in the transmission script A (4), the authentication is performed. The entire information is encrypted, and the encrypted data is transmitted to the authentication server 10 with the URL embedded in the transmission script A as the destination (5).

  FIG. 4 is a diagram showing resistance to an attack from the outside of the authentication system 1 according to the present embodiment.

  The authentication system 1 is assumed to be an attack by, for example, MITM (man-in-the-middle) or XSS (cross site scripting).

  For MITM attacks, the possibility of acquiring authentication information itself in the communication path 200 is reduced by encryption. Furthermore, for example, by adopting a method that does not fix encryption information transmitted and received using a one-time key, the possibility of unauthorized use of encryption information acquired by a third party is reduced.

  Even if the browser cache transmission script A is accessed by the XSS attack, the transmission information is transmitted only to the authorized authentication server 10 by executing the transmission script A.

Specifically, for example, when the terminal device 20 executes the attack script D prepared by the third-party server 100 (1) and connects to the authentication server 10 (2), the terminal device 20 receives the activation script C ( 3) Even if the transmission script A is accessed (4), as a result of executing this transmission script A, the authentication information is not provided to a third party and is transmitted only to the authorized authentication server 10 (5 ).
Even if the transmission script A is directly accessed by the attack script D, the authentication information is transmitted only to the authorized authentication server 10. Furthermore, when a part of the authentication information (KEY) is stored in the second storage unit 22 (local Storage), this information is not acquired from the domain of the server 100 different from the authentication server 10, and the authentication information is transmitted. Itself is not done.
Therefore, the possibility of unauthorized use of authentication information by a third party is reduced.

As described above, according to the present embodiment, the terminal device 20 stores the transmission script in which the confidential information (authentication information) and the instruction for transmitting the confidential information are described in the first storage unit 21 (browser cache). ) And restrict the use of accessing this transmission script to the execution of the script.
When a third-party script executed on the browser accesses a script (transmission script) stored in the first storage unit 21, it follows the access restrictions and interface defined by the browser. That is, even if a third-party script can execute the transmission script, it is impossible to directly read the description content of the transmission script outside the interface specification. Further, the transmission script does not describe an instruction for providing authentication information to the script that started the transmission script. Therefore, the transmission script transmits authentication information only to the authentication server 10 that is a specific destination. For this reason, even if a third-party script executes the transmission script, authentication information other than the authorized authentication server 10 will not be received.
In this way, the terminal device 20 can safely transmit confidential information to a specific destination.

  In particular, the authentication system 1 transmits authentication information for specifying a user from the terminal device 20 only to a specific authentication server 10 using a transmission script stored in the browser cache. Accordingly, the authentication system 1 can save the authentication information in the terminal device 20 and reduce the burden of the user on the authentication information input operation. Furthermore, since the stored authentication information can be accessed only for the purpose of transmission to the regular authentication server 10, the authentication system 1 can realize highly secure user authentication.

  Since the authentication system 1 stores a part of the authentication information in the local storage of HTML5 in which the access source (origin) is restricted, for example, access from a different domain can be rejected and unauthorized execution of the transmission script can be suppressed.

  Since the authentication system 1 encrypts the authentication information and transmits it to the authentication server 10, the possibility that the authentication information itself is read in the communication path can be reduced.

  Further, the authentication system 1 receives the input of the first authentication information (ID and password) from the first user, and then generates the second authentication information managed in association with the first authentication information, It can be stored in the terminal device 20. As a result, the authentication system 1 can realize highly secure user authentication with the newly issued second authentication information while specifying the user with the first authentication information managed by the user.

  Further, the authentication system 1 can generate second authentication information that is managed in association with the terminal specific information, and store the second authentication information in the terminal device 20. As a result, the authentication system 1 can identify the user terminal device 20 while further reducing input operations by the user, and can realize highly secure user authentication by the newly issued second authentication information.

  Further, the authentication system 1 can generate a random value as the authentication information and store it in the terminal device 20. Thereby, the authentication system 1 can authenticate that it is a user who accessed from the same terminal, without specifying the user or the terminal device 20 from the terminal device 20.

  The authentication system 1 cannot identify the user only with the authentication information (second authentication information) generated by the authentication server 10. For this reason, when the authentication server 10 reissues authentication information to a new terminal device 20 of the same user, for example, due to a model change or the like, the management information associated with each of the authentication information is managed by the same user. Need to be associated with each other. Therefore, the authentication server 10 receives and stores information (for example, a password) that groups a plurality of pieces of authentication information. Thereby, a plurality of pieces of authentication information can be linked to manage the same user information.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. Further, the effects described in the present embodiment are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the present embodiment.

  In the above-described embodiment, the information stored in the terminal device 20 is user authentication information, and the authentication system 1 that transmits this authentication information to the authentication server 10 has been described. However, the present invention is not limited to this. The terminal device 20 stores not only the authentication information but also other confidential information in the first storage unit 21 and the second storage unit 22 with the same configuration as the authentication information, and transmits it to a specific destination. There may be.

  In the above-described embodiment, the terminal device 20 transmits the authentication information by using the function of the browser application. However, the terminal device 20 is not limited thereto, and includes the first storage unit 21 that can be accessed from a predetermined application. It may be realized as a configuration.

  Moreover, the information memorize | stored in the 2nd memory | storage part 22 may be a transmission destination (address of the authentication server 10) other than a part of authentication information, and may be both of these. Thereby, in order for the terminal device 20 to transmit the authentication information, it is necessary to read the information from the second storage unit according to the instruction of the transmission script, so the transmission script must be accessed from a predetermined domain. Accordingly, execution of transmission script fraud is suppressed and safety is improved.

  The authentication method by the authentication system 1 is realized by software. When realized by software, a program constituting the software is installed in the information processing apparatus (the authentication server 10 and the terminal device 20). These programs may be recorded on a removable medium such as a CD-ROM and distributed to users, or may be distributed by downloading to a computer via a network. Furthermore, these programs may be provided to a computer as a Web service via a network without being downloaded.

A transmission script B storage script C activation script 1 authentication system 10 authentication server 11 generation unit 12 first transmission unit 13 second transmission unit 14 authentication unit 15 storage unit (third storage unit)
20 terminal device 21 first storage unit 22 second storage unit 23 storage processing unit 24 transmission processing unit (third transmission unit)

Claims (15)

A terminal device that stores confidential information that can be transmitted to a specific destination,
And wherein the instructions for sending sensitive information, and wherein at least a portion of said confidential information is written, the first storage unit you memorize the transmission script usage is limited to run,
Wherein the startup script received from the transmission destination to start the transmission script, by executing the transmission script, the transmission processing unit and, Bei obtain terminal device that transmits the confidential information to the destination.   The terminal device according to claim 1, wherein the first storage unit is a browser cache. The other part of the confidential information is stored in a second storage unit in which at least the access source domain is restricted,
The terminal according to claim 1 or 2, wherein the command is for reading another part of the confidential information from the second storage unit and transmitting all of the confidential information to the transmission destination. apparatus. The destination address is stored in a second storage unit in which at least the access source domain is restricted ,
4. The terminal according to claim 1 , wherein the command is for reading the address of the transmission destination from the second storage unit and transmitting the confidential information to the address of the transmission destination. 5. apparatus. The terminal device according to claim 3 or 4 , wherein the second storage unit is a local storage defined in HTML5. The transmission script, further terminal device according to any one of claims 1 to 3 in which the address of the destination is written. The instructions, terminal device according to claim 6 wherein the confidential information from the claim 1 is for sending encrypted. The confidential information is authentication information that identifies a user of the terminal device,
The destination terminal device according to any one of claims 1 to 7 by the authentication information is authentication server to authenticate the user. An authentication server that authenticates the legitimacy of the user by authentication information that identifies the user of the terminal device,
Generating the authentication information and generating a transmission script for transmitting the authentication information to the authentication server;
A first transmission unit for transmitting to the terminal device a storage script for storing the transmission script and the transmission script in a first storage unit whose use of the script is limited to execution in the terminal device;
An authentication server comprising: a second transmission unit that transmits an activation script for activating the transmission script to the terminal device in response to access from the terminal device, and activates the transmission script. The authentication server according to claim 9 , wherein the generation unit generates second authentication information in association with the first authentication information after receiving the first authentication information from the terminal device. The authentication server according to claim 9 , wherein the generation unit generates the authentication information in association with the terminal specific information after receiving the terminal specific information from the terminal device. The authentication server according to claim 9 , wherein the generation unit generates a random value as the authentication information. The authentication according to claim 11 or 12 , wherein the authentication server includes a third storage unit that receives and stores information associated with old and new authentication information when the authentication information of the same user is regenerated. server. An authentication method in which an authentication server authenticates the validity of a user of a terminal device,
A step of generating authentication information for the authentication server to identify the user and generating a transmission script for transmitting the authentication information to the authentication server;
A first transmission step in which the authentication server transmits the transmission script and a storage script for storing the transmission script in a predetermined storage area in the terminal device to the terminal device;
A storage step in which the terminal device executes the storage script, and the transmission script is stored in a first storage unit whose use of the script is limited to execution;
A second transmission step in which the authentication server transmits an activation script for activating the transmission script to the terminal device in response to an access from the terminal device;
And a third transmission step in which the terminal device executes the activation script to activate the transmission script and transmits the authentication information to the authentication server. An authentication program for authenticating the validity of a user of a terminal device by an authentication server,
A step of generating authentication information for the authentication server to identify the user and generating a transmission script for transmitting the authentication information to the authentication server;
A first transmission step in which the authentication server transmits the transmission script and a storage script for storing the transmission script in a predetermined storage area in the terminal device to the terminal device;
A storage step in which the terminal device executes the storage script, and the transmission script is stored in a first storage unit whose use of the script is limited to execution;
A second transmission step in which the authentication server transmits an activation script for activating the transmission script to the terminal device in response to an access from the terminal device;
An authentication program for causing the terminal device to execute the startup script to start the transmission script and to transmit the authentication information to the authentication server.

Images