JP5603697B2 - User authentication system, authentication apparatus, and program - Google Patents

Description

  The present invention relates to a user authentication system, an authentication apparatus, and a program for authenticating whether a user is valid.

  Conventionally, when communication is performed between a server device and a client terminal in an IPv6 network, an IPv6 address generated using unique information of the client terminal has been used. As the unique information of the client terminal, a MAC address including a manufacturer, a device type, and the like is used. Therefore, by intercepting the communication of the client terminal, there is a fear that it is possible to specify what device the client terminal is and who the owner of the client terminal is.

  As a countermeasure, a protocol as described in the following Non-Patent Document 1 has been proposed. According to this protocol, it is proposed to generate an IPv6 address using a random number instead of the unique information of the client terminal.

http://tools.ietf.org/html/rfc4941

  However, the above-described protocol in Non-Patent Document 1 makes it difficult to specify the type and owner of the client terminal from the IPv6 address, and is exchanged in the authentication process between the client terminal and the server device. Messages were not considered.

  Therefore, the present invention has been proposed in view of the above-described circumstances, and an object of the present invention is to provide a user authentication system, an authentication device, and a program that can achieve both secure IPv6 address setting and user authentication processing.

  A user authentication system according to a first invention for solving the above problem is connected to an authentication target apparatus that transmits a user ID to be authenticated, and an authentication apparatus for the user ID when the user ID is transmitted A user authentication system that performs user authentication by a first code string generation unit that generates a first code string using a user ID to be authenticated by the authentication device, a predetermined higher-order code string, and the first code Address information generating means for generating address information including a lower code string including the first code string generated by the string generating means, and an authentication request including address information generated by the address information generating means to the authentication device A communication means for transmitting, and when the authentication request is transmitted, the authentication device includes any user I included in a preset user ID list. When the second code string generated using the ID matches the first code string included in the lower code string of the address information of the authentication request, communication using the address information included in the authentication request is permitted. It is characterized by doing.

  In the user authentication system according to the first invention, the second invention is such that the authentication device requests the user ID, and the first code string generation means and the address information generation means In response to the request, address information including the first code string is generated, and an authentication request including the address information is transmitted to the authentication device by the communication unit.

  In the user authentication system according to the first or second invention, the third invention includes, in the user ID list, the upper code string in association with the user ID registered in the user ID list, The authentication device, when the authentication request is transmitted, the upper code string of the address information included in the authentication request matches the upper code string registered in the user ID list, and If the second code string generated using the user ID registered in association with the upper code string matches the first code string included in the lower code string of the address information of the authentication request, the authentication It is characterized by permitting communication using the address information included in the request.

  In the user authentication system according to the first invention, the fourth invention is such that the first code string generation means and the address information generation means are configured by a DHCP server, and the DHCP server responds to the first address request. The predetermined high-order code sequence is generated, and the DHCP server generates a first code sequence using the user ID in response to a second address request using the user ID, and includes the first code sequence Address information including a lower code string and a predetermined higher code string generated in response to the first address request is generated.

  The user authentication system according to a fourth aspect of the present invention is the user authentication system according to the fifth aspect, wherein the DHCP server responds to the first address request including the unique information of the terminal from the terminal in response to the first code request and the lower code string Is generated, the first identification information is stored in the lower code string of the address information, and the first code string is included in the lower code string in response to the second address request using the user ID. When the address information is generated, the second identification information is stored in the lower code string of the address information.

  The user authentication system according to the first invention is the user authentication system, wherein the first code string generation means and the address information generation means are constituted by a router, and the router uses the user ID to make an address request. Accordingly, a first code string is generated using a user ID, and a lower code string including the first code string is generated.

  An authentication apparatus according to a seventh invention for solving the above problem is connected to an authentication target apparatus that transmits a user ID to be authenticated, and performs user authentication for the user ID when the user ID is transmitted. An authentication apparatus that performs authentication request including address information including a first code string generated using a user ID to be authenticated and a lower code string including a predetermined higher code string. The receiving means for receiving from the device, and the second code string generated using any user ID included in the user ID list set in advance when the authentication request is transmitted are the addresses of the authentication request And an authentication unit that permits communication using the address information included in the authentication request when the first code string is included in the lower code string of the information.

  An authentication apparatus program according to a seventh aspect of the present invention for solving the above problem is connected to an authentication target apparatus that transmits a user ID to be authenticated, and a user corresponding to the user ID when the user ID is transmitted. A program executed by an authentication apparatus that performs authentication, and includes address information including a first code string generated using a user ID to be authenticated and a lower code string including a predetermined higher code string Receiving means for receiving an authentication request from the device to be authenticated, and a second code string generated using any user ID included in a user ID list set in advance when the authentication request is transmitted Authentication means for permitting communication using the address information included in the authentication request when the first code string included in the lower code string of the address information of the authentication request matches Characterized in that to function Te.

  According to the present invention, address information is generated using a user ID, transmitted to an authentication device, and authentication is performed using the address information by the authentication device. Thus, both safe address setting and user authentication processing are compatible. it can.

It is a system diagram showing a configuration of a user authentication system shown as an embodiment of the present invention. It is a system diagram which shows operation | movement of the user authentication system shown as one Embodiment of this invention. It is a sequence diagram which shows operation | movement of the user authentication system shown as one Embodiment of this invention. It is a flowchart which shows operation | movement of the terminal in the user authentication system shown as one Embodiment of this invention. It is a flowchart which shows operation | movement of the authentication server in the user authentication system shown as one Embodiment of this invention. It is a figure which shows the user ID list in the user authentication system shown as one Embodiment of this invention. It is a flowchart which shows the other operation | movement of the authentication server in the user authentication system shown as one Embodiment of this invention. It is a system diagram which shows the other structure of the user authentication system shown as one Embodiment of this invention. It is a sequence diagram which shows other operation | movement of the user authentication system shown as one Embodiment of this invention. It is a flowchart which shows operation | movement of the DHCP server in the user authentication system shown as one Embodiment of this invention. It is a system diagram which shows the other structure of the user authentication system shown as one Embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[First Embodiment]
The user authentication system as an embodiment of the present invention is configured as shown in FIG. 1, for example. This user authentication system includes a terminal 1 and an authentication server 2. This user authentication system performs user authentication for the terminal 1 by an authentication server 2 as an authentication device.

  The terminal 1 has a user ID set in advance. The user ID may be a value input by the user when the terminal 1 is used, or may be set in the terminal 1 in advance by a user operation. For example, a character string “m123” is used for the terminal 1.

  The terminal 1 is given an IPv6 address in order to communicate with a server or a terminal connected to the wide area network via the local network. The IPv6 address of the terminal 1 includes a subnet prefix as an upper code string and an authentication ID as a lower code string. Each of the subnet prefix as the upper code string and the authentication ID as the lower code string is composed of 64 bits. The subnet prefix is set in common with the local network. The authentication ID is set for the terminal 1 to perform user authentication with respect to the authentication server 2. A method for setting the authentication ID will be described later.

  The authentication server 2 performs user authentication processing for the terminal 1. For example, the authentication server 2 may provide a service that the terminal 1 wants to use (for example, a web browsing service using HTTP), or may be a server for user authentication processing. The authentication server 2 stores a user ID list in order to perform user authentication for the terminal 1. This user ID list is configured by registering a plurality of user IDs such as ID1, ID2,..., IDn, for example.

  In such a user authentication system, when user authentication of the terminal 1 is performed, as shown in FIGS. 2 and 3, first, the terminal 1 generates an IPv6 address in the procedure (1). At this time, as shown in FIG. 3, the terminal 1 generates BA and SA as the authentication ID as the lower code string. Next, in the procedure (2), the terminal 1 transmits an authentication request including the IPv6 address {SP | (BA | SA)} to the terminal 1. Next, when the authentication server 2 receives the authentication request transmitted from the terminal 1 in the procedure (3), the authentication server 2 performs IP address authentication using the IPv6 address and determines whether the terminal 1 can communicate. If the authentication is successful, the communication of the terminal 1 is permitted.

  On the other hand, when the attack terminal 100 is connected to the local network and the authentication request including the IPv6 address is transmitted from the attack terminal 100, the authentication server 2 rejects the communication of the attack terminal 100. Even if the metaphoric attack terminal 100 generates an IPv6 address including an authentication ID as a lower code string in the same manner as the terminal 1, the user ID of the attack terminal 100 is xx12 and the user ID list held by the authentication server 2 It is because it is not included.

  The IPv6 address generation and authentication request transmission processing by the terminal 1 in the user authentication system described above will be described with reference to the flowchart of FIG.

  First, in step S1, the terminal 1 determines whether or not to start user authentication by the authentication server 2, and proceeds to step S2 when starting authentication.

  In step S2, the terminal 1 reads a user ID “m123” stored in advance, and obtains a hash value of the user ID using a hash function.

  In the next step S3, the terminal 1 uses the hash value obtained from the user ID to generate an authentication ID (first code string) as a lower code string in the IPv6 address (first code string generation means). At this time, the terminal 1 calculates the first half code string BA of the authentication ID as the lower code string by the following expression 1, and calculates the second half code string SA by the following expression 2.

First half code string B _A = g ^id + gr ^m mod N (Formula 1)
Second half code string S _A = g ^ra mod N (Formula 2)
In the above formulas 1 and 2, id is a user ID, g is a primitive element, a is a secret key, r is a random number, and N is a radix (= 2 ³² ). The primitive element g, the secret key a, and the radix N are preset values and are shared between the terminal 1 and the authentication server 2. The random number r uses a value generated by a random number generator of the terminal 1.

  In the next step S4, the terminal 1 adds the authentication ID (BA, SA) generated in step S3 to a preset subnet prefix (SP). This subnet prefix is a value set in advance in the local network to which the terminal 1 is connected. For example, a value “2001 :: 200: 2/64” is used. As described above, the terminal 1 generates an IPv6 address as address information including the subnet prefix that is a predetermined upper code string and the lower code string that includes the first code string that is the authentication ID generated in step S3. (Address information generating means).

  In the next step S5, the terminal 1 transmits an authentication request including the IPv6 address generated in step S4 to the authentication server 2 (communication means).

  An IPv6 address authentication process by the authentication server 2 in the above-described user authentication system will be described with reference to a flowchart of FIG.

  The authentication server 2 determines whether or not an authentication request has been received in step S11. If it is determined that an authentication request has been received, the authentication server 2 advances the process to step S12.

  In step S12, the authentication server 2 sets the number i in the user ID list to “1”.

  In the next step S13, the authentication server 2 reads the user ID (i) from the user ID list, and acquires a value obtained by hashing the user ID (i).

  In the next step S14, the authentication server 2 extracts the first half code string BA and the second half code string SA of the authentication ID as the lower code string from the IPv6 address included in the authentication request received in step S1.

  In the next step S15, the authentication server 2 calculates the second half code string S ′ according to the following equation 3.

Second half code string S ′ = (BA−g ^{ID (i)} ) ^a modN (Formula 3)
In the above equation 3, BA is the value extracted in step S14, ID (i) is the user ID read and hashed in step S13, g is a primitive element, a is a secret key, r is a random number, and N is The radix (= 2 ³² ). The primitive element g and the secret key a are preset values and are shared with the authentication server 2.

Equation 3 above uses Equation 1 above,
Second half code string S ′ = (g ^id + g ^r −g ^{ID (i)} ) ^a modN
And can be transformed
Second half code string S ′ = g ^ra modN
It becomes. Therefore, when the latter half code string S ′ matches the latter half code string SA in the IPv6 address included in the authentication request in step S15, the user ID included in the authentication request is registered in the user ID list. Can be recognized.

  In the next step S16, the authentication server 2 determines whether or not the latter half code string S ′ calculated in step S15 and the latter half code string SA extracted in step S14 have the same value. If the latter half code string S 'and the latter half code string SA match, the process proceeds to step S17 to permit user ID authentication. Thereby, the authentication server 2 permits communication of the terminal 1 using the IPv6 address included in the authentication request.

  On the other hand, if the latter half code string S 'and the latter half code string SA do not match, the process proceeds to step S18. In step S18, it is determined whether or not the number i in the user ID list is the final number m. If the number i of the user ID list is not m, the number i of the user ID list is incremented in step S19, and the process returns to step S13.

  On the other hand, if the number i in the user ID list is m, the authentication request is not an IPv6 address using the user ID included in the user ID list, so the authentication is rejected and communication using the IPv6 address is performed. Shut off.

  In the above-described user authentication system, the terminal 1 transmits an authentication request including an IPv6 address to the authentication server 2, but the terminal 1 generates when the authentication server 2 requests a user ID in response to the authentication request. The IPv6 address may be transmitted. Thereby, the authentication server 2 can authenticate the user ID by authenticating the authentication ID as the lower code string in the IPv6 address.

  As described above, according to this user authentication system, the terminal 1 generates an IPv6 address using the user ID and makes an authentication request, and the authentication server 2 authenticates the user ID using the IPv6 address. it can. Thereby, according to the user authentication system, it is possible to authenticate the user ID in the authentication server 2 using only the IPv6 address, and to control whether or not communication is possible. Further, according to this user authentication system, an authentication ID (BA and SA) is generated by using a user ID which is an arbitrary character string, not information specifying a manufacturer or type such as a unique MAC address of the terminal 1 Since the IPv6 address can be generated, both privacy protection and authentication of the user can be achieved.

  Next, another embodiment of the above-described user authentication system will be described.

  As shown in FIG. 6, the user authentication system according to this embodiment includes a net prefix (SP1, SP1, IDn) associated with a user ID (ID1, ID2,..., IDn) in a user ID list held by the authentication server 2. SP2,..., SPn) are stored.

  As shown in FIG. 7, the authentication server 2 in such a user authentication system, in response to receiving the authentication request in step S11, in step S31, from the IPv6 address included in the received authentication request, the subnet prefix ( SP) is extracted.

  In the next step S32, the authentication server 2 determines whether or not the subnet prefix (received SP) extracted in step S31 matches the subnet prefix (stored SP) in the stored user ID list shown in FIG. Determine whether. If both subnet prefixes match, the process proceeds to step S33. On the other hand, if both subnet prefixes do not match, the process proceeds to step S20, and authentication is rejected.

  In step S33, the authentication server 2 extracts the user ID in the user ID list corresponding to the subnet prefix (stored SP) determined in step S32, and performs hashing.

  And the authentication server 2 performs step S14-step S17, step S20 using the user ID hashed in step S33, and performs the authentication process using the authentication ID as a low-order code sequence of the said IPv6 address. Do.

  According to such a user authentication system, the authentication server 2 limits the user ID in the user ID list using the subnet prefix as the upper code string in the IPv6 address, and performs the authentication process using the user ID. It can be carried out. Therefore, according to this user authentication system, the local network area that can be authenticated is limited, and even if an unauthorized attack terminal 100 transmits an authentication request to the authentication server 2 from another local network, the authentication request can be rejected. Therefore, according to this user authentication system, only an authentication request from the terminal 1 having a valid user ID transmitted from a specific local network can be permitted.

  Next, still another embodiment of the above-described user authentication system will be described.

  In the user authentication system according to this embodiment, as shown in FIG. 8, a DHCP (Dynamic Host Configuration Protocol) server 3 is connected to a local network to which a terminal 1 is connected. The DHCP server 3 dynamically assigns an IPv6 address to the terminal 1 when the terminal 1 is activated. The DHCP server 3 is compatible with DHCPv6.

  The DHCP server 3 stores in advance the source element g and the secret key a of the terminal 1 held in the terminal 1 and the authentication server 2. The DHCP server 3 has a function of generating an authentication ID as a lower code string of the IPv6 address performed by the terminal 1 as described above (steps S2 and 3) and a function of generating an IPv6 address (step S4). Yes.

  As shown in FIG. 9, when the terminal 1 transmits an address request C1 to the DHCP server 3 at the time of activation, the DHCP server 3 responds to the address request C1 (first address request) with a subnet prefix (predetermined value). An upper code string) and a lower code string (address) are generated and address distribution R1 is performed.

  Upon obtaining the address distribution R1, the terminal 1 obtains a hash value “2f5a7733” obtained by hashing its own user ID “m123” held in advance, and uses the hash value as a DUID (DHCP Unique Identifier). To the DHCP server 3. The DUID is a value represented in hexadecimal.

  The DHCP server 3 generates an authentication ID as a lower code sequence using the user ID in response to an address request (second address request) C2 including a DUID using the user ID. At this time, the DHCP server 3 calculates the first half code string BA of the authentication ID as the lower code string by the following expression 4, and calculates the second half code string SA by the following expression 5.

^First half code string B _A = g ^IDUD + g ^{r mod} N (Formula 4)
Second half code string S _A = g ^ra mod N (Formula 5)
In the above equations 4 and 5, IDUD is a value hashed from the user ID and is a value received by the address request C2, g is a primitive element, a is a secret key, r is a random number, and N is a radix (= 2 ³² ). The primitive element g and the secret key a are values set in advance and are shared among the DHCP server 3, the terminal 1, and the authentication server 2. The random number r uses a value generated by a random number generator of the DHCP server 3. The DHCP server 3 generates an IPv6 address in this way and performs IP address distribution R2.

  Thereby, the terminal 1 sets the IPv6 address created using the user ID as its own IPv6 address. Thereafter, the terminal 1 transmits an authentication request C3 including an IPv6 address to the authentication server 2. When the authentication is permitted by the authentication process by the authentication server 2, the terminal 1 is supplied with a communication permission R3. Thereafter, the terminal 1 starts communication with the authentication server 2.

  As described above, according to this user authentication system, by generating the IPv6 address using the user ID by the DHCP server 3, authentication using the IPv6 address is performed without significantly improving the terminal 1. be able to. Therefore, according to this user authentication system, introduction of the user authentication system can be facilitated.

  In this user authentication system, the DHCP server 3 may generate an IPv6 address and distribute it to the terminal 1 even if an existing MAC address as a DUID is supplied. In this case, there is a possibility that IPv6 addresses generated by the DHCP server 3 overlap between the terminal 1 that has the user ID and requests the authentication server 2 and the terminal 1 that does not have the user ID. That is, the IPv6 address generated from the MAC address and the IPv6 address generated from the hash value of the user ID may be the same value.

  Therefore, when the DHCP server 3 in this user authentication system generates an IPv6 address in response to the first address request including the unique information (MAC address) of the terminal 1 from the terminal 1, the lower code string of the IPv6 address is generated. 1st identification information is stored in. Further, when the DHCP server 3 generates an IPv6 address included in the authentication ID as a lower code sequence generated using the user ID in response to the second address request using the user ID, the IPv6 address The second identification information is stored in the lower code string. The first identification information and the second identification information are different values.

  Specifically, the DHCP server 3 operates as shown in FIG. When the DHCP server 3 first receives an address request transmitted from the terminal 1 in step S41, it determines whether or not the DUID is a MAC address in step S42. If the DHCP server 3 determines that the DUID is a MAC address, the process proceeds to step S43, and if not, the process proceeds to step S44.

  In step S43, the DHCP server 3 generates a lower code string (network ID) of the IPv6 address using the received MAC address. The DHCP server 3 subtracts the first-half code string BA and the second-half code string SA by 1 bit from the generated lower code string to make the lower code string 31 bits. The DHCP server 3 stores the value “00” as the first identification information F in the reduced 2-bit area. In step S45, the DHCP server 3 transmits the IPv6 address generated in step S43 to the terminal 1 as address distribution.

  In step S44, the DHCP server 3 generates a lower code string (authentication ID) of the IPv6 address using the DUID as the hash value of the received user ID. The DHCP server 3 subtracts the first-half code string BA and the second-half code string SA by 1 bit from the generated lower code string to make the lower code string 31 bits. The DHCP server 3 stores the value “11” as the second identification information F in the reduced 2-bit area. In step S45, the DHCP server 3 transmits the IPv6 address generated in step S44 to the terminal 1 as address distribution.

  As described above, according to this user authentication system, collision of IPv6 addresses can be avoided by changing identification information when an IPv6 address is generated from a MAC address and when an IPv6 address is generated from a user ID. .

  Next, still another embodiment of the above-described user authentication system will be described.

  As shown in FIG. 11, the user authentication system according to this embodiment can perform authentication using an IPv6 address by a router 4 provided between a local network to which the terminal 1 is connected and an external network. good. Similar to the authentication server 2 described above, the router 4 permits the authentication and rejects the authentication by performing the process shown in FIG. 5 such as generating the latter half code string S ′ using the user ID.

  Thereby, the user authentication system can control communication for each user ID that does not depend on the IPv6 address. For example, when the filtering condition is set to pass the valid user ID “m123” and reject other IDs, the router 4 can discard the packet transmitted from the attacking terminal 100.

  Further, according to this user authentication system, communication control for each group can be performed by assigning the same user ID to a user group including a plurality of users.

  The above-described embodiment is an example of the present invention. For this reason, the present invention is not limited to the above-described embodiment, and various modifications can be made depending on the design and the like as long as the technical idea according to the present invention is not deviated from this embodiment. Of course, it is possible to change.

1 Terminal 2 Authentication server 3 DHCP server 4 Router

Claims (8)

A user authentication system that is connected to an authentication target device that transmits a user ID to be authenticated and performs user authentication by the authentication device for the user ID when the user ID is transmitted,
First code string generation means for generating a first code string using a user ID to be authenticated by the authentication device;
Address information generating means for generating address information composed of a predetermined upper code string and a lower code string including the first code string generated by the first code string generating means;
A communication unit that transmits an authentication request including the address information generated by the address information generation unit from the authenticated device to the authentication device;
In the authentication apparatus, when the authentication request is transmitted, the second code string generated using any user ID included in the user ID list set in advance is lower than the address information of the authentication request. A user authentication system characterized by permitting communication using the address information included in the authentication request when it matches the first code string included in the code string. The authentication device requests the user ID;
The first code string generation unit and the address information generation unit generate address information including the first code string in response to a request for the user ID, and an authentication request including the address information is generated by the communication unit. The user authentication system according to claim 1, wherein the user authentication system is transmitted to the authentication device. In the user ID list, the upper code string is included in association with the user ID registered in the user ID list,
The authentication device, when the authentication request is transmitted, the upper code string of the address information included in the authentication request matches the upper code string registered in the user ID list, and If the second code string generated using the user ID registered in association with the upper code string matches the first code string included in the lower code string of the address information of the authentication request, the authentication The user authentication system according to claim 1 or 2, wherein communication using address information included in the request is permitted. The first code string generation means and the address information generation means are configured by a DHCP server,
The DHCP server generates the predetermined upper code sequence in response to a first address request,
The DHCP server generates a first code string using a user ID in response to a second address request using the user ID, and generates a lower code string including the first code string and the first address request. 2. The user authentication system according to claim 1, wherein address information including a predetermined higher-order code string generated in response is generated. The DHCP server is
In response to a first address request including specific information of the terminal from the terminal, when generating address information including the upper code string and the lower code string, the first identification information is added to the lower code string of the address information. Store and
When address information including the first code string in the lower code string is generated in response to the second address request using the user ID, the second identification information is stored in the lower code string of the address information. The user authentication system according to claim 4. The first code string generation means and the address information generation means are configured by a router,
The router generates a first code string using a user ID in response to an address request using the user ID, and generates a lower code string including the first code string. The user authentication system described in 1. An authentication device that is connected to an authenticated device that transmits a user ID to be authenticated and performs user authentication for the user ID when the user ID is transmitted,
Receiving means for receiving, from the device to be authenticated, an authentication request including address information including a first code string generated using a user ID to be authenticated and a lower code string including a predetermined higher code string; ,
When the authentication request is transmitted, the second code string generated using any user ID included in the user ID list set in advance is included in the lower code string of the address information of the authentication request. An authentication device comprising: authentication means for permitting communication using the address information included in the authentication request when the first code string matches. A program executed by an authentication device that is connected to an authentication target device that transmits a user ID to be authenticated and performs user authentication for the user ID when the user ID is transmitted,
Receiving means for receiving, from the device to be authenticated, an authentication request including address information including a first code string generated using a user ID to be authenticated and a lower code string including a predetermined higher code string; ,
When the authentication request is transmitted, the second code string generated using any user ID included in the user ID list set in advance is included in the lower code string of the address information of the authentication request. A program for an authentication apparatus, which functions as an authentication unit that permits communication using address information included in the authentication request when the first code string matches.

Images