JP4324951B2 - Password system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a password system that authenticates a password when a user logs in to a remote computer (hereinafter referred to as a server) via a network from a local computer (hereinafter referred to as a client) used as a terminal.
[0002]
[Prior art]
FIG. 3 shows a conventional password system, in which a user inputs a user ID and a password from the client 1 side via the network 3, and the server 2 side determines whether the user ID and the transmitted password match. It is a system that verifies using a password database and allows login.
[0003]
FIG. 4 shows a password system based on SSH (Secure Shell) which is a standard encryption standard that has been widely used recently. Both the client 1 and the server 2 are provided with SSH encryption software. On the client 1 side, a public key is passed from the server 2 side in advance, and the password is encrypted by SSH using this public key and sent to the server 2.
[0004]
On the server 2 side, the password is opened with a secret key, the encryption is decrypted with SSH, the password is registered with a database registered in the server side database, and login is permitted. In SSH, not only the password but the entire communication is encrypted.
[0005]
FIG. 5 shows an original method of a one-time (disposable) password system that is the subject of the present invention. When the user sends a user ID to the server 2 from the client 1 side, the server generates a random number, encrypts the shared key, and returns it to the client 1. The client 1 further decrypts it and sends a random number to the server 2.
The server 2 authenticates the user by checking whether the received random number matches the generated random number. New random numbers are sequentially generated.
[0006]
FIG. 6 shows another method of the password system. When the user gives the initial password to the server 2 in advance, the server 2 automatically generates several passwords using a hash function.
If the client 1 has a dedicated command that uses a hash function, the user calculates the password at that location to know the usable password, or outputs the calculation result on the server 2 side on paper in advance. In some cases, users carry this on paper.
[0007]
[Problems to be solved by the invention]
In the password system of FIG. 3, the password entered by the user flows on the network line as raw text, and is intercepted by a third party.
In the SSH system of FIG. 4, the client needs to be an SSH client. A user cannot always log in remotely to a server from a machine that supports SSH.
[0008]
In the password system of FIG. 5, like SSH, the client must always have a random number generation tool for decryption.
In the password system shown in FIG. 6, there is an annoyance that requires the user to remember the random one-time password passed from the server in advance. In addition, it is not impossible to obtain an inverse function of the hash function to guess the next one-time password from a certain one-time password.
[0009]
A person working in a company or university network may want to log in to the company or university remotely from a machine at home or on a business trip, or a machine whose form is unknown at a conference or the like. In recent years, network security has been strongly demanded, and many remote logins that do not use encryption are prohibited.
[0010]
If SSH is used, the entire communication is encrypted, so there is no security problem, but the user may not always be able to access the server from a client that supports SSH. Also, in most remote login cases, confidential files are not exchanged remotely, but exchange of files that may be known to others is not necessary, so encryption of the entire communication is unnecessary.
[0011]
As described above, password systems based on encryption so far make the user feel annoyed, such as by giving the user a decryption tool or by remembering a random password string. It was.
An object of the present invention is to realize a password system that does not use encryption and does not burden the user.
[0012]
[Means for Solving the Problems]
In order to achieve such an object, a feature of the invention described in claim 1 of the present invention is that a user logs in to a server which is a remote computer via a network from a client which is a local computer used as a terminal. Sometimes in password systems that authenticate passwords,
The server provides a database for registering a plurality of one-time passwords inputted by the user and registration of one-time passwords by the user with expiration date information as a registration condition and includes the expiration date information. Checking registration conditions, if registration conditions are satisfied, a message permitting registration in the database, and registration conditions determining means for notifying the user of a message rejecting registration if registration conditions are not satisfied,
When the user logs in using one of the one-time passwords, the user is allowed to log in when the login password is confirmed to match the registered one-time password, and the one-time password is retrieved from the database. And a user authentication means to be deleted .
[0015]
Features of claim 2, wherein the invention, the server, if you want to allow new registration of the one-time password by the user, the current effective one-time password and a one-time password of the new registration, the user's home directory Output to the list file.
[0016]
According to a third aspect of the present invention, the server updates the list file of the home directory when the registered one-time password is deleted from the database .
[0017]
According to a fourth aspect of the present invention, the registration permission / inhibition judging means receives a new registration of a password by the user , and if it is the same password as the password used in the past or a password different from the previous one, it is registered. determines not to satisfy the conditions, a message denying the registration in the database to a point to notify the user.
[0018]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a functional block diagram illustrating pre-operation on the server 2 side by a user 4 in the password system of the present invention.
[0019]
The user 4 registers the password in the one-time password database 6 via the man-machine interface 5 of the server 2 having the one-time password service (in this example, a new password passwd123 is added to the already registered password). .
The password to be input is an arbitrary character string, and the longest expiration date information is also input if necessary. At this time, the number of passwords may be entered as much as allowed.
[0020]
The server 2 has a registration permission determination means 7 and the password passwd123 that the user tried to register is registered in the database in accordance with the contents of the condition table 8 based on the administrator's security policy (number of password character strings, expiration date, etc.). Determine if you can.
[0021]
If the result of the determination is that registration is not possible, the user is informed through the man-machine interface 5 that registration is not possible, and if registration is possible, the password passwd123 is additionally registered in the database 6, and a currently available one-time password including new additions is registered. It outputs to the list file 10 of the user's home directory 9 and updates its contents.
[0022]
FIG. 2 is a functional block diagram for explaining the operation when the user sends a one-time password from the client 1 side to the server 2 side through the network 3 to request login permission in the password system of the present invention.
[0023]
At the time of use, the user 4 sends a password (for example, passwd123) to the server 2 via the network 3 from the man-machine interface of the client 1 and asks for permission of login.
[0024]
11 is a user authentication means that is a function of the server 2. When the password passwd 123 sent from the client 1 is received, if the password matches one of the passwords registered in the database 6, login permission is given. A notification is sent to the client 1 via the network, and a disapproval is notified if they do not match.
[0025]
When login is permitted due to the password passwd123 match, the password passwd123 is discarded from the database 6 and cannot be used at the same time as the permission.
Further, the change in the registered contents of the database 6 due to the password destruction is rewritten to the latest information by updating the password list file 10 in the user's home directory 9.
[0026]
In the operation of the system of the present invention, in the registration condition table 8 on the server side, the password used in the past is stored in addition to the minimum number of character strings and the maximum expiration date, and when the password registration by the user is accepted, In terms of security, it is preferable to set a registration condition in which if the password is the same as the password used for the password or a password that is different from the password, the registration is rejected and the password is not adopted.
[0027]
【The invention's effect】
As is apparent from the above description, according to the present invention, since special processing such as encryption and decryption is not required at the client, it is possible to log in to the server from any machine connected to the Internet.
[0028]
Passwords that are easy for users to remember can be used, and the trouble of remembering passwords in order is avoided.
[Brief description of the drawings]
FIG. 1 is a functional block diagram of a password system according to the present invention.
FIG. 2 is a functional block diagram of the password system of the present invention.
FIG. 3 is a block diagram showing a conventional password system.
FIG. 4 is a block diagram showing a conventional password system.
FIG. 5 is a block diagram showing a conventional password system.
FIG. 6 is a block diagram showing a conventional password system.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 Client 2 Server 3 Network 4 User 5 Server side man-machine interface 6 One-time password database 7 Registration possibility judgment means 8 Registration condition table 9 User home directory 10 Password list file 11 User authentication means

Claims (4)

In a password system that authenticates a password when a user logs in to a server that is a remote computer via a network from a client that is a local computer used by a user as a terminal,
The server
A database for registering a plurality of one-time passwords input by the user;
When the registration of the one-time password by the user is accepted, the expiration date information is added to the registration condition, and the registration condition including the expiration date information is checked. If the registration condition is satisfied, the registration to the database is permitted. A registration permission determination means for notifying the user of a message for rejecting registration if the message does not satisfy the registration conditions;
When the user logs in using one of the one-time passwords, the user is allowed to log in when the login password is confirmed to match the registered one-time password, and the one-time password is retrieved from the database. User authentication means to be deleted;
A password system comprising: The server, if you want to allow a new registration of the one-time password by the user, characterized in that the current effective one-time password that includes a one-time password for the new registration, to output to the user's home directory list file The password system according to claim 1 . 3. The password system according to claim 2, wherein the server updates the list file of the home directory when the registered one-time password is deleted from the database . The registration permission judgment unit, when accepting the new registration password by the user, when was the last-used password identical password or one character differences password, determines not satisfy the registration conditions, the The password system according to claim 1, wherein a message rejecting registration in the database is notified to the user.

Images