JPH10242957A - User authentication method, system therefor and storage medium for user authentication - Google Patents

Abstract

PROBLEM TO BE SOLVED: To secure the security of user authentication when a password processing function does not simultaneously exist in a server and a client by ciphering data flowing to a network. SOLUTION: When a server computer 1 does not has the processing function which is not contained in the list of a password processing method received from a client computer 2, NULL and a server initial key are transmitted to the client computer 2 (S304). The client computer 2 selects the holding password processing method, generates the password key from the received initial key and a certification identifier which a user inputs, ciphers user ID by using the key and transmits ID and a pertinent password processing program to the server computer 1 (S305). The server computer 1 sequentially generates the password key from the server initial key and the authentication identifier, recognizes the matching of ciphered user ID with received ciphering user ID by using the key and certifies it (S306).

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a program for performing encryption processing for securely transmitting information for user authentication via a network when a client computer connects to a server computer via a network. The present invention relates to a user authentication method and system, and a storage medium for authentication, in which user authentication is performed safely by moving a user between a client and a server.

[0002]

2. Description of the Related Art With the development of network infrastructure, a client-server type computing environment has been widespread. When a client computer accesses a server computer, user authentication is always performed to confirm the right to access information on the server computer.

For example, a program called "telnet" transmits a user ID and an authentication identifier from a client computer to a server computer when logging in to a server computer in a multi-user environment, and stores user authentication information stored in the server computer. By checking whether or not it matches, a mechanism that allows login to the server computer is adopted.

Also, when accessing an e-mail stored in an e-mail server computer, a user ID and an authentication identifier are transmitted from the client computer to the e-mail server computer via a network in order to confirm the recipient. Is done.

[0005] Further, even in a WWW system that is rapidly spreading, when controlling access to some information,
It is necessary to transmit a user ID and an authentication identifier registered in advance from the client computer to the WWW server computer.

Conventionally, data flowing on a network is
Since encryption processing was not performed, eavesdropping could be easily performed by monitoring packets flowing on the network, which was a major problem. In order to solve this, there has been a movement to introduce a cryptographic function for each application.

For example, with respect to access to a WWW server, a communication protocol including encryption processing called SSL (Secure Socket Layer) has been devised, and mounting on a commercial server is progressing. Also, a program called "Secure Telnet" has been developed to encrypt all communications between the client and server.

[0008]

However, in the above-mentioned prior art, it is assumed that a program for performing the same encryption processing exists on the client computer and the server computer. For example, in the above-mentioned SSL, when starting communication, the client computer and the server computer send and receive negotiations between cryptographic functions that they can process, but if there is no cryptographic processing program that exists simultaneously in both. In such a case, communication is performed without performing encryption processing. Further, only some of the encryption processing methods that can be used as standard are available, and a newly devised strong method cannot be used immediately.

According to the present invention, an encryption processing function for securely performing user authentication between a client computer and a server computer can encrypt data flowing over a network even if both the server and the client do not simultaneously exist. Another object of the present invention is to provide a user authentication method and system and a storage medium for authentication that can ensure the security of user authentication.

[0010]

In order to achieve the above object, a user authentication method according to the present invention basically comprises an encryption processing program for securely performing user authentication between a client computer and a server computer. If the server does not exist in both the server and the client at the same time, the encryption processing program is transmitted from the existing (holding) side to the non-existing side (non-holding side), and user authentication is performed by the transmitted encryption processing program. It is characterized by the following.

More specifically, if the server computer does not have the encryption processing program, the server computer transmits a user authentication request to the client computer in response to a connection request including user identification information from the client computer to the server computer. In response to the user authentication request, the client computer transmits a list of cryptographic processing programs held by the client computer itself to the server computer. If the server computer does not have a cryptographic processing program included in the list, the client computer Transmits to the server computer one of the cryptographic processing programs held by the client computer and the user authentication information encrypted by the cryptographic processing program. Which comprises carrying out the authentication of the user who utilizes the client computer on the basis of the cipher processing program and the user authentication information received in the computer.

Here, the user authentication information transmitted from the client computer to the server computer includes an arbitrary initial key received from the server computer together with information indicating that the server computer does not have the encryption processing program held by the client computer. And the authentication identifier entered by the user as an encryption key,
The user identification information input by the user is encrypted by the same encryption processing program as the encryption processing program transmitted to the server computer. The server computer responds to the received user authentication information with the user identification information received at the time of the connection request. The authentication identifier of the user registered in advance as a set with the user identification information is extracted from the storage device, and the authentication identifier and the same initial key as transmitted to the client computer are used as an encryption key,
The encryption processing program received from the client computer encrypts the user identification information received at the time of the connection request, and uses the client computer according to whether the encrypted user identification information matches the user authentication information received from the client computer. Authenticates the user to perform

If the client computer does not have the cryptographic processing program, the server computer transmits a user authentication request to the client computer in response to the connection request including the user identification information from the client computer to the server computer,
When the client computer transmits a list of cryptographic processing programs held by the client computer itself to the server computer in response to the user authentication request, if the client computer does not have the cryptographic processing program, the server computer transmits the list of cryptographic processing programs to the server. One of the cryptographic processing programs possessed by the computer is transmitted to the server computer, the client computer transmits the user authentication information encrypted by the received cryptographic processing program to the server computer, and receives authentication of the user using the client computer. It is characterized by the following.

Here, when the client computer does not have the encryption processing program, more specifically, a client initial key arbitrarily generated together with information indicating that the client computer does not have the encryption processing program, The identification information is transmitted to the server computer, and the server computer retrieves, from the storage device, an authentication identifier of the user registered in advance as a set together with the user identification information based on the user identification information received from the client computer. Using the identifier as an encryption key, the client initial key received from the client computer and the server initial key arbitrarily generated by the server computer are encrypted by the same encryption processing program that was transmitted to the client computer, and are encrypted by the client computer. The client computer decrypts the client initial key received from the server computer using the received encryption processing program and the authentication identifier input by the user, and the client computer transmits the user authentication request from the server computer. After confirming that there is, the server initial key is decrypted with the authentication identifier input by the user, and the decrypted server identifier and the authentication identifier input by the user are used as encryption keys, and the user identification information input by the user is encrypted by the encryption processing program. The server computer transmits the encrypted user identification information received from the client computer, using the same server initial key transmitted to the client computer and the authentication identifier extracted from the storage device as an encryption key. Decode, performs authentication of the user and the user identification information received together with the user identification information and the client initialization key that the decoding utilizes the client computer according to whether coincident.

A user authentication system according to the present invention comprises a server computer and a client computer connected to a network, and the server computer authenticates the client computer in response to a connection request including user identification information from the client computer to the server computer. First means for sending the request;
It is determined whether or not the server computer itself has the cryptographic processing program included in the list of cryptographic processing programs received from the client computer in response to the user authentication request. A second means for transmitting the retained information to the client computer; and a third means for authenticating a user who uses the client computer based on the encryption processing program and the user authentication information received from the client computer for the non-retained information. Means for transmitting a list of cryptographic processing programs held by the client computer in response to the user authentication request from a server computer; and Computer One of the cryptographic processing program that,
Fifth means for transmitting the user authentication information encrypted by the encryption processing program to the server computer.

The server computer may further comprise: first means for transmitting a user authentication request to the client computer in response to a connection request including user identification information from the client computer to the server computer; A second means for transmitting one of the cryptographic processing programs held by the server computer to the client computer upon receipt of non-holding information indicating that the cryptographic processing program is not stored from the server; And a third means for authenticating a user who uses the client computer based on the user authentication information received from the client computer by the client computer. A fourth means for transmitting non-holding information indicating that the authentication request does not have a cryptographic processing program to the server computer, and a cryptographic processing program received from the server computer for the transmitted non-holding information; Fifth means for transmitting the user authentication information encrypted by the server computer to the server computer.

Further, the storage medium for user authentication according to the present invention, in which the server computer stores a program for performing user authentication, provides a user authentication request to the client computer in response to a connection request including user identification information from the client computer to the server computer. And whether the server computer itself has the cryptographic processing program included in the list of cryptographic processing programs received from the client computer in response to the user authentication request. If not, a second process of transmitting non-retained information indicating that to the client computer, and using the client computer based on the encryption processing program and user authentication information received from the client computer for the non-retained information Characterized in that it stores a program and a third process of authenticating the user that.

On the other hand, the storage medium for user authentication according to the present invention in which a program for performing user authentication by the client computer is stored is a first process for transmitting a connection request including user identification information from the client computer to the server computer. A second process of transmitting a list of cryptographic processing programs held by the client computer itself in response to a user authentication request received from the server computer in response to the connection request; If non-holding information indicating that the server computer itself does not hold the encryption processing program included in the list is received from the server computer, one of the encryption processing programs held by the client computer for the non-holding information is received. And this darkness Characterized in that the encryption processing program to the user authentication information by storing a program and a third process of transmitting to the server computer.

The user authentication storage medium of the present invention, in which a server computer stores a program for performing user authentication, provides a user authentication request to a client computer in response to a connection request including user identification information from the client computer to the server computer. And the non-holding information indicating that the user does not have the cryptographic processing program is received from the client computer in response to the user authentication request. A second process of transmitting one to the client computer;
And a third process for authenticating a user who uses the client computer based on the user authentication information received from the client computer after being encrypted by the transmitted encryption processing program.

On the other hand, the user authentication storage medium of the present invention in which the client computer stores a program for performing user authentication is a first process for transmitting a connection request including user identification information from the client computer to the server computer. If the client computer does not have the cryptographic processing program in response to the user authentication request received from the server computer in response to the connection request, a second process of transmitting non-holding information indicating that to the server computer, And storing a program including a third process of transmitting, to the server computer, user authentication information obtained by encrypting the transmitted non-holding information by the encryption processing program received from the server computer.

[0021]

Embodiments of the present invention will be described below in detail with reference to the drawings.

FIG. 1 is a system configuration diagram showing an embodiment of the present invention. The system for user authentication of this embodiment includes a server computer 1 and a client computer 2 connected to the server computer 1 via a network 3. Although FIG. 1 shows only one client computer 2,
In practical use, a plurality of computers are connected to the server computer 1 via the network 3 directly or via another network connected to the network 3.

The server computer 1 has a CPU 11A,
A terminal device 11 comprising a memory 11B, an external storage device 12 storing a user authentication file 12A in which a pair of a user ID (user identification information) and an authentication identifier is registered, and an encryption processing program 12B; Consists of

The client computer 2 has a CPU 2
1A, a terminal device 21 including a memory 21B, and a communication port 22.

FIG. 2 shows the structure of the user authentication file 12 A registered in the external storage device 12 of the server computer 1, the contents of which are shown in FIG.
And a plurality of sets of authentication identifiers 203 are registered.

The user authentication file 12A may be specially prepared for each service application running on the server computer 1, but may be used as it is managed by an operating system such as UNIX or Windows NT. Absent.

FIG. 3 shows the flow of information communicated between the server and the client when there is no encryption processing program corresponding to the encryption processing method of the client computer 2 in the external storage device 12 of the server computer 1. It is shown.

FIG. 4 shows a flow of information communicated between the server and the client when the client computer 2 does not have an encryption processing program.

In the system configuration of FIG. 1, when the client computer 2 attempts to connect to the service application on the server computer 1, a connection request is transmitted (steps 301 and 401). In response to this connection request, the server computer 1 sends a user ID to the client computer 2 for user authentication.
And a user authentication request for requesting transmission of an authentication identifier (steps 302 and 402).

Upon receiving the user authentication request, the client computer 2 transmits a list of its own encryption processing method (encryption processing program) to the server computer 1 (step 303). The case where the client computer 2 does not have the encryption processing function will be described later.

When the server computer 1 receives the list of encryption processing methods from the client computer 2, if the encryption processing function of the server computer 1 is included in the received list of encryption processing methods, the server computer 1 selects one of them. Is transmitted to the client computer 2. The client computer 2 that has received this encrypts the user ID and the authentication identifier by the encryption processing method selected by the server computer 1 and transmits it to the server computer 1. Up to this stage, the procedure is the same as that conventionally performed.

However, if the server computer 1 does not have the cryptographic processing function included in the list of cryptographic processing methods received from the client computer 2,
Conversely, when the client computer 2 does not have the encryption processing function, the authentication procedure described below is executed.

First, when the server computer 1 does not have the cryptographic processing function included in the list of cryptographic processing methods received from the client computer 2, NULL (non-retained information) indicating that the server computer 1 does not have the cryptographic processing function A server initial key for processing is calculated from the current time and transmitted to the client computer 2 (step 30).
4).

The client computer 2 receiving the NULL selects one encryption processing method from the encryption processing function held by the client computer 2 in consideration of the encryption strength and processing speed, and selects the server initial key received from the server computer 1. Then, an encryption key is created from the authentication identifier input by the user (user of the client computer 2). Then, the user ID is encrypted using the encryption key, and the encrypted user ID and an encryption processing program corresponding to the selected encryption processing method are transmitted to the server computer 1 (step 305).

The server computer 1 generates an encryption key from a server initial key and an authentication identifier in order for a pair of a user ID 202 and an authentication identifier 203 registered in the user authentication file 12A, and uses the encryption key to generate a client key. It is checked whether the user ID encrypted by the encryption processing program received from the computer 2 matches the encrypted user ID received from the client computer 2, and if they match, it is determined that the user is an authorized user. Authentication is performed (step 306).

At this time, since the encryption key is created from the server initial key and the authentication identifier 202, only the server computer 1 and the client computer 2 having both can decrypt the encrypted information (user ID). Can not. Also, even if data transmitted and received between the client and the server is eavesdropped and the data is spoofed later, the spoofing is performed because the encryption key uses the server initial key calculated from the current time. Impossible.

On the other hand, if the client computer 2 does not have the cryptographic processing function in response to the authentication request from the server computer 1, the client computer 2 responds to the user authentication request from the service application of the server computer 1 with NULL (non-holding information). ), The user ID input by the user, and the client initial key calculated from the current time are transmitted to the server computer 1 (step 403).

Server computer 1 that has received NULL
Service application is a server computer 1
From among the cryptographic processing functions possessed by the user, one cryptographic processing program is selected by examining the strength and processing speed of cryptography, and an authentication identifier 203 corresponding to the user ID is used as a cryptographic key. It encrypts the server initial key calculated from its own time and sends it to the client computer 2 together with the same encryption processing program used for the encryption (step 404).

The client computer 2 having received the encrypted data decrypts the client initial key using the authentication identifier input by the user and the encryption processing program received from the server computer 1, and transmits the client initial key transmitted by itself. By checking whether they are equal, it is confirmed that the encryption processing program has been transmitted from the service application of the server computer 1. afterwards,
The server initial key is decrypted with the authentication identifier, and an encryption key is created from the server initial key and the authentication identifier. Then, the user ID is encrypted using the encryption key and transmitted to the server computer 1 (step 405).

The server computer 1 creates an encryption key from the server initial key and the authentication identifier 203, decrypts the data received from the client computer 2, and checks whether the data matches the user ID transmitted first. User authentication is performed (step 406).

At this time, since the encryption key is created from the server initial key and the authentication identifier 203, only the server computer 1 and the client computer 2 having both have the encryption key.
Encrypted information cannot be decrypted. Also, even if the data transmitted and received between the client and the server is eavesdropped and the data is spoofed later,
Since the encryption key uses the server initial key calculated from the current time, spoofing is impossible.

The encryption processing program assumes a symmetric encryption scheme in which encryption and decryption can be performed with the same key.

Hereinafter, the operation of the present embodiment will be described in detail with reference to a flowchart.

FIG. 5 is a flowchart showing the operation of the user authentication client program running on the client computer 1.

First, the user authentication client program sends a connection request to the server computer 1 (step 501), and receives an authentication request from the server computer 1 (step 502). Next, it is determined whether or not the client computer 2 has the encryption processing function (step 503). If not, the processing continues to the flowchart of FIG.

If the server has an encryption processing function, a list in which the encryption processing method is converted into an ID is transmitted to the server computer 1 (step 504).

On the other hand, the encryption processing method is received from the server computer 1 (step 505), and the
L (non-holding information) (step 506)
The processing in the case of NULL follows the flowchart of FIG.

If not NULL, the server computer 1 encrypts the user ID and the authentication identifier input by the user with the encryption program selected by the user and sends them to the server computer 1 (step 507). Thereafter, the authentication result is received from the server computer 1 (step 50).
8), end the process.

FIG. 6 is a flowchart showing the operation of the user authentication client program when the client computer has no encryption processing function. The user authentication client program shown in this flowchart is stored in a storage medium such as a CDROM and used by the client computer 2.

First, the client initial key is calculated from the current time (step 601), and NULL indicating that the client does not have the encryption processing program, the user ID, and the client initial key are transmitted to the server computer 1 (step 602). After that, the encryption program, the encrypted client initial key and the encrypted server initial key are received from the server computer 1 (step 603).

Next, the received encrypted client initial key is decrypted using the authentication identifier as the encryption key using the encryption processing program received from the server computer 1 (step 604).

The client initial key transmitted in step 602 is compared with the decrypted client initial key (step 605). If they are not equal, the received encryption processing program is not sent from the server computer 1, or It is determined that the data has been tampered with in the middle, and it is considered that the authentication has failed (step 606), and the process ends.

If they are equal to each other, the encrypted server initial key is decrypted using the received encryption processing program with the authentication identifier as the encryption key, and an encryption key is created by using this and the authentication identifier (step 607). After that, the encryption processing program received from the server computer 1 and step 6
The user ID is encrypted using the encryption key created in step 07 and transmitted to the server computer 1 (step 60).
8). Thereafter, the authentication result is received from the server computer 1 (step 609), and the process ends.

FIG. 7 is a flowchart showing the operation of the user authentication client program when the client computer 2 does not have the encryption processing program on the server computer 1. The user authentication client program shown in this flowchart is a CDR program.
It is stored in a storage medium such as OM and used by the client computer 2.

First, a server initial key is received (step 701). An encryption key is created from the server initial key and the authentication identifier (step 702). Next, one of the cryptographic processing programs held by the client computer 2
One encryption processing program is selected, and the user ID input by the user is encrypted using the encryption key created in step 702 (step 703). Then, step 70
The encryption processing program selected in step 3 and the user ID encrypted by the encryption processing program are transmitted to the server computer 1 (step 704), the authentication result is received from the server computer 1 (step 705), and the process ends.

FIG. 8 is a flowchart showing the operation of the user authentication server program running on the server computer 1. The user authentication server program shown in this flowchart is stored in a storage medium such as a CDROM and used by the server computer 1.

First, after receiving a connection request from the client computer 2 (step 801), a user authentication request is transmitted to the client computer 2 (step 802). Next, the client computer 2 sends the encryption processing program of the client computer 2 to I
The D-list is received (step 803). If the received result is NULL (step 804),
Subsequent processing continues to the flowchart of FIG.

If it is not NULL, it is determined whether or not the server computer 1 has an encryption processing program in the ID of the list (step 805). If not, the process continues to the flowchart of FIG. If so, one of the encryption processing programs is selected and transmitted to the client computer 2 (step 806). afterwards,
User I encrypted from client computer 2
D and the encrypted authentication identifier are received (step 80).
7) This is decrypted by the encryption processing program transmitted to the client computer 2 and the user authentication file 12A
Are compared in order, and if there is a match, the authentication is completed, and if there is no match, an authentication failure is transmitted to the client computer 2 as an authentication result (step 80).
8), end.

FIG. 9 is a flowchart showing the operation of the user authentication server program running on the server computer 1 when the client computer 2 does not have an encryption processing program. The user authentication server program shown in this flowchart is stored in a storage medium such as a CDROM and used by the server computer 1.

First, a user ID and a client initial key are received from the client computer 2 (step 9).
01). Next, a server initial key is created from the current time (step 902), and an encryption processing program to be transmitted to the client computer 2 is selected (step 903).
Next, from the user authentication file 12A, step 901 is executed.
Then, the authentication identifier 203 corresponding to the user ID received in step 901 is extracted, and the client initial key received in step 901 and the server initial key created in step 902 are encrypted (step 904).

Next, the encryption processing program and step 90
The server initial key and the client initial key encrypted in step 4 are transmitted to the client computer 2 (step 90).
5). Thereafter, the encrypted user ID is received from the client computer 2 (step 906). Next, the server initial key and the user I received in step 901
D is generated from the authentication identifier corresponding to D (step 907), and the client computer 2
Using the encryption program transmitted to
Encrypts the received user ID (step 90)
8).

The encrypted user ID received in step 906 is compared with the user ID encrypted in step 908 (step 909). If they are equal, authentication completion is transmitted to the client computer (step 910).
finish. If they are not the same, an authentication failure is transmitted to the client computer 2 (step 911), and the process ends.

FIG. 10 is a flowchart showing the operation of the user authentication server program when the server computer 1 does not have the encryption processing program transmitted from the client computer 2. The user authentication server program shown in this flowchart is stored in a storage medium such as a CDROM and executed by the server computer 1.

First, a server initial key is generated from the current time (step 1001). Next, NULL indicating that the server computer does not have the encryption processing program transmitted from the client computer 2 and the server initial key created in step 1001 are transmitted to the client computer 2 (step 1002).

Thereafter, an encryption processing program and an encrypted user ID are received from the client computer 2 (step 1003). Next, the transmitted user I
In order to check whether D is correct, the user ID 202 and the authentication identifier 203 are obtained from the user authentication file 12A.
Is read (step 1004). Next, it is determined whether there is a group to be read in the user authentication file 12A (step 1005). If not, an authentication failure is transmitted to the client computer 2 (step 101).
0), end.

If it can be read, an encryption key is created from the server initial key created in step 1001 and the authentication identifier 203 read in step 1004 (step 10).
06). Then, the user ID 202 read in step 1004 is encrypted with the received encryption processing program using the received encryption processing program (step 1007). next,
Encrypted user ID and client computer 2
It is determined whether the encrypted user ID received from is the same (step 1008), and if not, the process is repeated from step 1004. If they are equal, authentication completion is transmitted to the client computer 2 (step 100).
9), end.

As described above, in the present embodiment, when the server computer 1 does not hold the encryption processing program, the server computer 1 responds to the connection request including the user identification information from the client computer 2 to the server computer 1. Transmits a user authentication request to the client computer 2, and in response to the user authentication request, causes the client computer 2 to transmit a list of cryptographic processing programs held by the client computer 2 to the server computer 1. If the server computer 1 does not hold the encryption processing program to be executed, one of the encryption processing programs held by the client computer 2 and the user encrypted by the encryption processing program are transmitted from the client computer 2. The server computer 1 transmits the authentication information to the server computer 1, and the server computer 1 authenticates a user who uses the client computer 2 based on the received encryption processing program and the user authentication information. If the user does not have the program, the server computer 1 causes the client computer 2 to transmit one of the cryptographic processing programs stored in the server computer 1 to the client computer 2, and the client computer 2 uses the received cryptographic processing program to transmit the user authentication information. Is transmitted to the server computer 1 and the user of the client computer 2 is authenticated.

Thus, even if the encryption processing program for securely performing the user authentication between the client computer 2 and the server computer 1 does not exist in both the server and the client at the same time, the encryption of the data flowing on the network 3 is performed. And security of user authentication can be secured.

In this case, since the encryption key is created from the server initial key and the authentication identifier 202, it is impossible for only the server computer 1 and the client computer 2 having both to decrypt the encrypted information (user ID). Can not. Also, even if data transmitted and received between the client and the server is eavesdropped and the data is spoofed later, the spoofing is performed because the encryption key uses the server initial key calculated from the current time. This is impossible, and sufficient security can be ensured during user authentication.

[0070]

As described above, according to the present invention, a cryptographic processing function newly registered in a client computer is transmitted between a server and a client for user authentication even if it does not exist on the server computer. Since encrypted data can be transmitted and received, eavesdropping on the network can be prevented, and the security of user authentication can be ensured.

Also, even if the client computer does not have an encryption function, data transmitted between the server and the client for user authentication can be encrypted and transmitted and received, so that eavesdropping on the network can be prevented and user authentication can be performed. Safety can be ensured.

Further, since the program for realizing the user authentication method of the present invention is provided to the user in a form stored in a storage medium such as a CDROM, the program is immediately applied to an existing server or client system to perform user authentication. Can be implemented.

In particular, this is very effective when the encryption processing program installed in the client system or the server system is frequently updated.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram showing an embodiment of a user authentication system according to the present invention.

FIG. 2 is a diagram showing a configuration example of a user authentication file used by a user authentication server program according to the present invention.

FIG. 3 is a diagram showing a flow of data transmitted and received between a client computer and a server computer according to the present invention.

FIG. 4 is a diagram showing a flow of data transmitted and received between a client computer and a server computer according to the present invention.

FIG. 5 is a flowchart showing the operation of the user authentication client program according to the present invention.

FIG. 6 is a flowchart showing the operation of the user authentication client program according to the present invention.

FIG. 7 is a flowchart showing an operation of a user authentication client program according to the present invention.

FIG. 8 is a flowchart showing the operation of the user authentication server program according to the present invention.

FIG. 9 is a flowchart showing the operation of the user authentication server program according to the present invention.

FIG. 10 is a flowchart showing the operation of the user authentication server program according to the present invention.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Server computer, 2 ... Client computer, 3 ... Network, 11 ... Terminal device, 11A ... CP
U, 11B: memory, 12: external storage device, 12A: user authentication file, 12B: encryption processing program, 13
... Communication port, 21 ... Terminal device, 21A ... CPU, 21
B: memory, 22: communication port.

──────────────────────────────────────────────────続 き Continued on front page (51) Int.Cl. ⁶ Identification code FI H04L 9/14 H04L 9/00 641

Claims (12)

[Claims] 1. A user authentication method executed when a client computer connects to a server computer in a computer system including a server computer connected to a network and a client computer used by a user, comprising: In response to the connection request including the user identification information for the computer, the server computer transmits a user authentication request to the client computer. In response to the user authentication request, the client computer transmits to the server computer the encryption processing program of the client computer itself. If the server computer does not hold the encryption processing program included in the list, the client computer transmits the list. One of the encryption processing programs held by the client computer and the user authentication information encrypted by the encryption processing program are transmitted to the server computer, and the server computer executes the client processing based on the received encryption processing program and the user authentication information. A user authentication method, wherein authentication of a user using a computer is performed. 2. The user authentication information transmitted from the client computer to the server computer includes an initial key received from the server computer together with information indicating that the server computer does not have an encryption processing program held by the client computer. The authentication information input by the user is used as an encryption key, and the user identification information input by the user is encrypted by the same encryption processing program as the encryption processing program transmitted to the server computer. In response to the user authentication information, the user identification information received at the time of the connection request is taken out as a pair with the user identification information, and the authentication identifier of the user registered in advance is retrieved from the storage device and transmitted to the client computer. Same as The initial key is used as an encryption key, the user identification information received at the time of the connection request is encrypted by the encryption processing program received from the client computer, and the encrypted user identification information matches the user authentication information received from the client computer. 2. The user authentication method according to claim 1, wherein authentication of a user using the client computer is performed depending on whether or not to perform the authentication. 3. A user authentication method which is performed when a client computer connects to a server computer in a computer system including a server computer connected to a network and a client computer used by a user. In response to the connection request including the user identification information for the computer, the server computer transmits a user authentication request to the client computer. In response to the user authentication request, the client computer transmits to the server computer the encryption processing program of the client computer itself. When transmitting the list, if the client computer does not have the cryptographic processing program, the server computer sends the list. One of the cryptographic processing programs held by the computer is transmitted to the client computer, the client computer encrypts the user identification information by the received cryptographic processing program, transmits the encrypted user identification information to the server computer, and authenticates the user who uses the client computer. A user authentication method characterized in that: 4. When the client computer does not have a cryptographic processing program, the client computer arbitrarily generates a client initial key together with information indicating that the client computer does not have the cryptographic processing program, and user identification information input by the user. The server computer transmits the user identification information to the computer by using the user identification information received from the client computer.
The authentication identifier of the user registered in advance as a set is extracted from the storage device, and the authentication identifier is used as an encryption key, and the client initial key received from the client computer and the server initial key arbitrarily generated by the server computer are used as the client computer. The client computer encrypts with the same encryption processing program that was sent to the client computer and sends it to the client computer. The client computer decrypts the client initial key received from the server computer using the received encryption processing program and the authentication identifier input by the user, and performs the encryption processing. After confirming that the program was transmitted from the server computer that transmitted the user authentication request, the server decrypts the server initial key with the authentication identifier input by the user, and decrypts the decrypted server identifier with the authentication input by the user. Using the certificate identifier as an encryption key, the user identification information input by the user is encrypted by the encryption processing program and transmitted to the server computer, and the server computer retrieves the same server initial key and the storage device as those transmitted to the client computer. Using the authentication identifier as an encryption key, decrypts the encrypted user identification information received from the client computer, and determines whether the decrypted user identification information matches the user identification information received with the client initial key. 4. The user authentication method according to claim 3, wherein authentication of a user to use is performed. 5. A user authentication system comprising a server computer connected to a network and a client computer used by a user, and performing user authentication when connecting from the client computer to the server computer, wherein the server computer comprises: First means for transmitting a user authentication request to a client computer in response to a connection request including user identification information from a client computer to a server computer, and a list of cryptographic processing programs received from the client computer in response to the user authentication request A second means for determining whether or not the server computer itself holds the included cryptographic processing program, and if not, transmitting non-holding information indicating the fact to the client computer; And third means for authenticating a user who uses the client computer based on the encryption processing program and the user authentication information received from the client computer for the non-holding information, wherein the client computer is Fourth means for transmitting a list of encryption processing programs held by the client computer in response to the user authentication request, one of the encryption processing programs held by the client computer for the non-held information, Fifth means for transmitting the user authentication information encrypted by the processing program to the server computer. 6. The user authentication information transmitted from the client computer to the server computer includes an initial key received from the server computer together with information indicating that the server computer does not have an encryption processing program held by the client computer. The user identification information input by the user is encrypted by the same encryption processing program as the encryption processing program transmitted to the server computer, using the authentication identifier input by the user as an encryption key, and Means for extracting, from the storage device, an authentication identifier of the user registered in advance as a pair with the user identification information based on the user identification information received at the time of the connection request with respect to the received user authentication information, On the client computer Using the same initial key as the encrypted key as the encryption key, encrypting the user identification information received at the time of the connection request with the encryption processing program received from the client computer, and encrypting the user identification information and the user received from the client computer. 6. The user authentication system according to claim 5, wherein authentication of a user using the client computer is performed based on whether the authentication information matches. 7. A user authentication system comprising a server computer connected to a network and a client computer used by a user, and performing user authentication when connecting from the client computer to the server computer, wherein the server computer comprises: First means for transmitting a user authentication request to a client computer in response to a connection request including user identification information from a client computer to a server computer, and the client computer not having an encryption processing program in response to the user authentication request When receiving the non-holding information indicating that the server computer receives the non-holding information, the second means for transmitting one of the cryptographic processing programs held by the server computer to the client computer; Means for performing authentication of a user who uses the client computer based on the user authentication information received from the client computer, wherein the client computer responds to the user authentication request received from the server computer by an encryption processing program If the user authentication information is not held, the fourth means for transmitting the non-held information indicating that to the server computer, and the user authentication information encrypted by the encryption processing program received from the server computer for the transmitted non-held information. And a fifth means for transmitting to the server computer. 8. The fourth means of the client computer, when the user does not have the cryptographic processing program, the client initial key arbitrarily generated together with information indicating that he does not have the cryptographic processing program, and the user inputs And the second means of the server computer transmits one of the cryptographic processing programs held by the server computer to the client computer, and transmits the user identification information received from the client computer to the server computer. The authentication identifier of the user registered in advance as a set with the user identification information is extracted from the storage device, and the authentication identifier is arbitrarily generated by the server computer and the client initial key received from the client computer as an encryption key. Server first The key is encrypted by the same encryption processing program as that transmitted by the client computer and transmitted to the client computer. The fifth means of the client computer transmits the key from the server computer based on the received encryption processing program and the authentication identifier input by the user. After decrypting the received client initial key and confirming that the encryption processing program was transmitted from the server computer that transmitted the user authentication request, the server initial key is decrypted with the authentication identifier input by the user, and the decryption is performed. Using the server initial key obtained and the authentication identifier input by the user as an encryption key, the user identification information input by the user is encrypted by the encryption processing program and transmitted to the server computer. Pew The encrypted user identification information received from the client computer is decrypted using the same server initial key as transmitted to the server and the authentication identifier extracted from the storage device as an encryption key, and is received together with the decrypted user identification information and the client initial key. 8. The user authentication system according to claim 7, wherein the authentication of the user using the client computer is performed based on whether the obtained user identification information matches. 9. A user authentication system comprising a server computer connected to a network and a client computer used by a user, wherein the server computer stores a program for performing user authentication when connecting from the client computer to the server computer. A storage medium, wherein a first process of transmitting a user authentication request to a client computer in response to a connection request including user identification information from a client computer to a server computer, and an encryption received from the client computer in response to the user authentication request It is determined whether or not the server computer itself has the cryptographic processing program included in the list of processing programs, and if not, non-retained information indicating that fact is displayed on the client computer. And a third process for authenticating a user who uses the client computer based on the encryption processing program and the user authentication information received from the client computer for the non-held information. A storage medium for user authentication, characterized by storing: 10. A user authentication system comprising a server computer connected to a network and a client computer used by a user, wherein the client computer stores a program for performing user authentication when connecting from the client computer to the server computer. A storage medium, wherein a first process of transmitting a connection request including user identification information from a client computer to a server computer, and the client computer owning a user authentication request received from the server computer in response to the connection request A second process of transmitting a list of cryptographic processing programs to be transmitted, and a case where the server computer itself does not hold the cryptographic processing programs included in the transmitted list of cryptographic processing programs. When the non-holding information indicating that the non-holding information is received from the server computer, one of the encryption processing programs held by the client computer for the non-holding information and the user authentication information encrypted by the encryption processing program are transmitted to the server computer. A storage medium for user authentication, which stores a program including a third process to be transmitted to the user. 11. A user authentication system comprising a server computer connected to a network and a client computer used by a user, wherein the server computer stores a program for performing user authentication when connecting from the client computer to the server computer. A storage medium, a first process of transmitting a user authentication request to a client computer in response to a connection request including user identification information from a client computer to a server computer, and a cryptographic processing program transmitted from the client computer to the user authentication request Receiving the non-holding information indicating that the server computer does not own the server, a second process of transmitting one of the encryption processing programs held by the server computer to the client computer, and User authentication storage medium characterized by storing a program and a third process of authenticating a user who utilizes the client computer based on the user authentication information received from the client computer by a cryptographic processing program. 12. A user authentication system comprising a server computer connected to a network and a client computer used by a user, wherein the client computer stores a program for performing user authentication when connecting from the client computer to the server computer. A storage medium, wherein a first process of transmitting a connection request including user identification information from a client computer to a server computer, and a client computer performing an encryption process on a user authentication request received from the server computer in response to the connection request If the program is not possessed, second processing for transmitting non-proprietary information indicating that to the server computer; and a cryptographic processing program received from the server computer for the transmitted non-proprietary information. Therefore storage medium for user authentication, characterized in that stores a program including a third process for transmitting user authentication information encrypted in the server computer.