Source: http://www.google.com/patents/US7770207?ie=ISO-8859-1&dq=6175559
Timestamp: 2014-07-11 14:42:20
Document Index: 308164231

Matched Legal Cases: ['Application No. 2004', 'application No. 2004', 'Application No. 10', 'Application No. 10', 'Application No. 200510079696', 'Application No. 2']

Patent US7770207 - System, apparatus, program, and method for authentication - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign in<nobr>Advanced Patent Search</nobr>PatentsAccording to an aspect of the invention, a management of each authentication subprocess assures the each authentication subprocess, and assurance contents can be verified by verification side, so that trustworthiness of the whole authentication process can be improved. An authentication system includes...http://www.google.com/patents/US7770207?utm_source=gb-gplus-sharePatent US7770207 - System, apparatus, program, and method for authenticationAdvanced Patent SearchPublication numberUS7770207 B2Publication typeGrantApplication numberUS 11/165,276Publication dateAug 3, 2010Filing dateJun 24, 2005Priority dateJun 25, 2004Fee statusPaidAlso published asCA2510548A1, CA2510548C, CN1713572A, CN1713572B, CN101917274A, CN101917274B, EP1646017A2, EP1646017A3, US8230483, US20060005025, US20100281517Publication number11165276, 165276, US 7770207 B2, US 7770207B2, US-B2-7770207, US7770207 B2, US7770207B2InventorsKoji Okada, Tatsuro Ikeda, Hidehisa TakamizawaOriginal AssigneeKabushiki Kaisha Toshiba, Toshiba Solutions Corp.Export CitationBiBTeX, EndNote, RefManPatent Citations (12), Non-Patent Citations (10), Classifications (19), Legal Events (3) External Links: USPTO, USPTO Assignment, EspacenetSystem, apparatus, program, and method for authenticationUS 7770207 B2Abstract According to an aspect of the invention, a management of each authentication subprocess assures the each authentication subprocess, and assurance contents can be verified by verification side, so that trustworthiness of the whole authentication process can be improved. An authentication system includes authentication entity devices which separately execute authentication subprocesses P1 and P2 and a verification device which verifies the executed contents of each of the authentication subprocesses P1 and P2. The entity device includes a confidential information management unit which manages confidential information, an authenticator generating unit which generates an authenticator using the confidential information, and a context generating unit which generates a specific context pursuant to a specific format from the authenticator and the executed contents.
1. An authentication entity device used in an authentication system comprising a plurality of authentication entity devices which separately execute authentication subprocesses, the authentication subprocess constituting an authentication process, and a verification device which verifies the authentication process executed by the each authentication entity device, the authentication entity device comprising:
an authenticator generating module configured to generate an authenticator corresponding to executed contents of the authentication subprocess, the authenticator being generated using the confidential information;
a specific context generating module configured to generate a specific context data, the specific context data including a header block, a data block containing the executed contents of the authentication subprocess, and an authenticator block including the generated authenticator; and
a specific context output module configured to output the specific context data.
2. The authentication entity device according to claim 1, further comprising:
an overall authenticator generating module configured to generate an overall authenticator based on a plurality of specific contexts using the confidential information, the plurality of specific contexts being outputted from other authentication entity devices in association with the authentication process;
a generic context generating module configured to generate a generic context pursuant to the specific format from the overall authenticator and the plurality of specific contexts; and
a generic context output module configured to output the generic context to the verification device.
3. The authentication entity device according to claim 1, further comprising a specific context verifying module configured to verify the specific context inputted from other authentication entity devices using the confidential information.
4. The authentication entity device according to claim 1, further comprising a context information associating module configured to generate the specific context of the authentication entity device in order to express a hierarchical structure between specific contexts associated with dependence of the authentication subprocess such that the specific context of the authentication entity device includes the specific contexts inputted from other authentication entity devices.
5. The authentication entity device according to claim 4, further comprising:
6. The authentication entity device according to claim 1, further comprising a context information associating module configured to generate the specific context of the authentication entity device in order to express a hierarchical structure between specific contexts associated with dependence of the authentication subprocess such that the specific context of the authentication entity device includes reference information of the specific contexts inputted from other authentication entity devices.
7. The authentication entity device according to claim 1, wherein the confidential information memory module has a private key memory unit configured to store a private key in a public key cryptography as the confidential information, and
8. A verification device which verifies a authentication process executed by each of a plurality of authentication entity devices which separately executes an authentication subprocess constituting the authentication process, the verification device comprising:
a context verifying module configured to verify a plurality of contexts using confidential information identical to the confidential information or corresponding confidential information;
the plurality of contexts being generated by the plurality of authentication entity devices, wherein each of the plurality of authentication entity devices separately executes an authentication subprocess to generate a specific context for each of the plurality of authentication entity devices; and
the plurality of contexts including execution contents of the authentication subprocess corresponding to a particular authentication entity device, and an authenticator generated for the execution contents using predetermined confidential information stored on the particular authentication entity device.
9. A client device which transfers communication between a plurality of authentication entity devices and a verification device, the plurality of authentication entity devices separately executing a authentication subprocess constituting an authentication process, the verification device verifying the authentication process executed by the each authentication entity device, the client device comprising:
a profile query module configured to transmit a request for profiles to each of the plurality of authentication entity devices, the profiles defining execution environment contents of the authentication subprocess executing on each of the plurality of authentication entity devices;
a profile management module configured to store the profiles received from each of the plurality of authentication entity devices; and
a control module configured to determine one of the profiles compatible with a client environment of the client device.
10. The client device according to claim 9, further comprising a control module configured to cause each of the plurality of authentication entity devices having a corresponding profile matching a profile specified from the verification device to execute the authentication subprocess based on the profile. Description
CROSS-REFERENCE TO RELATED APPLICATIONS This application is based upon and claims the benefit of priority from prior Japanese Patent Application No. 2004-187239, filed Jun. 25, 2004, the entire contents of which are incorporated herein by reference.
At the same time, an authentication means has been developed in various layers. For example, SSL (Secure Sockets Layer)/TLS (Transport Layer Security) can be cited in a session layer of an OSI seven-layer model (see [SSL3.0] A. Frier, P. Karlton, and P. Kocher, �The SSL 3.0 Protocol�, Netscape Communications Corp., Nov. 18, 1996. and [TLS1.0] T. Dierks, C. Allen, �The TLS Protocol Version 1.0�, RFC2246, Jan. 1999, http://www.ietf.org/rfc/rfc2246.txt). The SSL/TLS becomes widespread as a standard secure communication protocol, because the SSL/TLS can provide the transparent secure communication to a higher layer. For an authentication mechanism, the SSL/TLS supports server authentication and client authentication based on a public key certificate.
IPsec can be cited as an example of secure communication for IP (Internet Protocol) which is a communication protocol in the network layer of the OSI seven-layer model (see [IPsec] S. Kent, R. Atkinson, �Security Architecture for the Internet Protocol�, Nov. 1998, <http://www.ietf.org/rfc/rfc2401.txt>). In the IPsec, authentication and encryption are performed at an IP packet level to realize the secure communication in unit of host. The IPsec is used for VPN (Virtual Private Network) and the like. The IPsec supports the authentication of the communication party by a known common key. For dynamic authentication, IPsec can utilize a mechanism, such as IKE and IKEv2, which is a higher security association mechanism.
On the other hand, SAML (Security Assertion Markup Language) has been developed as industrial standard specifications for assertion of the security statement concerning user authentication (for example, see [SAML] OASIS Security Services TC, �Security Assertion Markup Language (SAML) v1.1�, Sep. 2003, http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=security>). The SMAL is a framework in which the statements concerning client security and policy decision are expressed in an XML format to electronically make assurance.
BRIEF SUMMARY OF THE INVENTION An object of the invention is to provide an authentication system, apparatus, program, and method, in which the management assures each authentication subprocess, the assured contents can be verified by a verification side, and thereby the trustworthiness of the whole authentication process can be improved.
BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING FIG. 1 is a block diagram showing a configuration of an authentication system according to a first embodiment of the invention;
DETAILED DESCRIPTION OF THE INVENTION Referring now to the drawings, preferred embodiments of the invention will be described below.
First Embodiment FIG. 1 is a block diagram showing a configuration of an authentication system according to a first embodiment of the invention. FIG. 2 is a schematic view for explaining an authentication process in the authentication system. As shown in FIG. 2, the authentication process includes two authentication subprocesses P2 and P1. The authentication result is obtained based on the executing results of the authentication subprocesses P2 and P1. The authentication subprocesses P1 and P2 are executed by first and second entity devices 10 and 20 different from each other. In this case, the authentication subprocess P1 is executed by the first entity device 10 and the authentication subprocess P2 is executed by the second entity device 20.
FIG. 5 shows the structure of the second specific context p2. The second specific context p2 is formed pursuant to the specific format. The second specific context p2 includes a header block p2 h, a data block (execution contents) p2 d, and an authenticator block p2 a. The header block p2 h includes the information for identifying the second specific context p2. Further, the header block p2 h may include the information on the structure of the second specific context p2.
The first specific context p1 has the same structure as for the second specific context p2. The first specific context p1 is formed pursuant to the specific format. The first specific context p1 includes a header block p1 h, a data block p1 d, and an authenticator block p1 a. The header block p1 h includes the information for identifying the first specific context p1. Further, the header block p1 h may include the information on the structure of the first specific context p1.
Second Embodiment A second embodiment of the invention is an example of the authentication system in which a generic context generating unit 16 is added to a first entity device 10. FIG. 6 shows a configuration of the first entity device 10. FIG. 7 shows a flowchart for explaining the operation of a portion to which the generic context generating unit 16 is added.
Third Embodiment A third embodiment of the invention is an authentication system in which a context generating unit 15 of a first entity device 10 in the first and second embodiments includes a context information associating unit 17. FIG. 9 shows a configuration of the first entity device 10.
Fourth Embodiment A fourth embodiment of the invention is a modification of the first to third embodiments. Particularly, in the fourth embodiment, an authentication system is specifically shown using the authentication with the biometric information.
FIG. 15 shows the matching-process executing unit 12′. The matching-process executing unit 12′ includes a user information management unit 12′a and a biometric information matching unit 12′b. The biometric template of a person who is an owner of the user information management device 10′ is stored in the user information management unit 12′a. It is desirable that the user information management unit 12′a has tamper-resistant characteristics. The confidential information stored in the confidential information management unit 13 of the user information management device 10′ may be stored in the user information management unit 12′a. The biometric information matching unit 12′b performs the matching process to the biometric sample information received from the biometric device 20′ and the biometric template stored in the user information management unit 12′a, and then the biometric information matching unit 12′b outputs the matching result to the context generating unit 15′.
Then, the context generating unit 15′ generates an MOC specific context p1 formed in the structure shown in FIG. 20. The MOC specific context p1 includes the header block p1 h, the data block p1 d and the authenticator block p1 a. The header block p1 h has a specific context identifier, a profile name, a specific context type, a biometric information type, a issuer, a subject, the requestor, the generation date, and the challenge value. The specific context identifier is the identifier which is assigned in order to uniquely identify the specific context. The specific context type is the information for identifying the type of the specific context. The issuer is the information for uniquely identifying the entity issuing the specific context. The subject is the information for uniquely identifying the entity receiving the specific context. The requester is the information for identifying the entity requesting the specific context. The generation date is the information indicating the date when the specific context is generated. The challenge value is the random numbers generated by the entity requesting the specific context.
Fifth Embodiment A fifth embodiment is a modification of the fourth embodiment. The fifth embodiment is an authentication system (hereinafter referred to as STOC (Store On Card) model) in which the biometric device 20′ has the matching function instead of the user information management device 10′.
Sixth Embodiment A sixth embodiment is another modification of the fourth embodiment. As shown in FIG. 25, the sixth embodiment is an authentication system (hereinafter referred to as multimodal system) including at least two biometric devices 20 1″, 20 2″, . . . .
Seventh Embodiment A seventh embodiment is a modification of the first to sixth embodiments, and the seventh embodiment shows an example in which the profile concerning the authentication system is used.
In the seventh embodiment shows an example including the client device 40 as the authentication system entity substituting device which can organize the profile compatible with the client environment. The client device 40 has no authentication subprocess, and the client device 40 transfers between the authentication entity devices 10 e, 20 1 e, and 20 2 e and the verification device 30 or between the authentication entity device 10 e and the authentication entity devices 120 1 e and 20 2 e. The client device 40 is connected to one or more authentication entity devices 10 e, 20 1 e, and 20 2 e. The client device 40 transfers the communication among the authentication entity devices 10 e, 20 1 e, and 20 2 e to perform a process of handling the whole authentication process. For example, a general-purpose personal computer and a handheld instrument can be applied to the client device 40.
The profile query unit 43 asks the profile compatible with each of the authentication entity devices 10 e, 20 1 e, and 20 2 e. The profile management unit 44 manages the profile compatible with the client environment.
The profile management unit 44 manages the response contents from each of the authentication entity devices 10 e, 20 1 e, and 20 2 e as supported profile information (ST39). It is desirable that the supported profile information is managed in correspondence with the authentication entity devices 10 e, 20 1 e, and 20 2 e. The client device 40 determines the profile with which the client environment is compatible from the supported profile information managed (ST40). As a result of the determination, the client device 40 registers the compatible profile in the profile management unit 44 (ST41).
During executing the authentication subprocess, the client device 40 may not perform the transfer substitution of the communication among the authentication entity devices 10 e, 20 1 e, and 20 2 e. As described above, according to the seventh embodiment, in addition to the effects of the first to sixth embodiments, before the authentication subprocess is executed, the profile with which the client environment is compatible is registered among the profiles of the authentication subprocesses in each of the authentication entity devices 10 e, 20 1 e, and 20 2 e. Therefore, the agreement between the client environment and the profile can be established.
Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS5818936Mar 15, 1996Oct 6, 1998Novell, Inc.System and method for automically authenticating a user in a distributed network systemUS6178511Apr 30, 1998Jan 23, 2001International Business Machines CorporationCoordinating user target logons in a single sign-on (SSO) environmentUS7207058 *Dec 31, 2002Apr 17, 2007American Express Travel Related Services Company, Inc.Method and system for transmitting authentication context informationUS20020071567Dec 12, 2000Jun 13, 2002Kurn David MichaelScalable computer system using remote agents to manipulate cryptographic keysUS20020104006Feb 1, 2001Aug 1, 2002Alan BoateMethod and system for securing a computer network and personal identification device used therein for controlling access to network componentsUS20040088587 *Oct 30, 2002May 6, 2004International Business Machines CorporationMethods and apparatus for dynamic user authentication using customizable context-dependent interaction across multiple verification objectsUS20040172535 *Nov 26, 2003Sep 2, 2004Rsa Security Inc.Identity authentication system and methodUS20050132235 *Dec 15, 2003Jun 16, 2005Remco TeunenSystem and method for providing improved claimant authenticationCN1430417ADec 27, 2002Jul 16, 2003佳能株式会社Image generating device, image file generating method, image verification device and image verification methodeJP2003143136A Title not availableKR20020086030A Title not availableWO2004051585A2Nov 26, 2003Jun 17, 2004Rsa Security IncIdentity authentication system and method* Cited by examinerNon-Patent CitationsReference1"Technical Overview of the OASIS Securtiy Assertion Markup Language (SAML) V1.1," OASIS (May 11, 2004), pp. 1-19.2Dierks et al., "The TLS Protocol," The Internet Society (Jan. 1999), pp. 1-71.3Freier et al., "The SSL Protocol," Internet Engineering Task Force (Nov. 18, 1996), pp. 1-57.4Kent et al., "Security Architecture for the Internet Protocol," The Internet Society (Nov. 1998), pp. 1-58.5Notice of Reason for Rejection dated Feb. 16, 2010, from the Japanese Patent Office in corresponding Japanese application No. 2004-187239.6Notification for Filing Opinion dated Nov. 6, 2007 in Korean Patent Application No. 10-2007-81359.7Notification for Filing Opinion dated Oct. 25, 2006, in Korean Patent Application No. 10-2005-54260.8Notification of the First Office Action dated Dec. 5, 2008 in Chinese Patent Application No. 200510079696.2.9Office Action dated Jul. 6, 2009 in corresponding Canadian Patent Application No. 2,510,548 (4 pages).10Ye Manyon, "Modern Cryptology and Application", Nov. 20, 2002, pp. 200-201 and 345-356.Classifications U.S. Classification726/2, 713/170, 713/168International ClassificationG07F7/10, H04L9/32, G06F21/00, G07C9/00, G09C1/00, H04L9/00Cooperative ClassificationH04L9/3247, G06Q20/40145, G07C9/00158, G06Q20/341, G07F7/1008, G06Q20/40975European ClassificationG06Q20/40145, G06Q20/341, H04L9/32, G07F7/10DLegal EventsDateCodeEventDescriptionJan 8, 2014FPAYFee paymentYear of fee payment: 4Jan 29, 2013CCCertificate of correctionSep 20, 2005ASAssignmentOwner name: KABUSHIKI KAISHA TOSHIBA, JAPANFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:OKADA, KOJI;IDEDA, TATSURO;TAKAMIZAWA, HIDEHISA;REEL/FRAME:017090/0497Effective date: 20050704Owner name: TOSHIBA SOLUTIONS CORPORATION, JAPANRotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services©2012 Google