Abstract:
A login permission method improving network security and efficiently performing a login process is disclosed. In a host-based network, information required for outside login is previously registered with the host-based network. When an outside login request is received from a terminal through the communications line, it is determined whether user&#39;s login information is validated based on the registered information required for outside login. Only when the user&#39;s login information is validated, the terminal is permitted to log in to the host-based network from outside.

Description:
BACKGROUND OF THE INVENTION 
     1. Field of the Invention 
     The present invention generally relates to a communications system permitting authorized users to log in to a host computer or server and, in particular, to a login permission method and system from outside to the host computer with improved security. 
     2. Description of the Related Art 
     In a premises network system to which a user can access from outside through a communications line, network security is one of the most important issues. A major focus of network security on computer systems like this is the prevention of system use by unauthorized persons. To protect the system from unauthorized use, the system requires a user to enter a password to verify that the user is authorized to access the network. 
     According to a conventional security method, a user name and a user&#39;s authentication information are registered on the host computer in advance. When a user&#39;s mobile terminal has accessed to the host computer through a communications line, the user name is sent to the host computer and, if it matches the registered user name, then the user&#39;s authentication information is also sent to the host computer. In this way, only when both the user name and the user&#39;s authentication information match the registered ones, a one-time password is sent from the host computer to the mobile terminal. The mobile terminal is allowed to log in to the host computer using the one-time password. 
     When an unauthorized person has known the user name and the authentication information of the authorized user, however, the unauthorized person can get the one-time password easily, resulting in comprised security of the network. Further, the conventional technique fails to provide sufficiently rapid connection establishment because the one-time password transmission is performed between the host computer and the mobile terminal during the login process. 
     An authentication method using secret-key encryption has been proposed in Japanese Patent Unexamined Publication No. 5-327693. A base station transmits random data to a mobile terminal. At the mobile terminal, first and second encrypted authentication signals are produced based on the received random data, a first secret key of the mobile terminal, and a second secret key input by the subscriber, respectively. The encrypted authentication response data is transmitted to the base station. 
     At the base station, the same encryption process is performed to produce encrypted check data and matches it with the encrypted authentication response data received from the mobile terminal. If the produced encrypted data matches the received one, the authentication check is affirmative. 
     In a combination of the conventional one-time password security method and the conventional authentication method using secret-key encryption, pluralities of data exchanges are needed for login between a mobile terminal and a host computer. Therefore, it is very difficult to shorten the time required for login completion. 
     SUMMARY OF THE INVENTION 
     An object of the present invention is to provide a login permission method and system which can improve network security and efficiently perform a login process at a short time. 
     According to the present invention, in a host-based network, information required for outside login is previously registered with the host-based network. When an outside login request is received from a terminal through the communications line, it is determined whether user&#39;s login information received is validated based on the registered information required for outside login. Only when the user&#39;s login information is validated, the terminal is permitted to log in to the host-based network from outside. 
     The user&#39;s login information is preferably a user name and a user&#39;s authentication information, wherein the user&#39;s authentication information is encrypted at the terminal and is decrypted at the host-based network according to a predetermined encryption scheme based on the registered information required for outside login. Further preferably, the registered information required for outside login include a unique information uniquely assigned to the terminal, such as an identification number assigned to a selective call receiver or a pager which can be detachably connected to the terminal. 
     Preferably, the registered information required for outside login further include a one-time password that is temporarily assigned to the terminal by the host-based network when the information required for outside login is registered with the host-based network. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     FIG. 1 is a schematic block diagram showing the configuration of a network system including a login system according to the present invention; 
     FIG. 2 is a block diagram showing the detailed internal circuits of a host computer and a PC-card pager in an embodiment of a login system according to the present invention; 
     FIG. 3 is a diagram showing a sequence of a successful login process in an embodiment of a login method according to the present invention; 
     FIG. 4 is a diagram showing an operation of encryption process in the embodiment of the login method; 
     FIG. 5 is a schematic diagram showing an operation of the embodiment of the login method when a mobile terminal fails to log in to the host computer; 
     FIG. 6 is a schematic diagram showing another operation of the embodiment of the login method when a mobile terminal fails to log in to the host computer; and 
     FIG. 7 is a schematic diagram showing an operation of the embodiment of the login method when a mobile terminal successfully logs in to the host computer. 
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     As shown in FIG. 1, assuming that a network is provided in an office building  10  to provide services to authorized users. The network is composed of a premises switched network  11  which can be connected to a public switched network  12  outside the office, such as the public switched telephone network. Hereinafter, a combination of the premises switched network  11  and the public switched network  12  is called a stationary switched network. The premises switched network  11  is connected to a host computer  13  which can provide services to a plurality to user terminals T 1 -T N  installed within the office building  10 . For example, an authorized user can log in to the host computer  13  through any user terminal by entering the correct password assigned to the user. 
     Further, the respective authorized users have PC-card pager PG 1 -PG N  and mobile or portable terminals MT 1 -MT N  such as notebook computers. A PC-card pager is a PC card having a selective call receiver, or a pager, therein. As described in detail later, a user&#39;s PC-card pager stores necessary information including the pager identification number and the encryption table. The PC-card pager is inserted into the PC card slot (PCMCIA slot) of a mobile terminal and thereby the authorized user can log in to the host computer  13  from outside through the public switched network  12 . In other words, by connecting the PC-card pager of the authorized user to the mobile terminal, the user can also log in to the host computer  13  outside the office building  10 . 
     A desktop computer with the communication function and the PC card slot can be also used instead of a mobile terminal MT. That is, the user inserts his/her PC-card pager into the PC card slot of the desktop computer located outside the office and starts the outside login operation as will be described later. Hereinafter, the descriptions with be made in the case of a mobile terminal as an example. 
     HOST AND PC-CARD PAGER 
     Referring to FIG. 2, the host computer  13  is connected to the stationary switched network ( 11 ,  12 ) through an interface  101  which may be a modem or a set of digital service unit (DSU) and a terminal adapter (TA). The host computer  13  performs necessary controls including the login control according to the present invention by running control programs on a processor  102 . 
     The host computer  1  further includes a memory  103  for storing authorized user name information, an encryption table  104 , and a random number generated (RNG)  105 . The authorized user name information includes the user name, the one-time password temporarily assigned to the user, and the page ID assigned to the PC-card pager PG J  to be used by the authorized user. The authorized user name information is registered onto the memory  103  when receiving an outside login permission request from a user terminal T J  (J=1, 2, −, N) in the office  10 . The memory  103 , the encryption table  104 , and the random number generator  105  are used to decrypt the encrypted authentication information received from the mobile terminal through the stationary switched network. As described later, only users who has been registered in the memory  103  and has sent the correct authentication information encrypted in a predetermined encryption scheme are permitted to log in to the host computer  13 . 
     A PC-card pager PG 1  is a PCMCIA card having encryption function and pager function. The PC-card pager PC J  has an interface  201  which is designed to be connected to the PC card slot of a mobile terminal MT J  (here, notebook computer). The PC-card pager PG J  performs the encryption function and the pager function, which may be implemented by programs running on a processor  202 . 
     The PC-card pager PG J  further includes a password memory  203  for storing one-time password, a random number generator (RNG)  204 , an encryption cable  205 , and a pager ID memory  206  storing the pager ID assigned to the PC-card pager PG J . 
     The one-time password, as will be described later, is transferred from the host computer  13  to the PC-card pager PG J  and then stored onto the password memory  203  when the PC-card pager PG J  is connected to the user terminal T J  in the office  10  and the user makes the outside login permission request. 
     The encryption table  205 , the random number generator  204 , and the pager ID memory  206  are used to encrypt the authentication information of the user. To successfully perform encryption of the PC-card pager PG J  and decryption at the host computer  13 , the encryption table  205  and the random number generator  204  of the PC-card pager PG J  are the same as the encryption table  104  and the random number generator  105  of the host computer  13 , respectively. 
     The PC-card pager PG J  further includes a radio receiver  207  which is used to receive a paging or selective calling signal from a radio base station (not shown). As will be described later, the pager function may be used to receive the one-time password from the host computer  13  through a paging system. 
     The user terminals T 1 -T N  each have a PCMCIA slot into which the PC-card pager PG J  is inserted for data communication. More specifically, the pager ID is sent from the PC-card pager PG J  to the host computer  13  and the one-time password is sent from the host computer  13  to the PC-card pager PG J . 
     The mobile terminals MT 1 -MT N  each have the PCMCIA slot for the PC-card pager and a data communication means for communicating with the host computer  13  through the stationary switched network ( 11 ,  12 ). The data communication means may be a modem or a set of digital service unit (DSU) and a terminal adapter (TA). Alternatively, the data communication means may be a wireless communication means. Further, the mobile terminals MT 1 -MT N  each have a central processing unit (CPU) on which a control program for a PC-card pager may run. 
     As described before, the present invention is not limited to mobile terminals MT 1 -MT N . A desktop computer with the communication function and the PC card slot can be also used instead of a mobile terminal MT. 
     LOGIN SEQUENCE 
     Next, the login procedure will be described in the case where a user having a mobile terminal MT J  and a PC-card pager PG J  therewith logs in to the host computer  13  through the stationary switched network. 
     When the user intends to log in to the host computer  13  outside the office  10 , the user inserts the PC-card pager PG J  of the user&#39;s own into the PC card slot of the in-use terminal T J  and then makes the outside login permission request to the host computer  13  through the in-user terminal T J . When receiving the outside login permission request from the terminal T J , the host computer  13  reads the pager ID from the PC-card pager PG J  and stores the pager ID and the user name as authorized user name information onto the memory  103 . Alternatively, the pager ID may be entered by the user through the keyboard of the terminal T J . 
     Next, the host computer  13  informs the user of the one-time password which should be used in the case of outside login through the mobile terminal MT J . The one-time password may be displayed on screen of the terminal T J . Here, assuming that the one-time password is transferred from the host computer  13  to the password memory  203  of the PC-card pager PG J . 
     Thereafter, the user logs out and goes out with the mobile terminal MT J  and the PC-card pager PG J . 
     Referring to FIG. 3, in the case where the user needs services provided by the host computer  13  from outside, the user inserts the PC-card pager PG J  into the PC card slot of the mobile terminal MT J  and than the mobile terminal MT J  is started making a connection setup request to the stationary switched network (step S 301 ). 
     If it is possible to establish the requested connection, the stationary switched network sends an acknowledgement (ACK) back to the mobile terminal MT J  and thereby the connection from the mobile terminal MT J  to the stationary switched network is established (step S 302 ). Subsequently, the stationary switched network sends a connection setup request to the host computer  13  (step S 303 ) and, when receiving the connection setup acknowledgement from the host computer  13  (step S 304 ), the connection between the stationary switched network and the host computer  13 . Thereafter, the stationary switched network sends a connection setup acknowledgement back to the mobile terminal MT J  and thereby the connection between the mobile terminal MT J  and the host computer  13  is established (step S 305 ). 
     When the connection has been established, the host computer  13  sends a user name request for the user name information of the user to the stationary switched network (step S 306 ). When receiving the user name request, the stationary switched network sends the user name request to the mobile terminal MT J  (step S 307 ). 
     When receiving the user name request from the host computer  13  through the stationary switched network, the user is prompted to enter a user name through the keypad of the mobile terminal MT J . The user name may be stored in a memory and be read out from the memory in response to the user name request. The user name is sent to the stationary switched network (step S 308 ) and further to the host computer  13  (step S 309 ). 
     When receiving the user name, the processor  102  of the host computer  13  searches the memory  103  for the received user name. If found, the processor  102  determines that the user name has been registered as an outside login user name and then sends an authentication request to the stationary switched network (step S 310 ) and further to the mobile terminal MT J  (step S 311 ). If not found, the processor  102  determines that the user name has never been registered as an outside login user name and stops the login process to reject the login request. 
     When receiving the authentication request from the host computer  13 , the user is prompted to enter the authentication information through the keypad of the mobile terminal MT J . The authentication information may be stored in a memory and be read out from the memory in response to the received authentication request. When the authentication information has been entered, it is transferred to the PC-card pager PG J . The processor  202  of the PC-card pager PG J  encrypts the authentication information using the pager ID, the one-time password, the encryption table  205 , and the random number generator  204 . The details of the encryption will be described later. 
     The encrypted authentication information is sent back to the mobile terminal MT J  and is then transmitted to the stationary switched network (step S 312 ) and further to the host computer  13  (step S 313 ). 
     At the host computer  13 , the encrypted authentication information received from the mobile terminal MT J  is decrypted using the encryption table  104 , the random number generator  105  and the authorized user name information in the way similar to the encryption steps performed in the PC-card pager PG J . 
     Then, the processor  102  compares the decrypted authentication information with the registered authentication information stored in the memory  103 . If the decrypted authentication information matches the registered one, the host computer  13  sends a login permission message to the stationary switched network (step S 314 ) and further to the mobile terminal MT J  (step S 315 ). In this manner, the user can obtain desired services from the host computer  13  (step S 316 ). Contrarily, If the decrypted authentication information does not match the registered one, the login is rejected. 
     ENCRYPTION 
     Referring to FIG. 4, the encryption of the authentication information is performed at the PC-card pager. When the user enters the authentication information, the processor  202  of the PC-card pager PG J  reads the pager ID from the pager ID memory  206  (step S 401 ) and the one-time password from the password memory  203  (step S 402 ). Then, the processor  202  calculates a Hash value H from the one-time password using the Hash function (step S 403 ). 
     The processor  202  initializes the random number generator  204  according to the Hash value H and then obtains a random number RN T  from the random number generator  104  according to the pager ID (step S 404 ). Further, the processor  202  converts the random number RN T  to a number R T  ranging from 0 to 255 by dividing the random number RN T  by 256 to obtain the reminder R T  thereof (step S 405 ). 
     Subsequently, the processor  202  reads encryption value from the location of the encryption table  205  which is addressed with the reminder R T  (step S 406 ). Finally, the processor  202  exclusive-ORs the encryption value read from the encryption table  205  and the authentication information entered by the user to produce encrypted authentication information (step S 407 ). The encrypted authentication information is transmitted to the host computer  13 . 
     When receiving the encrypted authentication information, the decryption steps are performed in the similar way. More specifically, the processor  102  of the host computer  13  reads the pager ID and the one-time password of the authorized user name from the memory  103 . Then, the processor  102  calculates a Hash value H from the one-time password using the Hash function and initializes the random number generator  105  according to the Hash value H and then obtains a random number RN T  from the random number generator  105  according to the pager ID. Further, the processor  102  converts the random number RN T  to a number R T  ranging from 0 to 255 by dividing the random number RN T  by 256 to obtain the reminder R T  thereof. 
     Subsequently, the processor  102  reads encryption value from the location of the encryption table  104  which is addressed with the reminder R T . Finally, the processor  102  exclusive-ORs the encryption value read from the encryption table  104  and the encrypted authentication information received from the mobile terminal to reproduce the original authentication information. The decrypted authentication information is matched with the registered one. 
     LOGIN REJECTION AND PERMISSION 
     FIGS. 5 and 6 shows login rejection cases. In the case shown in FIG. 5, the user is not authorized to log in to the host computer  13  from outside. That is, the user has not been registered onto the memory  103  for outside login permission. Since neither a one-time password not a pager ID for use in encryption is registered, when the login request of the user is made from outside through the stationary switched network, the host computer determines that the user is an unauthorized person. 
     In the case shown in FIG. 6, the user has been properly registered onto the memory  103  for outside login permission. Therefore, a one-time password and a pager ID for use in encryption are registered on the host computer  13 . In the case where the user does not have the PC-card pager therewith, however, the encryption of the authentication information cannot be performed properly. Therefore, the host computer also determines that the user is an unauthorized person. 
     Referring to FIG. 7, the user has been properly registered onto the memory  103  for outside login permission and the authentication information is properly encrypted using the pager ID and the one-time password. Therefore, the host computer determines that the user is an authorized person and permits the user to log in to the host computer  13 . 
     As another embodiment of the present invention, the paging system may be used to transfer the one-time password from the host computer  13  to the PC-card pager. More specifically, the host computer  13  is connected to the paging system and calls up the PC-card pager that the user has. When the PC-card pager has been successfully called, the one-time password is transferred to the PC-card pager through the paging system and is stored onto the password memory  203  of the PC-card pager PG J  through the radio receiver  207 . 
     As described above according to the present invention, only a user who has been authorized to log in to the host computer from outside can log in to the host computer. Especially, the encryption of authentication information is performed based on the pager ID of the PC-card pager of the user&#39;s own and the one-time password previously assigned to the user. Therefore, the conditions required for login from outside become more strict, resulting in improved network security. 
     Since there is no need to send a one-time password from the host computer to the mobile terminal at a login, the login process can be rapidly completed.