JP2007279775A - Web server authentication system capable of performing web access point authentication (wapa) - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a Web server authentication system capable of performing Web access point authentication(WAPA). <P>SOLUTION: This Web server authentication system includes: a server authentication system incorporated in a Web server; a client terminal; and an authentication information registration server for storing authentication information. The Web server includes: a browsing request receiving means for receiving a browsing request and a server authentication request from the client terminal; an authentication information inquiry means for making inquiry about the authentication information of the Web server to the authentication information registration server; an authentication information receiving means for receiving the authentication information as the result of inquiry; an authentication information adding means for adding the authentication information to a Web content; and a Web content transmitting means for transmitting the Web content to the client terminal. The authentication information registration server stores the authentication information and the user identification information. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a web server authentication system.

  In recent years, the spread of the Internet has been remarkable, and accordingly, security problems have arisen from the past. For this reason, confirming the safety of websites is an important security measure.

JP 2003-337797 A JP 2002-373080 A

For example, in Japanese Patent Application Laid-Open No. 2003-337797 “Website safety level authentication system, method and program”, a provider (ISP) program conducts a site safety level survey, stores the safety level in a database, A system for informing safety level information has been proposed.
Japanese Patent Laid-Open No. 2002-373080 “Client / Server System” performs a security / authentication check as to whether an appropriate game download file or the like has been received from an appropriate server in a system for downloading content from a server to a mobile phone. A system has been proposed.
Japanese Patent Laid-Open No. 2002-140309 “Service System” proposes a system in which data delivery between a server and a client is performed via a data relay device, and the server provides a service to the client. It is described that the server is connected to the data relay processing server, server authentication information for authenticating the server device is managed, and data is delivered between the client and the server after authenticating the server. However, the client does not particularly authenticate the web server.

  Today, a number of techniques are available that assist in web server authentication of who is accessing the web server. However, such technology cannot prevent end users from accessing unauthenticated websites. For example, a hacker may create a home banking web page that is spoofed just like a real home banking web page for the purpose of stealing login and password information, and end users may attempt to access it here. .

Computer technology is becoming more complex every day, but the complexity of Internet security issues exceeds that. In addition, it may be difficult to understand the existence of the security problem itself before trying to understand the risks involved and their solutions.
As an example, the problem that WAPA can solve using a conventional automatic teller machine (ATM) will be described.
If you want to use an ATM, you must first find an ATM. Many ATMs are installed in most urban areas, so you can easily find them by looking for ATM signs. If you find an ATM, you can usually easily operate it by inserting an ATM card and entering a PIN number. A diagram of an end user operating an ATM is shown in FIG.

  The appearance and feel of the ATM itself varies depending on the installation location. However, it is usually not afraid to question whether an ATM is reliable. ATM may display “Error” or “Service stopped”. Such problems are rarely reported to banks unless the ATM card is not returned from the ATM. However, if the ATM is not reliable, as shown in FIG. 2, after the card information and PIN number are recorded, the card is returned and only “error” is displayed on the display. possible.

There is also a more advanced technique in which hackers transfer information collected in real ATMs as “brokers”. In such a case, as shown in FIG. 3, the hacker can make it appear as if the ATM transaction is completed to the end user and withdraw a large amount of cash.
The fraudulent acts shown in FIGS. 2 and 3 can be prevented if the end user has access to technology for authenticating ATMs. In practice, it is unthinkable for a hacker to manufacture a fake ATM and install it successfully in a public place.
However, because the website is digital, it can be more easily imitated than ATM. Today, as described below, hacking methods are known that can reroute end-user Internet access traffic. Hackers can perform all these scams more carefully and anonymously than at ATM. Web Access Point Authentication (WAPA) is a technology that authenticates websites for end users.

The purpose of the hacker is to trick the end user into entering confidential information on a fake website created by the hacker. This can be done fairly easily for some web applications.
Currently, Internet access via a wireless 802.11b access point called a hot spot is possible in public places. Hotspots are typically commercial services that provide high-speed wireless Internet access in public places such as coffee shops, train stations, and airports. If a mobile device capable of wireless communication (802.11b) is used, the user can check e-mails at the airport or purchase movie tickets from a coffee shop. Commercial hotspots use end users to self-authenticate to limit service usage to their customers only. This is executed by entering a login name and password in the hot spot web page that is displayed first when the web browser is started after connecting to the hot spot.

  In the hotspot connection method, as shown in FIG. 4, the mobile device is configured to connect to a specific wireless network. This can be done by configuring the mobile device to connect to a specific SSID. SSID (service setting identification) is the name of the wireless network. When the mobile device attempts a wireless connection, the mobile device searches for an access point having the same SSID as the SSID configured in the mobile device. If an access point with the wrong SSID is found, the access point is rejected and another search point with the correct SSID continues to be searched. When a plurality of access points having the same accurate SSID are found, in order to perform the best wireless connection, the access point supplying the best signal is connected. The signal strength of all 802.11b wireless access points is regulated to 30 milliwatts by the FCC (Federal Communications Commission).

Theoretically, a hacker can set up a wireless access point with a stronger signal strength and the same SSID as the hot spot at the same hot spot location. With this setting, all hot spot users can be forcibly connected to a wireless access point installed by a hacker without the end user being aware of it. The hacker provides a web page that mimics the hotspot authentication screen and stores all user names and passwords. Once the login name and password are entered, the user appears to be deceived with a little creativity that displays an error message such as "The hotspot is currently unavailable. Please connect after a while." . This is similar to the ATM example of FIG. 2 shown in Section 2.
Today, this type of web application can be easily configured using a free tool called Airsnarf published by the Shmoo group at http://airsnarf.shmoo.com/, for example.
Advanced smart hackers can continue to let the end user use the hotspot as usual, with all traffic to their web server rerouted to the hotspot. With this method, hackers can see everything the end user does.
For example, if an end user is accessing their home banking, hackers can steal the information they are accessing. This is similar to the ATM example shown in FIG. 3 in Section 2. By using these methods to hack a hot spot, a hacker can at least steal a username and password for connecting to the hot spot. This could be prevented if the end user can authenticate whether the web server of the hotspot is authentic.

By using a technique called URL spoofing, a user can be transferred to a camouflaged website.
For example, the user clicks on a link labeled http://www.visa.com, but is actually redirected to http://www.hacker_web_site.com. By using a special code inserted in the URL, you can trick the browser and display it as http://www.visa.com, but in fact the web from http://www.hacker_web_site.com A page is displayed. A URL spoofing link is sent to the end user using spam mail. With just a little system engineering, the user appears to access a camouflaged web page and enter his username / password information.

The previous hotspot hacking example used wireless signals to transfer end users to a hacker's website. It is also possible to transfer end users to another website on the LAN.
Access to a particular website is accomplished by entering the appropriate URL for the particular website into the browser.
For example, to access a Yahoo website, a user enters a URL such as http://www.yahoo.com/ into a browser. Such a URL name is actually an alias (alias definition) of a network address (IP address) such as “66.218.70.48”. Usually, since it is difficult to store such a network address, a service for automatically converting a URL name into a network address is provided. DNS (Domain Name Server) holds a table of domain names and network addresses. Since there are many DNS servers on the Internet, each computer is configured to use a specific DNS server when converting a URL name to a network address.

Theoretically, by changing the network address entered in the DNS server, it is possible to automatically forward the end user to access the camouflaged web server. In order to do this, the hacker needs to hack the DNS server. This is not a common occurrence, but it is not impossible.
In addition, there is a method of reconfiguring the end user computer so that the DNS setting in the “c: \ windows \ system32 \ drivers \ etc \ hosts” file matches the hacker's DNS server. Such reconfiguration can be performed using malicious code or even by system engineering. Hackers can reconfigure the network address of websites that handle confidential information, such as home banking sites, so that they can impersonate all access to home banking without the end user being aware of it. Can be forcibly transferred to a page. Again, after entering your login name and password, if you have a little creativity, such as displaying an error message such as "Home banking is currently unavailable. Please connect after a while." Tend to be deceived. This is similar to the ATM example shown in FIG.
A more advanced and smart hacker can even reroute all traffic to the home banking web server that she impersonated to the actual home banking website. Using this method, hackers can see everything the end user does on this website. This is similar to the ATM example shown in FIG. By using these website hacking methods, hackers can at least steal user names and passwords to websites that handle confidential information. This theft could be prevented if the user can authenticate whether the web server is authentic or not.

In addition, many companies today interact with customers over the Internet. Most of these companies have invested a great deal of money and effort in securing their web servers over the Internet. The good news is that there are many techniques for data encryption, such as various user authentications, and the use of such techniques helps to significantly improve the security of the system. By using such a technology, a company can surely know who is accessing its own server, and can protect data on the web server.
However, such security solutions do not employ web access point authentication (WAPA). These security solutions help protect the web server from hackers, but precisely protect end users directly from hackers. Solutions such as encryption used in Internet communications (eg WEP, SSH) only protect data if intercepted by hackers. User authentication only proves the user himself, it does not authenticate the web server to the end user. That is, none of these technologies protects users from WAPA hackers.

  Today, there are no products or technologies in the market that are aimed at authenticating web servers to end users. Currently, web authentication is only performed by web servers. For example, the web server can perform access control using Active Directory or access / user management software to authenticate who is accessing the web server. However, this technique cannot be used by a user to authenticate a web server as authentic.

Accordingly, an object of the present invention is to solve the above-mentioned various problems and provide web access point authentication (WAPA), which is a new Internet technology that provides web server certification to end users.
Web access point authentication is not just traditional web server authentication, but assists end users in authenticating whether the web server is genuine before sending confidential information such as username and password. It is intended. Targeted applications are web services that first require the user to enter confidential information such as username and password, including services such as hotspot wireless access points and home banking websites. It is.
Web access point authentication (WAPA) is a client-server application. For example, the server component resides on a web server, and the client component is an ActiveX control. This provides an easy-to-use method for end users to prove whether a web server is real or impersonated. A central authentication algorithm is realized based on a public key encryption algorithm.

In order to solve the above problem, in the invention according to claim 1,
A server authentication system provided in a web server for performing web server authentication when accessing any server connected to a network through a browser,
A browsing request receiving means for receiving a web content browsing request and a server authentication request from a client terminal accessing the web server;
In response to the browsing request and the server authentication request from the client terminal, the authentication information of the web server is set in response to the browsing request and the server authentication request from the client terminal. An authentication information query means for querying;
As a result of the inquiry to the authentication information registration server, if there is authentication information of the web server, authentication information receiving means for receiving the authentication information;
In response to a web content browsing request and server authentication request from a client terminal, authentication information adding means for adding received authentication information to the web content;
A web server authentication system comprising web content transmission means for transmitting web content to which the authentication information is added to the client terminal.

In order to solve the above problem, in the invention according to claim 2,
A server authentication system provided in a web server for performing web server authentication when accessing any server connected to the network via a browser, a client terminal accessing the web server, and each web server An authentication information registration server configured to store authentication information for setting and authenticating the web server,
The web server
A browsing request receiving means for receiving a web content browsing request and a server authentication request from a client terminal accessing the web server;
In response to the browsing request and the server authentication request from the client terminal, the authentication information of the web server is set in response to the browsing request and the server authentication request from the client terminal. An authentication information query means for querying;
As a result of the inquiry to the authentication information registration server, if there is authentication information of the web server, authentication information receiving means for receiving the authentication information;
In response to a web content browsing request and server authentication request from a client terminal, authentication information adding means for adding received authentication information to the web content;
Web content transmission means for transmitting the web content to which the authentication information is added to the client terminal;
The authentication information registration server is a web server authentication system that stores at least authentication information for authenticating the web server and user identification information for each user who uses the server authentication system in a client terminal. It is a feature.

In order to solve the above problem, in the invention according to claim 3,
In the client terminal, an authentication request transmitting means for transmitting a server authentication request to the web server together with a web content browsing request;
It is a web server authentication system provided with server public key storage means for storing a public key for each web server.

In order to solve the above problem, in the invention according to claim 4,
The web server authentication according to any one of claims 1 to 3, wherein the server authentication request transmitted from the client terminal and received by the browsing request receiving means in the web server includes user identification information of the server authentication system. It is characterized by being a system.

In order to solve the above problem, in the invention according to claim 5,
The server authentication request transmitted from the client terminal and received by the browsing request reception unit in the web server includes a response request indicating whether or not the web server includes the server authentication system. 4. The web server authentication system according to any one of 4).

In order to solve the above problem, in the invention according to claim 6,
The said authentication information inquiry means transmits the inquiry request | requirement containing the said user identification information, when inquiring the authentication information of the said web server with respect to the said authentication information registration server. It is a web server authentication system.

In order to solve the above problem, in the invention according to claim 7,
The authentication information inquiry means is configured for each web server, and further inquires authentication information of the web server stored in advance corresponding to the user identification information based on the user identification information. It is the web server authentication system described.

In order to solve the above problem, in the invention according to claim 8,
The authentication information of the web server that is set for each web server and is stored in advance corresponding to the user identification information is obtained by using the public key of the user for the authentication information for each user generated in the client terminal. The web server according to any one of claims 1 to 7, wherein the web server is stored by web server registration to be registered in the authentication information registration server after being encrypted and then encrypted using the public key of the web server. It is an authentication system.

In order to solve the above problem, in the invention according to claim 9,
When a web server is accessed from a client terminal, the web server responds to a response request included in the server authentication request transmitted from the client terminal whether the web server includes the server authentication system. If it is provided with the server authentication system, a response to that effect is made, and if the web server is not equipped with the server authentication system, a response to that effect is not made. It is a web server authentication system.

In order to solve the above problem, in the invention according to claim 10,
When the public key of the web server for decrypting the authentication information added to the web content is stored in the client terminal, the authentication information added to the web content received from the web server is stored. The web server authentication system according to any one of claims 1 to 9, wherein the authentication is performed using a secret key of a user who uses the client terminal to determine validity of the authentication information.

In order to solve the above problem, in the invention according to claim 11,
The web server authentication system according to claim 10, wherein a warning is displayed at the client terminal when it is determined that the authentication information is not valid.

In order to solve the above problem, in the invention according to claim 12,
When the public key of the web server for decrypting the authentication information added to the web content is not stored in the client terminal, if the web server includes the server authentication system, that fact The web server authentication system according to claim 10 or 11, wherein a user who uses the client terminal selects whether or not to perform web server registration.

According to the present invention, it is possible to provide Web Access Point Authentication (WAPA), which is a new Internet technology that provides web server certification to end users.
Web access point authentication is not just traditional web server authentication, but assists end users in authenticating whether the web server is genuine before sending confidential information such as username and password. It is intended. Targeted applications are web services that first require users to enter confidential information such as username and password, including services such as hotspot wireless access points and home banking websites. It is.
This provides an easy-to-use method for end users to prove whether a web server is real or impersonated. A central authentication algorithm is realized based on a public key encryption algorithm.

Embodiments of the present invention will be described below with reference to the drawings.
FIG. 5 is a system configuration diagram showing an example of a basic configuration of the system of the present invention.
The system of the present invention is a server authentication system provided in a web server for performing web server authentication when accessing any server connected to a network via a browser.
That is, any web server set to use the system of the present invention.

In addition, the system of the present invention accesses a server authentication system provided in a web server for performing web server authentication when accessing any server connected to a network via a browser, and the web server. The system includes a client terminal and an authentication information registration server that stores authentication information that is set for each web server and authenticates the web server.
That is, it is composed of any web server that is set to use the system of the present invention and an authentication information registration server that stores the authentication information for each web server and operates in cooperation therewith.

  In addition, a public key server is provided that stores a public key for each web server in a state usable by the user. The public key server uses the public key for each web server, and the user stores the public key for each web server in the local database at the client terminal, and registers the authentication information for each server in the authentication information registration server. Thus, the server registration process is performed.

  As a user terminal for connecting to the server system of the present invention, a computer terminal such as a personal computer or a workstation is usually used. In addition, the user terminal has a wireless communication terminal such as a mobile phone equipped with a browser function connectable to the Internet, a portable information terminal, an Internet TV, a game machine, a video conference system, and other network connection functions. Devices such as home appliances provided may be widely included. The computer terminal includes control means, storage means, input means, output means, display means, and the like. Further, it is a normal form to connect to a computer network typified by the Internet and have a function of transmitting and receiving data, and an application program such as a browser, e-mail software, and a word processor, and an operating system (OS).

  The server is provided connected to a network represented by the Internet. The network is usually assumed to be the Internet, but it includes a wide variety of forms such as a network connected by a dedicated line, an intra-company LAN, an inter-company LAN, a WAN, and the communication line used here. Widely includes forms of wired communication and wireless communication, and includes forms using satellite communication, Bluetooth, or the like.

The web server authenticated in the system of the present invention stores content data and application programs to be accessed from the user terminal. The content data includes data displayed on the web such as an HTML file and an XML file. Files and data files displayed on a mobile phone or the like that can access a WEB site such as a C-HTML file are included.
It is also possible to store character data files, audio data files, image data files, moving image data files, animation data files, and other various content data that are displayed or output by being inserted into these files. it can.

First, the web server will be described.
A web server using the system of the present invention includes a browse request receiving means for receiving a web content browsing request and a server authentication request from a client terminal accessing the web server.
The web content browsing request is a normally known browsing request that sends an HTTP request by inputting a URL or clicking a hyperlink using a browser.

Here, in the system of the present invention, a server authentication request for proving the validity of the server is included together with a web content browsing request.
Further, the server authentication request transmitted from the client terminal and received by the browsing request receiving means in the web server includes user identification information of the server authentication system.
The server authentication request can be included in an HTTP GET request transmitted from the client to the server corresponding to the server authentication system. More preferably, the server authentication request further includes the server authentication system user ID of the client. .

  According to another preferred embodiment, apart from the HTTP GET request transmitted from the client to the server corresponding to the server authentication system, the server authentication request is included in data transmitted / received by socket communication between the client and the server using TCP communication. More preferably, the server authentication request further includes the server authentication system user ID of the client. Socket (Socket) is an abstract interface for creating TCP / IP applications. It creates a socket, connects to the server, sends / receives to / from the server, and discards the socket. Do. The socket performs data communication using a data transmission / reception program between computers in the same manner as a file output / input program.

System calls used for TCP communication are known on the client side: socket () socket creation, connect () socket connection, read () data reception, write () data transmission, close () socket deletion, etc. Socket () socket generation, bind () socket registration, listen () socket connection preparation, accept () socket connection wait, read () data reception, write () data transmission, close () socket deletion, etc. are known .
Before starting communication, both the client and the server first create a socket, the server side waits for a communication connection request from the client, the client side sends a communication connection request to the server side, and the server socket and client When a communication connection is established between the sockets, data transmission / reception is started.
Among the system calls, socket () generates a socket, and the server side uses three system calls of bind (), listen (), and accept () to put the socket into a connection standby state. The client side creates a socket with socket (), sends a connection request to the server with connect (), and after connecting, writes data to the socket via the write () system call and sends it to each socket, The other can read the socket via the read () system call and receive the data sent by the other party. Data transmission / reception is repeated by the write () and read () system calls until communication is completed. When either one executes the close () system call and disconnects the communication connection, the communication ends.

More preferably, the server authentication request transmitted from the client terminal and received by the browsing request receiving unit in the web server includes a response request indicating whether or not the web server includes the server authentication system. The response request is a response request for transmitting a web content browsing request from the user terminal and confirming whether or not the web server to be browsed is compatible with the web access point authentication (WAPA) which is the system of the present invention. It is.
When a web server is accessed from a client terminal, the web server responds to a response request included in the server authentication request transmitted from the client terminal whether the web server includes the server authentication system. If the web server does not have the server authentication system, it does not respond.

Next, the web server is set for each web server, and responds to the browsing request and server authentication request from the client terminal to the authentication information registration server that stores the authentication information for authenticating the web server. An authentication information inquiry means for inquiring the authentication information of the web server is provided.
The authentication information inquiry means transmits an inquiry request including the user identification information to the authentication information registration server, which is a database server that has registered authentication information, when inquiring the authentication information of the web server. The user identification information is a user ID of the system of the present invention.
The authentication information is preferably authentication information for each user corresponding to the user identification information of the server authentication system included in the server authentication request transmitted from the client terminal.
The authentication information for each user is registered by generating the authentication information for each user using the public key for each server, and preferably the public key for each user. It is a thing.
Also, in communication between the web server and the authentication information registration server, necessary data can be transmitted and received by socket communication using TCP communication as described above.

Next, the web server includes authentication information receiving means for receiving the authentication information when there is authentication information of the web server as a result of the inquiry to the authentication information registration server.
The authentication information inquiry means makes an inquiry based on the user identification information for authentication information of the web server that is set for each web server and is stored in advance corresponding to the user identification information.
As a result of the inquiry, if there is corresponding authentication information, the web server receives the authentication information.

Next, the web server is provided with authentication information adding means for adding the received authentication information to the web content in response to the web content browsing request and server authentication request from the client terminal.
Various data formats can be adopted as the data format of the authentication information, such as an electronic certificate and other data formats.
Preferably, the authentication information of the web server that is set for each web server and stored in advance corresponding to the user identification information is the authentication information for each user generated in the client terminal. And then encrypted using the public key of the web server, and then stored by the web server registration registered in the authentication information registration server.

The addition of authentication information is a data file that can be interpreted and displayed by a browser on the user's client terminal by adding data to an HTML file or other web content. For example, it can be displayed as image data such as a server certificate.
In addition, if the authentication information for each user is generated by double encryption using the public key for each web server and the public key for each user, it is decrypted using the secret key for the web server and the user The user's client terminal can be decrypted with the secret key.

Next, the web server includes web content transmitting means for transmitting the web content to which the authentication information is added to the client terminal.
In accordance with the web content browsing request, the web content transmitting unit transmits the web content to which the authentication information is given to the user's client terminal in the same manner as when browsing normal web content.

  According to another preferred embodiment, the authentication information is not added to the HTML file or other web contents, but separately from the socket communication between the client and the server using TCP communication. Thus, the authentication information can be included in the data transmitted from the web server to the client terminal.

Next, the authentication information registration server will be described.
The authentication information registration server is an authentication information registration server that stores authentication information for each web server and operates in cooperation with any web server set to use the system of the present invention. The authentication information registration server is preferably a database server provided for each web server using the system of the present invention.
The authentication information registration server stores at least authentication information for authenticating the web server and user identification information for each user who uses the server authentication system in a client terminal.

Next, the client terminal will be described.
The client terminal is provided with authentication request transmission means for transmitting a server authentication request to the web server together with a web content browsing request.
The authentication request is a request to prove the validity of the server as described above, and a response request for confirming whether or not it is compatible with the Web access point authentication (WAPA) which is the system of the present invention. included.
The authentication request transmission function for transmitting these requests may be added to a normal browser, for example. A browser dedicated to the system of the present invention may be used.

  The client terminal includes server public key storage means for storing a public key for each web server. The server public key storage means is a local database in which the user stores a public key for each web server in the client terminal. When a server registration process is performed by downloading a public key corresponding to a web server that performs server registration from a public key server and registering authentication information for each server in the authentication information registration server, this is a local database. The public key is stored in the server public key storage means.

When the public key of the web server for decrypting the authentication information added to the web content is stored in the client terminal, the authentication information added to the web content received from the web server is stored in the client terminal. Decryption is performed using the secret key of the user who uses the terminal, and the validity of the authentication information is determined.
If it is determined that the authentication information is not valid, a warning such as a warning displayed on the client terminal is output.

  In addition, when the public key of the web server for decrypting the authentication information added to the web content is not stored in the client terminal, the web server includes the server authentication system. In response to this, the user using the client terminal is allowed to select whether or not to register the web server.

The basic processing flow of the present invention will be described below. The processing flow shown here is an example, and the present invention is not limited to this, and various applications and modifications are possible.
Hereinafter, a general transaction executed by the WAPA technique when authenticating a web server according to a situation will be described.
FIG. 6 is a diagram showing a typical example of a server authentication pattern using the system of the present invention.
7 to 24 are flowcharts showing an example of the basic processing flow of the present invention.

First, referring to FIG. 7 and FIG. 8, when a real server having web access point authentication (WAPA), which is the system of the present invention, is accessed from a WAPA-compatible client terminal that has not registered the server. The process will be described.
This is a process in the case where an attempt is made to access a web server that supports web access point authentication (WAPA) that is regarded as an unknown site because the server is not registered in the web access point authentication (WAPA) compatible client. is there.
In a web access point authentication (WAPA) client terminal, it is preferable to give the user an option as to whether or not to register the web server. If the user accepts this, the client terminal performs registration processing of a web server that supports web access point authentication (WAPA), which will be described later. When the server registration process is completed, the web access point authentication (WAPA) compatible client can authenticate the web access point authentication (WAPA) compatible web server in subsequent transactions.

Referring to FIG. 7, the client terminal makes an inquiry to the server public key storage means (local database) to know that the web server is not registered.
An HTTP GET request, which is a browsing request, is transmitted from the client terminal to the web server. This request includes a response request indicating whether or not the web server has a server authentication system.
Since the web server is a server authentication system compatible server, a response message indicating that the web server is compatible with the server authentication system is incorporated into the requested HTML file.
Next, the web server transmits the HTML page to the server terminal corresponding to the server authentication system.
In the client terminal, an option is given to the user as to whether or not to register a web server corresponding to the server authentication system via the browser.
Note that no warning is generated because the server is legitimate.

  FIG. 8 is a flowchart showing an example of performing the above-described processing to transmit / receive data necessary for server authentication by TCP communication using a socket in communication between a client and a server as described above.

Next, referring to FIG. 9 and FIG. 10, processing when accessing a real server having web access point authentication (WAPA), which is the system of the present invention, from a WAPA-compatible client terminal registered with the server Will be described.
This is processing when a web access point authentication (WAPA) compatible client attempts to access a web server that is already registered in the client.
The client initiates the authentication transaction by providing the server with the user ID of the system of the present invention. In the server, appropriate authentication information is extracted based on the user ID and returned to the client terminal. At the client terminal, the authentication information package is decrypted using the user's private key, and it is proved that the authentication information package has been transmitted from a real server.

Referring to FIG. 9, the client terminal searches for an appropriate server authentication system user ID in the local database.
An HTTP GET request, which is a browsing request, is transmitted from the client terminal to the server server corresponding to the server authentication system. This request further includes the server authentication system user ID of the user at the client terminal.
When a browsing request including a server authentication request is received, the web server corresponding to the system of the present invention confirms the server authentication system user ID of the client.
The server queries the authentication information registration server for the user ID of the client user. The authentication information registration server searches for appropriate authentication information based on the user ID of the client. Next, the authentication information registration server transmits the extracted authentication information to the server server corresponding to the server authentication system.
In the web server corresponding to the server authentication system, the authentication information is incorporated into the requested HTML page. The HTML page is transmitted from the web server to the server authentication system compatible client.
Next, in the client terminal, in order to determine the validity of the web server corresponding to the server authentication system, the authentication information is decrypted using the secret key in the client terminal, and the validity of the web server is verified. Prove it. This process is performed by comparing the decrypted information with the local copy and confirming whether there is a match.
When the decrypted information matches, the server authentication system compatible server is authenticated by the client, and related information is displayed on the browser.

  FIG. 10 is a flowchart showing an example of performing the above-described processing for transmitting and receiving data necessary for server authentication by TCP communication using a socket in communication between a client and a server as described above.

Next, referring to FIG. 11 and FIG. 12, a web access point authentication (WAPA) that is not registered with a real server that does not have the web access point authentication (WAPA) that is the system of the present invention. ) Processing when accessed from a compatible client terminal will be described.
This is a process when a web access point authentication (WAPA) -compatible client attempts to access a real web server that does not use web access point authentication (WAPA).
In order to determine whether the web server is compatible with web access point authentication (WAPA) or WAPA, a response request compatible with web access point authentication (WAPA) is sent from a client terminal compatible with web access point authentication (WAPA). Send to web server.
Since the web server does not use web access point authentication (WAPA) and cannot be authenticated, the client terminal does not perform any authentication, and does not generate an alert.

Referring to FIG. 11, the client terminal makes an inquiry to the local database and knows that the web server is not registered.
An HTTP GET request which is a browsing request is transmitted from the client terminal to the web server. This request further includes a server authentication system response request whether or not the web server has a server authentication system.
Since the web server does not have a server authentication system, the server authentication system support request is simply ignored.
The web server returns the requested HTML file without responding to the server authentication system support request.
Since there is no signature package, the web server cannot be authenticated, and since the web server is not registered with the client, no warning is generated.

  FIG. 12 is a flowchart showing an example of performing the above-described processing for transmitting and receiving data necessary for server authentication by TCP communication using a socket in communication between a client and a server as described above.

Next, referring to FIG. 13 and FIG. 14, when a real server that does not have the web access point authentication (WAPA), which is the system of the present invention, is accessed from a WAPA compatible client terminal registered with the server. Processing will be described.
This is a scenario where a web access point authentication (WAPA) enabled client attempts to access a real server that does not have web access point authentication (WAPA).
This can happen for unknown reasons when a real server is disabled for Web Access Point Authentication (WAPA).
Such a case is impersonating because the server cannot return any information related to Web Access Point Authentication (WAPA) to the client even if the server information is registered with the Web Access Point Authentication (WAPA) client. Should be similar to the web server In a Web access point authentication (WAPA) client terminal, it is necessary to display a fraud warning.

Referring to FIG. 13, the client terminal searches for an appropriate server authentication system user ID in the local database based on the website to be visited.
The client transmits an HTTP GET request, which is a browsing request, to the web server. This request further includes the user ID of the client's server authentication system.
Since the web server does not include the server authentication system of the present invention, the user ID of the client server authentication system is simply ignored.
The web server sends the requested HTML page without responding to any server authentication system.
At the client terminal, the registered web server could not send back the appropriate server authentication system authentication information, so the client displays a fraud warning.

  FIG. 14 is a flowchart showing an example of performing the above-described processing for transmitting and receiving data necessary for server authentication by TCP communication using a socket in communication between a client and a server as described above.

Next, referring to FIG. 15 and FIG. 16, the impersonation server having the web access point authentication (WAPA) which is the system of the present invention is compatible with the web access point authentication (WAPA) in which the server is not registered. Processing when accessed from a client terminal will be described.
This is because a web access point authentication (WAPA) compatible client does not register the server, so it is considered an unknown site regardless of its authenticity. This is a processing scenario when an attempt is made to access a server.
A web access point authentication (WAPA) enabled client gives the user the option of registering the web server. If the user accepts this, the client terminal performs registration processing of a web server corresponding to web access point authentication (WAPA). A detailed transaction regarding registration of server information to a Web access point authentication (WAPA) client will be described later. When the registration procedure is completed, the web access point authentication (WAPA) compatible client terminal can authenticate the web access point authentication (WAPA) compatible web server in subsequent transactions.

Referring to FIG. 15, the client terminal makes an inquiry to the local database to know that the web server is not registered.
An HTTP GET request which is a browsing request is transmitted from the client terminal to the web server. This request further includes a server authentication system response request for checking whether or not the web server has the server authentication system of the present invention.
The web server constructs a fake server authentication system acknowledgment message and incorporates it in the requested HTML file. Next, the HTML page is transmitted from the web server to the server authentication system compatible client.
At the client terminal, the user is given the option of registering the web server.
The web server cannot be authenticated. This web server is not registered with the client, so no warning is generated.

  FIG. 16 is a flowchart showing an example of performing the above-described processing to transmit / receive data necessary for server authentication by TCP communication using a socket in communication between a client and a server as described above.

Next, referring to FIG. 17 and FIG. 18, when a camouflaged server having web access point authentication (WAPA), which is the system of the present invention, is accessed from a WAPA-compatible client terminal that is not registered with the server. Processing will be described.
This is a process when a Web access point authentication (WAPA) compatible client attempts to access a camouflaged web server pretending to be a web access point authentication (WAPA) compatible server.
Since the camouflaged web server does not have an appropriate authentication information package for each user, there is a possibility of returning an error to the client terminal or returning a bad authentication package. In any case, a fraud warning is displayed on the client terminal.

Referring to FIG. 17, the client terminal searches for an appropriate server authentication system user ID in the local database.
An HTTP GET request as a browsing request is transmitted from the client terminal to the web server corresponding to the server authentication system. This request further includes the user ID of the client's server authentication system.
The impersonation server compatible with the server authentication system of the present invention confirms the user ID of the client, forms a fake authentication package, and incorporates the fake authentication information in the requested HTML page.
In the camouflaged server corresponding to the server authentication system, the HTML page is transmitted to the server authentication system compatible client.
The client terminal receives the web content and decrypts the authentication information using the client's private key to prove the website's validity in order to determine the validity of the web server compatible with the server authentication system. To do. This is done by comparing the decrypted information with its local copy to see if there is a match.
Since the decrypted information does not match, in the client terminal, the web server is classified as a camouflaged website. The client terminal issues a fraud warning to the user and displays related information on the browser.

  FIG. 18 is a flowchart illustrating an example of performing the above-described processing to transmit and receive data necessary for server authentication by TCP communication using a socket in communication between a client and a server as described above.

Next, referring to FIG. 19 and FIG. 20, for a camouflaged server that does not have the web access point authentication (WAPA), which is the system of the present invention, the web access point authentication (WAPA) in which the server registration is not performed. Processing when accessed from a compatible client terminal will be described.
This is a process when a web access point authentication (WAPA) -compatible client attempts to access a camouflaged web server that does not use web access point authentication (WAPA).
Whether or not the web server supports web access point authentication (WAPA) in order to determine whether or not the web server supports web access point authentication (WAPA). Is sent to the web server.
Since the web server does not support web access point authentication (WAPA), it cannot be authenticated. Therefore, no authentication is performed at the client terminal and no warning is generated.

Referring to FIG. 19, the client terminal makes an inquiry to the local database and knows that the web server is not registered.
Although it is a browsing request from a client terminal, an HTTP GET request is transmitted to the web server. This request further includes a response request corresponding to the server authentication system for checking whether or not the web server is provided with the server authentication system of the present invention.
Since the camouflaged web server does not include the server authentication system of the present invention, a response request corresponding to the server authentication system is simply ignored.
The camouflaged web server does not respond to the server authentication system compatible response request, and returns the requested HTML file.
Since there is no authentication information package, server authentication is not possible. Since the web server is unregistered with the client and the web server does not have a server authentication system, no warning is generated.

  FIG. 20 is a flowchart showing an example of performing the above-described processing for transmitting and receiving data necessary for server authentication by TCP communication using a socket in communication between a client and a server as described above.

Next, referring to FIG. 21 and FIG. 22, for a camouflaged server that does not have the web access point authentication (WAPA), which is the system of the present invention, the server registered web access point authentication (WAPA) compatible client. Processing when accessed from a terminal will be described.
This is processing when a Web access point authentication (WAPA) compatible client attempts to access a camouflaged server that does not have Web access point authentication (WAPA).
This can happen for unknown reasons when a real web server is disabled for Web Access Point Authentication (WAPA).
Such a case is because even if the server information is registered with a Web Access Point Authentication (WAPA) client, the server cannot return any Web Access Point Authentication (WAPA) related information to the client at all. You should do something similar to a camouflaged web server. It is necessary to display a fraud warning at a web access point authentication (WAPA) client terminal.

Referring to FIG. 21, the client terminal searches for an appropriate server authentication system user ID in the local database.
An HTTP GET request which is a browsing request is transmitted from the client terminal to the web server. This request further includes the user ID of the client's server authentication system.
Since the camouflaged web server does not have the server authentication system of the present invention, it simply ignores the user ID of the client.
Since the camouflaged web server does not have the server authentication system of the present invention, it simply sends the requested HTML page.
The registered web server cannot send back the proper authentication information, so the client displays a fraud alert.

  FIG. 22 is a flowchart showing an example of performing the above-described processing for transmitting and receiving data necessary for server authentication by TCP communication using a socket in communication between a client and a server as described above.

Next, referring to FIG. 23, even for a real server equipped with Web access point authentication (WAPA) which is the system of the present invention, registration from a client terminal compatible with Web access point authentication (WAPA) to a browser is performed. The server registration process will be described.
Web access point authentication (WAPA) authentication is performed using a public key encryption algorithm.
In order to execute public key encryption, it is necessary to manage a public key and a secret key between a transmission side and a reception side. As part of this authentication, a web access point authentication (WAPA) enabled browser must maintain a list of public keys for the web access point authentication (WAPA) enabled web server in a local database.
This procedure allows the client to authenticate a specific web access point authentication (WAPA) enabled web server public key by default to a web access point authentication (WAPA) enabled web browser. This can be done safely by downloading from a point authentication (WAPA) public key server.

Referring to FIG. 23, a web server compatible with the server authentication system is registered in the client terminal.
From the client terminal, request the public key server for the public key with the signature of the web server corresponding to the server authentication system.
The public key server searches for an appropriate signed public key of the server server that supports the server authentication system. Next, the public key server transmits the signed public key of the server server that supports the server authentication system to the client terminal.
The client terminal generates authentication information of the user, encrypts this information using the client's public key, and then encrypts this encrypted information using the public key of the server authentication system compatible web server. Encrypt again.
This double-encrypted authentication information is transmitted from the client terminal to the web server corresponding to the server authentication system.
In the web server, the authentication information of the user transmitted from the client terminal is received, transmitted to a database server as a server for authentication, and stored in association with the user ID.

Next, a process for registering a public key from a web server corresponding to web access point authentication (WAPA) will be described with reference to FIG.
Web access point authentication (WAPA) authentication is performed using a public key encryption algorithm.
Dedicated web access point authentication (WAPA) disclosure to securely transmit the public key of the web access point authentication (WAPA) web server to each web access point authentication (WAPA) compatible client terminal in a secure manner Use a key server. It is desirable that the public key stored on the public key server is accompanied by an option that can be signed by a certification authority owner who is a third party in order to ensure the authentication of the public key.

Referring to FIG. 24, the web server generates a combination of a public key and a private key.
Next, the public key is transmitted from the web server to the authentication authority owner system which is a third party.
In the system of the authentication authority owner, which is a third-party organization, the validity of the web server is proved and the public key of the web server is signed. Next, the signed public key is directly transmitted from the authentication authority owner system, which is a third party organization, to the public key server of the system of the present invention.
The public key server receives the public key with the signature and stores it in association with identification information for identifying the web server so that the server authentication system compatible client can use it.
It is desirable that the public key server notifies the owner of the web server that the public key can be used at the client terminal.
With the above processing, the web server is regarded as a server server compatible with the server authentication system, and the user can perform registration processing of the web server using the browser of the client terminal.

  As described above in detail, according to the present invention, it is possible to provide web access point authentication (WAPA), which is a new Internet technology that provides web server certification to end users.

It is a figure which shows a prior art example. It is a figure which shows a prior art example. It is a figure which shows a prior art example. It is a figure which shows a prior art example. It is a system configuration figure showing an example of the basic composition of the system of the present invention. It is a figure which shows a typical example of the pattern of the server authentication using the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention. It is a flowchart which shows an example of the flow of a basic process of the system of this invention.

Claims (12)

A server authentication system provided in a web server for performing web server authentication when accessing any server connected to a network through a browser,
A browsing request receiving means for receiving a web content browsing request and a server authentication request from a client terminal accessing the web server;
In response to the browsing request and the server authentication request from the client terminal, the authentication information of the web server is set in response to the browsing request and the server authentication request from the client terminal. An authentication information query means for querying;
As a result of the inquiry to the authentication information registration server, if there is authentication information of the web server, authentication information receiving means for receiving the authentication information;
In response to a web content browsing request and server authentication request from a client terminal, authentication information adding means for adding received authentication information to the web content;
A web server authentication system comprising: web content transmission means for transmitting the web content to which the authentication information is added to the client terminal. A server authentication system provided in a web server for performing web server authentication when accessing any server connected to the network via a browser, a client terminal accessing the web server, and each web server An authentication information registration server configured to store authentication information for setting and authenticating the web server,
The web server
A browsing request receiving means for receiving a web content browsing request and a server authentication request from a client terminal accessing the web server;
In response to the browsing request and the server authentication request from the client terminal, the authentication information of the web server is set in response to the browsing request and the server authentication request from the client terminal. An authentication information query means for querying;
As a result of the inquiry to the authentication information registration server, if there is authentication information of the web server, authentication information receiving means for receiving the authentication information;
In response to a web content browsing request and server authentication request from a client terminal, authentication information adding means for adding received authentication information to the web content;
Web content transmission means for transmitting the web content to which the authentication information is added to the client terminal;
The authentication information registration server stores at least authentication information for authenticating the web server and user identification information for each user who uses the server authentication system in a client terminal. system. In the client terminal, an authentication request transmitting means for transmitting a server authentication request to the web server together with a web content browsing request;
A web server authentication system comprising server public key storage means for storing a public key for each web server. 4. The server authentication request transmitted from a client terminal and received by the browsing request receiving means in the web server includes user identification information of the server authentication system. The web server authentication system described. The server authentication request transmitted from the client terminal and received by the browsing request reception means in the web server includes a response request as to whether or not the web server includes the server authentication system. The web server authentication system according to any one of claims 1 to 4. The authentication information inquiry means transmits an inquiry request including the user identification information to the authentication information registration server when inquiring the authentication information of the web server. The web server authentication system according to any one of the above. The authentication information inquiring unit is set for each web server, and further inquires the authentication information of the web server stored in advance corresponding to the user identification information based on the user identification information. The web server authentication system according to claim 6. The authentication information of the web server that is set for each web server and is stored in advance corresponding to the user identification information is obtained by using the public key of the user for the authentication information for each user generated in the client terminal. 8. The data stored in the web server registration to be registered in the authentication information registration server after being encrypted and then encrypted using the public key of the web server. Web server authentication system described in 1. When a web server is accessed from a client terminal, the web server responds to a response request included in the server authentication request transmitted from the client terminal whether the web server includes the server authentication system. If the server is equipped with the server authentication system, a response to that effect is sent, and if the web server is not equipped with the server authentication system, a response to that effect is not sent. The web server authentication system according to any one of the above. When the public key of the web server for decrypting the authentication information added to the web content is stored in the client terminal, the authentication information added to the web content received from the web server is stored. The web server authentication system according to any one of claims 1 to 9, wherein the authentication is performed using a secret key of a user who uses the client terminal to determine the validity of the authentication information. The web server authentication system according to claim 10, wherein a warning is displayed on the client terminal when it is determined that the authentication information is not valid. When the public key of the web server for decrypting the authentication information added to the web content is not stored in the client terminal, if the web server includes the server authentication system, that fact The web server authentication system according to claim 10 or 11, wherein the user who uses the client terminal selects whether or not to register the web server.