Access authentication system, access authentication method, and program storing medium storing programs thereof

• US 20080130899A1
• Filed: 11/02/2007
• Published: 06/05/2008
• Est. Priority Date: 12/04/2006
• Status: Abandoned Application

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Kubota, Akinori, Ikeda, Takashi, Yonehara, Akio, Iwamoto, Eiji
• Application Number:
  US11/982,599
• Publication Number:
  US 20080130899A1
• Time in Patent Office: Days
• US Class Current: 380/278
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

When a decryption-key request is transmitted from a client computer to a management server via a network apparatus, the network apparatus instead of the client computer adds location information to the decryption-key request. When the decryption-key request reaches the management server, location information stored therein is compared with location information associated with the decryption-key request. When the two pieces of the location information are the same, a decryption key is transmitted to the client computer. Thus, only when the management server receives the decryption-key request via the network apparatus which adds the specific location information to the decryption-key request, the management server transmits the decryption key to the client computer. This allows the encrypted data to be accessed within a specific area.

Claims

1. An access authentication system comprising:

a client computer for transmitting a decryption-key request requesting for a decryption key which enables decryption of an encrypted file;

a network apparatus for adding to the decryption-key request first authentication information for authenticating the decryption-key request, and transferring the decryption-key request; and

a management server for authenticating the decryption-key request on the basis of the first authentication information, and transmitting the decryption key to the client computer upon successful authentication of the decryption-key request.

2. The access authentication system of claim 1,

said first authentication information including location information indicating a location of the network apparatus.

3. The access authentication system of claim 1,

said client computer adding second authentication information for authenticating the decryption-key request to the decryption-key request,

said management server authenticating the decryption-key request on the basis of the first authentication information and the second authentication information.

4. The access authentication system of claim 3,

said second authentication information including user information indicating a user of the client computer.

5. The access authentication system of claim 3,

said second authentication information including attribute information indicating an attribute of the encrypted file.

6. The access authentication system of claim 1,

said management server authenticating the decryption-key request on the basis of the first authentication information and a time of receiving the decryption-key request.

7. The access authentication system of claim 1,

said client computer communicating with the network apparatus at a data link layer and transmitting the decryption-key request with a broadcast address as a destination address thereof.

8. An access authentication method executed by an access authentication system including a network apparatus, said access authentication system authenticating a decryption-key request transmitted from a client computer, said decryption-key request requesting for a decryption key which enables decryption of an encrypted file, said access authentication method comprising the steps of:

receiving the decryption-key request;

adding to the decryption-key request first authentication information for authenticating the decryption-key request;

transferring the decryption-key request;

authenticating the decryption-key request on the basis of the first authentication information; and

transmitting the decryption key upon successful authentication of the decryption-key request.

9. The access authentication method of claim 8,

said first authentication information including location information indicating a location of the network apparatus.

10. The access authentication method of claim 8,

said decryption-key request including second authentication information for authenticating the decryption-key request,

the decryption-key request being authenticated, in said authenticating step, on the basis of the first authentication information and the second authentication information.

11. The access authentication method of claim 10,

said second authentication information including user information indicating a user of the client computer.

12. The access authentication method of claim 10,

said second authentication information including attribute information indicating an attribute of the encrypted file.

13. The access authentication method of claim 8,

the decryption-key request being authenticated, in said authenticating step, on the basis of the first authentication information and a time of receiving the decryption-key request.

14. A program storage medium readable by a computer, said program storage medium storing programs of instructions for a first computer and a second computer for executing an access authentication method, said first computer authenticating a decryption-key request transmitted from a client computer, said decryption-key request requesting for a decryption key which enables decryption of an encrypted file, said access authentication method comprising the steps of:

receiving the decryption-key request;

adding to the decryption-key request first authentication information for authenticating the decryption-key request;

transferring the decryption-key request;

authenticating the decryption-key request on the basis of the first authentication information; and

transmitting the decryption key upon successful authentication of the decryption-key request.

15. The program storage medium of claim 14,

said first authentication information including location information indicating a location of the second computer.

16. The program storage medium of claim 14,

said decryption-key request including second authentication information for authenticating the decryption-key request,

the decryption-key request being authenticated, in said authenticating step, on the basis of the first authentication information and the second authentication information.

17. The program storage medium of claim 16,

said second authentication information including user information indicating a user of the client computer.

18. The program storage medium of claim 16,

said second authentication information including attribute information indicating an attribute of the encrypted file.

19. The program storage medium of claim 14,

the decryption-key request being authenticated, in said authenticating step, on the basis of the first authentication information and a time of receiving the decryption-key request.