AUTHENTICATION APPARATUS, AUTHENTICATION SYSTEM, AUTHENTICATION METHOD, AND AUTHENTICATION PROGRAM

• US 20110202757A1
• Filed: 02/11/2011
• Published: 08/18/2011
• Est. Priority Date: 02/12/2010
• Status: Active Grant

• Current Assignee: Ricoh Company Limited
• Original Assignee: Ricoh Company Limited
• Inventors: NAKAGAWA, Masaki, Volmat, Alain, Asai, Takahiro
• Granted Patent: US 8,949,593 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

An authentication system receives encrypted terminal identification information and terminal identification information, from a transmission terminal, and determines whether decrypted identification information decrypted using a terminal public key obtained by the authenctaion system matches the terminal identification information received from the transmission terminal.

Claims

1. A transmission system, comprising:

a transmission terminal to log in the transmission system; and

an authentication system to authenticate the transmission terminal before the transmission terminal logs in the transmission system, wherein;

the transmission terminal includes;

a first encryption processor to encrypt terminal identification information of the transmission terminal using a terminal private key assigned to the transmission terminal to generate encrypted terminal identification information; and

a transmit unit to transmit the encrypted terminal identification information and the terminal identification information to the authentication system, and

the authentication system includes;

a receive unit to receive the encrypted terminal identification information and the terminal identification information, from the transmission terminal;

a key extractor to obtain a terminal public key that corresponds to the terminal identification information received from the transmission terminal;

a first decryption processor to decrypt the encrypted identification information using the terminal public key to obtain decrypted identification information; and

a determiner to determine whether the decrypted identification information obtained by the first decryption processor matches the terminal identification information received from the transmission terminal to generate a determination result.

2. The transmission system of claim 1, wherein:

the authentication system further includes;

a storage unit to store a plurality of items of identification information each identifying a specific transmission terminal of the transmission system in association with a plurality of terminal public keys each assigned to the specific transmission terminal of the transmission system, and

the key extractor extracts one of the plurality of items of identification information stored in the storage unit using the terminal identification information received from the transmission terminal to obtain the terminal public key.

3. The transmission system of claim 1, wherein:

the transmission terminal further includes;

a second encryption processor to encrypt information containing the encrypted terminal identification information and the terminal identification information, using a system public key assigned to the authentication system, to generate encrypted information containing the encrypted terminal identification information and the terminal identification information, and

the transmit unit transmits the encrypted information containing the encrypted terminal identification information and the terminal identification information, and

the authentication system further includes;

a second decryption processor to decrypt the encrypted information containing the encrypted terminal identification information and the terminal identification information, using a system private key that is paired with the system public key, to obtain the encrypted terminal identification information and the terminal identification information, and

the determiner determines whether the decrypted identification information obtained by the first decryption processor matches the terminal identification information obtained by the second decryption processor to generate the determination result.

4. The transmission system of claim 1, wherein:

the authentication system further includes;

a transmit unit to transmit login information to the transmission terminal when the determination result indicates that the decrypted identification information matches the terminal identification information received from the transmission terminal, and

the transmission terminal logs in the transmission system using the login information received from the authentication system.

5. The transmission system of claim 4, wherein the authentication system further includes:

a login data extractor to obtain login identification information of the transmission terminal that corresponds to the terminal identification information, wherein the login information includes the login identification information obtained by the login data extractor.

6. An authentication apparatus for authenticating a transmission terminal before the transmission terminal logs in a transmission system, the apparatus comprising:

a receive unit to receive encrypted terminal identification information and terminal identification information from the transmission terminal, wherein the encrypted terminal identification information is encrypted with a terminal private key assigned to the transmission terminal;

a key extractor to obtain a terminal public key that corresponds to the terminal identification information received from the transmission terminal;

a first decryption processor to decrypt the encrypted identification information using the terminal public key to obtain decrypted identification information; and

a determiner to determine whether the decrypted identification information obtained by the first decryption processor matches the terminal identification information received from the transmission terminal to generate a determination result.

7. The authentication apparatus of claim 6, further comprising:

a storage unit to store a plurality of items of identification information each identifying a specific transmission terminal of the transmission system in association with a plurality of terminal public keys each assigned to the specific transmission terminal of the transmission system, and

the key extractor extracts one of the plurality of items of identification information stored in the storage unit using the terminal identification information received from the transmission terminal to obtain the terminal public key.

8. The authentication apparatus of claim 6, further comprising:

a second decryption processor to;

receive encrypted information containing the encrypted terminal identification information and the terminal identification information from the transmission terminal via the receive unit;

decrypt the encrypted information containing the encrypted terminal identification information and the terminal identification information, using a system private key that is paired with the system public key, to obtain the encrypted terminal identification information and the terminal identification information, wherein

the determiner determines whether the decrypted identification information obtained by the first decryption processor matches the terminal identification information obtained by the second decryption processor to generate the determination result.

9. The authentication apparatus of claim 6, further comprising:

a transmit unit to transmit login information to the transmission terminal when the determination result indicates that the decrypted identification information matches the terminal identification information received from the transmission terminal, and

the transmission terminal logs in the transmission system using the login information received from the authentication system.

10. The authentication apparatus of claim 9, further comprising:

a login data extractor to obtain login identification information of the transmission terminal that corresponds to the terminal identification information, wherein the login information includes the login identification information obtained by the login data extractor.

11. A recording medium which stores a plurality of instructions which, when executed, cause a processor to perform a method of authenticating a transmission terminal before the transmission terminal logs in a transmission system, the method comprising:

encrypting terminal identification information of the transmission terminal using a terminal private key assigned to the transmission terminal to generate encrypted terminal identification information;

transmitting the encrypted terminal identification information and the terminal identification information from the transmission terminal to an authentication system;

obtaining, by the authentication system, a terminal public key that corresponds to the terminal identification information transmitted from the transmission terminal;

decrypting, at the authentication system, the encrypted identification information using the terminal public key to obtain decrypted identification information; and

determining whether the decrypted identification information obtained by the authentication system matches the terminal identification information transmitted from the transmission terminal to generate a determination result.

12. The medium of claim 11, wherein the method further comprises:

storing, in a memory, a plurality of items of identification information each identifying a specific transmission terminal of the transmission system in association with a plurality of terminal public keys each assigned to the specific transmission terminal of the transmission system, wherein the obtaining includes;

extracting one of the plurality of items of identification information stored in the memory using the terminal identification information received from the transmission terminal to obtain the terminal public key.

13. The medium of claim 11, wherein the method further comprises:

encrypting information containing the encrypted terminal identification information and the terminal identification information, using a system public key assigned to the authentication system, to generate encrypted information containing the encrypted terminal identification information and the terminal identification information;

transmitting the encrypted information containing the encrypted terminal identification information and the terminal identification information from the transmission terminal to the authentication system; and

decrypting, at the authentication system, the encrypted information containing the encrypted terminal identification information and the terminal identification information, using a system private key that is paired with the system public key, to obtain the encrypted terminal identification information and the terminal identification.

14. The medium of claim 11, wherein the method further comprises:

transmitting login information to the transmission terminal when the determination result indicates that the decrypted identification information matches the terminal identification information received from the transmission terminal; and

causing the transmission terminal to log in the transmission system using the login information received from the authentication system.