AUTHENTICATION INFORMATION MANAGEMENT OF ASSOCIATED FIRST AND SECOND AUTHENTICATION INFORMATION FOR USER AUTHENTICATION

• US 20140380440A1
• Filed: 09/10/2014
• Published: 12/25/2014
• Est. Priority Date: 04/01/2009
• Status: Abandoned Application

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Nakagawa, Itaru, Sasaki, Kazuo
• Application Number:
  US14/482,486
• Publication Number:
  US 20140380440A1
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

An authentication information management program of an authentication information management apparatus allowing the authentication information management apparatus to execute: changing the first authentication information in correspondence information which is information including the first authentication information and second authentication information in association with each other and stored in a storage section of the authentication information management apparatus; transmitting the authentication apparatus of the changed first authentication information; determining, in response to a request from the apparatus to be authenticated, whether the second authentication information in the authentication request coincides with the second authentication information in the correspondence information; and returning, in the case where it is determined that the second authentication information in the authentication request coincides with the second authentication information in the correspondence information, the first authentication information associated with the second authentication information read from the storage section.

Claims

1. A method for controlling an authentication server which manages a first password for a login process from a client terminal to an application comprising:

managing the first password and authentication information for the login process from the client terminal to the authentication server; and

generating a second password which is different from the first password based on policy information to change the first password.

2. The method for controlling the authentication server according to claim 1, further comprising:

requesting the application to change the first password to the second password; and

changing the first password which is managed in association with the authentication information to the second password.

3. The method for controlling the authentication server according to claim 2, wherein the policy information includes an authentication key generation condition.

4. The method for controlling the authentication server according to claim 3, wherein the authentication key generation condition includes a character type, an occurrence frequency of characters, a password length or dissimilarity among passwords.

5. The method for controlling the authentication server according to claim 2, wherein the policy information includes a change timing.

6. The method for controlling the authentication server according to claim 5, wherein the change timing includes change at every login, change at periodic intervals, change at every authentication, or whether to allow a change to be made in-use.

7. An authentication method for a login process from a client terminal to an application comprising:

receiving authentication information inputted to the client terminal;

managing a first password for the login process to the application in association with the authentication information; and

generating a second password which is different from the first password based on policy information to change the first password.

8. The authentication method according to claim 7, wherein an authentication method of the authentication information inputted to the client terminal is different from an authentication method for a login process to the application.

9. The authentication method according to claim 8, wherein the authentication method of the authentication information inputted to the client terminal is a biometric authentication method.

10. The authentication method according to claim 8, wherein the authentication method of the authentication information inputted to the client terminal is selectable among a plurality of authentication methods which an authentication strength differ from each other.

11. The authentication method according to claim 7, wherein the generated second password is transmitted to a screen for a change of a password of the application.

12. The authentication method according to claim 11, wherein the second password is stored in association with the authentication information after the password of the application is changed to the second password.

13. The authentication method according to claim 7, wherein the policy information includes an authentication key generation condition.

14. The authentication method according to 13, wherein the authentication key generation condition includes a character type, an occurrence frequency of characters, a password length or dissimilarity among passwords.

15. The authentication method according to 13, wherein the authentication key generation condition includes a character type.

16. The authentication method according to 13, wherein the authentication key generation condition includes an occurrence frequency of characters.

17. The authentication method according to 13, wherein the authentication key generation condition includes a password length.

18. The authentication method according to 13, wherein the authentication key generation condition includes dissimilarity among passwords.

19. The authentication method according to 13, wherein the policy information includes a change timing.

20. The authentication method according to 19, wherein the change timing includes change at every login, change at periodic intervals, change at every authentication, or whether to allow a change to be made in-use.

22. The authentication server according to claim 17, wherein the CPU further requests the application to change the first password to the second password and changes the first password which is managed in association with the authentication information to the second password.

21. An authentication server which manages a first password for a login process from a client terminal to an application comprising:

a storage configured to store the first password and authentication information for the login process from the client terminal to the authentication server, the authentication information being associated with the first password; and

a CPU configured to generate a second password which is different from the first password based on policy information to change the first password.