INFORMATION PROCESSING SYSTEM AND INFORMATION PROCESSING METHOD

• US 20150333909A1
• Filed: 04/30/2015
• Published: 11/19/2015
• Est. Priority Date: 05/15/2014
• Status: Abandoned Application

• Current Assignee: Ricoh Company Limited
• Original Assignee: Ricoh Company Limited
• Inventors: OMORI, Tetsuhiko, HORI, Seijiro
• Application Number:
  US14/700,544
• Publication Number:
  US 20150333909A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

An information processing system is provided in which a first information processing apparatus generates a hash value of predetermined information when authentication is successfully performed with respect to information transmitted from a client apparatus, generates encrypted data by encrypting the hash value using a first encryption key, and transmits the encrypted data and the predetermined information to a client apparatus. A second information processing apparatus receives a request including the encrypted data and the predetermined information that is transmitted from the client apparatus, decrypts the encrypted data using a second encryption key that is the same as the first encryption key or forms a pair with the first encryption key, generates a hash value of the predetermined information included in the received request, compares the decryption result with the generated hash value, and executes a process in response to the request according to the comparison result.

Claims

1. An information processing system comprising:

a first information processing apparatus that includes

an authentication unit configured to perform an authentication process with respect to information transmitted from a client apparatus;

a first generating unit configured to generate a hash value of predetermined information in a case where the authentication process by the authentication unit is successful;

an encryption unit configured to generate encrypted data by encrypting the hash value generated by the first generating unit using a first encryption key; and

a response unit configured to transmit the encrypted data and the predetermined information to the client apparatus; and

a second information processing apparatus that includes

a request receiving unit configured to receive a request transmitted from the client apparatus, the request including the encrypted data generated by the encryption unit and the predetermined information;

a decryption unit configured to decrypt the encrypted data included in the request received by the request receiving unit using a second encryption key, the second encryption key being the same as the first encryption key or forming a pair with the first encryption key;

a second generating unit configured to generate a hash value of the predetermined information included in the request received by the request receiving unit; and

a comparison unit configured to compare a decryption result obtained by the decryption unit with the hash value generated by the second generating unit;

wherein the second information processing apparatus executes a process in response to the request according to a comparison result of the comparison unit.

2. The information processing system as claimed in claim 1, wherein

the first information processing apparatus further includes a first key receiving unit configured to receive the first encryption key at a predetermined timing;

the encryption unit generates the encrypted data by encrypting the hash value using the first encryption key that is received most recently by the first key receiving unit;

the second information processing apparatus further includes a second key receiving unit configured to receive the second encryption key at the predetermined timing; and

the decryption unit decrypts the encrypted data included in the request received by the request receiving unit using the second encryption key that is received most recently by the second key receiving unit.

3. The information processing system as claimed in claim 2, wherein

when the decryption unit is unable to decrypt the encrypted data using the second encryption key that is received most recently by the second key receiving unit, the decryption unit decrypts the encrypted data using the second encryption key that is received earlier than the second encryption key received most recently by the second key receiving unit.

4. The information processing system as claimed in claim 2, wherein

when the decryption unit is unable to decrypt the encrypted data using the second encryption key that is received most recently by the second key receiving unit, the decryption unit decrypts the encrypted data using not more than a predetermined number of the second encryption keys that are received earlier than the second encryption key received most recently by the second key receiving unit.

5. The information processing system as claimed in claim 1, wherein

the encryption unit generates the encrypted data by encrypting the hash value generated by the first generating unit and date and time information;

and

the second information processing apparatus executes the process in response to the request according to the date and time information included in the decryption result obtained by the decryption unit.

6. The information processing system as claimed in claim 1, wherein the predetermined information includes information relating to a user authenticated by the authentication unit.

7. An information processing method implemented by a first information processing apparatus and a second information processing apparatus, the information processing method comprising:

an authentication step that is executed by the first information processing apparatus and includes performing an authentication process with respect to information transmitted from a client apparatus;

a first generating step that is executed by the first information processing apparatus and includes generating a hash value of predetermined information in a case where the authentication process performed in the authentication step is successful;

an encryption step that is executed by the first information processing apparatus and includes generating encrypted data by encrypting the hash value generated in the first generating step using a first encryption key;

a response step that is executed by the first information processing apparatus and includes transmitting the encrypted data and the predetermined information to the client apparatus;

a request receiving step that is executed by the second information processing apparatus and includes receiving a request transmitted from the client apparatus, the request including the encrypted data and the predetermined information;

a decryption step that is executed by the second information processing apparatus and includes decrypting the encrypted data included in the request received in the request receiving step using a second encryption key, the second encryption key being the same as the first encryption key or forming a pair with the first encryption key;

a second generating step that is executed by the second information processing apparatus and includes generating a hash value of the predetermined information included in the request received in the request receiving step; and

a comparison step that is executed by the second information processing apparatus and includes comparing a decryption result obtained in the decryption step with the hash value generated in the second generating step;

wherein the second information processing apparatus executes a process in response to the request according to a comparison result of the comparison step.

8. The information processing method as claimed in claim 7, further comprising:

a first key receiving step that is executed by the first information processing apparatus and includes receiving the first encryption key at a predetermined timing; and

a second key receiving step that is executed by the second information processing apparatus and includes receiving the second encryption key at the predetermined timing;

wherein the encryption step includes generating the encrypted data by encrypting the hash value using the first encryption key that is received most recently in the first key receiving step; and

wherein the decryption step includes decrypting the encrypted data included in the request received in the request receiving step using the second encryption key that is received most recently in the second key receiving step.

9. The information processing method as claimed in claim 8, wherein

when the encrypted data cannot be decrypted in the decryption step using the second encryption key that is received most recently in the second key receiving step, the decryption step further includes decrypting the encrypted data using the second encryption key that is received earlier than the second encryption key received most recently in the second key receiving step.

10. The information processing method as claimed in claim 8, wherein

when the encrypted data cannot be decrypted in the decryption step using the second encryption key that is received most recently in the second key receiving step, the decryption step further includes decrypting the encrypted data using not more than a predetermined number of the second encryption keys that are received earlier than the second encryption key received most recently in the second key receiving step.

11. The information processing method as claimed in claim 7, wherein

the encryption step includes generating the encrypted data by encrypting the hash value generated in the first generating step and date and time information;

and

the second information processing apparatus executes the process in response to the request according to the date and time information included in the decryption result obtained in the decryption step.

12. The information processing method as claimed in claim 7, wherein the predetermined information includes information relating to a user authenticated in the authentication step.

13. An information processing apparatus comprising:

an authentication unit configured to perform an authentication process with respect to information transmitted from a client apparatus;

a first generating unit configured to generate a first hash value of first predetermined information in a case where the authentication process by the authentication unit is successful;

an encryption unit configured to generate first encrypted data by encrypting the first hash value generated by the first generating unit using a first encryption key;

a response unit configured to transmit the first encrypted data and the first predetermined information to the client apparatus;

a request receiving unit configured to receive a request transmitted from the client apparatus, the request including second predetermined information and second encrypted data generated by encrypting a second hash value of the second predetermined information;

a decryption unit configured to decrypt the second encrypted data included in the request received by the request receiving unit using a second encryption key;

a second generating unit configured to generate the second hash value of the second predetermined information included in the request received by the request receiving unit;

a comparison unit configured to compare a decryption result obtained by the decryption unit with the second hash value generated by the second generating unit; and

a process executing unit configured to execute a process in response to the request according to a comparison result of the comparison unit.

14. The information processing apparatus as claimed in claim 13, further comprising:

a first key receiving unit configured to receive the first encryption key at a predetermined timing, wherein the encryption unit generates the first encrypted data by encrypting the first hash value using the first encryption key that is received most recently by the first key receiving unit; and

a second key receiving unit configured to receive the second encryption key at a predetermined timing, wherein the decryption unit decrypts the second encrypted data included in the request received by the request receiving unit using the second encryption key that is received most recently by the second key receiving unit.

15. The information processing apparatus as claimed in claim 14, wherein

when the decryption unit is unable to decrypt the second encrypted data using the second encryption key that is received most recently by the second key receiving unit, the decryption unit decrypts the second encrypted data using the second encryption key that is received earlier than the second encryption key received most recently by the second key receiving unit.

16. The information processing apparatus as claimed in claim 14, wherein

when the decryption unit is unable to decrypt the second encrypted data using the second encryption key that is received most recently by the second key receiving unit, the decryption unit decrypts the second encrypted data using not more than a predetermined number of the second encryption keys that are received earlier than the second encryption key received most recently by the second key receiving unit.

17. The information processing apparatus as claimed in claim 13, wherein

the first encrypted data and the second encrypted data are generated by encrypting date and time information;

and

the process executing unit executes the process in response to the request according to the date and time information included in the decryption result obtained by the decryption unit.

18. The information processing apparatus as claimed in claim 13, wherein the first predetermined information and the second predetermined information include information relating to a user authenticated by the authentication unit.