INFORMATION COMMUNICATION SYSTEM

• US 20180115421A1
• Filed: 02/10/2017
• Published: 04/26/2018
• Est. Priority Date: 10/21/2016
• Status: Active Grant

• Current Assignee: Platfield Inc.
• Original Assignee: Platfield Inc.
• Inventors: Mizuta, Takeshi
• Granted Patent: US 10,454,682 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0863 involving passwords or one-time passwords network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

A first apparatus performs a pairing providing process of displaying a provision string on the first apparatus and transmitting the provision string to a server apparatus, the provision string being of a given number of digits that changes every given amount of time in such a manner that, every given amount of time, the provision string is subjected to carrying and a new character is added to the rightmost digit of the provision string. A second apparatus transmits an acceptance string to the server apparatus, the acceptance string being input from the second apparatus based on the provision string displayed on the first apparatus. The server apparatus compares the provision string with the acceptance string, and determines that pairing is established between the first apparatus and the second apparatus when the provision string and the acceptance string match each other.

Claims

1. An information communication system comprising a plurality of apparatuses connected to an information communication network and a server apparatus connected to the information communication network, wherein

a first apparatus of the plurality of apparatuses comprises a first controller comprising a pairing provision processing unit that performs a pairing providing process of displaying a provision string on a display device of the first apparatus, and transmitting pairing provision information containing the provision string to the server apparatus, the provision string being a character string of a given number of digits that is configured to change every given amount of time in such a manner that, every given amount of time, the character string is subjected to carrying and a new character is added to a rightmost digit of the character string,

a second apparatus of the plurality of apparatuses comprises a second controller comprising a pairing acceptance processing unit that performs a pairing accepting process of displaying an acceptance string on a display device of the second apparatus, and transmitting pairing acceptance information containing the displayed acceptance string to the server apparatus, the acceptance string being a character string that is input from an input device of the second apparatus based on the provision string displayed on the display device of the first apparatus,

the server apparatus comprises a server side controller comprising a pairing determination processing unit that compares the provision string contained in the pairing provision information received from the first apparatus with the acceptance string contained in the pairing acceptance information received from the second apparatus, and determines that pairing is established between the first apparatus and the second apparatus on a condition that the provision string and the acceptance string are determined to match each other, and

the pairing acceptance processing unit of the second apparatus comprises a carry processing unit that performs, in order to follow changing of the provision string in the first apparatus, carrying on an acceptance string corresponding to the provision string before the changing and adding a character to a rightmost digit of the acceptance string, the character being input from the input device of the second apparatus and corresponding to the new character added to the rightmost digit of the provision string, so as to generate an acceptance string corresponding to the provision string after the changing.

2. The information communication system according to claim 1, wherein the carry processing unit of the second apparatus is configured to perform carrying on the acceptance string in synchronization with carrying of the provision string in the first apparatus.

3. The information communication system according to claim 1, wherein the pairing determination processing unit of the server apparatus comprises a re-pairing performing instruction processing unit that, when the first apparatus corresponding to a provision string that matches the acceptance string contained in the pairing acceptance information received from the second apparatus comprises a plurality of first apparatuses, urges the plurality of the first apparatuses to execute the pairing providing process again, and at a same time instructs the second apparatus to perform the pairing accepting process again.

4. The information communication system according to claim 1, wherein

the pairing acceptance processing unit of the second apparatus comprises a confirmation string display processing unit that displays a confirmation string on the display device of the second apparatus on a condition that the pairing determination processing unit of the server apparatus determines that the provision string and the acceptance string match each other,

the pairing provision processing unit of the first apparatus comprises a response string acquisition processing unit that acquires a response string being a character string input from an input device of the first apparatus based on the confirmation string displayed on the display device of the second apparatus, and

the pairing determination processing unit of the server apparatus is configured to determine that pairing is established between the first apparatus and the second apparatus on the condition that the confirmation string displayed on the display device of the second apparatus matches the response string acquired by the first apparatus.

5. The information communication system according to claim 1, wherein the information communication system comprises the second apparatus comprising a plurality of second apparatuses and is configured to establish pairing between the first apparatus and the plurality of second apparatuses.

6. The information communication system according to claim 1, wherein

the information communication system functions as a system that performs the authentication for making a specific service available on a precondition that pairing is established between a service apparatus and an authentication apparatus, with one of the first and the second apparatuses serving as the service apparatus, and another serving as the authentication apparatus, the service apparatus being an apparatus that provides the specific service, the authentication apparatus being an apparatus that performs the authentication at a time of using the specific service,

the authentication apparatus comprises an authentication side controller comprising an authentication side registering unit that generates an authentication side private key being a private key to be used by the authentication apparatus and an authentication side public key being a public key corresponding to the authentication side private key, stores the authentication side private key, and transmits the authentication side public key to the service apparatus,

the service apparatus comprises a service side controller comprising a service side registering unit that, upon receiving the authentication side public key from the authentication apparatus, generates an internal user ID being an identification marker for the authentication apparatus in the specific service, stores the authentication side public key associating the authentication side public key with the internal user ID, and transmits the internal user ID to the authentication apparatus,

the service side controller comprises a service side encrypting unit that, upon receiving information to request authentication with the internal user ID specified, from the authentication apparatus, transmits service side encrypted data to the authentication apparatus, the service side encrypted data being data obtained by encrypting service side original data being any data prepared in the service apparatus, using the authentication side public key that corresponds to the internal user ID and is stored in the service side registering unit,

the authentication side controller comprises an authentication side decrypting unit that transmits service side computed data obtained by performing predetermined computation on service side decrypted data, to the service apparatus, the service side decrypted data being data obtained by decrypting the service side encrypted data received from the service apparatus, using the authentication side private key that is stored in the authentication side registering unit, and

the service side controller comprises an internal user ID genuineness determining unit that determines that the internal user ID is genuine when the service side computed data received from the authentication apparatus matches data obtained by performing the predetermined computation on the service side original data.

7. The information communication system according to claim 6, wherein

the service side registering unit further generates a service side private key being a private key to be used by the service apparatus and a service side public key being a public key corresponding to the service side private key, stores the service side private key, and transmits the service side public key together with a service ID that is an identification marker for the service apparatus in the specific service, to the authentication apparatus,

upon receiving the service side public key from the service apparatus, the authentication side registering unit further stores the service side public key associating the service side public key with the service ID,

the authentication side controller comprises an authentication side encrypting unit that, upon receiving information to request authentication with the service ID specified, from the service apparatus, transmits authentication side encrypted data to the service apparatus, the authentication side encrypted data being data obtained by encrypting authentication side original data being any data prepared in the authentication apparatus, using the service side public key that corresponds to the service ID and is stored in the authentication side registering unit,

the service side controller comprises a service side decrypting unit that transmits authentication side computed data obtained by performing predetermined computation on authentication side decrypted data, to the authentication apparatus, the authentication side decrypted data being data obtained by decrypting the authentication side encrypted data received from the authentication apparatus, using the service side private key that is stored in the service side registering unit, and

the authentication side controller comprises a service ID genuineness determining unit that determines that the service ID is genuine when the authentication side computed data received from the service apparatus matches data obtained by performing the predetermined computation on the authentication side original data.

8. The information communication system according to claim 1, wherein

the information communication system functions as a system that performs the authentication for making a specific service available on a precondition that pairing is established between a service apparatus and an authentication apparatus, with one of the first and the second apparatuses serving as the service apparatus, and another serving as the authentication apparatus, the service apparatus being an apparatus that provides the specific service, the authentication apparatus being an apparatus that performs the authentication at a time of using the specific service,

the service apparatus comprises a service side controller comprising a service side registering unit that generates a service side private key being a private key to be used by the service apparatus and a service side public key being a public key corresponding to the service side private key, stores the service side private key, and transmits the service side public key together with a service ID that is an identification marker for the service apparatus in the specific service, to the authentication apparatus,

the authentication apparatus comprises an authentication side controller comprising an authentication side registering unit that, upon receiving the service side public key from the service apparatus, stores the service side public key associating the service side public key with the service ID,

the authentication side controller comprises an authentication side encrypting unit that, upon receiving information to request authentication with the service ID specified, from the service apparatus, transmits authentication side encrypted data to the service apparatus, the authentication side encrypted data being data obtained by encrypting authentication side original data being any data prepared in the authentication apparatus, using the service side public key that corresponds to the service ID and is stored in the authentication side registering unit,

the service side controller comprises a service side decrypting unit that transmits authentication side computed data obtained by performing predetermined computation on authentication side decrypted data, to the authentication apparatus, the authentication side decrypted data being data obtained by decrypting the authentication side encrypted data received from the authentication apparatus, using the service side private key that is stored in the service side registering unit, and

the authentication side controller comprises a service ID genuineness determining unit that determines that the service ID is genuine when the authentication side computed data received from the service apparatus matches data obtained by performing the predetermined computation on the authentication side original data.

9. The server apparatus used in the information communication system according to claim 1.

10. The first apparatus used in the information communication system according to claim 1.

11. The second apparatus used in the information communication system according to claim 1.

12. The service apparatus used in the information communication system according to claim 6.

13. The authentication apparatus used in the information communication system according to claim 6.

14. A program for causing a computer to function as the server side controller of the server apparatus according to claim 9.

15. A recording medium in which the program according to claim 14 is stored.

17. The information communication system according to claim 2, wherein

the pairing acceptance processing unit of the second apparatus comprises a confirmation string display processing unit that displays a confirmation string on the display device of the second apparatus on a condition that the pairing determination processing unit of the server apparatus determines that the provision string and the acceptance string match each other,

the pairing provision processing unit of the first apparatus comprises a response string acquisition processing unit that acquires a response string being a character string input from an input device of the first apparatus based on the confirmation string displayed on the display device of the second apparatus, and

the pairing determination processing unit of the server apparatus is configured to determine that pairing is established between the first apparatus and the second apparatus on the condition that the confirmation string displayed on the display device of the second apparatus matches the response string acquired by the first apparatus.

18. The information communication system according to claim 2, wherein

the information communication system functions as a system that performs the authentication for making a specific service available on a precondition that pairing is established between a service apparatus and an authentication apparatus, with one of the first and the second apparatuses serving as the service apparatus, and another serving as the authentication apparatus, the service apparatus being an apparatus that provides the specific service, the authentication apparatus being an apparatus that performs the authentication at a time of using the specific service,

the authentication apparatus comprises an authentication side controller comprising an authentication side registering unit that generates an authentication side private key being a private key to be used by the authentication apparatus and an authentication side public key being a public key corresponding to the authentication side private key, stores the authentication side private key, and transmits the authentication side public key to the service apparatus,

the service apparatus comprises a service side controller comprising a service side registering unit that, upon receiving the authentication side public key from the authentication apparatus, generates an internal user ID being an identification marker for the authentication apparatus in the specific service, stores the authentication side public key associating the authentication side public key with the internal user ID, and transmits the internal user ID to the authentication apparatus,

the service side controller comprises a service side encrypting unit that, upon receiving information to request authentication with the internal user ID specified, from the authentication apparatus, transmits service side encrypted data to the authentication apparatus, the service side encrypted data being data obtained by encrypting service side original data being any data prepared in the service apparatus, using the authentication side public key that corresponds to the internal user ID and is stored in the service side registering unit,

the authentication side controller comprises an authentication side decrypting unit that transmits service side computed data obtained by performing predetermined computation on service side decrypted data, to the service apparatus, the service side decrypted data being data obtained by decrypting the service side encrypted data received from the service apparatus, using the authentication side private key that is stored in the authentication side registering unit, and

the service side controller comprises an internal user ID genuineness determining unit that determines that the internal user ID is genuine when the service side computed data received from the authentication apparatus matches data obtained by performing the predetermined computation on the service side original data.

19. The information communication system according to claim 18, wherein

the service side registering unit further generates a service side private key being a private key to be used by the service apparatus and a service side public key being a public key corresponding to the service side private key, stores the service side private key, and transmits the service side public key together with a service ID that is an identification marker for the service apparatus in the specific service, to the authentication apparatus,

upon receiving the service side public key from the service apparatus, the authentication side registering unit further stores the service side public key associating the service side public key with the service ID,

the authentication side controller comprises an authentication side encrypting unit that, upon receiving information to request authentication with the service ID specified, from the service apparatus, transmits authentication side encrypted data to the service apparatus, the authentication side encrypted data being data obtained by encrypting authentication side original data being any data prepared in the authentication apparatus, using the service side public key that corresponds to the service ID and is stored in the authentication side registering unit,

the service side controller comprises a service side decrypting unit that transmits authentication side computed data obtained by performing predetermined computation on authentication side decrypted data, to the authentication apparatus, the authentication side decrypted data being data obtained by decrypting the authentication side encrypted data received from the authentication apparatus, using the service side private key that is stored in the service side registering unit, and

the authentication side controller comprises a service ID genuineness determining unit that determines that the service ID is genuine when the authentication side computed data received from the service apparatus matches data obtained by performing the predetermined computation on the authentication side original data.

20. The information communication system according to claim 2, wherein

the information communication system functions as a system that performs the authentication for making a specific service available on a precondition that pairing is established between a service apparatus and an authentication apparatus, with one of the first and the second apparatuses serving as the service apparatus, and another serving as the authentication apparatus, the service apparatus being an apparatus that provides the specific service, the authentication apparatus being an apparatus that performs the authentication at a time of using the specific service,

the service apparatus comprises a service side controller comprising a service side registering unit that generates a service side private key being a private key to be used by the service apparatus and a service side public key being a public key corresponding to the service side private key, stores the service side private key, and transmits the service side public key together with a service ID that is an identification marker for the service apparatus in the specific service, to the authentication apparatus,

the authentication apparatus comprises an authentication side controller comprising an authentication side registering unit that, upon receiving the service side public key from the service apparatus, stores the service side public key associating the service side public key with the service ID,

the authentication side controller comprises an authentication side encrypting unit that, upon receiving information to request authentication with the service ID specified, from the service apparatus, transmits authentication side encrypted data to the service apparatus, the authentication side encrypted data being data obtained by encrypting authentication side original data being any data prepared in the authentication apparatus, using the service side public key that corresponds to the service ID and is stored in the authentication side registering unit,

the service side controller comprises a service side decrypting unit that transmits authentication side computed data obtained by performing predetermined computation on authentication side decrypted data, to the authentication apparatus, the authentication side decrypted data being data obtained by decrypting the authentication side encrypted data received from the authentication apparatus, using the service side private key that is stored in the service side registering unit, and

the authentication side controller comprises a service ID genuineness determining unit that determines that the service ID is genuine when the authentication side computed data received from the service apparatus matches data obtained by performing the predetermined computation on the authentication side original data.

16. An information communication method that is performed using an information communication system comprising a plurality of apparatuses connected to an information communication network and a server apparatus connected to the information communication network, the information communication method comprising:

a pairing provision processing step, by a first apparatus of the plurality of apparatuses, of performing a pairing providing process of displaying a provision string on a display device of the first apparatus, and transmitting pairing provision information containing the provision string to the server apparatus, the provision string being a character string of a given number of digits that is configured to change every given amount of time in such a manner that, every given amount of time, the character string is subjected to carrying and a new character is added to a rightmost digit of the character string;

a pairing acceptance processing step, by a second apparatus of the plurality of apparatuses, of performing a pairing accepting process of displaying an acceptance string on a display device of the second apparatus, and transmitting pairing acceptance information containing the displayed acceptance string to the server apparatus, the acceptance string being a character string that is input from an input device of the second apparatus based on the provision string displayed on the display device of the first apparatus; and

a pairing determination processing step, by the server apparatus, of comparing the provision string contained in the pairing provision information received from the first apparatus with the acceptance string contained in the pairing acceptance information received from the second apparatus, and of determining that pairing is established between the first apparatus and the second apparatus on a condition that the provision string and the acceptance string are determined to match each other, wherein

the pairing acceptance processing step comprises a carry processing step, by the second apparatus, in order to follow changing of the provision string in the first apparatus, of performing carrying on an acceptance string corresponding to the provision string before the changing, and adding a character to a rightmost digit of the acceptance string, the character being input from the input device of the second apparatus and corresponding to the new character added to the rightmost digit of the provision string, so as to generate an acceptance string corresponding to the provision string after the changing.