TERMINAL AUTHENTICATION SYSTEM, SERVER DEVICE, AND TERMINAL AUTHENTICATION METHOD

• US 20150350196A1
• Filed: 05/14/2015
• Published: 12/03/2015
• Est. Priority Date: 05/27/2014
• Status: Active Grant

• Current Assignee: Panasonic Intellectual Property Management Co., Ltd. (Panasonic Holdings Corporation)
• Original Assignee: Panasonic Intellectual Property Management Co., Ltd. (Panasonic Holdings Corporation)
• Inventors: Toyonaga, Saburo, Tanaka, Hiroyuki, Ike, Kenjiro, Matsuo, Masakatsu
• Granted Patent: US 10,015,159 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint

Abstract

Provided is a terminal authentication system including a client terminal and a server device. The client terminal transmits first information based on secret information different for each client terminal and a client certificate including a hash value of the secret information which is derived from the secret information, to a server device. The server device receives the first information and the client certificate, derives a hash value from the secret information based on the first information using a unidirectional function, and authenticates the client terminal on the basis of the derived hash value and the hash value of the secret information which is included in the client certificate.

Claims

1. A terminal authentication system comprising:

a client terminal; and

a server device,

wherein the client terminal and the server device are connected to each other through a network,

wherein the client terminal includes

a storage unit that stores secret information different for each client terminal and a client certificate including a hash value of the secret information which is derived from the secret information, and

a first communication unit that transmits first information based on the secret information and the client certificate to the server device, and

wherein the server device includes

a second communication unit that receives the first information and the client certificate from the client terminal,

a unidirectional function processing unit that derives a hash value from the secret information based on the first information, using a unidirectional function, and

an authentication processing unit that authenticates the client terminal on the basis of the derived hash value and the hash value of the secret information which is included in the client certificate.

2. The terminal authentication system of claim 1,

wherein the client certificate includes a public key of the client terminal,

wherein the storage unit stores a secret key of the client terminal,

wherein the server device includes

a random number generation unit that generates a first random number sequence,

a second data encryption unit that encrypts a first random number including the first random number sequence, using the public key of the client terminal which is included in the client certificate,

wherein the second communication unit transmits the encrypted first random number to the client terminal,

wherein the first communication unit receives the encrypted first random number from the server device,

wherein the client terminal includes

a first data decryption unit that decrypts the encrypted first random number using the secret key of the client terminal to thereby acquire the first random number, and

a first data encryption unit that encrypts the secret information using the first random number,

wherein the first communication unit transmits the encrypted secret information to the server device,

wherein the second communication unit receives the encrypted secret information from the client terminal, and

wherein the server device includes a second data decryption unit that decrypts the encrypted secret information using the first random number to thereby acquire the secret information.

3. The terminal authentication system of claim 2,

wherein the first data encryption unit encrypts the secret information using a public key of the server device and the first random number,

wherein the first communication unit transmits the encrypted secret information to the server device,

wherein the second communication unit receives the encrypted secret information from the client terminal, and

wherein the second data decryption unit decrypts the encrypted secret information using a secret key of the server device and the first random number to thereby acquire the secret information.

4. The terminal authentication system of claim 1, wherein the secret information includes a second random number sequence.

5. The terminal authentication system of claim 1,

wherein the first communication unit and the second communication unit communicate with each other through a secure communication path, and

wherein the first information includes the secret information.

6. The terminal authentication system of claim 1, wherein the client certificate includes at least one of identification information of the client terminal and authority information.

7. A server device which is connected to a client terminal through a network, the server device comprising:

a communication unit that receives first information based on secret information different for each client terminal and a client certificate including a hash value of the secret information which is derived from the secret information, from the client terminal;

a unidirectional function processing unit that derives a hash value from the secret information based on the first information, using a unidirectional function; and

an authentication processing unit that authenticates the client terminal on the basis of the derived hash value and the hash value of the secret information which is included in the client certificate.

8. A terminal authentication method in a server device which is connected to a client terminal through a network, the terminal authentication method comprising:

a step of receiving first information based on secret information different for each client terminal and a client certificate including a hash value of the secret information which is derived from the secret information, from the client terminal;

a step of deriving a hash value from the secret information based on the first information, using a unidirectional function; and

a step of authenticating the client terminal on the basis of the derived hash value and the hash value of the secret information which is included in the client certificate.