Nippon Telegraph and Telephone Corporation

Nippon Telegraph & Telephone Co.

Yukio Tsuruoka

Kei Karasawa

Kenji Takahashi

Shingo Orihara

Noriaki Saito

Satoshi Ono

Masahisa Kawashima

Yusuke Hisada

Yoshinao Kikuchi

Nachi Ueno

Tsuyoshi Abe

Katsumi Takahashi

Masayoshi Nakao

Jun Miyake

Shingo Kinoshita

Fumitaka Hoshino

Shintaro Mizuno

Akiko Fujimura

Tomoo Fukazawa

A secret information serveron a networkand a client apparatusconstitute an authentication information generating system. The secret information serverhas a function to confirm the validity of a user in accordance with user identification information received from the client apparatusand a function to hold the secret information database of each user and to send the secret information database of a user whose validity has been confirmed to the client apparatusof the user. The client apparatushas a main memoryhaving a domain A where an application or a main OS is executed and a domain B which has a program execution environment mutually independent of that for the domain A. The secret information database received from the secret information serveris saved in the domain B, and authentication information is generated by using the secret information database. Secret information required to generate the authentication information for user authentication is held securely at low cost.

Authentication information generating system, authentication information generating method, client apparatus, and authentication information generating program for implementing the method

A terminal devicetransmits a certificate issue request including a communication ID thereof and a sub ID to a certificate issuing devicevia a NW(a first network). The certificate issuing deviceinquires of a communication ID (identifier) checking devicewhether or not the communication ID included in the certificate issue request is in use or not and inquires of a communication ID/sub ID checking devicewhether or not the communication ID and the sub ID are associated with each other. If both the check results are OK, the certificate issuing devicegenerates a certificate including the ID of the certificate issuing device, the communication ID, the sub ID and a validity period and transmits the certificate to the terminal device. In this way, a certificate with a short validity period can be issued only based on the access to the NWusing the communication ID and the sub ID.

Certificate authenticating method, certificate issuing device, and authentication device

At the user authentication apparatus, an identifier of a certification authority (CA) certificate that a CA information disclosure serverdiscloses in advance is registered in an identifier list of the CA. At the user terminal, a key pair consisting of a terminal public key and a terminal secret key is generated, the terminal signature is generated for information containing the terminal public key using the CA secret key acquired in advance, and a self-signed certificate of the same form as the certificate issued from CA, that is, a terminal certificate containing at least a terminal public key, a terminal signature, and a CA identifier, is created and stored, and registered in the user authentication apparatus. The terminal certificate having the same issuer information as the CA identifier in the identifier list of the CA notified from the user authentication apparatusat the time of the service request is selected, and user authentication in accordance with a well-known user authentication protocol is executed using the terminal certificate.

User authentication system and method for the same

At user registration, a client device obtains a signature for a user ID, a password, and a public key by using a private key, and sends user information that includes the signature and the above-described information items to a service providing apparatus. The service providing apparatus verifies the signature by using the public key and stores the user information by which the password and the public key are associated with each other. When a request for a service is made, the client device allows authentication processing by sending to the service providing apparatus an authentication response that includes the user ID together with password authentication information, a signature for a challenge sent from the service providing apparatus, or a signature for the password and the challenge, irrespective of whether the authentication method for the service is password authentication, public key authentication, or public-key-and-password combination authentication.

Client device, key device, service providing apparatus, user authentication system, user authentication method, program, and recording medium

A secret key of a second apparatus is stored in a relay apparatus. A first apparatus specifies secret information used to identify a common key, generates encrypted secret information by encrypting the secret information by using a public key of the second apparatus, and transmits the encrypted secret information to the relay apparatus. Then, the relay apparatus decrypts the encrypted secret information by using the secret key of the second apparatus to extract the secret information. The relay apparatus transmits the encrypted secret information to the second apparatus. The second apparatus decrypts the encrypted secret information by using the secret key of the second apparatus to extract the secret information. Finished messages corresponding to communication log information and the secret information are exchanged between the first apparatus and the relay apparatus and between the second apparatus and the relay apparatus.

Common key setting method, relay apparatus, and program

An address allocated to a user by an authentication server is used as an IP address of a packet which is transmitted from a user terminal, preventing an illicit use if the IP address were eavesdropped. An authentication serverperforms an authentication of a user based on a user authentication information which is transmitted from the user terminal, and upon a successful authentication, allocates an address to the user terminal, and issues a ticket containing the address to be returned to the user terminal. The user terminal sets up the address contained in the ticket as a source address, and transmits the ticket to the application server, requesting a session to be established. After verifying that the ticket is authentic, the serverstores the ticket and establishes a session with the user terminal. The user terminal transmits a service request packet containing the source address to the serverutilizing the session. If the source address coincides with the address contained in the stored ticket, the serverprovides a service to the user.

User authentication system for providing online services based on the transmission address

An address notification device is provided with: a link information list storage partfor storing link information list composed of link information including an own address, an address of a communicating party, and process information about processing of communication information to be communicated between the own address and the communicating party address; a change information registration partfor adding the link information selected by a link information select partwith change information representing the content of the change; a link change information sending partfor sending link change information representing a change of the link information to a destination indicated by the communicating party address contained in the link information added with the change information; and a link information change partfor changing the link information on the basis of the change information added thereto in response to response information sent from the communicating party in response to the sending thereto of the link change information.

Address notifying apparatus and address notifying method

A mediating apparatus is provided on an IP network, and stores an access control list (ACL) retained in a VPN gateway unit. The mediating apparatus: receives a retrieval request from a VPN client unit; acquires a private IP address of a communication unit by reference to ACL; searches DNS to acquire therefrom an IP address of the VPN gateway unit; generates a common key that is used for authentication between the VPN client unit and the VPN gateway unit and for encrypted communication therebetween; sends the IP address of the VPN gateway unit, the private IP address of the communication unit, and the common key to the VPN client unit; and sends the IP address of the VPN client unit and the common key to the VPN gateway unit.

Remote access VPN mediation method and mediation device

A recipient identifier and communication condition information stored in a recipient-identifier storing unit are encrypted by an identifier-for-disclosure creating unit of a recipient terminal to create an identifier-for-disclosure. An identifier-for-disclosure notifying unit notifies a sender terminal of the identifier-for-disclosure. When a communication request using the identifier-for-disclosure is sent from the recipient terminal, a restoring unit of a relay system extracts the communication condition information from the identifier-for-disclosure. Only when communication conditions included in the communication condition information are satisfied, communication between the recipient terminal and the sender terminal is established.

Growing community of inventors

Tokyo, Japan

Yukio Tsuruoka