Authentication entity device, verification device and authentication request device

CROSS-REFERENCE TO RELATED APPLICATIONS

0001This is a Continuation Application of PCT Application No. PCT/JP2006/313615, filed Jul. 7, 2006, which was published under PCT Article 21(2) in Japanese.

0002This application is based upon and claims the benefit of priority from prior Japanese Patent Application No. 2005-199189, filed Jul. 7, 2005, the entire contents of which are incorporated herein by reference.

BACKGROUND OF THE INVENTION

00031. Field of the Invention

0004The present invention relates to an authentication device, a verification device and an authentication request device for notifying a verifier of the authentication context assuring the result of execution of the authentication, or for example, an authentication device, a verification device and an authentication request device capable of improving the safety against the repetitive attacks which repeatedly use the past authentication contexts.

00052. Description of the Related Art

0006In communications and services via a network, the authentication of the other party of the communication is an essential technical element. Especially, with the recent extension of an open network environment and the development of the federation technology among distributed service resources, the objects of authentication have come to cover even the device terminals as well as the users.

0007In this situation, authentication means in a variety of layers is implemented. An example is SSL (secure sockets layer)/TLS (transport layer security) in the session layer of the OSI 7 layer model. See, for example, [SSL3.0] A. Frier, P. Karlton, and P. Kocher, “The SSL 3.0 Protocol”, Netscape Communications Corp., Nov. 18, 1996 (Document 1) and [TLS1.0] T. Dierks, C. Allen, “The TLS Protocol Version 1.0”, RFC2246, January 1999, <http://www.jetf.org/rfc/rfc2246.txt> (Document 2). SSL/TLS can provide a secure communication transparent to the upper layer, and therefore, has extended widely as a standard secure communication protocol. In SSL/TLS, the server authentication and the client authentication are supported based on the public key certificate as an authentication mechanism.

0008Also, IPsec is available as a secure communication aimed at IP (Internet Protocol) providing a communication protocol for the network layer of the OSI 7 layer model. See, for example, [IPsec] S. Kent, R. Atkinson, “Security Architecture for the Internet Protocol”, November 1998, <http://www.jetf.org/rfc/rfc2401.txt> (Document 3). IPsec, which is intended for authentication and encryption at the IP packet level and realizes secure communication by host, is used for VPN (Virtual Private Network), etc. IPsec supports the authentication of the other party of communication with a known common key, and dynamic authentication can use the mechanism of IKE or IKEv2 providing a host security association mechanism.

0009As an industrial standard specification stipulating the statement of security on the user authentication, on the other hand, SAML (Security Assertion Markup Language) has been conceived. Refer, for example, to [SAML]OASIS Security Services TC, “Security Assertion Markup Language (SAML) vol. 1”, September 2003”<http://www.oasis-open.org/committees/tc_home.php?wg_ab brev=security> (Document 4). SAML is a mechanism for electronically assuring by expressing the statement relating to the client security or policy decision in XML form.

0010As described above, the authentication means through a network, the application of which has advanced in various layers, constitutes an essential technical element for communications and services as described above.

0011Also, in the case where the object of authentication is an individual person, the technique for confirming the particular individual person as a principal is currently being followed closely. Normally, the requirement for authentication is the strict identification or verifying of the person to be authenticated (hereinafter sometimes referred to as the object person). In the case where the object person is an individual, the identification technique for strictly confirming that the particular individual is the principal (hereinafter referred to as the principal identification) is required.

0012A current promising technique for principal confirmation involves biometrics (biometric verifying/authentication technique). Biometrics is a technique in which a unique physical feature or characteristic of an individual person is verified with the biometric information registered in advance (hereinafter referred to as the biometric template) for the principal identification of an individual. The biometric information used includes fingerprints, iris, retina, face, voice, key stroke and signature.

0013Biometrics, which differs from existing authentication methods such as passwords, uses biometric information that can never be lost or forgotten, and therefore alleviates the burden on the user. Also, the use of biometric information presupposes the difficulty in duplication, and therefore, can constitute an effective measure to prevent a third party user from assuming the identity as the principal.

0014Further, open networks, which typically include the internet, have extended to such an extent that the move to use biometrics has been heightened as a method of authenticating the other party of communication over a network in electronic commercial transactions. Also, the principal confirmation of a legitimate holder of an ID card using biometrics is under study.

0015The use of biometrics on the assumption of the communication through the network poses the problem of security of the matching result and the matching information on the network path. The combination with a secure medium such as a public key infrastructure or IC card, however, has reduced the risk of theft and alteration of the critical information such as the biometric information in the devices on the communication path.

0016A multimodal biometrics system for overall principal identification by combining a plurality of biometrics methods as described above has made possible a highly accurate identification of the principal.

0017Most of the currently available authentication techniques, however, presuppose that the processes comprising authentication are managed in the same management domain, and therefore, a problem is posed that the assurance of each process is not taken into consideration.

0018In biometrics, for example, how the processes comprising authentication (hereinafter sometimes referred to as authentication subprocesses) including the functions of capturing and matching the biometric information are arranged on the devices and equipment is often determined uniquely for each system. Specifically, in the matching-on-card (MOC) model constituting one of the biometrics models, for example, the function to capture the biometric information is realized within a scanner, and the function to match the biometric information and the function to manage the biometric template are realized within a card (smart card, etc.).

0019As described above, the authentication subprocesses often involve a different management entity for a different process. As a result, it is difficult on the part of the authentication result verifier to positively determine whether the authentication subprocesses for each management entity are legitimate or not.

0020The resulting failure to determine the legitimacy of the authentication subprocesses may deteriorate the reliability of the entire authentication process as an integration of the authentication subprocesses. This risk is considered conspicuous, especially for authentication processes on an open network environment that do not always operate within the same management domain.

0021As a technique for solving this problem, an authentication system is known which uses an authentication context typically including a biometric authentication context. See, for example, “Koji Okada, Tatsuro Ikeda, Hidehisa Takamizawa, Toshiaki Saisho, “Extensible Personal Authentication Framework using Biometrics and PKI”, Pre-Proceedings of The 3rd International Workshop for Applied PKI (IWAP2004), pp. 96-107 (Document 5). The authentication context is a technique in which the management entity (entity device) executing each subprocess for principal identification assures the execution result, thereby making it possible to verify the legitimacy of the result of execution of each subprocess on the part of the verifier.

0022Specific execution steps are described below.

0023First, the management entity executing each subprocess holds the confidential information (such as the confidential key for the public key encryption system). For principal identification, each management entity generates an authenticator (such as a digital signature) using the confidential information thus held for the execution result of the subprocess executed by itself, and outputs by shaping the execution result and the authenticator in accordance with a specified format called the authentication context. Then, the management entities exchange the authentication contexts in the order of execution of the principal identification. The last management entity transmits the last output authentication context to the verifier.

0024The verifier can verify the legitimacy of the result of principal identification execution by verifying the legitimacy of the authenticator described in the authentication context (using, for example, the public key corresponding to the digital signature).

BRIEF SUMMARY OF THE INVENTION

0025The authentication system described above in Document 5 normally poses no problem. The detailed study carried out by the present inventor, however, indicates the likelihood of the following four inconveniences, (1) to (4), each considered to have an individual margin of improvement.

0026(1) The first inconvenience is that in the case of “repetitive attacks” in which the past authentication context is used repeatedly, the execution result in the past authentication context may be misinterpreted as the present right execution result.

0027Let us add that “repetitive attacks” means an attack in which the authentication context generated in the past for principal identification is transmitted to the verifier as the authentication context for the present principal identification. In this repetitive attack, the verifier misinterprets the execution result of the principal identification as the right one.

0028In the case where the latter principal identification (matching process, etc.) is conducted with the authentication context output by the scanner in the past in the MOC model, for example, the verifier fails to detect that the biometric information in the authentication context is the one scanned in the past, and erroneously determines it as the correct biometric information.

0029With regard to the first inconvenience, there is considered room to improve the security against repetitive attacks in which the past authentication context is repeatedly used.

0030(2) The second inconvenience is that in the case where a “false replacement” of the biometric information is received, the biometric information after replacement is erroneously used for the matching process.

0031Let us add that during the authentication, there may be some information (confidential information) of which the transmission to the verifier is not desired, to protect privacy. The confidential information is, for example, biometric information such as fingerprints. The situation prevails, on the other hand, in which the principal identification cannot be obtained without exchanging the biometric information among the management entities executing the subprocess.

0032In the technique described in Document 5, therefore, a method has been proposed in which the information (hash value, etc.) related to the biometric information is described in the authentication context, and the biometric information and the authentication context are delivered separately from each other, thereby preventing the biometric information from being included in the authentication context transmitted to the verifier.

0033In the case where the transmission of the biometric information to the verifier is not desired in the MOC model, for example, the scanned biometric information and the authentication context including the information (such as the hash value) related to the particular biometric information are transmitted separately from each other to the card from the scanner. In the process, by wrongly replacing only the transmitted biometric information, the illegal principal identification may succeed. This is due to the fact that the difference between the scanned biometric information and the replacement biometric information cannot be verified, and the illegal biometric information after wrong replacement is used for the card matching process.

0034Document 5 proposes a preventive method in which each management entity verifies the correspondence between the input biometric information and the related information (such as the hash value) in the authentication context. Nevertheless, each management entity is a scanner or a smart card comparatively low in calculation ability. The verification by such a management entity is not effective from the realistic point of view.

0035With the second inconvenience, therefore, the security is considered required to be improved against the attack by wrong replacement of the confidential information such as biometric information.

0036(3) The third inconvenience is that the various execution environments of the requester are grasped by the verifier in the protocol to assure that the security level of the execution entity (requester) of the principal identification meets the security policy of the verifier.

0037Specifically, according to the technique described in Document 5, the verifier transmits the profile list request information to the requester at the time of executing the authentication. The profile is the information defining the execution environments such as the combination of the management entities executing the principal identification, the subprocesses executed by each management entity, the rule on information exchange between the management entities and the security execution rule (including the security level). The profile list is the information including a plurality of the profiles described as a list.

0038The requester, in response to the profile list request information, creates a profile list including all the profiles executable by combination of the management entities held by himself, and transmits it to the verifier. From the profile list thus received, the verifier determines a profile to be executed in accordance with the security policy set by himself. The security policy is the information describing the security level that can be accepted by the verifier. By comparing the security level in the security policy with the security level in the profile, the profile meeting the requirement of the security policy can be assured.

0039The verifier then designates the determined profile for the requester. The requester executes the principal identification in accordance with the profile thus designated.

0040The process described above, in which the various execution environments of the requester are grasped by the verifier from the profile list transmitted by the requester, is not desirable from the viewpoint of the privacy protection of the requester.

0041With regard to the third inconvenience, therefore, a margin of improvement is considered to exist in hiding the various execution environments of the requester from the verifier.

0042(4) The fourth inconvenience is the low communication efficiency of the authentication context.

0043A verification device <b>30</b> may verify the authentication context by accessing the static information (the information identical among the authentication sessions) in the authentication context. The static information includes the information on the maker of the entity device, the accuracy information of the capture device in biometrics authentication, and the information for evaluation of the biometric template.

0044In any case, the static information is accessed by transmitting the authentication context including the same static information to the verification device <b>30</b> at each time of authentication, and therefore, the efficiency is low in terms of communication traffic.

0045With regard to the fourth inconvenience, therefore, a margin of improvement is considered to exist for a higher efficiency of communication of the authentication context.

0046A first object of this invention is to provide an authentication device and a verification device in which the security can be improved against the repetitive attacks in which the past authentication context is repeatedly used.

0047A second object of this invention is to provide an authentication device and a verification device in which the security can be improved against an illegal (false) replacement attack of the confidential information.

0048A third object of this invention is to provide an authentication device, a verification device and an authentication request device in which the various execution environments of the requester can be hidden from the verifier.

0049A fourth object of this invention is to provide an authentication device, a verification device and an authentication request device in which the communication efficiency of the authentication context can be improved.

0050According to a first aspect of the present invention, there is provided an authentication system comprising a plurality of authentication entity devices which individually execute authentication subprocesses making up an authentication process and a verification device which verifies the authentication process executed by the entity devices, wherein the authentication entity devices each include: a challenge information receiving module configured to receive a challenge information generated by the verification device; a confidential information storage module configured to store a confidential information for the verification; an authenticator generating module configured to generate an authenticator for the contents of execution of the authentication subprocesses and the challenge information based on the confidential information; an authentication context generating module configured to generate an authentication context describing the authenticator, the contents of execution and the challenge information in accordance with a specified format; and an authentication context transmitting module configured to transmit the authentication context, and the verification device includes: a verification information storage module configured to store an authenticator verification information corresponding to the confidential information; a challenge generating module configured to generate the challenge information; a challenge storage module configured to store the challenge information; a challenge information transmitting module configured to transmit the challenge information; an authentication context receiving module configured to receive each authentication context generated by the authentication entity devices; a challenge verification module configured to verify whether the challenge information identical to the challenge information in the challenge storage module is described for each of the authentication contexts received; an authenticator verification module configured to verify the authenticator for each authentication context based on the authenticator verification information; and an authentication context verification module configured to verify the legitimacy of each authentication context based on the verification result of each of the verification module.

0051According to the first aspect of the invention, the verification device verifies, for each authentication context received, that the challenge information identical to the challenge information in the challenge storage module is described in the authentication context, thereby making it possible to confirm that each authentication context is the present authentication context. Therefore, repetitive attacks that repeatedly use the past authentication context are prevented, which improves security against repetitive attacks.

0052According to a second aspect of the present invention, there is provided an authentication system comprising a plurality of authentication entity devices which individually execute authentication subprocesses making up an authentication process and a verification device which verifies the authentication processes executed by the entity devices, wherein the authentication entity devices include at least one first-stage authentication entity device and at least one second-stage authentication entity device the first-stage authentication entity device includes: a first-stage hash value generating module configured to generate a first-stage hash value for a confidential execution content which is included in the execution content of the authentication subprocesses and which is input to a second-stage authentication subprocess and hidden from the verification device; a first-stage confidential information storage module configured to store a confidential information for the verification; a first-stage authenticator generating module configured to generate an authenticator for the contents of execution of the authentication subprocess and the first-stage hash value based on the confidential information; a first-stage authentication context generating module configured to generate an authentication context describing, in accordance with a specified format, the authenticator, the execution content other than for the first-stage hash value and the first-stage hash value; and a first-stage transmitting module configured to transmit the authentication context and the confidential execution content, the second-stage authentication entity device includes: a confidential execution content receiving module configured to receive the confidential execution content transmitted; a second-stage hash value generating module configured to generate a second-stage hash value for the confidential execution content received; a second-stage confidential information storage module configured to store the confidential information for the verification; a second-stage authenticator generating module configured to generate an authenticator for the execution content of the authentication subprocess and the second-stage hash value based on the confidential information; a second-stage authentication context generating module configured to generate an authentication context describing the authenticator, the execution content and the second-stage hash value in accordance with a specified format; and a second-stage transmitting module configured to transmit the authentication context, and the verification device includes: a verification information storage module configured to store an authenticator verification information corresponding to the confidential information; an authentication context receiving module configured to receive the authentication contexts generated by the authentication entity devices; a hash value comparative verification module configured to verify by comparison that the first-stage hash value and the second-stage hash value contained in the authentication context received are identical to each other; an authenticator verification module configured to verify the authenticator for each of the authentication contexts based on the authenticator verification information; and an authentication context verification module configured to verify the legitimacy of the authentication contexts based on the verification result by the verification module.

0053According to the second aspect, the verification device verifies that the hash values included in the authentication contexts are identical to each other, thereby making it possible to confirm that the contents of the confidential execution of the first-stage authentication subprocess is identical to the contents of the confidential execution of the second-stage authentication subprocess. Therefore, the security is improved against illegal replacement attacks of the confidential information.

0054According to a third aspect of the present invention, there is provided an authentication system according to the first or second aspect, comprising an authentication request device which relays the communication between the verification device and the authentication entity devices, wherein the verification device includes: a profile list generating module configured to generate the profile list specifying an execution environment acceptable for execution of the authentication subprocesses; and a list transmitting module configured to transmit the profile list to the authentication request device, the authentication request device includes: a profile list receiving module configured to receive the profile list; a function list receiving module configured to receive, for each authentication entity device, a function list specifying the functions of executing the authentication subprocesses; a profile determining module configured to determine an execution profile in such a manner as to meet the requirements of both the profile list and the function list; and an execution profile transmitting module configured to transmit the execution profile to the authentication entity devices, and the authentication entity devices each include: an execution profile receiving module configured to receive the execution profile from the authentication request device; and an authentication subprocess execution module configured to execute the authentication subprocesses based on the execution profile.

0055According to the third aspect, in addition to the operation of the first or second aspect, the authentication request device determines an execution profile indicating the execution environment of each authentication entity device in such a manner as to meet the requirements of both the profile list indicating the execution environment acceptable by the verification device and the function list of each authentication entity device. Thus, the various execution environments of each entity device not related to the execution of authentication can be hidden from the verification device, and therefore, the privacy of the requester in each authentication entity device can be protected.

0056According to a fourth aspect of the present invention, there is provided an authentication system according to any one of the first to third aspects, wherein the authentication entity devices each include link destination information storage module configured to storing link destination information which is smaller in data amount than static information having the same content for each authentication session and which is adapted to acquire the static information, the authentication context generating module generates the authentication context in such a manner as to include the link destination information in place of the static information, and the verification device includes: a module configured to acquire the static information based on the link destination information in the authentication content received; and a verification module configured to verify the authentication process based on the static information and the execution content in the authentication context.

0057According to the fourth aspect, in addition to the operation of the first to third aspects, each entity device generates an authentication context in such a manner as to include the link destination information for acquiring the static information smaller in data amount than the static information indicating the same contents for each authentication. Thus, the size of the authentication context is reduced, and therefore, the communication traffic between the authentication request device and the verification device can be reduced, which improves the communication efficiency of the authentication context.

0058Although each aspect described above is expressed as a “system” including the devices, the invention is not limited to such a configuration, and the expression “apparatus”, “program”, “computer readable storage medium” or “method” may be used to include each device or for each device.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING

0059<figref idref="DRAWINGS">FIG. 1</figref> is a schematic diagram showing a configuration of an authentication system according to a first embodiment of the invention.

0060<figref idref="DRAWINGS">FIG. 2</figref> is a flowchart for explaining an authentication process according to the same embodiment.

0061<figref idref="DRAWINGS">FIG. 3</figref> is a schematic diagram showing a configuration of each entity device according to the same embodiment.

0062<figref idref="DRAWINGS">FIG. 4A</figref> is a schematic diagram showing a configuration of an authentication context according to the same embodiment.

0063<figref idref="DRAWINGS">FIG. 4B</figref> is a schematic diagram showing a configuration of the authentication context according to the same embodiment.

0064<figref idref="DRAWINGS">FIG. 5</figref> is a schematic diagram showing a configuration of a verification device according to the same embodiment.

0065<figref idref="DRAWINGS">FIG. 6</figref> is a flowchart for explaining the operation according to the same embodiment.

0066<figref idref="DRAWINGS">FIG. 7</figref> is a schematic diagram showing a configuration of an authentication system according to a second embodiment of the invention.

0067<figref idref="DRAWINGS">FIG. 8</figref> is a schematic diagram showing a configuration of each entity device according to the same embodiment.

0068<figref idref="DRAWINGS">FIG. 9</figref> is a schematic diagram showing a configuration of a verification device according to the same embodiment.

0069<figref idref="DRAWINGS">FIG. 10</figref> is a schematic diagram showing a configuration of an authentication system according to a third embodiment of the invention.

0070<figref idref="DRAWINGS">FIG. 11</figref> is a schematic diagram showing a configuration of an authentication request device according to the same embodiment.

0071<figref idref="DRAWINGS">FIG. 12</figref> is a schematic diagram for explaining a profile list according to the same embodiment.

0072<figref idref="DRAWINGS">FIG. 13</figref> is a schematic diagram for explaining an execution profile according to the same embodiment.

0073<figref idref="DRAWINGS">FIG. 14</figref> is a schematic diagram showing a configuration of each entity device according to the same embodiment.

0074<figref idref="DRAWINGS">FIG. 15</figref> is a sequence diagram for explaining the operation according to the same embodiment.

0075<figref idref="DRAWINGS">FIG. 16</figref> is a schematic diagram showing a configuration according to a modification of the same embodiment.

0076<figref idref="DRAWINGS">FIG. 17</figref> is a schematic diagram showing a configuration of an authentication system according to a fourth embodiment of the invention.

0077<figref idref="DRAWINGS">FIG. 18</figref> is a schematic diagram showing an example of a template certificate according to the same embodiment.

0078<figref idref="DRAWINGS">FIG. 19</figref> is a schematic diagram showing a configuration of each entity device according to the same embodiment.

0079<figref idref="DRAWINGS">FIG. 20A</figref> is a schematic diagram showing a configuration of an authentication context according to the same embodiment.

0080<figref idref="DRAWINGS">FIG. 20B</figref> is a schematic diagram showing a configuration of the authentication context according to the same embodiment.

0081<figref idref="DRAWINGS">FIG. 21</figref> is a schematic diagram showing a configuration according to a modification of the same embodiment.

0082<figref idref="DRAWINGS">FIG. 22</figref> is a schematic diagram showing a configuration according to a modification of the same embodiment.

DETAILED DESCRIPTION OF THE INVENTION

0083Each embodiment of the invention is explained in detail below with reference to the drawings.

First Embodiment

0084<figref idref="DRAWINGS">FIG. 1</figref> is a schematic diagram showing the configuration of an authentication system according to a first embodiment of the invention. This authentication system, as shown in <figref idref="DRAWINGS">FIG. 2</figref>, is configured of two processes; an authentication subprocess P<b>1</b> and an authentication subprocess P<b>2</b>. The authentication result is obtained based on the result of execution of the subprocesses P<b>1</b>, P<b>2</b>, which are executed by different entity devices <b>10</b>, <b>20</b>, respectively. Specifically, the authentication subprocess P<b>1</b> is executed by the first entity device <b>10</b>, and the authentication subprocess P<b>2</b> by the second entity device <b>20</b>.

0085The authentication subprocesses P<b>1</b>, P<b>2</b> each constitute a component element of the authentication process, or specifically, one of the processes into which the whole authentication process is separated. In other words, assuming that the authentication process is the whole process, the authentication subprocesses P<b>1</b>, P<b>2</b> each represent a sub-process of the whole process.

0086The authentication process may be separated into three or more instead of two authentication subprocesses, each of which may be executed by a different entity device. Also, the authentication subprocess in the second stage may or may not be executed with reference to the result of the authentication subprocess in the first stage.

0087The authentication system shown in <figref idref="DRAWINGS">FIG. 1</figref> includes a verification device <b>30</b>, the first entity device <b>10</b> and the second entity device <b>20</b>. The verification device <b>30</b> includes a communication unit <b>31</b> communicable with the first entity device <b>10</b>, and an authentication context verification unit <b>32</b> for verifying the authentication contexts generated by the first and second entity devices <b>10</b>, <b>20</b>.

0088The entity devices <b>10</b>, <b>20</b>, as shown in <figref idref="DRAWINGS">FIG. 3</figref>, include communication units <b>11</b>, <b>21</b>, an authentication subprocess P<b>1</b> execution unit <b>12</b>, an authentication subprocess P<b>2</b> execution unit <b>22</b>, confidential information management units <b>13</b>, <b>23</b>, authenticator generating units <b>14</b>, <b>24</b> and authentication context generating units <b>15</b>, <b>25</b>, respectively. The elements designated by the reference numerals on the order of ten are associated with the first entity device <b>10</b>, and those on the order of twenty with the second entity device <b>20</b>.

0089The communication units <b>11</b>, <b>21</b> are for establishing communication between external devices such as the verification device <b>30</b> and the other entity devices <b>20</b>, <b>10</b> on the one hand and the local devices <b>10</b>, <b>20</b> on the other hand.

0090The communication unit <b>11</b>, for example, has the function of receiving an authentication execution request and the challenge information from the verification device <b>30</b>, the function of generating an authentication subprocess P<b>2</b> execution request based on the received authentication execution request, the function of transmitting the authentication subprocess P<b>2</b> execution request and the challenge information to the second entity device <b>20</b>, the function of receiving the second authentication context from the second entity device, the function of sending out the aforementioned authentication execution request to the authentication subprocess P<b>1</b> execution unit <b>12</b>, the function of sending out the aforementioned challenge information to the authentication context generating unit <b>15</b> and the function of transmitting the first authentication context obtained from the authentication context generating unit <b>15</b> to the verification device <b>30</b> together with the aforementioned second authentication context.

0091The communication unit <b>21</b>, on the other hand, has the function of receiving the authentication subprocess P<b>2</b> execution request and the challenge information from the first authentication entity device <b>10</b>, the function of sending out the received authentication subprocess P<b>2</b> execution request to the authentication subprocess P<b>2</b> execution unit <b>22</b>, the function of sending out the received challenge information to the authentication context generating unit <b>25</b>, and the function of transmitting the second authentication context obtained from the authentication context generating unit <b>25</b> to the first authentication entity device <b>10</b>.

0092The authentication subprocess P<b>1</b> execution unit <b>12</b> executes the aforementioned authentication subprocess P<b>1</b> based on the authentication execution request received from the communication unit <b>11</b> and outputs the result of execution to the authentication context generating unit <b>15</b>.

0093The authentication subprocess P<b>2</b> execution unit <b>22</b> executes the aforementioned authentication subprocess P<b>2</b> based on the authentication execution request received from the communication unit <b>21</b> and outputs the result of execution to the authentication context generating unit <b>25</b>.

0094The confidential information management unit <b>13</b> is a storage device with the confidential information <b>1</b> for generating an authenticator stored therein in advance, and which is readable from the authenticator generating unit <b>14</b>.

0095The confidential information management unit <b>23</b> is a storage device with the confidential information <b>2</b> for generating an authenticator stored therein in advance, and which is readable from the authenticator generating unit <b>24</b>.

0096The authenticator generating units <b>14</b>, <b>24</b> generate an authenticator using the confidential information <b>1</b>, <b>2</b> read from the confidential information management units <b>13</b>, <b>23</b> in respect of the data (execution result, challenge information, etc.) input from the authentication context generating units <b>15</b>, <b>25</b>, and send out the obtained authenticator to the authentication context generating units <b>15</b>, <b>25</b>.

0097The authenticator is defined as, for example, a digital signature or a message authentication code (MAC). The confidential information <b>1</b>, <b>2</b> is the key information for generating the authenticator (to verify the authentication context), which is a private key for the public key encryption system in the case where the authenticator is the digital signature and a common key shared with the verification device <b>30</b> in advance in the case where the authenticator is the message authentication code.

0098The authentication context generating units <b>15</b>, <b>25</b> describe and shape, in accordance with a specified format, the execution result of the authentication subprocess P<b>1</b>, P<b>2</b> execution units <b>12</b>, <b>22</b>, the authenticators sent out from the authenticator generating units <b>14</b>, <b>24</b> and the challenge information sent out from the communication units <b>11</b>, <b>21</b>, and send out the obtained authentication contexts to the communication units <b>11</b>, <b>21</b>.

0099As shown in <figref idref="DRAWINGS">FIG. 4A</figref>, the format of the first authentication context Ac<b>1</b> is configured of a header block h<b>1</b>, a data block d<b>1</b> and an authenticator block a<b>1</b>. The first authentication context Ac<b>1</b> is the information including the header block h<b>1</b>, the data block d<b>1</b> and the authenticator block a<b>1</b>. Specifically, the first authentication context Ac<b>1</b> is the information including the context information having the header block h<b>1</b> and the data block d<b>1</b> and the authenticator block a<b>1</b> generated for the particular context information.

0100The header block h<b>1</b> has described therein the requester or the like information specifying the authentication context Ac<b>1</b> thereof and the challenge information or the like indicating the legitimacy of the authentication context. The challenge information is the variable information issued for each authentication execution request to prevent “the repetitive attack”, and can use a random number or a temporary variable such as time information or a serial number determined between the verification device and each entity device.

0101The data block d<b>1</b> has described therein the entity information. The entity information includes, but is not limited to, the dynamic information (information generated for each authentication session) such as the execution result of the authentication subprocess P<b>1</b> and can use the static information (the same information for all authentication sessions) such as the execution environment. The information usable as static information includes the information on the maker of the entity device, the accuracy information on the capture device in biometrics authentication and the evaluation information of the biometric template.

0102The authenticator block a<b>1</b> has described therein the authenticator generated based on the confidential information <b>1</b> for the header block h<b>1</b> and the data block d<b>1</b>.

0103The format of the second authentication context Ac<b>2</b> is similar to the format of the first authentication context Ac<b>1</b> as shown in <figref idref="DRAWINGS">FIG. 4B</figref>.

0104Similarly, therefore, the second authentication context A<b>2</b> is the information including the header block h<b>2</b>, the data block d<b>2</b> and the authenticator block a<b>2</b>. Specifically, the second authentication context Ac<b>2</b> is the information including the context information having the header block h<b>2</b> and the data block d<b>2</b> and the authenticator block a<b>2</b> generated for the particular context information. Let us add on the generation of the authenticator. The authenticator block a<b>2</b> has described therein the authenticator generated based on the confidential information <b>2</b> for the header block h<b>2</b> and the data block d<b>2</b>.

0105The verification device <b>30</b>, on the other hand, includes the communication unit <b>31</b> and the authentication context verification unit <b>32</b> as shown in <figref idref="DRAWINGS">FIG. 5</figref>.

0106The communication unit <b>31</b> has the function of transmitting the authentication execution request and the challenge information in the challenge holding unit <b>34</b> to the first entity device <b>10</b>, the function of receiving the first and second authentication contexts from the first entity device <b>10</b> and the function of sending out the received first and second authentication contexts to the authentication context verification unit <b>32</b>.

0107The authentication context verification unit <b>32</b> includes a challenge generating unit <b>33</b>, a challenge holding unit <b>34</b>, a challenge verification unit <b>35</b>, a context verification unit <b>36</b>, a confidential information management unit <b>37</b> and an authenticator verification unit <b>38</b>.

0108The challenge generating unit <b>33</b> has the function of generating the challenge information including the variable information such as a random number and holding the obtained challenge information in the challenge holding unit <b>34</b>.

0109The challenge holding unit <b>34</b> is a memory for storing the challenge information, which is writable from the challenge generating unit <b>33</b> and readable from the communication unit <b>31</b> and the challenge verification unit <b>35</b>, for example.

0110The challenge verification unit <b>35</b> has the function of verifying whether the same challenge information as the one in the challenge holding unit <b>34</b> is described or not for each authentication context received from the context verification unit <b>36</b> and the function of returning the obtained challenge information verification result to the context verification unit <b>36</b>.

0111The context verification unit <b>36</b> has the function of sending out each authentication context, if received from the communication unit <b>31</b>, to the authenticator verification unit <b>38</b>, the function of receiving the authenticator verification result from the authenticator verification unit <b>38</b>, the function of sending out each authentication context to the challenge verification unit <b>35</b>, the function of receiving the challenge verification result from the challenge verification unit <b>35</b>, the function of verifying the legitimacy of each authentication context based on the authenticator verification result and the challenge verification result, and the function of confirming the contents (execution environment, the execution result, etc.) of the authentication subprocesses P<b>1</b>, P<b>2</b> based on the information of the data block in each authentication context.

0112The confidential information management unit <b>37</b> is a memory for storing the authenticator verification information corresponding to the confidential information <b>1</b>, <b>2</b> and readable from the authenticator verification unit <b>38</b>. The authenticator verification information, which is defined as the key information for verifying the authenticator (generated by the confidential information <b>1</b>, <b>2</b>), is a public key for the public key encryption system in the case where the authenticator is a digital signature or a common key shared with the entity devices <b>10</b>, <b>20</b> in advance in the case where the authenticator is a message authentication code. The authenticator verification information, which is for verification of the authenticator generated by the confidential information <b>1</b>, <b>2</b>, constitutes the key information corresponding to the confidential information <b>1</b>, <b>2</b>. The word “corresponding” means the correspondence, for example, in the sense that the authenticator verification information is a decryption key in the case where the confidential information <b>1</b>, <b>2</b> is an encryption key. the confidential information <b>1</b>, <b>2</b> and the authenticator verification information, if corresponding to each other, therefore, may have different contents (private key versus public key) or the same contents (both common keys).

0113The authenticator verification unit <b>38</b> has the function of verifying the authenticator for each authentication context received from the context verification unit <b>36</b> based on the authenticator verification information in the confidential information management unit <b>37</b>, and sending out the result of the authenticator verification to the context verification unit <b>36</b>.

0114Next, the operation of the authentication system configured as described above is explained with reference to the flowchart of <figref idref="DRAWINGS">FIG. 6</figref>.

0115At the time of starting the execution of the authentication process, the challenge generating unit <b>33</b> of the verification device <b>30</b> generates the challenge information, which is temporarily held in the challenge holding unit <b>34</b>. Incidentally, this challenge information is used later for verifying the correspondence between the authentication execution request and the authentication context.

0116After that, the verification device <b>30</b>, through the communication unit <b>31</b>, transmits the authentication execution request and the challenge information to the first entity device <b>10</b> (ST<b>1</b>). The authentication execution request includes the designation of the authentication process to be executed.

0117The first entity device <b>10</b>, upon receipt of the authentication execution request and the challenge information (ST<b>2</b>), follows the authentication process predetermined or designated in the authentication execution request. Specifically, the first entity device <b>10</b> transmits the authentication subprocess P<b>2</b> execution request and the challenge information to the second entity device <b>20</b> (ST<b>3</b>). This execution request may include the designation of the authentication process contained in the authentication execution request from the verification device <b>30</b> and the information required for execution of the authentication subprocess P<b>2</b> (not shown) and held only by the first entity device <b>10</b>.

0118The second entity device <b>20</b>, upon receipt of the authentication subprocess P<b>2</b> execution request and the challenge information from the first entity device <b>10</b> (ST<b>4</b>), follows the authentication process predetermined or designated by the authentication execution request from the verification device <b>30</b>. Specifically, the second entity device <b>20</b> executes the authentication subprocess P<b>2</b> through the authentication subprocess P<b>2</b> execution unit <b>12</b> (ST<b>5</b>) and obtains the execution result.

0119Next, the authentication context generating unit <b>25</b>, supplied with the challenge information and the result of execution of the authentication subprocess P<b>2</b> input thereto, generates the second authentication context Ac<b>2</b> in the format shown in <figref idref="DRAWINGS">FIG. 4B</figref> (ST<b>6</b> to ST<b>9</b>).

0120Specifically, the authentication context generating unit <b>25</b> describes the header block h<b>2</b> containing the requester and the challenge information and the data block d<b>2</b> containing the execution result and the entity information, and thus generates the context information including the blocks h<b>2</b>, d<b>2</b> (ST<b>6</b>). Incidentally, the challenge information is received in step ST<b>4</b>.

0121Next, the authenticator generating unit <b>24</b> reads the confidential information <b>2</b> for authenticator generation from the confidential information management unit <b>23</b> (ST<b>7</b>), and generates the authenticator using the confidential information <b>2</b> for the header block h<b>2</b> and the data block d<b>2</b> described above (ST<b>8</b>). Finally, the authenticator generated is described in the authenticator block a<b>2</b> thereby to generate the second authentication context Ac<b>2</b> including the blocks h<b>2</b>, d<b>2</b>, a<b>2</b> (ST<b>9</b>).

0122The second entity device <b>20</b> transmits this second authentication context Ac<b>2</b> to the first entity device <b>10</b> through the communication unit <b>21</b> (ST<b>10</b>).

0123The first entity device <b>10</b>, upon receipt of the second authentication context Ac<b>2</b> (ST<b>1</b>), executes the authentication subprocess P<b>1</b> through the authentication subprocess P<b>1</b> execution unit <b>12</b> (ST<b>12</b>) thereby to obtain the execution result.

0124Next, the authentication context generating unit <b>15</b>, supplied with the execution result of the authentication subprocess P<b>1</b> and the challenge information input thereto, generates the first authentication context Ac<b>1</b> in the format shown in <figref idref="DRAWINGS">FIG. 4A</figref> (ST<b>13</b> to ST<b>16</b>).

0125Specifically, the authentication context generating unit <b>15</b> describes the header block h<b>1</b> containing the requester and the challenge information and the data block d<b>1</b> containing the entity information such as the execution result and generates the context information including the blocks h<b>1</b> and d<b>1</b> (ST<b>3</b>). Incidentally, the challenge information is received in step ST<b>2</b>.

0126Next, the authenticator generating unit <b>14</b> reads the confidential information <b>1</b> from the confidential information management unit <b>13</b> for generating the authenticator (ST<b>14</b>). Then, the authenticator is generated using the confidential information <b>1</b> for the header block h<b>1</b> and the data block d<b>1</b> described above (ST<b>15</b>). Finally, the authenticator thus generated is described in the authenticator block a<b>1</b> to thereby generate the first authentication context Ac<b>1</b> including the blocks h<b>1</b>, d<b>1</b>, a<b>1</b> (ST<b>16</b>).

0127The second entity device <b>20</b> transmits the first authentication context Ac<b>1</b> and the second authentication context Ac<b>2</b> to the verification device <b>30</b> through the communication unit <b>11</b> (ST<b>17</b>).

0128The verification device <b>30</b> receives the first and second authentication contexts Ac<b>1</b>, Ac<b>2</b> (ST<b>18</b>). In the authentication context verification unit <b>32</b>, the context verification unit <b>36</b> sends out the first and second authentication contexts to the authenticator verification unit <b>38</b>. The authenticator verification unit <b>38</b>, in order to confirm the completeness of the first and second authentication contexts Ac<b>1</b>, Ac<b>2</b>, verifies the authenticators in the authentication contexts Ac<b>1</b>, Ac<b>2</b> based on the authenticator verification information in the confidential information management unit <b>37</b> (ST<b>19</b>), and sends out each authenticator verification result to the context verification unit <b>36</b>.

0129Also, the context verification unit <b>36</b>, in order to confirm that the first and second authentication contexts Ac<b>1</b>, Ac<b>2</b> correspond to the authentication request, sends out the authentication contexts Ac<b>1</b>, Ac<b>2</b> to the challenge information verification unit <b>35</b>. Incidentally, only the header blocks h<b>1</b>, h<b>2</b> including the challenge information may be sent out to the challenge information verification unit <b>35</b>.

0130The challenge information verification unit <b>35</b>, based on the challenge information in the challenge holding unit <b>34</b>, verifies the challenge information of the authentication contexts Ac<b>1</b>, Ac<b>2</b> (ST<b>20</b>), and returns the challenge information verification result to the context verification unit <b>36</b>.

0131Further, the context verification unit <b>36</b> verifies the context information of the authentication contexts Ac<b>1</b>, Ac<b>2</b> (ST<b>21</b>). Specifically, the context verification unit <b>36</b> verifies the result of execution of the authentication subprocesses P<b>1</b>, P<b>2</b> included in the data blocks d<b>1</b>, d<b>2</b> in the context information.

0132In the case where at least one of the verification results (the authenticator verification result, the challenge information verification result and the context information verification result) of steps ST<b>19</b> to ST<b>21</b> is abnormal, the context verification unit <b>36</b> determines that the authentication contexts Ac<b>1</b>, Ac<b>2</b> are illegitimate and ends the process (ST<b>22</b>).

0133Also, in the case where all the verification results of steps ST<b>19</b> to ST<b>21</b> are legitimate, the context verification unit <b>36</b> determines that the authentication contexts Ac<b>1</b>, Ac<b>2</b> are legitimate and ends the process (ST<b>23</b>). The verification process of each of steps ST<b>19</b> to ST<b>21</b> does not use the result of other verification processes, and therefore, can be executed in an arbitrary order but not in the order described above.

0134As described above, according to this embodiment, the verification device <b>30</b> transmits the challenge information to the first entity device <b>10</b>, stores the particular challenge information in the challenge holding unit <b>34</b>, and verifies that the same challenge information as that in the challenge holding unit <b>34</b> is described for each of the authentication contexts Ac<b>1</b>, Ac<b>2</b> received in return, thereby confirming that the authentication contexts Ac<b>1</b>, Ac<b>2</b> are the present ones.

0135In this way, repetitive attacks that repeatedly use the past authentication context are prevented, which improves the security against repetitive attacks.

Second Embodiment

0136<figref idref="DRAWINGS">FIG. 7</figref> is a schematic diagram showing the configuration of an authentication system according to a second embodiment of the invention, <figref idref="DRAWINGS">FIG. 8 a</figref> schematic diagram showing the configuration of each entity device of the same system, and <figref idref="DRAWINGS">FIG. 9 a</figref> schematic diagram showing the configuration of a verification device of the same system. In FIGS. <b>7</b> to <b>9</b>, the component parts identical to those in the aforementioned drawings other than each device body are designated by the same reference numerals, respectively, and are not described in detail, while the component parts different from those in the aforementioned drawings are designated by different reference numerals or by attaching a dash or apostrophe and are not described in detail. Thus, only different component parts are mainly described below. Duplication of explanations is also avoided in the description of each embodiment below.

0137Specifically, the second embodiment is a modification of the first embodiment, and represents an authentication system dealing with the contents of the confidential execution providing the information to be hidden without notifying the verification device <b>30</b>.

0138Examples of the confidential execution content include the biometric template for biometrics authentication and the biometric information acquired by the sensor at the time of execution. The biometric template is essential for biological authentication and is required to be shared between the entity devices <b>10</b>, <b>20</b>. From the viewpoint of privacy protection, this information is not desirably notified to the verification device <b>30</b>.

0139The second entity device <b>20</b>, as shown on the left side of <figref idref="DRAWINGS">FIG. 8</figref>, includes a confidential execution content management unit <b>26</b> and a hash value generating unit <b>27</b> in addition to the aforementioned configuration. Accordingly, the contents processed by a communication unit <b>21</b>′, an authentication subprocess P<b>2</b> execution unit <b>22</b>′ and an authentication context generating unit <b>25</b>′ are somewhat different.

0140The communication unit <b>21</b>′ has the function of activating the authentication subprocess P<b>2</b> execution unit <b>22</b>′ upon receipt of the authentication execution request from the verification device <b>30</b>, the function of transmitting the confidential execution content received from the confidential content management unit <b>26</b> to the first entity device <b>10</b> and the function of transmitting the second authentication context received from the authentication context generating unit <b>25</b>′ to the verification device <b>30</b>. Incidentally, the communication of the confidential execution content between the second and first entity devices <b>20</b>, <b>10</b> is desirably hidden from outside using a secure communication path established by another means not shown.

0141The authentication subprocess P<b>2</b> execution unit <b>22</b>′ is activated by the communication unit <b>21</b>′, and based on the authentication execution request received from the communication unit <b>21</b>′ and the confidential execution content received from the confidential content management unit <b>26</b>, executes the authentication subprocess P<b>2</b> and sends out the execution result to the authentication context generating unit <b>25</b>′.

0142The authentication context generating unit <b>25</b>′ has the function of generating the second authentication context by describing, according to a specified format, the authenticator generated by the authenticator generating unit <b>24</b>, the content of execution other than the object (confidential execution content) of the second hash value in the authentication subprocess P<b>2</b> execution unit <b>22</b>′ and the second hash value received from the hash value generating unit <b>27</b>, and the function of sending out the second authentication context to the communication unit <b>21</b>′. The authenticator is generated by the authenticator generating unit <b>24</b> for the content of execution of the authentication subprocess P<b>2</b> and the second hash value based on the confidential information <b>2</b> in the confidential information management unit <b>23</b>.

0143The confidential content management unit <b>26</b> has the function of holding the confidential execution content and the function of sending out the confidential execution content to the communication unit <b>21</b>′, the authentication subprocess P<b>2</b> execution unit <b>22</b>′ and the hash value generating unit <b>27</b> upon activation of the authentication subprocess P<b>2</b> execution unit <b>22</b>′.

0144The hash value generating unit <b>27</b> has the function of generating the second hash value (the first-stage hash value) intended for the confidential execution content upon receipt of the particular confidential execution content (the confidential execution content input also to the second-stage authentication subprocess P<b>1</b> and hidden from the verification device <b>30</b>) from the confidential content management unit <b>26</b>, and the function of sending out the particular second hash value to the authentication context generating unit <b>25</b>′.

0145The first entity device <b>10</b>, as shown on the right side of <figref idref="DRAWINGS">FIG. 8</figref>, includes a hash value generating unit <b>17</b> in addition to the aforementioned configuration. Accordingly, the contents processed by the communication unit <b>11</b>′, the authentication subprocess P<b>1</b> execution unit <b>12</b>′ and the authentication context generating unit <b>15</b>′ are somewhat different.

0146The communication unit <b>11</b>′ has the function of activating the authentication subprocess P<b>1</b> execution unit <b>12</b>′ upon receipt of the authentication execution request from the verification device <b>30</b> and the confidential execution content from the second entity device <b>20</b>, the function of sending out the authentication execution request and the confidential execution content to the authentication subprocess P<b>1</b> execution unit <b>12</b>′ activated while at the same time sending out the confidential execution content to the hash value generating unit <b>17</b>, and the function of transmitting the first authentication context received from the authentication context generating unit <b>15</b>′ to the verification device <b>30</b>.

0147The authentication subprocess P<b>1</b> execution unit <b>12</b>′ is activated by the communication unit <b>11</b>′, and based on the authentication execution request and the confidential execution content received from the communication unit <b>11</b>′, executes the authentication subprocess P<b>1</b> and sends out the execution result to the authentication context generating unit <b>15</b>′.

0148The authentication context generating unit <b>15</b>′ has the function of generating the first authentication context by describing, according to a specified format, the authenticator generated by the authenticator generating unit <b>14</b>, the content of execution of the authentication subprocess P<b>1</b> execution unit <b>12</b>′ and the first hash value received from the hash value generating unit <b>17</b>, and the function of sending out the first authentication context to the communication unit <b>11</b>′. The authenticator is generated by the authenticator generating unit <b>14</b> for the content of execution of the authentication subprocess P<b>1</b> and the first hash value based on the confidential information <b>1</b> in the confidential information management unit <b>13</b>.

0149The hash value generating unit <b>17</b> has the function of generating the first hash value (second-stage hash value) providing the hash value intended for the confidential execution content upon receipt of the particular confidential execution content from the communication unit <b>11</b>′, and the function of sending out the first hash value to the authentication context generating unit <b>15</b>′.

0150The verification device <b>30</b>, as shown in <figref idref="DRAWINGS">FIG. 9</figref>, includes a hash value comparator <b>39</b> but not the parts <b>33</b> to <b>35</b> related to the challenge information described above. Accordingly, the contents processed by the context verification unit <b>36</b>′ are somewhat different. Nevertheless, the parts <b>33</b> to <b>35</b> related to the challenge information may be included without being omitted. Specifically, the function of verifying the challenge information and the function of verifying the hash value according to this embodiment are not necessarily included in different configurations but in the same configuration.

0151The communication unit <b>31</b> has the function of transmitting the authentication execution request to the first and second entity devices <b>10</b>, <b>20</b>, the function of receiving the first and second authentication contexts individually from the first and second entity devices <b>10</b>, <b>20</b>, and the function of sending out each authentication context received to the context verification unit <b>36</b>′.

0152The context verification unit <b>36</b>′ has the function of sending out each authentication context to the authenticator verification unit <b>38</b>, the function of receiving the authenticator verification result from the authenticator verification unit <b>38</b>, the function of sending out the first hash value and the second hash value contained individually in each authentication context to the hash value comparator <b>39</b>, the function of receiving the hash value comparative verification result from the hash value comparator <b>39</b>, the function of verifying the legitimacy of each authentication context based on the authenticator verification result and the hash value comparative verification result, and the function of confirming the contents (execution environment, execution result, etc.) of the authentication subprocesses P<b>1</b>, P<b>2</b> based on the data block information in each authentication context.

0153The hash value comparator <b>39</b> has the function of verifying by comparison that the second and first hash values received from the context verification unit <b>36</b>′ are identical to each other, and the function of returning the hash value comparative verification result obtained to the context verification unit <b>36</b>′.

0154Next, the operation of the authentication system configured as described above is explained.

0155First, in the verification device <b>30</b>, the communication unit <b>31</b> transmits the authentication execution request to the first and second entity devices <b>10</b>, <b>20</b>.

0156The second entity device <b>20</b>, upon receipt of the authentication execution request through the communication unit <b>21</b>′, activates the authentication subprocess P<b>2</b> execution unit <b>22</b>′. Also, the confidential content management unit <b>26</b>, upon activation of the authentication subprocess P<b>2</b> execution unit <b>22</b>′, sends out the confidential execution content to the communication unit <b>21</b>′, the authentication subprocess P<b>2</b> execution unit <b>22</b>′ and the hash value generating unit <b>27</b>. The communication unit <b>21</b>′ transmits the received confidential execution content to the first entity device <b>10</b>.

0157On the other hand, the authentication subprocess P<b>2</b> execution unit <b>22</b>′, once activated, executes the authentication subprocess P<b>2</b> based on the authentication execution request received from the communication unit <b>21</b>′ and the confidential execution content received from the confidential content management unit <b>26</b>, and sends out the execution result to the authentication context generating unit <b>25</b>′.

0158The execution result of the authentication subprocess P<b>2</b> execution unit <b>22</b>′ may be considered as the confidential execution content. The confidential execution content being the biometric information acquired by an external sensor is an example.

0159In this case, in response to the authentication execution request received from the communication unit <b>21</b>′, the execution result of the authentication subprocess P<b>2</b> execution unit <b>22</b>′ is sent out to the confidential content management unit <b>22</b>. The confidential content management unit <b>22</b> holds the execution result received from the authentication subprocess P<b>22</b> execution unit <b>22</b>′ as the confidential execution content, and transmits the particular confidential execution content to the communication unit <b>21</b>′ and the hash value generating unit <b>27</b>.

0160In the case where the confidential execution content is held beforehand in the confidential content management unit <b>26</b>, the confidential content management unit <b>26</b> desirably sends out the confidential execution content including the confidential execution content held beforehand and the execution content received from the authentication subprocess P<b>2</b> execution unit <b>22</b>′ to the communication unit <b>21</b>′ and the hash value generating unit <b>27</b>. As an alternative, they may be transmitted separately from each other and combined on the part of the hash value generating unit <b>27</b>.

0161Also, the hash value generating unit <b>27</b>, upon receipt of the confidential execution content from the confidential content management unit <b>26</b>, generates the second hash value providing the hash value intended for the particular confidential execution content and sends out the second hash value to the authentication context generating unit <b>25</b>′.

0162The authentication context generating unit <b>25</b>′ generates the second authentication context by describing, in accordance with a specified format, the authenticator generated by the authenticator generating unit <b>24</b>, the execution content other than the confidential execution content in the authentication subprocess P<b>2</b> execution unit <b>22</b>′ and the second hash value received from the hash value generating unit <b>27</b>, and sends out this second authentication context to the communication unit <b>21</b>′.

0163The communication unit <b>21</b>′ transmits the second authentication context to the verification device <b>30</b>.

0164In the first entity device <b>10</b>, on the other hand, the communication unit <b>11</b>′, upon receipt of the authentication execution request from the verification device <b>30</b> and the confidential execution content from the second entity device <b>20</b>, activates the authentication subprocess P<b>1</b> execution unit <b>12</b>′, and sends out the authentication execution request and the confidential execution content to the authentication subprocess P<b>1</b> execution unit <b>12</b>′ while at the same time sending out the confidential execution content to the hash value generating unit <b>17</b>.

0165In the process, the verification device <b>30</b> may transmit the authentication execution request to an authentication execution control device not shown instead of to the first entity device <b>10</b> and the second entity device <b>20</b>, and the authentication execution control device may transmit the authentication execution request to the first entity device <b>10</b> and the second entity device <b>20</b>.

0166In this case, as long as a particular entity device to which the authentication execution request is to be transmitted is determined beforehand in the authentication execution control device, the verification device <b>30</b> may send the authentication execution request to the authentication execution control device without designating any entity device.

0167Also, the first authentication context and the second authentication context generated by the first entity device <b>10</b> and the second entity device <b>20</b>, respectively, may be transmitted to the authentication execution control device and then collectively to the verification device <b>30</b> without being directly transmitted to the verification device <b>30</b>.

0168The authentication subprocess P<b>1</b> execution unit <b>12</b>′, based on the authentication execution request and the confidential execution content received from the communication unit <b>11</b>′, executes the authentication subprocess P<b>1</b> and sends out the execution result to the authentication context generating unit <b>15</b>′.

0169The hash value generating unit <b>17</b>, upon receipt of the confidential execution content from the communication unit <b>11</b>′, generates the first hash value providing the hash value for the particular confidential execution content, and sends out this first hash value to the authentication context generating unit <b>15</b>′.

0170The authentication context generating unit <b>15</b>′ generates the first authentication context by describing, according to a specified format, the authenticator generated by the authenticator generating unit <b>14</b>, the execution content of the authentication subprocess P<b>1</b> execution unit <b>12</b>′ and the first hash value received from the hash value generating unit <b>17</b>, and sends out the first authentication context to the communication unit <b>11</b>′.

0171The communication unit <b>11</b>′ transmits the first authentication context to the verification device <b>30</b>.

0172In the verification device <b>30</b>, the communication unit <b>31</b> receives the first and second authentication contexts individually and sends out each authentication context to the context verification unit <b>36</b>′.

0173The context verification unit <b>36</b>′ sends out each authentication context to the authenticator verification unit <b>38</b> and receives the authenticator verification result from the authenticator verification unit <b>38</b>.

0174Also, the context verification unit <b>36</b>′ sends out the first hash value and the second hash value contained individually in each authentication context to the hash value comparator <b>39</b>. The hash value comparator <b>39</b> verifies by comparison that the first and second hash values are identical to each other, and returns the hash value comparative verification result obtained to the context verification unit <b>36</b>′.

0175As a result, the context verification unit <b>36</b>′ verifies the legitimacy of each authentication context based on the authenticator verification result and the hash value comparative verification result. Also, the context verification unit <b>36</b>′ confirms the contents (execution environment, execution result, etc.) of the authentication subprocesses P<b>1</b>, P<b>2</b> based on the information of the data block in each authentication context.

0176As described above, according to this embodiment, the verification device <b>30</b> verifies that the hash values contained in the authentication contexts Ac<b>1</b>, Ac<b>2</b> are identical to each other thereby to confirm that is the confidential execution content of the first-stage authentication subprocess P<b>1</b> and the confidential execution content of the second-stage authentication subprocess P<b>2</b> are identical to each other. Thus, the security against the replacement attack against the confidential information can be improved. As a result, the “illegal replacement” of the biometric information in confirming the principal in biometrics, for example, can be prevented, which improves security.

0177Also, this embodiment, though configured of two entity devices including the first entity device <b>10</b> and the second entity device <b>20</b>, may alternatively be configured of more entity devices. In this case, each entity device may have either the same configuration as the first entity device <b>10</b> and the second entity device <b>20</b> or the functions of both the first entity device <b>10</b> and the second entity device <b>20</b> at the same time. In such a case, one functional part can execute a plurality of the same functions.

Third Embodiment

0178<figref idref="DRAWINGS">FIG. 10</figref> is a schematic diagram showing the configuration of an authentication system according to a third embodiment of the invention. This embodiment represents an example of the authentication system using biometrics authentication.

0179This embodiment represents an example of the authentication system in which the execution result of the authentication subprocess P<b>1</b> is obtained based on the execution result of the authentication subprocess P<b>2</b>.

0180This authentication system includes an authentication request device <b>40</b> between the first entity device <b>10</b>, the second entity device <b>20</b> and the verification device <b>30</b>. Specifically, the challenge information and a profile list summarizing the profiles defining the execution environment acceptable by the verification device <b>30</b> are transmitted collectively to the authentication request device <b>40</b> by the verification device <b>30</b> before starting the authentication. The authentication request device <b>40</b> determines the execution profile in such a manner as to meet the requirements of both the profile list and the function lists of the devices <b>10</b>, <b>20</b>, and according to this execution profile, causes the devices <b>10</b>, <b>20</b> to execute the authentication. The authentication request device <b>40</b> returns the first and second authentication contexts and the execution profile thus obtained to the verification device <b>30</b>. Specifically, this authentication system, with the configuration having the authentication request device <b>40</b>, can hide the function list of the devices <b>10</b>, <b>20</b> from the verification device <b>30</b>.

0181The authentication request device <b>40</b>, as shown in <figref idref="DRAWINGS">FIG. 11</figref>, includes a communication unit <b>41</b> and a control unit <b>42</b>. The control unit <b>42</b> includes a communication control unit <b>43</b> and a profile determining unit <b>44</b>.

0182The communication unit <b>41</b> is a communication interface between the devices <b>10</b>, <b>20</b>, <b>30</b> and the communication control unit <b>43</b>. In the explanation that follows, the description of the interposition of the communication unit <b>41</b> for communication between the devices <b>10</b>, <b>20</b>, <b>30</b> and the communication control unit <b>43</b> is omitted for simplification.

0183The communication control unit <b>43</b> has the function of transmitting the authentication request to the verification device <b>30</b>, the function of receiving the challenge information and the profile list from the verification device <b>30</b>, the function of sending out the profile list to the profile determining unit <b>44</b>, the function of transmitting the function list request individually to the first and second entity devices <b>10</b>, <b>20</b>, the function of receiving the function list individually from the entity devices <b>10</b>, <b>20</b>, the function of sending out the function list to the profile determining unit <b>44</b>, the function of transmitting the authentication execution request and the challenge information received from the aforementioned verification device <b>30</b> to the second entity device <b>20</b> together with the execution profile received from the profile determining unit <b>44</b>, the function of receiving the second authentication context from the second entity device <b>20</b>, the function of transmitting the authentication execution request, the aforementioned challenge information and the execution profile to the first entity device <b>10</b> together with the second authentication context, the function of receiving the first authentication context from the first entity device <b>10</b>, and the function of transmitting the first and second authentication contexts and the execution profile to the verification device <b>30</b>.

0184Incidentally, the function list request may be transmitted each time the authentication process is executed or at the time of initialization of the authentication request device <b>40</b>. In the case where the function list request is transmitted at the time of initialization, the function list obtained is held in the authentication request device <b>40</b>.

0185The profile determining unit <b>44</b> has the function of determining the execution profile used for authentication in such a manner as to meet the requirements of both the profile list and the function list received from the communication control unit <b>43</b> and the function of sending out the particular execution profile to the communication control unit <b>43</b>.

0186The profile list contains the description (information) of the information of the profile (execution environment) of the entity devices <b>10</b>, <b>20</b> acceptable by the verification device <b>30</b>, and as shown in <figref idref="DRAWINGS">FIG. 12</figref>, for example, has listed therein candidates of the hash value calculation algorithm and candidates of the authenticator calculation algorithm. Incidentally, the profile list is not necessarily in the form of a list. The profile list may be either the information described in the form (of a sentence) enumerating the information of acceptable profiles (without changing the line) or the information described in the form of a table (a list in the broad sense of the word). Specifically, the profile list is defined as information, in whatever form of description, containing the description of the information of the profile acceptable by the verification device <b>30</b>.

0187The function list specifies the function (execution environment) for executing the authentication subprocess in the entity devices <b>10</b>, <b>20</b>.

0188The execution profile, which is determined (or selected) in such a manner as to meet the requirements of the profile list and each function list, is executed at the time of authentication and as shown in <figref idref="DRAWINGS">FIG. 13</figref>, contains the description of the hash value calculation algorithm and the authenticator calculation algorithm.

0189The first and second entity devices <b>10</b>, <b>20</b>, to which the authentication context verification unit <b>16</b> is added in the aforementioned configuration as shown in <figref idref="DRAWINGS">FIG. 14</figref>, include function list storage units <b>18</b>, <b>28</b>. Accordingly, each communication unit <b>11</b>″, <b>21</b>″ has the function of returning the function list in the function list storage units <b>18</b>, <b>28</b> in response to the function list request received from the authentication request device <b>40</b> and returning the authentication context in respect of the authentication execution request, the challenge information and the execution profile. Incidentally, the challenge information, which can be omitted from the viewpoint of hiding the function list, is included in this example.

0190Also, the authentication subprocess P<b>2</b> execution unit <b>22</b>″ includes a biometric information input processing function <b>22</b>-<b>1</b> and a signal processing function <b>22</b>-<b>2</b>. The authentication subprocess P<b>1</b> execution unit <b>12</b>″ includes a biometric template storage unit <b>12</b>-<b>1</b> and a matching process function <b>12</b>-<b>2</b>.

0191In this case, the authentication subprocess P<b>2</b> execution unit <b>22</b>″, upon receipt of the authentication execution request and the execution profile from the communication unit <b>21</b>″, executes the biometric information input processing function <b>22</b>-<b>1</b> and the signal processing function <b>22</b>-<b>2</b> based on the execution profile, and sends out the execution result to the authentication context generating unit <b>25</b>.

0192The biometric information input processing function <b>22</b>-<b>1</b> generates the input biometric information based on the biometric information input and sends out this input biometric information to the signal processing function <b>22</b>-<b>2</b>. The signal processing function <b>22</b>-<b>2</b> generates the biometric sample information based on the input biometric information received from the biometric information input processing function <b>22</b>-<b>1</b>, and sends out the execution result having this biometric sample information to the authentication context generating unit <b>25</b>.

0193The authentication subprocess P<b>1</b> execution unit <b>12</b>″, upon receipt of the authentication execution request and the execution profile from the communication unit <b>11</b>″ and the second authentication context from the authentication context verification unit <b>16</b>, executes the matching process function <b>12</b>-<b>2</b> with reference to the biometric template storage unit <b>12</b>-<b>1</b> based on the execution profile and the second authentication context, and sends out the execution result to the authentication context generating unit <b>15</b>.

0194The biometric template storage unit <b>12</b>-<b>1</b> is a memory for storing the biometric template in advance and can be accessed from the matching process function <b>12</b>-<b>2</b>.

0195The matching process function <b>12</b>-<b>2</b> executes the matching process for matching the biometric template in the biometric template storage unit <b>12</b>-<b>1</b> with the biometric sample information in the second authentication context, and sends out the execution result indicating the matching result to the authentication context generating unit <b>15</b>.

0196The authentication context verification unit <b>16</b> verifies the second authentication context received from the communication unit <b>11</b>″ based on the confidential information <b>1</b> in the confidential information management unit <b>10</b>, and whenever the verification result is legitimate, sends out the second authentication context to the authentication subprocess P<b>1</b> execution unit <b>12</b>″.

0197Next, the operation of the authentication system having this configuration is explained with reference to the sequence diagram of <figref idref="DRAWINGS">FIG. 15</figref>. This explanation concerns a case in which the authentication subprocess P<b>2</b> execution unit <b>22</b> of the second entity device <b>20</b> collects the biological data and processes the signals while the authentication subprocess P<b>1</b> execution unit <b>12</b> of the first entity device <b>10</b> executes the process of holding and matching the biometric template.

0198The verification device <b>30</b> holds a profile list having profiles acceptable to the component data of the first and second authentication contexts (ST<b>30</b>).

0199The authentication request device transmits the authentication request for biological authentication to the verification device <b>30</b> (ST<b>31</b>).

0200The verification device <b>30</b>, upon receipt of the authentication request, transmits the challenge information and the profile list to the authentication request device <b>40</b> (ST<b>32</b>).

0201The authentication request device <b>40</b> receives the challenge information and the profile list and requests the function list individually from the first and second entity devices <b>10</b>, <b>20</b> (ST<b>33</b>).

0202The first and second entity devices <b>10</b>, <b>20</b> transmit the function lists read from the function list storage units <b>18</b>, <b>28</b>, respectively, to the authentication request device <b>40</b> (ST<b>34</b>).

0203In the authentication request device <b>40</b>, the communication control unit <b>43</b> sends out each function list received from the entity devices <b>10</b>, <b>20</b> and the profile list received from the verification device <b>30</b> to the profile determining unit <b>44</b>.

0204The profile determining unit <b>44</b> compares each function list with the profile list, determines an execution profile in such a manner as to meet the requirements of the three lists (ST<b>35</b>), and sends out the execution profile to the communication control unit <b>43</b>.

0205The authentication request device <b>40</b> transmits the authentication execution request, the challenge information and the execution profile to the second entity device <b>20</b> through the communication control unit <b>43</b> (ST<b>36</b>). Incidentally, in the case where the execution profile cannot be determined, the authentication request device <b>40</b> returns the message indicating the impossibility of authentication to the verification device (ST<b>36</b>′).

0206The second entity device <b>20</b>, upon receipt of the authentication execution request, the challenge information and the execution profile, executes the authentication subprocess P<b>2</b> (biometric information input process and the signal processing). At the same time, the authentication subprocess P<b>2</b> execution unit <b>12</b>″ generates the biometric sample information in accordance with the execution profile and sends out the execution result including the biometric sample information to the authentication context generating unit <b>15</b>.

0207The authentication context generating unit <b>15</b> generates the authenticator through the authenticator generating unit <b>14</b> in accordance with the execution profile, and generates the second authentication context including the particular authenticator, the challenge information and the execution result (ST<b>37</b>).

0208The second entity device <b>20</b> transmits the second authentication context thus obtained to the authentication request device <b>40</b> (ST<b>38</b>).

0209The authentication request device <b>40</b> transmits the second authentication context, the authentication execution request, the challenge information and the execution profile to the first entity device <b>10</b> (ST<b>39</b>).

0210In the first entity device <b>10</b>, the authentication context verification unit <b>16</b> verifies the completeness of the second authentication context. After that, the authentication subprocess P<b>1</b> execution unit <b>12</b>″ executes the matching process for matching the biometric sample information in the second authentication context with the biometric template in the reference information storage unit <b>12</b>-<b>1</b> in accordance with the execution profile, and sends out the execution result to the authentication context generating unit <b>15</b>. The authentication context generating unit <b>15</b> generates the authenticator through the authenticator generating unit <b>14</b> in accordance with the execution profile, and generates the first authentication context including the particular authenticator, the challenge information and the execution result (ST<b>40</b>).

0211The first entity device <b>10</b> transmits the first authentication context to the authentication request device <b>40</b> (ST<b>41</b>).

0212The authentication request device <b>40</b> transmits the first and second authentication contexts and the execution profile to the verification device <b>30</b> (ST<b>42</b>).

0213The verification device <b>30</b> verifies each authentication context thus received (ST<b>43</b>).

0214Specifically, the verification device <b>30</b> verifies the completeness of each authentication context based on the authenticator in each authentication context. In addition, the verification device <b>30</b> may be so configured as to confirm that the authentication process has been executed without altering each piece of biometric information by confirming the authenticator of the biometric sample information and the authenticator of the biometric template. In this case, each piece of biometric information and the authenticator thereof may be included in the authentication contexts by the respective entity devices <b>10</b>, <b>20</b>.

0215Also, the verification device <b>30</b> confirms that the challenge information in each authentication context coincides with the value transmitted in step ST<b>32</b>, and thus confirms that there is no repetitive attack.

0216Finally, the verification device <b>30</b> compares the information contained in the authentication contexts, the execution profile and the profile list and then determines the advisability of the final authentication. In this way, the verification device <b>30</b> ends the verification process of step ST<b>43</b>.

0217In the process, the contents of the execution profile may not be left without being compared. This is by reason of the fact that the contents of the execution profile are contained also in the authentication context and therefore the effects of the invention remain unchanged by the non-comparison.

0218As described above, according to this embodiment, the authentication request device <b>40</b> determines the execution profile indicating the execution environment of the authentication entity devices <b>10</b>, <b>20</b> in such a manner as to meet the requirements of both the profile list indicating the execution environment acceptable by the verification device <b>30</b> and the function lists of the entity devices <b>10</b>, <b>20</b>. In this way, the various execution environments of the entity devices <b>10</b>, <b>20</b> not related to the execution of the authentication can be hidden from the verification device <b>30</b>, and therefore, the privacy of the requester on the part of each authentication entity device <b>10</b>, <b>20</b> can be protected.

0219Also, this embodiment is applicable not only to the first embodiment using the challenge information but also, as shown in <figref idref="DRAWINGS">FIGS. 10, 16</figref>, to the second embodiment using the hash value with equal effect. Incidentally, according to the modification shown in <figref idref="DRAWINGS">FIG. 16</figref>, the contents of confidential execution are transmitted to the first entity device <b>10</b> from the second entity device <b>20</b> through the authentication request device <b>40</b>.

Fourth Embodiment

0220<figref idref="DRAWINGS">FIG. 17</figref> is a schematic diagram showing the configuration of the authentication system according to a fourth embodiment of the invention.

0221In the first to third embodiments, the verification of the authentication context by the verification device <b>30</b> may require the access to the static information (information remaining unchanged each time of authentication) in, for example, the data blocks d<b>1</b>, d<b>2</b>. From the viewpoint of communication traffic, however, a low efficiency results if the static information is transmitted by being described in the authentication context each time of authentication.

0222According to this embodiment, typically as in the example applied to the third embodiment, the communication traffic is reduced by describing the link destination information (identification information such as URL (uniform resource locator), URN (uniform resource name) or URI (uniform resource identifier)) in the authentication context without describing the static information in the authentication context. Naturally, the link destination information contains the description of a link destination smaller in data amount than the static information.

0223In the case where the static information constitutes the information on the entity devices <b>10</b>, <b>20</b>, for example, the link destination includes a static information management server <b>50</b> managed by the maker of the entity devices <b>10</b>, <b>20</b> or a fair third party organization.

0224The static information management server <b>50</b> includes a communication unit <b>51</b> for returning the static information in the static information storage unit <b>52</b> to the requester in response to the static information request received from an external source and a static information storage unit <b>52</b> for storing the static information in a manner readable from the communication unit <b>51</b>.

0225In the case where the static information is the information on the biometric template, the server of a biometric information register or a public evaluation organization, though not shown, may constitute the link destination.

0226The link destination is not limited to a server, but the information whereby a certificate can be issued for static information by a reliable organization may constitute the link information. In the case of the template evaluation information, for example, the information such as the issuing party name and the serial number whereby the template certificate issued by a registration organization for the hash value of the template and the evaluation information may be used as the link destination information. An example of such a template certificate Ct is shown in <figref idref="DRAWINGS">FIG. 18</figref>.

0227This template certificate Ct is configured of a basic area and a signature area. The basic area includes such items (and contents) as the version (the version of the certificate form), the serial number (the serial number of the certificate), the signature algorithm (the signature algorithm of the signature of the issuing party), the expiry date (the expiry date of the template), the name of the issuing party (the issuing party name information of the certificate), the hash algorithm (the hash algorithm of the template digest), the template digest (the hash value of the template), the template evaluation result (the evaluation result of the template) and the criterion for template evaluation (the evaluation criterion for the template).

0228The signature area includes such an item (and content) as the signature of the issuing party (the digital signature of the issuing party for the basic area).

0229Next, the first and second entity devices <b>10</b>, <b>20</b>, as shown in <figref idref="DRAWINGS">FIG. 19</figref>, include static information link destination management units <b>19</b>, <b>29</b> for storing the link destination information of the static information in addition to the aforementioned configuration. Accordingly, the authentication context generating units <b>15</b>″, <b>25</b>″ generate the first or second authentication context including the link destination information in place of the static information, in addition to the execution result of the authentication subprocess P<b>1</b>, P<b>2</b> execution units <b>12</b>″, <b>22</b>″.

0230An example of the first and second authentication contexts Ac<b>1</b>, Ac<b>2</b> is shown in <figref idref="DRAWINGS">FIGS. 20A and 20B</figref>. In this example, link destination information dLi of the static information and entity information dEn are stored in the data blocks d<b>1</b>″, d<b>2</b>″, respectively. The link destination information dLi includes the link destination of the static information such as the entity evaluation report, the entity accuracy information and the template certificate used for the matching process. Incidentally, differing information for a different authentication is stored in the entity information (execution result, etc.). The entity information dEn includes the quality of the biometric sample information and the degree of coincidence of the matching process.

0231Next, the operation of the authentication system configured as described above is explained.

0232Assume that the verification device <b>30</b>, as in the third embodiment, has received the first and second authentication contexts and the execution profile from the authentication request device <b>40</b>.

0233The verification device <b>30</b>, as described above, verifies each authentication context and transmits the static information request to the static information management server <b>50</b>, for example, based on the static information link destination information in each authentication context as required.

0234The static information management server <b>50</b>, upon receipt of the static information request through the communication unit <b>51</b>, returns the corresponding static information in the static information storage unit <b>52</b> to the verification device <b>30</b> from the communication unit <b>51</b> based on the static information request.

0235The verification device <b>30</b>, based on the static information thus received, continues to verify each authentication context and finally determines the advisability of the authentication. Incidentally, the verification device <b>30</b> may hold, in a cache memory (not shown), the static information received in the past to improve the access rate to the link destination.

0236As described above, according to this embodiment, the entity devices <b>10</b>, <b>20</b> generate the authentication contexts Ac<b>1</b>, Ac<b>2</b> in such a manner as to contain the link destination information for acquiring the static information smaller in data amount than the static information indicating the same content for each authentication session, and therefore, the size of the authentication context is reduced. As a result, the communication traffic between the authentication request device <b>40</b> and the verification device <b>30</b> can be reduced, which improves communication efficiency of the authentication context.

0237Incidentally, this embodiment is applicable not only to the third embodiment using the authentication request device <b>40</b> but also to the first or second embodiment lacking the authentication request device <b>40</b> with equal effects, as shown in <figref idref="DRAWINGS">FIGS. 21 and 22</figref>. Also in this modification, the entity devices <b>10</b>, <b>20</b> have the static information link destination management units <b>19</b>, <b>29</b> and, naturally, the authentication context is generated by the authentication context generating units <b>15</b>, <b>25</b> in such a manner as to include the link destination information in place of the static information.

0238The method exhibited in each above-mentioned embodiment can be distributed as a computer executable program by storing into a storage medium such as a magnetic disk (floppy [trade mark] disk, hard disk, etc.), an optical disk (CD-ROM, DVD, etc.), a magnet-optical disk (MO) and a semiconductor memory.

0239Regardless of type of storage format, any storage medium capable of storing the program and being read by the computer is usable as the storage medium for this program.

0240An operating system (OS) or middleware (MW) such as a database management software and a network software running on the computer, based on the instruction installed in the computer from the storage medium, may executes a part of each processing to achieve each above-described embodiment.

0241The storage medium for the invention is not limited to a medium independent from the computer, and includes the storage medium with a program transmitted via a LAN, the Internet, etc., downloaded and stored or temporarily stored thereon.

0242The number of the storage medium for the invention is not limited only one, and the storage medium of the invention includes the case that processing in each embodiment is respectively executed by means of a plurality of media, and any structure of the medium is acceptable.

0243The computer in the invention executes each processing in each above mentioned embodiment, based on the program stored in the storage medium. Any configuration of the computer such as a device composed of a single personal computer, etc., and a system composed of a plurality of devices network-connected therein are available.

0244The computer in the invention is not limited to a personal computer, and includes computing processing device, a micro-computer, etc., included in information processing equipment and generically means equipment and a device capable of achieving the functions of the invention.

0245The invention in its broader aspects is not limited to the specific details and representative embodiments shown and described herein, and can be embodied in their implementation phases by modifying constituent components without departing from the spirit or scope of the general inventive concept of the invention. A variety of modifications of the invention may be made by appropriate combinations of a plurality of constituent components shown in each foregoing embodiment. For example, some constituent components may be omitted from the whole of the constituent components shown in each embodiment. Furthermore, the constituent components over different embodiments can be appropriately combined.

0246The method exhibited in each above-mentioned embodiment can be expressed as shown in following item 1 to 13.

02471. An authentication system comprising a plurality of authentication entity devices which individually execute authentication subprocesses making up an authentication process and a verification device which verifies the authentication process executed by the entity devices, wherein the authentication entity devices each include: a challenge information receiving module configured to receive a challenge information generated by the verification device; a confidential information storage module configured to store a confidential information for the verification; an authenticator generating module configured to generate an authenticator for the contents of execution of the authentication subprocesses and the challenge information based on the confidential information; an authentication context generating module configured to generate an authentication context describing the authenticator, the contents of execution and the challenge information in accordance with a specified format; and an authentication context transmitting module configured to transmit the authentication context, and the verification device includes: a verification information storage module configured to store an authenticator verification information corresponding to the confidential information; a challenge generating module configured to generate the challenge information; a challenge storage module configured to store the challenge information; a challenge information transmitting module configured to transmit the challenge information; an authentication context receiving module configured to receive each authentication context generated by the authentication entity devices; a challenge verification module configured to verify whether the challenge information identical to the challenge information in the challenge storage module is described for each of the authentication contexts received; an authenticator verification module configured to verify the authenticator for each authentication context based on the authenticator verification information; and an authentication context verification module configured to verify the legitimacy of each authentication context based on the verification result of each of the verification module.

02482. An authentication system comprising a plurality of authentication entity devices which individually execute authentication subprocesses making up an authentication process and a verification device which verifies the authentication processes executed by the entity devices, wherein the authentication entity devices include at least one first-stage authentication entity device and at least one second-stage authentication entity device the first-stage authentication entity device includes: a first-stage hash value generating module configured to generate a first-stage hash value for a confidential execution content which is included in the execution content of the authentication subprocesses and which is input to a second-stage authentication subprocess and hidden from the verification device; a first-stage confidential information storage module configured to store a confidential information for the verification; a first-stage authenticator generating module configured to generate an authenticator for the contents of execution of the authentication subprocess and the first-stage hash value based on the confidential information; a first-stage authentication context generating module configured to generate an authentication context describing, in accordance with a specified format, the authenticator, the execution content other than for the first-stage hash value and the first-stage hash value; and a first-stage transmitting module configured to transmit the authentication context and the confidential execution content, the second-stage authentication entity device includes: a confidential execution content receiving module configured to receive the confidential execution content transmitted; a second-stage hash value generating module configured to generate a second-stage hash value for the confidential execution content received; a second-stage confidential information storage module configured to store the confidential information for the verification; a second-stage authenticator generating module configured to generate an authenticator for the execution content of the authentication subprocess and the second-stage hash value based on the confidential information; a second-stage authentication context generating module configured to generate an authentication context describing the authenticator, the execution content and the second-stage hash value in accordance with a specified format; and a second-stage transmitting module configured to transmit the authentication context, and the verification device includes: a verification information storage module configured to store an authenticator verification information corresponding to the confidential information; an authentication context receiving module configured to receive the authentication contexts generated by the authentication entity devices; a hash value comparative verification module configured to verify by comparison that the first-stage hash value and the second-stage hash value contained in the authentication context received are identical to each other; an authenticator verification module configured to verify the authenticator for each of the authentication contexts based on the authenticator verification information; and an authentication context verification module configured to verify the legitimacy of the authentication contexts based on the verification result by the verification module.

02493. The authentication system according to item 1, comprising an authentication request device which relays the communication between the verification device and the authentication entity devices, wherein the verification device includes: a profile list generating module configured to generate the profile list specifying an execution environment acceptable for execution of the authentication subprocesses; and a list transmitting module configured to transmit the profile list to the authentication request device, the authentication request device includes: a profile list receiving module configured to receive the profile list; a function list receiving module configured to receive, for each authentication entity device, a function list specifying the functions of executing the authentication subprocesses; a profile determining module configured to determine an execution profile in such a manner as to meet the requirements of both the profile list and the function list; and an execution profile transmitting module configured to transmit the execution profile to the authentication entity devices, and the authentication entity devices each include: an execution profile receiving module configured to receive the execution profile from the authentication request device; and an authentication subprocess execution module configured to execute the authentication subprocesses based on the execution profile.

02504. The authentication system according to item 1, wherein the authentication entity devices each include link destination information storage module configured to storing link destination information which is smaller in data amount than static information having the same content for each authentication session and which is adapted to acquire the static information, the authentication context generating module generates the authentication context in such a manner as to include the link destination information in place of the static information, and the verification device includes: a module configured to acquire the static information based on the link destination information in the authentication content received; and a verification module configured to verify the authentication process based on the static information and the execution content in the authentication context.

02515. A program stored in a computer-readable storage medium for use in a computer of each of authentication entity devices which are communicable with a verification device to verify an authentication process and which individually execute authentication subprocesses making up the authentication process, the program comprising: receiving program code for receiving challenge information generated by the verification device; authenticator generating program code for generating an authenticator for execution contents of the authentication subprocesses and the challenge information based on the confidential information-stored in the each authentication entity device; authentication context generating program code for generating an authentication context describing the authenticator, the execution contents and the challenge information in accordance with a specified format; and authentication context transmitting program code for transmitting the authentication context to the verification device, and the authentication context is such that the verification device verifies whether the challenge information identical to the challenge information generated by the verification device is described or not, and based on authenticator verification information corresponding to the confidential information, the verification device verifies the authenticator thereby to verify the legitimacy based on the verification result.

02526. A program stored in a computer-readable storage medium for use in a computer of a verification device communicable with a plurality of authentication entity devices which individually execute authentication subprocesses making up an authentication process and adapted to verify the authentication process executed by the authentication entity devices, the program comprising: challenge generating program code for generating the challenge information; challenge information transmitting program code for transmitting the challenge information; authentication context receiving program code for receiving an authentication context transmitted from the authentication entity devices after the authentication entity devices generate an authenticator for execution contents of the authentication subprocesses and the challenge information based on the confidential information, and an authentication context is generated by describing the authenticator, the execution contents and the challenge information in accordance with a specified format; challenge verification program code for verifying whether the challenge information identical to the challenge information in the challenge storage device is described or not for each authentication context received; authenticator verification program code for verifying the authenticator for each authentication context based on authenticator verification information stored in the verification device, the authenticator verification information corresponding to confidential information stored in the authentication entity devices; and authentication context verification program code for verifying the legitimacy of the authentication context based on the verification result of the verification program code.

02537. A program stored in a computer-readable storage medium for use in a computer of at least one first-stage entity device communicable with a verification device to verify an authentication process and also communicable with at least one second-stage authentication entity device among a plurality of authentication entity devices which individually execute authentication subprocesses making up the authentication process, the program comprising: first-stage hash value generating program code for generating a first-stage hash value for a confidential execution content, among the execution contents of the authentication subprocesses, input to a second-stage authentication subprocess and hidden from the verification device; first-stage authenticator generating program code for generating an authenticator for the execution contents of the authentication subprocesses and the first-stage hash value based on the confidential information stored in the first-stage entity device; first-stage authentication context generating program code for generating a first-stage authentication context describing the authenticator, the execution content for other than the first-stage hash value and the first-stage hash value in accordance with a specified format; and first-stage transmitting program code for transmitting the authentication context and the confidential execution content, the confidential execution content is received by the second-stage authentication entity device and converted into a second-stage hash value for the particular confidential execution content, the second-stage hash value is converted by the second-stage authentication entity device into the authenticator for the execution content of the authentication subprocess and the second-stage hash value based on the confidential information on the one hand and described in the second-stage authentication context together with the authenticator and the execution content in accordance with a specified format and transmitted together with the second-stage authentication context on the other hand, and the verification device receives the authentication contexts, verifies by comparison that the first-stage hash value and the second-stage hash value contained in the authentication context are identical to each other, verifies the authenticator for each authentication context based on the authenticator verification information corresponding to the confidential information, and verifies the legitimacy based on the verification result.

02548. A program stored in a computer-readable storage medium for use in a computer of at least one second-stage entity device communicable with a verification device to verify an authentication process and also communicable with at least one first-stage authentication entity device among a plurality of authentication entity devices which individually execute authentication subprocesses making up the authentication process, the program comprising: confidential execution content receiving program code for receiving, from the first-stage authentication entity device, a confidential execution content included in the execution contents of the authentication subprocesses, which is input to the second-stage authentication subprocess and hidden from the verification device; second-stage hash value generating program code for generating a second-stage hash value for the confidential execution content received; second-stage authenticator generating program code for generating an authenticator for the execution contents of the authentication subprocess and the second-stage hash value based on the confidential information stored in the second-stage entity device; second-stage authentication context generating program code for generating an authentication context describing the authenticator, the execution content and the second-stage hash value in accordance with a specified format; and second-stage transmitting program code for transmitting the authentication context, the confidential execution content is converted into a first-stage hash value for the particular confidential execution content by the first-stage authentication entity device before being transmitted from the first-stage authentication entity device, the first-stage hash value is converted into an authenticator for the execution content of the authentication subprocess and the first-stage hash value based on the confidential information by the first-stage authentication entity device while at the same time being described in the first-stage authentication context in accordance with a specified format together with the authenticator and the execution content and transmitted together with the first-stage authentication context, and the verification device receives the authentication contexts, verifies by comparison that the first-stage hash value and the second-stage hash value contained in the authentication context are identical to each other, verifies the authenticator for each authentication context based on the authenticator verification information corresponding to the confidential information, and verifies the legitimacy based on the verification result.

02559. A program stored in a computer-readable storage medium for use in a computer of a verification device communicable with a plurality of authentication entity devices which individually execute authentication subprocesses making up an authentication process and adapted to verify the authentication processes executed by the authentication entity devices, the program comprising: first authentication context receiving program code for receiving a first-stage authentication context transmitted from the first-stage authentication entity device after a first-stage hash value for the confidential execution content included in the execution contents of the authentication subprocesses, which is input to the second-stage authentication subprocess and hidden from the verification device, is generated by at least one of the first-stage authentication entity devices, an authenticator for the execution content of the authentication subprocess and the first-stage hash value is generated based on the confidential information, and the first-stage authentication context is generated by describing the authenticator, the execution content for other than the first-stage hash value and the first-stage hash value in accordance with a specified format; second authentication context receiving program code for receiving the second-stage authentication context transmitted from the second-stage authentication entity device after the confidential execution content transmitted from the first-stage authentication entity device is received by at least one of the second-stage authentication entity devices of the authentication entity devices, a second-stage hash value for the confidential execution content is generated, and the authenticator for the execution content of the authentication subprocess and the second-stage hash value is generated based on the confidential information, and the second-stage authentication context is generated by describing the authenticator, the execution content and the second-stage hash value in accordance with a specified format; hash value comparative verification program code for verifying by comparison that the first-stage hash value and the second-stage hash value contained in the authentication context received are identical to each other; authenticator verification program code for verifying the authenticator for each authentication context based on authenticator verification information stored in the verification device, the authenticator verification information corresponding to confidential information stored in the authentication entity devices; and authentication context verification program code for verifying the legitimacy of the authentication contexts based on the verification result of the verification program code.

025610. The program according to item 6, further comprising: profile list generating program code for generating a profile list defining an execution environment acceptable for execution of the authentication subprocesses; and list transmitting program code for transmitting the profile list, the profile list is received by an authentication request device which relays the communication between the verification device and the authentication entity devices, and compared with a function list which is acquired by the authentication request device for each of the authentication entity devices and which defines the function of executing the authentication subprocesses, the comparison is a process for determining an execution profile in such a manner as to meet the requirements of both the profile list and the function list, and the execution profile is transmitted to the authentication entity devices and defines the execution environment for executing the authentication subprocesses.

025711. A program stored in a computer-readable storage medium for use in a computer of a authentication request device which relays the communication between the verification device according to item 10 and the authentication entity devices, the program comprising: profile list receiving program code for receiving the profile list from the verification device; function list receiving program code for receiving, for each authentication entity device, the function list defining the function of executing the authentication subprocesses; profile determining program code for determining the execution profile in such a manner as to meet the requirements of both the profile list and the function list; and execution profile transmitting program code for transmitting the execution profile to the authentication entity devices.

025812. The program according to item 5, further comprising: wherein the each of authentication entity devices stores link destination information which is for acquiring the static information smaller in data amount than the static information indicating the same content for each authentication; and the authentication context generating program code is to generate the authentication context in such a manner as to include the link destination information in place of the static information, and the authentication context is received by the verification device, the static information is acquired based on the link destination information in the authentication context, and the authentication process is verified based on the static information and the execution content in the authentication context.

025913. The program according to item 6, further comprising: program code for acquiring the static information indicating the same content for each authentication session, based on link destination information in the authentication context received by the authentication context receiving program code in the case where the authentication context contains the link destination information, in place of the static information, smaller in data amount than the static information and adapted to acquire the static information; and verification program code for verifying the authentication process based on the static information and the execution content in the authentication context.

0260As explained above, in the authentication system, apparatus and program according to this invention, the security can be improved against repetitive attacks in which the past authentication contexts are repeatedly used. Also, the security against illegal replacement attacks of the confidential information is improved. Further, the various execution environments of the requesting party can be hidden from the verifiers, etc. Also, the communication efficiency of the authentication context is improved.