Terminal device, authentication server, authentication method, and non-transitory computer readable storage medium
A terminal device according to the present application includes a sending unit that sends a challenge to an authenticator, a reception unit that receives the challenge with a signature and a public key from the authenticator, a verification unit that performs signature verification using the public key, and a providing unit that provides a verification result of the signature to an authentication server. Further, an authentication server according to the present application includes a sending unit that makes an authentication request to a terminal device, an acquisition unit that receives, from the terminal device, a verification result of a signature generated by an authenticator together with an ID and a password of a user, and a verification unit that determines that FIDO authentication is completed with the verification result of the signature, and verifies the ID and the password of the user.
1. A terminal device comprising:
a communication unit connected to a network; and
a processor, wherein the processor is configured to:
send a challenge to an authenticator;
receive the challenge with a signature and a public key from the authenticator;
perform signature verification using the public key;
directly provide a verification result of the signature to an authentication server via the communication unit;
receive a first challenge sent from the authentication server via the communication unit;
send a second challenge different from the first challenge to the authenticator;
receive a signature of the second challenge and a public key from the authenticator;
generate a signature of the first challenge when authentication is successful as a result of performing signature verification using the public key; and
return the signature of the first challenge to the authentication server via the communication unit as a response.
2. The terminal device according to claim 1 , wherein the processor is further configured to:
receive an authentication request of an ID and a password of a user from the authentication server via the communication unit, and
provide the authentication server with the verification result of the signature together with the ID and the password of the user via the communication unit.
3. The terminal device according to claim 2 , wherein the processor is further configured to:
send a challenge to the authenticator when a verification request button displayed on a password screen for inputting an ID and a password of the user is pressed, and
provide the authentication server with the verification result of the signature together with the ID and the password of the user via the communication unit when the verification request button is pressed, and provides only the ID and the password of the user to the authentication server via the communication unit when the verification request button is not pressed.
4. The terminal device according to claim 1 , wherein the processor is further configured to:
receive a challenge sent from the authentication server via the communication unit,
send the challenge sent from the authentication server to the authenticator, and
return the challenge with the signature to the authentication server via the communication unit as a response together with the verification result of the signature.
5. The terminal device according to claim 1 , wherein the processor is further configured to:
indicate integrity of the terminal device by the signature of the first challenge.
6. The terminal device according to claim 1 , wherein the processor is further configured to:
provide the verification result of the signature to the authentication server having both a FIDO authentication function and a password authentication function via the communication unit.
7. The terminal device according to claim 6 , wherein the processor is further configured to:
represent that the FIDO authentication function is completed by providing the verification result of the signature.
8. An authentication server comprising:
a communication unit connected to a network; and
a processor, wherein the processor is configured to:
make an authentication request to a terminal device via the communication unit;
receive, directly from the terminal device via the communication unit, a verification result of a signature generated by an authenticator together with an ID and a password of a user;
determine that FIDO authentication is completed with the verification result of the signature, and verify the ID and the password of the user;
send a first challenge to the terminal device via the communication unit, wherein the terminal device issues a second challenge to the authenticator following receipt of the first challenge, and receives a signature of the second challenge and a public key from the authenticator;
receive a signature of the first challenge generated by the terminal device as a response from the terminal device that has performed the FIDO authentication; and
verify the signature of the first challenge sent from the terminal device as a response,
wherein the signature of the first challenge is generated when authentication is successful as a result of performing signature verification using the public key.
9. The authentication server according to claim 8 , wherein the processor is further configured to:
send a third challenge to the terminal device via the communication unit,
receive, from the terminal device via the communication unit, a challenge in which a signature is generated by the authenticator together with the verification result of the signature as a response, and
verify the challenge sent from the terminal device via the communication unit as a response.
10. The authentication server according to claim 8 , wherein
the processor has both a FIDO authentication function and a password authentication function.
11. An authentication method executed by a terminal device, the method comprising:
a receiving step of receiving a first challenge sent from an authentication server via a communication unit connected to a network;
a sending step of sending a second challenge different from the first challenge to an authenticator;
a reception step of receiving the second challenge with a signature and a public key from the authenticator;
a verification step of performing signature verification using the public key;
a generation step of generating a signature of the first challenge when the signature verification is successful; and
a providing step of directly providing the signature of the first challenge to the authentication server as a response.
12. An authentication method executed by an authentication server, the method comprising:
a sending step of making an authentication request to a terminal device via a communication unit connected to a network;
an acquisition step of receiving, directly from the terminal device via the communication unit, a verification result of a signature generated by an authenticator together with an ID and a password of a user;
a verification step of determining that FIDO authentication is completed with the verification result of the signature, and verifying the ID and the password of the user;
a sending step of sending a first challenge to the terminal device via the communication unit, wherein the terminal device issues a second challenge to the authenticator following receipt of the first challenge, and receives a signature of the second challenge and a public key from the authenticator;
a receiving step of receiving a signature of the first challenge generated by the terminal device as a response from the terminal device that has performed the FIDO authentication; and
a verification step of verifying the signature of the first challenge sent from the terminal device as a response,
wherein the signature of the first challenge is generated when authentication is successful as a result of performing signature verification using the public key.
13. An authentication program causing a computer that functions as a terminal device to execute:
a sending procedure of sending a first challenge to an authenticator;
a reception procedure of receiving the first challenge with a signature and a public key from the authenticator;
a verification procedure of performing signature verification using the public key;
a providing procedure of directly providing a verification result of the signature to an authentication server via a communication unit connected to a network;
a receiving procedure of receiving a second challenge sent from the authentication server via the communication unit;
a sending procedure of sending a third challenge different from the second challenge to the authenticator;
a receiving procedure of receiving a signature of the third challenge and a public key from the authenticator;
a generating procedure of generating a signature of the second challenge when authentication is successful as a result of performing signature verification using the public key; and
a transmitting procedure of returning the signature of the second challenge to the authentication server via the communication unit as a response.
14. A non-transitory computer-readable storage medium that stores an authentication program causing a computer that functions as an authentication server to execute:
a sending procedure of making an authentication request to a terminal device via a communication unit connected to a network;
an acquisition procedure of receiving, directly from the terminal device via the communication unit, a verification result of a signature generated by an authenticator together with an ID and a password of a user;
a verification procedure of determining that FIDO authentication is completed with the verification result of the signature, and verifying the ID and the password of the user;
a sending procedure of sending a first challenge to the terminal device via the communication unit, wherein the terminal device issues a second challenge to the authenticator following receipt of the first challenge, and receives a signature of the second challenge and a public key from the authenticator;
a receiving procedure of receiving a signature of the first challenge generated by the terminal device as a response from the terminal device that has performed the FIDO authentication; and
a verification procedure of verifying the signature of the first challenge sent from the terminal device as a response,
wherein the signature of the first challenge is generated when authentication is successful as a result of performing signature verification using the public key.