JP2000250858A - System and method for approving service - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a service approving system capable of flexibly dealing with the change of information in the request source of a service. SOLUTION: This service approving system is provided with a certification server 1 for issuing a certificate to be a certificate to be used for verifying the request source with a request source identifier for identifying the request source to request a service, an information storage 4 for storing information related to the request source of the service and a service server 3 for accepting a service request containing the request source identifier and the said certificate from the request source, verifying the said request source identifier with the said certificate, reading information corresponding to the request source from the said information storage when the request source is certified, discriminating whether a service to the request source is enabled or not on the basis of the read information of the request source and providing the service when the provision of the service is enabled.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a service authorization system and method using a certificate.

[0002]

2. Description of the Related Art A conventional service authorization system using a certificate includes a system shown in FIG.
Hereinafter, a conventional service authorization method will be described with reference to FIG. 1p issues a certificate which is a certificate used when verifying a requester by a requester identifier for identifying a requester who requests a service, and when a certificate is revoked, a certificate revocation list is issued. The authentication server to generate.
Reference numeral 2 denotes a service request source that requests a service based on the request source identifier and the certificate issued by the authentication server 1p. Here, it is shown as a claymant. 3p
Receives a service request including a requester identifier and a certificate from a requester, determines whether or not a service to the requester is possible based on the requester identifier and the certificate, and can provide the service. A service server that provides services in certain cases. Reference numeral 5p denotes a certificate serving as a certificate used when verifying the request source, and is issued by the authentication server 1p. 6 is a service request issued from the request source. Reference numeral 7 denotes a request source identifier for identifying a request source that requests a service. Here, a digital signature is shown as an example. 8p is information used by the service server as information for determining whether or not the service is available, for determining whether or not the service is authorized. It is included in the certificate issued by the authentication server 1p, and is sent to the service server as information included in the certificate when the requester requests a service. It is a certificate used as a certificate used when verifying a request source, and includes information for determining whether service is authorized. 9 is a service provided by the service server. Reference numeral 10 denotes a rejection notification sent to the service request source when the service server determines that the service cannot be provided. Reference numeral 11 denotes a directory server that receives the revocation certificate list generated by the authentication server 1p, and stores and manages the revocation certificate list. 12 is
It is a revocation certificate list that is a list of revoked certificates. This is used to determine whether the certificate issued by the authentication server 1p has been revoked.

Next, the operation will be described with reference to FIG. First, Claymant 2 sends a certificate 5p from the authentication server 1p.
Receive. Next, Claymant 2p requests service 6
To the service server 3p. The certificate 5p stores in advance information 8p for determining whether or not the service is authorized. When the certificate 5p of the claymant 2 is revoked, the authentication server 1p generates a revocation certificate list 12 and stores the revocation certificate list 12 in the directory server 11. Next, an operation from a service request to a provision will be described. Claymant 2 adds digital signature 7 to service request 6. Next, the certificate is passed to the service server 3p together with the certificate 5p. The service server 3p confirms that the service request 6 is indeed from Claymant 2. First, the digital signature 7 is verified using the certificate 5p. Next, the revocation certificate list 12 is acquired from the directory server 11, and it is also confirmed that the certificate 5p has not been revoked. If the verification is successful, information 8p for judging whether service is permitted is extracted from the certificate 5p, and whether service is permitted for the claymant 2 is determined. If the service can be provided, the service server 3p provides the service 9 to the clayman 2. If the service cannot be provided, a rejection notice 10 is passed.

[0004]

As described above, in the prior art, information for judging whether or not to permit the service of Claymant is stored in the certificate. For this reason, when the above information changes, the authentication server must reissue the certificate each time, and the claimant must re-receive the reissued certificate, which makes the certificate management of the entire system complicated. There was a problem. Further, the revocation certificate list as the information on the revocation of the certificate is generated by the authentication server, distributed to the directory server, and uses the stored revocation certificate list. For this reason, there is also a problem that the distribution path of the revocation certificate list, the distribution timing, and the arrangement of the directory server must be carefully considered.

The present invention has been made to solve the above problems. A new information storage to be accessed by the service server is provided, and the information for service authorization determination, which is conventionally stored in a certificate, is stored in the information storage. In this way, an object of the present invention is to eliminate the complexity of certificate management in the entire system and to flexibly cope with a change in the information for determining whether the service is authorized. In addition, by storing the revocation information of the certificate of Claymant in a place accessible by the service server, specifically, in the above-mentioned information storage or another information storage, the distribution path and distribution of the revocation certificate list are provided. An object of the present invention is to eliminate the need to consider timing and directory server arrangement problems.

[0006]

SUMMARY OF THE INVENTION A service authorization system according to the present invention issues an authentication server which issues a certificate which is a certificate used when verifying a request source by a request source identifier for identifying a request source requesting a service. An information storage for storing information about a service request source, a service request including a request source identifier and the certificate received from the request source, and a request source identifier, the certificate, and the information stored in the information storage. And a service server for providing a service when the service can be provided to the request source based on the service request.

[0007] The information storage stores, for each request source, information for judging whether service authorization is possible, which is information for judging whether or not the requested service can be provided. The requester identifier is verified by the above certificate, and if the requester is an authenticated requester,
The information for service permission approval / disapproval determination corresponding to the request source is read from the information storage, and based on the read information for service permission enable / disable determination, it is determined whether or not the service to the request source is possible. The service is provided when the service can be provided.

[0008] The information storage further stores information for certificate revocation determination, which is information for determining whether a certificate issued by the authentication server has been revoked, and the service server further includes: The information for certificate revocation determination is read from the information storage, and it is determined whether the certificate included in the service request has been revoked based on the read information for certificate revocation determination. If the service has expired, no service is provided to the requester.

[0009] The service authorization method further includes a revocation certificate storage for storing information for certificate revocation determination, which is information for determining whether a certificate issued by the authentication server is revoked. The service server further reads information for certificate revocation determination from the revocation certificate storage, and the certificate included in the service request is revoked based on the read certificate revocation determination information. If the certificate has expired, no service is provided to the requester.

[0010] The service authorization method according to the present invention provides an authentication server that issues a certificate as a certificate for verifying whether a requesting source is an authorized requesting source by a requesting source identifier for identifying a requesting source requesting a service. A certificate issuing step of issuing a certificate according to the above, an information storing step of storing information in an information storage for storing information on a service request source, and a service server receiving a service request from the request source, the request source identifier and A service request including a certificate is received from a request source, and it is determined whether or not a service to the request source is possible based on the request source identifier, the certificate and the information stored in the information storage, and the service is determined. And a service providing step of providing a service when the service can be provided.

[0011]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Embodiment 1 FIG. 1 shows a first embodiment which is an example of the present invention. In FIG. 1, components denoted by the same reference numerals as those in FIG. 4 are the same as those in the related art, and thus description thereof will be omitted. Reference numeral 4 denotes an information storage for storing information on service request sources for each request source. Information is stored in the information storage in advance. Storing information in the information storage corresponds to an information storage step. In this embodiment, information for judging service permission is stored. Regarding the following components, points different from the points described based on FIG. 4 will be particularly described. Therefore, what is not specified is the same as that described with reference to FIG. 1
Is an authentication server that issues a certificate. In addition, a certificate issuance step of issuing a certificate is performed. The certificate to be issued does not include the information for judging whether service is authorized. 3
Is a service server that provides services. Also,
Implement a service providing process to provide services. The request source identifier is verified by the certificate, and if the request source is an authenticated request source, information for determining whether the service is authorized is read from the information storage 4 and the read service authorization determination is performed. Based on the information for the, to determine whether the service to the request source is possible,
Providing a service when it is possible. A certificate 5 is a certificate used when verifying the request source. It does not include information for judging service authorization. Reference numeral 8 denotes information for determining whether or not the service is permitted. Information vault 4 instead of certificate 5
Is stored in

Next, the operation will be described with reference to FIG. The point that the Cramant 2 receives the certificate 5 from the authentication server 1 and that the authentication server 1 generates the revocation certificate list 12 and stores the revocation certificate list 12 in the directory server 11 are the same as in the related art. It is.

Next, an operation from a service request to a provision will be described. The Claymant 2 adds a digital signature 7 to the service request 6 and passes it to the service server 3 together with its own certificate 5. The service server 3 that has received the service request confirms that the service request 6 comes from the clayman 2. First, the digital signature 7 is verified using the certificate 5. Next, the revocation certificate list 12 is obtained from the directory server 11, and it is also confirmed that the certificate 5 has not been revoked. If the verification is successful, the service server 3 determines whether to provide a service to the clayman 2 or not. The service server 3
Information 8 for judging service authorization from information storage 4
To get. Next, the service server 3 determines whether or not to provide the service to the clayman 2 based on the acquired information 8 for service permission determination. If the service can be provided, use Service 9 as Claymant 2
, And refusal notice 1 if service cannot be provided
Pass 0. As described above, if the information storage 4 is provided, if the information 8 for determining whether or not the service is permitted for the clayman 2 changes, it is sufficient to change the information in the information storage 4. The Cramant 2 performs the digital signature 7 as before, and passes the same certificate 5 as before to the service server 3, and according to the changed information 8 for judging the new service authorization, the new service is provided. Can be provided.

[0014] As described above, there are a clayman that requests a certain service, an authentication server that issues a certificate to the above-mentioned clayman, and a service server that provides the above-mentioned service. When a service is requested, in a system that passes a certificate to the service server as proof that the claymant is himself, information for judging the service authorization of the claymant is not stored in the certificate, but is stored in the information storage. It is a method of holding.

Embodiment 2 This embodiment is different from the first embodiment in that the revocation certificate list is not stored and managed by the directory server, but is stored in the information storage 4.
Is stored. FIG. 2 shows a second embodiment which is an example of the present invention. Reference numeral 13 denotes information for certificate revocation determination, which is information for determining whether a certificate issued by the authentication server has been revoked. The information storage 4 stores information for judging whether service is permitted and information for judging certificate revocation. Therefore, when the certificate is revoked, the authentication server 1a stores information for certificate revocation determination in the information storage 4 without creating a revocation certificate list. Further, when judging the revocation of the certificate, the service server 3a reads the information 13 for the certificate revocation judgment from the information storage 4, and based on the read information 13 for the certificate revocation judgment, reads the service request. It is determined whether the certificate included in the certificate has expired. If the certificate has expired, no service is provided to the request source.

Next, the operation will be described with reference to FIG. FIG.
, The point that the claymant 2 receives the certificate 5 from the authentication server 1a is the same as the conventional one. Next, an operation from a service request to a provision will be described. Clay cloak 2
Attaches a digital signature 7 to the service request 6 and passes it along with its own certificate 5 to the service server 3a. The service server 3a confirms that the service request 6 comes from the clayman 2. First, the digital signature 7
Is verified using the certificate 5. If the verification is successful, the service server 3a acquires from the information storage 4 the information 8 for judging whether the service is authorized and the information 13 for judging the certificate revocation. Next, the service server 3a confirms that the certificate 5 has not been revoked by the information 13 for certificate revocation determination. Further, the service server 3a determines whether or not to provide a service to the clayman 2 based on the information 8 for determining whether or not to permit the service. If the service can be provided, use Service 9 as Claymant 2
, And refusal notice 1 if service cannot be provided
Pass 0. As in the first embodiment, when the information 8 for determining whether or not the service is permitted for the claymant 2 has changed, it is sufficient to change the information in the information storage 4. Further, in this embodiment, even if the certificate 5 is revoked, the revocation certificate list 12 is generated by the authentication server 1 and distributed via the directory server 11 as shown in FIG. No need. In such a case, it is only necessary to change the information 13 for the certificate revocation determination in the information storage 4. The change of the information 13 for the certificate revocation determination may be performed by the authentication server 1a, but is not limited thereto.

Embodiment 3 This embodiment is different from the second embodiment in that information 1 for certificate revocation determination is used.
3 is not stored in the information storage 4 but stored in a newly provided revocation certificate storage. FIG. 3 shows a third embodiment which is an example of the present invention. A revocation certificate storage 14 stores information 13 for certificate revocation determination, which is information for determining whether a certificate issued by the authentication server 1b has been revoked. In this embodiment, the information storage 4 stores information for judging whether service is permitted. Therefore, when the certificate is revoked, the authentication server 1b stores the information for certificate revocation determination in the revocation certificate storage 14 without creating a revocation certificate list. Further, when judging the revocation of the certificate, the service server 3b reads the information 13 for the certificate revocation judgment from the revocation certificate storage 14 and based on the read information 13 for the certificate revocation judgment. It is determined whether the certificate included in the service request has expired, and if the certificate has expired, no service is provided to the request source.

Next, the operation will be described with reference to FIG. In FIG. 3, the claymant 2 receives the certificate 5 from the authentication server 1b before passing the service request 6 to the service server 3b. In the operation from the service request to the provision of the service, the operation of the service server 3b to determine whether or not to provide the service is performed when the certificate is revoked. Information 13
Is different from the second embodiment. Therefore, when the certificate 5 is revoked, it is only necessary to change the information 13 for the certificate revocation determination in the revoked certificate storage 14. By separating the revocation certificate vault 14 from the information vault 4,
The information 13 for the certificate revocation determination and the information 8 for the service permission determination can be managed independently.

Embodiment 4 In the above-mentioned embodiment, a new storage for storing information called the information storage 4 or the revocation certificate storage 14 is newly installed, and the information 8 for judging whether the service is authorized and the information 13 for judging the certificate revocation are newly installed. Although the case where it stores in the hangar shown was shown, it is possible to install another hangar in the above-mentioned hangar. further,
If the information is related to the request source, the information 8 for determining whether the service is authorized and the information 1 for determining whether the certificate has been revoked are described above.
It is also possible to store information other than 3 in the storage.

[0020]

According to the service authorization method and method according to the present invention, even if the information for judging whether or not the service authorization for the clayman is changed, only the information in the information storage needs to be changed. It is not necessary to issue a new certificate or to have Claymant receive and store it. Therefore, the management of the certificate is not complicated in the entire system, and it is possible to flexibly cope with a change in the information of the service authorization availability determination.

By storing the revocation information of the certificate of Claymant as information for determining the revocation of a certificate in the above-mentioned information storage or by storing it in the revocation certificate storage, It becomes possible to avoid having to pay attention to the distribution route, the distribution timing, and the arrangement of the directory server.

[Brief description of the drawings]

FIG. 1 is a diagram showing a first embodiment which is an example of the present invention.

FIG. 2 is a diagram showing a second embodiment which is an example of the present invention;

FIG. 3 is a diagram showing a third embodiment which is an example of the present invention;

FIG. 4 is a diagram showing an embodiment corresponding to a conventional technique.

[Explanation of symbols]

1a, 1b, 1p authentication server, 2 Claymant,
3, 3a, 3b, 3p service server, 4 information storage, 5, 5p Cramant certificate, 6 service request, 7 digital signature attached to 7 Clamant service request, information for 8,8p service authorization judgment ,
9 service, 10 service refusal notice, 11 directory server, 12 revocation certificate list, 13 information for certificate revocation judgment, 14 revocation certificate storage

Claims (5)

[Claims] An authentication server for issuing a certificate serving as a certificate used when verifying a request source by a request source identifier for identifying a request source of a service, and an information storage for storing information on a service request source. Receiving a service request including a requester identifier and the certificate from the requester, and determining whether a service to the requester is possible based on the requester identifier, the certificate, and the information stored in the information storage. And a service server for providing a service when the service can be provided. 2. The information storage stores, for each request source, information for judging whether or not the requested service can be provided, which is information for judging whether or not the requested service can be provided. The request source identifier is verified by the certificate, and if the request source is an authenticated request source, information for judging service authorization corresponding to the request source is read from the information storage, and the read service authorization is read. 2. The service authorization according to claim 1, wherein it is determined whether or not the service to the request source is possible based on the information for determining whether or not the service is available, and the service is provided when the service can be provided. method. 3. The information storage further stores information for certificate revocation determination, which is information for determining whether a certificate issued by the authentication server has been revoked. Further, information for certificate revocation determination is read from the information storage, and based on the read information for certificate revocation determination, it is determined whether the certificate included in the service request has been revoked, 3. The service authorization method according to claim 1, wherein the service is not provided to the requester when the certificate has expired. 4. The service authorization system further includes a revocation certificate storage for storing information for certificate revocation determination, which is information for determining whether a certificate issued by the authentication server has been revoked. The service server further reads information for certificate revocation determination from the revocation certificate storage, and revoked the certificate included in the service request based on the read certificate revocation determination information. 3. The service authorization system according to claim 2, wherein it is determined whether the certificate has been expired, and if the certificate has expired, no service is provided to the request source. 5. A certificate that issues a certificate by an authentication server that issues a certificate as a certificate for verifying whether a request source is an authorized request source by a request source identifier that identifies a request source that requests a service. A service request including a request source identifier and the certificate by a service server that receives the service request from the request source; and a service server that receives the service request from the request source. Is received from the requestor, and it is determined whether or not the service to the requester is possible based on the requester identifier, the certificate, and the information stored in the information storage, and the service can be provided. A service providing step of providing a service to the service.