JP2002328901A - User authentication system, user authentication starting method, user authentication program and storage medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve convenience of a user for whom a user authentication is executed by eliminating a need for the user to start an authentication function intentionally. SOLUTION: A user authentication starting part 24 is provided to a terminal 1 on a network 20, which, in accessing, judges whether a request for an access is made to a network or a system needing a user authentication. When the request for the access is made, the user authentication function is started automatically, thereby eliminating the user's need to start the authentication function intentionally.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a user authentication system, a user authentication start method, a user authentication start program, and a recording medium, and more particularly, to a user authentication required for accessing a network or a system on the network. It relates to the improvement of the interface when receiving.

[0002]

2. Description of the Related Art In recent years, information systems using networks such as the Internet and an intranet have been widely used. In this information system, it is an important issue how to prevent illegal intrusion, information leakage, falsification, and obstruction of operation of the information system itself by others. There are several technologies as security systems for protecting the security of information systems, and one of them is a user authentication technology.

[0003] A typical user authentication technique is a password. That is, each user enters a unique password assigned to him / her from a keyboard or the like,
If the password is verified and verified by the personal authentication system, access to a network or a system on the system can be made.

However, in recent years, hacking techniques have been improved, and stealing passwords has become easier. Therefore, it is practically impossible to completely prevent unauthorized access by others with user authentication using a password. Therefore, recently, a user authentication technique using an IC card that is difficult to decipher has been used.

[0005] More recently, a so-called biometrics authentication technique for identifying an individual using a fingerprint, voice, face, or the like has attracted attention and has been developed. Also, a technology combining this with an IC card has been developed. For example, a user's fingerprint data is stored in an IC card, and when the user uses a network or the like, the IC card is inserted into a terminal to verify the fingerprint data of the user himself. If the fingerprint data is correct, access to the network is permitted. It was made.

FIG. 4 is a diagram showing a configuration example of a network system to which the user authentication technology is applied. In the system shown in FIG. 4, first and second terminals 101 and 102 and a personnel / payroll server 106 are connected via a network 110. A database 107 is connected to the personnel / payroll server 106 and stores various data relating to personnel / payroll. The various data also include personal information on the individual's educational background, punishment, medical history, health status, salary, and the like.

[0007] First and second terminals 101 and 102 and personnel
A personal authentication device 105 is installed between the pay server 106 and the pay server 106. The personal authentication device 105 is the database 1
In order to avoid inconveniences such as data on 2007 being falsified or personal information being stolen, processing relating to user authentication is performed in order to permit only specific users to access the personnel / payroll server 106. It is.

The first terminal 101 has an IC card 104
Dedicated reader 103 is connected. The IC card 104 includes authentication information (user status information,
Or biometric information such as fingerprints, voices, faces, etc.)
Is stored.

Conventionally, when the user of the first terminal 101 accesses the personnel / payroll server 106 via the network 110, the following procedure is performed. First, the user clicks the icon for executing user authentication displayed on the screen of the first terminal 101. Then, the user inserts the IC card 104 into the dedicated reader 103 according to the instruction displayed on the screen, and inputs his / her authentication information to the first terminal 10.
Let 1 read.

[0010] The first terminal 101 sends the read authentication information to the personal authentication device 105. The personal authentication device 105
Check the authentication information sent from the first terminal 101,
If correct, access to the personnel / payroll server 106 is permitted. When access to the personnel / payroll server 106 is permitted, the fact is notified to the first terminal 101 and displayed as a message on the screen.

[0011] The user who sees this message can use the personnel / payroll server 106 displayed on the screen of the first terminal 101.
Click the icon for launching. Then, the initial screen provided by the personnel / pay server 106 is activated, and the service provided by the personnel / pay server 106 can be subsequently received.

[0012]

By using the above-mentioned user authentication technique, it is possible to enhance the security of a system connected on a network. However, in the above-described conventional technology, it is necessary to intentionally activate a user authentication function by clicking a user authentication execution icon before a user accesses a target system.

[0013] As a human psychology, when trying to use a certain system, it is usual to directly start the system. Therefore, prior to starting the target system, the conventional mechanism that requires the user authentication function to be started in order to perform extra work completely unrelated to the intended purpose is extremely difficult for the user. Was troublesome. Also, the user authentication function and the function of the target system have to be activated each time by clicking the icon, so that the operation is very troublesome.

The present invention has been made to solve such a problem, and eliminates the need for a user to intentionally activate an authentication function, thereby improving the convenience of a user who performs user authentication. The purpose is to be able to.

[0015]

A user authentication system according to the present invention determines whether or not an access request has been made to a network requiring user authentication or a system on the network when accessing. When,
When the determination means determines that an access request has been made to a network or a system requiring the user authentication, a user authentication activation means for activating the user authentication function is provided.

The method for activating user authentication according to the present invention includes an access determining step of determining whether an access request has been made to a network requiring user authentication or a system on the network when accessing. And a user authentication activation step of activating the user authentication function when it is determined in the access determination step that an access request has been made to the network or system requiring the user authentication. .

In another aspect of the present invention, an access determining step for determining whether an access request has been made to a network requiring user authentication or a system on the network when accessing, An authentication success / failure judging step for judging whether or not the user authentication has already been established when it is judged that an access request has been made to the network or system requiring the user authentication in the step, And a step of activating the user authentication function when it is determined that the user authentication has not been established yet.

In another aspect of the present invention, the access determining step includes a first step of determining whether any access request has been made, and a determination that the some access request has been made in the first step. And determining whether the access request is an access request to the network or system requiring user authentication.

Further, the user authentication activation program according to the present invention includes an access determining procedure for determining whether an access request has been made to a network requiring user authentication or a system on the network when accessing the program, and When the access determination step determines that an access request has been made to the network or system that requires the user authentication, the computer executes a user authentication activation procedure that activates the user authentication function. is there.

According to another aspect of the present invention, there is provided an access determining procedure for determining whether an access request has been made to a network requiring user authentication or a system on the network when accessing, When it is determined that an access request has been made to the network or system requiring user authentication, an authentication success / failure determination procedure for determining whether user authentication has already been established, and an authentication success / failure determination procedure This is for causing a computer to execute a user authentication activation procedure for activating the user authentication function when it is determined that the user authentication has not been established yet.

A computer-readable recording medium according to the present invention is characterized by recording a program for causing a computer to execute the procedures described in any one of claims 5 and 6.

[0022]

DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing a functional configuration of a user authentication system according to the present embodiment.
1 is a diagram illustrating a configuration of an entire network system to which a user authentication system according to the present embodiment is applied.

In FIG. 2, 1, 2 and 3 are terminals composed of a personal computer or the like, 9 is a file server, 10
Is a mail server, 11 is a personnel / payroll server, and 12 is an accounting / financial server, which are connected via a network 20 so that they can communicate with each other.

The file server 9 performs processing such as file transfer, deletion, and directory operation. The mail server 10 transmits an e-mail based on a request from the terminals 1, 2, and 3, stores the received e-mail, and
It performs processing such as handing over when there is an inquiry from 2 and 3. The personnel and salary server 11 performs various processes related to personnel and salary in a company. The accounting and finance server 12
Performs various accounting and financial processes within a company. In addition,
Known servers can be used for these various servers 9 to 12, and a detailed description of the processing content is omitted here.

Reference numeral 8 denotes a router, which is installed at an appropriate position on the network 20. Data transmitted from a certain computer over the network 20 must be
Delivered to the target computer via. The router 8 refers to the routing information (routing table) of the router 8 based on the destination IP address in the IP header, determines the next node to be transferred, and transfers the data.

Reference numeral 13 denotes a personal authentication device, which is installed between the first to third terminals 1 to 3 and the personnel / payment server 11 and the accounting / finance server 12. Personal authentication device 13
User authentication based on authentication information sent from the first and second terminals 1 and 2 in order to permit only specific users to access the personnel / payment server 11 and the accounting / finance server 12 Related processing.

The first terminal 1 is connected to a dedicated reader 4 of an IC card 5. The IC card 5 includes, for example, personnel
Authentication information (user status information, bio information such as a fingerprint, etc.) relating to a user who has access to the pay server 11 is stored. The user of the first terminal 1 can freely access the file server 9 and the mail server 10, and
By receiving the user authentication by using, the personnel / payment server 11 can be accessed.

The second terminal 2 is connected to a dedicated reader 6 of an IC card 7. The IC card 7 stores, for example, authentication information (user status information, bio information such as a fingerprint, etc.) relating to a user who has access to the accounting and financial server 12. The user of the second terminal 2 has a file server 9 and a mail server 10
Can be freely accessed, and by receiving user authentication using the IC card 7, it is also possible to access the accounting and financial server 12.

The third terminal 3 does not have a function for receiving user authentication. That is, the user of the third terminal 3 includes the personnel / payroll server 11 and the accounting / financial server 1
2 has no access right to the file server 9 and the mail server 10.

Here, the first and second terminals 1, 1
Although the dedicated readers 4 and 6 for the IC cards 5 and 7 are provided externally, the first and second terminals 1 and 2 themselves may have the function of reading the IC cards 5 and 7.
Although the IC cards 5 and 7 are used for user authentication here, the present invention does not particularly limit the user authentication method. For example, another user authentication technique such as a password may be used.

Here, those requiring user authentication for access are the personnel / payment server 11 and the accounting / financial server 12, but the present invention is not limited to these servers. For example, user authentication by the personal authentication device 13 may be used as a prerequisite for access to another server (not shown), the file server 9, the mail server 10, or a host computer (not shown).

FIG. 1 is a block diagram showing an example of the functional configuration of the first terminal 1 shown in FIG. Note that the second terminal 2 is also configured in the same manner as the first terminal 1, so that the illustration is omitted here. In FIG. 1, a communication unit 21 performs a process related to data transmission and reception via the network 20. Reference numeral 22 denotes an authentication processing unit that performs processing related to user authentication in cooperation with the personal authentication device 13.

The authentication processing unit 22 has a function of taking in authentication information in the IC card 5 read by the dedicated reader 4 and transmitting the authentication information to the personal authentication device 13 via the communication unit 21. In addition, it also has a function of capturing and retaining authentication permission information sent from the personal authentication device 13 via the communication unit 21. It is possible to access the personnel / payroll server 11 only while the authentication processing unit 22 holds the authentication permission information.

Reference numeral 23 denotes an access request unit which performs processing for requesting a user to access the file server 9, the mail server 10, and the personnel / payroll server 11. Specifically, the access request unit 23 displays a GUI (Graphical Usual) displayed on the screen of the first terminal 1.
er Interface). By clicking this icon with the mouse, the user requests access to the file server 9, the mail server 10, or the personnel / payroll server 11.

The method of activating these servers 9, 10, 11 is not limited to the method of activating using the icons. For example, it is needless to say that an access to each of the servers 9, 10, and 11 may be requested by selecting a start-up menu displayed in a pop-up or pull-down menu from the menu bar. In the present invention, the starting method of each of the servers 9, 10, and 11 is not particularly limited.

Reference numeral 24 denotes a user authentication activation unit, which automatically activates a function for performing user authentication by the authentication processing unit 22 when an access request to the personnel / payment server 11 is made by the access request unit 23. . This requests the user to insert the IC card 5 into the card slot of the dedicated reader 4. In response to this, the user inserts the IC card 4 into the dedicated reader 5, causes the first terminal 1 to read his / her authentication information, and executes user authentication.

The user authentication activating section 24 corresponds to the determining means and the user authentication activating means of the present invention. Actually, the CPU or MPU, R of the first terminal 1
The functional configuration of the user authentication start unit 24 described above is realized by operating a program stored in the RAM or the ROM, which is configured by an AM, a ROM, and the like.

Accordingly, a program that causes the first terminal 1 to perform the function of the user authentication activation unit 24 is recorded on a recording medium such as a CD-ROM, and is read by a computer. is there. As a recording medium for recording the above program,
In addition to a CD-ROM, a floppy (registered trademark) disk, a hard disk, a magnetic tape, an optical disk, a magneto-optical disk, a DVD, a nonvolatile memory card, and the like can be used. In addition, the above program is transferred to the network 20
May be downloaded from another computer via the Internet.

When the first terminal 1 executes the supplied program, not only the function of the user authentication activation unit 24 is realized, but also the program is executed by the first terminal 1.
When the above-mentioned functions are realized in cooperation with an OS (operating system) or other application software running on the terminal, or when all or a part of the processing of the supplied program is expanded in function of the first terminal 1 Such a program is also included in the embodiment of the present invention when the above-described functions are realized by a board or a function expansion unit.

FIG. 3 is a flowchart showing the operation of the user authentication activation unit 24. In FIG. 3, the user authentication activation unit 24 monitors whether an access request has been made by the access request unit 23 (step S1). If any access request is made, it is determined whether the request is an access request to the personnel and payroll server 11 (step S2).

Here, it is determined whether or not the access request is for the personnel / payment server 11 by checking whether the IP address of the personnel / payment server 11 matches the IP address for which the access request was made. I do. I of the personnel and payroll server 11 that requires user authentication
The P address may be specified in advance.

If the request is not an access request to the personnel / payroll server 11, that is, if it is a request to access the file server 9 and the mail server 10, the user can freely access without performing user authentication. Step S1 without performing any processing
Return to In this case, the function of the file server 9 or the mail server 10 requested to access is executed (not shown).

On the other hand, if the request is an access request to the personnel / payroll server 11, it is determined whether or not user authentication has already been performed and has been established (step S3). Whether or not the user authentication has already been established can be determined by checking whether or not the authentication processing unit 22 holds the authentication permission information.

Note that the method of determining the success or failure of the user authentication is not limited to this example. For example, when an access request to the personnel / payroll server 11 is made, an inquiry may be made to the personal authentication device 13 via the communication unit 21 as to whether the user authentication has been successful. In this case, the personal authentication device 13 holds the authentication permission information.

In the present embodiment, an icon for executing user authentication is also displayed on the screen of the first terminal 1 in the same manner as in the related art, and the user authentication function is intentionally activated by clicking this icon. Also make it possible. Therefore, when an access request is made to the personnel / payroll server 11, user authentication may have already been established. If user authentication has already been established,
It returns to step S1.

On the other hand, when the user authentication has not been established yet (when the user authentication processing has not been performed yet), the function for performing the user authentication is automatically activated by the authentication processing unit 22 (step S4). . In response to this, the user follows the instruction displayed on the screen of the first terminal 1
The user inserts the C card 4 into the dedicated reader 5 and causes the first terminal 1 to read his / her authentication information to execute user authentication.

Here, the operation of the user authentication activation unit 24 when an access request to the personnel / payment server 11 is made at the first terminal 1 has been described. Similar processing is performed by the user authentication activation unit 24 in the second terminal 2 when an access request to the terminal 12 is made.

As described in detail above, in the present embodiment, the user authentication program is automatically started when an access to a specified server that requires user authentication occurs. Need not intentionally activate the authentication function.

Thus, the user only has to perform an operation according to his / her own purpose, that is, what he wants to do.
This eliminates the hassle of activating the authentication function. Further, the user only has to click the icon once to access the target server, and it is not necessary to click the icon separately for user authentication. Therefore, 1
Access to the target server and activation of the authentication function can be performed by a single click operation, and the operation procedure of the user can be simplified.

In the present embodiment, when the user accesses the designated server that requires user authentication, if the user authentication has already been completed, the user authentication function is not activated again. That is, according to the present embodiment, unnecessary automatic activation of the user authentication function can be prevented.

The embodiment described above is merely an example of a concrete example for carrying out the present invention, and the technical scope of the present invention should not be interpreted in a limited manner. It is. That is, the present invention can be embodied in various forms without departing from the spirit or main features thereof.

[0052]

As described above, according to the present invention, when accessing, it is determined whether or not an access request has been made to a network or system requiring user authentication, and such an access request has been made. Since the user authentication function is sometimes activated, it is not necessary for the user to intentionally activate the user authentication function. As a result, the user is not bothered to activate the authentication function before executing the intended use, and the user can access the target system and activate the authentication function with a single operation. And the user's operation procedure can be simplified. As described above, according to the present invention, the convenience of a user who performs user authentication can be improved.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating an example of a functional configuration of a first terminal according to an embodiment.

FIG. 2 is a diagram showing a configuration of an entire network system to which a user authentication system according to the embodiment is applied.

FIG. 3 is a flowchart illustrating an operation of a user authentication activation unit provided in the first terminal according to the embodiment;

FIG. 4 is a diagram showing a configuration of an entire conventional network system.

[Explanation of symbols]

 1, 2, 3 Terminal (personal computer) 4, 6 Dedicated reader 5, 7 IC card 8 Router 9 File server 10 Mail server 11 Personnel / payment server 12 Accounting / financial server 13 Personal authentication device 21 Communication unit 22 Authentication processing unit 23 Access request unit 24 User authentication start unit

Claims (7)

[Claims] 1. A determining means for determining whether an access request has been made to a network requiring user authentication or a system on the network at the time of access, and the user authentication is required by the determining means. A user authentication system comprising: a user authentication activation unit that activates the user authentication function when it is determined that an access request has been made to a network or a system. 2. An access determining step for determining whether or not an access request has been made to a network requiring user authentication or a system on the network when accessing, and the user authentication is performed in the access determining step. A user authentication activation step of activating the user authentication function when it is determined that an access request has been made to a required network or system. 3. An access determining step for determining whether an access request has been made to a network requiring user authentication or a system on the network at the time of access; When it is determined that an access request has been made to a required network or system, an authentication success / failure determining step of determining whether or not user authentication has already been achieved; and A user authentication activation step of activating the user authentication function when it is determined that the user authentication is not established. 4. The access determining step includes: a first step of determining whether any access request has been made; and determining that the access request has been made in the first step, 4. The method according to claim 2, further comprising: determining whether the request is an access request to a network or a system requiring user authentication. 5. An access judging step for judging whether an access request has been made to a network requiring user authentication or a system on the network at the time of access, and the user authentication being carried out by the access judging step. A user authentication activation program for causing a computer to execute a user authentication activation procedure for activating the user authentication function when it is determined that an access request has been made to a required network or system. 6. An access determining procedure for determining whether or not an access request has been made to a network requiring user authentication or a system on the network when accessing, and the user authentication is required in the access determining procedure. When it is determined that an access request has been made to a new network or system, an authentication success / failure determination procedure for determining whether or not user authentication has already been established, and the user authentication has still been established in the authentication success / failure determination procedure A user authentication activation program for causing a computer to execute a user authentication activation procedure for activating the user authentication function when it is determined that the user authentication has not been performed. 7. A computer-readable recording medium on which a program for causing a computer to execute each of the procedures according to claim 5 or 6 is recorded.