JP2005130524A - Access authentication system, storage medium, program and access authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an access authentication system in which, on the basis of personal information for one server, a user can use other servers providing a variety of services. <P>SOLUTION: The access authentication system comprises: a first authentication server 22 for determining whether or not a client terminal 10 should be connected to a first terminal server, on the basis of personal information inputted from the client terminal, creating first ticket data by encoding a client parameter P and transferring the first ticket data to a second terminal server; and a second authentication server 32 for detecting whether or not the client parameter P is valid and whether or not the first ticket data D1 has been used, creating second ticket data D2 by encoding the client parameter P, comparing the second ticket data D2 and the first ticket data D1, and supplying the second terminal server 31with data indicative of whether or not the second terminal server should be connected to the client terminal 10. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an access authentication system and an access authentication method for a user who has an access right to a predetermined application provider in advance to obtain an access right to a different application provider.

  The user can use a service provider that provides various services such as various information services via the Internet. A service provider refers to a provider that provides data and content to client terminals connected via the Internet and provides information processing services. Each service provider is independent, and the user contracts with the service provider that he / she wants to use, and obtains the access right by having an ID and a password, respectively.

  However, the number of service providers is increasing, and it is troublesome for users to contract with each service provider in managing IDs and passwords. In addition, there is a limit to the types of services that each service provider can provide.

  On the other hand, a method of sharing one ID and password among a plurality of service providers is also conceivable, but since both the ID and password are held by each service provider, in terms of billing and confidentiality There was a problem.

  Therefore, the present invention provides only personal information (ID and password) for one server (service provider) without disclosing all personal information to other servers (service providers) that provide various services. An object of the present invention is to provide an access authentication system, a storage medium, a program, and an access authentication method for enabling use.

  In order to solve the above problems and achieve the object, an access authentication system, a storage medium, a program, and an access authentication method of the present invention are configured as follows.

(1) In an access authentication system for providing a connection service to a second terminal server to a client via the first terminal server, based on individual information input from the client to the first terminal server Authenticating whether or not the client can connect to the first terminal server, creating first ticket data in which client parameters including a part of the personal information are encoded according to a predetermined rule, and generating the second ticket A first authentication server to be transferred to the terminal server, and the second ticket data obtained by verifying the validity of the client parameter and whether or not the first ticket data is exercised, and encoding the client parameter according to a predetermined rule And the second ticket data and the first ticket data Matches, characterized in that a second authentication server that instructs the connection possibility of the client to the second terminal server.

(2) In the access authentication system described in (1) above, the predetermined rule is a summary by a one-way function.

(3) In the access authentication system described in (1) above, the client parameter includes at least one of the client ID, the access source IP address, and the expiration date of the first ticket data. It is characterized by.

(4) In the access authentication system described in (1) above, when the first and second ticket data are created in the first and second authentication servers, a predetermined common Character strings are included.

(5) In the access authentication system described in (4) above, the common character string is changed at a predetermined timing.

(6) In an access authentication system for providing a connection service to the second terminal server to the client via the first terminal server, based on the ID and password input from the client to the first terminal server In addition to authenticating whether or not the client can connect to the first terminal server, the client parameter consisting of the ID, the access source IP address of the client, a predetermined expiration date, and a common character string is encoded according to a predetermined rule. The first authentication server that creates the first ticket data and transfers it to the second terminal server, the access source IP address input from the client to the second terminal server, and the client parameter Match the access source IP address of Determining whether the access is within the expiration date, determining whether the first ticket data is exercised, creating second ticket data in which the client parameters are encoded according to the predetermined rule, And a second authentication server for instructing the second terminal server to determine whether or not the client can be connected by collating the second ticket data with the first ticket data. .

(7) In an access authentication system that provides a connection service to the second terminal server to the client via the first terminal server, the first terminal server acquires the individual information input from the client in the first terminal server. Specific information acquisition means, first authentication means for authenticating the connection of the client to the first terminal server based on the individual information, and a client parameter including a part of the personal information as a predetermined parameter. First ticket data creation means for creating first ticket data encoded by rules, transfer means for transfer to the second terminal server, and individual information input from the client in the second terminal server A second individual information acquisition means for acquiring a personal information and a client including a part of the personal information The second ticket data in which the parameters are encoded according to a predetermined rule is created, the second ticket data is compared with the first ticket data, and the connection of the client to the second terminal server is authenticated. And a second authentication means.

(8) The access authentication system according to (7), wherein the predetermined rule is a summary by a one-way function.

(9) In the access authentication system described in (7) above, the first and second ticket data creation means are predetermined when creating the first and second ticket data. A common character string is included.

(10) The access authentication system according to (7), wherein the second authentication unit determines the validity of the first ticket data.

(11) The access authentication system according to (7), wherein the second authentication unit includes determining validity of the client parameter.

(12) In an access authentication system that provides a connection service to a client via a first terminal server, a first individual information acquisition unit that acquires individual information from the client, and the first information based on the individual information First authentication means for authenticating whether or not the client can connect to the terminal server, and when authentication is permitted by the first authentication means, a client parameter including at least a part of the individual information is set to a predetermined rule. The first ticket data creating means for creating the first ticket data encoded in step 1 and the transfer means for transferring the first ticket data.

(13) In an access authentication system for providing a connection service to a second terminal server for a client, a first ticket data obtained by encoding a client parameter including a part of individual information of the client according to a predetermined rule is acquired. 1 ticket data acquisition means, a second individual information acquisition means for acquiring individual information from the client, and a client parameter including a part of the individual information acquired by the second individual information acquisition means The second ticket data creating means for creating the second ticket data encoded according to the above rule, the second ticket data and the first ticket data are collated, and the client is sent to the second terminal server. And determining means for determining whether or not connection is possible.

(14) In a computer-readable storage medium storing a program for operating a computer, the program includes first individual information acquisition means for acquiring individual information from a client in a first terminal server, and the individual information. A first authenticating means for authenticating whether or not the client can connect to the first terminal server, and a client including at least a part of the individual information when the connection of the client is permitted First ticket data creation means for creating first ticket data in which parameters are encoded according to a predetermined rule; transfer means for forwarding the first ticket data to a second terminal server; and the second terminal A first ticket for acquiring the first ticket data in the server Data acquisition means, second individual information acquisition means for acquiring individual information from the client in the second terminal server, and client parameters including a part of the individual information encoded by the predetermined rule Second ticket data creating means for creating the second ticket data, the first ticket data and the second ticket data are collated to authenticate whether the client can connect to the second terminal server. And a second authentication means.

(15) In a computer-readable storage medium storing a program for operating a computer, the program includes first individual information acquisition means for acquiring individual information from a client in a first terminal server, and the individual information. A first authenticating means for authenticating whether or not the client can connect to the first terminal server, and a client including at least a part of the individual information when the connection of the client is permitted It is characterized by comprising first ticket data creating means for creating first ticket data in which parameters are encoded according to a predetermined rule, and transfer means for transferring the first ticket data.

(16) In a computer-readable storage medium storing a program for operating a computer, the program encodes a client parameter including a part of the individual information in a second terminal server according to a predetermined rule. First ticket data acquisition means for acquiring first ticket data, second individual information acquisition means for acquiring individual information from the client in the second terminal server, and a client including a part of the individual information Second ticket data creating means for creating second ticket data in which parameters are encoded according to the predetermined rule, the first ticket data and the second ticket data are collated, and the second terminal Second authentication means for authenticating whether the client can connect to the server Characterized in that it comprises a.

(17) In a program for operating a computer, a first individual information acquisition means for acquiring individual information from a client in a first terminal server, and the client to the first terminal server based on the individual information First authentication means for authenticating whether or not the connection of the client is permitted, and a first ticket in which a client parameter including at least a part of the individual information is encoded according to a predetermined rule when the connection of the client is permitted. First ticket data creating means for creating data, transfer means for transferring the first ticket data to the second terminal server, and first ticket data for acquiring the first ticket data in the second terminal server Ticket data acquisition means and the second terminal server Second individual information acquisition means for acquiring individual information from an ant, and second ticket data generation means for generating second ticket data in which client parameters including a part of the individual information are encoded according to the predetermined rule And second authentication means for verifying whether the client can connect to the second terminal server by comparing the first ticket data with the second ticket data. .

(18) In a program for operating a computer, a first individual information acquisition means for acquiring individual information from a client in a first terminal server, and the client to the first terminal server based on the individual information First authentication means for authenticating whether or not the connection of the client is permitted, and a first ticket in which a client parameter including at least a part of the individual information is encoded according to a predetermined rule when the connection of the client is permitted. It is characterized by comprising first ticket data creating means for creating data and transfer means for transferring the first ticket data.

(19) In a program for operating a computer, a first ticket that causes the second terminal server to acquire the first ticket data obtained by encoding a client parameter including a part of individual client information according to a predetermined rule. A data acquisition means; a second individual information acquisition means for acquiring individual information from the client in the second terminal server; and a second parameter obtained by encoding a client parameter including a part of the individual information according to the predetermined rule. Second ticket data creation means for creating the ticket data, and the first ticket data and the second ticket data are collated to authenticate whether or not the client can connect to the second terminal server. And 2 authentication means.

(20) In an access authentication method for providing a connection service to a second terminal server to a client via the first terminal server, a first authentication for authenticating whether or not the client can connect to the first terminal server An authentication step, a first ticket data creation step for creating first ticket data in which a client parameter including at least a part of individual information input from the client is encoded according to a predetermined rule, and the second terminal server A data transfer step for transferring the client parameter and the first ticket data, and a verification step for verifying the validity of the client parameter and whether or not the first ticket data is exercised in the first terminal server, The above client parameters are A second ticket data creating step for creating second ticket data encoded according to a rule; a ticket data collating step for collating the second ticket data with the first ticket data; the verifying step; and the ticket And a second authentication step for instructing the second terminal server whether or not the client can be connected based on a result in the data collating step.

  According to the present invention, the client can use only personal information (ID and password) for one server (service provider), and other servers (service providers) that provide various services can receive all of the personal information. It can be used without disclosure.

  FIG. 1 is a diagram showing a configuration of an access authentication system according to an embodiment of the present invention. FIGS. 2A and 2B are blocks showing a configuration of authentication servers 22 and 32 incorporated in the access authentication system. FIG. 3 and FIG. 3 are flowcharts showing the access authentication procedure. Note that this embodiment includes a case where it is realized by software processing.

  In FIG. 1, 10 is a user's client terminal, 20 is a service provider service provider in contract with the user, 30 is a service provider service provider not in direct contract with the user, 40 is an Internet line, and 50 is a telephone. Indicates a line.

  The service provider service provider 20 includes a terminal server (first terminal server) 21 connected to the Internet line 40 and an authentication server (first authentication) connected to the terminal server 21 and performing authentication as described later. Server) 22, a main server 23 connected to the terminal server 22 and providing information services, and a common character string updating unit 24 connected to a telephone line 50.

  The authentication server 22 includes an authentication unit 22a that authenticates whether or not the connection from the client terminal 10 to the terminal server 21 is based on the ID and password input from the client terminal 10 to the first terminal server 21, and the client terminal An IP address detection unit 22b that detects 10 access source IP addresses, an expiration date generation unit 22c that generates an expiration date of a first ticket (first ticket data) to be described later, a client parameter P, that is, an ID, Using predetermined rules such as summarizing the access source IP address, the expiration date generated by the expiration date generation unit 22c, and the latest common character string updated by the common character string update unit 24 using a one-way function. A ticket data generating unit 22d for generating one ticket data D1, and a client parameter The data P and the first ticket data to the authentication server 32 and a transfer portion 22e for transferring via the Internet 40 and the terminal server 31.

  The service provider service provider 30 includes a terminal server (second terminal server) 31 connected to the Internet line 40, and an authentication server (second authentication) connected to the terminal server 31 and performing authentication as described later. Server) 32, a main server 33 that is connected to the terminal server 31 and provides information services, and a common character string update unit 34 connected to the telephone line 50.

  The authentication server 32 compares the access source IP address input from the client terminal 10 to the terminal server 31 and the access source IP address of the client parameter P transferred from the authentication server 22 described above. 32a, an expiration date determination unit 32b for determining whether the access is within the expiration date, a ticket exercise determination unit 32c for determining whether or not the first ticket data D1 is exercised, and the transferred client parameter P. By collating the ticket data generating unit 32d that creates the second ticket data D2 encoded with the same rule as described above, the second ticket data D2 and the first ticket data D1, Authentication unit 32 for instructing terminal server 31 whether or not connection from client terminal 10 is possible It is equipped with a door.

  The common character string update unit 24 and the common character string update unit 34 hold the same common character string composed of character strings, and are updated regularly.

  With this configuration, when the user accesses the main server 33 from the client terminal 10, the following is performed. That is, the user connects from the client terminal 10 to the terminal server 21 via the Internet line 40. At this time, the user inputs his / her ID and password on the login screen provided by the service provider (ST10). At this time, the terminal server 21 performs arbitrary access restriction (ST11), and if access is prohibited, login is rejected (ST12).

  If access is permitted in ST2, the ID, password, and access source IP address are sent to the authentication server 22, and the authentication unit 22a performs user authentication based on the ID and password (ST13), and authentication fails. In this case, login is rejected (ST14). At this time, access to the main server 23 is permitted.

  When user authentication is successful in ST4, the IP address detection unit 22b detects the access source IP address of the client terminal 10, and the expiration date generation unit 22c generates the expiration date of the first ticket data D1. Then, in the ticket data generation unit 22d, the client parameter P (ID, access source IP address, expiration date, common character string) is summarized by a one-way function to create first ticket data D1 (ST15).

  Next, the transfer unit 22e transfers the client parameter P and the first ticket data D1 to the authentication server 32 via the Internet line 40 and the terminal server 31 (ST16).

  In the authentication server 32 of the service provider service provider 30, the access source IP address input from the client terminal 10 to the access source IP address verification unit 32a terminal server 31 by the access source IP address verification unit 32a and the authentication server described above. 22 is compared with the access source IP address of the client parameter P transferred from the client 22 (ST20). If they do not match, the login is rejected (ST21).

  Next, the expiration date determination unit 32b determines whether or not the access is within the expiration date (ST22). If the expiration date has passed, it is invalidated and login is rejected (ST23).

  Next, the ticket exercise determination unit 32c determines whether or not the first ticket data D1 is exercised (ST24), and if it has already been exercised, the login is rejected (ST25).

  Next, the ticket data generation unit 32d creates the second ticket data D2 obtained by summarizing the transferred client parameter P with the above-described one-way function, and collates with the first ticket data D1 (ST26). In this case, login is rejected (ST27).

  Next, it is searched whether or not the ID has already been registered (ST28). If it has been registered, the process proceeds to ST30 to be described later. If it has not been registered, the ID is created (ST29). Then, login to the main server 33 becomes possible (ST30).

  In the case of such an access authentication system, when the client parameter P is transferred from the service provider service provider 20 to the service provider service provider 30, the client parameter P is intercepted by some method, Even if the parameter P is falsified and an unauthorized access is attempted, the first ticket data D1 and the second ticket data D2 created based on the falsified client parameter P do not match, and login is rejected. .

  In addition, by creating the first ticket data D1 based on the altered client parameter P, it is possible to log in to the new service provider service provider 30. However, it is necessary to know a common character string to create the first ticket data D1. Moreover, it is conceivable that this common character string is obtained by intruding into the authentication servers 22 and 32, estimated by the brute force method, or derived by reverse operation of a one-way function. By setting the update sufficiently short, it becomes difficult to obtain a practically common character string.

  Even if the client parameter P and the first ticket data D1 are to be used, if the expiration date is set sufficiently short, there is a high possibility of access after the expiration date, and login is rejected. .

  Furthermore, even if it is used within the expiration date, the access to the service provider service provider 30 by the authorized user is almost the same as the access to the service provider service provider 20. For this reason, even if a third party intercepts the client parameter P and the first ticket data D1 and tries to use it illegally, the legitimate user has already exercised the first ticket data D1, and the third party's first The ticket data D1 cannot log in.

  On the other hand, when the legitimate user reaches the service provider service provider 30 with the first ticket data D1 generated in a state including the common character string, the common character string is updated and the second The problem that the login data is rejected because the ticket data D2 and the first ticket data D1 are different is solved as follows.

  For example, when a common character string is periodically changed in the order of A, B, C, and D, two types of first character strings are combined by combining two common character strings such as AB, BC, CD,. This is dealt with by creating ticket data D1 and setting so that login is possible if either of the two first ticket data D1 matches the second ticket data D2.

  As described above, according to the access authentication system according to the embodiment of the present invention, the client can provide other services only with an ID and password for one service provider service provider. It can be used without disclosing the password to the provider service provider. Even if the data transferred from the service provider to the service provider service provider is intercepted by a third party, multiple measures are taken to ensure that the service provider There is no unauthorized access to service providers.

  Note that the above-described system may be executed based on an instruction of a program installed in a computer such as each server, or an operating system or middleware running on the computer based on an instruction of the program. Etc. may execute a part of each process.

  The program may be provided in a state stored in a computer-readable storage medium. For example, the storage medium can store a program such as a magnetic disk, floppy disk, hard disk, optical disk (CD-ROM, CD-R, DVD, etc.), MO, semiconductor memory, etc., and can be read by a computer. Anything is acceptable.

  Further, the program may be transmitted via a LAN, the Internet, or the like.

  Note that the present invention is not limited to the above-described embodiment, and various modifications can be made without departing from the scope of the present invention.

The figure which shows the structure of the access authentication system which concerns on one embodiment of this invention. The block diagram which shows the structure of the authentication server integrated in the access authentication system. The flowchart which shows operation | movement of the access authentication system.

Explanation of symbols

10. Client terminal 20 ... Service provider service provider 30 ... Service provider service provider 40 ... Internet line 50 ... Telephone line

Claims (20)

In an access authentication system for providing a connection service to a second terminal server to a client via the first terminal server,
Based on the individual information input from the client to the first terminal server, authenticating the connection of the client to the first terminal server, and including client parameters including a part of the personal information A first authentication server that creates first ticket data encoded according to a predetermined rule and transfers the first ticket data to the second terminal server;
The validity of the client parameter and the presence / absence of exercising the first ticket data are verified, and second ticket data in which the client parameter is encoded according to a predetermined rule is generated. An access authentication system comprising: a second authentication server that collates with the first ticket data and instructs the second terminal server to determine whether or not the client can be connected.   The access authentication system according to claim 1, wherein the predetermined rule is a summary by a one-way function.   The access authentication system according to claim 1, wherein the client parameter includes at least one of an ID of the client, an access source IP address, and an expiration date of the first ticket data.   The access authentication system according to claim 1, wherein the first and second authentication servers include a predetermined common character string when the first and second ticket data are created. .   The access authentication system according to claim 4, wherein the common character string is changed at a predetermined timing. In an access authentication system for providing a connection service to a second terminal server to a client via the first terminal server,
The first terminal server authenticates whether the client can connect to the first terminal server based on the ID and password input from the client, and the ID, the access source IP address of the client A first authentication server that creates first ticket data obtained by encoding a client parameter including a predetermined expiration date and a common character string according to a predetermined rule, and transfers the first ticket data to the second terminal server;
The access source IP address input from the client to the second terminal server is compared with the access source IP address of the client parameter to determine whether the access is within the validity period, and the second terminal server It is determined whether or not one ticket data is exercised, second ticket data in which the client parameter is encoded according to the predetermined rule is created, and the second ticket data is compared with the first ticket data. Thus, an access authentication system comprising: a second authentication server that instructs the second terminal server whether the client can be connected or not. In an access authentication system for providing a connection service to a second terminal server to a client via the first terminal server,
First individual information acquisition means for acquiring individual information input from the client in the first terminal server;
First authentication means for authenticating whether or not the client can connect to the first terminal server based on the individual information;
First ticket data creating means for creating first ticket data obtained by encoding a client parameter including a part of the personal information according to a predetermined rule;
Transfer means for transferring to the second terminal server;
Second individual information acquisition means for acquiring individual information input from the client in the second terminal server;
Creating second ticket data in which client parameters including a part of the personal information are encoded according to a predetermined rule, comparing the second ticket data with the first ticket data, and the second terminal; An access authentication system comprising: second authentication means for authenticating whether the client can be connected to the server.   8. The access authentication system according to claim 7, wherein the predetermined rule is a summary by a one-way function.   The access according to claim 7, wherein the first and second ticket data creating means include a predetermined common character string when creating the first and second ticket data. Authentication system.   8. The access authentication system according to claim 7, wherein the second authentication means determines the validity of the first ticket data.   The access authentication system according to claim 7, wherein the second authentication unit includes determining validity of the client parameter. In an access authentication system that provides a connection service to a client via a first terminal server,
First individual information acquisition means for acquiring individual information from the client;
First authentication means for authenticating whether or not the client can connect to the first terminal server based on the individual information;
First ticket data creation means for creating first ticket data in which a client parameter including at least a part of the individual information is encoded according to a predetermined rule when authentication is permitted by the first authentication means. When,
An access authentication system comprising: transfer means for transferring the first ticket data. In an access authentication system for providing a connection service to a second terminal server for a client,
First ticket data acquisition means for acquiring first ticket data obtained by encoding a client parameter including a part of individual information of the client according to a predetermined rule;
A second individual information acquisition means for acquiring individual information from the client;
Second ticket data creation means for creating second ticket data obtained by encoding client parameters including a part of the individual information acquired by the second individual information acquisition means according to the predetermined rule;
An access authentication system comprising: a judgment unit that collates the second ticket data with the first ticket data and judges whether or not the client can be connected to the second terminal server. In a computer-readable storage medium storing a program for operating a computer, the program is
First individual information acquisition means for acquiring individual information from a client in a first terminal server;
First authentication means for authenticating whether or not the client can connect to the first terminal server based on the individual information;
First ticket data creating means for creating first ticket data in which a client parameter including at least a part of the individual information is encoded according to a predetermined rule when authentication of the client connection is permitted;
Transfer means for transferring the first ticket data to a second terminal server;
First ticket data acquisition means for acquiring the first ticket data in the second terminal server;
Second individual information acquisition means for acquiring individual information from the client in the second terminal server;
Second ticket data creating means for creating second ticket data in which a client parameter including a part of the individual information is encoded according to the predetermined rule;
A storage medium comprising: a second authentication unit that collates the first ticket data with the second ticket data and authenticates whether or not the client can connect to the second terminal server. . In a computer-readable storage medium storing a program for operating a computer, the program is
First individual information acquisition means for acquiring individual information from a client in a first terminal server;
First authentication means for authenticating whether or not the client can connect to the first terminal server based on the individual information;
First ticket data creating means for creating first ticket data in which a client parameter including at least a part of the individual information is encoded according to a predetermined rule when authentication of the client connection is permitted;
A storage medium comprising transfer means for transferring the first ticket data. In a computer-readable storage medium storing a program for operating a computer, the program is
First ticket data acquisition means for acquiring the first ticket data obtained by encoding a client parameter including a part of the individual information according to a predetermined rule in a second terminal server;
Second individual information acquisition means for acquiring individual information from the client in the second terminal server;
Second ticket data creating means for creating second ticket data in which a client parameter including a part of the individual information is encoded according to the predetermined rule;
A storage medium comprising: a second authentication unit that collates the first ticket data with the second ticket data and authenticates whether or not the client can connect to the second terminal server. . In a program for operating a computer,
First individual information acquisition means for acquiring individual information from a client in a first terminal server;
First authentication means for authenticating whether or not the client can connect to the first terminal server based on the individual information;
First ticket data creating means for creating first ticket data in which a client parameter including at least a part of the individual information is encoded according to a predetermined rule when authentication of the client connection is permitted;
Transfer means for transferring the first ticket data to a second terminal server;
First ticket data acquisition means for acquiring the first ticket data in the second terminal server;
Second individual information acquisition means for acquiring individual information from the client in the second terminal server;
Second ticket data creating means for creating second ticket data in which a client parameter including a part of the individual information is encoded according to the predetermined rule;
A program comprising: second authentication means for collating the first ticket data with the second ticket data and authenticating whether or not the client can connect to the second terminal server. In a program for operating a computer,
First individual information acquisition means for acquiring individual information from a client in a first terminal server;
First authentication means for authenticating whether or not the client can connect to the first terminal server based on the individual information;
First ticket data creating means for creating first ticket data in which a client parameter including at least a part of the individual information is encoded according to a predetermined rule when authentication of the client connection is permitted;
A program comprising transfer means for transferring the first ticket data. In a program for operating a computer,
First ticket data acquisition means for acquiring the first ticket data obtained by encoding a client parameter including a part of individual client information in a second rule in a second terminal server;
Second individual information acquisition means for acquiring individual information from the client in the second terminal server;
Second ticket data creating means for creating second ticket data in which a client parameter including a part of the individual information is encoded according to the predetermined rule;
A program comprising: second authentication means for collating the first ticket data with the second ticket data and authenticating whether or not the client can connect to the second terminal server. In an access authentication method for providing a connection service to a second terminal server to a client via the first terminal server,
A first authentication step for authenticating whether or not the client can connect to the first terminal server;
A first ticket data creating step of creating first ticket data obtained by encoding a client parameter including at least a part of the individual information input from the client according to a predetermined rule;
A data transfer step of transferring the client parameters and the first ticket data to the second terminal server;
A verification step for verifying the validity of the client parameter in the first terminal server and the presence / absence of exercising the first ticket data;
A second ticket data creating step for creating second ticket data obtained by encoding the client parameter according to a predetermined rule;
A ticket data collating step for collating the second ticket data with the first ticket data;
An access authentication method comprising: a second authentication step for instructing the second terminal server whether the client can be connected based on the results of the verification step and the ticket data collation step.

Images