JP2006065712A - Integrated authentication method and apparatus, and program for integrated authentication - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an integrated authentication method capable of integrally executing a user authentication while utilizing a mechanism of an existing application software, an integrated authentication apparatus, and a program for executing the integrated authentication method. <P>SOLUTION: After an integrated authentication for a user, a terminal apparatus accepts an operation for an application software. In response to the operation for the application software, individual authentication information stored in association with the user is acquired from an authentication information storing part, to execute the user's individual authentication for the application software by use of the acquired individual authentication information. Furthermore, it is determined whether the accepted operation is permissible or not by referring to access control information stored in an access control information storing part, to execute the operation only when the determination is affirmative. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an integrated authentication method, an integrated authentication apparatus, and a program for executing an integrated authentication method that integrate and execute authentication of users who use a plurality of application software.

  Some existing application software has a mechanism for user authentication and access control. In addition, a plurality of application software may be used in a common information processing system.

  Patent Document 1 describes a software license authentication system for protecting software licenses.

JP 2004-213436 A

  However, when multiple application softwares are handled by a common information processing system, individual application authentication is required for each application software because the application software has different user authentication mechanisms, different access controls, or different methods. There is a problem that proper access control becomes difficult.

  FIG. 8 illustrates the implementation status of a mechanism for user authentication and access control in existing application software. In this example, a user authentication mechanism is mixed with a user authentication mechanism. As for access control, there are those that perform access control by setting both the work area and role classification, those that can be set only for role classification, or those that do not have an access control mechanism. It is mixed. When such a plurality of software is used in a common information processing system, user authentication is required for each application software as shown in FIG. Further, as shown in FIG. 10, access control is also executed for each application software.

  However, when executing user authentication for each application software, the user must memorize the user IDs and passwords of all application software to be used, and management of these becomes complicated. In addition, every time the application software is authenticated, an input operation using a keyboard or the like is required. Furthermore, since a plurality of application software has independent user authentication / access control mechanisms, the burden on the system administrator who manages them increases.

  From the viewpoint of security, there is a problem in using software that does not support user authentication / access control as it is. Further, for example, in an application of an IA (Industrial Automation) system, fine access control by both the work area and the role classification is required, but there are few existing softwares corresponding to such access control.

  In addition, when using multiple application software that requires authentication, the single sign-on function enables the use of all permitted systems by executing a single authentication. There are products that provide. However, such a product has a problem that the user authentication / access control mechanism realized by the existing application software, in particular, the access control mechanism based on both the work area and the role classification cannot be used as it is.

  An object of the present invention is to provide an integrated authentication method, an integrated authentication apparatus, and a program for executing such an integrated authentication method that can execute user authentication in an integrated manner using an existing application software mechanism. It is to provide.

The integrated authentication method according to the present invention includes a step of executing integrated authentication of a user in an integrated authentication method that integrates and executes authentication of a user who uses a plurality of application software, and an individual stored in association with the user Obtaining authentication information; and performing individual authentication on application software of the user who has been integrated and authenticated using the acquired individual authentication information.
According to this integrated authentication method, information necessary for individual authentication for an application stored in advance is acquired and authentication for the application software is executed, so that individual user authentication for each application is not necessary, and the system A single sign-on function can be provided. In addition, since the step of performing integrated authentication of the user is provided, an opportunity for user authentication can be surely ensured even when the application software has no user authentication mechanism. Furthermore, since individual authentication for application software is executed using individual authentication information stored in advance, it is not necessary for a user to store information necessary for individual authentication for each application software, and the burden of system management is reduced. Is done. Furthermore, as information necessary for individual authentication for each application, information necessary for authentication prepared as a mechanism of each application software (for example, a user ID and a password registered for each application software) is stored in advance. Therefore, it is possible to use the mechanism as it is. If the original application software includes software that does not have an authentication mechanism, individual authentication for the software may be omitted, or individual authentication processing for the software may be added. . Moreover, in this invention, the method of integrated authentication of a user is not limited. For example, a method using a user ID and a password may be used, or a method using a user's physical characteristics may be used. The “individual authentication information” may be a user ID or password registered for each application, or may be various types of information for identifying the user, such as a physical feature of the user.

In the step of executing the individual authentication, the individual authentication may be executed using an authentication method prepared in advance in the application software.
In this case, since an authentication method prepared in advance in the application software is used, it is not necessary to create a new individual authentication procedure. Therefore, a system that realizes integrated authentication can be easily constructed.

A step of accepting an operation request for the application software, a step of determining whether or not the operation is permitted by referring to pre-stored access control information, and a case where the operation is determined to be permitted And the step of executing the operation.
In this case, it is determined whether or not the operation is allowed, and the operation is executed only when the determination is affirmed. Therefore, access to the application software can be appropriately restricted. The access control information to be referred to can be, for example, information defining an operation permitted for each user. In addition, operations can be restricted even for application software that does not have an access control mechanism. For an application with an access control mechanism, that mechanism can also be used.

The access control information may define a work area permitted for the user. The access control information may define a role that is allowed for the user.
In these cases, it is possible to control access to application software based on the work area or role classification.

The integrated authentication apparatus according to the present invention is an integrated authentication apparatus that integrates and executes authentication of a user who uses a plurality of application software, and an integrated authentication unit that performs integrated authentication of the user, and individual authentication associated with the user Individual authentication information storage means for storing information, acquisition means for acquiring the individual authentication information from the individual authentication information storage means, and the user who has been integrated and authenticated using the individual authentication information acquired by the acquisition means And individual authentication means for executing individual authentication for the application software.
According to this integrated authentication apparatus, since information necessary for individual authentication for an application stored in advance is acquired and authentication for the application software is executed, individual user authentication for each application becomes unnecessary, and the system A single sign-on function can be provided. In addition, since the integrated authentication means for performing the integrated authentication of the user is provided, the user authentication opportunity can be surely ensured even when the application software has no user authentication mechanism. Furthermore, since individual authentication for application software is executed using individual authentication information stored in advance, it is not necessary for a user to store information necessary for individual authentication for each application software, and the burden of system management is reduced. Is done. Furthermore, as information necessary for individual authentication for each application, information necessary for authentication prepared as a mechanism of each application software (for example, a user ID and a password registered for each application software) is stored in advance. Therefore, it is possible to use the mechanism as it is. If the original application software includes software that does not have an authentication mechanism, individual authentication for the software may be omitted, or individual authentication processing for the software may be added. . Moreover, in this invention, the method of integrated authentication of a user is not limited. For example, a method using a user ID and a password may be used, or a method using a user's physical characteristics may be used. The “individual authentication information” may be a user ID or password registered for each application, or may be various types of information for identifying the user, such as a physical feature of the user.

The individual authentication means may execute the individual authentication using an authentication method prepared in advance in the application software.
In this case, since an authentication method prepared in advance in the application software is used, it is not necessary to create a new individual authentication procedure. Therefore, a system that realizes integrated authentication can be easily constructed.

Whether the operation is permitted by referring to the accepting means for accepting an operation request for the application software, the access control information storing means for storing the access control information in advance, and the access control information in the access control information storing means. Determination means for determining whether or not the operation is permitted, and execution means for executing the operation only when it is determined that the operation is permitted.
In this case, it is determined whether or not the operation is allowed, and the operation is executed only when the determination is affirmed. Therefore, access to the application software can be appropriately restricted. The access control information to be referred to can be, for example, information defining an operation permitted for each user. In addition, operations can be restricted even for application software that does not have an access control mechanism. For an application with an access control mechanism, that mechanism can also be used.

The access control information may define a work area permitted for the user. The access control information may define a role that is allowed for the user.
In these cases, it is possible to control access to application software based on the work area or role classification.

A program of the present invention is a program for executing an integrated authentication method that integrates authentication of a user who uses a plurality of application software, and executes the integrated authentication of a user on a computer; Obtaining the individual authentication information stored in association with each other, and executing the individual authentication for the application software of the user who has been integrated and authenticated using the acquired individual authentication information. It is characterized by.
According to this program, information necessary for individual authentication for an application stored in advance is acquired, and authentication for the application software is executed. Therefore, individual user authentication for each application is not required, and single signing is performed in the system. An on function can be provided. In addition, since the step of performing integrated authentication of the user is provided, an opportunity for user authentication can be surely ensured even when the application software has no user authentication mechanism. Furthermore, since individual authentication for application software is executed using individual authentication information stored in advance, it is not necessary for a user to store information necessary for individual authentication for each application software, and the burden of system management is reduced. Is done. Furthermore, as information necessary for individual authentication for each application, information necessary for authentication prepared as a mechanism of each application software (for example, a user ID and a password registered for each application software) is stored in advance. Therefore, it is possible to use the mechanism as it is. If the original application software includes software that does not have an authentication mechanism, individual authentication for the software may be omitted, or individual authentication processing for the software may be added. . Moreover, in this invention, the method of integrated authentication of a user is not limited. For example, a method using a user ID and a password may be used, or a method using a user's physical characteristics may be used. The “individual authentication information” may be a user ID or password registered for each application, or may be various types of information for identifying the user, such as a physical feature of the user.

In the step of executing the individual authentication, the individual authentication may be executed using an authentication method prepared in advance in the application software.
In this case, since an authentication method prepared in advance in the application software is used, it is not necessary to create a new individual authentication procedure. Therefore, a system that realizes integrated authentication can be easily constructed.

A step of accepting an operation request for the application software in the computer; a step of determining whether or not the operation is permitted by referring to access control information stored in advance; and a determination that the operation is permitted Only when it is done, the step of executing the operation may be executed.
In this case, it is determined whether or not the operation is allowed, and the operation is executed only when the determination is affirmed. Therefore, access to the application software can be appropriately restricted. The access control information to be referred to can be, for example, information defining an operation permitted for each user. In addition, operations can be restricted even for application software that does not have an access control mechanism. For an application with an access control mechanism, that mechanism can also be used.

The access control information may define a work area permitted for the user. The access control information may define a role that is allowed for the user.
In these cases, it is possible to control access to application software based on the work area or role classification.

  According to the integrated authentication method, integrated authentication apparatus, and program of the present invention, authentication for application software is executed by referring to information necessary for authentication for each application, and therefore a mechanism such as user authentication provided in the application software is used. However, the system can have a single sign-on function.

  Hereinafter, an embodiment of an integrated authentication method according to the present invention will be described with reference to FIGS.

  FIG. 1A is a block diagram showing a configuration of an information processing system to which the integrated authentication method of this embodiment is applied. As shown in FIG. 1A, the information processing system 100 includes a processing server 1 that supervises overall system processing including user authentication and access control processing, and an application server 2 that stores a plurality of application software. The terminal device 3 is provided. The processing server 1, application server 2, and terminal device 3 are connected to each other via a communication line 5.

  The processing server 1 stores an authentication information storage unit 11 for storing authentication information necessary for authenticating a user who uses the application software via the terminal device 3, and access control information necessary for restricting access to the application software. An access control information storage unit 12, a work memory 13 that temporarily stores information necessary for work processing in the processing server 1, and a control unit 14 that controls each unit of the processing server 1 and executes necessary processing. Is provided.

  In addition, the application server 2 is provided with an application software storage unit 21 that stores each application software, and a control unit 22 that performs necessary processing while communicating with the control unit 14 of the processing server 1. ing.

  In the information processing system 100, the user can access the processing server 1 by operating the terminal device 3 and use application software stored in the application server 2. Further, the information processing system 100 has a function of executing integrated authentication of each application software for the user. By performing integrated authentication, the user can access each application software without performing an operation for individual user authentication for each application software. That is, the information processing system has a single sign-on function. Furthermore, the information processing system 100 has a function of restricting access to application software when the user uses the application software.

  FIG. 1B is a block diagram showing functions of the processing server 1 according to the present invention. As shown in FIG. 1B, the processing server 1 includes an integrated authentication unit 101 that performs integrated authentication of a user, an individual authentication information storage unit 102 that stores individual authentication information associated with the user, and an individual authentication information storage. An acquisition unit 103 that acquires individual authentication information from the unit 102, and an individual authentication unit 104 that performs individual authentication for application software of a user who is integrated and authenticated using the individual authentication information acquired by the acquisition unit 103. Function. The individual authentication information storage unit 102 corresponds to the function of the authentication information storage unit 11.

  In addition, the processing server 1 refers to the access control information in the reception unit 105 that receives an operation request for the application software, the access control information storage unit 106 that stores the access control information in advance, and the access control information storage unit 106. Only when the judgment means 107 for judging whether or not the operation is permitted and when the judgment means 107 judges that the operation is permitted, the functions as the execution means 108 for executing the operation. The access control information storage unit 106 corresponds to the function of the access control information storage unit 12.

  FIG. 2 is a diagram showing an integrated user authentication table and an application account mapping table stored in the authentication information storage unit 11.

  As shown in FIG. 2, the integrated user authentication table is a table that associates “integrated user” with “password”. Here, the “integrated user” is a user who actually accesses the processing server 1 via the terminal device 3, and is a person who is registered as a user who has integrated each user registered for each application. . As shown in FIG. 2, for example, a password “Admin” is set in advance corresponding to the integrated user “admin”, and a password “Xyzxyzx” is set in advance corresponding to the integrated user “user A”. “Integrated user” and “password” stored in the integrated user authentication table are account information necessary for integrated authentication, which will be described later.

  Next, the application account mapping table is a table in which “user” and “password” registered for each application software are associated with “integrated user”. For example, it is indicated that the integrated user “admin” is registered as a different user as the user “ADMIN” for the first application and as the user “app2admin” for the second application. Yes. Also, it is shown that the password “adm” is registered for the user “ADMIN” of the first application, and the password “admin” is registered for the user “app2admin” of the second application. Thus, the application account mapping table stores account information necessary for individual authentication for each application software in association with the integrated user.

  FIG. 3 is a diagram showing a role definition table, an access authority definition table, and area information stored in the access control information storage unit 12. These constitute access control information necessary for an access control process to be described later.

  As shown in FIG. 3, the role definition table defines associations between role names and business logic. The business logic indicates the operations that can be executed for each application software. For example, the role name “App1 Engineer” allows operations “App1 / build” and “App1 / delete” for the first application. It has been shown that. The role name “App4 Admin” includes operations “App4 / build”, “App4 / delete”, “App4 / start”, “App4 / stop”, “App4 / read” and “App4 / build” for the fourth application. "App4 / write" is shown to be allowed.

  Next, in the access authority definition table, a “role name” given to each integrated user and an “area” that defines an accessible work area are defined. For example, the integrated user “admin” is given the roles indicated by the role names “App1 Engineer”, “Appl Operator”, and “App4 Admin”. In addition, the area “/ root” is defined as an accessible work area corresponding to the role names “App1 Engineer”, “Appl Operator”, and “App4 Admin”, respectively. For example, the integrated user “user A” is given the roles indicated by the role names “App1 Engineer” and “App4 Engineer”, respectively, and the areas “/ root / App1” and “ “/ Root / App4” is defined as an accessible work area.

  As shown in FIG. 3, the work area of each application software is shown in the area information in a hierarchical manner, and the work area becomes a higher (wider) work area as it goes upward in FIG. The range defined in “Area” in the access authority definition table in FIG. 3 corresponds to the range indicated in the area information. For example, the area indicated as “/ root” indicates all work areas of all application software (first to fourth applications), and the area indicated as “/ root / App1” indicates all work areas of the first application. Indicates. An area indicated as “/ root / App1 / controler1” indicates a work area included in “controler1” of the first application.

  Next, operations of integrated authentication processing, individual authentication processing, and access control processing in the information processing system 100 will be described.

  First, the integrated authentication processing procedure will be described with reference to FIGS. 4 and 5. FIG. 4 is a flowchart showing a processing procedure in integrated authentication, and FIG. 5 is a block diagram functionally showing a processing procedure in integrated authentication.

  The integrated authentication process corresponds to the functions of the integrated authentication unit and the acquisition unit. The integrated authentication process is a process of executing integrated authentication for confirming that the user has input the integrated user and the correct password, and is executed based on the control of the control unit 14 of the processing server 1 according to the computer program. The processing server 1 (FIG. 1) functions as the web server 50 shown in FIG. 5, and the terminal device 3 (FIG. 1) functions as the web client shown in FIG. An authentication / access control infrastructure 51 is constructed in the web server 50.

  As shown in FIG. 5, in the integrated authentication process, an authentication screen 41 is displayed on the monitor of the terminal device 3, and the user is requested to input a user name (integrated user) and a password. Next, the authentication / access control infrastructure 51 performs integrated authentication with reference to the integrated user authentication table (FIG. 2). Hereinafter, each procedure of the integrated authentication process will be described with reference to the flowchart of FIG.

  First, in step S1 of FIG. 4, a user authentication operation is accepted. As shown in FIG. 5, here, the authentication screen 41 is displayed on the monitor of the terminal device 3, and the user (integrated user) is allowed to input a user name, which is information for identifying the user himself, and a password. This process is a process indicated as “maru 1” in FIG. 5 (a case where 1 is indicated in a circle is referred to as “maru 1” for the sake of convenience. The same applies to the notation after “maru 2”). A user name and a password are input to the authentication / access control infrastructure 51 from a certain terminal device 3. In step S2, the authentication / access control infrastructure 51 refers to the integrated user authentication table stored in the authentication information storage unit 11 (corresponding to “maru 2” in FIG. 5), and the input user name (“integrated in FIG. 2”). The password associated with “user”) is compared with the password actually entered.

  Next, in step S3, it is determined whether or not the passwords match in step S2. If they match, that is, if integrated authentication is possible, the process proceeds to step S5. If the passwords do not match, that is, integrated authentication is performed. If not, the process proceeds to step S4. In step S4, an error display indicating that the authentication has failed is displayed on the authentication screen 41, and the process returns to step S1.

  On the other hand, in step S5, the authentication / access infrastructure 51 constructs authentication information, which is information indicating that the integrated authentication of the integrated user has been completed, on the session provided in the work memory 13, and ends the processing. This processing corresponds to “maru 3” in FIG.

  Next, the procedure of the individual authentication process and the access control process will be described with reference to FIGS. FIG. 6 is a flowchart showing a processing procedure when accessing application software, and FIG. 7 is a block diagram functionally showing the processing procedure when accessing application software.

  In this process, a user who has already completed the integrated authentication process (FIG. 4) can access predetermined application software without requiring a new operation for authentication (single sign-on process). In addition, an access control process is executed that enables the integrated user to access the application software only within a preset range. As shown in FIG. 7, this processing is executed by causing the web application 52 to function as a target client of the user authentication / access control infrastructure 51 in the web server 50. In FIG. 7, a web application providing DLL (Dynamic Link Library) 53 is a DLL necessary for executing the web application 52, and an access DLL 54 is a DLL necessary for accessing the first application. The authentication plug-in 55 is a DLL for executing authentication for the first application, and is provided from the first application.

  6 and 7 exemplify a procedure when a user who has completed the integrated authentication process (FIG. 4) accesses the first application. The same procedure is applied when there is access to other application software. The individual authentication processing and access control processing procedures will be described below with reference to the flowchart of FIG. The individual authentication process corresponds to the function of the individual authentication means, and the access control process corresponds to the functions of the determination means and the execution means.

  In step S11 of FIG. 6, the application screen 42 of the application software 1 is displayed on the monitor of the terminal device 3 functioning as the web client of FIG. 7, and the operation (operation) of the application software 1 via the terminal device 3 is performed. Request). This process corresponds to “maru 1” in FIG. In step S12, an inquiry is made to the authentication / access control infrastructure as to whether or not integrated authentication has been completed (corresponding to “maru 2” in FIG. 7). This process is a process in response to the process of step S5 (FIG. 4). Here, it is confirmed that authentication information indicating completion of the integrated authentication process of the user is built on the session.

  Next, in step S13, access is made to session authentication information provided in the work memory 13, and it is confirmed whether the individual authentication for the first application has been completed (corresponding to "maru 3" in FIG. 7). Next, in step S14, it is determined whether or not the completion of individual authentication is confirmed in step S13. If the determination is affirmative, the process proceeds to step S21, and if the determination is negative, the process proceeds to step S15. Note that the determination in step S14 is a response to whether or not the processing in step S18 described later has been executed. This determination is denied when the user first accesses the first application after the integrated authentication process, and is affirmed at the second and subsequent accesses.

  If the determination in step S14 is negative, in step S15, the “user” and “password” for the first application of the user (integrated user) are retrieved from the application account mapping table stored in the authentication information storage unit 11. get. This process corresponds to “maru 3-1” in FIG. 7, and the authentication / access base 51 accesses the application account mapping table of the authentication information storage unit 11 and acquires “user” and “password”. is there.

  Next, in step S16, communication with the application server 2 is performed, and user authentication of the first application is executed using the “user” and “password” acquired in step S15. This process corresponds to “maru 3-2” in FIG. 7, and the authentication / access control infrastructure 51 uses the authentication plug-in 55 to execute individual authentication for the first application. This process can be executed using the authentication mechanism provided in the first application as it is.

  Next, in step S17, it is determined whether the individual authentication (step S16) of the first application is completed. If the determination is affirmed, the process proceeds to step S18, and if the determination is negative, the process returns to step S11.

  In step S18, information indicating that the individual authentication of the user for the first application is completed is set in the authentication information on the session provided in the work memory 13, and the process proceeds to step S21. This process corresponds to “maru 3-3” in FIG.

  In step S21, with reference to the access control information in the access control information storage unit 12, it is confirmed whether or not the operation accepted in step S11 is subject to the access restriction defined in the role definition table and the access authority table (see “ Corresponding to “Full 4”). Next, in step S22, it is determined whether the current access is permitted as a result of the confirmation in step S21. If the determination is affirmative, the process proceeds to step S23, and if the determination is negative, the process proceeds to step S24.

  In step S21, by referring to the role definition table and the access authority definition table, the operation accepted in step S11 should be allowed in light of the user's role name and accessible work area (area). It is determined whether or not. If the operation is included in the role name and area assigned to the corresponding integrated user, the operation is allowed, and if not included, the operation is not allowed. Therefore, appropriate access control is executed based on both the role classification and the work area.

  Note that this processing may be executed using the mechanism as it is when the first application has a mechanism for restricting access. Even if the access restriction mechanism is not provided in the first application, it is possible to execute appropriate access control for the first application by defining the access restriction in the access control information.

  In step S24, a screen indicating that access is not permitted (access impossible error) is displayed on the monitor of the terminal device 3, and the process returns to step S11.

  On the other hand, in step S23, authentication information necessary for the operation (step S25) for the first application is returned to the web application 52 (corresponding to “maru 5” in FIG. 7). Next, in step S25, communication with the application server 2 is executed, and an operation for the first application is executed using the authentication information returned in step S23 (corresponding to “maru 6” in FIG. 7). .

  Next, in step S26, the result of the operation in step S25 is displayed on the monitor of the terminal device 3, and the process ends.

  As described above, in the processing shown in FIGS. 6 and 7, “user” and “password” for the first application of the user (integrated user) are acquired from the application account mapping table (step S15), and the acquired “user” ”And“ password ”are used to perform individual authentication for the first application (step S16). Therefore, the user who uses the system can use the first application without requiring an operation for individual authentication only by accessing the system with a single account at the time of integrated authentication. The same applies when other application software is used.

  Further, by referring to the access control information in the access control information storage unit 12, the operation requested by the user is prohibited as necessary (steps S21 to S22), so that access can be appropriately restricted. . Furthermore, since the access control information includes a role definition table and an access authority table, access control in units of users (integrated users) based on both the work area and role classification can be realized. For this reason, it is possible to reliably prevent erroneous operation of application software and leakage of confidential information.

  The scope of application of the present invention is not limited to the above embodiment. The present invention can be widely applied not only to IA systems but also to information processing systems that handle various types of information.

It is a figure which shows the information processing system with which the integrated authentication method of one Embodiment is applied, (a) is a block diagram which shows the structure of an information processing system, (b) is a block diagram which shows the function of a processing server. The figure which shows the integrated user authentication table and application account mapping table which were stored in the authentication information storage part. The figure which shows the role definition table, access authority definition table, and area information which were stored in the access control information storage part. The flowchart which shows the process sequence in integrated authentication. The block diagram which shows the process sequence in integrated authentication functionally. The flowchart which shows the process sequence at the time of access to application software. The block diagram which shows the process sequence at the time of access to application software functionally. The figure which illustrates the implementation situation of the mechanism of user authentication and access control in the existing application software. The figure which shows the method of the user authentication in the conventional system. The figure which shows the method of access control in the conventional system.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Processing server 2 Application server 3 Terminal device 11 Authentication information storage part 12 Access control information storage part 101 Integrated authentication means 102 Individual authentication information storage means 103 Acquisition means 104 Individual authentication means 105 Reception means 106 Access control information storage means

Claims (15)

In an integrated authentication method that integrates and executes authentication of users who use multiple application software,
Performing integrated authentication of the user;
Obtaining individual authentication information stored in association with the user;
Using the acquired individual authentication information to perform individual authentication for the application software of the user who has been integrated and authenticated;
An integrated authentication method comprising: The integrated authentication method according to claim 1, wherein in the step of executing the individual authentication, the individual authentication is performed using an authentication method prepared in advance in the application software. Receiving an operation request for the application software;
Determining whether or not the operation is allowed by referring to pre-stored access control information;
Performing the operation only if it is determined that the operation is allowed; and
The integrated authentication method according to claim 1, further comprising: The integrated authentication method according to claim 3, wherein the access control information defines a work area permitted for the user. 4. The integrated authentication method according to claim 3, wherein the access control information defines a role recognized for the user. In an integrated authentication device that integrates and executes authentication of users who use multiple application software,
Integrated authentication means for performing integrated authentication of users;
Individual authentication information storage means for storing individual authentication information associated with the user;
Obtaining means for obtaining the individual authentication information from the individual authentication information storage means;
Using the individual authentication information acquired by the acquisition means, the individual authentication means for performing individual authentication for the application software of the user who has been integrated authentication;
An integrated authentication apparatus comprising: The integrated authentication apparatus according to claim 6, wherein the individual authentication unit executes the individual authentication using an authentication method prepared in advance in the application software. An accepting means for accepting an operation request for the application software;
Access control information storage means for storing access control information in advance;
Judging means for judging whether or not the operation is permitted by referring to the access control information in the access control information storage means;
Execution means for performing the operation only when it is determined that the operation is allowed;
The integrated authentication device according to claim 6 or 7, further comprising: 9. The integrated authentication apparatus according to claim 8, wherein the access control information defines a work area permitted for the user. The integrated authentication apparatus according to claim 8, wherein the access control information defines a role permitted to the user. A program for executing an integrated authentication method that integrates authentication of users who use a plurality of application software,
On the computer,
Performing integrated authentication of the user;
Obtaining individual authentication information stored in association with the user;
Using the acquired individual authentication information to perform individual authentication for the application software of the user who has been integrated and authenticated;
A program characterized by having executed. The program according to claim 11, wherein in the step of executing the individual authentication, the individual authentication is executed using an authentication method prepared in advance in the application software. On the computer,
Receiving an operation request for the application software;
Determining whether or not the operation is allowed by referring to pre-stored access control information;
Performing the operation only if it is determined that the operation is allowed; and
The program according to claim 11, wherein: The program according to claim 13, wherein the access control information defines a work area permitted for the user. The program according to claim 13, wherein the access control information defines a role permitted to the user.