JP5258685B2 - Management device and terminal device - Google Patents

Description

  The present invention relates to a technique for distributing a security policy applied in an organization to a terminal device.

As a technique related to the present invention, there is a technique described in Patent Document 1.
Patent Document 1 proposes a system that distributes and updates a security policy from a server to terminal devices in an organization.
In the method of Patent Document 1, processing is performed according to the following procedure.
(1) Set a security policy in the management server.
(2) The administrator sets which security policy is applied to which terminal device in the management server.
(3) The management server notifies the terminal device of a key corresponding to the security policy.
(4) The distribution server encrypts and broadcasts the security policy.
(5) The terminal device decrypts the broadcast security policy with the key and stores it in the terminal.
(6) The terminal device performs authentication using the stored security policy.

JP 2006-243791 A

In the method of Patent Document 1, in order to distribute as a security policy to be immediately applied, the security policy is immediately applied (reflected) to the terminal device.
For this reason, when there is a user who is logged in to the terminal device, the distributed security policy cannot be immediately reflected and reflected from the next login.
In other words, there is a security policy that is preferably applied in session units when managing log-in and logout of a user terminal as one session. However, in Patent Document 1, it is desirable to apply security policies in session units. In order to distribute all security policies as targets of immediate application without distinguishing them from those that should be applied immediately, all security policies are immediately reflected and it is desirable to apply them on a session basis. Even if it exists, there is a problem that flexible operation such as deferring application until the start of the next session (at the time of the next login) cannot be performed.

An example of a security policy to be applied on a session basis is “authentication device policy”.
The “authentication device policy” specifies, for example, whether an IC card can be used for user authentication or a device for fingerprint authentication can be used.
An IC card is required when a user who first logs into a terminal device through user authentication according to a policy using an ID and a password temporarily locks the screen of the terminal device in a toilet or the like When the authentication device policy is distributed and the terminal device is changed to a new authentication device policy, the user cannot release the screen lock because the user does not have the IC card.

Conversely, there is an “account lock policy” as a security policy that should be reflected immediately.
“Account lock policy” specifies how many times the password is entered incorrectly to lock the account.
This condition can be considered a security issue if the user is not logged in immediately (even at the start of a session) and may be considered a security issue (an unauthorized user may try to unlock the screen when it is locked) Because there is).

As described above, depending on the type of security policy, it should be “immediately reflected” or “reflected in session units”. There are also differences depending on the organization's policy.
Therefore, it is necessary to be able to specify whether to “immediately reflect” or “reflect to session” for each security policy.
In addition, when the policy of the organization is changed, it is necessary to be able to change the security policy.

In the conventional technology, when a new security policy is distributed after the user logs in to the terminal device, the security policy at the time of login is overwritten and disappears. Therefore, the security policy can be reflected on a session basis. Can not.
Also, it is not possible to specify “immediately reflect” or “reflect on a session basis” for each security policy.
As described above, the conventional technology has a problem in that it cannot be flexibly operated such that it is immediately applied to a terminal device or applied on a session basis for each security policy.
The main object of the present invention is to solve such problems, and it is a main object of the present invention to provide a mechanism for flexibly applying a security policy.

The management device according to the present invention is:
A session is started from the start of the user login process, a session is established after the login process is completed, and is a management apparatus connected to a terminal device that requests transmission of a security policy at least during the login process,
The security policy to be applied to the terminal device is a first type security policy in which the application start timing is limited at the start of the session and is continuously applied during the session after the start of application at the start of the session, and the application start timing is not limited to at the start of the session A security policy storage unit for storing separately from the second type security policy that can be additionally applied after session establishment;
A receiving unit for receiving a security policy transmission request for requesting transmission of a security policy, including a state identifier indicating whether the terminal device is currently performing login processing or login processing from the terminal device;
When the state identifier included in the security policy transmission request is analyzed and it is determined that the terminal device is currently performing a login process, the first type security policy is acquired from the security policy storage unit, and the terminal A security policy acquisition unit that acquires the second type security policy from the security policy storage unit when it is determined that the apparatus has already undergone login processing;
And a transmission unit that transmits the security policy acquired by the security policy acquisition unit to the terminal device.

  According to the present invention, the security policy is classified into the first type security policy and the second type security policy, and at the start of the session, the first type security policy is transmitted to the terminal device to continue for the first type security. The policy can be applied to the terminal device, and after the session is established, the second type security policy can be transmitted to the terminal device and the second type security policy can be additionally applied immediately.

FIG. 3 is a diagram illustrating an example of a system configuration according to the first embodiment. FIG. 3 is a diagram illustrating a configuration example of a security management device according to the first embodiment. FIG. 3 is a diagram illustrating a configuration example of a security terminal device according to the first embodiment. FIG. 6 shows an example of an authentication policy according to the first embodiment. FIG. 4 is a diagram showing types of authentication policies according to the first embodiment. FIG. 6 is a diagram showing a description example of an authentication policy according to the first embodiment. FIG. 5 shows an example of authentication information according to the first embodiment. FIG. 5 is a diagram showing a description example of authentication information according to the first embodiment. The figure which shows the example of the acquired information of each user which concerns on Embodiment 1. FIG. FIG. 6 is a diagram illustrating a description example of acquired information of each user according to the first embodiment. FIG. 4 is a diagram illustrating a configuration example of a security management device according to a second embodiment. The figure which shows the structural example of the security terminal device which concerns on Embodiment 2. FIG. The figure which shows the hardware structural example of the security management apparatus which concerns on Embodiment 1, 2, and a security terminal device.

Embodiment 1 FIG.
FIG. 1 is a system configuration example according to the present embodiment.
The security management device 1 (management device) transmits a security policy set by a security administrator (hereinafter referred to as an administrator) to a plurality of security terminal devices 11.
The security terminal device 11 (terminal device) implements security measures according to the security policy received from the security management device 1.
The security terminal device 11 has one session from user login to logout. The session starts from the start of the user login process, and the session is established after the login process is completed.
In FIG. 1, only one security terminal device 11 is illustrated, but a plurality of security terminal devices 11 may exist.

A security policy is information that indicates a policy regarding information security measures for information assets in an organization such as a company. For example, a user authentication method, a user authentication implementation procedure, a type of data to be encrypted, an encryption Policy, countermeasures against unauthorized access from outside, countermeasures against confidential leaks, countermeasures against computer viruses, countermeasures against data loss, and the like.
Hereinafter, the security management device 1 and the security terminal device 11 according to the present embodiment will be described using a policy relating to user authentication (hereinafter referred to as an authentication policy) as an example of a security policy.

  Before describing details of the internal configuration and the like of the security management device 1 and the security terminal device 11, an outline of the security management device 1 and the security terminal device 11 according to the present embodiment will be described here.

The security management device 1 holds timing information indicating whether to “immediately reflect” or “reflect to session” for each authentication policy.
The security terminal device 11 can hold an authentication policy and a cache of authentication information (ID / password, etc.) and execute authentication using the cache.
At the start of a session (during user login processing), the security terminal apparatus 11 receives the latest authentication policy and authentication information from the security management apparatus 1 and performs authentication using the information.
In the authentication process (screen lock release, etc.) during the session, the security terminal device 11 receives only the authentication policy designated “immediately reflect” from the security management device 1, and receives other authentication policies and authentication information cached at the time of login. Use to perform authentication.
As a result, the authentication policy designated as “immediately reflected” is transmitted to the security terminal device 11 at the time of authentication, and the latest authentication policy is applied.
The authentication policy designated “Reflect in session units” is transmitted to the security terminal device 11 only at the start of the session, and is not updated during the session.
Further, the security management device 1 can store only the authentication policies that have been changed by storing the acquired authentication policies of the respective users, and send them to the security terminal device 11.
As a result, the amount of data during communication can be reduced.

Next, FIG. 2 shows an internal configuration example of the security management device 1 according to the present embodiment.
As shown in FIG. 2, the security management device 1 is roughly divided into an information storage device 2 and an information distribution device 6.

The information storage device 2 stores an authentication policy 3, authentication information 4, and acquired information 5 of each user.
The authentication policy 3 and the authentication information 4 are input from the administrator to the information storage device 2.
A flag indicating whether to “immediately reflect” or “apply to each session” is set in the authentication policy 3, and the plurality of authentication policies 3 are either an authentication policy to be immediately reflected or an authentication policy to be reflected to each session. It is distinguished and memorized.
In the example of FIG. 2, the authentication policy A and the authentication policy C are authentication policies that are reflected on a session basis, and the application start timing is limited at the start of the session, and security is applied continuously during the session after the start of application at the start of the session. It is a policy.
The authentication policy reflected in the session unit such as the authentication policy A and the authentication policy C is an example of the first type security policy.
The authentication policy B is an authentication policy that is reflected immediately, and the application start timing is not limited to the session start time, and is a security policy that can be additionally applied after the session is established.
The authentication policy immediately reflected such as the authentication policy B is an example of the second type security policy.
The authentication information 4 is authentication information such as a user ID and a password. In the example of FIG. 2, authentication information of users X, Y, and Z is shown.
The acquired information 5 of each user indicates an authentication policy that has already been acquired and transmitted for the user. In the example of FIG. 2, the authentication policies acquired and transmitted to the users X, Y, and Z are shown. Acquired information 5 for each user is an example of transmitted security policy information.
The information storage device 2 is an example of a security policy storage unit and a transmitted security policy information storage unit.

Further, the information distribution device 6 receives a security policy transmission request (hereinafter referred to as a policy transmission request) for requesting transmission of an authentication policy from the security terminal device 11, and based on the received policy transmission request, the information storage device 2 The authentication policy is acquired from the authentication information, the authentication information is acquired, and the acquired authentication policy and authentication information are transmitted to the security terminal device 11.
The policy transmission request includes a state identifier indicating whether the security terminal device 11 is currently performing login processing (at the start of a session) or login processing has been completed (session has been established). The state identifier is analyzed to determine whether the security terminal device 11 that has transmitted the policy transmission request is currently in the login process or has been logged in.
When the transmission source security terminal device 11 determines that the login process is currently in progress, an authentication policy (first type security policy) to be applied in units of unsent sessions is acquired (and unsent immediate authentication is applied) If there is a policy, an unsent immediate application authentication policy is also acquired) and transmitted to the security terminal device 11. The security terminal device 11 performs user authentication during the login process using the received authentication policy.
On the other hand, if the source security terminal device 11 determines that the login processing has already been completed, the information distribution device 6 acquires an unsent immediate authentication policy (second type security policy), and the security terminal device 11 to send. The security terminal device 11 performs user authentication during the session using the received authentication policy and the authentication policy in the cache.
The information distribution device 6 is an example of a security policy acquisition unit, a transmission unit, and a reception unit.

Next, FIG. 3 shows an internal configuration example of the security terminal apparatus 11 according to the present embodiment.
The security terminal device 11 is a terminal used by a user, and is roughly divided into an information update device 12, a cache information storage device 13, an authentication execution device 16, and an authentication information input device 17, as shown in FIG.

The information update device 12 transmits a policy transmission request for requesting transmission of an authentication policy to the security management device 1 at an arbitrary timing during the login process or after the session is established.
As described above, the policy transmission request includes the state identifier indicating whether the login process is being performed or the login process has been completed.
The arbitrary timing after the session is established is, for example, at the time of authentication processing in the middle of the session (screen lock release, etc.).
The information update device 12 receives the authentication policy and authentication information transmitted from the security management device 11.
The information update device 12 is an example of a transmission unit and a reception unit.

  The cache information storage device 13 stores the authentication policy 14 and the authentication information 15 received by the information update device 12.

The authentication execution device 16 uses the authentication policy 14 and the authentication information 15 in the cache information storage device 13 to implement security measures (authentication processing) according to the authentication policy.
More specifically, for authentication policies (authentication policy A, authentication policy C) applied on a session basis, application is started from the start of the session, and authentication is performed according to the authentication policy applied on a session basis during the session. The processing is continued, and for the immediate application authentication policy, the application of the immediately applied authentication policy is started and the authentication process is performed every time the immediate application authentication policy is received.
The authentication execution device 16 is an example of a security policy application unit.

  The authentication information input device 17 inputs authentication input information (user ID, password, etc.) used in the authentication process by the authentication execution device 16 from the user.

  Next, operation examples of the security management device 1 and the security terminal device 11 according to the present embodiment will be described.

First, an initial setting method will be described.
The administrator sets an authentication policy and authentication information in advance.

The contents of the authentication policy are shown in FIG.
The authentication policy information indicates a rule to be followed when executing the authentication. The ID (policy_id) for identifying the authentication policy, the name of the authentication policy (name), the value of the authentication policy (value), and “ It consists of an application timing (timing) of an authentication policy indicating whether to “immediately reflect” or “reflect in session units”.
If immediate is specified for timing, “immediately reflect” is specified, and if session is specified, “reflect in session units”.
FIG. 5 shows the types of authentication policies.
Further, FIG. 6 shows an example in which the authentication policy is described in an XML (Extensible Markup Language) format.
This example shows that only an IC card can be used as an authentication device.
The contents of the authentication information are shown in FIG.
The authentication information includes a user ID (user_id), a user password (password), a user authority (right), and an expiration date (term) of the authentication information.
FIG. 8 shows an example in which authentication information is described in XML format.
FIG. 9 shows the contents of the acquired information 5 for each user.
The information to be held includes an ID (policy_id) for identifying an authentication policy, an authentication policy name (name), and an authentication policy value (value).
FIG. 10 shows an example in which the acquired information 5 of each user is described in the XML format.
This example shows that only the fingerprint authentication device can be used as the authentication device.

Next, operations of the security management device 1 and the security terminal device 11 when starting a session will be described.
Here, the start of a session refers to the time when an unlogged user logs in.

The user inputs a user ID and password to the authentication information input device 17 of the security terminal device 11 or requests authentication using an IC card (including the user ID inside). These pieces of information that the user inputs to the authentication information input device 17 correspond to authentication input information.
The authentication information input device 17 passes the authentication input information to the authentication execution device 16 and requests authentication.
The authentication execution device 16 requests the cache information storage device 13 for an authentication policy and authentication information corresponding to the user ID.
The cache information storage device 13 requests the information updating device 12 for an authentication policy and authentication information corresponding to the user ID.
The information updating apparatus 12 transmits an authentication policy and a policy transmission request for requesting distribution of authentication information corresponding to the user ID to the information distribution apparatus 6.
The policy transmission request includes a state identifier and a user ID.
The policy transmission request transmitted here includes a state identifier indicating that login processing is currently being performed.

The information distribution device 6 receives the policy transmission request, searches the acquired information 5 of each user using the user ID included in the received policy transmission request, and acquires the authentication acquired for the user. Extract the policy.
Since the security terminal device 11 is currently in the login process, the authentication policy is not extracted from the acquired information 5 of each user unless an authentication policy has been transmitted to the security terminal device 11 of the user in the past. When an authentication policy has been transmitted to the user's security terminal device 11 in the past, the authentication policy transmitted before the end of the previous session is extracted.
Next, the information distribution apparatus 6 selects an authentication policy (both the session-based application authentication policy and the immediate application authentication policy) that has been updated by comparing with the extracted acquired authentication policy among the authentication policies of the authentication policy 3. Obtained from the information storage device 2. In addition, the authentication policy that has been updated in comparison with the extracted acquired authentication policy includes a newly introduced authentication policy that is different from the acquired authentication policy, and authentication that corresponds to updating the content of the acquired authentication policy. Both policies (hereinafter referred to as revised authentication policies) are included.
Further, the information distribution device 6 acquires authentication information corresponding to the user ID included in the policy transmission request from the information storage device 2.
Then, the information distribution device 6 transmits the acquired authentication policy and authentication information to the information update device 12 of the security terminal device 11.
Further, the information distribution device 6 writes the authentication policy transmitted to the security terminal device 11 in “acquired information 5 of each user”. When the authentication policy transmitted to the security terminal device 11 is a revised version of the previous authentication policy, the revised authentication policy is recorded over the previous revision of the authentication policy.

In the security terminal device 11, the information updating device 12 receives the authentication policy and the authentication information, encrypts the received authentication policy, stores it in the cache information storage device 13 as the authentication policy 14, and encrypts the received authentication information. And stored in the cache information storage device 13 as authentication information 15.
Note that the encryption of the authentication policy and the authentication information is arbitrary, and the encryption may not be performed. Further, the authentication policy and the authentication information may be encrypted also when transmitting from the information distribution apparatus 6 to the information update apparatus 12.
The cache information storage device 13 returns the authentication policy (both the newly received authentication policy and the authentication policy previously in the cache) and the authentication information to the authentication execution device 16.
The authentication execution device 16 executes authentication using the received authentication policy and authentication information, and returns the result to the authentication information input device 17.
The authentication information input device 17 returns an authentication result to the user.
When the authentication in the authentication execution device 16 is successful, the user successfully logs in to the security terminal device 11 and a session is established.

Next, operations of the security management device 1 and the security terminal device 11 when executing authentication during a session will be described.
Here, the authentication during the session indicates, for example, authentication when a logged-in user performs screen lock release.

The user inputs a user ID and password at the authentication information input device 17 of the security terminal device 11 or requests authentication using an IC card.
The authentication information input device 17 passes the input authentication input information to the authentication execution device 16 and requests authentication.
The authentication execution device 16 requests the cache information storage device 13 for an authentication policy and authentication information corresponding to the user ID.
The cache information storage device 13 requests the information updating device 12 for an authentication policy designated as “immediately reflected” and authentication information corresponding to the user ID.
The information updating apparatus 12 transmits an authentication policy designated “immediately reflected” (immediate) and a policy transmission request for requesting transmission of authentication information corresponding to the user ID to the information distribution apparatus 6.
The policy transmission request includes a state identifier and a user ID.
The policy transmission request transmitted here includes a state identifier indicating that login processing has already been completed (session has been established).

The information distribution device 6 receives the policy transmission request, searches the acquired information 5 of each user using the user ID included in the received policy transmission request, and acquires the authentication acquired for the user. Extract the policy.
Next, the information distribution device 6 displays the authentication policy designated as “immediately reflected” (immediate), which is updated by comparison with the extracted acquired authentication policy, among the authentication policies of the authentication policy 3. Get from. That is, only the authentication policy to be applied immediately is acquired at the stage where the session has been established.
Then, the information distribution device 6 transmits the acquired authentication policy to the information update device 12 of the security terminal device 11.
Further, the information distribution device 6 acquires authentication information corresponding to the user ID from the authentication information 4 and distributes it to the information update device 12.
Further, the information distribution device 6 writes the authentication policy transmitted to the security terminal device 11 in “acquired information 5 of each user”. Also here, when the authentication policy transmitted to the security terminal device 11 corresponds to a revised version of the previous authentication policy, the revised authentication policy is recorded over the old authentication policy.

In the security terminal device 11, the information updating device 12 receives the authentication policy and the authentication information, encrypts the received authentication policy, stores it in the cache information storage device 13 as the authentication policy 14, and encrypts the received authentication information. And stored in the cache information storage device 13 as authentication information 15.
The cache information storage device 13 returns all authentication policies (both the newly received authentication policy and the authentication policy previously in the cache) and authentication information corresponding to the user ID to the authentication execution device 16.
The authentication execution device 16 executes authentication using the received authentication policy and authentication information, and returns the result to the authentication information input device 17.
The authentication information input device 17 returns an authentication result to the user.

As described above, according to the present embodiment, according to the nature of the security policy, the security policy to be applied on a session basis is distinguished from the security policy that should be applied immediately, and the security policy on a session basis is assigned to the security terminal device at the start of the session. It is possible to flexibly operate such that a security policy of immediate application is additionally applied to the security terminal device immediately after the session is established.
In addition, security policies that differ depending on the organization can be reflected at an appropriate timing.

  Further, according to the present embodiment, when updating the authentication policy, it is only necessary to notify only the updated authentication policy from the session start time, so that the amount of information to be communicated can be minimized.

  Further, according to the present embodiment, even when the communication line is broken and the security management device and the security terminal device cannot communicate with each other, the authentication policy and the authentication information held by the security terminal device are used. Authentication can be performed with the policy at the start of the session.

In addition, the present embodiment can be used as a method for realizing the user authentication function of the information system.
It is considered effective when security needs to be managed according to organizational policies.
In addition, it is possible to cope with a case where the timing of reflecting the authentication policy becomes a problem in a business where security is strictly managed such as finance.

Embodiment 2. FIG.
In the first embodiment, an example in which an authentication policy is transmitted from the security management device 1 to the security terminal device 11 and user authentication is performed according to the authentication policy in the security terminal device 11 has been described.
In the present embodiment, an example will be described in which the security management device 1 performs user authentication according to an authentication policy.

A system configuration example according to the present embodiment is as shown in FIG.
Moreover, the structural example of the security management apparatus 1 which concerns on this Embodiment is as showing in FIG.
Moreover, the structural example of the security terminal device 11 which concerns on this Embodiment is as showing in FIG.

In the security management device 1 according to the present embodiment, an authentication execution device 7 is arranged instead of the information distribution device 6.
The authentication execution device 7 uses the information stored in the information storage device 2 to perform authentication processing for the user of the security terminal device 11.
More specifically, the authentication execution device 7 receives a user authentication request for requesting user authentication from the security terminal device 11, analyzes a state identifier included in the user authentication request, and the security terminal device 11 is currently logged in If it is determined that processing is in progress, an authentication policy applied to each session is acquired from the information storage device 2 (and, if there is an immediate application authentication policy, an immediate application authentication policy is also acquired), and the acquired authentication policy Authenticates the user during login process using.
Further, the authentication execution device 7 acquires an immediately applied authentication policy from the information storage device 2 when it is determined that the security terminal device 11 has already undergone login processing (session has been established) as a result of analysis of the state identifier. The user authentication during the session is performed using the acquired authentication policy and the acquired authentication policy.
In this way, the authentication execution device 7 executes authentication while distinguishing between the start of the session and the middle of the session.
The authentication execution device 7 is an example of a reception unit, a security policy acquisition unit, and an authentication execution unit.
In FIG. 11, the elements other than the authentication execution device 7 are the same as those shown in FIG. 2, but the acquired information 5 of each user is the authentication policy transmitted to the security terminal device 11 in the embodiment. As shown, since the authentication policy is not transmitted to the security terminal device 11 in the present embodiment, the acquired information 5 for each user indicates the authentication policy acquired for each user.
In addition, the authentication policy itself acquired for each user may be pooled for each user in the acquired information 5 of each user, or may be pooled for each user in another area in the information storage device 2. It may be.
Further, the authentication execution device 7 may acquire the target authentication policy again from the area of the authentication policy 3 according to the list of acquired authentication policies of the acquired information 5 of each user.

The security terminal device 11 according to the present embodiment is a terminal used by a user, and includes an authentication information input device 17 that inputs authentication input information and transmits a user authentication request to the security management device 11. .
That is, in the present embodiment, since the security terminal device 11 does not perform user authentication, the information update device 12, the cache information storage device 13, and the authentication execution device 16 shown in FIG. 3 are unnecessary.

  Next, operation examples of the security management device 1 and the security terminal device 11 according to the present embodiment will be described.

  Since the initial setting method is the same as that described in the first embodiment, the description thereof is omitted.

  Next, operations of the security management device 1 and the security terminal device 11 when starting a session will be described.

The user inputs a user ID and password to the authentication information input device 17 of the security terminal device 11 or requests authentication using an IC card (including a user ID inside).
The authentication information input device 17 generates a user authentication request from the input authentication input information, and transmits the user authentication request to the authentication execution device 7.
The user authentication request includes a state identifier and a user ID.
The user authentication request transmitted here includes a state identifier indicating that login processing is currently being performed.

The authentication execution device 7 receives the user authentication request, searches the acquired information 5 of each user using the user ID included in the received user authentication request, and acquires the authentication policy acquired for the user To extract.
Since the security terminal device 11 is currently in the login process, the authentication policy is not extracted from the acquired information 5 of each user unless an authentication policy has been acquired for the user's security terminal device 11 in the past. If an authentication policy has been acquired in the past for the security terminal device 11 of the user, the authentication policy acquired until the end of the previous session is extracted.
Next, the authentication execution device 7 selects an authentication policy (both the session-based application authentication policy and the immediate application authentication policy) that has been updated by comparing with the extracted acquired authentication policy among the authentication policies of the authentication policy 3. Obtained from the information storage device 2. The authentication policy that has been updated compared to the extracted acquired authentication policy includes a newly introduced authentication policy that is different from the acquired authentication policy and an authentication policy that is a revised version of the acquired authentication policy. Both are included.
Further, the authentication execution device 7 also acquires the authentication policy described in the acquired information 5 of each user from the information storage device 2.
In addition, the authentication execution device 7 acquires authentication information corresponding to the user ID included in the user authentication request from the information storage device 2.
And the authentication execution apparatus 7 performs user authentication at the time of login using the acquired authentication information according to the acquired authentication policy.
Note that the authentication execution apparatus 7 may request the security terminal apparatus 11 to transmit the missing information if there is missing information in the authentication process. For example, when the acquired authentication policy defines biometric authentication using biometric information such as fingerprints and veins, the authentication execution device 7 may request the security terminal device 11 to transmit the biometric information of the user. Good.
Then, the authentication execution device 7 returns an authentication result to the authentication information input device 17.
At the same time, the authentication execution device 7 records the authentication policy at this time in “acquired information 5 of each user”. When an authentication policy corresponding to a revised version of the previous authentication policy is acquired, the revised authentication policy is recorded over the previous authentication policy.
If the authentication in the authentication execution device 7 is successful, the user successfully logs in to the security terminal device 11 and a session is established.

  The operations of the security management device 1 and the security terminal device 11 when executing authentication during a session will be described.

The user inputs a user ID and password at the authentication information input device 17 of the security terminal device 11 or requests authentication using an IC card.
The authentication information input device 17 generates a user authentication request from the input authentication input information, and transmits the user authentication request to the authentication execution device 7.
The user authentication request includes a state identifier and a user ID.
The user authentication request transmitted here includes a state identifier indicating that login processing has already been completed (session has been established).

The authentication execution device 7 receives the user authentication request, searches the acquired information 5 of each user using the user ID included in the received user authentication request, and acquires the authentication policy acquired for the user To extract.
Next, the authentication execution device 7 displays the authentication policy designated as “immediately reflected” (immediate), which is updated by comparison with the extracted acquired authentication policy, among the authentication policies of the authentication policy 3. Get from. That is, only the authentication policy to be applied immediately is acquired at the stage where the session has been established.
Further, the authentication execution device 7 also acquires the authentication policy described in the acquired information 5 of each user from the information storage device 2.
In addition, the authentication execution device 7 acquires authentication information corresponding to the user ID from the authentication information 4.
Next, the authentication execution device 7 performs user authentication at the time of login using the acquired authentication information in accordance with the acquired authentication policy.
Then, the authentication execution device 7 returns an authentication result to the authentication information input device 17.
At the same time, the authentication execution device 7 records the authentication policy at this time in “acquired information 5 of each user”. Also here, when the authentication policy corresponding to the revised version of the previous authentication policy is obtained, the revised authentication policy is recorded over the old authentication policy.

  As described above, even when user authentication is performed in the security management apparatus, it is possible to apply a flexible authentication policy by distinguishing between an authentication policy applied in units of sessions and an authentication policy applied immediately.

In the first and second embodiments described above, the security management apparatus including the following apparatuses has been described.
(A) "Authentication execution device" for executing authentication,
(B) “Information distribution device” that distributes authentication policy and authentication information;
(C) “Information storage device” that holds authentication policy and authentication information.

In the first embodiment, a security terminal device including the following devices has been described.
(A) "Authentication execution device" for executing authentication,
(B) “Information update device” that makes an inquiry to the security management device and obtains an authentication policy and authentication information;
(C) “cache information storage device” that holds an authentication policy and authentication information;
(D) An “authentication information input device” that receives a password, IC card information, and the like from a user.

In the second embodiment, the authentication execution device 7 that performs the following operations has been described.
(A) In the case of starting a session, authentication is executed using information such as a password and a user ID received from the authentication information input device 17, authentication policy 3 and authentication information 4, and authentication information 4.
(B) In the middle of the session, information such as a password and a user ID received from the authentication information input device 17, an authentication policy of “immediate reflection” of the authentication policy 3, authentication information of the authentication information 4, and “each user The policy information corresponding to the user ID is acquired from “acquired information 5” and authentication is executed.

  In the first embodiment, the authentication execution is performed by using the information such as the password and the user ID received from the authentication information input device 17, the authentication policy of the authentication policy 14, and the authentication information of the authentication information 15. Apparatus 16 has been described.

In the first embodiment, the information distribution device 6 that performs the following operations has been described.
(A) At the start of a session, if the acquired information 5 of the authentication policies of the authentication policy 3 has been updated by comparison, the information is transmitted to the information updating device 12; , The authentication policy designated “immediately reflected” (immediate) is extracted, the extracted authentication policy is compared with the acquired information 5, and if it has been updated, it is transmitted to the information update device 12. ,
(B) The authentication information corresponding to the user ID is acquired from the authentication information 4 and transmitted to the information update device 12.

In the first and second embodiments, the information storage device 2 that performs the following operations has been described.
(A) The latest authentication policy and the information indicating whether to apply “immediately” or “apply in session units (apply at the start of a session)” as the accompanying information are retained,
(B) keep the latest authentication information,
(C) The authentication policy at the time when each user logs in is held.

In the first embodiment, the cache information storage device 13 that performs the following operations has been described.
(A) The latest authentication policy is retained for the authentication policy designated “immediately apply”, and the authentication information at the start of the session is retained for the authentication policy designated “apply per session”.
(B) Hold the latest authentication information.

Finally, a hardware configuration example of the security management device 1 and the security terminal device 11 described in the first and second embodiments will be described.
FIG. 13 is a diagram illustrating an example of hardware resources of the security management device 1 and the security terminal device 11 described in the first and second embodiments.
The configuration in FIG. 13 is merely an example of the hardware configuration of the security management device 1 and the security terminal device 11, and the hardware configuration of the security management device 1 and the security terminal device 11 is the configuration described in FIG. The configuration is not limited to this, and other configurations may be used.

In FIG. 13, the security management device 1 and the security terminal device 11 include a CPU 911 (also referred to as a central processing unit, a central processing unit, a processing unit, an arithmetic unit, a microprocessor, a microcomputer, and a processor) that executes a program.
The CPU 911 is connected to, for example, a ROM (Read Only Memory) 913, a RAM (Random Access Memory) 914, a communication board 915, a display device 901, a keyboard 902, a mouse 903, and a magnetic disk device 920 via a bus 912. Control hardware devices.
Further, the CPU 911 may be connected to an FDD 904 (Flexible Disk Drive), a compact disk device 905 (CDD), a printer device 906, and a scanner device 907. Further, instead of the magnetic disk device 920, a storage device such as an optical disk device or a memory card (registered trademark) read / write device may be used.
The RAM 914 is an example of a volatile memory. The storage media of the ROM 913, the FDD 904, the CDD 905, and the magnetic disk device 920 are an example of a nonvolatile memory. These are examples of the storage device.
The “information storage device 2” and “cache information storage device 13” described in the first and second embodiments are realized by the RAM 914, the magnetic disk device 920, and the like.
A communication board 915, a keyboard 902, a mouse 903, a scanner device 907, an FDD 904, and the like are examples of input devices.
Further, the “authentication information input device 17” described in the first and second embodiments can input authentication input information using the keyboard 902, the mouse 903, and the like.
The communication board 915, the display device 901, the printer device 906, and the like are examples of output devices.

  As shown in FIG. 1, the communication board 915 is connected to a network. For example, the communication board 915 may be connected to a LAN (local area network), the Internet, a WAN (wide area network), a SAN (storage area network), or the like.

The magnetic disk device 920 stores an operating system 921 (OS), a window system 922, a program group 923, and a file group 924.
The programs in the program group 923 are executed by the CPU 911 using the operating system 921 and the window system 922.

The RAM 914 temporarily stores at least part of the operating system 921 program and application programs to be executed by the CPU 911.
The RAM 914 stores various data necessary for processing by the CPU 911.

The ROM 913 stores a BIOS (Basic Input Output System) program, and the magnetic disk device 920 stores a boot program.
When the security management device 1 and the security terminal device 11 are activated, the BIOS program in the ROM 913 and the boot program in the magnetic disk device 920 are executed, and the operating system 921 is activated by the BIOS program and the boot program.

  The program group 923 includes “information distribution device 6”, “authentication execution device 7”, “information update device 12”, “authentication execution device 16”, and “authentication information input device 17” in the description of the first and second embodiments. The program which performs the function demonstrated as is memorize | stored. The program is read and executed by the CPU 911.

In the file group 924, in the description of the first and second embodiments, “determination of”, “calculation of”, “comparison of”, “authentication of”, “evaluation of”, “update of” ”,“ Setting of ”,“ registration of ”,“ extraction of ”,“ selection of ”, etc., information, data, signal values, variable values, and parameters indicating the results of the processing are“ It is stored as each item of "~ file" and "~ database".
The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 911 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. Used for CPU operations such as calculation, processing, editing, output, printing, and display.
Information, data, signal values, variable values, and parameters are stored in the main memory, registers, cache memory, and buffers during the CPU operations of extraction, search, reference, comparison, calculation, processing, editing, output, printing, and display. It is temporarily stored in a memory or the like.
The data and signal values described in the first and second embodiments are the memory of the RAM 914, the flexible disk of the FDD 904, the compact disk of the CDD 905, the magnetic disk of the magnetic disk device 920, other optical disks, mini disks, DVDs, etc. Recorded on a recording medium. Data and signals are transmitted online via a bus 912, signal lines, cables, or other transmission media.

  In the description of the first and second embodiments, “information distribution device 6”, “authentication execution device 7”, “information update device 12”, “authentication execution device 16”, and “authentication information input device 17” are described. The thing may be “˜circuit”, “˜means”, “˜apparatus”, or may be “˜step”, “˜procedure”, “˜processing”. That is, what is described as “information distribution device 6”, “authentication execution device 7”, “information update device 12”, “authentication execution device 16”, and “authentication information input device 17” is firmware stored in ROM 913. It may be realized with. Alternatively, it may be implemented only by software, or only by hardware such as elements, devices, substrates, and wirings, by a combination of software and hardware, or by a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 911 and executed by the CPU 911. That is, the program functions the computer as “information distribution device 6”, “authentication execution device 7”, “information update device 12”, “authentication execution device 16”, and “authentication information input device 17” in the first and second embodiments. It is something to be made. Alternatively, the procedures and methods of ““ information distribution device 6 ”,“ authentication execution device 7 ”,“ information update device 12 ”,“ authentication execution device 16 ”, and“ authentication information input device 17 ”according to the first and second embodiments are used. To be executed.

  As described above, the security management device 1 and the security terminal device 11 shown in the first and second embodiments include a CPU as a processing device, a memory as a storage device, a magnetic disk, an input device such as a keyboard, a mouse, and a communication board. The computer includes a display device, a communication board, and the like, and implements the functions described in the first and second embodiments using the processing device, the storage device, the input device, and the output device.

  DESCRIPTION OF SYMBOLS 1 Security management apparatus, 2 Information storage apparatus, 3 Authentication policy, 4 Authentication information, 5 Acquired information of each user, 6 Information distribution apparatus, 7 Authentication execution apparatus, 11 Security terminal apparatus, 12 Information update apparatus, 13 Cache information Storage device, 14 authentication policy, 15 authentication information, 16 authentication execution device, 17 authentication information input device.

Claims (8)

A session is started from the start of the user login process, a session is established after the login process is completed, and is a management apparatus connected to a terminal device that requests transmission of a security policy at least during the login process,
The security policy to be applied to the terminal device is a first type security policy in which the application start timing is limited at the start of the session and is continuously applied during the session after the start of application at the start of the session, and the application start timing is not limited to at the start of the session A security policy storage unit for storing separately from the second type security policy that can be additionally applied after session establishment;
A receiving unit for receiving a security policy transmission request for requesting transmission of a security policy, including a state identifier indicating whether the terminal device is currently performing login processing or login processing from the terminal device;
When the state identifier included in the security policy transmission request is analyzed and it is determined that the terminal device is currently performing a login process, the first type security policy is acquired from the security policy storage unit, and the terminal A security policy acquisition unit that acquires the second type security policy from the security policy storage unit when it is determined that the apparatus has already undergone login processing;
A management apparatus comprising: a transmission unit that transmits the security policy acquired by the security policy acquisition unit to the terminal device. The security policy acquisition unit
As a result of analyzing the state identifier, when it is determined that the terminal device is currently in the login process, the first type security policy is acquired from the security policy storage unit and the second type security policy is acquired,
As a result of the analysis of the state identifier, when it is determined that the terminal device has already been logged in, the second type other than the second type security policy acquired from the security policy storage unit during the login processing of the terminal device. The management apparatus according to claim 1, wherein a security policy is acquired. The management device further includes:
A transmitted security policy information storage unit for storing transmitted security policy information indicating a security policy transmitted from the transmission unit to the terminal device;
The security policy acquisition unit
As a result of the analysis of the state identifier, when it is determined that the terminal device is currently in the login process, the security policy storage unit stores the first type security policy that has not been transmitted to the terminal device based on the transmitted security policy information. Get from
As a result of the analysis of the state identifier, when it is determined that the terminal device has already been logged in, the security policy storage unit stores the second type security policy that has not been transmitted to the terminal device based on the transmitted security policy information. The management device according to claim 1, wherein the management device is acquired from the above. A session is started from the start of a user login process, a session is established after the login process is completed, and is a management apparatus connected to a terminal device that requests user authentication at least during the login process,
A security policy applied to user authentication of the terminal device is a first type security policy that is applied only at the start of a session and is continuously applied during the session after the start of application at the start of the session. A security policy storage unit that stores the security policy separately from the second type security policy that is not limited to time and can be additionally applied after session establishment;
A reception unit that receives a user authentication request for requesting user authentication from the terminal device, including a state identifier indicating whether the terminal device is currently performing login processing or login processing,
When the state identifier included in the user authentication request is analyzed and it is determined that the terminal device is currently performing login processing, the first type security policy is acquired from the security policy storage unit, and the terminal device Security policy acquisition unit that acquires the second type security policy from the security policy storage unit,
A management apparatus comprising: an authentication execution unit that performs user authentication of the terminal device by applying the security policy acquired by the security policy acquisition unit. The security policy acquisition unit
As a result of analyzing the state identifier, when it is determined that the terminal device is currently in the login process, the first type security policy is acquired from the security policy storage unit and the second type security policy is acquired,
As a result of the analysis of the state identifier, when it is determined that the terminal device has already been logged in, the second type other than the second type security policy acquired from the security policy storage unit during the login processing of the terminal device. The management apparatus according to claim 4, wherein a security policy is acquired. The authentication execution unit
When the security policy acquisition unit determines that the terminal device is currently in the login process, the security policy acquisition unit applies the first type security policy and the second type security policy acquired by the security policy acquisition unit. Perform user authentication of the terminal device,
When the security policy acquisition unit determines that the terminal device has already been logged in, the first type security policy and the second security policy acquired by the security policy acquisition unit during the login process of the terminal device 6. The management apparatus according to claim 5, wherein user authentication of the terminal device is performed by applying a seed security policy and a second security policy newly acquired by the security policy acquisition unit. Connected to a management device that stores security policies,
A terminal device in which a session starts from the start of the login process of a user and the session is established after the login process is completed,
A security policy transmission request for requesting transmission of a security policy is included in the management apparatus, including a state identifier indicating whether login processing is currently being performed or login processing is completed at any timing during login processing or after session establishment. A transmitter for transmitting
When the security policy transmission request is transmitted from the transmission unit during the login process, the application start timing is limited at the start of the session, and the first type security policy applied continuously during the session after the start of application at the start of the session When a security policy transmission request is transmitted after the session is established from the management device and the transmission unit is established, the application start timing is not limited to the session start time, and the second type security policy that can be additionally applied after the session is established is received. A receiver,
The first type security policy starts to be applied from the start of the session, and security measures are continuously performed according to the first type security policy during the session. Has a security policy application unit that starts application of the second type security policy received each time the second type security policy is received and implements security measures in accordance with the second type security policy that has been applied. A terminal device characterized by the above. The receiver is
When a security policy transmission request is transmitted from the transmission unit during login processing, the first type security policy and the second type security policy are received from the management device, and the security policy transmission request is transmitted from the transmission unit after session establishment. The terminal device according to claim 7, wherein when received, the terminal device receives a second type security policy other than the second type security policy received during the login process.

Images