JPH11175476A - Security check method and authentication system and record medium for recording program in the same method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize synthetic security management by providing pleural authentication systems, and selecting and executing the certification system according to attribute information other than a user name and a password inputted by a user. SOLUTION: When a computer 2(3) uses a computer resource or a network resource, a security check dispatcher 21 promotes the input of network information including attribute information in addition to a user identifier and a password, selects any of plural proliminairly prepared certification systems according to the inputted attribute information or constitution information following a PD 5, and activates a computer authenticating processor 23 or a network authenticating processor 22. Thus, security check following the selected certification system can be attained.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a security check method and an authentication system, and a recording medium on which the method is programmed and recorded.

[0002]

2. Description of the Related Art In a client server system, a server having a specific function such as a database access is accessed from a client system having an interface on the user side and application logic, and the server or another different server via a network. By processing on a computer and responding to a client's request, a system is realized in cooperation between network-connected computers.

Incidentally, the above-described client-server system needs to manage the security of each of the network resources and the computer resources constituting the network. Conventionally, these resources are separately managed in terms of security, and a user has to perform a plurality of security checks to access a plurality of resource groups.

[0004]

As a method of integrating these, a method of simply allowing a plurality of resources to be accessed by a single security method is conceivable.
In this case, usually, the security information on the network side must be used.

[0005] For example, in Japanese Patent Application Laid-Open No. 8-314863,
The network authentication is performed on the network, but the subsequent access right check of the resources is performed by the computer on the main body side. There is also a method of ensuring collective security in this way, but in this case, even if the computer is disconnected from the network, a network security check is required. That is, the authentication information flows on the network without any need. Alternatively, performing a security check on only the main body is the same as receiving a plurality of security checks as described above.

The present invention has been made in view of the above circumstances, and has a plurality of authentication methods, and selects and executes the authentication method in accordance with attribute information other than a user name and a password input by a user, thereby achieving unified security. An object of the present invention is to provide a security check method and an authentication system capable of realizing management, and a recording medium on which the method is programmed and recorded.

[0007]

A security check method according to the present invention is a computer which can use resources in a network by connecting to a network. When the computer uses computer resources or network resources, a user identifier and Prompt for input of network information including the attribute information in addition to the password, select one of a plurality of prepared authentication methods according to the input attribute information, and perform a security check according to the selected authentication method It is characterized by. When a computer that can use resources in the network by connecting to a network, and the computer uses computer resources or network resources, a plurality of authentication methods prepared in advance based on configuration information possessed by the system are used. It is also characterized in that a security check according to the selected authentication method is performed based on a user identifier and a password which are selected and inputted.

The authentication system of the present invention prompts input of network information including attribute information in addition to a user identifier and a password, and selects one of a plurality of authentication methods prepared in advance according to the input attribute information. One or more computers that authenticate themselves or authenticate to an authentication server connected via a network line, and authenticates depending on attribute information, and sends a result of the authentication to a requested computer. And a response authentication server. Also, based on the configuration information generated by the system, select one of a plurality of authentication methods prepared in advance, and authenticate yourself with the input user identifier and password, or connect via a network line. It is also characterized in that it comprises one or more computers for entrusting authentication to an authentication server to be executed, and an authentication server for performing authentication depending on the configuration information and responding to the computer that has made a request with a result of the authentication. .

A recording medium according to the present invention is a computer which can use resources in a network by connecting to a network, and is used when the computer uses computer resources or network resources. Prompting input of network information including the attribute information, selecting one of a plurality of authentication methods prepared in advance according to the input attribute information, and performing a security check according to the selected authentication method Are programmed and recorded. A computer capable of using resources in the network by connecting to the network, the computer being used when the computer uses computer resources or network resources, and a step of referring to configuration information generated by the system; A step of selecting one of a plurality of authentication methods prepared in advance, and a step of performing a security check in accordance with the selected authentication method by an input user identifier and a password, are programmed and recorded. Also features.

As a result, security can be managed collectively, security functions can be enhanced without accessing unnecessary resources, and various access rights can always be exercised by the user with the same input contents.

[0011]

FIG. 1 is a block diagram showing an example of the configuration of an authentication system according to the present invention. In the figure, reference numeral 1 denotes an authentication server, and reference numerals 2 and 3 denote client computers, both of which are connected via a network line 4. Reference numeral 5 denotes a mass storage external storage device, which is referred to by the client computer 2. Characteristically, the present invention includes a security check dispatcher SCD21 and a property generator PG25 in the client computer 2 (3).

The SCD 21 has its computer 2 (3)
When using computer resources or network resources, the user is prompted to enter network information including attribute information in addition to the user identifier and password, and a plurality of authentications prepared in advance according to the input attribute information or configuration information according to the PD 25. One of the methods is selected, the computer authentication processor 23 or the network authentication processor 22 prepared in advance is activated, and a security check according to the selected authentication method is performed. Details of each configuration will be described later.

FIG. 2 shows a software structure implemented in the client computers 2 and 3. FIG.
FIG. 3 is a diagram showing a structure of software used in the embodiment of the present invention mapped on a memory of a client computer. In the figure, reference numeral 21 denotes a security check dispatcher (SCD), which prompts a user to input a user identifier 2101, a password 2102, and network information 210 including attribute information 2103 thereof. Reference numerals 22 and 23 denote processors (network authentication processor 22 and computer authentication processor 23, respectively) prepared in advance for performing authentication of network resources and authentication of resources in a computer. The SCD 21 follows the above-mentioned user input. One of them is selected according to the attribute information 2103 and activated. For example, the network authentication processor 22 sends the network information 210 to the authentication server 1 via the network line 4 to check the authentication, and the computer authentication processor 23 checks the authentication by referring to its own password database 24. .

Of the network information 210, only the attribute information can be automatically generated by the computer 2 (3) without depending on user input. That is, the automatic generation of the configuration information by the property generator (PG25) is used. The PG 25 is an extension of the functions of the configuration survey program normally provided in a computer. The PG 25 accesses the network 4 to confirm that the computer 2 is correctly connected to the network. , Attribute information 2103
Is set to the information that selects network access. Then, control is transferred to the SCD 22, and if authentication by the network is permitted, the computer 2
Access rights, including resources within Also,
If the connection has not been made, information for prohibiting network access is set, and access rights for only resources in the computer are given. Resource access rights can be managed easily and with a unified security scheme.

FIG. 3 is a flowchart describing a specific operation of the embodiment of the present invention described above.
The flow of the program processing by D21 is shown. S
At the time of security check, the CD 21 generates a display screen shown in FIG.
D. The user is prompted to enter attribute information in addition to the password (step S2). Here, it is assumed that the user selects and instructs the checkboxes Net and Local displayed on the screen as the attribute information. When Net is selected, network access including computer resources is displayed, and when Local is selected, only access to computer resources is displayed.

The SCD 21 further checks the existence of the configuration information (step S3), and if there is (step S3 is present), refers to the configuration information by the PG 25 (step S4).
Then, one or both of the network authentication processor 22 and the computer authentication processor 23 are selected, and an appropriate security check is performed (step S6). If there is no configuration information (No in step S3), Net or Local according to the attribute information input from the user is checked (step S5), and an appropriate security check is performed.

By controlling as described above, the optimum authentication method can be selected without imposing a particular burden on the user, and when there is no need to use network resources, the optimum authentication method can be obtained simply by changing the attribute information. Becomes possible,
Eliminate unnecessary network access.

[0018]

As described above, according to the present invention, when a computer uses computer resources or network resources, input of network information including attribute information in addition to a user identifier and a password is prompted, and the input attribute information is input. Alternatively, according to the configuration information, one of a plurality of authentication methods prepared in advance is selected, and a security check according to the selected authentication method is performed,
As a result, when it is not necessary to use network resources, authentication can be performed only by changing attribute information or configuration information, and unnecessary network access does not occur. Therefore, the chance of password theft is reduced, and the user can always exercise various access rights with the same input contents.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration example of an authentication system of the present invention;

FIG. 2 is a diagram showing the structure of software implemented on the client computer shown in FIG. 1 expanded on a memory;

FIG. 3 is a flowchart cited for explaining the operation of the embodiment of the present invention,

FIG. 4 is a view showing an example of a password input screen used in the present invention;

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Authentication server, 2 (3) ... Client computer, 4 ... Network line, 5 ... Authentication database, 2
1. Security check dispatcher (SCD),
22 network authentication processor, 23 computer authentication processor, 24 password database, 2
5. Property generator (PG).

Claims (8)

[Claims] 1. A computer which can use resources in a network by connecting to a network. When the computer uses computer resources or network resources, the network information includes attribute information in addition to a user identifier and a password. A security check method characterized by prompting an input, selecting one of a plurality of authentication methods prepared in advance according to input attribute information, and performing a security check according to the selected authentication method. 2. A computer which can use resources in a network by connecting to a network. When the computer uses computer resources or network resources, a plurality of computers prepared in advance based on configuration information of the system. A security check method comprising selecting one of the authentication methods and performing a security check according to the selected authentication method based on a user identifier and a password input. 3. The security check method according to claim 1, wherein resources accessible by a certain authentication method include resources accessible by another authentication method. 4. The security check method according to claim 2, wherein the setting of the attribute information by the configuration information of the system is prioritized over the setting of the attribute information by the user. 5. Prompting input of network information including attribute information in addition to a user identifier and a password, selecting one of a plurality of authentication methods prepared in advance according to the input attribute information, and performing authentication by itself. Or one or more computers that delegate authentication to an authentication server connected via a network line, and an authentication server that performs authentication depending on attribute information and responds to the requested computer with a result of the authentication. An authentication system comprising: 6. A method of selecting one of a plurality of authentication methods prepared in advance based on configuration information generated by the system and performing authentication by a user identifier and a password input, or establishing a network line. At least one computer that entrusts authentication to an authentication server connected via the PC, and an authentication server that performs authentication depending on the configuration information and responds to the computer that has requested the result of the authentication. Characteristic authentication system. 7. A recording medium used by a computer that can use resources in the network by connecting to the network, and is used when the computer uses computer resources or network resources. Prompting input of network information including the attribute information, selecting one of a plurality of authentication methods prepared in advance according to the input attribute information, and performing a security check according to the selected authentication method And a computer-readable recording medium on which the program information is recorded. 8. A recording medium used by a computer that can use resources in a network by connecting to a network, and is used when the computer uses computer resources or network resources, and configuration information generated by the system. , A step of selecting one of a plurality of authentication methods prepared in advance based on the configuration information, and a step of performing a security check according to the selected authentication method, based on a user identifier and a password input. And a computer-readable recording medium on which the program information is recorded.