DE102004016654A1 - Network component access controlling method for use in network system, involves checking access authorization of user to component by another component based on instruction, and provisioning access for user based on checked result - Google Patents

Abstract

The method involves calculating unique user identification (3) for a user of a network component (10), and registering an order from the user. A right checking instruction is created by another network component (20) based on the identification. An access authorization of the user to the component (20) is checked by the component (10) based on the instruction. The access for the user is provisioned based on the checked result. Independent claims are also included for the following: (A) a network system comprising a network component (B) a primary network component for use in a network having primary access controller (C) a secondary network component having secondary access controller (D) a computer program adapted to execute on a computer to cause the computer to carry out a network component access controlling method.

Description

The The present invention relates to a method for controlling a Access of a first network component to at least one second Network component and a network system with the characteristics of Generic term of the independent Claim 15, which is suitable for carrying out the method is.

Further the present invention relates to first and second network components, the for a use are formed in the network system.

In a network system where multiple computers interconnect with each other Network are connected, for example, it is particularly time-consuming Arithmetic work due to the limited computing power of the individual Computer of the network frequently required to relocate the computational work to several other computers. Also lack of storage capacity the single computer or a centrally stored database can have one Require network access. There must be access and execution rights the computer and facilities of the network being accessed is to be considered, for example, to shift the computational work into account become.

Usually is a user on a first computer connected to the network Registered. Should be a time-consuming arithmetic work on this first Computer running an application running on the first computer tries to use the Work on several second computers connected to the first computer via the computer Network are distributed, distribute. For this purpose send the the first computer running application corresponding orders over the Network to the or the respective second computer.

In order to be able to process the jobs, it is usually necessary for the second computer (s) to first check, based on the access and / or execution rights of the user of the first computer, whether the user is authorized to access the second computer (s). For this purpose, various approaches are known:
In a first approach, the user is known and logged on both the first and second computers. In this case, each computer itself can check the access and / or execution rights of the logged-in user.

In a second approach is the access and / or execution rights centrally through a central computer of the network for the whole Network, which allows the user of the first computer via the Central computer throughout the network is known.

This Approach thus requires a configured computer network with a Central computer for execution the review of Access and / or Execution Rights.

A third prior art approach is known by the name "Corba Call Chain" and will be described with reference to 4 described in more detail below.

In the in 4 As shown, a user wishes to do so by means of a user request 50 on a target object 48 which is in a subdomain 45 a domain 40 is included.

The user request 50 is first of an access control 41 the domain 40 then checked to see if the user has access to the domain 40 contained objects 42 . 43 . 44 or subdomains 45 is entitled.

If the user is authorized to access, the access control fails 41 the domain 40 access to. Otherwise denied access control 41 the domain 40 the access of the user and the forwarding of the user request 50 ,

Is an access of the user from the access control 41 the domain 40 approved, the user request 50 to those in the domain 40 included subdomain 45 forwarded.

Subsequently, the user request 50 from an access control 46 the subdomain 45 then checked if the user also has access to in the subdomain 45 contained objects 47 . 48 . 49 or sub-subdomains (in 4 not shown).

Is the user accessing the subdomain 45 contained objects 47 . 48 . 49 authorized, so allows access control 46 the subdomain 45 the access and the user can through the user request 50 on that in the subdomain 45 included target object 48 access. Otherwise denied access control 46 the user's access to in the subdomain 45 contained objects 47 . 48 . 49 ,

The Corba Call Chain is thus based on a chain of functional processes up to a target object. To verify access authorization, it is necessary to know the identity of the user, the identity of an in-chain access control, or both the identity of the user and the identities the chaining access control along with the user request. Only by transmitting this information is it possible to check the access authorization through chain-linked access controls.

How out 4 As can be clearly seen, the Corba Call Chain's access authorization is always physically located within the chain at the point of processing. Thus, the access authorization check is performed hierarchically before permission to access a domain or subdomain and the computer to be accessed.

The in the prior art previously known approaches have various z. T. serious Disadvantage.

A Login of a user on all computers of a network, on the possible is to be accessed, is associated with an unreasonable effort. Next is the multiple logon of the user the Problem that the computers on which the user is logged in not all at the same time can be supervised, leaving an unauthorized Third over an unattended registered computer slightly unauthorized Gain access to the network. Also is in a multiple application a user's danger is very large that the user forgets to log out of all computers after finishing work.

A central access control via a central computer of the network in turn involves the disadvantage that it requires a network with a central computer and the Central computer and the network connected computer for a central Access control must be set up. In case of malfunction The central computer can provide access to the network for all users impossible be. Next you can Access permissions usually only from a system administrator of the central computer, so this system is very is inflexible.

at The Corba Call Chain, in turn, is detrimental to the review of the Access authorization together with the user request respectively identity of the client, or at least the identity of those in the chain Pass access controls must become. This makes the method very susceptible to manipulation, because the information attached to the user request is easily spied out and misused can be. In addition, the individual access controls the chain with the identity of the respective User or those associated with the in-chain access controls Know access and / or execution rights, making the setup of a Corba Call Chain very time consuming and complex is tedious. That's why the Corba Call Chain is very inflexible.

outgoing It is the object of the present invention to provide a network system and a method of controlling access of a first network component to provide at least a second network component, the largest possible Access security a high level flexibility includes and no additional Hardware components needed.

Further It is an object of the present invention, suitable first and second Network components for to provide the network system according to the invention.

The The object is achieved by a method having the features of the independent claim 1 solved.

Further is the task in a network system with the characteristics of Generic term of the independent Claim 15 by the features of the characterizing part of the independent claim 15 solved.

Further the task is accomplished by first and second network components the characteristics of the independent claims 21 and 26 solved.

advantageous Embodiments are in the respective subclaims.

• – Berechnen einer eindeutigen Benutzeridentifikation für einen Benutzer der ersten Netzwerkkomponente durch die erste Netzwerkkomponente;
• – Registrierung eines Auftrages des Benutzers an die erste Netzwerkkomponente durch die erste Netzwerkkomponente, wobei der Auftrag eine Einbindung der wenigstens einen zweiten Netzwerkkomponente über das Netzwerk bedingt;
• – Übermittlung einer durch die erste Netzwerkkomponente anhand des Auftrages erstellten Anfrage zusammen mit der eindeutigen Benutzeridentifikation durch die erste Netzwerkkomponente über das Netzwerk an die zweite Netzwerkkomponente;
• – Detektion der der Anfrage beigefügten eindeutigen Benutzeridentifikation durch die zweite Netzwerkkomponente;
• – Erstellung eines Rechte-Prüfungsauftrages durch die zweite Netzwerkkomponente anhand der detektierten eindeutigen Benutzeridentifikation;
• – Übermittlung des Rechte-Prüfungsauftrages durch die zweite Netzwerkkomponente über das Netzwerk an die erste Netzwerkkomponente;
• – Überprüfung der Zugangsberechtigung des Benutzers zu der zweiten Netzwerkkomponente durch die erste Netzwerkkomponente anhand des Rechte-Prüfungsauftrages;
• – Übermittlung eines Ergebnisses der Überprüfung durch die erste Netzwerkkomponente über das Netzwerk an die zweite Netzwerkkomponente; und
• – Bereitstellung des Zugangs des Benutzers zu der zweiten Netzwerkkomponente durch die zweite Netzwerkkomponente, wenn das übermittelte Ergebnis der Überprüfung angibt, dass der Benutzer zum Zugang zu der zweiten Netzwerkkomponente berechtigt ist.

According to the present invention, a method for controlling access of a first network component to at least one second network component is proposed, wherein the first network component and the at least one second network component are connected via a network and the method comprises the following steps:

• Calculating by the first network component a unique user identification for a user of the first network component;
• - Registering an order of the user to the first network component by the first network component, wherein the order requires an integration of the at least one second network component via the network;
• - Transmission of a request generated by the first network component based on the order together with the unique user identification by the first network component via the network to the second network component;
• - Detection of the unique user identification attached to the request by the second network component;
• - Creation of a rights audit order by the second network component based on the detected unique user identification;
• - transmission of the rights audit order by the second network component via the network to the first network component;
• - checking the access authorization of the user to the second network component by the first network component based on the rights examination order;
• - transmitting a result of the check by the first network component to the second network component via the network; and
• Providing the user's access to the second network component by the second network component if the transmitted result of the verification indicates that the user is authorized to access the second network component.

Consequently is in accordance with the present Invention by the transmission the unique user identification no associated with the respective user Transmitted access and / or execution right, but only a reference to the access or execution rights of the respective user on the respective first network component passed. The unique user identification is provided by the second network component thus only for the purpose of delegation the review of Access and / or Execution Rights of the user with respect to the second network component evaluated first network component and not to the unique User identification directly the user's access and / or execution rights refer to.

by virtue of the content of the detected by the second network component unique user identification will be the physical verification of Access and / or Execution Rights According to the invention of the second network component back to the first network component. consequently the physical verification of the access and / or execution rights outside direct access to the respective second network component.

by virtue of the delegation of the review of Access and / or execution rights of the user with respect to the second network component of the second network component to the first network component Creation and transmission a rights exam order this process is extremely flexible, as it does without a central computer in the network and the respective Users of the second network component may not even be known got to. A configuration of access and / or execution rights the user on the second network component or a login the user at the second network component is thus not he required. This allows flexible expansion of the network and the first network component requests to any number from second network components.

There moreover, together with the unique user identification none direct access and / or execution rights can, can they were not intercepted and misused by an unauthorized third party so that the inventive method a high level of security across from Tampering guaranteed.

• – Anmeldung des Benutzers bei der ersten Netzwerkkomponente;
• – Überprüfung der Anmeldung durch die erste Netzwerkkomponente; und
• – Bereitstellung eines Zugangs des Benutzers zu der ersten Netzwerkkomponente durch die erste Netzwerkkomponente, wenn die Überprüfung ergibt, dass der Benutzer zum Zugriff zu der ersten Netzwerkkomponente berechtigt ist.

Preferably, the inventive method further comprises the following steps:

• - registration of the user with the first network component;
• - checking the registration by the first network component; and
• Providing the user with access to the first network component by the first network component if the verification indicates that the user is authorized to access the first network component.

By the review of Authorization of the user for access to the first network component will ensure that the access and / or execution rights of the user correctly detected by the first network component be and the actual identity the user is ensured.

In In this case, it is particularly advantageous if the calculation of the unique user identification for the user of the first network component automatically immediately after the provision of access of the User to the first network component.

• – Bearbeitung der Anfrage durch die zweite Netzwerkkomponente zur Gewinnung eines Anfrageergebnisses;
• – Übermittlung des Anfrageergebnisses durch die zweite Netzwerkkomponente über das Netzwerk an die erste Netzwerkkomponente; und
• – Ausgabe des empfangenen Anfrageergebnisses durch die erste Netzwerkkomponente an den Benutzer.

Preferably, the method further comprises the following steps:

• Processing the request by the second network component to obtain a request result;
• - Transmission of the request result by the second network component via the network to the first network component; and
• - Output of the received request result by the first network component to the user.

Here are the steps of the transmission of the Query result by the second network component via the network to the first network component and the output of the received request result by the first network component to the user only optionally if the nature of the request result allows a transmission and output.

According to one preferred embodiment of present invention the unique user identification the name of the user as well as a Communication address of the first network component.

hereby receives the second network component via the unique user identification all information that belongs to a delegation of the review of the Access and / or Execution Rights the user to the second network component of the second Network component to the first network component required are.

In In this case, it is also advantageous if the unique user identification furthermore, the domain indicates the first network component in the network.

According to one particularly preferred embodiment The rights exam order created by the second network component includes individual ones Access criteria of the respective second network component.

Based the one contained in the Rights Audit Order individual access criteria, it is the first network component possible, the access and / or execution rights the user of the first network component to the second network component individually for to check the respective second network component.

Preferably The steps of logging in the user at the first take place Network component, checking the Login by the first network component and the provision of the Access the user to the first network component and / or of computing a unique user identification for a Users of the first network component and / or the review of the Access authorization of the user to the second network component on the basis of the rights examination order and / or the transmission of the verification result about the Network to the second network component through a first access control the first network component.

In In this case, it is particularly advantageous if the unique user identification the name of the user as well as a communication address of the first Includes access control.

Prefers The steps of registering the user's job are done to the first network component and / or the transmission of the basis of the Job created request together with the unique user identification via the Network to the second network component and / or the output of the Request Result to the user by running on the first network component first application.

In In this case, the first application preferably generates the request by modifying the order received from the user.

Preferably the steps of detection of the unique appended to the request take place User identification and / or the creation of a rights exam order based on a clear user identification and / or the transmission of the Rights Examination Contract on the Network to the first network component and / or the deployment the user's access to the second network component a second access control of the second network component.

Further It is advantageous if the steps of detection of the request attached unique user identification and / or processing of the request for obtaining a request result and / or the transmission of the inquiry result over the network to the first network component through a second application the second network component.

He follows the detection of the unique user identification attached to the request through the second application of the second network component, so may the format of the unique user identification independent of a format commonly used by the second access controller chosen since implementation by the second application is possible. As a result, the inventive method especially flexible.

The The present invention is also realized by a computer program product solved, that is suitable, a method according to any one of claims 1 to 13 perform, when it is loaded into a computer.

Furthermore, the above object is achieved by a network system having at least a first network component which is connected via a network to at least one second network component, the first network component having at least a first access controller and a first application and the second network component having at least one second access controller, in which
the first access control is adapted to a calculate unique user identification for a user of the first network component and output to the first application;
the first application is adapted to register a job of the user to the first network component which implies an integration of the second network component via the network, to make a request to the second network component based on the request and to transmit the request together with the unique user identification to transmit the network to the second network component;
the second access controller is adapted to create a rights check job based on the unique user identification and to transmit the rights check job to the first access controller via the network;
the first access controller is further configured to check the access authorization of the user to the second network component based on the received rights check job and to transmit a result of the check over the network to the second access controller; and
the second access controller is further configured to provide the user's access to the second network component if the result of the verification communicated by the first access control indicates that the user is authorized to access the second network component.

there is obvious that the transmission the result of the review of the Received Rights Examination Contract by the first access control to the second access controller not only directly but also indirectly via other elements of the second Network component can be done.

preferably, the first access control is further adapted to log on of the user at the first network component and to provide an access of the user to the first network component, if the over test shows, that the user is entitled to access the first network component is.

Especially It is advantageous if the second network component also has a second application, which is adapted to that of the request attached to detect unique user identification and to the second Access control for the purpose of creating the rights audit order issue and / or the request to obtain a request result to process and the query result over the network to the first Application to submit and the first application is further adapted to receive the received one Request result to the user.

there are the transmission of the inquiry result over the network to the first application and the output of the received Query result by the first application to the user only optional if the nature or nature of the respective query result a transmission and edition permits.

He follows the detection of the unique user identification attached to the request and the output of the unique user identification attached to the request to the second access control for the purpose of creating the rights exam order through the second application, so can both the nomenclature of the request as well as the nomenclature of unique user identification independently be chosen from a nomenclature of the second access control, since a corresponding implementation by the second application can. As a result, the network system according to the invention is particular flexible.

Prefers contains the unique user identification calculated by the first access control the name of the user as well as a communication address of the first Access control.

In In this case, it is advantageous if that of the first access control Furthermore, unique user identification computes the domain of the first one Network component on the network.

Preferably includes the rights audit job created by the second network component individual access criteria of the respective second network component.

Further, the above object is achieved by a first network component for use in a network in which the first network component is connected to at least one second network component via the network, with a first access control configured to provide a unique user identification for a user first network component to compute and output to a first application of the first network component, wherein the first application is adapted to register an order of the user to the first network component, which requires an integration of the second network component via the network, a request based on the order to the second network component and to transmit the request along with the unique user identification via the network to the second network component, and wherein the first access control is further configured to control the access authorization of the user z u the second network component on the basis of one of the second network component as a result of the transmitted unique user identification created and transmitted to the first network component rights check check job and submit a result of the check over the network to the second network component.

there it is particularly advantageous if the first access control further is designed to register the user at a first Network component to check and provide the user's access to the first network component, if the review shows that the user is entitled to access the first network component is.

preferably, the first application is further adapted to be one of the second Network component obtained and transmitted to the first network component Request result to the user.

Prefers contains the unique user identification calculated by the first access control the name of the user as well as a communication address of the first Access control, which is calculated by the first access control unique user identification preferably also the domain of the first Network component on the network.

The above object is also achieved by a second network component for use in a network in which the second network component is connected via the network to at least one first network component, the second network component comprising:
a second access control to detect a unique user identification of a user of the first network component attached to a request transmitted by the first network component, to create a rights audit request based on the unique user identification, and to transmit the rights audit request to the first network component via the network the second access controller is further configured to provide an access of the user to the second network component if a result of a review of the rights check job transmitted by the first access control indicates that the user is authorized to access the second network component.

there may be the detection of the transmitted from the first network component Request attached unique user identification of a user of the first network component by the second access control both indirectly and immediately respectively.

Prefers the second network component further has a second application which is adapted to the unique user identification attached to the request to detect and to the second access control for the purpose of Creation of the rights examination contract issue and / or the request to obtain a request result to process and the query result over the network to the first Network component to submit.

Further it is advantageous if that of the second network component created rights exam order includes individual access criteria of the second network component.

in the Below are embodiments of the present invention with reference to the accompanying drawings, in which like reference numerals designate like elements, described in more detail. It shows

1 schematically the structure of the network system according to the invention according to a preferred embodiment;

2 a flow chart of the inventive method in the network system according to the invention according to the preferred embodiment;

3a and 3b a flow chart of the method according to the invention according to a preferred embodiment; and

4 a Corba call chain according to the prior art.

1 schematically shows the structure of a network system according to a preferred embodiment of the present invention.

This in 1 shown network system has a first network component 10 on that over a network 1 with two second network components 20 and 30 connected is.

In the particularly preferred embodiment shown, the first network component 10 and the second network components 20 . 30 each a first access control 11 or second access controls 21 respectively. 31 as well as a first application 12 or second applications 22 respectively. 32 on.

In 1 this is the first network component 10 and the second network components 20 respectively. 30 to each other over the network 1 networked computers. The first access control 11 or the second access controls 21 . 31 and the first application 12 or the second An applications 22 . 32 are in this embodiment on the respective computers 10 . 20 . 30 running applications. Alternatively, however, the access controls and / or the applications may be implemented, for example, in the form of microprocessor-controlled separate components.

Even if that is in 1 network system shown only a single first network component 10 over the network 1 with two second network components 20 . 30 Alternatively, any number of first network components may connect over the network 1 be connected to any number of second network components.

The in the first network component 10 included first access control 11 is configured to register a user with the first network component 10 to check and access a user to the first network component 10 when the verification reveals that the user has access to the first network component 10 is entitled. The registration can be done as usual in computers, for example via a password.

Furthermore, the first access control is 11 configured to automatically calculate a unique user identification for a user of the first network component and to the first application 12 the first network component 10 issue.

In the in 1 The particularly preferred embodiment shown includes that of the first access control 11 unique user ID calculated the name of the user as well as a communication address of the first access control 11 and also gives the domain of the first network component 10 in the network 1 at. Thus, the unique user identification may, for example, have the format <username> \ <name of the domain of the first network component> \ <computer name> \ <port number of access control>.

hereby receives the second network component via the unique user identification all information that belongs to a delegation of the review of the Access and / or Execution Rights the user to the second network component of the second Network component to the first network component required are.

The in the first network component 10 included first application 12 is trained to have one in the 1 not explicitly shown user interface (via which also the user's login in the first access control 11 can be done), such as a mouse or a keyboard, a job of the user to the first network component 10 to register and determine if the order involves an integration of one or both of the second network components 20 and 30 over the network 1 conditionally.

The integration of one or both of the second network components 20 and 30 over the network 1 may be required, for example, if the computing capacity or storage capacity of the first network component 10 is not sufficient for processing the order or for processing in one or both of the second network components 20 and 30 stored data will be needed.

Based on the job created the first application 12 automatically by a suitable modification of the order, a request to one or both second network components 20 . 30 and transmits the request along with that from the first access control 11 received unique user identification over the network 1 to one or both of the second network components 20 . 30 ,

The second access controls 21 respectively. 31 the second network components 20 respectively. 30 are in the in 1 shown preferred to that of the first network component 10 Submitted request unique user identification of the user of the first network component 10 to detect and create based on the unique user identification a rights audit order.

The rights check order contains individual access criteria for the respective second network component 20 respectively. 30 , allowing for authorization of user access to the respective second network components 20 respectively. 30 (For example, due to on one of the second network components 20 respectively. 30 stored particularly sensitive data) different requirements can be made.

According to an alternative embodiment (the structure of which nevertheless corresponds to that in 1 shown construction), the detection of the unique user identification attached to the request is not performed by the second access controls 21 respectively. 31 but through the second applications 22 . 32 ,

This has the advantage that the nomenclature of the unique user identification and the request only from the second applications 22 . 32 and not the second access controls 21 . 31 depends.

According to this alternative embodiment, a detected unique user identification will be from the second applications 22 . 32 for two automatically create the rights audit job to the respective second access control 21 respectively. 31 output. For this purpose, the unique user identification by the respective second application 22 . 32 previously encoded appropriately.

That of the respective second access control 21 respectively. 31 the second network components 20 respectively. 30 created rights audit order is from the respective second network component 20 respectively. 30 over the network 1 to the first access control 11 the first network component 10 transmitted.

The first access control 11 the first network component 10 Receives the transmitted rights check jobs of the second network components 20 respectively. 30 and checks against the individual second network components based on the individual access criteria contained in the rights audit jobs 20 respectively. 30 the access authorization of the user to the respective second network component 20 respectively. 30 ,

The result thus determined, which indicates whether the user of the first network component 10 to an access to the respective second network component 20 respectively. 30 is authorized by the first access control 11 over the network 1 to the respective second network component 20 respectively. 30 transmitted.

The second access controls 21 respectively. 31 the second network components 20 respectively. 30 depending on the content of one of the first access control 11 the first network component 10 transmitted result access the user of the first network component 10 to the second network component 20 respectively. 30 ready.

If the user of the first network component 10 to an access to the respective second network component 20 respectively. 30 is entitled, the request is the first application 12 the first network component 10 automatically from the respective second access control 21 respectively. 31 to the respective second application 22 respectively. 32 the respective second network component 20 respectively. 30 forwarded and processed by this, in order to win a corresponding query result.

The request result is from the respective second application 22 respectively. 32 the respective second network component 20 respectively. 30 automatically over the network 1 to the first application 12 the first network component 10 and transmitted by it through a suitable, in 1 not explicitly shown interface, such as a monitor or printer, to the user of the first network component 10 output.

It is obvious that the transmission of the request result from the respective second application 22 respectively. 32 over the network 1 to the first application 12 and the output of the received request result by the first application 12 to the user are only optional, if the respective nature or nature of the request result allows a transmission and output.

If the request exists, for example, in a print job to the respective second application 22 respectively. 32 wherein the pressure is through the respective second application 22 respectively. 32 should be done, so is a transmission of the request result of the respective second application 22 respectively. 32 over the network 1 to the first application 12 and the output of the received request result by the first application 12 to the user does not make sense.

The following is the operation of the in 1 shown network system according to the invention with reference to the in 2 shown flow chart and that in the 3a and 3b Flowchart shown explained in more detail.

In a first step S1, an application is made 9 a user 2 at the first access control 11 the first network component 10 ,

In the following step S2, the application 9 through the first access control 11 checked.

If the first access control 11 decides that the user 2 for access to the first network component 10 is authorized, represents the first access control 11 an access of the user 2 to the first network component 10 ready in step S3.

Represents the first access control 11 however, it states that the user 2 due to the registration 9 not to access the first network component 10 is authorized, so denied the first access control 11 the first network component 10 in step S16, the user's access 2 to the first network component 10 and terminate the procedure.

Was in step S3, an access of the user 2 to the first network component 10 established, the first access control calculates 11 in the following step S4 automatically a unique user identification 3 for the user 2 the first network component 10 where the unique user identification 3 the name of the user 2 , a communication address of the first access control 11 the first network component 10 and the domain of the first network component 10 on the network.

In the following step S5 registers the first application 12 the first network component 10 automatically an order 4 the user 2 , where the order 4 due to its nature, an integration of the at least one second network component 20 over the network conditionally.

Subsequently, the first application generates 12 the first network component 10 in step S6 by modifying the job 4 automatically a request 5 and transmits the request created in this way 5 automatically together with the unique user identification 3 over the network to the second network component 20 ,

This can be the unique user identification 3 the first application 12 the first network component 10 according to a first embodiment previously by the first access control 11 have been communicated.

Alternatively, the unique user identification 3 the one from the first application 12 submitted request 5 through the first access control 11 when submitting the request 5 to the second network component 20 automatically attached, so no message of unique user identification 3 through the first access control 11 to the first application 12 must be done.

The request 5 attached unique user identification 3 is from the second access control 21 the second network component 20 automatically detected in step S7.

Alternatively, the transmission of the request 5 together with the unique user identification 3 in step S6 also directly to the second application 22 the second network component 20 which are the request 5 attached unique user identification detected in step S7 and for the purpose of checking the access authorization to the second access control 21 forwards.

In the following step S8 creates the second access control 21 based on the detected unique user identification 3 and based on individual access criteria of the second network component 20 automatically a rights exam order 6 ,

Subsequently, the second access control transmits 21 the second network component 20 the rights exam order 6 in step S9 automatically over the network to the first network component 10 ,

The second access control 21 Submitted rights examination order 6 is from the first access control 11 the first network component 10 receive. The first access control 11 automatically checks the access authorization of the user in step S10 2 to the second network component 20 on the basis of the rights examination order 6 taking into account the rights examination commission 6 contained individual access criteria for the second network component 20 ,

The result 7 the check is made in the following step S11 from the first access control 11 the first network component 10 automatically over the network to the second access control 21 the second network component 20 transmitted.

The second access control 21 checks if the submitted result 7 indicates that the user 2 accesses the second network component 10 is entitled.

If not, the second access control is denied 21 the user's access 2 to the second network component 20 in step S17 and terminates the process.

Otherwise, the second access control 21 the user's access 2 to the second network component 20 ready in step S12.

Unless already done at an earlier stage, the second access control submits 21 then the request 5 and the second application 22 , If necessary, in addition, the result 7 checking the access authorization of the user 2 to the second network component 20 from the second access control 21 to the second application 22 be transmitted.

Will the result 7 checking the access authorization of the user 2 to the second network component 20 from the second access control 21 to the second application 22 transferred, then obtained the second application 22 Knowing if they are for the user 2 the first network component 10 may act.

In the following step S13, the second application processes 22 the request 5 to obtain a request result 8th ,

The request result 8th is subsequently (step S14) of the second application 22 via the second access control 21 over the network to the first network component 10 transmitted.

Such a transmission of the request result 8th from the second application 22 to the first network component 10 Of course, this only happens if the nature of the request result 8th requires a transmission.

The request result 8th is from the first application 12 the first network component 10 via the first access control 11 received and in step S15 to the user 2 the first network component 10 output. This ends the procedure.

According to one particularly preferred embodiment the invention is implemented in the form of a computer program, which for execution the method according to the invention according to one of the claims 1 to 13 when loaded into a computer.

Thus, according to the present invention, the transmission of the unique user identification 3 none with the respective user 2 connected access and / or execution right, but only a reference to the access or execution rights of each user 2 on the respective first network component 10 passed. The unique user identification 3 is from the second network component 20 . 30 thus only for the purpose of delegating the review of the user's access and / or execution rights 2 with regard to the second network component 20 . 30 to the first network component 10 evaluated and not to the unique user identification 3 directly to remove the access and / or execution rights of the user.

Due to the content of the second network component 20 . 30 detected unique user identification 3 is the physical verification of access and / or execution rights according to the invention of the second network component 20 . 30 to the first network component 10 back delegated. Consequently, the physical checking of the access and / or execution rights takes place outside the direct access to the respective second network component 20 . 30 ,

Due to the delegation of verification of the user's access and / or execution rights with respect to the second network component 20 . 30 from the second network component 20 . 30 to the first network component 10 through the creation and transmission of a rights examination contract 6 the solution according to the invention is extremely flexible, since it is without a central computer in the network 1 gets along and the respective user 2 the respective second network component 20 . 30 does not even have to be known. A configuration of the user's access and / or execution rights 2 on the respective second network component 20 . 30 or a user login 2 at the respective second network component 20 . 30 is not required. This allows the network 1 be flexibly expanded and the first network component 10 Requests to any number of second network components 20 . 30 to distribute.

In addition, together with the unique user identification 3 no direct access and / or execution rights are transmitted, they can not be intercepted and misused by an unauthorized third party, so that the inventive solution ensures a high degree of security against manipulation.

By automatically checking the authorization of the user 2 access to the first network component 10 In addition, according to the preferred embodiment described above, it is ensured that the user's access and / or execution rights 2 through the first network component 10 be properly recorded and the actual identity of the user 2 is ensured.

Based on the in the rights exam order 6 preferably containing individual access criteria, it is the first network component 10 possible, the access and / or execution rights of the user 2 the first network component 10 to the second network component 20 . 30 individually for the respective second network component 20 . 30 to check.

Claims (28)

Method for controlling access of a first network component ( 10 ) to at least one second network component ( 20 . 30 ), the first network component ( 10 ) and the at least one second network component ( 20 . 30 ) over a network ( 1 ) and the method comprises the following steps: - (S4) calculating a unique user identification ( 3 ) for a user ( 2 ) of the first network component ( 10 ) by the first network component ( 10 ); - (S5) Registration of an order ( 4 ) of the user ( 2 ) to the first network component ( 10 ) by the first network component ( 10 ), whereby the order ( 4 ) an integration of the at least one second network component ( 20 . 30 ) over the network ( 1 ) conditionally; - (S6) Transmission of a message by the first network component ( 10 ) based on the order ( 4 ) ( 5 ) together with the unique user identification ( 3 ) by the first network component ( 10 ) over the network ( 1 ) to the second network component ( 20 . 30 ); - (S7) Detection of the request ( 5 ) attached unique user identification ( 3 ) by the second network component ( 20 . 30 ); - (S8) Creation of a rights examination contract ( 6 ) by the second network component ( 20 . 30 ) at hand of the detected unique user identification ( 3 ); - (S9) Transmission of the Rights Audit Order ( 6 ) by the second network component ( 20 . 30 ) over the network ( 1 ) to the first network component ( 10 ); - (S10) checking the access authorization of the user ( 2 ) to the second network component ( 20 . 30 ) by the first network component ( 10 ) on the basis of the rights examination order ( 6 ); - (S11) transmission of a result ( 7 ) checking by the first network component ( 10 ) over the network ( 1 ) to the second network component ( 20 . 30 ); and - (S12) providing the user's access ( 2 ) to the second network component ( 20 . 30 ) by the second network component ( 20 . 30 ), if the transmitted result ( 7 ) the verification indicates that the user ( 2 ) for access to the second network component ( 20 . 30 ) is entitled. Method according to claim 1, characterized in that the method further comprises the following steps: - (S1) user's registration ( 2 ) at the first network component ( 10 ); - (S2) Verification of the application by the first network component ( 10 ); and - (S3) providing a user's access ( 2 ) to the first network component ( 10 ) by the first network component ( 10 ), if the verification shows that the user ( 2 ) for access to the first network component ( 10 ) is entitled. Method according to Claim 2, characterized in that the calculation (S4) of the unique user identification (S4) 3 ) for the user ( 2 ) of the first network component ( 10 ) immediately after the (S3) provision of the user's access ( 2 ) to the first network component ( 10 ) he follows. A method according to claim 1, 2 or 3, characterized in that the method further comprises the following steps: - (S13) processing of the request ( 5 ) by the second network component ( 20 . 30 ) to obtain a query result ( 8th ); - (S14) transmission of the request result ( 8th ) by the second network component ( 20 . 30 ) over the network ( 1 ) to the first network component ( 10 ); and - (S15) output the received request result ( 8th ) by the first network component ( 10 ) to the user ( 2 ). Method according to one of the preceding claims, characterized in that the unique user identification ( 3 ) the name of the user ( 2 ) as well as a communication address of the first network component ( 10 ) contains. Method according to claim 5, characterized in that the unique user identification ( 3 ) the domain of the first network component ( 10 ) in the network ( 1 ) indicates. Method according to one of the preceding claims, characterized in that that of the second network component ( 20 . 30 ) created rights examination order ( 6 ) individual access criteria of the respective second network component ( 20 . 30 ) includes. Method according to one of the preceding claims, characterized in that the steps of the (S1) application of the user ( 2 ) at the first network component ( 10 ), the (S2) check of the registration by the first network component ( 10 ) and the (S3) provision of the user's access ( 2 ) to the first network component ( 10 ) and / or (S4) calculating a unique user identification ( 3 ) for a user ( 2 ) of the first network component ( 10 ) and / or the (S10) checking the access authorization of the user ( 2 ) to the second network component ( 20 . 30 ) on the basis of the rights examination order ( 6 ) and / or the (S9) transmission of the check result ( 7 ) over the network ( 1 ) to the second network component ( 20 . 30 ) by a first access control ( 11 ) of the first network component ( 10 ) respectively. Method according to claim 8, characterized in that the unique user identification ( 3 ) the name of the user ( 2 ) as well as a communication address of the first access control ( 11 ) contains. Method according to one of the preceding claims, characterized in that the steps of the (S5) registration of the order ( 4 ) of the user ( 2 ) to the first network component ( 10 ) and / or the (S6) transmission of the order ( 4 ) ( 5 ) together with the unique user identification ( 3 ) over the network ( 1 ) to the second network component ( 20 . 30 ) and / or the (S15) output of the request result ( 8th ) to the user ( 2 ) by one on the first network component ( 10 ) running first application ( 12 ) respectively. Method according to claim 10, characterized in that the first application ( 12 ) the request ( 5 ) by modifying the order ( 4 ) generated. Method according to one of the preceding claims, characterized in that the Steps of (S7) detection of the request ( 5 ) attached unique user identification ( 3 ) and / or the (S8) creation of a rights examination order ( 6 ) based on the unique user identification ( 3 ) and / or the (S9) transmission of the rights audit order ( 6 ) over the network ( 1 ) to the first network component ( 10 ) and / or the (S12) provision of the user's access ( 2 ) to the second network component ( 20 . 30 ) by a second access control ( 21 . 31 ) of the second network component ( 20 . 30 ) respectively. Method according to one of the preceding claims, characterized in that the steps of the (S7) detection of the request ( 5 ) attached unique user identification ( 3 ) and / or the (S13) processing of the request ( 5 ) to obtain a query result ( 8th ) and / or the (S14) transmission of the request result ( 8th ) over the network ( 1 ) to the first network component ( 10 ) by a second application ( 22 . 32 ) of the second network component ( 20 . 30 ) respectively. Computer program product that is suitable, a method according to one of the claims Perform 1 to 13, when it is loaded into a computer. Network system with at least one first network component ( 10 ) over a network ( 1 ) with at least one second network component ( 20 . 30 ), the first network component ( 10 ) at least one first access control ( 11 ) and a first application ( 12 ) and the second network component ( 20 . 30 ) at least one second access control ( 21 . 31 ), characterized in that the first access control ( 11 ) is designed to provide a unique user identification ( 3 ) for a user ( 2 ) of the first network component ( 10 ) and to the first application ( 12 ) issue; the first application ( 12 ) is designed to perform an order ( 4 ) of the user ( 2 ) to the first network component ( 10 ), which involves an integration of the second network component ( 20 . 30 ) over the network ( 1 ), to register, based on the order ( 4 ) a request ( 5 ) to the second network component ( 20 . 30 ) and the request ( 5 ) together with the unique user identification ( 3 ) over the network ( 1 ) to the second network component ( 20 . 30 ) to transmit; the second access control ( 21 . 31 ) is designed to be based on the unique user identification ( 3 ) a rights audit mandate ( 6 ) and the rights examination order ( 6 ) over the network ( 1 ) to the first access control ( 11 ) to transmit; the first access control ( 11 ) is further adapted to the access authorization of the user ( 2 ) to the second network component ( 20 . 30 ) on the basis of the received rights examination order ( 6 ) and a result ( 7 ) the review over the network ( 1 ) to the second access control ( 21 . 31 ) to transmit; and the second access control ( 21 . 31 ) is further adapted to prevent the user ( 2 ) to the second network component ( 20 . 30 ) when the first access control ( 11 ) transmitted result ( 7 ) the verification indicates that the user ( 2 ) for access to the second network component ( 20 . 30 ) is entitled. Network system according to claim 15, characterized in that the first access control ( 11 ) is further adapted to register the user ( 2 ) at the first network component ( 10 ) and a user's access ( 2 ) to the first network component ( 10 ), if the verification shows that the user ( 2 ) for access to the first network component ( 10 ) is entitled. Network system according to Claim 15 or 16, characterized in that the second network component ( 20 . 30 ), a second application ( 22 . 32 ), which is designed to correspond to the request ( 5 ) attached unique user identification ( 3 ) and to the second access control ( 21 . 31 ) for the purpose of the preparation of the rights examination contract ( 6 ) and / or the request ( 5 ) to obtain a query result ( 8th ) and the query result ( 8th ) over the network ( 1 ) to the first application ( 12 ) and the first application ( 12 ) is further adapted to receive the received query result ( 8th ) to the user ( 2 ). A network system according to claim 15, 16 or 17, characterized in that that of the first access control ( 11 ) calculated unique user identification ( 3 ) the name of the user ( 2 ) as well as a communication address of the first access control ( 11 ) contains. Network system according to claim 18, characterized in that the information provided by the first access control ( 11 ) calculated unique user identification ( 3 ) the domain of the first network component ( 10 ) in the network ( 1 ) indicates. Network system according to one of Claims 15 to 19, characterized in that that of the second network component ( 20 . 30 ) created rights examination order ( 6 ) individual access criteria of the respective second network component ( 20 . 30 ) includes. First network component for use in a network ( 1 ), in which the first network component ( 10 ) over the network ( 1 ) with at least one second network component ( 20 . 30 ) connected to a first access control ( 11 ) which is designed to provide a unique user identification ( 3 ) for a user ( 2 ) of the first network component ( 10 ) and to a first application ( 12 ) of the first network component ( 10 ), the first application ( 12 ) is designed to perform an order ( 4 ) of the user ( 2 ) to the first network component ( 10 ), which involves an integration of the second network component ( 20 . 30 ) over the network ( 1 ), to register, based on the order ( 4 ) a request ( 5 ) to the second network component ( 20 . 30 ) and the request ( 5 ) together with the unique user identification ( 3 ) over the network ( 1 ) to the second network component ( 20 . 30 ), and wherein the first access control ( 11 ) is further adapted to the access authorization of the user ( 1 ) to the second network component ( 20 . 30 ) based on one of the second network component ( 20 . 30 ) as a result of the transmitted unique user identification ( 3 ) and to the first network component ( 10 ) transmitted rights examination order ( 6 ) and a result ( 7 ) the review over the network ( 1 ) to the second network component ( 20 . 30 ). First network component according to claim 21, characterized in that the first access control ( 11 ) is further adapted to register the user ( 2 ) at the first network component ( 10 ) and the access of the user ( 2 ) to the first network component ( 10 ), if the verification shows that the user ( 2 ) for access to the first network component ( 10 ) is entitled. First network component according to claim 21 or 22, characterized in that the first application ( 12 ) is further adapted to receive one of the second network component ( 20 . 30 ) and to the first network component ( 10 ) transmitted query result ( 8th ) to the user ( 2 ). First network component according to claim 21, 22 or 23, characterized in that that of the first access control ( 11 ) calculated unique user identification ( 3 ) the name of the user ( 2 ) as well as a communication address of the first access control ( 11 ) contains. First network component according to claim 24, characterized in that that of the first access control ( 11 ) calculated unique user identification ( 3 ) the domain of the first network component ( 10 ) in the network ( 1 ) indicates. Second network component for use in a network ( 1 ), in which the second network component ( 20 . 30 ) over the network ( 1 ) with at least one first network component ( 10 ), with a second access control ( 21 . 31 ) to one of the first network component ( 10 ) ( 5 ) attached unique user identification ( 3 ) of a user ( 2 ) of the first network component ( 10 ), based on the unique user identification ( 3 ) a rights examination order ( 6 ) and the rights examination order ( 6 ) over the network ( 1 ) to the first network component ( 10 ), the second access control ( 21 . 31 ) is further adapted to allow access by the user ( 2 ) to the second network component ( 20 . 30 ) when one of the first access control ( 11 ) transmitted result ( 7 ) a review of the rights examination order ( 6 ) shows that the user ( 2 ) for access to the second network component ( 20 . 30 ) is entitled. Second network component according to claim 26, characterized in that the second network component ( 20 . 30 ), a second application ( 22 . 32 ), which is designed to correspond to the request ( 5 ) attached unique user identification ( 3 ) and to the second access control ( 21 . 31 ) for the purpose of the preparation of the rights examination contract ( 6 ) and / or the request ( 5 ) to obtain a query result ( 8th ) and the query result ( 8th ) over the network ( 1 ) to the first network component ( 10 ). Second network component according to claim 26 or 27, characterized in that that of the second network component ( 20 . 30 ) created rights examination order ( 6 ) individual access criteria of the second network component ( 20 . 30 ) includes.