JP2000105747A - Screen control method for single log-in system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To obtain a single log in using a portable medium in an enterprise information system by sending user identification information from the portable medium when access is allowed and making the portable medium ineffective when access is not allowed. SOLUTION: An authentication client 22 is provided on the client side to perform an authenticating process using log-in information (certificate, user identification information, etc.). When the user fits the portable medium 700 to a portable medium reader 705, an authentication information input picture is displayed, and a password or biological information on a fingerprint, the retina, etc., is confirmed to judge whether access is allowed or not. When it is judged that the user 11 is the regular user 11, a single log-in process is performed as to a task authenticating process. When not, the portable medium 70 is made ineffective by using the open key of the authentication client 22 and a note showing that the access is not allowed is sent to the user 11.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION When a conventional enterprise information system provides a security management function, an end user is required to use an OS.
And a login operation was requested for each application system. For example, when starting an AP in an in-house business server from a mobile terminal, it is necessary to log in first for each VPN, then for groupware, and also for each business AP, distribution AP, and user AP to be used. If you use a Windows NT server to manage user information in the domain, you were also required to log in to the NT domain. This is a heavy burden for the end user, and there is a danger of lowering the security level as a result of writing down a password that cannot be remembered and pasting it on a desk.

In order to reduce such a security operation load, it is important to provide a utility for realizing a single login and an AP development environment and an execution environment. The present invention relates to a screen control method for realizing a single login in a wide area network system using a portable medium, and cooperates with an integrated authentication server proposed in the prior invention (Japanese Patent Application No. 9-76954). It is intended for a user authentication method that realizes the above.

[0003]

2. Description of the Related Art As described above, in order to reduce the security operation load, it is important to provide a utility for realizing a single login and an AP development environment and an execution environment. As a single login method, there is a method in which a user ID and a password conventionally required for each job are consolidated into one user ID and a password. That is, the user
Once you enter your login information, you will be able to log in to all your business. Indeed, this is a method to reduce the security operation load, but at the same time, there is a danger of weakening security. If the aggregated user ID and password are broken, a malicious third party can infiltrate the system more easily than before, thereby putting confidential corporate information at risk.

[0004] Single login, in which the resources of the corporate information system are accessed by one login, can be realized for the first time by providing a strong user authentication infrastructure. Therefore, it was considered necessary to provide a single login method using the technology of the invention of the prior application (Japanese Patent Application No. 9-76954) as a basis for properly managing login information. In particular, it is necessary to apply technologies that take into account information obtained from authentication based on information that is known, and biological information (fingerprint, retina, DNA information, etc.).

[0005]

SUMMARY OF THE INVENTION An object of the present invention is to realize a single login using a portable medium in an enterprise information system. In the method of Japanese Patent Application No. 9-76954, in order to realize a single login in the enterprise information system with the information of one certificate, the integrated authentication server checks the information of the certificate and performs user authentication. It is an object of the present invention to realize the same user authentication processing on the client side. In order to manage login information on the client side, it cannot be placed on the hard disk of the PC from the viewpoint of security and operation. Therefore, use of a secure portable medium is indispensable. At present, FDs and IC cards may be the mainstream as portable media, but the use of rings, tie pins, earrings, and the like, as well as the use of biological information such as fingerprints and retinas, has also been an issue.

[0006]

According to the present invention, in a network system in which a client, a business server, and an integrated authentication server can communicate with each other, a user can carry out user authentication processing for a plurality of businesses at one time. Medium
Means for determining whether or not access to (where the user's login information is stored) .If the access is permitted, the portable medium can be accessed from the portable medium every time a user authentication process is required in business. Send the user identification information to the user authentication screen. If the access is not permitted, the portable medium is invalidated. For a user who does not use the portable medium, a user authentication screen is displayed in order to perform conventional user authentication processing for each job.

Means for displaying a portable medium issuance application screen to the user in order to issue a portable medium to the user; means for transmitting information input by the user to the portable medium application screen to an integrated authentication server; Means for receiving a portable medium issued by the authentication server is provided.

A means for displaying a portable medium reuse application screen for a user whose access is denied by the access permission / non-permission determining means and wishes to use the authentication processing using the portable medium again, A means for transmitting information input to the medium reuse request screen to the integrated authentication server, and means for permitting the user to perform a user authentication process using a portable medium for the user by the integrated authentication server.

[0009] Further, it is possible to cooperate the process using the portable medium with the business process, and to automatically start the business for the user who is permitted access, when the user removes the portable medium. It also provides a means to automatically end the business.

[0010]

DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 is a configuration diagram of a network system according to the present embodiment. A corporate network system 1 and another corporate network system 9 are connected to a wide area network 10 such as the Internet. In the corporate network system 1, in addition to the client 8, an integrated authentication server 2, a server 3 for managing security information, an access control server 50, a database (DB) server 5, a business server 6,
Servers such as a groupware server 4, a key management server 17, and a certificate issuing server 18 are connected. The DB server 5 and the business server 6 are servers accessed by the client 8 and used for business processing. The groupware server 4 is a server that sends the first job menu screen to the client 8, manages transmission and reception of e-mail of the client 8, and manages user schedules. Other company network system 9 has a client
20 is connected, and the user 11 of the client 8 and the user 14 of the client 20 perform a specific business such as an electronic transaction using a certificate or an externally issued certificate. The user 11 and the user 14 carry a portable medium 700 such as an FD, an IC card, a bracelet, a ring, and a tie pin, and perform an authentication process using the portable medium 700. The server 3 is a server for centrally managing security information including information for controlling access to the DB server 5 and the business server 6 or the other company network system 9 and user authentication information including certificate information according to the business. It is. In the invention of Japanese Patent Application No. 9-76954, the integrated authentication server 2 checks the certificate sent from the client 8, obtains the security information from the server 3, and determines whether the user is qualified to log in to the corporate network system 1. I was investigating. However, in the present invention, by providing the authentication client 22 on the client side, an authentication process using login information (such as a certificate or user identification information) is performed. The access control server 50 is a server that manages the access authority of the user in each business, and the key management server 17 is a key (a secret key and a public key) Key pair). Wide area network 10
Is connected to the external certificate issuing server 7. The external certificate issuing server 7 is a server that issues an external certificate according to a predetermined procedure. Note that a server called a so-called directory server may have the information of the server 3.

FIG. 2 shows a processing sequence in which the user 11 logs in from the client 8 using the portable medium 700. In the invention of Japanese Patent Application No. 9-76954, a user on the client side inputs a certificate 10, and the integrated certificate server
The user authentication was performed by confirming. However, FIG. 2 of the present embodiment is different in that the same certificate confirmation processing is performed by the authentication client 22. Normally, the user 11 displays the I
It is necessary to enter the certificate 10 in the C card,
Taking advantage of the feature of the portable medium 700, a person who can access the portable medium 700 is determined to be a valid user. It is assumed that the portable medium 700 is always operated by the user himself and that access is protected by a password or biological information known only to the user. Portable media
700 needs to be physically secure and robust against unauthorized reading of information by a malicious third party, with the information itself encrypted and stored or no access allowed It provides a mechanism to erase stored information for reading.

First, when the user 11 attaches a portable medium to the portable medium reading device 705 (2001), an authentication information input screen (2002) is displayed, and the user 11 can input biological information such as a password or fingerprint or retina. Enter (2003). Then, access permission is determined by confirming the password or biological information such as fingerprint and retina (2004). If it is determined that the user is a legitimate user 11, a single log-in process is provided for the subsequent business authentication process. Otherwise, the portable medium 700 using the public key of the authentication client 22 is provided. Is invalidated (2005), and an access denied notification is sent to the user 11 (2006). For example, an operation that allows up to three incorrect password entries is also conceivable.
On the portable medium 700 or at a position interlocked with the portable medium 700,
When the authentication device 701 based on biological information is provided,
It is necessary to set the allowable number of times of failure in access determination in consideration of the accuracy of the authentication device 701 based on biological information. In any case, if it is not determined that the user 11 is valid,
Since it is necessary to make the portable medium 700 unusable thereafter, the information in the portable medium is made inaccessible.

As shown in FIG. 2, the user authentication screen normally required for each job is not displayed for a legitimate user. When the user 11 makes a business request to the business server 6 (2007), a user authentication screen is sent from the business server 6 (2008), but the authentication client 22 does not request the user 11 to input information to the screen, The necessary login information is extracted from the portable medium 700 and the information is sent to the business server 6 (2009). Similarly, when the user 11 next wants to access the DB server 5 (2014), the DB server 5
Although a user authentication screen is sent from (2015), the authentication client 22 does not request the user 11 to input information to the screen,
The necessary login information is extracted from the portable medium 700 and sent to the DB server 5 (2016). In the invention of Japanese Patent Application No. 9-76954, the integrated authentication server 2 obtains security information (login information for each job, etc.) from the server 3 and checks whether the user 11 is qualified to log in to the corporate network system 1. . However, in this embodiment, the portable medium
Since the security information can be included in 700, it is not always necessary to make an inquiry to the server 3.
However, in some cases, even the access control information about the details of the business cannot be included in the portable medium 700. In such a case, the server 3 or the access control server 50
Collaboration with is required.

When the user 11 requests the end of the work (2012, 20
19), business end is notified (2013, 2020), client 8
The portable medium 700 is removed from the portable medium reading device 705 in the inside (2021).

A user who does not use the portable medium 700 must perform a conventional authentication process as shown in FIG. In other words, the user is required to enter a user authentication screen
It is necessary to input login information by yourself (3003, 3010) (3004, 3011).

Next, FIG. 4 shows a sequence of a request for issuing the portable medium 700. When the user 14 issues an issuance request for the portable medium 700 (4001), the authentication client 22 displays a portable medium issuance application screen (4002). On the portable medium issuance application screen, it is necessary to specify various information such as user identification information, affiliation information, and job authority information. However, since these information are basically managed by the server 3, at least The identification information is input to the limited user (4003). When the authentication client 22 transmits the input information to the integrated authentication server 2, the integrated authentication server 2 checks the authority of the user 14 by inquiring the server 3 of security information on the user 14 (4004). Then, based on the authority information, the user
The login information for 14 is created (4005), encrypted with the public key of the integrated authentication server 2 (4006), and stored in the portable medium 700. By performing secure communication between the integrated authentication server 2 and the authentication client 22, it is possible to write login information for the user 14 on a portable medium on the authentication client 22 side (4007). It can also be delivered by a method other than communication (4013). In any case,
When the user 14 receives the portable medium, a password setting request for the portable medium 700 is issued (4014), and the user 14 must specify the password. And
The password information is also sent to the authentication client 22 and the integrated authentication server 2 (4015).

Referring to FIG. 5, a description will be given of a process for enabling a user who has been denied access to the portable medium 700 to use the portable medium 700 again. Here, it is assumed that the user 11 is denied access. The user 11 uses the portable medium 700
(5001), the authentication client 22 displays a portable medium reuse request screen (5002). Basically, it is necessary to input the information required for the portable medium issuance application screen, but the user making the portable medium reuse request is a valid user 11 by another means. You can also check For example, if you enter information that only user 11 knows or information that only user 11 has, you will know that you are who you are, so you can change the password on the portable medium to user 11's private key (corresponding to the public key in the certificate). It is also effective to use a procedure to transmit the encrypted data (5004). In this way, if it can be confirmed that the user is the correct user 11, (5
006), the integrated authentication server 2 instructs the authentication client 22 to make the portable medium 700 usable again.
As described in the process 2005 of FIG. 2, the information in the portable medium 700 is made inaccessible using the public key of the authentication client 22. Therefore, in order to release it, the user 11 Password and the secret key of the authentication client 22 are required. By inputting the password of the user 11 and the secret key, the authentication client 22
0 is returned to a referenceable state (5007). And the portable medium 700
Is sent to the user 11 (5008).

From the viewpoint of simplifying the business operation of the user, the function of coordinating with the business shown in FIG. 6 can also be realized. This can be considered as a customized operation for a specific business. For the user permitted to access by the access permission determination (6004), the task is automatically started as scheduled in advance. In the example of FIG. 6, after a series of processing for the business server 6 is completed, operation information for automatically ending the business after performing update processing of the DB server 5 unrelated thereto is stored in advance in a portable medium. Inside the 700. Process from process 6001 in Fig. 6
2 is the same as FIG. 2, but differs from the process 2007 in FIG. 2 in that a process request to the business server 6 in the process 6007 is issued from the portable medium 700. As described above, the portable medium 7
In 00, when the next business request is issued from the user 11, (601
2), issue a business end notification to the business server 6 (6013),
Issue a business request to the next business, DB server 5 (601
4) is specified. Therefore, there is no need for the user 11 to make a business end request to the business server 6 or a business request to the DB server 5. Similarly, when the portable medium 700 is removed (6019), since it is specified to issue a business end notification to the DB server 5 (6020), it is not necessary for the user 11 to issue a business end request to the DB server 5. Absent. In this way, when the portable medium 700 is removed from the reading device, the process is automatically terminated. When the seat is temporarily removed, the portable medium is removed, and the work is accordingly reduced. It is expected that security will increase.

FIG. 7 shows a portable medium 700 for realizing the processing procedures and operation examples shown in FIGS. 2 to 6, a portable medium reading device 705 in a client, an authentication device 701 based on biological information, and a client. The relationship with the authentication client 22 will be described. The portable medium 700 includes an information control unit 7010 and an access availability determination unit 7020. The information control unit 7010 manages the login information 7011, the operation information 7012, and the portable medium status information 7013. The information control unit 7010 manages the state of the portable medium (valid / invalid, etc.), and when the portable medium is in an invalid state, reads information via the portable medium reading device 705. Is prohibited, and the portable medium is enabled by the invalidation release function 7222 and the information writing function 7223 from the authentication client 22. The access permission / non-permission determining unit 7020 is a part that determines a password or biological information input by a user.

The portable medium reading device 705 includes a portable medium 700
This is a device for inserting an information and reading information from the device, and includes an information reading unit 7110 and an insertion state monitoring unit 7120.

The authentication client 22 includes a screen control unit 7210,
It comprises a portable medium control unit 7220 and an information input / output control unit 7230. The screen control unit 7210 includes an authentication information input screen 7211 required when using or applying for a portable medium, and a portable medium issuance application screen 72.
12 and a portable medium reuse request screen 7213, and a user authentication screen 7212 required when a user requests a job. Also,
In the portable medium control unit 7220, a portable medium invalidation function 7221,
It includes a portable medium invalidation release function 7222, a function of writing information to a portable medium 7223, a password management function 7224, and the like. The information input / output control unit 7230 includes a function 7231 for accepting input information from a user, an interface 7322 with the authentication device 701 using biological information, and a function 7233 for displaying information to the user.
Among the clients are the authentication client 22 and the portable medium reading device 705.

[0023]

As described above, according to the present invention, a single login using a portable medium can be realized in an enterprise information system. Utilize the strong user authentication and access control infrastructure proposed in the prior invention (Japanese Patent Application No. 9-76954), and provide a screen control unit using portable media and an authentication unit using biological information on the client side. Allows the user to be strictly authenticated. As a result of the access permission / inhibition determination, the portable medium is invalidated for an unauthorized user, so that high security is guaranteed. The user can use a conventional authentication process that does not use a portable medium, but can also apply for using a portable medium or make an invalid portable medium available again. By linking the use of portable media with tasks, it is possible to simplify user task operations and customize operations for specific tasks.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a network system according to an embodiment.

FIG. 2 is a diagram showing a processing procedure for a user 11 of the embodiment to log in from a client 8 using a portable medium 700.

FIG. 3 is a diagram showing a conventional authentication processing procedure.

FIG. 4 is a diagram showing a procedure of an issuance request process of a portable medium 700 by a user 14 according to the embodiment.

FIG. 5 is a diagram illustrating a processing procedure for enabling a user who has been denied access to the portable medium 700 to use the portable medium 700 again according to the embodiment.

FIG. 6 is an example of an operation customized for a specific task by linking the portable medium 700 of the embodiment with the task.

FIG. 7 shows a portable medium 700 for realizing the processing procedures and operation examples of FIGS. 2 to 6 of the embodiment, a portable medium reading device 705 in a client, and an authentication device 70 based on biological information.
FIG. 1 is a configuration diagram for explaining a relationship between a client device and an authentication client 22 in the client.

[Explanation of symbols]

Corporate network system 1, Other company's network system 9, Wide area network system 10 Network system FW60, FW61 Firewall device Integrated authentication server 2, Security information management server 3, Groupware server 4, DB server 5, Business server 6 , External certificate issuing server 7, key management server 17, certificate issuing server 18, certificate revocation list management server 54, access control server 50, network management server 41 server system client 8, client 20 client authentication client 22 Program on the client that performs user authentication processing in cooperation with the integrated authentication server 2 User 11, User 14: User Portable media 700: Portable media such as FD, IC card, bracelet, ring, tie pin, etc. Portable media reading device 705: Client that reads the contents of the portable medium 700 Device on biometric device Authentication device 701 using biological information Device for authenticating users using fingerprint, retina, DNA information, etc. 2001 to 2021 Processing contents of FIG. 2 3001 to 3014 Processing contents of FIG. 3 4001 to 4016 Processing contents of FIG. 4 5001 to 5008... Processing contents of FIG. 5 6001 to 6020... Processing contents of FIG. 6 Information control unit 7010, login information 7011, operation information 7012, portable medium status information 7013, access permission / non-permission judgment unit 7020. Components of the portable medium 700 Information reading unit 7110, insertion state monitoring unit 7120: components of the portable medium reading device 705 Screen control unit 7210, authentication information input screen 7211, portable medium issue application screen 7212, portable medium reuse Request screen 7213, user authentication screen 7212, portable medium control unit 7220, portable medium invalidation function 7221, portable medium invalidation release function 7222, information writing function to portable medium 7223, password management function 7224, Information input / output control unit 7230, input information receiving function 7 231, interface 7232 with authentication device 701 based on biological information, information display function 7233 ... constituent elements of authentication client 22

Claims (4)

[Claims] In a network system in which a client, a business server, and an integrated authentication server can communicate with each other, access permission / non-permission determination means for a portable medium possessed by a user in order to perform a single user authentication process for a plurality of businesses. Means for transmitting user identification information from the portable medium to a client-side user authentication screen each time the user authentication processing is required, when the access is permitted by the access permission / non-permission determination means; Means for invalidating the portable medium when access is denied by the user, and for a user who does not perform the user authentication processing using the portable medium, a user authentication screen is displayed for each business user authentication processing. A screen control method for a single login system, comprising a display unit. 2. A means for displaying a portable medium issuance application screen for issuing a portable medium to a user, a means for transmitting information input by the user to the portable medium application screen to an integrated authentication server, 2. The screen control method for a single login method according to claim 1, further comprising means for receiving a portable medium issued by the authentication server or information stored in the portable medium. 3. A means for displaying a portable medium reuse request screen for a user whose access is denied by said access permission / non-permission determining means, and integrated authentication of information input by said user on said portable medium reuse request screen. 2. The screen control method for a single login method according to claim 1, further comprising: means for transmitting to a server; and means for permitting the user to perform a user authentication process using a portable medium by the integrated authentication server. 4. A means for automatically starting a job for a user permitted to access by said access permission / judgment means, and a means for automatically terminating a job when said user removes a portable medium. 2. The method according to claim 1, further comprising:
Screen control method for the single login method described.