JP2000267995A - Device and method for integrated security management and recording medium recording program for integrated security management - Google Patents

Abstract

PROBLEM TO BE SOLVED: To utilize a plurality of pieces of software each having original authentication mechanisms without caring about authentication of every software by having an approval data base and a dependency data base and making a system execute the authentication of every software in behalf of a user. SOLUTION: A storage device 2 stores an approval date base 21 and a dependency information data base 22. An initial security judging part 41 receives a user ID and a password or the like from a user information input device 11, collates them with information in the approval data base 21 and confirms whether that information is correct. Concerning the user authenticated by the initial security judging part 41, a security request judging part 42 extracts security information requested by an application 12 from the dependency information data base 22. On the basis of this security information, a security information exchange part 43 performs authentication to security managing devices 32-34 and reports this security information to an application 31.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security integrated management device for integrally managing authentication mechanisms of a plurality of software when each of the plurality of software has an authentication mechanism based on a unique user ID, password, and the like.

[0002]

2. Description of the Related Art In a system in which a desired process is executed using a plurality of software, each software often has an authentication mechanism based on a unique user ID, a password and the like. Conventionally, when using software in such a system, a user inputs a user ID, a password, and the like for each software and is authenticated for each software.

[0003]

However, according to this conventional technique, the user has a user ID,
Since a password must be entered, the user must use the software while always being aware of what user ID, password, etc. are set in each software, and the software cannot be used easily. There was a point.

[0004] The present invention has been made to solve such problems of the prior art, and an object of the present invention is to provide a case where each of a plurality of software has an authentication mechanism based on a unique user ID, a password, and the like. An object of the present invention is to provide a security integrated management device, a security integrated management method, and a recording medium on which a security integrated management program is recorded, which can use software without being conscious of authentication in the plurality of software.

[0005]

According to a first aspect of the present invention, there is provided a first integrated security management apparatus comprising, for each of a plurality of users, identification information and first security information required for authentication when using the system. A first storage unit for storing an approval database in which identification information of each user is associated, and identification information of each user, and second security information required for authentication when the user uses each of the plurality of software. Second storage means for storing the dependent information database, and when the user identification information and the first security information are externally input, the user identification information and the first security information are stored in the approval database. An initial security judgment unit for judging whether or not the user is associated with the identification information of the user; When it is determined that the security information is associated with the first security information, if any of the plurality of software is externally designated, the security information is associated with the identification information of the user from the dependency information database. A security request information input unit for retrieving, from the second security information, information relating to the designated software; and a security request information input unit for retrieving the second security information extracted by the security request information input unit. A security information transfer unit for performing user authentication.

A second security integrated management device according to the present invention provides an approval database in which identification information of each of a plurality of users is associated with first security information required for authentication when using the system. And a dependency information database in which identification information of each user is associated with second security information required for authentication when the user uses each of the plurality of software. When the user's identification information and the first security information are externally input, whether the user's identification information and the first security information are associated with each other in the approval database is determined. An initial security determining unit for determining
When the initial security determining unit determines that the identification information of the user and the first security information are associated with each other, if any of the plurality of software is externally specified, the dependency information A security request information input unit that retrieves, from the database, the second security information associated with the specified software among the second security information associated with the user identification information; and a second security information input unit that retrieves the second security information that is retrieved by the security request information input unit.
And a security information transfer unit for outputting the security information to an application for authenticating the user in the designated software.

According to a first security integrated management method of the present invention, an approval database in which, for each of a plurality of users, identification information thereof is associated with first security information required for authentication when using a system. And a dependency information database in which identification information of each user is associated with second security information required for authentication when the user uses each of the plurality of software. A second step of storing, and when the user identification information and the first security information are externally input, whether the user identification information and the first security information are associated with each other in the approval database A third step of determining
In a case where it is determined in the third step that the identification information of the user is associated with the first security information, if any of the plurality of software is externally specified, the dependency information A fourth step of extracting, from the database, the second security information associated with the specified software among the second security information associated with the identification information of the user, and a second security information extracted in the fourth step. And a fifth step of authenticating the user with the designated software.

According to a second security integrated management method of the present invention, for each of a plurality of users, an approval database in which identification information of the plurality of users is associated with first security information required for authentication when using the system. And a dependency information database in which identification information of each user is associated with second security information required for authentication when the user uses each of the plurality of software. A second step of storing, and when the user identification information and the first security information are externally input, whether the user identification information and the first security information are associated with each other in the approval database A third step of determining
In a case where it is determined in the third step that the identification information of the user is associated with the first security information, if any of the plurality of software is externally specified, the dependency information A fourth step of extracting, from the database, the second security information associated with the specified software among the second security information associated with the identification information of the user, and a second security information extracted in the fourth step. A fifth step of outputting to the application for authenticating the user in the designated software.

The first recording medium of the present invention stores, in advance, an approval database in which identification information of each of a plurality of users is associated with first security information required for authentication when using the system. A dependent information database in which a first process to be stored, identification information of each user, and second security information required for authentication when the user uses each of the plurality of software is stored in advance. The second processing, the user identification information and the first
When the security information is input from the outside, a third process of determining whether the identification information of the user and the first security information are associated with each other in the approval database, When it is determined that the identification information of the user and the first security information are associated with each other, if any of the plurality of software is specified from the outside, the dependency information database determines that the user's A fourth process of extracting the second security information related to the specified software from the second security information associated with the identification information; and performing the designation based on the second security information extracted in the fourth process. And a program for causing a computer to execute a fifth process of performing authentication of the user in the performed software.

[0010] The second recording medium of the present invention stores, in advance, an approval database in which identification information of each of a plurality of users is associated with first security information necessary for authentication when using the system. A dependent information database in which a first process to be stored, identification information of each user, and second security information required for authentication when the user uses each of the plurality of software is stored in advance. The second processing, the user identification information and the first
When the security information is input from the outside, a third process of determining whether the identification information of the user and the first security information are associated with each other in the approval database, When it is determined that the identification information of the user and the first security information are associated with each other, if any of the plurality of software is specified from the outside, the dependency information database determines that the user's A fourth process of extracting the second security information related to the specified software from the second security information associated with the identification information; and a second process of extracting the second security information extracted in the fourth process by the specified software. And a fifth process of outputting to an application for authenticating the user in It has recorded.

The recording medium group according to the present invention includes the first or second recording medium.
The program recorded on any of the recording media is divided into a plurality of portions, and the plurality of portions are respectively recorded on a plurality of recording media.

[0012]

Next, a first embodiment of the present invention will be described in detail with reference to the drawings.

Referring to FIG. 1, according to a first embodiment of the present invention, an input device 1 such as a keyboard, a storage device 2 for storing various information, and a security for performing user authentication of software operating on the system. An output device 3 such as a mechanism (hereinafter, referred to as a “security device”) and a data processing device 4 that operates under program control are included. In addition,
FIG. 1 shows a configuration in which these devices are provided in a terminal device used by a user.

The input device 1 includes a user information input device 11 such as a keyboard, and an application program (hereinafter, simply referred to as an “application”) 1 for requesting security judgment on software desired by a user.
2 is provided.

The user information input device 11 is provided by a user
Information for identifying the user (such as a user ID);
It receives information (such as a password) for confirming that the user has not forged, and inputs the information to the data processing device 4.

The application 12 designates one of the security management devices 32, 33, and 34 as an authentication destination and specifies how to perform authentication as an authentication means.

The storage device 2 includes an approval database 21 and
The dependency information database 22 is stored.

The approval database 21 holds information such as a user ID and a password. It is desirable that this information be encrypted in order to prevent it from being accessed without going through regular procedures.

The dependency information database 22 holds correspondence information between user IDs stored in the approval database 21 and information necessary for authentication in the security management devices 32, 33, and 34 (hereinafter referred to as "security information"). are doing. This information is also desirably encrypted in order to prevent it from being accessed without a formal procedure. Hereinafter, the correspondence information between the user ID and the security information of each security device is referred to as “dependent information”.

The output device 3 includes an application 31 and
Security management devices 32, 33, and 34.

The application 31 has information indicating that authentication in the security management devices 32, 33, 34 has succeeded or failed, or information on the security management devices 32, 3
The information necessary for performing the authentication in 3, 34 is received. The information required for performing authentication is a user ID, a password, and the like.
1 can directly authenticate the security management devices 32, 33, and 34.

Each of the security management devices 32, 33, and 34 is a security management device possessed by software.

The data processing device 4 includes an initial security judgment unit 41, a security request judgment unit 42, and a security information transfer unit 43.

The initial security judging section 41 receives a user ID, a password, and the like from the user information input device 11, compares the received information with information in the approval database 21, and checks whether the information is correct.

The security request judging section 42 retrieves the security information requested by the application 12 from the dependency information database 22 for the user authenticated by the initial security judging section 41.

The security information transfer unit 43 performs two operations in accordance with an instruction from the security request determination unit 42. One is that the security management device 3 based on the security information extracted by the security request determination unit 42.
This is an operation for performing authentication to 2, 33, and 34. The result of this authentication is transmitted to the application 31. The other is an operation of transmitting the security information extracted by the security request determination unit 42 to the application 31.

Next, the operation of this embodiment will be described in detail with reference to FIGS.

As shown in FIG. 2, the initial security judging section 41 sends a user ID,
Receiving user information such as password (Step A)
1) The information is stored in the approval database 2 of the storage device 2.
(Step A)
2). The initial security determination unit 41 determines whether the input user information is registered in the authentication database 21 (step A3), and ends the processing if it is not registered. If registered, it notifies the security request determination unit 42 that the authentication has been successful.

The application 12 receives information on the authentication destination (the security management device 32, the security management device 32,
The security request judging unit 42 is notified of which of 33 and 34 is the authentication destination) and the authentication means (how to perform authentication in the security management devices 32, 33 and 34) (step A4). As the authentication means, either an authentication procedure by integrated security management or an authentication procedure by an application can be selected. The former is
Authentication is performed by the device of the present invention, and the application 31 functions as a procedure for receiving an authentication result. In the latter case, the application 31 receives security request information necessary for authentication by the device of the present invention, and the application 31 transmits the security request information to the security management devices 32, 33,
34 functions as a procedure for directly performing authentication. Which of the authentication means is designated is determined in step A6 described later.

The security request judging section 42 searches the security information about the user authenticated in step A3 from the dependency information database 22 for information on the authentication destination specified by the application 12 (step A5).

The security information transfer unit 43 receives the security information obtained by the security judgment unit 42, and judges the authentication means (Step A6). If it is determined that the authentication means is an authentication procedure based on integrated management, the security information transfer unit 43 determines one or more security management devices 32, 33, and 33 based on the security information.
Authentication is performed at 34 (step A7). The result of the authentication is transmitted to the application 31 (step A8). If it is determined in step A6 that the authentication means is an application authentication procedure, the security information is transmitted to the application 31 (step A9).

Next, the present embodiment will be described using a specific example.

As shown in FIG. 3, the approval database 21
Has a user ID "USR1" and a password "ABCD"
EFG "is defined. Assume that the same user ID and password are given from the user information input device 11 (step A1). The initial security judgment unit 41 determines the user ID and password given from the user information input device 11, It is confirmed that the correspondence of the password exists in the approval database 21 (step A2), it is determined that the input user is a registered user (step A3), and the user ID “USR1” is transmitted to the security request determination unit 42.

As shown in FIG. 3, the dependency information database 22 stores a user ID “USR1” and an authentication destination “D
B ", the authentication user ID" DBUSR1 ", and the authentication destination password" DBABC "are defined.
It is assumed that the security management device of the authentication destination “DB” is the security management device 32. That is, the security management device 32 is an authentication mechanism of DB software, and permits connection with a user ID “DBUSR1” and a password “DBABC”. The application 12
If the user wants to use the DB software and wants to omit the authentication of the security management device 32, the security request information "authentication procedure by security integrated management" and the authentication destination "DB" are given to the security request determination unit 42 as security request information (step A4). Security request determination unit 42
Is the user ID “USR1” given in step A1
And the dependent information database 22 is searched based on the authentication destination “DB” given in step A4 and the authentication destination “DB” and the authentication destination user ID “DBUSR” as security information.
1 ", the authentication destination password" DBABC ", and gives it to the security information transfer unit 43 together with the authentication means" authentication procedure by integrated security management "(step A5).

The security information transfer unit 43 determines that the authentication means given by the application 12 is "authentication procedure by integrated security management" (step A6). Then, the authentication destination “D” given in step A4
Since B "is the security management device 32, the user ID" DBUSR1 "and the password" DB
When authentication is attempted using "ABC" and a result "success" is received (step A7), a result "success" is output to the application 31 (step A8).

In this example, the case where the application 12 wants to omit the authentication of the security management device 32 has been described. Next, an example where the application 31 performs the authentication of the security management device 34 will be described with reference to FIG. I do.

As shown in FIG. 4, the dependency information database 22 stores a user ID “USR1”, an authentication destination “print”,
Authentication user ID “PRUSR1”, authentication destination password ”
PRXX1 "is defined. Here, it is assumed that the security management device of the authentication destination" print "is the security management device 34. That is, the security management device 34 is an authentication mechanism of the printing software, and I
D "PRUSR1" and password "PRXX1" permit connection. The process up to step A3 is the same as the above example using FIG. 3, but the application 12
If the user wants to use print software and wants the application 31 to authenticate the security management device 34, the authentication destination “print” may be used as the security request information.
The authentication means "authentication procedure by application" is given to the security request judgment unit 42 (step A4). The security request determination unit 42 searches the dependency information database 22 based on the user ID “USR1” given in step A1 and the authentication destination “print” given in step A4, and obtains the authentication destination “print” as security information. Authentication destination user ID “PRUSR1”, authentication destination password “PR”
XX1 ”and the security information transfer unit 4 together with the authentication means“ authentication procedure by application ”.
3 (step A5).

The security information transfer unit 43 determines that the authentication means given by the application 12 is “authentication procedure by application” (step A).
6). Then, for the application 31, the authentication destination “print” and the authentication destination user ID “
PRUSR1 "and the authentication destination password" PRXX1 "are output (step A9), and as a result, the application 31 directly authenticates with the security management device 34.

With the above, the operation of the present embodiment ends.

The above embodiment has been described on the assumption that all of the input device 1, the storage device 2, the output device 3, and the data processing device 4 are provided in a terminal device used by a user. In the configuration, when another terminal device has to be used due to a failure of the terminal device, the approval database 21 and the dependency information database 22 in the storage device 2 cannot be referred to from the other terminal device.
There is a problem that processing by desired software cannot be performed. Therefore, only the storage device 2 is provided in a host computer, and a plurality of terminal devices are connected to the computer via a line, so that the approval database 21 and the dependency information database 22 in the storage device 2 can be referred to from the plurality of terminal devices. You may.

Next, a second embodiment of the present invention will be described.

Referring to FIG. 5, according to a second embodiment of the present invention, an input device 5 such as a keyboard, a storage device 6 for storing information, and an output device such as a security device for software operating on the system are provided. 7, a data processing device 8 that operates under program control, and a recording medium 9 that records a program (hereinafter, referred to as a “security integrated management program”) that causes the device to execute processing related to integrated security management. Here, the recording medium 9 is
The recording medium may be a magnetic disk, a semiconductor memory, or another recording medium, and the security integrated management program may be divided and recorded in a recording medium group including a plurality of recording media.

The security integrated management program recorded on the recording medium 9 is loaded into a computer including the input device 5, the output device 6, and the data processing device 8, and the input device 5, the output device 6, and the data processing device 8 Under the control of the loaded program, operations similar to those of the input device 1, the output device 2, and the data processing device 4 in the first embodiment are performed.

In the first and second embodiments, the case where three security management devices are used has been described. However, the number of security management devices is not limited to this, but how many security management devices are used. The present invention can be applied to a system using a management device.

In the first and second embodiments, the case where the application 12 and the application 31 operate on different devices has been described. However, they may be operated on the same device.

In the first and second embodiments of the present invention, the user I required for authentication when using this system
D, an authorization database that stores information such as passwords, and a dependency information database that stores information such as user IDs and passwords required for authentication when using each software. In the case where each of a plurality of software has an authentication mechanism based on a unique user ID, a password, etc., it is possible to use the software without being aware of the authentication in the plurality of software. It has the effect of being able to do it.

[0047]

According to the present invention, when each of a plurality of software has an authentication mechanism based on a unique user ID, a password, and the like, it is possible to use the software without being aware of the authentication in the plurality of software. There is an effect that can be.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of a first exemplary embodiment of the present invention.

FIG. 2 is a flowchart showing an operation of the first exemplary embodiment of the present invention.

FIG. 3 is a diagram for specifically explaining the operation of the first embodiment of the present invention;

FIG. 4 is a diagram for specifically explaining an operation of the first exemplary embodiment of the present invention.

FIG. 5 is a block diagram showing a configuration of a second exemplary embodiment of the present invention.

[Explanation of symbols]

 1,5 Input device 11,51 User information input device 12,52 Application 2,6 Storage device 21,61 Authorization database 22,62 Dependency information database 3,7 Output device 31,71 Application 32,72 Security management device 33,73 Security management device 34, 74 Security management device 4, 8 Data processing device 41, 81 Initial security determination unit 42, 82 Security request determination unit 43, 83 Security information transfer unit 9 Recording medium

Claims (7)

[Claims] A first storage unit for storing, for each of a plurality of users, an approval database in which identification information of the plurality of users is associated with first security information required for authentication when using the system; Second storage means for storing a dependency information database in which identification information of each user is associated with second security information required for authentication when the user uses each of the plurality of software; When the identification information and the first security information are input from the outside, an initial security determination unit that determines whether the identification information of the user and the first security information are associated with each other in the approval database. The initial security determining unit determines that the identification information of the user is associated with the first security information. In this case, when any of the plurality of software is externally specified, the second security information associated with the identification information of the user is associated with the specified software from the dependency information database. A security request information input unit to be extracted, and a security information transfer unit that authenticates the user with the specified software based on the second security information extracted by the security request information input unit. The integrated security management device. 2. A first storage means for storing, for each of a plurality of users, an approval database in which identification information of the plurality of users is associated with first security information required for authentication when using the system. Second storage means for storing a dependency information database in which identification information of each user is associated with second security information required for authentication when the user uses each of the plurality of software; When the identification information and the first security information are input from the outside, an initial security determination unit that determines whether the identification information of the user and the first security information are associated with each other in the approval database. The initial security determining unit determines that the identification information of the user is associated with the first security information. In this case, when any of the plurality of software is externally specified, the second security information associated with the identification information of the user is associated with the specified software from the dependency information database. A security request information input unit to be extracted; and a security information transfer unit that outputs the second security information extracted by the security request information input unit to an application for authenticating the user in the designated software. An integrated security management device characterized by the following. 3. a first step of preliminarily storing an approval database in which identification information of each of a plurality of users is associated with first security information required for authentication when using the system; A second step of storing in advance a dependency information database in which identification information of each user is associated with second security information required for authentication when the user uses each of the plurality of software; A third step of determining whether the identification information of the user and the first security information are associated with each other in the approval database when the identification information and the first security information are input from outside; When it is determined in the third step that the identification information of the user is associated with the first security information, When any one of the plurality of software is externally specified, the second security information associated with the user identification information relating to the specified software is extracted from the dependency information database. And a fifth step of performing authentication of the user with the designated software based on the second security information extracted in the fourth step. Management method. 4. A first step of preliminarily storing an approval database in which identification information of each of a plurality of users is associated with first security information required for authentication when using the system. A second step of storing in advance a dependency information database in which identification information of each user is associated with second security information required for authentication when the user uses each of the plurality of software; A third step of determining whether the identification information of the user and the first security information are associated with each other in the approval database when the identification information and the first security information are input from outside; When it is determined in the third step that the identification information of the user is associated with the first security information, When any one of the plurality of software is externally specified, the second security information associated with the user identification information relating to the specified software is extracted from the dependency information database. And a fifth step of outputting the second security information extracted in the fourth step to an application for authenticating the user in the designated software. Integrated management method. 5. A first process for preliminarily storing an approval database in which identification information of each of a plurality of users is associated with first security information required for authentication when using the system; A second process of storing in advance a dependency information database in which identification information of each user is associated with second security information required for authentication when the user uses each of the plurality of software; When the identification information and the first security information are externally input, a third process of determining whether the identification information of the user and the first security information are associated with each other in the approval database; If it is determined in the third processing that the identification information of the user is associated with the first security information, a plurality of software When any one of the software is specified from the outside, a fourth security information associated with the specified software among the second security information associated with the identification information of the user is extracted from the dependency information database. A program for causing a computer to execute a process, and a fifth process of authenticating the user with the specified software based on the second security information extracted in the fourth process. Recording medium characterized by the above-mentioned. 6. A first process of preliminarily storing an approval database in which identification information of each of a plurality of users is associated with first security information required for authentication when using the system. A second process of storing in advance a dependency information database in which identification information of each user is associated with second security information required for authentication when the user uses each of the plurality of software; When the identification information and the first security information are externally input, a third process of determining whether the identification information of the user and the first security information are associated with each other in the approval database; If it is determined in the third processing that the identification information of the user is associated with the first security information, a plurality of software When any one of the software is specified from the outside, a fourth security information associated with the specified software among the second security information associated with the identification information of the user is extracted from the dependency information database. And a fifth process of outputting the second security information extracted in the fourth process to an application for authenticating the user in the designated software. A recording medium characterized by the above-mentioned. 7. A recording medium group obtained by dividing the program according to claim 5 into a plurality of portions and recording the plurality of portions on a plurality of recording media.