JP2001282667A - Authentication server-client system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To allow between arbitrary clients, who are authenticated by an authentication server, to request and provide services. SOLUTION: The authentication server 100 has a client management table 101 for managing address information on clients 1101 to 100n, service information that the clients can provide, and status information and an access control table 102 which represents whether services provided by the clients are accessable or not accessable by other clients. The authentication server receives a service request from a client, performs retrieval from client management table and access control table to provide address information on a client, which can provide service and authentication as to whether the service providing source client is accessable to a service requesting client, who sends a service request to the service provided source client based on them.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an authentication server / client system comprising an authentication server and a plurality of clients authenticated by the authentication server through a network, and more particularly to authentication between arbitrary clients. And access control technology.

[0002]

2. Description of the Related Art In a server / client system, a client is generally authenticated by a method in which a user inputs a login name and a password, and compares this with a login name and a password registered in advance in a server. I have. However, in this method, it is necessary for the user to remember the password and the like, and it is troublesome to input the password. Further, if the password is known to another person, there is a possibility that the password may be illegally accessed.

Conventionally, as a countermeasure against this, for example, a method described in Japanese Patent Application Laid-Open No. 9-274377 is known. In this method, the client sets a storage medium in which a server address distributed in advance and identification information of the storage medium and the like are stored, reads the storage contents of the storage medium, and sends a message to the server using the read server address. , And sends the read identification information of the storage medium to request permission for server access. Upon receiving a server access permission request from the client side, the server compares the identification information of the storage medium sent at this time with the contents of the storage medium to which server access is to be permitted and stored in advance. Server access permission according to the comparison result
Give unauthorized authentication to the client.

[0004]

In the method described above, the server address to which the client is to be connected is stored in a storage medium, and is unique for each storage medium. Therefore, if the network configuration changes, such as when the address of the server to which the client is to connect dynamically changes or when a new server is added, the storage medium storing the new server address is changed. There is a problem that requires work such as redistribution. Further, with existing devices, it is difficult for any client in the system to dynamically request a service to any server, or for any server to provide service to any client, and the network configuration in the system is difficult. However, there is a problem that it is not possible to easily change or enlarge the size.

An object of the present invention is to enable authentication, service request, service provision, and the like between arbitrary clients authenticated by an authentication server, and to establish a security network without sacrificing flexibility, reliability, and expandability. It is to provide an authentication server / client system that can be constructed.

[0006]

In order to achieve the above object, according to an embodiment of the present invention, in an authentication server / client system comprising an authentication server and a plurality of clients authenticated by the authentication server, the authentication server is It manages and authenticates all clients based on the client management table and the access control table. Each client authenticates between any clients by using information sent from the authentication server and certificate information held by each client. -It is characterized in that service provision and service request are performed by encrypted communication.

[0007] Each client first transmits a client ID, certificate information, address information of each client, provided service information, and the like, which are distributed in advance from the authentication server to the authentication server when the system is started. The authentication server compares the identification information stored in advance with the previously received client ID and certificate information, and authenticates the client as to whether or not access is permitted. When the access is permitted, the address information and the service information notified from each client are stored in the client management table. In addition, each client notifies the authentication server of the change information even when a change occurs in the state such as a change in the address information. Thereby, the authentication server can always hold the latest information of all the clients in the authentication system in the client management table.

When the authentication server manages the address information and the provided service information of all the clients in the system, if each client knows the requested service name,
Even if the address information of the service providing destination is not known, the required service can be received by receiving the address information of the service providing destination client from the authentication server. In addition, the authentication server holds access control information for services between all clients in the authentication system in an access control table, so that all other clients in the authentication system can access the service providing client at the service level. Perform control.

Further, each client has certificate information, and performs a service request between arbitrary clients and encrypts communication at the time of providing a service. This makes it possible to increase the security of the entire network in the authentication system.

[0010]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be specifically described below with reference to the drawings. FIG. 1 is a block diagram showing the overall configuration of an authentication server / client system according to an embodiment of the present invention. The present authentication server / client system includes an authentication server 100, a plurality of clients 110 _{1 to} 110 _n authenticated by the authentication server 100,
And, the authentication server 100 and each client 110 _1-
The communication network 120 connects between 110 _n .
The authentication server 100 has a client management table 101
(Client management means) and access control table 10
2 (access control management means).

The authentication server 100 manages and authenticates all the clients 110 _{1 to} 110 _n in the system, and manages access control between the clients. The client management table 101 stores the client IDs of all the clients 110 _{1 to} 110 _n in the present system, and manages address information, service information, and the like for all the stored client IDs. The access control table 102 stores access control information at a service level between all clients in the system. The clients 110 _{1 to} 110 _n communicate with the authentication server 10
Under the authentication from 0, a service request or service is provided to an arbitrary client. Encrypted communication can be performed between each client. In the following description, it is assumed that the client 110 _n is a service providing client. Of course, the client 110 _n can be the service requesting side and the client 110 ₁ can be the service providing side.

FIG. 2 shows the authentication server 100 and each client 110 ₁ ,
It is a diagram illustrating a flow of a process between 110 _n. FIG.
, The outline operation of the authentication server 100 and the clients 110 ₁ and 110 _n in the present system will be described.

First, registration notification processing of the clients 110 ₁ and 110 _{n to} the authentication server 100 will be described. The authentication server 100 stores the client IDs of the clients 110 ₁ and 110 _n and certificate information including a public key certificate and private key information used for authentication and encryption in advance for each client 1.
Distributed to _{10 1, 110 n (201)} . Client 1
10 ₁ and 110 _n transmit the client ID and the certificate information distributed in advance to the authentication server 100 when the system is started up, and are authenticated by the authentication server 100 for permission / inhibition of access. At this time, the clients 110 ₁ and 110 _n transmit registration information such as their address information, provided service information, and status information to the authentication server 100 (202). When the authentication server 100 permits access to the clients 110 ₁ and 110 _n , the authentication server 100 updates the client management table 101 according to the registration information sent from the clients 110 ₁ and 110 _n (20).
3). After that, the authentication server 100
A notification of the authentication result is sent to the 0 ₁ and 110 _n (204).
If the authentication result notification indicates that the access is permitted, the authentication server 100 sends the authentication result notification together with the authentication result notification.
The client ID list in the system managed by the client is also transmitted to the clients 110 ₁ and 110 _n . Now, _assuming that the client 110 _n has a service that can be provided, the client 110 _n according to the client ID list received from the authentication server 100,
For each service provided by 10 _n , service use permission / non-permission of each client is set to create access control information, and the created access control information is transmitted to the authentication server 100 (205). Authentication server 100
Updates the access control table 102 in the authentication server 100 according to the access control information received from the client 110 _n (206). Client 110 ₁
If the client 110 ₁ does not have a service that can be provided between the authentication server 100 and the authentication server 100, the processing 205, 20
6 is unnecessary.

Next, a series of processing for service request and service provision between the client 110 ₁ and the client 110 _n will be described.

First, the client 110 ₁ (service request side) makes a service request to the authentication server 100 (2).
07). At this time, the client 110 ₁ communicates with the authentication server 1
00, the client ID and certificate information of the client 110 ₁ are sent. The authentication server 100 includes the client 11
By client ID and certificate information of from 0 to _1,
The client management table 101 is searched to authenticate access permission / non-permission. If access is permitted, access control processing is performed based on the access control table 102, and the address information of a service providing destination client that can access the requested service is stored in the client 11
Notify 0 ₁ (208). Here, client 1
It is assumed that 10 _n address information has been notified.

The client 110 ₁ communicates with the authentication server 10
Client 1 that is the service provider notified from 0
A service request is made to 10 _n (209). The client 110 _{n that} has received the service request from the client 110 ₁ sends the client 11
Inquiry 0 ₁ of legitimacy (210), the authentication server 10
From 0, it undergoes a client 110 _n response of the client 110 _first access permitted or not for providing services (211). Upon receiving the access permission from the authentication server 100, the client 110 _n
0 ₁ is notified of the start of service provision (212), and the clients 110 ₁ and 110 _n perform encrypted communication using their respective public key certificates and private keys (213).

The client 11 on the service providing side
Authentication server 1 for inquiry (210) from 0 _n
00 response processing (211) is performed by the previous client 110
Authentication server 100 for _one service request (207)
This is the same process as the access control process in. That is, the access right is checked twice when the service is requested and when the service is provided, in order to enhance reliability. However, if sufficient reliability can be obtained only when the service is requested, the check (processing 210, 211) can be omitted. Conversely, the access control processing at the time of service request is omitted, and the access control processing (service 21) is performed at the time of providing the service.
0, 211) can also be selected.

Next, each of the clients 110 _{1 to} 110 _1
n ends the service provided by the user (service stopped)
The operation in the case of doing this will be described. The client terminates (stops) the authentication server 100 when the service ends.
Make a notification. When receiving the end notification from the client, the authentication server 100
In the status information of the target service regarding the client in the end state (stop state). At this time, each client cannot make the service request to the client whose service has been terminated.

Further, each of the clients 110 _{1 to} 110 _n notifies the authentication server 100 of the change when there is a change in the setting of the permission or non-permission of each client for the service provided by the client. Authentication server 1
00 updates the access control table 102 according to this change notification. Thereby, the authentication server 100 always
It is possible to have the latest access control information at the provided service level among all the clients 110 _{1 to} 110 _n .

FIG. 3 shows a configuration example of the client management table 101 managed by the authentication server 100. The client management table 101 includes client ID information in the system, address information of each client, provided service information, status information, and the like. Each client can have one or more provided services. The provided services include service information that can be provided by each client, and the status information indicates the latest state of each provided service such as starting or stopping. Is stored.

The client management table 101 is created and updated by the authentication server 100. First, all client IDs of the clients issued at the time of issuing the certificate information in the authentication server (201 in FIG. 2) are registered in the client management table 101. At this time, the address information, the provided service, and the status information corresponding to the registered client ID are not registered in the table. After that, each of the clients 110 _{1 to} 110 _n starts the authentication server 100 when the system is started or the program is started.
Is notified of address information, provided service, and status information (202 in FIG. 2). This is called a start notification. The authentication server 100 creates and updates a client management table according to the activation notification information. At this time, the status information becomes active. In addition, each client 110
_When the provided service is terminated (stopped), _{1 to} 110 _n notify the authentication server 100 of the address information, the target service, and the status information of the service termination. This is called an end notification. The authentication server 100 sets the status of the target client ID and the status of the target service in the client management table 101 to inactive according to the end notification information. Furthermore, each client _{1101 n} address information, providing services, when there is a change in the status information, each time, the client _1101
n notifies the authentication server 100 of the change, and the authentication server 100 updates the client management table 101. Accordingly, the authentication server 100 can have the latest information of each of the clients 110 _{1 to} 110 _{n in} the client management table 101.

FIG. 4 shows an example of the configuration of the access control table 102 for storing access control information at the service level provided between all clients in the system. The access control table 102 is held in the authentication server 100 like the client management table 101, and the authentication server 100 creates and updates. As shown in FIG.
The access control table 102 has, as a matrix table, all access control information for each service provided between the clients, and stores information indicating access permission / non-permission.

The access control table 102 is created and updated by the authentication server according to the notification information from each client. First, each of the clients 110 _{1 to} 110 _n acquires all client IDs in the system from the authentication server 100 (process 204 in FIG. 2). Each of the clients 110 _{1 to} 110 _n determines, based on the client ID list, whether to permit or prohibit the use of the service that can be provided for each client, and creates access control information. After the creation, each of the clients 110 _{1 to} 110 _n transmits the access control information to the authentication server 100. Process 205 of the previous Figure 2, for convenience, shows the registration of the access control information about the client 110 _1.
By writing the access control information received from each client into the access control table 102, the authentication server 100 can have the access control information at the service level provided by all the clients in the system in the access control table 102. Become.

FIG. 5 shows each of the clients 110 ₁ to 110 _{1 in} advance.
The content of the certificate information distributed to 10 _n is shown. Each of the clients 110 _{1 to} 110 _n uses the public key certificate and the private key included in the certificate information to
The authentication / encryption communication is performed between 0 and an arbitrary client.

FIG. 6 shows that each client is connected to the authentication server 10.
9 is a flowchart showing a processing procedure when a start notification, an end notification, and the like for notifying registration information of the client to 0 are performed. Here, the client 110 _n will be described as an example.

First, the client 110 _n connects to the authentication server (step 601), and transmits its client ID, certificate information, address information, provided service, and status information to the authentication server 100 (step 602). Next, the authentication result from the authentication server 100 is determined (step 603), and when the access is rejected, the client 110 _n performs error processing (step 60).
4). If access is granted, client 110 _n
Is the client I in the system from the authentication server 100
D is received (step 605), and in accordance with this information, each client in the system is set to permit or prohibit use of the service provided by itself, access control information is created, and the created access is performed. The control information is transmitted to the authentication server 100 (step 60).
6). Then, the registration result notification from the authentication server 100 is determined (step 607). If the registration is permitted, the registration information to the authentication server 100 is a start notification and the client 110 _n has a service that can be provided. If so, the client 110 _n starts the provided service (step 608). If the registration information to the authentication server 100 is an end notification, end (stop) the target service
(Step 609).

FIG. 7 is a flowchart showing a processing procedure when the authentication server 100 receives a notification such as a start notification or an end notification from each of the clients 110 _{1 to} 110 _n . Here, the client 110 _n will be described as an example.

First, the authentication server 100 sends the client 1
Receiving connections from 10 _n (step 701), the client ID, certificate information, address information, providing services,
The status information is received (Step 702). The client management table 101 is searched using the client ID and the certificate information (step 703), and is compared with the identification information held in advance by the authentication server 100 to authenticate access permission / non-permission (step 704). If the access is denied, the authentication server 100
_The access denial is notified to _n (step 705), and the process ends. If granted permission to the client 110 _n, then the authentication server 110, based on the client management table 101, and transmits the client ID list in the system to the client 110 _n (step 706). Next, the authentication server 100
From 0 _n, receives the access control information to which the client 110 _n created (step 707), updates the access control table 102 on the basis of this information (Step 7
08). After that, the authentication server 100
The registration result is notified to 10 _n (step 709).

FIG. 8 shows that a certain client is the authentication server 1
13 is a flowchart showing a processing procedure when a service request is made to the client 00 and encrypted communication is performed with a client providing the service. Here, client 1
10 ₁ is a service request client, client 11
0 _n is a service providing client.

FIG. 8A shows the client 110.₁Flow of
FIG. Client making service request
Account 110₁First, a service is required to the authentication server 100.
Request (step 801). After that, the authentication server 10
0, a response to the service request is received (step
802), if the result is an access denied,
Iant 110₁Performs error processing (step 80).
3) Terminate the service request. Access allowed
Client 110₁Is the authentication server 100
Client 110 to which the service is provided_nAddress information
Information (step 804), and uses this address information.
And the service providing client 110 _nService
A request is made (step 805). Next, this service
Client 110 to which service is provided for request_nFrom
(Step 806), the access is denied.
Client 110₁Performs error handling (
Step 803), the service request ends. Sir
Service providing client 110_nPermission from
Client 110₁Is a proof that is held in advance
Client 110 of the service providing destination using the certificate information
_nPerforms encrypted communication with and receives the applicable service
(Step 807).

FIG. 8 (b) is a flowchart of a client 110 _n. Service providing client 110 _n
Receives a service request from the client 110 _first service requested (step 811), firstly, the client 110 ₁ of the service requested to the authentication server 100
(Step 812), and the result of the inquiry is determined (step 813). Authentication server 10
If the validity of the service request destination client 110 ₁ is determined to be access denied by 0, the access request is notified to the service request destination client 110 ₁ (step 814), and the process is ended here. When the access is permitted, the client 110 _n notifies the service request destination client 110 _{1 of the} start of service provision (step 815), and performs encrypted communication using the certificate information held in advance (step 816). Perform the corresponding service.

In the flowchart of FIG. 8, when the service request destination client 1101 _first makes a service request to the authentication server 100 in step 801,
The service request destination legitimacy by authenticating the authentication server 100, the service provides the client 110 _n, it is also possible to omit the process of step 812 and 813.
Conversely, in response to the service request in step 801, the service request destination client 110 ₁ in the authentication server 100.
By omitting the access control process, it is selectable to perform the inquiry from the service providing client 110 _n in step 812. These are as described in FIG.

FIG. 9 is a flowchart showing a processing procedure when the authentication server 100 receives a service request from an arbitrary client. Here, the client 110 ₁
Suppose a service request is received from.

The authentication server 100 includes a client 110
_{When a} service request is received from the client ₁ (step 901), the client management table 101 is searched (step 90).
2) First, the authentication service request destination client 110 _1, then the requested service is currently to check if provided (step 903). If the authentication result is not permitted or there is no service that can be provided, the authentication server 100 sends the service request destination client 110 ₁
Is notified of access rejection (step 904). If the authentication result indicates that there is a service that is permitted and can be provided, the authentication server 100 sends the service providing destination client (client 110
access control table according to the information of the _n) 102
(Step 905). The access permission or non-permission of the service requesting client 110 _n is determined from the obtained access control information (step 906). If the access is permitted, the service providing client 110 _{n is} provided.
Notifies the address information to the service requesting client 110 ₁ (step 907), if the access denial, notifying the access denial to the client 110 ₁ (step 904).

[0035] Then, the authentication server 100 receives an inquiry from the service providing destination client 110 _n of service requested client 110 ₁ validity (Step 9
08), searches the access control table 102 (step 909), a determination of the accessibility to the target service of the service requested client 110 ₁ (step 9
09). Then, the service request destination client 110 ₁
Determines that access is denied,
If permission to access permission notification is performed to the service providing destination client 110 _n (step 911).

The processing in step 910 is the same as the access control processing in step 906, and it is possible to select whether to perform only one of steps 906 and 910 or both.

Although the embodiment of the present invention has been described above, in FIG. 1, the authentication server 100 has only the client management table 101 and the access control table 102 has the clients 110 _{1 to} 110 _n.
May manage access control information indicating access permission / non-permission of another client with respect to the service provided by the client. In this case, when the authentication server 100 receives a service request from each client 110 ₁ , for example, the client management table 10
1 to notify the client 110 ₁ of address information of the client 110 _n , for example, which can provide a service in response to the service request. Client 11
0 ₁ makes a service request to the client 110 _{n based} on the address information notified from the authentication server 100. When the client 110 _n receives the service request from the client 110 ₁ , the client 110 _n determines whether or not the target provided service that has requested the service has permitted access to the client 110 ₁ based on the access control information held by the client 110 _n . If it is determined and access is permitted,
And notifies the service start to the client 110 _1. Thereby, the burden on the authentication server 100 is reduced, and
The service providing client can start / stop the service without querying the authentication server 100.

[0038]

As described above, according to the authentication server / client system of the present invention, authentication between any clients authenticated in the authentication server and access control at the service level can be performed. In addition, each client has a service request function and a service providing function, and when there is a change in the state due to a change in address information or the like, notifies the authentication server of the change in the state, and the authentication server holds information on all clients. By doing so, even if the scale or configuration of the system changes, authentication, service request, and service provision between arbitrary clients can be performed.
In addition, since the authentication server or the client has access control information of each client, access control can be performed for service provision between arbitrary clients. By applying this authentication server / client system, a flexible security network can be constructed without sacrificing reliability and expandability.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an overall configuration of an authentication server / client system according to an embodiment of the present invention.

FIG. 2 is a block diagram showing a flow of a series of processes between an authentication server and a client in FIG. 1;

FIG. 3 is a diagram illustrating a configuration example of a client management table in FIG. 1;

FIG. 4 is a diagram illustrating a configuration example of an access control table in FIG. 1;

FIG. 5 is a diagram showing contents of certificate information distributed from an authentication server.

FIG. 6 is a flowchart illustrating a processing procedure when a client transmits registration information to an authentication server.

FIG. 7 is a flowchart illustrating a processing procedure when the authentication server receives registration information from a client.

FIG. 8 is a flowchart showing a processing procedure when performing encrypted communication between a service requesting client and a service providing client.

FIG. 9 is a flowchart illustrating a processing procedure when the authentication server receives a service request from a client.

[Explanation of symbols]

REFERENCE SIGNS LIST 100 authentication server 101 client management table 102 access control table 110 ₁ , 110 _n client 120 network

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Takashi Nishiide 6-81 Onoe-cho, Naka-ku, Yokohama-shi, Kanagawa Prefecture In-house Hitachi Software Engineering Co., Ltd. (72) Inventor Hitoshi Kumagai 6 Onoe-cho, Naka-ku, Yokohama-shi, Kanagawa 81-chome Hitachi Software Engineering Co., Ltd. In-house F-term (reference) 5B085 AE04 AE23 BG07 CA04

Claims (5)

[Claims] 1. An authentication server / client system comprising an authentication server and a plurality of clients that are authenticated by the authentication server. The authentication server / client system enables service request and service provision between arbitrary clients. Client management means for managing address information, service information that can be provided by each client, and status information. When the authentication server receives a service request from a client, the authentication server searches the client management means and provides a service. An authentication server for notifying a service requesting client of address information of a possible client, wherein the service requesting client issues a service request to a service providing client based on the address information notified from the authentication server.
Client system. 2. The authentication server / client system according to claim 1, wherein the authentication server manages access control information indicating whether another client can use a service provided by each client. The authentication server, comprising: a management unit, the authentication server searches the access control management unit, and, for a service requesting client, when the provided service of the service providing client is available,
An authentication server / client system for notifying a service requesting client of address information of the service providing client. 3. The authentication server / client system according to claim 1, wherein the authentication server manages access control information indicating whether or not another client can use a service provided by each client. The authentication server searches the access control management means by an inquiry from a service providing client that has received a service request, and determines whether a service request client is available for the provided service of the service providing client. Notifying the service providing client of a search result indicating whether or not the service providing client starts a service for a service requesting client when the search result notified from the authentication server indicates that it is available. Authentication server / client System. 4. The authentication server / client system according to claim 1, wherein each client manages access control information indicating whether another client can use a service provided by the client. The service providing client, upon receiving a service request from the service requesting client, searches the access control management means to indicate that the service provided by the service request is available to the service requesting client. If so, starting a service for the access requesting client. 5. The authentication server / client system according to claim 1, wherein each client includes address information, provided service information,
When there is a change in the status information or the access control information, the change is notified to the authentication server, and the authentication server updates the information of the client management means and the access control management means with the change notification from the client. An authentication server / client system characterized by the following.