JP2001282747A - Network terminal with user authentication function - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a network terminal with user authentication function, which is useful as a thin client for an application service provider, capable of simultaneously satisfying convenience, security, maintainability and operability. SOLUTION: A recording medium such as IC card storing first information required for connecting the terminal through a network to a server and second information for authenticating a user is loaded, information inputted by the user is collated with the second information stored on the recording medium and when it is matched, while using the first information read out of the recording medium, the terminal is automatically connected to the server. Besides, third information required for utilizing a service provided by the server is stored on the recording medium and while using the third information read out of the recording medium, the terminal is automatically connected to the service provided by the server.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network terminal with a user authentication function, and is used, for example, as a user terminal for electronic commerce.

[0002]

2. Description of the Related Art Hitherto, a provider as an Internet connection provider is called an ISP (Internet Service Provider), and merely provides an environment capable of connecting to the Internet. In contrast, in recent years, ASP
A new business type called (application service provider) has been proposed. This is an attempt to provide an application that previously ran on the user's personal computer on the network, and is suitable for, for example, a term lending service of business software for companies, and has become a big trend in the United States . Unlike the conventional stand-alone environment in which software is installed and used on a user's personal computer, application software is not distributed to the user in the ASP. The application software is installed or updated on a network server, and the user uses the processing power of the server via the network. Therefore,
There is no problem such as inconsistency between hardware and software, or incompatibility between OS and application software, which occurs in the conventional stand-alone environment, and insufficient performance of software due to insufficient hardware capability.

FIG. 5 is an explanatory diagram showing a service providing mechanism by the ASP. The provider hands out the device to the user. A display, keyboard and mouse are connected to the terminal. The “up” information flowing from the terminal to the provider server via the network is operation information input by the user from a keyboard or a mouse. The “downstream” information flowing from the provider server to the terminal via the network is content (mainly image information). The image information sent from the server to the user also includes a screen prompting the user to input. Since this terminal has no hard disk, no CD-ROM drive, and no rotating parts, it has a structure that is very hard to break and easy to handle.

FIGS. 6 and 7 show a stand-alone environment using a conventional personal computer (PC) and an SBC (Ser) using an ASP.
FIG. 4 is an explanatory diagram showing a difference between the “ver based computing”. As shown in FIG. 6, a conventional personal computer (PC) is connected via a CPU, a memory connected on a bus line thereof, a hard disk connected via an interface such as IDE or SCSI, and an I / O port. And a display connected via a video card. On the other hand, in a multi-user network computing environment (FIG. 7) in which a server and a plurality of clients are connected in a 1: n (plural) manner, so to speak, a server I / O port and a user mouse / keyboard It can be said that there is a network between the video card of the server and the display of the user. Therefore, each client does not have a hard disk. No need to install software, CD
-No ROM drive is required. As described above, only the user interface portion such as the screen, keyboard, and mouse of the conventional PC is transferred to the client, and the server centrally processes all the requests from the plurality of clients. The network interposed between the client and the server is not limited to the Internet, but includes CATV and LA.
N or WAN may be used.

[0005] The client shown in FIG. 7 has only a user interface portion and does not perform a heavy processing that requires a load. Therefore, the client can be made not only light in function but also physically thin and small and light. Because of that, "t
It is called a “thin client” in the sense of “hin” (thin) client. When such a thin client is used as a term lending application for business software for a company or as a network terminal for e-commerce (e-commerce), there are several types of thin clients. There's a problem.

[0006]

In the conventional network terminal, anyone can set the connection information to the server, and if the user is a little technically savvy, the set connection information is read and changed. It was easy to do. For this reason, there is a possibility that the service cannot be provided due to the user's easy setting change. Also, if the read connection information is ported to another computer and accessed from that computer, the service of the provider may be used illegally, and a third party or a malicious user from another terminal There was a problem that allowed to login. Further, there is a problem that the service can be used even if the terminal is stolen or operated by a user other than the legitimate user even if the terminal is legitimate. Such unauthorized use may cause the original user to receive an excessive charge or suffer damage from information leakage. In order to reject operations other than authorized users, it is preferable from a security point of view to use a long and complicated user ID and password when logging in to the server, but this degrades user convenience. was there.

SUMMARY OF THE INVENTION The present invention has been made in view of the above points, and provides a user who can satisfy convenience, security, maintainability, and operability at the same time and is useful as a thin client for an application service provider. It is an object to provide a network terminal with an authentication function.

[0008]

According to a first aspect of the present invention, there is provided a network terminal having a user authentication function, the first terminal being necessary to connect the terminal to a server via a network in order to solve the above-mentioned problems. And a recording medium storing the second information for authenticating the user and the second information stored in the recording medium. Automatically connecting to the server using the first information read from the server. In the network terminal with a user authentication function according to the second aspect, based on the premise of the first aspect, the recording medium stores third information necessary for using a service provided by a server. It is characterized by automatically connecting to a service provided by the server using the third information read from the recording medium. Note that the automatic connection to the service may use either encrypted communication or non-encrypted communication.

[0009]

FIG. 1 is an explanatory view conceptually showing the difference between a network terminal of the present invention and a conventional network terminal. In the figure, 1 is an IC card, 2 is a network terminal of the present invention, 3 is a service provider, and 4 is a conventional network terminal. First, in the conventional network terminal 4, log-in information to a network server, information related to the location and connection of the server, connection form such as desktop service and application service, and other information are always set in the registry. In order to set such information, a conventional network terminal has a terminal setting utility, and has been manually registered by a network engineer. To establish a connection with the server,
Automatic login or manual login by operating the connection manager.

Next, the service provider 3 has a plurality of network servers, dynamically distributes access from a user (client) to an optimal server, performs load distribution, and performs application performance and server utilization. The rate optimization has been achieved. After the connection between the server and the client is established, it is necessary to log in to the ASP service itself in order to use the application service, and a user ID (customer account) and a password for that purpose are individually prepared for each user. . This is because users who connect to the server are multi-users, and whether or not a service can be provided depends on the content of the contract. Therefore, a plurality of users are allocated by preparing a user ID (customer account) and a password for each service.

Next, the network terminal 2 of the present invention usually does not have connection information to servers and services. IC
When the card is set and the user is authenticated by inputting the owner password, various setting information is decrypted and loaded into the registry. For this purpose, the network terminal of the present invention provides an I / O for performing communication with the IC card, decryption processing of encrypted data read from the IC card, and management of insertion and removal of the card.
Equipped with C card manager. The IC card 1 includes a CPU for various types of information processing, and stores, in a storage unit, log-in information for a network server, information relating to the location and connection of the server, connection forms such as desktop services and application services, and other information. I remember it. Further, the IC card of this embodiment further stores login information for the ASP service itself. The connection manager automatically establishes a connection with the server based on the connection information read from the IC card, and also automatically logs in to the ASP service itself.

When using the network terminal of the present invention,
In the embodiment shown in FIG. 1, three security checkpoints will be passed. Of these, the user must manually input the password of the IC card in the first stage, but the user ID and password required to log in to the server in the second stage, and the third.
For the user ID (customer account) and password required to log in to the ASP service itself at the stage, IC
Since what is read and decrypted from the card is used, there is no need for the user to input. Therefore, it is possible to use a maximum length user ID or a password that is difficult to guess.

As described above, in the network terminal of the present invention, since the user does not need to manually input the user ID and password, the user ID and password flowing on the network are very long and complicated. be able to. Therefore, it is extremely unlikely that a malicious third party can establish a connection with the server. In addition, complicated passwords and long user IDs are difficult to use for ordinary users, but this system uses user IDs.
Since there is no need for each user to remember the D and the password, the convenience of the user is not impaired. Also, since the user ID and password are not even known to the user in the first place, the possibility of unauthorized use is extremely low. In addition, since even the information related to the location and connection of the server is not exposed to the outside at all, for example, an attack that intentionally concentrates a huge number of accesses on the server and interferes with the provision of services to legitimate users Even the possibility of receiving can be ruled out.

As described above, it is a feature of the network terminal of the present invention that the network terminal has a user authentication function and the connection information is not known to the user. Here, as the server connection information to be encrypted and stored in the IC card, for example, connection form information: IP address or server (host) name of application server, public application (non-desktop service) Published application name,
Command line and working directory name, login information to thin client server: user ID, password, domain name, window color depth, resolution, data stream compression, enable / disable window, firewall connection setting (firewall SOCKS with / without using alternate address for connection
Via the Internet), and information such as login information (user ID and password) to the application service. It is preferable that the login information to the application service be encrypted and communicated with the server.

By preventing the user from knowing the connection information to the server as described above, it is possible to eliminate the possibility that a malicious user illegally uses the application of the provider using a personal computer or the like. An object of the present invention is to realize an environment in which a provider can provide an application with a sense of security by reliably preventing unauthorized use of the application. Also, from the standpoint of a well-meaning user, it is also an object of the present invention to provide a user-friendly system that does not require software installation or difficult setting work, and immediately starts an application when the terminal is turned on. .

That is, not only the automatic log-in to the server but also the automatic log-in to the application itself can be performed only by inserting the IC card and inputting the password. It is possible to provide customized "individual" level services. Further, if a distribution method of "one card per service" is used, one user can go to a different application for each card by replacing and using a plurality of cards.

Further, by storing the connection information in the IC card, the operability of the system is improved. For example, when the connection information is changed by adding a server on the provider side, it is necessary to change the connection information of the user's network terminal. In such a case,
In a conventional network terminal, it is necessary to manually reregister connection information, which is complicated. Of course, with a conventional network terminal, it was possible to change the user's connection information setting by remote control from the server side via the network, but in this case, the user turned on the terminal and connected to the server. I had to keep it. In addition, if a trouble occurs during the work of changing the connection information of the user's terminal, the user's terminal will not be able to start up again. Therefore, when the provider makes any change such as adding a server, the network technician of the provider has to visit each user's home and reset the terminal.

On the other hand, in the network terminal of the present invention, the setting of the connection information of the user is changed by distributing a new IC card with a message "Please use this card from the month x day". be able to. In this case, the user replaces the newly distributed IC card with the IC card that has been used up to now, and does not require any complicated setting operation with exactly the same operation as before, and the provider's It is possible to receive new services to be provided.

Further, even if stolen, the network terminal of the present invention is in a blank state in which connection information to the provider is not stored in the terminal.
A person who does not have an IC card cannot use it at all. Further, if the IC card is stolen, the user may be notified of the damage, and the connection with the user ID or password sent from the IC card may be refused. In this case, the service for the authorized user can be resumed only by issuing a new card. Therefore, security can be ensured even when used for a terminal for Internet banking or online trading.

One configuration example of the network terminal of the present invention will be described with reference to FIG. In the figure, 1 is an IC card, 11 is an IC card data encoder, 12 is an IC card reader, 20 is a client OS, 21 is an IC card reader driver, 22 is an IC card data decoder, 2
3 is a processing unit for connection setting by IC card data,
24 is a connection manager for automatic log-in, and 25 is a processing unit for automatic log-in to a service. The part above the broken line in FIG. 2 shows the configuration on the server side. In the figure, 30 is an OS for the server, 31 is a service login manager, and 32 is a service menu launcher.

The network terminal shown in FIG. 2 is a WBT (Windows Bass) proposed by Microsoft.
Windows CE suitable for ed Terminal)
OS for clients such as
A plurality of softwares 21 to 25 operating on S are installed. The server is Microsoft's WindowsN
T / TSE (Terminal Server Edi
) is installed with an OS for a server having a multi-user function, such as a multi-user function, on which application software is operated in response to requests from a plurality of users.

Before distributing the IC card to the user, the provider uses the IC card data encoder 11 to
The server connection information and data for user authentication are written in the card 1. The user uses the distributed IC card 1 by mounting it on the IC card reader 12. IC
The card reader 12 is connected to a COM port or the like of a network terminal, and when the IC card 1 is attached,
The IC card reader driver 21 can communicate with the CPU in the IC card. The IC card reader driver 21 manages the insertion and removal of the IC card 1 and reads data. The IC card data decoder 22 decrypts the encrypted data read from the IC card 1. Thereby, the connection information to the server is expanded as a profile and set in the registry of the terminal. The connection manager 24 automatically logs in to the server using the set connection information to the server. Furthermore, the service is automatically logged in using the connection information to the ASP itself read from the IC card. ICA encoder is US Citri
The keyboard and mouse operation information is transmitted to the server based on the ICA protocol of Company x. The ICA decoder of the server decodes the operation information transmitted from the network terminal by the ICA protocol and operates the application on the server. Service Login Manager 3
While performing encrypted communication with the client, 1 reads information on the user account and refers to the user information database. The application (or their menu) to be obtained obtained therefrom is passed to the service application launcher 32, and the service application launcher activates this.

Here, the ICA protocol will be briefly described. Correctly, the Citrix ICA (Indep.
end Computing Architec
This is a distributed presentation service protocol developed by Citrix in the United States. WTS (Windows), a thin client / server system that executes all applications on the server side
(Registered Trademark Terminal Server), only the information of the user interface of the application is cut out, and plays a role of exchanging between the server and the client via the network. The information transmitted is only for keystrokes, mouse clicks, and updated parts of the screen, and is therefore very compact data. The minimum required bandwidth of the ICA stream is set to 20 Kbps or less. Therefore, even when using a network with a narrow communication band, users will not feel stressed,
Service can be provided.

FIG. 3 shows how the screen changes when the network terminal of the present invention is started. After the power is turned on, the screen of the network terminal displays “I” as shown in FIG.
Set the C card. Is displayed. When the user sets the IC card in the IC card reader, a message "Please enter a password." Is displayed as shown in FIG. Up to this point, the network terminal is in a clean state with no communication setting information. When the user inputs the password, the network terminal reads the connection information from the IC card to the server, sets the communication state, and performs an automatic login to the server and an automatic login to the service. As shown in the figure, an application / service screen is activated. Thereafter, when the user removes the IC card, as shown in FIG.
"Locked!""Please insert an IC card."
Is displayed, and the terminal is locked.

FIG. 4 shows a flow of processing after power-on of the network terminal of the present invention. When the power is turned on, the network terminal is initialized, and the IC card reader is used to initialize the network terminal.
Check if C card is installed. Until the installation of the IC card is confirmed, the message "Please insert the IC card." Is displayed on the screen. If you have an IC card, "Please enter your password."
Is displayed, and the entered password is referred to the CPU of the IC card. If the password is incorrect, the server connection information will not be loaded on the network terminal. If the password is correct, the user
Since you physically own the card and know the password to unseal the card, you are determined to be a legitimate user, read the card's encrypted data, and connect to the server. Decode the information,
Set the server connection information in the terminal and automatically log in to the server as it is. The service ID and password are read from the card, and the service is automatically logged in. Therefore, the user can immediately use the service as long as the user inserts the IC card and inputs a password for unsealing the IC card. If the IC card is removed while using the service, the terminal is locked and a message "Please insert an IC card." Is displayed. When the IC card is inserted again, the terminal is unlocked and the service can be used again.

The scope of application of the network terminal of the present invention is not necessarily limited to a WBT terminal on the Internet. For example, if a cable TV station of CATV becomes an application service provider,
A set-top box (STB) connected via a cable modem is used as the network terminal of the present invention. In this case, the user's television is used as the display, and the user's remote control is used as the operation input unit.

[0027]

According to the network terminal with a user authentication function of the present invention, both the information for user authentication and the information for connecting to the server are stored in the recording medium. Only those who know the necessary information can operate the terminal, so the security is high. Further, since the server connection information stored in the recording medium is set in the terminal at the time of use, the connection information to the server is not easily leaked to the outside, and no trouble occurs due to the user's setting change. Further, the user can easily call his or her service or environment using different terminals, which is highly convenient. Further, since a maximum length password or a sufficiently complicated password can be used for logging in to the server, it is very difficult for a third party to guess the user ID and the password. Furthermore, even when the server environment of the service provider changes or when a new service is provided, it is only necessary to re-issue the recording medium, and there is no need to go to the user's house to perform on-site work, and the maintainability and operability are high.

[Brief description of the drawings]

FIG. 1 is an explanatory diagram conceptually showing a difference between a network terminal of the present invention and a conventional network terminal.

FIG. 2 is an explanatory diagram showing a configuration example of a network terminal according to the present invention.

FIG. 3 is an explanatory diagram showing a state of screen transition when a network terminal of the present invention is activated.

FIG. 4 is a flowchart showing a flow of processing after power-on of the network terminal of the present invention.

FIG. 5 is an explanatory diagram showing a service providing mechanism by an ASP.

FIG. 6 is an explanatory diagram showing a stand-alone environment using a conventional personal computer.

FIG. 7 is an explanatory diagram showing a network computing environment used in the present invention.

[Explanation of symbols]

 1 IC card 2 network terminal 3 service provider

Continued on the front page F-term (reference)

Claims (2)

[Claims] 1. A recording medium storing first information necessary for connecting a terminal to a server via a network and second information for authenticating a user is mounted, and the information input by the user is stored in the storage medium. A network terminal with a user authentication function, wherein the network terminal with a user authentication function is automatically connected to a server using the first information read from the recording medium when the data matches and matches the second information stored in the recording medium. 2. The recording medium stores third information necessary for using a service provided by the server, and automatically connects to a service provided by the server using the third information read from the recording medium. 2. The method according to claim 1, wherein
Network terminal with user authentication function described.