JP2001344207A - Certification system and its method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To solve such a conventional problem that each certification server should be provided with a specific function for transferring a registered user s certificate between certification servers. SOLUTION: In the certification system 100 constituted of a client 10 connected to a communication line, plural proxy servers 21, 22 interposed between the client 10 and a server 40 and plural certification servers 31, 32 formed correspondingly to respective proxy servers 21, 22, the servers 31, 32 respectively execute certification on the basis of certificates distributed to the corresponding proxy servers 21, 22 and the connection sources of the servers 21, 22. The proxy server 21 repeating the client 10 and the proxy server 22 transfers a certificate 31a owned by the client 10 to the proxy server 22. Thereby it is unnecessary to transfer the registered user's certificate between the certification servers 31, 32.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to an authentication system and an authentication method, and more particularly to a client connected to a communication line, a plurality of proxy servers interposed between the client and the server, and corresponding to these proxy servers. The present invention relates to an authentication system and an authentication method including a plurality of provided authentication servers.

[0002]

2. Description of the Related Art Conventionally, this type of authentication system is composed of a client connected to a communication line, a plurality of proxy servers interposed between the client and the server, and a plurality of authentication servers. The plurality of authentication servers are provided corresponding to the respective proxy servers. Then, the authentication servers belonging to all the proxy servers register the users who use the clients and distribute the certificates to the clients. Moreover,
Based on the distributed certificate, the authentication server performs authentication between the corresponding proxy server and this connection source in order from the client side. As a result, each proxy server can authenticate the user who uses the client. However, since certificates must be distributed from all the authentication servers to the clients, a great deal of work is required only for user management.

In order to reduce this work, there is also known an authentication system in which a user is registered only in an authentication server closest to a client (JP-A-11-328).
117 publication). This authentication system performs authentication between the proxy server and this connection source in order from the client side by passing the registered user's certificate between the authentication servers. This is because each authentication server requires a user certificate when authentication is performed between the client and each proxy server. Then, even if you do not register the user information of the client in all the authentication servers,
Each proxy server can authenticate the user who uses the client.

[0004]

However, in the above-mentioned conventional authentication system, each authentication server must have a special function of transferring a registered user's certificate between the authentication servers. Was.

[0005] The present invention has been made in view of the above-described problems, and enables each proxy server to authenticate a user who uses a client, even if each authentication server does not have a special function. The purpose is to provide an authentication system and an authentication method.

[0006]

In order to achieve the above object, the invention according to claim 1 comprises a client connected to a communication line and an intervening client connected to the communication line between the client and the server. A plurality of proxy servers that are connected to the communication line and are provided corresponding to the respective proxy servers and perform authentication from the client side in order from the client side. An authentication system including a server, wherein the authentication server performs authentication based on a certificate distributed to the corresponding proxy server and a connection source to the proxy server, and the proxy server includes:
When a certificate request for a certificate is input from the connection destination to the client, the certificate request is sent to the connection source, and the certificate distributed to the client sent from the connection source to the connection destination is sent to the connection destination. Then, the client transmits the certificate distributed in response to the certificate request from the connection destination to the connection destination.

That is, a client, a plurality of proxy servers, and a plurality of authentication servers are connected via a communication line so as to be capable of two-way communication. Multiple proxy servers
It is possible to connect the client and the server by interposing between the client and the server. The plurality of authentication servers are provided corresponding to the respective proxy servers, and perform authentication between the corresponding proxy server and a connection source of the proxy server. The connection source of the proxy server closest to the client is the client, and the connection sources of the other proxy servers are different proxy servers.

The authentication server distributes a certificate to the corresponding proxy server and this connection source in advance. Then, based on the distributed certificate, the plurality of authentication servers perform authentication between the corresponding proxy server and the connection source in order from the client side. At this time, authentication between the proxy server and this connection source is performed by confirming the certificate distributed from the authentication server to the corresponding proxy server and this connection source.

[0009] When a certificate request for requesting a certificate is input to the client from the connection destination, the proxy server relaying the client and the server transmits the certificate request to the connection source. If the connection source is another proxy server,
As with the proxy server at the connection destination, the input certificate request is transmitted to the connection source. Then, when the connection source becomes the client, the client responds to the certificate request,
It is distributed to itself and sends the authenticated certificate to the connection destination proxy server. Then, the proxy server closest to the client obtains the authenticated certificate and sends it to the connection destination. If the connection destination is a proxy server, this authenticated certificate is obtained and transmitted to the connection destination, similarly to the connection source proxy server.

That is, the certificate distributed to the client is authenticated and passed to a plurality of proxy servers that relay the client and the server. Then, each proxy server can confirm the authenticated certificate held by the client.
Therefore, it is not necessary to register the user who uses the client in all the authentication servers, and it becomes possible to authenticate the user who uses the client in each proxy server. At this time, a special function of transferring the registered user's certificate between the authentication servers is unnecessary.

Here, the output source of a certificate request for requesting a certificate from a client can be various, and as an example of a specific configuration, the invention according to claim 2 is the authentication system according to claim 1 In, the proxy server closest to the server, when the authentication with the connection source is completed,
The certificate request is transmitted to the connection source. That is, when the authentication between the proxy server closest to the server and the proxy server of this connection source is completed,
The proxy server closest to the server sends a certificate request to the connection source. Then, the proxy server that relays the client and the proxy server closest to the server sends this certificate request to the client. Therefore, the proxy server closest to the server can authenticate the user using the client. Of course,
The configuration in which the output source of the certificate request is the proxy server closest to the server is only an example, and other proxy servers may be the output source, or an external server may be the output source. It is.

The certificate distributed by the authentication server may be any information that identifies a client or a proxy server. Further, the certificate to be passed to the proxy server is not limited to the certificate distributed to the client. As an example of the configuration, the invention according to claim 3 is the authentication according to claim 1 or 2. In the system, the proxy server transmits the certificate distributed to the client together with the certificate distributed to the client to a connection destination. That is, the proxy server can check the authenticated certificate held by another proxy server together with the authenticated certificate held by the client. Therefore, authentication can be performed more reliably.

As an example of a configuration for further utilizing a certificate distributed to each proxy server, the invention according to claim 4 is the authentication system according to any one of claims 1 to 3, wherein The server attaches the certificate distributed to itself to the certificate request and transmits the certificate request to the connection source. The client confirms the certificate distributed to the proxy server, and checks the distributed certificate. The document is transmitted to the connection destination. That is, the client receives the authenticated certificate held by the proxy server. Then, after confirming the received certificate, it hands over its own certificate to the proxy server. Therefore, authentication can be performed more reliably.

By the way, since the client, the plurality of proxy servers, and the authentication server constituting the authentication system are connected by a communication line, it may take too much time to perform authentication depending on the state of the communication line and the like. Therefore, according to a fifth aspect of the present invention, in the authentication system according to any one of the first to fourth aspects, the client requests the certificate request within a predetermined time after requesting a connection to the server. When the certificate cannot be obtained, the delivery of the certificate distributed to itself is stopped. That is, if the certificate request is not transmitted within a predetermined time from the proxy server of the connection destination, the client stops delivery of the certificate held by the client. Therefore, when the communication state is not good, the connection process to the server is stopped, and the utility value of the present system can be further increased.

As described above, in a system including a client, a proxy server, and an authentication server, a predetermined program is executed, and this program is used to execute processing according to a predetermined control procedure corresponding to the above-described means. It goes without saying that the invention lies in the procedure at the root.

Therefore, the invention according to claim 6 provides a client connected to a communication line, a plurality of proxy servers connected to the communication line and interposed between the client and the server, and connecting to the communication line. An authentication method comprising a plurality of authentication servers that are provided in correspondence with the respective proxy servers and perform authentication with the connection source of the corresponding proxy server in order from the client side, In the above authentication server,
Authentication is performed based on the certificate distributed to the corresponding proxy server and the connection source to the proxy server, and a certificate request for the certificate is input from the connection destination to the client at the proxy server. When this certificate request is sent to the connection source, the certificate distributed to the client sent from the connection source is sent to the connection destination, and the client responds to the certificate request from the connection destination. Authentication is performed by transmitting the certificate distributed as above to the connection destination. That is, the present invention is not necessarily limited to a substantial system, and is effective as a method, and basically has the same operation. Claim 2
Needless to say, it is also possible to make the system configuration according to the fifth aspect correspond to the method.

[0017]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a schematic diagram showing an authentication system according to an embodiment of the present invention. In FIG. 1, an authentication system 100 includes a client 10 and a proxy server 2 connected to a communication line capable of two-way communication.
1 and 22 and authentication servers 31 and 32. When a user requests a connection from the client 10 to the AP server 40, after predetermined authentication is completed, a connection between the client 10 and the AP server 40 is established via the proxy servers 21 and 22.

The client 10 may be any computer provided with a communication interface capable of accessing a communication line and being connectable to the communication line. So client 1
0 may be, for example, a personal computer generally used in each home or a portable terminal that is portable. In addition, a predetermined personal computer is used as a local server for the
(Local Area Network) can also be connected. That is, a LAN may be connected in place of the client 10 and a plurality of personal computers in the LAN may access the communication line.

The client 10 of the present embodiment has a hard disk for storing a predetermined OS program and application programs. And CPU, RO
These OS programs and application programs are executed by M, RAM, and the like. Further, a display, a keyboard, a mouse, and the like are provided, and these are driven under the control of the OS program.

The proxy servers 21 and 22 are interposed between the client 10 and the AP server 40 and can connect the client and the server. Therefore, the proxy servers 21 and 22 have a hardware configuration including a communication interface that can access a communication line, a hard disk that stores a predetermined program, and the like. Then, the program stored in the hard disk is executed by the CPU, the ROM, the RAM, and the like.

The authentication servers 31 and 32 are provided corresponding to the respective proxy servers 21 and 22. The corresponding proxy servers 21 and 22 and the proxy servers 2 and 22 are provided.
Authentication is performed between the connection sources 1 and 22. Here, the connection source of the proxy server 21 is the client 10, and the authentication server 31 performs authentication between the client 10 and the proxy server 21. The connection source of the proxy server 22 is the proxy server 21, and the authentication server 32 performs authentication between the proxy server 21 and the proxy server 22. The hardware configuration of the authentication servers 31 and 32 is substantially the same as that of the proxy servers 21 and 22.

The authentication servers 31 and 32 receive in advance user registrations of the corresponding proxy servers 21 and 22 and the client 10 or the proxy server 21 as the connection source. Then, the certificate is distributed to the client 10 or the proxy servers 21 and 22.

In the case of this embodiment, the user information of the user who requests connection from the client 10 to the AP server 40 is registered in the authentication server 31 to which the proxy server 21 closest to the client 10 belongs. The authentication server 31 distributes the user certificate 31 a to the client 10. Further, the user information as the proxy server 21 includes the authentication server 31 to which the proxy server 21 belongs and the authentication server 3 to which the proxy server 22 to be relayed next belongs.
Registered in 2. The certificate 31b is distributed from the authentication server 31, and the certificate 32a is distributed from the authentication server 32. The user information as the proxy server 22 is registered in the authentication server 32, and the certificate 32b is distributed from the authentication server 32.

Then, the distributed certificates 31a, 31
b, 32a, 32b, the authentication servers 31, 32
Performs authentication between the corresponding proxy servers 21 and 22 and this connection source in order from the client side. When the user makes a connection request from the client 10 to the AP server 40, first, the authentication server 31 sends the certificate 31a and the certificate 31
b and obtain authentication. If this authentication is successful, the proxy server 21 connects to the proxy server 22 and
The authentication server 32 obtains the certificate 32a and the certificate 32b and performs authentication. If this authentication succeeds, the certificate 32b held by the proxy server 22 closest to the AP server 40 and the certificate 31a held by the client 10 are exchanged via the proxy server 21 by a predetermined procedure.

Here, the state between the client 10 and the proxy server 21 is authenticated by the certificate 31a and the certificate 31b. The certificate 32a and the certificate 32 are also provided between the proxy server 21 and the proxy server 22.
b. That is, the state between the client 10 and the proxy server 22 is already authenticated via the proxy server 21. Then
The exchanged certificate 32b and certificate 31a are mutually trusted certificates. Therefore, when the proxy server 22 requests connection to the AP server 40 based on the certificate 31a of the user who uses the client 10, the connection between the client 10 and the AP server 40 can be established.

Therefore, the user registration is performed by the client 1
By performing the process only in the authentication server 31 corresponding to the proxy server 21 closest to 0, the user can be authenticated in each proxy server. At that time, there is no need to transfer the user certificate between the authentication servers. Note that when the state between the client 10 and the proxy server 22 is authenticated, the certificate 3 held by the client 10
Only 1a may be passed to the proxy server 22 via the proxy server 21. Even in this case, Certificate 3
Since 1a is a trusted certificate, this certificate 31a
It is possible to authenticate the user at each proxy server by using.

Next, processing executed by the client 10 and the proxy servers 21 and 22 in the authentication system 100 will be described with reference to flowcharts. In this flow, the certificate 31 held by the proxy server 21 is used.
Also, b and 32a are configured to more reliably perform authentication by being passed to the client 10 or the proxy server 22. 2, 3, and 4 each show the client 1
9 is a flowchart showing an outline of processing executed by the proxy server 21 and the proxy server 22.

First, the user inputs an AP from the client 10.
When a connection request is made to the server 40 (step S10 in FIG. 2).
0), the proxy server 21 sends the AP
Receiving a connection request to the server 40 (step S in FIG. 3)
200). Then, the proxy server 21 requests the authentication server 31 to authenticate the connected user (step S205). When the authentication result is received from the authentication server 31 (step S210), it is determined whether the authentication of the user is successful (step S215). If authentication fails,
In addition to rejecting the connection request from the user to the AP server 40, the connection request rejection is notified to the client 10 (step S220), and the present flow ends. In this case, the client 10 ends the flow of FIG. If the authentication is successful, a connection request to the AP server 40 is made to the connection destination proxy server 22 (step S225).

The proxy server 22 is a proxy server 2
4 receives a connection request from AP 1 to AP server 40 (FIG. 4).
Step S300), the connected proxy server 2
1 is requested to the authentication server 32 (step S30).
5). When the authentication result is received from the authentication server 32 (step S310), it is determined whether the authentication of the proxy server 21 is successful (step S315). If the authentication fails, the connection request from the proxy server 21 to the AP server 40 is rejected, and the connection request rejection is notified to the proxy server 21 (step S320), and the flow of FIG. 4 ends. In this case, the proxy server 21 notifies the client 10 of the rejection of the connection request by a flow not shown, and ends the flow of FIG. If the authentication is successful,
The proxy server 22 transmits the certificate request of the user making the connection request to the AP server 40 to the connection source proxy server 21 (step S325). At this time, it has attached its authenticated certificate 32b.

Then, the proxy server 21 receives, from the proxy server 22, a certificate request of the user making a connection request to the AP server 40 (step S2 in FIG. 3).
30). Then, the certificate 3 authenticated by the authentication server 32
2b is checked (step S23).
5). Then, the proxy server 21
For 0, a certificate request of the user making the connection request is transmitted to the AP server 40 (step S240). At this time, an authenticated certificate 31b held by the proxy server 21 is further attached together with the certificate 32b.

In the client 10, the proxy server 2
From 1, it is determined whether a certificate request of the user making a connection request to the AP server 40 has been received within a predetermined time (step S105 in FIG. 2). When the connection request rejection is notified from the proxy server 21 or when the user's certificate request is not received within a predetermined time, the connection request to the AP server 40 is canceled. Therefore, when the communication state is not good or the like, a connection request to the AP server 40 is not made longer than necessary.

When the user's certificate request is received (step S110), it is confirmed that the certificate 31b distributed to the proxy server 21 is attached and that the authentication has been performed by the authentication server 31 (step S115). .
Also, it is confirmed that the certificate 32b distributed to the proxy server 22 closest to the AP server 40 that is the certificate requester is attached and that the certificate has been authenticated by the authentication server 32 (step S120). Therefore, the client 10 sends the AP server 4 to the proxy server 21.
Then, the certificate 31a of the user making the connection request is transmitted to step S125 (step S125), and the flow of FIG. 2 ends.

In the proxy server 21, the client 1
0, the certificate 31a of the user making the connection request to the AP server 40 is received (step S24 in FIG. 3).
5). Then, it is confirmed that the certificate 31a has been authenticated by the authentication server 31 (step S250). Then, the certificate 31a of the user making the connection request to the AP server 40 is transmitted to the proxy server 22 (step S255), and the flow of FIG. 3 ends. that time,
Authenticated certificate 32 distributed to proxy server 21
a is further attached.

The proxy server 22 receives, from the proxy server 21, the certificate 31a of the user making the connection request to the AP server 40 (step S33 in FIG. 4).
0). Then, the certificate 32 authenticated by the authentication server 32
a is attached (step S33)
5). Further, it is confirmed that the certificate 31a of the user making the connection request to the AP server 40 has also been authenticated (step S340). As a result, the proxy server 22
The proxy server 22 transmits a connection request to the AP server 40 (step S345). Then, it is possible to establish a connection between the client 10 and the AP server 40 via the proxy servers 21 and 22.

As described above, in the present authentication system 100,
Based on the distributed certificate, authentication between the corresponding proxy server and the connection source is performed by the authentication server in order from the client side. Then, the certificate 31 a distributed to the client 10 is transferred to the proxy server 22 closest to the AP server 40 via the proxy server 21. Therefore, it is not necessary to register the user who uses the client in every authentication server, and the user can be authenticated in each proxy server. At this time, a special function of transferring the registered user's certificate between the authentication servers is unnecessary.

The client receives and confirms the authenticated certificate held by each proxy server, and then passes the authenticated certificate held by the client to the proxy server. Furthermore, the authenticated certificate held by the proxy server that relays between the client and the proxy server closest to the server is also passed to the proxy server closest to the client or server and is confirmed. Therefore, authentication is performed more reliably.

The present invention can be applied to a case where there are three or more proxy servers for relaying a client and a server. FIG. 5 is a schematic diagram showing an authentication system according to a modification. In FIG. 5, the authentication system 200 includes a client 10, proxy servers 21, 23, and 22 and authentication servers 31, 33, and 32. That is, there are three proxy servers that relay the client 10 and the AP server 40, and there are also three authentication servers provided corresponding to the proxy servers. Note that the hardware configurations of the newly provided proxy server 23 and authentication server 33 are substantially the same as those of the other proxy servers and authentication servers, and a description thereof will be omitted.

In the authentication system 200, the authentication server 31
Distributes the certificate 31 a to the client 10 and distributes the certificate 31 b to the proxy server 21. The authentication server 33 distributes the certificate 33a to the proxy server 21 and distributes the certificate 33b to the proxy server 23. Then, the authentication server 32
The certificate 32a is distributed to the proxy server 22, and the certificate 32b is distributed to the proxy server 22.

The processing executed by the client 10 and the proxy servers 21, 23, and 22 in the authentication system 200 will be described below with reference to flowcharts. FIGS. 6, 7, and 8 are flowcharts illustrating the outline of the processing executed by the proxy server 21, the proxy server 23, and the proxy server 22, respectively. The outline of the processing executed by the client 10 is the same as that in FIG.

First, the user inputs an AP from the client 10.
When a connection request is made to the server 40 (step S10 in FIG. 2).
0), the proxy server 21 sends the AP
A connection request to the server 40 is received (step S in FIG. 6).
400). Then, the proxy server 21 requests the authentication server 31 to authenticate the user (step S405).
Upon receiving the authentication result from the authentication server 31 (step S
410), it is determined whether the user authentication is successful (step S415). If the authentication is unsuccessful, the connection request from the user is rejected, and the client 10 is notified of the rejection of the connection request (step S420), and the flow ends. In this case, the client 10 ends the flow of FIG. If the authentication is successful, the proxy server 21 requests the proxy server 23 to connect to the AP server 40 (step S425).

The proxy server 23 is a proxy server 2
7 receives a connection request to the AP server 40 from FIG.
Of the proxy server 21 to the authentication server 33 (step S505). Upon receiving the authentication result from the authentication server 33 (step S5)
10), it is determined whether or not the authentication of the proxy server 21 is successful (step S515). If authentication fails, A
The connection request to the P server 40 is rejected, and the rejection of the connection request is notified to the proxy server 21 (step S52).
0), the flow of FIG. 7 ends. In this case, the proxy server 21 notifies the client 10 of the rejection of the connection request by a flow not shown, and ends the flow of FIG. If the authentication is successful, there is another proxy server 22 at the connection destination, so a connection request to the AP server 40 is made to the proxy server 22 (step S525).

The proxy server 22 is a proxy server 2
3 receives a connection request to the AP server 40 from FIG.
, The authentication server 32 requests the authentication server 32 to authenticate the proxy server 23 (step S605). Upon receiving the authentication result from the authentication server 32 (step S6)
10), it is determined whether the authentication of the proxy server 23 is successful (step S615). If authentication fails, A
The connection request to the P server 40 is rejected, and the rejection of the connection request is notified to the proxy server 23 (step S62).
0), the flow of FIG. 8 ends. In this case, the notification of rejection of the connection request is transmitted to the proxy server 21 and the client 10 in this order, and the flow in FIGS. 7 and 6 ends.
If the authentication is successful, the user attaches the authenticated certificate 32b owned by the user and transmits the user's certificate request to the proxy server 23 of the connection source (step S625).

Then, the proxy server 23 receives the user's certificate request from the proxy server 22 (FIG. 7).
Step S530). Then, it is confirmed that the certificate 32b authenticated by the authentication server 32 is attached (step S535). Then, the proxy server 23 sends the user's certificate request to the connection-source proxy server 21 with the authenticated certificate 33b attached (step S540). The proxy server 21 receives the user's certificate request from the proxy server 23 (step S430 in FIG. 5). And the authentication server 33
Confirms that the authenticated certificate 33b is attached (step S435). Then, the proxy server 23 sends the user's certificate request to the connection-source proxy server 21 with the authenticated certificate 31b attached (step S440).

In the client 10, the proxy server 2
From 1, it is determined whether or not the user's certificate request has been received within a predetermined time (step S 105 in FIG. 2). If the connection request rejection is notified from the proxy server 21 or the user's certificate request is not received within a predetermined time, A
The connection request to the P server 40 is canceled. When the user's certificate request is received (step S110), the authenticated certificate 31b held by the proxy server 21 is confirmed (step S115). Further, the authenticated certificate 33b held by the proxy server 23 is confirmed. Further, it is confirmed that the certificate 32b distributed to the proxy server 22 closest to the AP server 40 which is the certificate requester is attached and that the certificate has been authenticated by the authentication server 32 (step S120). Then, the client 10
Transmits the user certificate 31a to the proxy server 21 (step S125), and ends the flow of FIG.

In the proxy server 21, the client 1
The certificate 31a of the user is received from 0 (step S445 in FIG. 6), and it is confirmed that the certificate 31a has been authenticated by the authentication server 31 (step S450). And
Authenticated certificate 32 distributed to proxy server 21
a is further attached, and the user certificate 31a is transmitted to the proxy server 22 (step S455), and the flow of FIG. 6 ends. The proxy server 23 receives the user certificate 31a from the proxy server 21 of the connection source (step S545 in FIG. 7), and confirms that the certificate 33a authenticated by the authentication server 33 is attached (step S550). ). Then, the authenticated certificate 33a distributed to the proxy server 23 is further attached, and the user certificate 31a is transmitted to the proxy server 22 (step S555), and the flow of FIG. 7 ends.

The proxy server 22 receives the user certificate 31a from the proxy server 23 (step S630 in FIG. 8) and confirms that the authenticated certificate 32a held by the proxy server 23 is attached (step S630). Step S635). Also, the certificate 33a held by the proxy server 21 is confirmed. And the user's certificate 31
a is also checked (step S640). As a result, the proxy server 22 and the user are successfully authenticated, and the proxy server 22 transmits a connection request to the AP server 40 (step S645). Then, it is possible to establish a connection between the client 10 and the AP server 40 via the proxy servers 21, 23, 22.

As described above, even in the present authentication system 200 having three proxy servers for relaying a client and a server, it is not necessary to register the user in all the authentication servers, and each proxy server can authenticate the client. It is. Also, there is no need for a special function of transferring registered user certificates between authentication servers. Even in an authentication system having four or more proxy servers to be relayed, the above-described authentication can be performed by performing the same processing as that of the proxy server 23 interposed between the proxy servers.

[0048]

As described above, according to the present invention, each proxy server can authenticate a user who uses a client without having to transfer a certificate of a registered user between authentication servers. An authentication system can be provided. According to the second aspect of the present invention, it is possible to authenticate a user who uses a client at a proxy server closest to the server. further,
According to the third aspect of the present invention, since the proxy server can also confirm the authenticated certificate held by another proxy server, it is possible to perform authentication more reliably.

Further, according to the invention of claim 4,
Since the client can confirm the authenticated certificate held by the proxy server, the authentication can be performed more reliably. Further, according to the invention of claim 5, the utility value of the present system can be further enhanced. Further, according to the invention according to claim 6, there is no need to transfer the certificate of the registered user between the authentication servers,
An authentication method capable of authenticating a user who uses a client in each proxy server can be provided.

[Brief description of the drawings]

FIG. 1 is a schematic diagram showing an authentication system according to an embodiment of the present invention.

FIG. 2 is a flowchart illustrating an outline of a process executed by a client.

FIG. 3 is a flowchart illustrating an outline of a process executed by a proxy server that relays a client and a proxy server;

FIG. 4 is a flowchart illustrating an outline of a process executed by a proxy server closest to the server;

FIG. 5 is a schematic diagram showing an authentication system according to a modification.

FIG. 6 is a flowchart illustrating an outline of a process executed by a proxy server that relays a client and a proxy server.

FIG. 7 is a flowchart illustrating an outline of a process executed by a proxy server that relays between proxy servers;

FIG. 8 is a flowchart showing an outline of processing executed by a proxy server closest to the server.

[Explanation of symbols]

10 Client 100, 200 Authentication system 21, 22, 23 Proxy server 31, 32, 33 Authentication server 31a, 31b, 32a, 32b, 33a, 33b Certificate 40 AP server

Claims (6)

[Claims] 1. A client connected to a communication line,
A plurality of proxy servers connected to the communication line and interposed between the client and the server, and a plurality of proxy servers connected to the communication line and provided corresponding to the respective proxy servers, and connected to the corresponding proxy servers; An authentication system comprising: a plurality of authentication servers for performing authentication from a client in order from the client side, wherein the authentication server is distributed to the corresponding proxy server and a connection source to the proxy server. The proxy server performs authentication based on the certificate, and transmits a certificate request to the connection source when a certificate request for a certificate is input from the connection destination to the client, and transmits the certificate request from the connection source. The client sends the certificate distributed to the client to the connection destination, and the client sends the certificate from the connection destination. Authentication system and transmits the certificate distributed on demand to the destination. 2. The authentication system according to claim 1, wherein the proxy server closest to the server transmits the certificate request to the connection source when the authentication with the connection source is completed. Characteristic authentication system. 3. The authentication system according to claim 1, wherein the proxy server sends the certificate distributed to the client together with the certificate distributed to the client. An authentication system for transmitting to a connection destination. 4. The authentication system according to claim 1, wherein the proxy server attaches the certificate distributed to itself to the certificate request and transmits the certificate to a connection source. The authentication system, wherein the client confirms the certificate distributed to the proxy server, and transmits the distributed certificate to a connection destination. 5. The authentication system according to claim 1, wherein the client obtains the certificate request within a predetermined time after requesting a connection to the server. An authentication system characterized by stopping delivery of a certificate distributed to oneself when unable to do so. 6. A client connected to a communication line,
A plurality of proxy servers connected to the communication line and interposed between the client and the server, and a plurality of proxy servers connected to the communication line and provided corresponding to the respective proxy servers, and connected to the corresponding proxy servers; An authentication method configured by a plurality of authentication servers that perform authentication from a client side in order from the client side, wherein the authentication server communicates with the corresponding proxy server and a connection source to the proxy server. Authenticates based on the distributed certificate. When the proxy server inputs a certificate request to the client from the connection destination, the certificate request is sent to the connection source. Sends the certificate distributed to the client sent from the client to the connection destination. Authentication method and performing authentication by sending the certificate distributed in accordance with the serial certificate request to the destination.