JP2004272614A - User authentication device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To manage the right of access of an individual user indirectly by way of a manager X. <P>SOLUTION: When there is an access to a server device 200 from a user A, the authentication is performed by an access authentication part 110. The authentication succeeds when a user ID and a password coincide with registered contents of a user information registration part 120 and a period of validity has not passed. When the period of validity has passed, a user is urged to input a key of period extension. When the key of period extension inputted at this time coincides with a key stored in a period extending key storage part 130 and a new period of validity after extension has not passed, the authentication succeeds. Period extending keys α1, α2, and α3 are issued by a period extending key issuing part 140 during a specified time, are stored in the period extending key storage part 130, and are transmitted to the manager X. The manager X arbitrarily decides whether or not the period extending keys should be communicated to individual users A, B, and C. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a user authentication device, and more particularly, to a user authentication device for authenticating whether or not a user has a valid access right when the user accesses a server device via a network.
[0002]
[Prior art]
With the widespread use of the Internet, an intranet, an in-house LAN, and the like, a system for obtaining necessary information from a server device via a network has become indispensable as a social information infrastructure. In such a system, in order to ensure security, it is important that only a user having a legitimate access right be provided with information from the server device within the range of the access right. . Therefore, when a user accesses the server device via the network, first, the user authentication device performs a process of authenticating that the access is an access from a user having a legitimate access right. An operation is performed such that access to the server device is permitted only when is performed.
[0003]
A basic authentication method in a general user authentication device is authentication using a user ID and a password. A predetermined user ID and a password are issued to each user in advance, and input from the terminal device at the time of access. Authentication is performed based on whether or not the user ID and password that have been issued match those issued in advance. In addition, a means for further increasing security by previously issuing a client certificate to the user and confirming that the data of the client certificate exists in the user's terminal device is adopted. In some cases.
[0004]
A method of confirming a match between a user ID and a password for user authentication is an authentication method widely used in various fields, and related arts are disclosed in many documents. For example, the following Patent Documents 1 to 4 disclose various improved techniques for such a basic authentication method.
[Patent Document 1]
JP-A-2002-229552
[Patent Document 2]
JP 2002-297546 A
[Patent Document 3]
JP-A-2002-314549
[Patent Document 4]
JP-A-2002-328899
[0005]
[Problems to be solved by the invention]
The general user authentication device used so far is based on the premise that direct management is performed for each user, so when performing indirect management via a third party, Cannot operate smoothly and responsively.
[0006]
For example, when operating a Web site that allows only specific users who have paid a subscription fee to browse, it is common for the operator of the site to directly manage each user. It is an operation form. In such an operation form, for a user who has offered to cancel the subscription or a user who has delinquent the subscription fee, the site operator himself performs processing such as invalidating the user ID of the user. It is possible to take measures to deprive legitimate access rights. In a system such as an in-house LAN that grants legitimate access rights only to regular employees, for retired employees, in cooperation with the erasure process of employee data etc. of the Human Resources Department, the user It is possible to perform processing for invalidating the ID.
[0007]
As described above, if the information provision service is provided via a network in an operation mode in which individual users can be directly managed, the trend of each user's access right can be directly grasped. For a user whose access right fluctuates, it is possible to immediately take measures such as invalidating the user ID. However, depending on the operation mode, it is not always possible to directly manage individual users.
[0008]
For example, when a company operates as a service for a business partner that allows a specific person in charge of the business partner to release part of the information in its own server device and view it through a network Consider In this case, to ensure security, a user ID and a password are issued to the specific person in charge, and user authentication is performed when accessing the server device. However, since the company that operates the server device and the business partner of the server are two different entities, the person in charge of the business partner may be transferred to another department or retired. However, it is practically difficult for a company operating the server device to immediately grasp such a fact.
[0009]
In such a case, after all, the operator of the server device cannot directly manage the individual users, so that a third party (for example, an administrator such as a manager of a business partner company) is required. Indirect management through the Internet. However, since the conventional user authentication device does not have a function for smoothly performing such indirect management, in practice, a specific person in charge may be assigned by a manager such as a manager of a business partner company. When the fact of transfer or retirement is notified, the user ID must be invalidated for the person in charge. Therefore, the access right to be originally deleted often remains in a state of being left for a long time. In particular, if there is a person in charge who changed jobs to a competitor after retirement, if the person in charge still has access to information on the business of the company before retirement, it is not preferable in business practice.
[0010]
Further, as a method of managing the user ID, there is a method of setting an expiration date for the client certificate described above and, after the expiration date expires, making the client certificate inaccessible. However, in such a method, every time the validity period expires, it is necessary to perform a process of reissuing a client certificate, a process of distributing to a user on a magnetic recording medium or the like, a process of uninstalling or installing a browser, and the like. , It takes a lot of trouble.
[0011]
Therefore, an object of the present invention is to provide a user authentication device capable of performing smooth and responsive operation even when performing indirect management of an individual user through a third party. .
[0012]
[Means for Solving the Problems]
(1) A first aspect of the present invention is a user authentication device for authenticating whether or not a user has a valid access right when a user accesses a server device via a network,
A user information registration unit for registering user information including a user ID, a password, and an expiration date for each user;
A term extension key issuing unit for issuing a term extension key necessary to extend the expiration date for a prescribed period or to a prescribed date;
A term extension key storage unit that stores the issued term extension key together with information indicating the extension period or extension term for a predetermined holding period,
When a user accesses with a user ID and a password, a password confirmation process for confirming that the user ID and the password associated with the access match the registration contents of the user information registration unit. Execute the expiration date confirmation process to confirm that the registered expiration date has not passed, and if both password confirmation process and expiration date confirmation process are confirmed, the If the password is verified in the password confirmation process but not confirmed in the expiration date confirmation process, the user is prompted to enter a term extension key, and the entered term extension is extended. If the key matches the key stored in the extension key storage unit and the new expiration date after extension has not And access authentication unit that performs authentication with the access with a,
Is provided.
[0013]
(2) According to a second aspect of the present invention, in the user authentication device according to the first aspect,
The access authentication unit, if the extension key entered by the user matches the key stored in the extension key storage unit and the new expiration date after extension has not passed, The processing for rewriting the expiration date of the user to the new expiration date is performed.
[0014]
(3) According to a third aspect of the present invention, in the user authentication device according to the second aspect,
The access authentication unit performs the rewriting process of the expiration date based on the same expiration date key for the same user only once.
[0015]
(4) According to a fourth aspect of the present invention, in the user authentication device according to the above-described first to third aspects,
The access authentication unit prompts the user if the extension key entered by the user matches the key stored in the extension key storage unit and the new expiration date after extension has not passed. The process prompts the user to enter a password and performs a process of rewriting the password for the user in the user information registration unit with a new password.
[0016]
(5) According to a fifth aspect of the present invention, in the user authentication device according to the above-described first to fourth aspects,
The extension key issuing unit issues a different extension key for each user or user group,
A term extension key storage unit stores a term extension key for each user or user group in association with each user ID,
The access authentication unit performs authentication by referring to a term extension key for each user or each user group.
[0017]
(6) According to a sixth aspect of the present invention, in the user authentication device according to the fifth aspect,
The term extension key issuing unit issues a term extension key having a different extension period or extension term for each user or user group.
[0018]
(7) According to a seventh aspect of the present invention, in the user authentication device according to the first to sixth aspects described above,
The term extension key issuance unit automatically issues a term extension key based on a predetermined algorithm a predetermined period before a term requiring extension.
[0019]
(8) According to an eighth aspect of the present invention, in the user authentication device according to the first to seventh aspects,
The term extension key issuance unit has a function of transmitting the issued term extension key by e-mail to a predetermined address a predetermined period before the term required for extension.
[0020]
(9) According to a ninth aspect of the present invention, in the user authentication device according to the eighth aspect,
In the user information registration unit, register user information including an e-mail address to which a term extension key is transmitted for each user,
The term extension key issuing unit transmits an e-mail to an address in the user information.
[0021]
(10) According to a tenth aspect of the present invention, in the user authentication device according to the first to ninth aspects,
The term extension key issuing unit has a function of printing out the issued term extension key.
[0022]
(11) An eleventh aspect of the present invention is the user authentication device according to the tenth aspect described above,
In the user information registration unit, to register user information including information for specifying a user administrator to which a term extension key is transmitted for each user,
The term extension key issuing unit has a function of printing out a list of term extension keys for a plurality of users having the same user administrator as a list.
[0023]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, the present invention will be described based on an illustrated embodiment. FIG. 1 is a block diagram showing a use form of a user authentication device according to an embodiment of the present invention. Here, a simple mode in which three users A, B, and C access the server device 200 via the user authentication device 100 via the Internet 50 using the terminal devices 10, 20, and 30 respectively is illustrated. I will do it. The illustrated user authentication device 100 is a user authentication device according to the present invention, and when each of the users A, B, and C accesses the server device 200 via the network 50, the user has an authorized access right. It fulfills the function of authenticating whether or not it has. That is, when each of the users A, B, and C accesses the server device 200 from the terminal devices 10, 20, and 30, first, user authentication is performed in the user authentication device 100. Access to the server device 200 is permitted only when authentication of access from the server device 200 has been performed.
[0024]
In practice, the user authentication device 100 is generally prepared as a component incorporated in the server device 200. However, here, for convenience of explanation, the user authentication device 100 is separated from the server device 200. It will be shown as a component of the body. Of course, in practice, the illustrated user authentication device 100 and the server device 200 can be realized by the same hardware.
[0025]
A feature of the user authentication device according to the present invention is that smooth and responsive operation can be performed even when indirect management is performed through a third party. Therefore, here, as an example of a usage form utilizing such features, the server device 200 is a server operated by a printing company “Patent Printing Co., Ltd.”, and users A, B, and C The following description will be made on the assumption that the person in charge of the company “Kosho Trading Co., Ltd.” that orders printed matter from Patent Printing Co., Ltd. is in charge.
[0026]
More specifically, the server device 200 has a function of presenting a list indicating the progress of the printing process for a printed material ordered from Ko Corporation, a screen indicating the layout of the printing plate, and the like. In this example, the server device 200 also serves as a data server for a worker in charge of Patent Printing Co., Ltd. to store data. Data indicating the situation is stored in the server device 200. The users A, B, and C, who are in charge of Kosho Co., Ltd., access such data stored in the server device 200, and thus, the current progress of the printing process and the state of the layout to the printing plate. Can be checked on the screens of the terminal devices 10, 20, 30.
[0027]
Of course, in order to ensure security, the data relating to the business of Kosho Co., Ltd. stored in the server device 200 is not accessible from users A, B, and C, who are responsible for Kosho Co., Ltd. Only need to be presented. Therefore, it is necessary for Patent Printing Co., Ltd. to issue a predetermined user ID and password to each person in charge of Kosho Co., Ltd., and perform user authentication when accessing server device 200. If necessary, a client certificate may be issued, and the data may be stored in each of the terminal devices 10, 20, 30. When accessing, an operation of confirming the data may be performed.
[0028]
However, since users A, B, and C are employees of Kosho Co., Ltd. and not of Patent Printing Co., Ltd., users A, B, and C are transferred to another department due to personnel changes, Even if you leave the company, Patent Printing Co., Ltd. will not be able to know such facts unless notified to that effect. In other words, Patent Printing Co., Ltd., which operates the server device 200, provides the users A, B, and C with access to the server device 200 to present the progress status of the received print job and the like. However, these users cannot be directly managed.
[0029]
As described above, when it is not possible to directly manage individual users, management of the users is inevitably performed indirectly through a third party. The user authentication device 100 according to the present invention can perform smooth and responsive operation even when such indirect management has to be performed. In the case of the example shown in FIG. 1, indirect management is performed for the users A, B, and C via the user manager X in Kosho Corporation. Here, as the user manager X, for example, a suitable person who is the boss of each of the users A, B, and C, such as the manager of Kosho Corporation, may be designated.
[0030]
As shown, the basic components of the user authentication device 100 according to the present invention are an access authentication unit 110, a user information registration unit 120, a term extension key storage unit 130, and a term extension key issuing unit 140. However, each of these components is a component when the user authentication device 100 according to the present invention is considered as a functional component, and does not correspond to an actual hardware component. As described above, in practice, the user authentication device 100 is often used by being incorporated in the server device 200. In this case, the above-described components include hardware constituting the server device 200 and the It is realized by predetermined software incorporated in hardware.
[0031]
The user information registration unit 120 is a component having a function of registering information including a user ID, a password, and an expiration date (hereinafter, referred to as user information) for each user. For example, in the illustrated example, the user IDs “AAA”, “BBB”, and “CCC” are registered for the users A, B, and C, respectively, and their unique passwords (in the figure, “**” for convenience). *** "is displayed, but actually, a predetermined combination of numbers and characters is registered. Such registration is performed in advance as a pre-process for accessing the server device 200 and receiving various services. For each of the users A, B, and C, the user ID and password registered in the user information registration unit 120 are indirectly transmitted via the user administrator X or from the patent printing company. You will be informed directly.
[0032]
One of the features of the user authentication device 100 according to the present invention is that information of an expiration date is registered in addition to a user ID and a password. In the illustrated example, the same expiration date of “2003/6/30” is registered for each of the users A, B, and C. This is because the expiration date of each user ID is June 30, 2003. Is shown. Of course, it is also possible to set different expiration dates for each user. If the same expiration date is set for all users, instead of setting the expiration date for each individual user as in the example shown in the figure, one common expiration date is set as a representative. You can leave it.
[0033]
On the other hand, the term extension key issuing unit 140 has a function of issuing a term extension key necessary to extend the expiration date registered in the user information registration unit 120 for a predetermined period or to the predetermined period. The key storage unit 130 has a function of storing the extension key issued by the extension key issuing unit 140 together with information indicating the extension period or the extension period for a predetermined holding period. The illustrated example shows a state in which the term extension key issuing unit 140 has issued the term extension keys α1, α2, and α3 and stored in the term extension key storage unit 130. In this example, the extension keys α1, α2, and α3 are keys for extending the expiration date by one month, two months, and three months, respectively. The extension periods are stored together with the extension keys α1, α2, and α3.
[0034]
The access authentication unit 110 authenticates whether or not the user A, B, and C have access with a user ID and a password if the access is legitimate. Only the process of permitting access to the server device 200 is performed.
[0035]
The first process for this authentication is that, when there is an access involving a user ID and a password from the users A, B, and C, the user ID and the password associated with the access are registered in the user information registration unit 120. Is a password confirmation process for confirming that the password matches the password. For example, when the user A makes an access from the terminal device 10 with a user ID “AAA” and a predetermined password “****”, these pieces of information are stored in the registered contents in the user information registration unit 120. If they match, the password has been confirmed in this password confirmation process.
[0036]
The second process for authentication is an expiration date confirmation process for confirming that the expiration date registered in the user information registration unit 120 has not passed, corresponding to the user ID associated with the access. For example, when a user ID “AAA” is given, the validity period of the user ID registered in the user information registration unit 120 is June 30, 2003. The expiration date has not yet passed as long as the expiration date has been performed by the 30th of the month, and the expiration date confirmation process allows confirmation.
[0037]
Basically, the access authentication unit 110 authenticates that the access is an access with valid authority when the password is confirmed in both the password confirmation process and the expiration date confirmation process described above (that is, And authentication success), and the access to the server device 200 is permitted. Therefore, in the case of the illustrated example, if the users A, B, and C make access using a regular user ID and password, the users A, B, and C will send to the server device 200 at least until the expiration date of June 30, 2003. Can be accessed.
[0038]
The feature of the user authentication device 100 is that, when the confirmation in the password confirmation process cannot be performed, the authentication failure always occurs, and the access to the server device 200 is not permitted. However, in the case where the confirmation in the expiration date confirmation processing cannot be obtained, the authentication is not immediately failed, but when a predetermined condition is satisfied, it is regarded that the authentication is successful. That is, when the access authentication unit 110 has confirmed in the password confirmation process but not in the expiration date confirmation process, the access authentication unit 110 first performs a process of prompting the user to input a term extension key.
[0039]
Specifically, for example, "This user ID has expired. To access, please input a term extension key" for the terminal device operated by the user. What is necessary is just to perform a process of causing the user to input an expiration date extension key from a keyboard or the like. In response to such a display, when the user inputs the extension key, the access authentication unit 110 determines that the input extension key matches the key stored in the extension key storage unit 130, and If the new expiration date after the extension has not passed, the access to the server device 200 is permitted by authenticating that the access is authorized.
[0040]
For example, on July 2, 2003, when user A makes an access with a user ID “AAA” and a predetermined password “****”, the password can be confirmed in the password confirmation process, but the expiration date can be obtained. Since June 30 has already passed, no confirmation can be made in the expiration date confirmation processing. In this case, as described above, the display for prompting the terminal device 10 to input the term extension key is performed from the access authentication unit 110. In response to this display, assuming that user A has input a term extension key “α1” from terminal device 10, access authentication section 110 stores the term extension key in term extension key storage section 130. In addition to examining whether the key matches the existing key, recognizes the extension period of the extension key, and determines whether the new expiration date obtained by extending the original expiration date by the extension period has not elapsed. Or certify. In the case of the example shown in the figure, the extension period of the term extension key α1 is one month, so the June 30, 2003 expiration date of the user ID “AAA” is the new expiration date of 2003. It will be extended to July 31. Since the new expiration date has not elapsed, the authentication process in the access authentication unit 110 succeeds, and the user A is permitted to access the server device 200.
[0041]
Here, the respective user IDs and passwords are information that have already been notified to the users A, B, and C at the time of initial registration. The term extension key issuing unit 140 issues the term extension key by a predetermined period of time before the term that requires extension using the term extension key. For example, in the case of the illustrated example, the term extension key α1 for extending the term of one month is required for access after July 1st. Therefore, for example, if it is determined that each extension key is to be issued one week before the extension is required, the extension key α1 is issued by the extension key issuing unit 140 on June 23. Will be issued. Similarly, the term extension keys α2 and α3 are issued on July 24 and August 24, respectively.
[0042]
In this way, the extension key issued by the extension key issuing unit 140 is stored in the extension key storage unit 130 and, in principle, transmitted to each of the users A, B, and C without delay after issuance. become. At this time, the extension key is not transmitted directly from Patent Printing Co., Ltd. to each of the users A, B, and C, but is transmitted indirectly through the user manager X of Kosho Corporation. To In other words, the term extension key α1 issued on June 23 will be transmitted to the user manager X by some method, and thereafter, the key α1 will be transmitted to each of the users A, B, and C. It is up to the user manager X to decide whether or not to inform the user.
[0043]
Normally, the user manager X transmits the key α1 to each of his / her subordinates, the users A, B, and C, by any method. Can be taken as a choice not to transmit. For example, if user B is to retire from Kou Shoji Co., Ltd. on June 30, the user manager X, who is the boss, provides users A and C with Although the term extension key α1 is transmitted, the transmission may not be performed to the user B. When any of the users A, B, and C accesses the server device 200 during July, the access authentication unit 110 requests the input of the term extension key as described above. In this case, the users A and C are permitted to access the server device 200 by inputting the term extension key α1 transmitted from the user manager X, but have resigned from Koko Corporation. Since the user B does not know the extension key α1, the user B can no longer access.
[0044]
The important point here is that Patent Printing Co., Ltd. is able to perform smooth and responsive authentication processing without recognizing the fact that User B has retired from Kou Shoji Co., Ltd. Is a point. Of course, if Kosho Co., Ltd. notifies Patent Printing Co., Ltd. of the fact that User B will retire on June 30, Patent Printing Co., Ltd. will provide the user information registration section on June 30. It is possible to perform processing such as deleting the user ID “BBB” in 120. However, even if the user B retires from Kou Shoji Co., Ltd., the fact is not always immediately notified to Patent Printing Co., Ltd. There is a possibility that the user ID “BBB” remains as it is, and in reality, such a case is considered to be more common. According to the present invention, it is possible to adopt a method of entrusting the management of each of the users A, B, and C to the user manager X, so that even in such a case, smooth and responsive operation can be performed. Become. In other words, the user manager X who is familiar with the changes in the duties of the users A, B, and C makes a decision as to whether or not to transmit the term extension key, so that the responsive indirect user can be used. Management will be done.
[0045]
FIG. 2 is a bar graph showing how the initial expiration date is extended by using the extension keys α1, α2, α3. Each bar graph indicates a period during which access to the server device 200 is permitted when each period extension key is input. For example, in the case of no extension, access is allowed only until the initial expiration date of June 30, but by entering the extension key α1, the extension is extended by one month and access is possible until July 31. become. Similarly, by inputting the time limit extension key α2, an extension of two months is made, and access is possible until August 31, and by inputting the time limit extension key α3, a three month extension is made. Access until March 30 is possible.
[0046]
As described above, if each extension key is issued one week before the extension is required, the extension key α1 is transmitted to the user manager X on June 23, If there are no personnel changes, etc., it will be reported to each user A, B, C within a few days. Therefore, during July, each of the users A, B, and C can continue to access the server device 200 by inputting the term extension key α1. Then, on July 24, a new time limit extension key α2 is transmitted in the same manner. During August, access is enabled by inputting this α2, and on August 24, new access is made. A similar term extension key α3 is transmitted in the same manner, and during September, the user can access by inputting this α3. Hereinafter, the same applies. Of course, the extension period does not necessarily have to be in units of one month, but can be set freely, such as in units of three months or six months. Also, the time for issuing the time limit extension key does not necessarily need to be set one week before the time limit required for extension, but can be set arbitrarily.
[0047]
The basic embodiment of the present invention has been described above, and subsequently, some modified examples will be described. First, in the above-described basic embodiment, a method is adopted in which the information on the expiration date initially registered in the user information registration unit 120 is not updated. However, in practice, the information on the expiration date is sequentially rewritten. It is preferable to adopt a method of updating by updating. This is because, if the expiration date is not renewed, the user will always be required to input the extension key after the expiration date has passed. For example, in the case of the example shown in FIG. 1, after July 1, 2003, the user is always requested to input a user ID, a password, and a term extension key. Therefore, in order to avoid the trouble of inputting the extension key, the expiration date may be updated by the following method.
[0048]
That is, if the extension key input by the user matches the key stored in the extension key storage unit 130 and the new expiration date after extension has not passed, the access authentication unit 110 What is necessary is just to perform the process of rewriting the expiration date of the user in the user information registration unit 120 to the new expiration date.
[0049]
For example, when the user A makes an access on July 2, the expiration date has already passed, and the user is required to input a term extension key as described above. Here, when the user A inputs the term extension key α1, the new expiration date is extended to July 31, so that the authentication for the access is successful and the access to the server device 200 is already permitted. It is as stated. In the modification described here, at this time, the access authentication unit 110 changes the expiration date of the user A (that is, the expiration date corresponding to the user ID “AAA”) to the new expiration date of July 31, 2003. The rewriting process is performed. In this case, if the user A performs the extension process using the key α1 once, the expiration date registered in the user information registration unit 120 is extended. Access is possible without performing.
[0050]
In the case of employing such a modified example, the extension periods of the term extension keys α2 and α3 may be set to one month. By entering the key α2 in August, the registration expiration date in the user information registration unit 120 can be extended to August 31 by performing the process of inputting the key α2. In September, the key α3 is entered. By performing the processing, the registration expiration date in the user information registration unit 120 can be extended to September 30.
[0051]
In this case, it is preferable that the access authentication unit 110 performs the rewriting process of the expiration date for the same user based on the same expiration date key only once. This is because, after the user A inputs the term extension key α1 on July 2 and extends the expiration date to July 31, the user A again enters the same term extension key α1 to extend the expiration date for another month. This is in order to prevent an extension of fraud.
[0052]
In order to further enhance the security, it is also possible to adopt a method of restricting a period for holding the extension key in the extension key storage unit 130 to a predetermined period. This is an example in which the predetermined period is set to infinity, and the term extension key is held semi-permanently). For example, the extension key α1 is held in the extension key storage unit 130 until July 31, but may be deleted on August 1. In such an operation, each expiration date extension key has an expiration date, and is invalidated when the expiration date has passed. Therefore, in the case of the above example, the term extension key α1 functions effectively until July 31, but becomes invalid after August 1.
[0053]
In the example described so far, the term extension key is a key for extending the expiration date registered in the user information registration unit 120 for a predetermined period (for example, one month). A key for extending the expiration date registered in the information registration unit 120 to a predetermined expiration date (for example, July 31, 2003) may be used as the expiration date extension key. In this case, the issued term extension key is stored in the term extension key storage unit 130 together with information indicating the extension term.
[0054]
FIG. 3 is a diagram showing a state in which the term extension keys β1, β2, and β3 for extending the expiration date to the predetermined term are stored together with information indicating the predetermined extension term. In this example, the keys β1, β2, and β3 are term extension keys for extending the expiration dates in the user information registration unit 120 until July 31, 2003, August 31, 2003, and September 30, 2003, respectively. It has become. Like the keys α1, α2, and α3, such keys β1, β2, and β3 are issued by the term extension key issuing unit 140, for example, one week before each extension term, and transmitted to the user manager X. do it.
[0055]
For example, when the user A accesses the computer on July 2, and inputs the extension key β1 in response to the request, the access authentication unit 110 stores the information in the extension key storage unit 130 shown in FIG. By referring to it, it is possible to recognize that the new expiration date is July 31, 2003, so that it can be determined that the authentication for the access has been successful. At this time, if the access authentication unit 110 rewrites the expiration date registered for the user A in the user information registration unit 120 to the new expiration date of July 31, 2003, the user A A will be able to access during July without entering the extension key.
[0056]
In practice, it is convenient to update the password at the time of requesting the input of the extension key. That is, if the access authentication unit 110 determines that the extension key input by the user matches the key stored in the extension key storage unit 130 and that the new expiration date after extension has not elapsed, As described above, the authentication for the access is determined to be successful, and the access to the server device 200 is permitted. At this time, the user is prompted to enter a new password, and the It is preferable to perform a process of rewriting a password for a user with a new password. In general, from the viewpoint of maintaining security, it is recommended that the password be updated periodically, so if the password is updated during the operation of extending the term as described above, practically preferable operation can be performed. Become.
[0057]
As described above, the term extension key issuing unit 140 shown in FIG. 1 has a function of issuing a new term extension key a predetermined period (for example, one week) before the term that requires extension. The issued term extension key is transmitted to the user manager X. Here, the issuance of the term extension key can be performed by an operation of a specialized operator, but in view of the necessity of issuing a new term extension key at regular intervals, a special operator operation is required. It is preferable that automatic issuance be performed without performing the above. More specifically, the function of automatically issuing a time limit extension key at predetermined time intervals based on a predetermined algorithm may be incorporated in the time limit extension key issuing unit 140. Various methods are known as a method for automatically issuing an encryption key, such as a method using a random number, and a detailed description thereof will be omitted here.
[0058]
Further, the method of transmitting the issued term extension keys α1, α2, α3, and the like to the user manager X can be any method. For example, the person in charge of Patent Printing Co., Ltd. confirms the term extension key automatically issued by the term extension key issuing unit 140 on the display screen or on the printed paper, and calls the user administrator X by telephone or the like. Oral communication may be used. Alternatively, the paper on which the term extension key is printed out may be sent to the user manager X by facsimile or mail.
[0059]
However, in practice, it is preferable to use an operation mode in which communication to the user manager X is performed by a method that requires as little human intervention as possible. The present inventor believes that the most reasonable means of communication at this time is electronic mail. As described above, the function of automatically issuing a necessary term extension key for each necessary period based on a predetermined algorithm is provided in the term extension key issuing unit 140. If a function of automatically transmitting an e-mail is provided, an operation of “transmission of a time extension key” indispensable in the present invention can be automatically performed without any human intervention. In other words, if the expiration date extension key issuing unit 140 executes a process of transmitting the issued extension date extension key by e-mail to a predetermined address a predetermined period before the expiration date for which the extension is required, Good.
[0060]
Of course, the method by which the user manager X having received the extension key by e-mail transmits the received extension key to each of the subordinate users A, B, and C is also optional. It may be transmitted orally, may be transmitted by handing a memo, or may be transmitted by transferring a received mail.
[0061]
In the basic embodiment shown in FIG. 1, the term extension key is common to each of the users A, B, and C, but the term extension key issuing unit 140 issues a different term extension key for each user or user group. The expiration date extension key storage unit 130 stores an expiration date extension key for each user or user group in association with each user ID. It is also possible to perform authentication by referring to a term extension key for each.
[0062]
For example, FIG. 4 shows a modification of the user information registration unit 120 and the term extension key storage unit 130 shown in FIG. That is, the user information registration unit 120 shown in FIG. 4 stores three users A, A, B and C, and four C, belonging to Party B, For each of D male, E male E, F male F, and G male G, information such as company name, department, name, user ID, password, expiration date, and transmission destination is registered. On the other hand, the term extension key storage unit 130 shown in FIG. 4 stores a prescribed term extension key and extension term for each user ID. Specifically, the user IDs “AAA”, “BBB”, and “CCC” correspond to the term extension key β4, and the user IDs “DDD”, “EEE”, “FFF”, and “GGG” , And a term extension key γ4, and the extension term is October 31, 2003.
[0063]
In this case, a different extension key is issued for each user group, and the extension key storage unit 130 stores the extension key for each user group in association with each user ID. In this example, the access authentication unit 110 performs authentication by referring to a term extension key for each user group. In other words, the term extension key β4 is issued to the user group belonging to Party A, and the term extension key γ4 is issued to the user group belonging to the party B. In this example, Patent Printing Co., Ltd. provides a service of providing information in the server device 200 to two business partners. However, according to commercial practice, different keys are assigned to different business partners. Since it is preferable to provide the extension key, a different term extension key is issued for each user group. Of course, in this case, the extension key β4 is transmitted to the user manager X of Kosho Corporation, and the extension key γ4 is transmitted to the user administrator Y of the second party.
[0064]
In the example shown in FIG. 4, the extension keys β4 and γ4 stored in the extension key storage unit 130 have the same extension date as that of October 31, 2003. The key issuing unit 140 can also issue a term extension key having a different extension term or extension term for each user or user group.
[0065]
FIG. 5 is a diagram showing an example in which different term extension keys βa to βg are issued to seven individual users, and different extension terms are set for the individual term extension keys βa to βg. It is. In this example, the access authentication unit 110 needs to recognize the key corresponding to each user ID and the extension period when referring to the period extension key storage unit 130. However, as in the example shown in FIG. 5, if the term extension key or extension term is changed for each user, the burden on the user administrator becomes heavy. For example, the key βa is transmitted to the user having the user ID “AAA”, the key βb is transmitted to the user having the user ID “BBB”, and the key βc is transmitted to the user having the user ID “CCC”. I have to take measures such as communicating. In addition, if the extension dates are different, the transmission time of the extension key varies for each user, so that the paperwork has to be complicated. Therefore, in practice, it is preferable to issue the same term extension key and set the same extension term for users under the control of the same user manager.
[0066]
An e-mail address is registered in the transmission destination column at the right end of the user information registration unit 120 shown in FIG. 4, but the e-mail address registered here is not an e-mail address of each user but an e-mail address. , The e-mail address of the user administrator. Specifically, the e-mail address “xxx@kou.co.jp” in the transmission destination column for the three persons belonging to Kosho is the address of the user administrator X of Kosho, and belongs to Otsusho. The e-mail addresses “yyy@otsu.co.jp” in the transmission destination column for the four persons are the addresses of the user manager Y of Otsukai.
[0067]
As described above, if the user information including the e-mail address (e-mail address of the user administrator) to which the extension key is transmitted for each user is registered in the user information registration unit 120, the extension key is registered. The issuing unit 140 can automatically transmit the issued term extension keys to the addresses by e-mail. For example, in the case of the example shown in FIG. 4, the key β4 is automatically transmitted to the e-mail address “xxx@kou.co.jp”, and the key γ4 is transmitted to the e-mail address “yyy@otsu.co.jp”. It will be sent automatically.
[0068]
When the extension key is transmitted to the user managers X and Y not by e-mail but by post or fax, the issued extension key is printed out to the extension key issuing unit 140. And send it by mail or fax. In this case, the mailing address, the fax number, etc., together with the names of the user managers X and Y may be registered in the transmission column on the right end of FIG. Further, the term extension key issuing unit 140 refers to the registration contents of the user information registration unit 120 and prints out a list of term extension keys for a plurality of users having the same user administrator as a list. do it.
[0069]
For example, in the case of the example shown in FIG. 4, a list of extension keys for three persons, that is, A man A, B man B, and C man C, who have the same user manager X, specifically, three persons A list showing the department and name of the user and the extension key to be transmitted to each of them (in this example, β4 in each case) is printed out on one sheet of paper, and the D mountain D having the same user manager Y is printed out. A list of extension keys for four men, E man E, F man F, and G man G, specifically, the four departments and their names and the extension keys to be transmitted to each of them (this In the example, the list indicating γ4) is printed out on one sheet of paper.
[0070]
As described above, the present invention has been described based on some embodiments, but the present invention is not limited to these embodiments, and can be implemented in various other modes. For example, in the above-described example, the operation of indirectly transmitting the term extension key to each user A, B, and C via the supervisor, the user manager X, has been described, but the present invention is implemented. Above, the mediator of the extension key does not have to be the company's boss.
[0071]
For example, by accessing the server device 200, a person who is developing a business that provides a service for browsing some information for a fee may transmit a term extension key to a user using a convenience store or the like as a transmission mediator. Operation is also possible. Specifically, for example, a card on which an extension key is printed may be prepared, and the printed portion of the extension key may be sold at a convenience store in a state where the printed portion is covered with a scratch coating film. . The user makes an initial registration as a subscriber within a certain period of time by any method, thereafter purchases this card at a convenience store, peels off the scratch coating portion and obtains an extension key By performing the extension process, the extension of the subscription period can be extended.
[0072]
Even in such an operation mode, the operator of the server device 200 needs to be involved in the initial registration of each user, but thereafter, it is directly determined whether or not each user has paid the subscription renewal fee. It is not necessary to perform user management. In the above example, the management of whether or not the user has renewed the subscription is left to the convenience store that sells the card.
[0073]
【The invention's effect】
As described above, according to the user authentication device of the present invention, smooth and responsive operation can be performed for individual users even when indirect management is performed via a third party. .
[Brief description of the drawings]
FIG. 1 is a block diagram showing a use form of a user authentication device according to an embodiment of the present invention.
FIG. 2 is a bar graph showing how an initial expiration date is extended by using a term extension key α1, α2, α3 in the user authentication device according to the present invention.
FIG. 3 is a modification in which a term extension key β1, β2, and β3 for extending an expiration date to a prescribed term is stored together with information indicating a prescribed extension term in the term extension key storage unit 130 shown in FIG. It is a figure showing an example.
FIG. 4 is a diagram showing a modification of the user information registration unit 120 and the term extension key storage unit 130 shown in FIG.
FIG. 5 is a diagram showing an example in which different extension keys βa to βg are issued to seven individual users, and different extension dates are set for the individual extension keys βa to βg. It is.
[Explanation of symbols]
10, 20, 30 ... terminal device
50 ... Internet
100: User authentication device
110 ... Access authentication unit
120: User information registration unit
130 ... time limit key storage
140 ... Expansion key issuing unit
200: Server device
A, B, C: Users
X: User administrator
α1, α2, α3 ... Expansion key
β1, β2, β3, β4, βa ~ βg ... Extension key
γ4 ... Expiration date key

Claims (11)

A user authentication device for authenticating whether or not the user has a valid access right when a user accesses the server device via a network,
A user information registration unit for registering user information including a user ID, a password, and an expiration date for each user;
A term extension key issuing unit that issues a term extension key necessary to extend the expiration date only for a predetermined period or until a predetermined period,
A term extension key storage unit that stores the issued term extension key together with information indicating the extension period or extension term for a predetermined holding period,
When a user accesses with a user ID and a password, a password confirmation process is performed to confirm that the user ID and the password associated with the access match the registered contents of the user information registration unit; The expiration date confirmation process for confirming that the registered expiration date has not passed has been performed.If both the password confirmation process and the expiration date confirmation process have been confirmed, a valid If the password is verified in the password confirmation process but not confirmed in the expiration date confirmation process, the user is prompted to input a term extension key. The entered extension key matches the key stored in the extension key storage unit, and the new expiration date after extension is not And access authentication section when there was a peroxide, performs authentication with the access having official rights,
A user authentication device comprising: The user authentication device according to claim 1,
The access authentication unit, if the extension key entered by the user matches the key stored in the extension key storage unit and the new expiration date after extension has not passed, A user authentication device for rewriting the expiration date of the user to the new expiration date. The user authentication device according to claim 2,
A user authentication apparatus, wherein the access authentication unit is configured to perform the rewriting process of the expiration date for the same user based on the same expiration date key only once. The user authentication device according to any one of claims 1 to 3,
The access authentication unit prompts the user if the extension key entered by the user matches the key stored in the extension key storage unit and the new expiration date after extension has not passed. A user authentication device, which prompts for a password and performs a process of rewriting a password for the user in the user information registration unit with the new password. The user authentication device according to any one of claims 1 to 4,
The extension key issuing unit issues a different extension key for each user or user group,
A term extension key storage unit stores a term extension key for each user or user group in association with each user ID,
A user authentication device, wherein an access authentication unit performs authentication by referring to a term extension key for each user or each user group. The user authentication device according to claim 5,
A user authentication device, wherein a term extension key issuing unit issues a term extension key having a different extension period or extension term for each user or user group. The user authentication device according to any one of claims 1 to 6,
A user authentication device, wherein a term extension key issuance unit automatically issues a term extension key based on a predetermined algorithm a predetermined period before a term that requires extension. The user authentication device according to any one of claims 1 to 7,
A user authentication device having a function in which a term extension key issuing unit transmits an issued term extension key by e-mail to a predetermined address a predetermined period before a term requiring extension. The user authentication device according to claim 8,
User information including an e-mail address to which a term extension key is transmitted for each user is registered in the user information registration unit,
A user authentication device, wherein a term extension key issuing unit transmits an electronic mail to an address in the user information. The user authentication device according to any one of claims 1 to 9,
A user authentication device having a function of printing out an issued term extension key by a term extension key issuing unit. The user authentication device according to claim 10,
In the user information registration unit, user information including information for specifying a user administrator to which a term extension key is transmitted for each user is registered,
A user authentication device, wherein a term extension key issuing unit has a function of printing out a list of term extension keys for a plurality of users having the same user administrator as a list.

Images