JP2012118833A - Access control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication technique with which user authentication convenience is improved while ensuring security in so-called single sign-on.SOLUTION: An access control system is provided which includes a total authentication device which manages user authentication in a unitary manner, a terminal device that a user utilizes, and a job processing device which performs information processing of various jobs. The access control system further includes processing to substitute user authentication processing, processing to confirm an identity of the user, processing to manage a job authority given to the user, processing to manage an authentication level required for executing a job processing, processing to manage correspondence between the authentication level and an authentication system, a DB which stores authentication information of the user, a DB which stores the job authority given to the user, a DB which stores the authentication level required for executing the job processing, and a DB which stores the authentication level of the user at an arbitrary point in time.

Description

  The present invention relates to a technique for centrally managing access authority and user authentication, and more particularly to a single sign-on system.

  In recent years, computer systems and applications can be obtained at low cost, and information systems for various operations supporting corporate activities have been developed.

  While an environment in which a business system can be easily built is maintained, individual departments within a company often proceed with individual maintenance, and for users who use such business systems, application and authentication procedures are required for each system. It was necessary to use different IDs and passwords.

  As one of the methods for improving the convenience of the user as described above, there is a single sign-on system that allows a plurality of business systems to be used without requiring subsequent authentication by one authentication.

  While the single sign-on system improves user convenience, the authentication method is common to all business systems, so authentication according to the security level cannot be performed, and a highly authentic authentication method such as biometric authentication is not possible. Adopting has the demerit of increasing security and increasing convenience but also increasing costs. Adopting authentication methods with low identity, such as IDs and passwords, increases the possibility of misuse of important business systems. There are disadvantages.

  In order to deal with the above-described problems, there is a technique that provides the business system with a difference in the identity verification method when registering a user, and adds it to the conditions for whether or not the business system is authenticated. For example, in Patent Document 1, in a network system composed of a plurality of systems that are not in a trust relationship or cooperative relationship with each other, in order to be able to use a plurality of applications that require authentication by inputting authentication information once, The following configuration is adopted. When the Web server 10 performs authentication by comparing the authentication information from the terminal 13 with the authentication information in the storage unit, and the authentication is established, the user ID included in the authentication information, This message is a message indicating that authentication is successful from the Web server 11 by generating a message including one URL, a second URL to the Web server 11 and information related to the authentication strength of the storage unit and outputting it to the network. And receiving the message including information related to the user ID, the first URL, the second URL, and the authentication strength, the authentication strength received when the user ID is stored in the storage unit. The authentication is performed based on the information related to the information and the information related to the authentication strength of the storage unit.

JP 2010-86435 A

  However, the technique described in Patent Document 1 requires a means for receiving and determining the difference in the identity verification method on the business system side, and in an environment where the business system already exists, the system must be significantly reorganized. Moreover, since the authentication method at the time of authentication is not changed according to the business system, there is a problem that security and convenience cannot be achieved at the same time.

  In order to solve the above-mentioned problem, in the present invention, in the single sign-on, the authentication level of the first authentication that has been authenticated in advance and the second authentication required by the system being accessed (or the authentication request). The authentication levels are compared, and the necessity of the second authentication is determined based on the comparison result. More specifically, when the authentication level of the second authentication is higher (the authentication of the first authentication level is lower), the second authentication or the corresponding authentication is executed. Further, when the authentication level of the second authentication is lower (the authentication of the first authentication level is higher), the second authentication or the authentication corresponding thereto is suppressed in one aspect of the present invention. is there.

  For the authentication corresponding to the second authentication, it is also an aspect of the present invention to specify a difference between the first authentication and the second authentication and execute the authentication of the difference. Here, the difference is an authentication that is not included in the first authentication among the plurality of authentications and is executed when at least the second authentication is realized by combining a plurality of authentications. Further, a level difference between the authentication level of the first authentication and the authentication level of the second authentication may be calculated, and authentication at the authentication level of this level difference may be executed.

  In addition, when there are a plurality of first authentications, that is, those that have been authenticated in advance (and whose results are still maintained as valid), the above-mentioned difference has the highest authentication level among the plurality of first authentications. The difference is specified on the basis of the thing.

  More specifically, an access control method according to the present invention includes an integrated authentication device that centrally manages user authentication, a terminal device used by the user, and a business processing device that performs information processing of various business operations. In the above, a process for performing the user authentication process, a process for confirming the identity of the user, a process for managing the business authority given to the user, a process for managing an authentication level necessary for executing the business process, A process for managing the correspondence between the authentication level and the authentication method, a DB storing the authentication information of the user, a DB storing the business authority given to the user, and an authentication level necessary for executing the business process And a DB storing the authentication level of the user at an arbitrary time.

  According to the present invention, it is possible to select an authentication method according to the actual situation, so that both security and convenience can be achieved.

It is a figure explaining the function of the access control system 100 in one Example of this invention. It is a figure explaining the hardware constitutions of the access control system 100 in one Example of this invention. It is a figure which shows an example of the data processed within the access control system 100 in one Example of this invention. It is a figure explaining an example of the typical process of the access control system 100 in one Example of this invention.

  FIG. 1 shows a configuration of an access control system 100 according to an embodiment of the present invention.

  As shown in FIG. 1, the access control system 100 includes an integrated authentication device 1100, a terminal device 1200, and a business processing device 1300. Each device is connected by a communication path such as a local area network (LAN) or the Internet. Note that there may be a plurality of devices included in the access control system 100.

  The integrated authentication device 1100 confirms the identity of the user, an authentication agent 1101 that performs authentication processing for a user who accesses the business processing device 1300 from the terminal device 1200, a user management unit 1102 that manages the authentication information of the user. Authentication means 1103, access control management means 1104 for managing the usage authority of the user's business processing means, authentication level management means 1105 for managing the authentication level necessary for using the business processing means, and managing the correspondence between the authentication level and the authentication method Authentication method management means 1106, a user DB 1107 storing the user authentication information, an access control DB 1108 storing information on the business processing means available to the user, and information on the authentication level necessary for using the business processing means Authentication level DB 1109, the user at a certain point in time Authentication state DB1110 storing the testimony levels, including authentication method DB1111 which stores correspondence information of the authentication levels and authentication methods.

  The terminal device 1200 includes a business process input / output unit 1201 for a user to input an operation command or data to the business processing unit and receive a processing result, and an authentication information input unit 1202 for the user to input authentication information for identity verification. including. The terminal device 1200 is an information processing device such as a personal computer. The authentication information input means is a keyboard for inputting an ID or a password, a reader for reading authentication information from a medium such as an IC card, a biometric information scanner for inputting biometric information, and the like.

  The business processing apparatus 1300 includes business processing means A 1301 and business processing means B 1302 for performing business processes such as personnel, accounting, design, manufacturing, and logistics. The business processing unit A 1301 and the business processing unit B 1302 may be the same business process or different business processes. The business processing device 1300 is a server on which an application that performs the business processing operates.

  Each of the above devices is realized by a so-called computer, and the processing including a flowchart to be described later is executed by an arithmetic device such as a CPU according to a program. Note that an arithmetic unit that executes processing according to a program is represented by each means in FIG.

  FIG. 2 illustrates an example of a hardware configuration of the integrated authentication device 1100, the terminal device 1200, and the business processing device 1300 included in the access control system 100.

  The apparatus 200 includes a CPU 201, a memory 202 such as a RAM and a ROM, a disk 203 such as a hard disk and a silicon disk, an input device 204 such as a keyboard, a mouse, or a switch, an output device 205 such as a liquid crystal display, a CRT, an LED, or a speaker, A communication interface 206 that communicates with the outside of the apparatus 200 is included, and is connected by a communication path inside the apparatus.

FIG. 3 shows an example of various data processed in the access control system 100.
The data 300 is an example in which the internal use of the user DB 1107 is represented in a table format. For convenience, it is expressed as a character string, but the data such as the biometric information 303 is data obtained by digitizing the biometric feature amount. The data 300 is stored in advance by the person in charge of business processing using the user management unit 1102.

Data 310 is an example of the contents of the access control DB 1108 expressed in a table format. The data 310 is stored in advance by the person in charge of business processing using the access control management unit 1103.
It is an example which represented the content of the data 320 and authentication level DB1109 in the table format. The data 320 is stored in advance by the person in charge of business processing using the authentication level management means 1105.

  The data 330 is an example of the contents of the authentication status DB 1110 expressed in a table format. The data 330 is stored in advance by the person in charge of business processing using the authentication level management unit 1105 in advance.

  The data 340 is an example of the contents of the authentication method DB 1111 expressed in a table format. The data 340 stores the authentication status of the user at a certain point in time by the authentication method management unit 1106.

FIG. 4 shows a user authentication process that is a typical process in the access control system 100.
The flowchart 400 starts when the user accesses the business processing apparatus 1301 from the terminal apparatus 1200.
Here, it is assumed that the user uses the business processing means A 1301, the “user ID” allocated in advance by the business processing administrator to the user is “0001”, and the authentication method selected by the user is “user ID + password”. "

  First, in the process 401, the business process input / output unit 1201 requests the authentication proxy unit 1101 to access the business process unit A 1301.

  Next, in the process 402, the authentication proxy means 1101 refers to the user ID 331 and the authentication level 332 of the authentication status DB 1110 via the authentication level management means 1105 and accesses from the business process input / output means 1201 with or without values. Check if you have been previously authenticated. This is determined based on whether the authentication level is recorded in the authentication level 332 of the data 330. In this case, if authentication has been performed before, it is more preferable to confirm whether the authentication is valid. In this case, when authentication is invalidated (logoff, etc.), it is possible to make a determination by deleting the contents, such as setting the authentication level 332 to null.

Here, there is no access from the business process input / output means 1201 before, or logoff after access, etc., so that the data 333 has no value (null) in the column of the authentication level 332. In processing 403, the authentication agent 1101 refers to the column of the business processing unit A 322 of the authentication level DB 1109 via the authentication level management unit 1105, and the “authentication level” necessary for using the business processing unit A 1301 is “1”. Get “2” and “3”.

Next, in process 404, the authentication agent 1101 compares the authentication level acquired in process 402 with the authentication level extracted in process 403, and the value acquired in process 402 is greater than or equal to the value acquired in process 403. If there is, the processing 408 is performed assuming that re-authentication of the user is unnecessary. In other cases, user authentication is required and the processing 405 is performed.
Here, since the authentication level acquired in process 402 has no value, process 405 is performed.

Next, in the process 405, the authentication agent 1101 searches the authentication level 341 column of the authentication method DB 1111 via the authentication level management unit 1105, and the authentication methods 341 respectively corresponding to “1”, “2”, and “3”. The “user ID + password”, “IC card”, and “biometric information” acquired as the value of the user ID are sent to the business process input / output means 1201.
The business process input / output unit 1201 presents the authentication method received from the authentication agent unit 1101 to the user, and waits for the user to select an authentication method and input authentication information to the authentication information input unit 1202.
As described above, it is assumed here that the user selects “user ID + password”, inputs “0001” as “user ID” as authentication information, and “Saklfjdaf” as “password”. Here, it is assumed that the user has selected, but authentication may be performed using a difference from the authenticated content. In this case, if the second authentication currently requested is a combination of a plurality of authentications, the second authentication (combination) includes an authentication that is not included in the already performed (valid) first authentication. Then, authentication is executed with this authentication. Also, the authentication level may be compared and used to identify the required authentication. In other words, if the authentication level is 1 and authentication is performed, and an access request is issued and authentication level 3 is requested, authentication level 2 that is the difference between the authentication level 2 and the corresponding authentication (see FIG. In the example of 3, IC card authentication) may be performed.

  Next, in process 406, the business process input / output unit 1201 sends the authentication method “user ID + password” selected by the user and “0001” and “Saklfjdaf” input to the authentication information input unit 1202 to the authentication proxy unit 1101. Send.

The authentication proxy unit 1101 passes the information received from the business process input / output unit 1201 to the authentication unit 1103.
The authentication unit 1103 refers to the user DB 1107 and searches for “001” in the column of the user ID 301 and “Saklfjdaf” in the column of the password 302 based on the information received from the authentication proxy unit 1101 to determine whether there is a match. Check.

  Next, in process 407, if the authentication information value stored in the user DB 1107 matches the authentication information value input by the user, the authentication unit 1103 determines that the authentication is successful and executes process 408. If they do not match, it is determined that the authentication has failed, and the flowchart 400 is terminated.

Here, since there is a match in the process 406, the process 408 is performed.
Next, in processing 408, the authentication proxy unit 1101 receives the result of the authentication information match from the authentication unit 1101, and receives “001” and “authentication level” “1” of the “user ID” via the authentication level management unit 1105. Is stored in the authentication status DB 1110.
The authentication proxy unit 1101 permits the business processing unit A 1301 to access from the business processing input / output unit 1201 of the terminal device 1200.

  Next, in the process 409, the business management means A 1301 executes a process according to the operation command and data from the business process input / output means 1201, and returns the result to the business process input / output means 1201.

  As described above, when the user uses the business processing apparatus, the processing 402 and processing 403 extract the authentication level and authentication method required for each business processing, and the processing 404 authenticates the user at that time. Only when the level does not reach the authentication level required for the business process, the user authentication is performed in the process 404 and the process 405, and when the authentication is successful in the process 407, the business process of the process 409 is performed. Since user authentication can be performed and an authentication method can be selected for each business system, it is possible to prevent complicated user authentication and improve user convenience while ensuring the security of business systems with different security levels.

DESCRIPTION OF SYMBOLS 100 Access control system 1100 Integrated authentication apparatus 1101 Authentication agent means 1102 User management means 1103 Authentication means 1104 Access control management means 1105 Authentication level management means 1106 Authentication method management means 1107 User DB
1108 Access control DB
1109 Authentication level DB
1110 Authentication status DB
1111 Authentication method DB
1200 Terminal device 1201 Business processing input / output unit 1202 Authentication information input unit 1300 Business processing device 1301 Business processing unit A
1302 Business processing means B
200 Device 201 CPU
202 Memory 203 Disk 204 Input device 205 Output device 206 Communication interface

Claims (5)

In an access control method using an access control system including an integrated authentication device that centrally manages user authentication, a terminal device used by a user, and a business processing device that performs information processing of various businesses,
The integrated authentication device is
Execute the first authentication process to confirm the user's identity,
Record the execution result of the first authentication process,
When an access request to the business processing device is received from the user via the terminal device, it is determined whether the result of the first authentication processing is valid,
If the result of the determination is valid, the second authentication necessary for accessing the business processing device is specified, and the second authentication is compared with the first authentication.
Based on the result of the comparison, it is determined whether the second authentication or the authentication corresponding to the second authentication is necessary,
An access control method, wherein authentication for the user is controlled based on a determination result of the necessity of the authentication. The access control method according to claim 1,
The integrated authentication device includes:
An authentication level necessary for execution of business processing of the business processing device is stored in the first storage device,
The authentication level and the authentication method indicating the authentication method are associated with each other and stored in the second storage device,
The access control method characterized in that the second authentication necessary for the access is specified based on the storage contents of the first and second storage devices. The access control method according to claim 2,
The determination of necessity of authentication corresponding to the second authentication or the second authentication is performed by comparing the first authentication level in the first authentication with the authentication level in the second authentication, and the first authentication. When the level is low or equivalent, it is determined that authentication corresponding to the second authentication or the second authentication is necessary. The access control method according to claim 3,
An access control method, wherein authentication corresponding to a difference between the first authentication and the second authentication is specified as authentication corresponding to the second authentication level. The access control method according to claim 4,
As the authentication corresponding to the difference, (1) when the second authentication is realized by a combination of a plurality of authentications, authentication that is not used for the first authentication or (2) the first authentication level and the An access control method characterized by specifying authentication at an authentication level indicating a difference between the second authentication levels.

Images