JP2012215985A - Client server system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To change an off-line policy of a client machine in a situation impossible to communicate with an authentication server, without requiring a dedicated device.SOLUTION: When a client machine cannot communicate with an authentication server, a challenge code which combines off-line policy information of an application target and user specific information is transmitted to a security manager via communication means such as a telephone or a mail, and by receiving approval from the security manager as a response code, it is possible to change a default off-line policy to any of a plurality of off-line policies stored in the client machine.

Description

  The present invention relates to a client server system that acquires an access control policy from an authentication server at the time of login and reflects the policy on a client machine.

For conventional access control on client machines, assuming an information system such as a company, the client machine acquires an access control policy from the authentication server when logging in to the system, and after logging in, the access control policy is reflected and logout Later, the focus will be on returning to a state in which all authorities are restricted.
The resources protected by these access control policies are diverse, such as a document, a print function, a data write function to an external medium, and a mail transmission function.
Among such systems, there is a system that takes into consideration operation in a situation where communication with the server is not possible, and obtains an access control policy when offline and logs the policy when offline.

As a system method considering operation in a situation where communication with the server is not possible, for example, there are technologies described in Patent Literature 1 and Patent Literature 2.
The technique disclosed in Patent Document 1 proposes a method in which one offline access control policy is acquired at the time of login and can be reflected within the expiration date.
In the technique disclosed in Patent Document 2, a plurality of access policies are acquired at the time of online login, and information on the access control policy to be selected in the token device is registered at the time of offline login, and connected to the client machine. , A method that can be reflected within the expiration date is proposed.

JP 2008-33855 A JP 2010-250714 A

However, the technique disclosed in Patent Document 1 is based on the assumption that the client machine and the authentication server can always communicate with each other, and there is a problem that nothing can be done in situations where the machine is always taken out of the office and used. . In addition, only one access control policy is applied, and even when the client machine cannot connect to the server, a flexible access control policy that is different for each user and that is appropriately restricted is implemented. Operation was not possible with the prior art.
In addition, the technique disclosed in Patent Document 2 has a problem that a dedicated device such as a token device has to be prepared. In addition, there is a problem that the business cannot be performed until the device is prepared again by losing the device.
Even when the offline policy is switched by using a one-time password without using a dedicated device, the security administrator cannot know the security policy after the change, so the appropriate security policy cannot be used. was there.

  An object of the present invention is to provide a client server system that can define an access control policy even in a state where communication with a server is not possible, can change an offline policy without preparing a dedicated device, and can realize a more flexible access control policy There is to do.

In order to achieve the above object, a client server system of the present invention authenticates a client machine, sends a server access control policy to an online resource, and receives an access control policy from the server. A client server system comprising a plurality of the client machines,
The server
In addition to the authentication information of each user using the client machine, an access that holds an online policy that is an access control policy at the time of online login of each user, and further holds a plurality of offline policies that are an access control policy at the time of offline A control policy storage means;
Installation medium creation means for creating an installation medium for introducing a plurality of offline policies held in the access control policy storage means to the client machine;
The client machine is
First means for acquiring an online policy held in the access control policy storage means when online to the server, and executing access control to the resource of the client machine according to the online policy;
Second means for applying any of the plurality of offline policies to the client machine according to the installation medium created by the installation medium creation means, and executing access control to resource resources when offline according to the offline policy; Have
The second means displays a challenge code combining security policy information corresponding to any offline policy and user information when applying any of the plurality of offline policies, and receives the challenge code. If the password is not correct, the offline policy is not applied and all access rights to the resource are restricted. The offline policy that matches the security policy information is applied to perform offline access control.
2. The client server according to claim 1, wherein information on a plurality of offline policies is held on the client machine, and which of the plurality of offline policies is applied is selected by the challenge code. system

The client server system of the present invention has the following effects.
Appropriate access control policies can be applied to client machines used in situations where communication with the authentication server is not possible. In addition, since the access control policy can be changed without preparing a dedicated device for a client machine that cannot communicate with the authentication server, it is possible to deal with various situations.

1 is an overall system configuration diagram including a management server and a client according to the present invention. It is a block diagram of the data stored in the access control policy database. It is a schematic explanatory drawing which shows the method of application of the security policy in this invention. It is a data block diagram of the offline policy set used by this invention. It is a flowchart which shows the process at the time of online login. It is a flowchart which shows the process at the time of offline login.

Hereinafter, an embodiment of a client server system to which the present invention is applied will be described.
FIG. 1 is a system configuration diagram showing an embodiment of the present invention.
The server 103 includes an access control policy database (DB) 104, in which an online policy for each user is stored.
A user of each client machine 101 normally performs online login with the server 103 and performs various operations. For each communication, an online policy is acquired from the server 103 and stored in the client machine 101.
For example, in FIG. 1, when User 1 logs in online from the client machine 101, the online policy 106 corresponding to User 1 in the access control policy DB 104 of the server 103 is downloaded to the client machine 101 via the network 102 and is used as the online policy 105 of User 1. Saved.
Thereby, when User1 logs in online, access control is executed according to the online policy.

FIG. 2 shows an example of information stored in the access control policy DB (104 in FIG. 1) for each user. The administrator can set (define) an online policy for each user, and can change it after the setting.
In the online policy of this example, User1 is set as a resource access right to print, mail can be sent, external media cannot be taken out, and network folder can be accessed.
On the other hand, User2 is set to be printable, mail can be sent, external media can be taken out, and network folder can be accessed, and the data takeout authority by the external medium is defined to be different from User1.

FIG. 3 shows the outline of the system configuration and processing at the time of offline login according to an embodiment of the present invention.
The server 103 holds a set 302 of various offline policies. Then, by creating an installation medium 303 used when introducing an offline policy to the client machine 101 and installing it on the client machine 101, various offline policies Set 302 held in the server 103 are also stored on the client machine 101. Hold.
The offline policy 302 to be used when offline is determined by sending a challenge code with security information corresponding to the user information and the offline policy to be applied to the security administrator, and issued with the approval of the security administrator. The user selects a one-time password by inputting it. If a one-time password has not been issued, all privileges are restricted.
FIG. 4 is a data configuration example of the offline policy set 302 used in the present invention.
As shown in FIG. 4, a plurality of combinations of offline policies are prepared, and set numbers Set 1 to Set 3... Are assigned to each of the combinations.

FIG. 5 is a flowchart showing a processing procedure at the time of online login in the client machine 101.
When a user logs in to the authentication server 103 online from the client machine 101, first, in step 501, authentication processing is performed with the authentication server 103 (step 502). If authentication fails, the process ends in error at step 503. If the authentication is successful, an online policy corresponding to the user is acquired from the access control policy DB 104 of the authentication server 103 in step 504. Thereafter, in step 505, online login processing is performed.
After the online login process, the client machine 101 performs access control to the resource according to the online policy acquired in step 504.

FIG. 6 is a flowchart showing a processing procedure when the client machine 101 is offline.
First, in step 601, the changed offline policy is selected.
That is, the client machine 101 holds a plurality of sets of offline policy sets acquired from the authentication server 103 when online, but the user of the client machine 101 wants to change the offline policy set used when offline from, for example, Set1 to Set2. In step 602, a challenge code is created from the combination of security information (Set number) corresponding to the offline policy selected in step 601 and user information.

In step 603, the client machine 101 displays the challenge code created in step 602 on a display screen (not shown) or the like, and the user uses a communication means such as telephone or e-mail, and the displayed challenge code is sent to the security administrator. Send. The security administrator receives the challenge code and determines in step 604 whether to approve switching to the offline policy.
If the security administrator approves the switching of the offline policy, in step 605, the authentication server 103 issues a one-time password, and the security administrator uses a communication means such as a telephone or e-mail to give the one-time password to the user. Send. If the security administrator does not approve, the client machine 101 applies the setting for restricting all authorities in step 610.

In step 606, the user receives the one-time password from the security manager by communication means such as a telephone or e-mail, and inputs the one-time password to the client machine 101.
In step 607, the client machine 101 determines whether the one-time password is correct. If the password is invalid, a setting for restricting all authorities is applied in step 610. If the one-time password is correct, it is determined in step 606 whether the password has expired. If the one-time password has expired, a setting for restricting all authorities is applied in step 610. If the one-time password has not expired, an offline policy is applied at step 609.

  The client machine 101 and the authentication server 103 have the same logic for generating a one-time password, and the same one-time password is generated by both devices from the same challenge code.

Through the above processing, even when the client machine 101 is in an offline state, the security administrator permits the user to select one of a plurality of offline policies acquired from the installation medium 303 and use the policy. It is used only when it is done, and resource access control is executed. Therefore, an appropriate access control policy can be applied to the client machine 101 that is used in a situation where it cannot communicate with the authentication server 103.
In addition, for the client machine 101 that cannot communicate with the authentication server 103, the access control policy can be changed to any of a plurality of policies without preparing a dedicated device. Is possible.

101 Client machine 103 Authentication server 104 Access control policy database

Claims (2)

A client server system comprising a server that authenticates a client machine and sends an access control policy to an online resource to the client machine, and a plurality of the client machines that receive the access control policy from the server,
The server
In addition to the authentication information of each user using the client machine, an access that holds an online policy that is an access control policy at the time of online login of each user, and further holds a plurality of offline policies that are an access control policy at the time of offline A control policy storage means;
Installation medium creation means for creating an installation medium for introducing a plurality of offline policies held in the access control policy storage means to the client machine;
The client machine is
First means for acquiring an online policy held in the access control policy storage means when online to the server, and executing access control to the resource of the client machine according to the online policy;
Second means for applying any of the plurality of offline policies to the client machine according to the installation medium created by the installation medium creation means, and executing access control to resource resources when offline according to the offline policy; Have
The second means displays a challenge code combining security policy information corresponding to any offline policy and user information when applying any of the plurality of offline policies, and receives the challenge code. If the password is not correct, the offline policy is not applied and all access rights to the resource are restricted. A client-server system that performs offline access control by applying an offline policy that matches security policy information.   2. The client server system according to claim 1, wherein information regarding a plurality of offline policies is held on the client machine, and which of the plurality of offline policies is selected is selected according to the challenge code.

Images