JP2015176238A - Authentication control apparatus, authentication system, authentication method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve security.SOLUTION: An authentication control apparatus includes: card information processing means which registers one or more pieces of card information on each user and security information corresponding to the card information; authentication processing means which collates card information transmitted from a device with the card information registered by the card information processing means to determine whether the authentication is successful or not; and interface means which outputs an authentication result obtained by the authentication processing means, to the device.

Description

  The present application relates to an authentication control device, an authentication system, an authentication method, and a program.

  For example, a method in which user authentication is performed using an IC card (Integrated Circuit Card) or the like for an authentication system that cooperates with a multifunction device such as an MFP (Multifunction Peripheral), and only authorized users perform printing or the like from the multifunction device Is known (see, for example, Patent Document 1).

  However, in the method described in Patent Document 1, since security is set for each logged-in user, for example, when a user loses an IC card, if another user uses the IC card, the card is lost. Will have the same authority as the selected user.

  In one aspect, the present invention aims to improve security.

  An authentication control device according to one aspect, wherein each user has one or more card information and card information processing means for registering security information corresponding to the card information, card information transmitted from a device, and the card Authentication processing means for determining whether authentication is possible by collating with card information registered by the information processing means, and interface means for outputting an authentication result obtained by the authentication processing means to the device.

  Security can be improved.

It is a figure which shows an example of schematic structure of the authentication system which concerns on this embodiment. It is a figure which shows an example of a function structure of each apparatus which concerns on this embodiment. It is a hardware block diagram of a computer system. It is a figure which shows an example of the various information used by this embodiment. It is a figure which shows an example of the security information in this embodiment. It is a sequence which shows an example of the registration process of card information. It is a sequence which shows an example of the registration process matched with the registration possible number of a security classification. This is a sequence for preventing duplicate registration of card information. It is a sequence which shows an example of a card | curd authentication process. It is a sequence which shows an example of the card | curd authentication process including external authentication.

  Hereinafter, embodiments will be described in detail.

<Authentication system: schematic configuration>
FIG. 1 is a diagram illustrating an example of a schematic configuration of an authentication system according to the present embodiment. An authentication system 1 illustrated in FIG. 1 includes a client PC (Personal Computer) 10, devices 20-1 to 20-2 (hereinafter, appropriately referred to as “device 20”), and a card authentication system 30. The card authentication system 30 includes an authentication control server 30-1 and external authentication servers 30-2 to 30-3.

  In the example of FIG. 1, the client PC 10, the device 20, and the card authentication system 30 are connected in a state where data can be transmitted and received via a communication network typified by the Internet or a LAN, for example.

  Note that the authentication control server 30-1 is a cloud server or the like composed of one or more information processing apparatuses, and between the device 20 and the authentication control server 30-1, or between the authentication control server 30-1 and the external authentication server 30. It is good also as a structure which provided the firewall between -2-30-3.

  The client PC 10 is an administrator terminal for registering, for example, authentication information for using the device 20 in the authentication control server 30-1. The authentication information is information such as access authority for the device 20 and is, for example, user information or card information, but is not limited thereto.

  The device 20 is a device to be used by the user (user), and in determining whether or not to allow the user to use, the device 20 reads card information included in an IC card or the like owned by the user, and the card information. Or the like is used to request card authentication to the card authentication system 30. Note that the card authentication is also referred to as login authentication because it is an authentication process performed when logging into the device 20, for example. When the device 20 obtains the authentication result from the card authentication system 30, the device 20 restricts the use of the user based on the authentication result.

  The device 20-1 is, for example, a multifunction peripheral such as an MFP or a printer. The device 20-2 is, for example, a projector or an electronic whiteboard. The type of the device 20 is not particularly limited. The device 20 requires successful login authentication (user authentication) when using at least some of the functions. The device 20-1 may be connected to a print server, a user terminal used by the user, or the like.

  The authentication control server 30-1 stores, for example, authentication information in which user information (user ID or the like) is associated with card information (card ID or the like). Upon receiving a card authentication request based on, for example, card information from the device 20, the authentication control server 30-1 collates with stored authentication information, and permits the user to use the device 20 based on the collation result. Authentication processing is performed to determine whether or not. For example, when receiving an authentication request based on a card ID, the authentication control server 30-1 specifies a user ID managed in association with the card ID.

  In addition, the authentication control server 30-1 can perform authentication using an existing authentication server in response to an authentication request from the device 20, for example, in cooperation with the external authentication servers 30-2 to 30-3. It is.

  The external authentication servers 30-2 to 30-3 perform user management (user ID management, presence confirmation by searching for a user ID, etc.). In the external authentication servers 30-2 to 30-3, for example, a user ID or the like is registered in advance. For example, login authentication (user authentication) in a user terminal used by a user, a device such as a company, organization, Used for integrated management of user authentication within a group.

  The external authentication servers 30-2 to 30-3 are, for example, Active Directory or LDAP (Lightweight Directory Access Protocol) servers provided by other companies, but are not limited thereto.

  When the authentication control server 30-1 performs authentication in cooperation with the external authentication servers 30-2 to 30-3, the user ID specified by the authentication control server 30-1 is assigned to the external authentication servers 30-2 to 30-3. To request user presence confirmation (search).

  The external authentication servers 30-2 to 30-3 search the received user ID from the stored user information (user ID is registered), and when the search is successful (when the user ID exists) In response, the authentication control server 30-1 responds that the presence has been confirmed. When the received user ID cannot be searched (when the user ID does not exist), the external authentication servers 30-2 to 30-3 respond to the authentication control server 30-1 that the presence cannot be confirmed. .

  When the authentication control server 30-1 receives from the external authentication servers 30-2 to 30-3 that it has been confirmed that there is a user ID, the authentication control server 30-1 transmits, for example, an authentication result that determines that the user authentication is successful to the device 20. In addition, when the authentication control server 30-1 receives information indicating that the presence confirmation cannot be performed from the external authentication servers 30-2 to 30-3, the authentication control server 30-1 transmits, for example, an authentication result that determines that the user authentication has failed to the device 20.

  The authentication control server 30-1 can also perform user authentication without cooperating with the external authentication servers 30-2 to 30-3. In this case, the authentication control server 30-1 determines that the authentication is successful when, for example, the user ID associated with the card ID can be specified.

  As another method, the authentication control server 30-1 determines that the authentication is successful when the card ID can be searched (when the card ID is registered in advance). This method is also referred to as “deemed authentication” because it is considered that there is a user ID when the card ID can be searched.

  The response of the authentication result of successful authentication to the device 20 includes, for example, a user ID and security information (usage authority information etc.) of the device 20. Therefore, the device 20 can perform usage restrictions on user usage based on this response information.

  In this embodiment, when performing login authentication with the device 20 using an IC card or the like carried by the user, authority management is performed for each of a plurality of IC cards or the like associated with the user.

<Functional configuration example>
Next, a functional configuration example of each device used in the authentication system 1 described above will be described with reference to the drawings. FIG. 2 is a diagram illustrating an example of a functional configuration of each device according to the present embodiment. FIG. 2A illustrates an example of a functional configuration of the device 20. FIG. 2B shows an example of the functional configuration of the authentication control server 30-1. FIG. 2C shows an example of the functional configuration of the external authentication servers 30-2 and 30-3.

<Device 20>
2A includes an input receiving unit 21, an output unit 22, a setting information storage unit 23, an authentication service using application 24, and an IC card reader reading unit 25.

  The input receiving unit 21 receives an output request for data or the like from the user. For example, if the device 20 is a multifunction device, a printer, or the like, a printing or copying instruction is accepted. For example, if the device 20 is a projector or the like, a data projection (display) instruction or the like for the screen is accepted.

  The output unit 22 outputs target data for the output request received by the input receiving unit 21. For example, if the device 20 is a multifunction device, a printer, or the like, printing or copying is performed on a paper medium or the like in response to a print request or a copy instruction. For example, if the device 20 is a projector or the like, the instructed data is projected (displayed) on the screen.

  The setting information accumulating unit 23 accumulates various setting information related to the use of the device 20 (for example, the IP address of the authentication control server 30-1 for accessing the card authentication system 30).

  The authentication service using application 24 is an application that makes an inquiry (authentication request) to the card authentication system 30 and obtains the result in order to confirm the usage authority and the like of the user who uses the device 20. The authentication service using application 24 includes an IC card information notifying unit 24-1 and an authentication result determining unit 24-2.

  When the IC card reader reading unit 25 reads card information from the IC card, the IC card information notification unit 24-1 notifies the card authentication system 30 of the card information and makes an authentication request. The card information is, for example, identification information (card ID) for identifying a card, but is not limited to this.

  The authentication result determination unit 24-2 acquires the authentication result from the card authentication system 30, and controls the output of the output unit 22 in response to the output request received by the input receiving unit 21 based on the authentication result.

  The IC card reader reading unit 25 reads information stored in a memory of an IC card carried by the user. The IC card reader reading unit 25 may be built in the device 20 or may be connected to the network by a USB (Universal Serial Bus) cable, Bluetooth (registered trademark), or the like regardless of wired or wireless. .

  The IC card reader reading unit 25 can also transmit card information read from the IC card to the device 20 and transmit an authentication request from the device 20 to the card authentication system 30. Further, the IC card reader reading means 25 can also directly send an authentication request to the card authentication system 30.

<Authentication control server 30-1>
An authentication control server 30-1 shown in FIG. 2B includes an IC card information I / F unit 31, a card information processing unit 32, an authentication processing unit 33, and a security information processing unit 34 as an example of an interface unit. User information storage means 35, card information storage means 36, and security information storage means 37.

  The IC card information I / F unit 31 is an interface for inputting card information from the authentication service using application 24 of the device 20 and outputting an authentication result to the authentication service using application 24.

  The card information processing means 32 accepts setting (registration) of card information including security information (usage authority information) for each IC card from the administrator (user) of the authentication control server 30-1, and the card information storage means 36.

  Here, the card information processing means 32 can register one or a plurality of card information for the user by registering the user in association with each IC card, for example. The security information set for each card information includes, for example, usable functions based on the security level and / or information on the device 20.

  The card information processing means 32 may determine whether or not an IC card can be registered in accordance with the number of IC cards that can be registered in advance based on the security level. Also, by setting the number of IC cards that can be registered based on this security level, for example, when one regular card is set, it is possible to prevent, for example, impersonation.

  Further, for example, when the IC information processing unit 32 newly registers an IC card in association with a user, the card information processing unit 32 determines whether the same card is already associated with an arbitrary user. When the same card is already associated with the user, the card information processing means 32 does not newly associate the user or cancels the association between the already associated user and the card. Thereafter, a new user is associated. This makes it possible to prevent duplicate registration of card information.

  The authentication processing unit 33 collates the card information acquired from the device 20 by the IC card information I / F unit 31 with the card information included in the authentication information stored in the card information storage unit 36, and uses it for the device 20. Determine whether or not. The authentication processing unit 33 determines success or failure of the authentication, and outputs an authentication result including usage authority information for the device 20 to the device 20 that requested the authentication. Note that the authentication processing unit 33 may request the external authentication servers 30-2 and 30-3 to check existence by searching for a user ID, for example.

  The security information processing means 34 accepts registration of security information for setting, for example, on the IC card from the administrator of the authentication control server 30-1 and stores it in the security information storage means 37. The security information processing means 34 sets the number of cards that can be registered according to the security level of the security classification, for example.

  The user information storage unit 35 stores user information such as a user name and a password. The card information storage means 36 stores card information and security information for each IC card, for example. The security information storage unit 37 stores security information for setting in the IC card.

<External authentication servers 30-2, 30-3>
The external authentication servers 30-2 and 30-3 illustrated in FIG. 2C include an authentication I / F unit 41, a process request unit 42, an authentication data management unit 43, and an authentication data storage unit 44.

  The authentication I / F unit 41 is an interface for receiving an authentication request from the authentication control server 30-1 and transmitting the authentication result processed by the processing request unit 42 to the authentication control server 30-1.

  The process request unit 42 executes a process for the process request (authentication request) acquired by the authentication I / F unit 41 from the authentication control server 30-1 (search for whether a user ID exists in the user information). The result is output to the authentication I / F unit 41. The processing request unit 42 acquires the authentication data stored in the authentication data storage unit 44 via the authentication data management unit 43, and performs authentication using the authentication data.

  The authentication data management means 43 manages authentication data such as user information (user ID is registered) used in other systems. For example, the authentication data management unit 43 uses the authentication data storage unit 44 to read or write authentication data in response to the processing request from the processing request unit 42.

  The client PC 10 shown in FIG. 1 is a device used by an administrator of the authentication control server 30-1. The client PC 10 accesses the authentication control server 30-1 to register card information, register security information, and confirm the authentication result for displaying the result of the authentication process, etc., by user input. Do. Since these functions are functions that can be realized by a general-purpose PC or the like, description of the functional configuration is omitted here.

<Hardware configuration example>
The above-described client PC 10, authentication control server 30-1, and external authentication servers 30-2 to 30-3 are realized by, for example, a computer system having a hardware configuration shown in FIG. FIG. 3 is a hardware configuration diagram of the computer system.

  3 includes an input device 51, a display device 52, a RAM (Random Access Memory) 53, a ROM (Read Only Memory) 54, an HDD (Hard Disk Drive) 55, and a CPU (Central Processing). Unit) 56, a communication I / F 57, and an external I / F 58, which are connected to each other via a bus B.

  The input device 51 includes a keyboard, a mouse, a touch panel, and the like, and is used by a user to input each operation signal. The display device 52 is a display, a monitor, or the like, and displays various setting information, processing results, and the like by the computer system 2.

  The RAM 53 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 54 is a nonvolatile semiconductor memory (storage device) that can retain programs and data even when the power is turned off. The ROM 54 stores programs and data such as BIOS (Basic Input / Output System), OS (Operating System) settings, and network settings that are executed when the computer system 2 is started.

  The HDD 55 is a nonvolatile storage device that stores programs and data. The stored programs and data include, for example, an OS that is basic software for controlling the entire computer system 2 and application software that provides various functions on the OS.

  The HDD 55 manages stored programs and data by a predetermined file system and / or DB (database). The computer system 2 may be provided with an SSD (Solid State Drive) instead of the HDD 55.

  The CPU 56 is an arithmetic unit that realizes control and functions of the entire computer system 2 by reading a program and data from a storage device such as the ROM 54 and the HDD 55 onto the RAM 53 and executing processing.

  The communication I / F 57 is an interface that connects the computer system 2 to a network. Thereby, the computer system 2 performs data communication via the communication I / F 57.

  The external I / F 58 is an interface with an external device. The external device includes a recording medium 58A. Thereby, the computer system 2 can read and / or write the recording medium 58A via the external I / F 58.

  The recording medium 58A is, for example, a flexible disk, a CD (Compact Disk), a DVD (Digital Versatile Disk), an SD memory card (SD Memory card), a USB memory, or the like, but is not limited thereto.

  The client PC 10, the authentication control server 30-1, and the external authentication servers 30-2 to 30-3 can implement various processes described later by the hardware configuration of the computer system 2. In the present embodiment, by installing an execution program in the hardware configuration of the computer system 2 described above, the hardware resource and the software can cooperate to realize the processing in the present embodiment. .

<Data example>
Next, an example of various information used in the present embodiment will be described with reference to the drawings. FIG. 4 is a diagram illustrating an example of various information used in the present embodiment. FIG. 4A shows an example of a user information table. FIG. 4B shows an example of the card configuration definition. FIG. 4C shows an example of a card information table corresponding to FIG.

  The user information table shown in FIG. 4A is stored in the user information storage unit 35. The items in the user information table include, for example, “UserID”, “user name”, “password”, but are not limited thereto, and may include “card ID”, for example. “UserID” is a user ID for identifying a user. “User name” is information indicating the name of the user. “Password” is an authentication password set for each user ID.

  The card information table shown in FIG. 4C is stored in the card information storage means 36, and is set based on the card configuration definition shown in FIG. 4B. As the card configuration definition, for example, “card ID (identification code: CardID)”, “owned user ID (identification code: UserID)”, “use start date (identification code: StartDay)”, “use end date (identification code: (EndDay) "," security classification (identification code: Security) ", etc., but is not limited to this.

  “CardID” is a card ID for identifying a card. The “owning user ID” is information for identifying a user who owns (carries) the IC card corresponding to the card ID. This owned user ID corresponds to the user ID shown in FIG.

  “Use start date” is information indicating a date when the owner starts using the card corresponding to the card ID. The “use end date” is information indicating the last date that the owner can use the card corresponding to the card ID.

  The “security classification” is security information set for the card ID. As the security classification, for example, regular (security classification ID: 1), semi-regular (security classification ID: 2), and temporary (security classification ID: 3), but is not limited to this.

  As shown in FIG. 4C, the user and security information are associated with each IC card, and the “CardID” is “0001” to “0003” for the user whose “UserID” is “1001”. Card information is set. Also, security categories “1” to “3” of “Security” are set for each. As described above, even when a plurality of IC cards are associated with the user, security information is set for each IC card, so that authority management based on each security level can be performed.

  FIG. 5 is a diagram showing an example of security information in the present embodiment. FIG. 5A shows a definition example of the security category configuration. FIG. 5B shows an example of a security information table corresponding to the definition of the security classification configuration shown in FIG. The security information table shown in FIG. 5B is stored in the security information storage unit 37.

  The definition items of the security classification configuration include, for example, “security classification ID (identification code: ID)”, “registrable number (identification code: Max)”, “copy function authority (identification code: CopyAuth)”, “print (printer) ) Function authority (identification code: PrintAuth) ”,“ applicability 1 (identification code: Machine1) ”,“ applicability 2 (identification code: Machine2) ”,“ applicability 3 (identification code: Machine3) ”, etc. However, the present invention is not limited to this.

  “Security classification ID” is information for identifying a security classification. Examples of the security classification ID include “1: normal”, “2: quasi-normal”, and “3: temporary”, but are not limited thereto.

  The “registrable number” is a registerable number set for one security classification. For example, in the security classification, there are a regular card / semi-regular card / temporary card. In this case, when the security level of each category is “regular card (high level)> quasi-regular card (medium level)> temporary card (low level)”, a card with a high security level can be set Limit the number of

  For example, when the employee card is a regular card, the temporary employee card is a semi-regular card, and the guest temporary card is a temporary card, the number of regular cards having a high security level is set to one. Here, if the employee ID is lost, the lost employee ID can be changed by downgrading the security classification of the employee ID card, temporarily revoking it, or using a temporary card as a regular card instead. It becomes possible to prevent impersonation used.

  “Copy function authority” is authority information such as various conditions (for example, color mode / monochrome mode) at the time of copying. “Print function authority” is authority information such as various conditions during printing (for example, color mode / monochrome mode). As described above, by defining the range of usable functions for the security classification of the card, for example, it is possible to prevent spoofing with a temporary card or a guest card.

  In “device availability 1 to 3”, address information (for example, IP address) of each target device is set. Note that the number of devices set by the availability of devices may not be three. In this way, by setting the range of usable devices as the security classification for each card, it becomes possible to restrict the use of outsiders, for example.

  The security classification information table shown in FIG. 5 (B) is based on the definition information of the security classification configuration shown in FIG. 5 (A), for each security classification (for example, 1: normal, 2: semi-normal, 3: temporary). Available authority is set. By using this security information, it is possible to perform authentication relating to device use.

<Example sequence for card information registration>
Next, as a registration example of authentication information (for example, user information, card information, security information) with respect to the authentication control server 30-1, the card information registration process according to the present embodiment will be described using a sequence.

  FIG. 6 is a sequence showing an example of card information registration processing. Note that the sequence shown in FIG. 6 is executed by the IC card information I / F means 31, the card information processing means 32, and the authentication processing means 33 in the authentication control server 30-1.

  In the example of FIG. 6, the administrator who manages the authentication control server 30-1 or the like makes a card information registration request from the client PC 10 or the like to the IC card information I / F means 31 (S10). The card information registration request is a process of associating the card ID of the IC card with the corresponding user information (for example, user ID, user name, password, etc.), and setting of security information (usage authority information), etc. Including.

  The IC card information I / F means 31 outputs a card information registration request to the card information processing means 32 (S11). Upon receiving the card information registration request, the card information processing means 32 associates the card ID of the card information to be registered with the corresponding user information. A confirmation request for confirming whether a user ID exists is made (S12). Note that the authentication processing unit 33 may confirm the existence of the user with respect to the external authentication servers 30-2 to 30-3, for example.

  When the card information processing means 32 obtains the result of the user presence confirmation (S13), it stores the card information in the card information storage means 36 (S14). The card information processing means 32 outputs information indicating that the registration is completed by accumulation to the IC card information I / F means 31 (S15). The ID card information I / F means 31 notifies the administrator or the like of the completion of card information registration (S16).

  In the processing described above, a plurality of pieces of card information are registered in association with the user, and for example, security information can be set for each card.

<Example of registration processing corresponding to the number of security categories that can be registered>
FIG. 7 is a sequence showing an example of registration processing corresponding to the number of registerable security categories. In the example of FIG. 7, as compared with the above-described example of FIG. 6, a security information processing unit 34 is further added to the configuration of FIG.

  In the example of FIG. 7, the administrator who manages the authentication control server 30-1 or the like makes a card information registration request to the IC card information I / F means 31 from the client PC 10 or the like (S20). The IC card information I / F means 31 outputs a card information registration request to the card information processing means 32 (S21).

  When the card information processing means 32 receives the card information registration request, the card information processing means 32 confirms the existence of the user with the authentication processing means 33 in order to associate the registration request target card ID with the corresponding user information. A confirmation request is made (S22).

  When the card information processing unit 32 obtains the result of the user presence check (S23), the card information storage unit 36 refers to the card information storage unit 36 to check whether the user has already been registered in the same card as the registration request target card (the same card). It is determined whether there is a user associated with the card (S24).

  If the card information processing means 32 determines that no user is registered for the same card, the card information storage means 32 stores (registers) the card information in the card information storage means 36 (S25). On the other hand, when the card information processing means 32 determines that a user has already been registered for the same card, it makes an acquisition request for the number of security classification information that can be registered to the security information processing means 34 (S26). ).

  Here, the security information processing unit 34 refers to the security information storage unit 37 shown in FIG. 5B in response to the acquisition request in S26, and corresponds to the security classification set in the card information to be registered. Get the number that can be registered.

  When the card information processing means 32 obtains the registerable number corresponding to the security classification from the security information processing means 34 (S27), it confirms the registerable number and the number of card IDs currently set in the classification. Then, it is determined whether the maximum number of registrations has been reached (S28).

  If the card information processing means 32 determines that the upper limit of the number that can be registered has not been reached, the card information is updated, for example, by relinking to a new user and registered in the card information storage means 36 (S29). ).

  If the number of registrations has reached the upper limit, the above update process cannot be executed, and an error process is executed. For error handling, for example, notify the administrator, etc. that the security category specified in the card information subject to registration request has reached the upper limit, or use a category with a lower level than the specified security category. It is recommended to show the administrator whether the registration process can be performed.

  The card information processing means 32 outputs the registration result (including information indicating whether or not registration is possible) to the IC card information I / F means 31 (S30). The IC card information I / F means 31 notifies the administrator etc. of the registration result (S31).

  With the above-described processing, it is possible to perform registration processing in which the number of security classifications that can be registered is limited.

<Sequence for preventing duplicate registration of card information>
Here, a sequence for preventing duplicate registration of card information will be described. FIG. 8 is a sequence for preventing duplicate registration of card information. The sequence shown in FIG. 8 is executed by the IC card information I / F unit 31, the card information processing unit 32, and the authentication processing unit 33.

  In the example of FIG. 8, for example, when a temporary card or the like of a security category that limits the expiration date of the device 20 is associated with a user, the card is already associated and registered with an arbitrary user. Determine if If it has already been registered, the association between the registered user and the card is canceled to revoke the rights, so that the user cannot use the card, and the user is then associated with the new user. Make the card available.

  In the example of FIG. 8, the administrator who manages the authentication control server 30-1 or the like makes a card information registration request from the client PC 10 or the like to the IC card information I / F means 31 (S40). The IC card information I / F means 31 outputs a card information registration request to the card information processing means 32 (S41).

  When the card information processing means 32 receives the card information registration request, the card information processing means 32 confirms the existence of the user with the authentication processing means 33 in order to associate the card ID to be registered with the corresponding user information. A request is made (S42).

  When the card information processing unit 32 obtains the result of the user presence check (S43), the card information storage unit 36 refers to the card information storage unit 36 and determines whether the user is already registered in the same card as the registration request target card (S43). S44).

  If the card information processing unit 32 determines that no user is registered for the same card, the card information storage unit 32 stores (registers) the card information in the card information storage unit 36 (S45). On the other hand, if the card information processing means 32 determines that a user has already been registered for the same card, the card information processing means 32 re-links to a new user, updates the card information, and registers it in the card information storage means 36. (S46).

  As a result, it is possible to cancel the association between the already registered user and the card and revoke the right so that the user cannot use the card. Note that it is also possible to control not to execute an update process for registering a new user in the process of S46.

  The card information processing means 32 outputs the registration result to the IC card information I / F means 31 (S47). The IC card information I / F means 31 notifies the administrator etc. of the registration result (S48).

  Through the above-described processing, it is possible to prevent a shared card such as a temporary card whose usage time limit is limited from being registered and used.

<Sequence showing an example of card authentication processing>
Next, an example of card authentication using information registered by the registration process described above will be described. FIG. 9 is a sequence showing an example of the card authentication process. The sequence shown in FIG. 9 is executed by the device 20 and the authentication control server 30-1. Further, the authentication control server 30-1 shows an example using an IC card information I / F unit 31, an authentication processing unit 33, and a card information processing unit 32.

  In the example of FIG. 9, a user (user) who uses the device 20 performs card login to the device 20 (S50). In card login, an IC card owned (carried) by a user is read by an IC card reader reading unit 25 built in or externally attached to the device 20, and the device 20 is used based on authentication information associated with the IC card. Login operation.

  Upon receiving a card login from the user, the device 20 makes an authentication request to the IC card information I / F means 31 based on login information (for example, card information such as a card ID) (S51). The IC card information I / F unit 31 outputs the login information read from the IC card to the authentication processing unit 33 (S52).

  The authentication processing unit 33 requests the card information processing unit 32 to read out the card information corresponding to the login information with reference to the card information storage unit 36 (S53). The card information stored in the means 36 is acquired (S54). The authentication processing unit 33 includes login information and authentication information (user information stored in the user information storage unit 35, card information stored in the card information storage unit 36, security information stored in the security information storage unit 37, etc.). Based on the above, an authentication process is executed (S55).

  The authentication processing means 33 outputs the authentication result to the IC card information I / F means 31 (S56). The IC card information I / F means 31 outputs usage authority information for the device 20 to the device 20 based on the authentication result (S57). The device 20 permits the user who owns the IC card based on the usage authority information to use the device 20 (S58).

<Sequence showing a specific example of card authentication processing>
Next, an example of card authentication including external authentication will be described. FIG. 10 is a sequence showing an example of card authentication processing including external authentication. The sequence shown in FIG. 10 is executed by the device 20, the authentication control server 30-1, and the external authentication servers 30-2 and 30-3.

  In the example of FIG. 10, a user (user) who uses the device 20 performs card login to the device 20 (S60). Upon receiving a card login from the user, the device 20 makes an authentication request to the IC card information I / F unit 31 based on login information (for example, card information such as a card ID) (S61). The IC card information I / F unit 31 outputs the login information to the authentication processing unit 33 (S62).

  The authentication processing unit 33 requests the card information processing unit 32 to read out the card information corresponding to the login information with reference to the card information storage unit 36 (S63). The card information stored in the means 36 is acquired (S64). Further, when the authentication processing unit 33 acquires the user ID from the card information stored in the card information storage unit 36 based on the login information (card ID), for example, the external authentication servers 30-2 and 30- based on the user ID. 3 requests authentication (S65).

  When the authentication processing unit 33 acquires the authentication result from the external authentication servers 30-2 and 30-3 (S66), the card information acquired in the process of S64, the authentication result acquired in the process of S66, and the security information storage unit 37 The authentication process is executed based on the security information stored in (S67).

  The authentication processing means 33 outputs the authentication result to the IC card information I / F means 31 (S68). The IC card information I / F means 31 outputs usage authority information for the device 20 to the device 20 based on the authentication result (S69). The device 20 permits the user who owns the IC card to use the device 20 based on the usage authority information (S70).

  According to the above-described embodiment, for example, when a plurality of IC cards are associated with a user, authority management based on security information can be performed. Also, with this authority management, for example, if an employee ID is lost, the security level can be changed to temporarily revoke use, or a temporary card can be used as a regular card and impersonation using a lost ID It is possible to prevent and improve security.

  The present invention is not limited to the specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims.

1 Authentication System 2 Computer System 10 Client PC
20 Device 21 Input Accepting Unit 22 Output Unit 23 Setting Information Storage Unit 24 Authentication Service Utilizing Application 25 IC Card Reader Reading Unit 30 Card Authentication System 30-1 Authentication Control Server (An Example of Authentication Control Device)
30-2, 30-3 External authentication server 31 IC card information I / F means (an example of interface means)
32 Card information processing means 33 Authentication processing means 34 Security information processing means 35 User information storage means 36 Card information storage means 37 Security information storage means 41 Authentication I / F means 42 Processing request means 43 Authentication data management means 44 Authentication data storage means 51 Input device 52 Display device 53 RAM
54 ROM
55 HDD
56 CPU
57 Communication I / F
58 External I / F
58A Recording medium

JP 2008-134854 A

Claims (8)

Card information processing means for registering one or a plurality of card information for each user and security information corresponding to the card information;
Authentication processing means for determining whether authentication is possible by comparing card information transmitted from the device with card information registered by the card information processing means;
An authentication control apparatus comprising: an interface unit that outputs an authentication result obtained by the authentication processing unit to the device.   The authentication control apparatus according to claim 1, further comprising security information processing means for setting a registrable number corresponding to a security level set by the security information.   The authentication control apparatus according to claim 1 or 2, wherein the security information set for each card information includes information on functions and / or devices that can be used. The card information processing means
When a card with a limited use period of the card information is newly associated with a user, it is determined whether the card information is already associated with an arbitrary user. The authentication control apparatus according to claim 1, wherein the authentication control apparatus is configured not to do so. The card information processing means
It is determined whether the card information is already associated with an arbitrary user. If the card information is already associated, the association between the already associated user and the card is canceled, and a new response is made. The authentication control device according to claim 4, wherein the authentication control device is attached. An authentication system having one or more information processing devices,
Card information processing means for registering one or a plurality of card information for each user and security information corresponding to the card information;
Authentication processing means for judging whether authentication is possible by comparing card information transmitted from a device connected to the information processing apparatus via a communication network and card information registered by the card information processing means;
An authentication system comprising: an interface unit that outputs an authentication result obtained by the authentication processing unit to the device. An authentication method in an authentication system having one or more information processing devices,
A card information processing procedure for registering one or more pieces of card information and security information corresponding to the card information for each user;
An authentication processing procedure for determining whether authentication is possible by comparing card information transmitted from a device connected to the information processing apparatus via a communication network and card information registered by the card information processing procedure;
And an interface unit for outputting an authentication result obtained by the authentication processing procedure to the device. Computer
Card information processing means for registering one or a plurality of card information and security information corresponding to the card information for each user;
An authentication processing unit that determines whether authentication is possible by comparing card information transmitted from the device with card information registered by the card information processing unit, and outputs an authentication result obtained by the authentication processing unit to the device A program for functioning as an interface means.

Images