JP2016212650A - Method for controlling startup in thin client system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable safe startup in a thin client system even when it is unusable due to the loss of an authentication card or for other reasons.SOLUTION: In a thin client system, the biological information of a user is registered in a client 11 first after authentication with an authentication card 61. The next time the client 11 starts up, the allowability of startup by authentication using biological information is determined. Also, if a resource for the client 11 is already active when the client 11 starts up upon authentication using biological information, unauthorized use by an other client is assumed, and the stoppage of the already active resource or the disconnection of the other client connected to the already active resource is executed, with a startup request from the client 11 newly authenticated using biological information accepted.SELECTED DRAWING: Figure 3

Description

  The present invention relates to a technique for controlling connection and activation of a so-called thin client system. In particular, the present invention relates to an activation control technique using another authentication method when a normal authentication method such as an authentication card is not used.

  Currently, for the purpose of ensuring security and the like, companies have introduced a thin client system. The thin client system performs authentication using a device such as an authentication card. When authenticated, the thin client system can execute processing in the corresponding resource (server). In such a thin client system, since resources existing on the server can be used, unauthorized access is possible as long as access to the server is permitted (normally a PC or the like physically secures a PC). If it is, unauthorized use is not possible.) For this reason, Patent Document 1 has been proposed as a technique for preventing unauthorized use.

In Patent Document 1, the address information of the server that is the access destination of the thin client is encrypted with the biometric information of the user and held. In addition, it is described that when biometric information of a thin client user is input to the authentication device, address information is decrypted using the biometric information and output to the thin client.

JP 2009-205479 A

  If there is a problem with normal authentication in the thin client system, for example, if ID or PW is leaked or authentication using an authentication card is assumed, or if it is stolen or lost, the There arises a problem that the client system cannot be used.

In order to solve the above-described problems, in the present invention, the thin client system can be activated by authentication using a method different from normal authentication.
For example, biometric information is registered after authenticating with an authentication card which is a normal authentication method, and at the next activation, whether or not activation is possible is determined by authentication using the biometric information.

  Furthermore, the following aspects are also included in the present invention. If the resource is already activated at the time of activation request authenticated by biometric authentication, the activated resource is stopped or the connection with the activated client is stopped, and the activation request at the newly performing biometric authentication client Accept. In addition, when biometric information is registered, the activation request for authentication of the authentication device or the like may be rejected.

  As described above, according to the present invention, it is possible to provide a thin client system that can be activated while ensuring safety even if a problem occurs in normal authentication.

The flowchart at the time of registering the biometric information in one Embodiment of this invention. The flowchart at the time of starting by the authentication using the biometric information in one Embodiment of this invention. 1 is a system configuration diagram according to an embodiment of the present invention. Data file diagram used in one embodiment of the present invention (profile management table 31, activation management table 42)

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings. First, FIG. 3 is a block diagram showing the configuration of the client 11, the management apparatus 41, and the processing server 51 in the present embodiment. The client 11 and the processing server 51 constitute a so-called thin client system.

  The authentication card 61 and the finger device 21 are connected to the client 11 via USB. Further, the client 11 manages finger profile data in the profile management table 31.

  The client 11, the management device 41, and the processing server 51 are connected via a network and can exchange information with each other.

  In the activation management table 42, the management device 41 manages whether finger profile data has been registered for each LDAP ID for identifying an individual and whether the SPC 41 is being activated.

  Further, the processing server 51 holds a resource (substance data in the HDD) for each LDAP ID in the resource 52.

  Next, the processing at the time of registering the finger profile data of the system will be described using the flowchart of FIG.

  First, the key mobile (authentication card) 61 and the finger device 21 are connected to the client 11. The client 11 receives a finger registration request from the user in S101 which is an initial state.

  Next, in step S <b> 102, the key mobile (authentication card) 61 reads profile information held by the user in accordance with the request in step S <b> 101 and transmits the profile information to the finger device 21. This profile information includes a user ID (LDAP ID) for identifying the user, the IP address of the client 11, wired / wireless indicating the connection method of the client 11, and VPN. Here, the finger data (encryption) shown in FIG. 4 is not included.

  Next, the finger device 21 reads the finger data of the finger profile registrant in S103. In step S104, finger profile data including the profile data received in step S102 and the finger data acquired in step S103 is transmitted to the client 11.

  In S105, the client 11 encrypts the finger data among the finger profile data received in S104. In S106, the finger profile information and the finger profile data encrypted in S105 are registered in the finger profile management table 31. This content is shown in FIG.

  Next, in step S107, the client 11 notifies the management apparatus 41 that the finger profile information has been registered.

  In S108, the management device 41 registers the user ID of the finger profile registrant and the finger registered information in the information activation management table 42. Here, since the finger data is registered in the activation management table 42, “◯” is described, and the processing in the processing server by the thin client 11 is not started, and therefore x is registered during activation. .

  Next, the process at the time of starting by the authentication using the finger data of the system will be described using the flowchart of FIG.

  First, the client 11 displays a screen for prompting authentication with the finger device 21 after activation in S201 (pressing the power button by the user).

  The finger device 21 reads the finger data of the user of the client 11 in S202, and transmits the read finger data to the client 11 in S203.

  The client 11 receives the finger data transmitted in S203 in S204, and performs verification / authentication based on the LDAP ID and the finger data in the profile management table 31 in S205. If the verification / authentication is successful, the process proceeds to S207. If the verification / authentication is unsuccessful, an error screen is displayed in S206 to complete the process. Here, the collation / authentication is executed as follows. First, the LDAP ID input from the user is compared with the LDAP stored in the profile management table, and the finger data received in S204 is compared with the decrypted finger data stored in the profile management table 31. If they match, it is determined that the authentication is OK.

  The client 11 reads the profile data verified and authenticated in S205 from the profile management table 31 in S207, and transmits a request for starting its own resource to the processing server 51 according to the profile in S208. The processing server 51 receives S208 and waits for activation in S209. Further, the client 11 notifies the management apparatus 41 of the profile in S210.

  The management device 41 receives a notification including the profile of S210 in S211. Here, in S212, the management apparatus 41 searches the activation management table 42 using the LDAP ID as a key to determine whether or not the same profile is being activated. If it has been activated, the activated client is disconnected in S213, and the process proceeds to S214. If not activated, the process proceeds to S214. Here, in S213, is the activation management table 42 being activated? Is rewritten with “×” to indicate that it is not running.

  The fact that it is being activated here is highly likely that a third party is illegally using the authentication card 61, and this use can be prevented by the disconnection process.

  Here, is the activation management table 42 being activated? May be performed as follows. In addition to the notification in S210, the configuration may be such that the activation status of each resource is periodically checked and the contents are described. The management device 41 transmits activation permission to the processing server 51 in S214. In S216, “starting” is registered in the start management table 42.

Furthermore, in addition to transmission of activation permission, information indicating that activation was in progress may be transmitted to the client 11 or the like. In this case, the administrator (terminal) of the system may be notified, or a subsequent activation request by the authentication card 61 may be rejected. In this case, a “black list” is recorded in the management apparatus, and the request from the corresponding authentication card 61 is rejected = connection is rejected. When the finger profile information shown in the flowchart of FIG. 2 is registered, in the subsequent authentication request, only an activation request for authentication using a finger may be accepted. For this purpose, a configuration is adopted in which information indicating whether or not to accept the activation request in the authentication device 61 is recorded in the activation management table 42. In this case, this information is also registered in S108.
In this embodiment, authentication using a finger has been described as an example. However, other biological information such as fingerprint and glow may be used, and authentication is normally performed using ID and PW, and a card is used instead of a finger. Authentication using a device such as

DESCRIPTION OF SYMBOLS 11, 12 ... Client 21 ... Finger device 31 ... Profile management table 41 ... Management apparatus 51 ... Processing server 61 ... Authentication card

Claims (3)

In a startup control method in a thin client system comprising a client, a processing server that executes processing in accordance with the instruction of the client, and a management device that manages these,
The management device determines whether or not to use resources in the processing server determined in advance according to an authentication result using an authentication card connected to the client,
The processing server is an activation control method for executing processing corresponding to a processing request from the client when the availability is available,
When the management device receives an activation request including biometric information from the client and the management device stores biometric information, the management device authenticates by comparing the received biometric information with the stored biometric information, If the result of the authentication is affirmative, send information permitting use of the resource corresponding to the processing server,
An activation control method in a thin client system, wherein the processing server starts using the resource to the client. The activation control method in the thin client system according to claim 1,
The management device
Remember the activation status of the resource,
When an activation request including biometric information is received from the client, the activation status is confirmed, and as a result of the confirmation, if activated, the activated resource is stopped or the client connected to the activated resource Perform one of the disconnects with
An activation control method in a thin client system, wherein the processing server starts using the resource to the client. In the starting control method in the client system according to claim 1,
When the management device receives an activation request by authentication with the authentication card, the management device determines whether the biometric information is stored, and if not, permits the activation, using the resource, An activation control method in a thin client system, which starts with respect to the client.

Images