JP3402247B2 - Security integrated management device, security integrated management method, and recording medium recording security integrated management program - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security integrated management device for integrally managing an authentication mechanism of a plurality of software when each of the plurality of software has an authentication mechanism based on a unique user ID, password or the like.

[0002]

2. Description of the Related Art In a system that uses a plurality of software to execute desired processing, each software often has an authentication mechanism based on a unique user ID, password, or the like. When software is used in such a system, conventionally, a user has been authenticated for each software by inputting a user ID, password, etc. for each software.

[0003]

However, according to this conventional technique, the user has a user ID for each software,
Since the user has to enter the password, etc., the user must always be aware of what kind of user ID, password, etc. are set for each software, and the software cannot be used easily. There was a point.

The present invention has been made to solve the problems of the prior art as described above, and an object thereof is to provide an authentication mechanism based on a unique user ID, password, etc. of a plurality of software. An object of the present invention is to provide a security integrated management device, a security integrated management method, and a recording medium that records a security integrated management program that can use software without being aware of authentication in the plurality of software.

[0005]

The security system of the present invention.
The integrated management device
Required for identification information and authentication when using the system
Approval database associated with the first security information
First storage means for storing the information and identification information of each user
And the user can use each of the multiple software.
The second security information required for authentication when
Second memorizer that stores the dependent information database
The step, the user identification information, and the first security information
When input from the outside, this user's identification information and the first
Security information corresponds to the authorization database
Initial security to determine if they are seated
The judging unit and this initial security judging unit
And the first security information are associated with each other.
Multiple software, if it is determined that
Any one of these and multiple authentication procedures
If the shift is specified from the outside, the dependency information database
From the source to the second information associated with the identification information of the user.
Security information related to the specified software
Security requirement information input section
Second retrieved by the security request information input unit of
Security information and the authentication procedure of
The authentication procedure is based on integrated security management.
If there is, the finger is based on the second security information.
Authenticate the user in the specified software,
The authentication procedure is an application authentication procedure.
If the second security information is specified,
Application for authenticating the user in software
Equipped with a security information passing unit that outputs the
It is characterized by that.

The security integrated management method according to the present invention is not limited to
For each of the
First security required for authentication when using the system
Pre-store an approval database that is associated with
The first step, the identification information of each user, and the user
Required for authentication when using each of multiple software
Dependency information associated with the necessary second security information
The second step of pre-storing the information database, and
The identification information of the user and the first security information are entered from the outside.
The user's identification information and the first security
Information in the approval database
The third step of determining whether or not
User's identification information and the first security
When it is determined that the information is associated with
One or more of the software
One of the authentication procedures specified is externally specified.
And the identification information of the user from the dependency information database.
Of the second security information associated with the information
The fourth step to retrieve related software
Step and the second set taken out in this fourth step
Receive the security information and the authentication procedure, and perform the authentication
The procedure is an authentication procedure by integrated security management
In this case, based on the second security information, the specified
The authenticated software, the user is authenticated and
If the certification procedure is an application certification procedure,
If the second security information is
Application for authenticating the user in software
And a fifth step of outputting the
It

The recording medium of the present invention is used by a plurality of users.
For each, its identification information and when using the system
Corresponds to the first security information required for authentication
The first process of pre-storing the digit approval database and each
The user's identification information and the user's identification of multiple software
The second security required for authentication when using each
A dependency information database that is associated with
The second process to be stored, the user identification information, and the first security
Security information and externally input, this user's
The identification information and the first security information are the approval data.
Determine if they are matched in the base
The third process and the identification information of the user in the third process
Determined to be associated with the first security information
If one of the multiple software
Either this or one of several authentication procedures is external
From the dependency information database,
Second security associated with user identification information
Collect information related to the specified software.
The fourth process to be ejected and the fourth process extracted in this fourth process
Received the security information of 2 and the authentication procedure,
The authentication procedure is an authentication procedure by integrated security management.
If it is, then based on the second security information,
Authenticates the user in the specified software
Yes, the authentication procedure is an application authentication procedure.
If the second security information is specified,
Application for authenticating the user in the created software
Application to the computer.
The feature is that the program to be executed is recorded.

The recording medium group of the present invention is a recording medium of the present invention.
Dividing the program into a plurality of parts
Is recorded on a plurality of recording media, respectively.
To do.

[0009]

[0010]

[0011]

[0012]

BEST MODE FOR CARRYING OUT THE INVENTION Next, a first embodiment of the present invention will be described in detail with reference to the drawings.

Referring to FIG. 1, in the first embodiment of the present invention, an input device 1 such as a keyboard, a storage device 2 for storing various information, and a security for performing user authentication of software operating in this system. It includes an output device 3 such as a mechanism (hereinafter referred to as “security device”) and a data processing device 4 which operates under program control. In addition,
FIG. 1 shows a configuration in which these devices are provided in a terminal device used by a user.

The input device 1 includes a user information input device 11 such as a keyboard, and an application program (hereinafter, simply referred to as "application") 1 for requesting security judgment for software that the user wants to use.
2 and.

The user information input device 11 receives information from the user.
Information (user ID etc.) for specifying the user,
Information (password, etc.) for confirming whether the user has not forged is received, and these pieces of information are input to the data processing device 4.

The application 12 designates one of the security management devices 32, 33, and 34 as an authentication destination and specifies how to perform authentication as an authentication means.

The storage device 2 includes an approval database 21 and
A dependency information database 22 is stored.

The approval database 21 holds information such as user ID and password. It is desirable to encrypt this information in order to prevent it from being accessed without going through the proper procedure.

The dependent information database 22 holds correspondence information between the user ID stored in the approval database 21 and information required for authentication in the security management devices 32, 33 and 34 (hereinafter referred to as "security information"). is doing. This information is also required to be encrypted in order to prevent it from being accessed without going through the proper procedure. In the following, the correspondence information between the user ID and the security information for each security device will be referred to as "dependency information".

The output device 3 includes an application 31 and
The security management devices 32, 33, and 34 are provided.

The application 31 has information that the authentication in the security management devices 32, 33, 34 has succeeded or failed, or the security management devices 32, 3
Receive the information needed to perform authentication at 3, 34. The information necessary for performing the authentication is a user ID, a password, etc., and the application 3 is based on the information.
1 can also directly authenticate to the security management devices 32, 33, 34.

The security management devices 32, 33, 34 are all security management devices included in software.

The data processing device 4 is provided with an initial security judging unit 41, a security request judging unit 42, and a security information passing unit 43.

The initial security judgment unit 41 receives the user ID, password and the like from the user information input device 11 and compares it with the information in the approval database 21 to confirm whether the information is correct.

The security request judgment unit 42 retrieves the security information requested by the application 12 for the user authenticated by the initial security judgment unit 41 from the dependency information database 22.

The security information passing unit 43 performs two operations according to the instruction from the security request judging unit 42. The first is the security management device 3 based on the security information retrieved by the security request judgment unit 42.
This is an operation for authenticating to 2, 33, and 34. The result of this authentication is transmitted to the application 31. The other is an operation of transmitting the security information extracted by the security request determination unit 42 to the application 31.

Next, the operation of the present embodiment will be described in detail with reference to FIGS.

As shown in FIG. 2, the initial security judgment unit 41 receives the user ID,
Receive user information such as password (Step A
1), this information is the approval database 2 of the storage device 2.
Check whether it is stored in 1 (step A
2). The initial security judgment unit 41 judges whether or not the input user information is registered in the authentication database 21 (step A3), and if not registered, terminates the processing. If it is registered, the security request determination unit 42 is notified that the authentication is successful.

The application 12 provides information about the authentication destination (security management device 32, security management device 32, as security request information (information for permitting disclosure of information by user ID, password, etc., information requesting security).
The security request determination unit 42 is informed of which of 33 and 34 is to be the authentication destination) and the authentication means (how to perform the authentication in the security management devices 32, 33, and 34) (step A4). As the authentication means, it is possible to select either an authentication procedure by integrated security management or an application. The former is
Authentication is performed by the device of the present invention, and the application 31 functions as a procedure for receiving the authentication result. In the latter case, the application 31 receives the security request information necessary for the authentication by the device of the present invention, and the application 31 receives the security management devices 32, 33,
34 functions as a procedure for directly authenticating. Which one is designated as the authentication means is determined in step A6 described later.

The security request judgment unit 42 searches the security information related to the user authenticated in step A3 for the authentication destination instructed by the application 12 from the dependency information database 22 (step A5).

The security information transfer unit 43 receives the security information obtained by the security judgment unit 42 and judges the authentication means (step A6). When it is determined that the authentication means is the authentication procedure based on the integrated management, the security information transfer unit 43 determines that one or a plurality of security management devices 32, 33, based on the security information.
Authentication is performed at 34 (step A7). The result of the authentication is transmitted to the application 31 (step A8). If it is determined in step A6 that the authentication means is an application authentication procedure, the security information is transmitted to the application 31 (step A9).

Next, this embodiment will be described using a specific example.

As shown in FIG. 3, the approval database 21
Has user ID "USR1" and password "ABCD"
EFG "is defined. Now, it is assumed that the same user ID and password are given from the user information input device 11 (step A1). The initial security judgment unit 41 gives the user ID given from the user information input device 11, It is confirmed that the correspondence of the password exists in the approval database 21 (step A2), it is judged that the input user is a registered user (step A3), and the user ID "USR1" is transmitted to the security request judgment part 42.

As shown in FIG. 3, the dependency information database 22 has a user ID "USR1" and an authentication destination "D".
The correspondence between B ", the authentication user ID" DBUSR1 ", and the authentication destination password" DBABC "is defined.
The security management device included in the authentication destination “DB” is assumed to be the security management device 32. That is, the security management device 32 is an authentication mechanism of the DB software, and permits the connection with the user ID "DBUSR1" and the password "DBABC". Application 12
When the user wants to use the DB software and omits the authentication of the security management device 32, the security request determination unit 42 is provided with the authentication destination "DB" and the authentication means "Authentication procedure by integrated security management" as the security request information (step A4). Security request determination unit 42
Is the user ID “USR1” given in step A1
And the dependent information database 22 is searched based on the authentication destination "DB" given in step A4, and the authentication destination "DB" and the authentication destination user ID "DBUSR are used as security information.
1 "and the authentication destination password" DBABC "are received and given to the security information delivery unit 43 together with the authentication means" authentication procedure by integrated security management "(step A5).

The security information delivery unit 43 determines that the authentication means provided by the application 12 is "authentication procedure by integrated security management" (step A6). Then, the authentication destination “D” given in step A4
Since B ”is the security management device 32, the user ID“ DBUSR1 ”and password“ DB ”for the device.
When authentication is attempted using "ABC" and the result "success" is received (step A7), the result "success" is output to the application 31 (step A8).

In this example, the case where the application 12 wants to omit the authentication of the security management device 32 has been described. Next, an example of the case where the application 31 authenticates the security management device 34 will be described with reference to FIG. To do.

As shown in FIG. 4, in the dependency information database 22, the user ID "USR1", the authentication destination "print",
Authentication user ID "PRUSR1", authentication destination password "
The correspondence of “PRXX1” is defined. Here, the security management device of the authentication destination “print” is assumed to be the security management device 34. That is, the security management device 34 is the authentication mechanism of the printing software, and is the user. I
D "PRUSR1" and password "PRXX1" permit connection. Up to step A3, it is the same as the above example using FIG.
If the user wants to use print software and wants the application 31 to authenticate the security management device 34, the authentication destination "print" as security request information,
The authentication means "authentication procedure by application" is given to the security request judgment unit 42 (step A4). The security request determination unit 42 searches the dependency information database 22 based on the user ID “USR1” given in step A1 and the authentication destination “print” given in step A4, and the authentication destination “print” as security information. , Authentication user ID "PRUSR1", authentication password "PR"
XX1 ", and the security information passing unit 4 together with the authentication means" authentication procedure by application "
3 (step A5).

The security information delivery unit 43 determines that the authentication means given by the application 12 is "authentication procedure by application" (step A).
6). Then, for the application 31, the authentication destination "print" and the authentication destination user ID "are used as security information.
The PRUSR1 "and the authentication destination password" PRXX1 "are output (step A9) As a result, the application 31 directly authenticates with the security management device 34.

With the above, the operation of the present embodiment is completed.

In the above embodiment, the case where all of the input device 1, the storage device 2, the output device 3, and the data processing device 4 are provided in the terminal device used by the user has been described. In the configuration, when it is necessary to use another terminal device due to a failure of the terminal device, the other terminal device cannot refer to the approval database 21 and the dependency information database 22 in the storage device 2.
There is a problem that processing by desired software cannot be performed. Therefore, only the storage device 2 is provided in the host computer, and a plurality of terminal devices are connected to the computer so that the approval database 21 and the dependency information database 22 in the storage device 2 can be referred to from the plurality of terminal devices. May be.

Next, a second embodiment of the present invention will be described.

Referring to FIG. 5, in the second embodiment of the present invention, an input device 5 such as a keyboard, a storage device 6 for storing information, and an output device such as a security device for software operating in this system. 7, a data processing device 8 operated by program control, and a recording medium 9 recording a program (hereinafter, referred to as “security integrated management program”) that causes the device to execute a process related to integrated security management. Here, the recording medium 9 is
It may be a magnetic disk, a semiconductor memory or other recording medium, and the integrated security management program may be divided and recorded in a recording medium group composed of a plurality of recording media.

The security integrated management program recorded on the recording medium 9 is loaded into a computer including the input device 5, the output device 6 and the data processing device 8, and the input device 5, the output device 6 and the data processing device 8 are Under the control of the loaded program, the same operations as those of the input device 1, the output device 2, and the data processing device 4 in the first embodiment are performed.

In the first and second embodiments, the case where three security management devices are used has been described, but the number of security management devices is not limited to this, and how many security management devices are used. The present invention can be applied to a system using a management device.

In the first and second embodiments, the case where the application 12 and the application 31 operate on different devices has been described, but they may operate on the same device.

The first and second embodiments of the present invention are the user I required for authentication when using this system.
The system includes an authorization database that stores information such as D and passwords, and a dependency information database that stores information such as user IDs and passwords that are required for authentication when using each software. In this case, when each of the plurality of software has an authentication mechanism based on a unique user ID, password, etc., the software can be used without being aware of the authentication in the plurality of software. It has the effect of being able to.

[0047]

According to the present invention, when each of a plurality of software has an authentication mechanism based on a unique user ID, password, etc., the software can be used without being aware of the authentication in the plurality of software. The effect is that you can do it.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of a first exemplary embodiment of the present invention.

FIG. 2 is a flowchart showing the operation of the first exemplary embodiment of the present invention.

FIG. 3 is a diagram for specifically explaining the operation of the first embodiment of the present invention.

FIG. 4 is a diagram for specifically explaining the operation of the first embodiment of the present invention.

FIG. 5 is a block diagram showing a configuration of a second exemplary embodiment of the present invention.

[Explanation of symbols]

1,5 input device 11,51 User information input device 12,52 applications 2,6 storage device 21,61 Approval database 22,62 Dependency information database 3,7 Output device 31,71 applications 32,72 Security management device 33,73 Security management device 34,74 Security management device 4,8 data processor 41,81 Initial security judgment section 42,82 Security request judgment unit 43,83 Security information transfer unit 9 recording media

Continuation of the front page (56) Reference JP-A-11-25051 (JP, A) JP-A-7-134696 (JP, A) JP-A-2000-259566 (JP, A) JP-A-11-175335 (JP, A) A) JP 10-228451 (JP, A) JP 9-134329 (JP, A) JP 7-239767 (JP, A) (58) Fields investigated (Int.Cl. ⁷ , DB name) ) G06F 1/00 G06F 15/00

Claims (4)

(57) [Claims] 1. A first storage means for storing an approval database in which identification information of each of a plurality of users and first security information required for authentication when using the system are stored. Second storage means for storing a dependency information database in which identification information of each user is associated with second security information required for authentication when the user uses each of the plurality of software; When the identification information and the first security information are input from the outside, an initial security determination unit that determines whether the identification information of the user and the first security information are associated with each other in the approval database, The initial security determination unit determines that the identification information of the user and the first security information are associated with each other. In this case, when any one of the plurality of software and any one of the plurality of authentication procedures is designated from the outside, from the dependency information database,
Of the second security information associated with the identification information of the user, a security request information input unit for taking out information related to the designated software, and second security information taken out by the security request information input unit , Received the authentication procedure,
The authentication procedure is an authentication procedure by integrated security management.
If it is, then based on the second security information,
Authenticates the user in the specified software
Yes, the authentication procedure is an application authentication procedure.
If the second security information is specified,
Application for authenticating the user in the created software
An integrated security management device, comprising: a security information transfer unit for outputting to an application . 2. A first step of pre-storing an approval database in which identification information of each of a plurality of users and first security information necessary for authentication when using the system are associated with each other. A second step of pre-storing a dependency information database in which identification information of each user is associated with second security information required for authentication when the user uses each of a plurality of software; When the identification information and the first security information are input from the outside, a third step of determining whether or not the identification information of the user and the first security information are associated with each other in the approval database, When it is determined in the third step that the identification information of the user and the first security information are associated with each other, Any and of the plurality of software
When any one of the plurality of authentication procedures is designated from the outside, the second security information related to the designated software is retrieved from the dependency information database, from the second security information. Four
And the second security extracted in this fourth step
The information and the authentication procedure are received, and the authentication procedure is
If the authentication procedure is based on integrated security management,
The specified software based on the second security information
Authenticates the user in the software, and the authentication procedure
If the application authentication procedure,
The second security information to the specified software
Output to the application that authenticates the user in
Security integrated management method characterized by comprising a fifth step that. 3. A first process of pre-storing an approval database in which identification information of each of a plurality of users and first security information necessary for authentication when using the system are associated with each other. A second process of pre-storing a dependency information database in which identification information of each user and second security information required for authentication when the user uses each of a plurality of software are stored in advance; When the identification information and the first security information are input from the outside, a third process of determining whether the identification information of the user and the first security information are associated with each other in the approval database, When it is determined in the third processing that the identification information of the user and the first security information are associated with each other, a plurality of software Any and more of the A
When any one of certain authentication procedures is designated from the outside, a fourth security information related to the designated software out of the second security information associated with the identification information of the user is retrieved from the dependency information database. Processing and the second security information retrieved by this fourth processing
And the authentication procedure, and the authentication procedure is
If the authentication procedure is based on the integrated management of
Based on the security information of
Authenticate the user in
If the authentication procedure is an application, the second
Keep the security information of the specified software in the specified software.
A recording medium having recorded thereon a program for causing a computer to execute a fifth process of outputting to a user authentication application . 4. made to record the divided and portions of the plurality of the program into a plurality of parts according to claim 3 to a plurality of recording media recording medium group.