JP3594075B2 - User authentication method and device - Google Patents

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a user authentication method and apparatus in a computer system requiring user authentication.
[0002]
[Prior art]
With the spread of computer systems, an unspecified number of people have come to use computer systems as needed. Therefore, in order to identify a user, generally, programs and network systems for performing user authentication by inputting user authentication information including a user name and password prior to use are increasing. Along with this, opportunities to use a plurality of programs and network systems that require input of such user names and passwords in one computer system are increasing. However, the user name and password input to each program and network system are often different, and the burden of managing the user name and password for the computer system user is increasing. Therefore, there is a need for a technique for reducing the burden of managing the user name and password of the computer system user while ensuring a certain level of security.
[0003]
Conventionally, in a computer system that uses a plurality of programs and network systems that require input of a user name and password, in order to reduce the burden on the user name and password management of the computer system user, the program to be used and the user name and password of the network system are used. Register the password in the user name / password management system, and enter the correct user name / password for the management system user into the user name / password management system prior to using the program or network system. After the user has been authenticated, the management system either substitutes the user name and password for input, or unifies or shares the program and network system user name and password. Which was.
[0004]
[Problems to be solved by the invention]
However, in the above-mentioned prior art, when the user name and password are unified, when the user name and password of one program or the network system are leaked, a third party is used by using the leaked user name and password. Makes all programs and network systems available.
In addition, when the user name / password management system is used, even if the user name / password of the user name / password management system is leaked, all registered programs and the network system become available. In each case, there was a problem that the security level was greatly reduced.
An object of the present invention is to provide a user authentication method that can reduce the burden of inputting and managing user authentication information while maintaining a high security level.
[0005]
[Means for Solving the Problems]
In order to achieve the above object, a user authentication method according to the present invention provides, in a user authentication operation for an access target, another computer resource having a dependency relationship with the access target and the user authentication and a proxy input / output condition for user authentication information. A step of searching a defined table to detect a status of another computer resource having a dependency on an object to be accessed by the user authentication operation and user authentication, and a status of the detected other computer resource being defined in the table. Checking whether or not the user has a dependency satisfying the proxy input availability condition , and, if so, inputting the user authentication information for the access target by proxy instead of the user.
[0006]
Further, the user authentication apparatus of the present invention searches for a table that defines other computer resources having a dependency on the user authentication and the proxy input permission / prohibition condition of the user authentication information in response to the user authentication operation on the access target . Means for detecting the status of another computer resource having a dependency on the user to be accessed by the user authentication operation and the user authentication, and the detected status of the other computer resource satisfies the proxy input availability condition defined in the table Means for checking whether or not the user has a dependency and , if the condition is satisfied, inputting the user authentication information for the access target on behalf of the user instead of the user.
[0007]
Here, the access target includes all resources that require user authentication in the computer system, such as programs, networks, computers, and databases.
Further, the computer resources include resources that require user authentication and resources that do not require user authentication.
[0008]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a configuration diagram showing an embodiment of a computer system having a user name / password management system to which the present invention is applied. FIG. 1 shows only a user name / password management system 11 which is a main part of the present invention, and parts related thereto, and other parts are not shown.
[0009]
The user name / password management system 11 (hereinafter, abbreviated as a management system) of the present embodiment includes a program and a network system group 13 (a group of access targets, a program, a network, It includes all resources that require user authentication in the computer system, such as a computer and a database. The set program and network system group 12 (computer resource group, including resources of all computer systems such as programs, networks, computers, databases, etc. There are resources that require user authentication and resources that are not required. Dependency programs and abbreviations) A user authentication dependency table 14 for storing the correspondence with the line input target program group 13 and the dependency on the user authentication, a user name / password management table 15 for each proxy input target program, and the other computer resource group 12 described above. Is constituted by a dependency program start condition management table 16 which stores the start conditions.
[0010]
In such a computer system, the management system 11 which has received from the computer system user an activation request for an arbitrary proxy input target program group 13 defined in the user authentication dependency relationship table 14 corresponds to the proxy input target program group 13. The dependency program group 12 and the dependencies to be extracted are extracted from the user authentication dependency table 14. If the status of the extracted dependency program group 12 satisfies the extracted dependency, the management system 11 replaces the user name / password corresponding to the proxy input target program group 13 for which the start request has been made with the user name / password. The start-up request is completed by inputting the obtained user name / password from the password management table 15 into the proxy input target program group 13 that has requested the start-up, on behalf of the user.
If the status of the extracted dependency program group 12 does not satisfy the dependency, proxy input is not performed.
[0011]
That is, the user name / password substitute input target program group 13 is composed of the programs 13a to 13n. For example, the program 13a in this program is dependent on the programs 12a and 12b in the dependency program group 12 in the user authentication. Is registered in the user authentication dependency relationship table 14 as “programs 12a and 12b have been started”, upon receiving a start request for the proxy input target program 13a, it is checked whether the programs 12a and 12b have been started. If the program has been started, the user authentication information (user name, password) of the proxy input target program 13a is input on behalf of the user.
[0012]
On the other hand, when the dependency program group 12 is activated, if the dependency program group 12 is a program that requires input of a user name / password, the management system 11 sends the user name / password input by the computer system user. And passes the input user name and password to the dependency program group 12 only when the start condition of the dependency program start condition table 16 is satisfied. If the condition is not satisfied, the activation of the dependency program group 12 is prevented by delivering an invalid password.
[0013]
In the management system 11, the user name and password for the management system 11 are used when the user name and password of the proxy input target program group 13 are registered in the user name / password management table 15, and when the proxy input target program group 13 and the It is used only by the system administrator when registering user authentication dependencies between the dependency program groups 12, and is not directly used by computer system users.
[0014]
FIG. 2 is a configuration diagram of the user authentication dependency relationship table 14 of FIG. A table 21 having entries for each of the proxy input target program groups 13 in FIG. 1 is created, and a table 22 defining the dependency program group 12 shown in FIG. 1 is created. FIG. 2 shows a state where two tables 22-1 and 22-2 are created.
Each of these tables 22-1 and 22-2 has an identifier input area 201 for a dependency program and a condition input area 202 for dependency in performing proxy input. These areas 201 and 202 are created in the tables 22-1 and 22-2 by the same number as the number of dependency programs.
When a plurality of dependency programs each requiring authentication are specified in the table 22 for the table 21 of one proxy input target program group 13, all of the specified dependency programs end the user authentication process normally. Whether the proxy input is performed when the user authentication process is performed or the proxy input is performed when any of the user authentication processes is normally completed is defined in the dependency input condition area 202 of the table 22 as the user authentication dependency. Is done. In this case, as a definition method, for example, an AND condition that both of the dependency programs 12a and 12b have been started, an OR condition that one of them has been started, or a start sequence of 12a is first and 12b is There is a specification method such as an order condition such as next. These conditions are registered in the (**) portion of the area 202.
[0015]
FIG. 3 is a flowchart showing a process when a start request for the proxy input target program group 13 is received from a computer system user.
First, when an activation request is received (step 31), the management system 11 refers to the tables 21 and 22 in the user authentication dependency table 14 and the activation is a precondition for processing a user name / password substitute input. The identifier of the dependency program group 12 is extracted (step 32). Then, the status of the dependency program group 12 is checked from the extracted identifier (step 33).
Next, it is evaluated whether or not the status of the dependency program group 12 satisfies the dependency condition defined in the dependency condition input area of the table 22 (steps 34 and 35). As a result of the evaluation, when the activation condition of the proxy input target program group 13 is satisfied, the user name / password of the proxy input target program group 13 is obtained from the user name / password management table 15 (step 36). The user name / password is input to the name / password substitute input target program group 13 and the program is started (step 37). However, if the evaluation result does not satisfy the activation condition of the proxy input target program group 13, the activation request to the proxy input target program group 13 is rejected (step 38).
[0016]
FIG. 4 is a configuration diagram of the dependency relationship program activation condition management table 16 of FIG. A table 41 having an entry for each dependency program group 12 in FIG. 1 is created, and a table 42 (42-1 to 42-n) defining the start condition of the dependency program group 12 is created for each entry in the table 41. I do. The activation condition table 42 has a set of an identifier area 401 indicating the type of the activation condition and a parameter area 402 required for the activation condition as one entry. When there is a request to start a certain dependency program group 12 and authentication is required to start the dependency program group 12, the management system is activated only when all the conditions defined in the table 42 are satisfied. The user name and password for the dependency program group 12 intercepted by 11 are transferred to the dependency program group 12. If the condition is not satisfied, an invalid password is delivered to the dependency program group 12.
[0017]
FIG. 5 is a flowchart showing a process when a user name / password for the dependency relationship program group 12 is input from a computer system user.
When the user name / password for the dependency program group 12 is input (step 51), the management system 11 intercepts the input user name / password and sets the tables 41 and 42 in the dependency program start condition table 16. (Step 52), a process for determining whether the activation condition defined in the table 42 has been achieved or not has been performed (step 53).
As a result of the evaluation processing (step 54), if the condition is not satisfied, the password is replaced with an invalid password, and the user name and password are handed over to the dependency program group 12 (steps 55 and 56). If the condition is satisfied, the intercepted password is delivered as it is (step 56).
[0018]
FIG. 6 is a flowchart showing details of the dependency relationship program activation condition evaluation processing (step 53) of FIG.
In the activation condition evaluation processing, first, an area for notifying the evaluation result to the evaluation result determination processing (step 54) in FIG. 5 is initialized with the value at the time when the condition is achieved (step 61). Next, the activation condition in the table 42 of FIG. 4 is read (step 62), and if there is no unevaluated activation condition, the evaluation process ends (step 63). However, if there is an unevaluated activation condition, the activation condition type is determined based on the activation condition identifier in the table 42, and the activation condition determination routine that matches the activation condition is called to make a determination (steps 64 and 65).
The activation condition determination routine compares, for example, in the case of the activation condition 1, the data stored in a predetermined storage area such as the clipboard of the computer in use with the activation condition parameters of the table 42. And so on. If the data do not match as a result of the comparison, a value indicating unachieved is stored in the area for notification to the above-described evaluation result determination processing (step 54), and the evaluation processing ends (step 66). If the data match, the activation condition reading process is performed again (steps 65 and 62).
In the case of the start condition 2, the value of the start condition parameter of the table 42 is set in the loop counter (step 67). Then, the computer user is requested to re-enter the user name / password by the number of times corresponding to the counter value (steps 69, 71, 72). If all the inputs are not the same, the process proceeds to the evaluation result determination processing (step 54). The evaluation processing is terminated after the value indicating the non-achievement is stored in the notification area (steps 68 and 70).
If all inputs are the same in a plurality of times, the activation condition reading process is performed again (steps 72 and 62).
[0019]
As described above, in the present embodiment, the dependency on the user authentication between the program and the network system is registered together with the program and the user name and the password of the network system for which the user name and the password are to be substituted. In the case where a start request to the program and the network system to be subjected to the proxy input is input, if the program and the network system for which the dependency on user authentication has been registered already match the conditions of the dependency, Based on the registered user authentication dependencies, the process to enter the user name and password on behalf of the program and the network system to be used subsequently will be executed. Before doing so, Once you have started a program that, again user name, password do not have to enter, it is possible to reduce the burden on the user.
[0020]
In addition, since the condition for performing the proxy input can be set only by the system administrator, the risk of leaking the condition is reduced. Therefore, it is possible to reduce the burden on the user name and password management of the computer system user while suppressing the security level from being lowered.
[0021]
Further, even when the program and the network system to be subjected to the user name / password substitution input are designed to perform user authentication using a short password with a low security level, or when the user does not have a user authentication procedure, the management system is used. In this case, it is possible to obtain a security level equivalent to that of a program and a network system in which a dependency on user authentication is registered.
[0022]
In the above embodiment, a program group composed of a plurality of programs is exemplified as the proxy input target program and the dependency program. However, the present invention is not limited to this. This can be applied in the same case.
[0023]
【The invention's effect】
As described above, according to the present invention, a program in which the administrator of the user name / password management system has set a dependency on user authentication and a new network only when the status of the network system already satisfies the dependency. It is possible to omit the input of the user authentication information of the access target to be activated at the first time. This makes it unnecessary to authenticate the user for all newly activated access targets without lowering the security level, thereby reducing the burden on the user.
The security level can also be improved depending on how the dependency is combined with the access target.
[Brief description of the drawings]
FIG. 1 is a configuration diagram showing an embodiment of a computer system incorporating a user authentication device of the present invention.
FIG. 2 is a configuration diagram of a user authentication dependency relationship table.
FIG. 3 is a flowchart of a user name / password substitute input process;
FIG. 4 is a configuration diagram of a dependency relationship program activation condition management table.
FIG. 5 is a flowchart showing a process at the time of starting a dependency relationship program.
FIG. 6 is a flowchart illustrating details of a dependency program activation condition evaluation process.
[Explanation of symbols]
11: User name / password management system, 12: Dependency program group, 13: User name / password proxy input target program group, 14: User authentication dependency table, 15: User name / password management table, 16: Dependency program Start condition table.

Claims (2)

A user authentication method in a computer system that uses an access target requiring user authentication,
In response to the user authentication operation for the access target , a search is made for a table that defines another computer resource having a dependency on the access target and the user authentication and a proxy input availability condition of the user authentication information. Detecting the status of another computer resource having a dependency on user authentication; and determining whether the detected status of the other computer resource has a dependency that satisfies the proxy input availability condition defined in the table . And if the user satisfies the condition, the user authentication information for the access target is input on behalf of the user on behalf of the user. A user authentication device in a computer system that uses an access target requiring user authentication,
In response to the user authentication operation for the access target , a search is made for a table that defines another computer resource having a dependency on the access target and the user authentication and a proxy input availability condition of the user authentication information. Means for detecting the status of another computer resource having a dependency on user authentication, and determining whether the detected status of the other computer resource has a dependency satisfying the proxy input availability condition defined in the table And a means for inputting the user authentication information for the access target on behalf of the user if the user authentication information is satisfied.

Images