JP4303988B2 - User authentication method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a user authentication of a Web application system that completes one process by exchanging data a plurality of times on the Internet.
[0002]
[Prior art]
Due to the rapid spread of the Internet, a web browser represented by online shopping or the like that completes one business by exchanging multiple times with a web server using a web browser (hereinafter referred to as a browser) installed in a client machine. Many applications are being used.
[0003]
In addition, for business applications in the enterprise, Web applications can be used instead of client / server systems because of the advantages that special application software does not need to be installed on the client machine and that there is no need for version management. More and more are being done.
[0004]
In these Web applications, it is common to log in to the system with a user ID and password, etc., and authenticate that the user is a valid user of the Web application before using the function.
[0005]
The HTTP (HyperText Tranfer Protocol) used in these Web applications is a protocol that simply returns a response to a request and does not maintain a state, and a session cannot be maintained only by the function of the HTTP protocol.
[0006]
Therefore, at the time of initial user authentication, a character string uniquely determined for each user is generated on the Web server side, and processing is performed while the character string is passed between the Web server and the browser, so that the user can be identified on the Web server. A method for determining and maintaining a series of sessions is known.
[0007]
As a method for delivering the above-described character string, there is a method for storing the character string in a mechanism called Cookie which is proposed by Netscape Corporation and which is a de facto standard (see, for example, Patent Document 1).
[0008]
Moreover, it is also a method of adding the above-mentioned character string to a part (Query String) of an argument of URL (Uniform Resource Locator) (for example, refer to Patent Document 2).
[0009]
[Patent Document 1]
Japanese Patent No. 3003997 [Patent Document 2]
JP 2000-508153 A [0010]
However, security defects have occurred in Web servers and browsers due to factors such as the sophistication and increase in complexity of recent software products, and there has been a high risk of Cookie leaking to third parties.
[0011]
Also, since the URL argument is recorded in the access log of the Web server, the Web server may be altered by a malicious third party, and the character string added to the argument may be stolen and read by another server. It is happening.
[0012]
[Problems to be solved by the invention]
The present invention has been made to solve such a problem, and even when information used for user authentication and session maintenance leaks, it is possible to prevent a third party from impersonating a legitimate user and performing unauthorized access. The purpose is to do.
[0013]
[Means for Solving the Problems]
According to a first aspect of the present invention, in a method for authenticating a user during a session in a Web application system in which a Web client and a Web server communicate to realize a series of tasks, the Web client starts the session from the Web server. The notified first session information and the second session information stored in the web page received from the web server are transmitted to the web server, and the web server receives the received first session information and the The verification information is generated from the second session information by the reverse generation procedure of the first session information and the second session information and is compared with the session maintenance information recorded in advance to authenticate the user of the session. It is determined whether or not to do.
[0014]
According to a second aspect of the present invention, in the user authentication method according to the first aspect described above, the Web server allows the Web server to uniquely identify the session by the initial communication request of the session from the Web client. Is generated and recorded.
[0015]
According to a third aspect of the present invention, in the user authentication method according to the first or second aspect described above, the Web server encrypts the session maintenance information and divides the session maintenance information into two, and the first session information and the Second session information is generated.
[0016]
According to a fourth aspect of the present invention, in the user authentication method according to the first to third aspects described above, the first session information is stored in Cookie data held by the Web client, and the Web client is started when the session starts. The second session information is added as an argument of the URL of the link destination described in the Web page requested by the Web client, and is transmitted to the Web client each time a Web page is requested. It is a thing.
[0017]
According to a fifth aspect of the present invention, in the user authentication method according to the first to fourth aspects described above, the first session information has a valid period, and the Web client is the first in the valid period only. Session information is transmitted to the Web server.
[0018]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, the present invention will be described based on the illustrated embodiments. FIG. 1 is a configuration diagram of a Web application system according to an embodiment of the present invention.
[0019]
The Web application system is a system in which the Web client 1 and the Web server 2 perform a series of tasks by repeating communication using HTTP.
[0020]
In the Web client 1, the browser 3 is operating, the data that needs continuity is held in the Cookie 4, and the URL of the link destination and the URL argument 5 are provided in the received Web page.
[0021]
The Web server 2 includes HTTP request processing 6, session information processing 7, response processing 8, user authentication processing 9, encryption / decryption processing 10, user information 11, session maintenance information 12, and the like.
[0022]
FIG. 2 is a schematic diagram showing the exchange of data between the browser 3 of the Web client 1, the request processing 6, the session information processing 7, and the response processing 8 of the Web server 2, that is, the state of the session.
[0023]
In the first login screen shown in FIG. 3, for example, the user ID “user01” and the password “passwordX” are input from the browser 3 and a login request is issued.
[0024]
The session information processing 7 compares the input user ID and password with the user information 11 recorded in advance by the user authentication processing 9 to authenticate the user.
[0025]
If the user is authenticated and confirmed to be a legitimate user, the session information processing 7 can use the session maintenance information used for subsequent session management with “user01” (a session between specific users can be uniquely specified). An arbitrary character string) is generated, encrypted by the encryption / decryption processing 10, and recorded in the session maintenance information 12 together with the user ID and the like.
[0026]
The session information processing 7 divides the generated session maintenance information into two parts at an arbitrary part, and generates first session information and second session information. An example of session maintenance information, first session information, and second session information is shown in FIG.
[0027]
The request process 6 stores the first session information in the Cookie 4 and transmits the second session information in the “user01” dedicated web page when transmitting the web page dedicated to the user “user01” after login. It is added to the URL argument 5 of the previous URL and transmitted to the browser 3 via the response process 8. An example of a URL with an argument added is shown in FIG.
[0028]
When the user indicates the link destination displayed on the “user01” dedicated Web page and issues a request for content, for example, the browser 3 transmits Cookie 4 and URL argument 5.
[0029]
The session information processing 7 combines the received Cookie 4 with the URL argument 5, decrypts it with the encryption / decryption processing 10, and confirms that it is a session with the user “user01” by comparing with the session maintenance information 12. The response process 8 transmits the next “user01” dedicated Web page to recover the session.
[0030]
Therefore, even when a dedicated Web page is dynamically generated and transmitted in response to a user request, the stored Cookie 4 is paired with the URL argument 5 added to the link destination URL in the Web page. By transmitting, the Web server 2 can reconfigure the session maintenance information.
[0031]
【The invention's effect】
As described above, according to the user authentication method of the Web application system according to the present invention, the Web server divides the session maintenance information for identifying each user into a plurality of parts, and the session is not recovered unless all of them are prepared. The risk of impersonation at the time of leakage can be suppressed.
[0032]
The first session information is held by the user by Cookie, and the second session information to be paired is embedded in the dedicated Web page of the user and transmitted each time, so even if one of them leaks Because the session cannot be recovered, the user in the session can be authenticated with robustness.
[Brief description of the drawings]
FIG. 1 is a configuration diagram of a Web application system of the present invention.
FIG. 2 is a schematic diagram showing the operation of the session of the present invention.
FIG. 3 is an input example of a login request according to the present invention.
FIG. 4 is an example of session maintenance information generated by the present invention.
FIG. 5 is an example of a URL to which an argument of the present invention is added.
[Explanation of symbols]
1 Web client 2 Web server 3 Browser 4 Cookie
5 URL argument 6 Request processing 7 Session information processing 8 Response processing 9 User authentication processing 10 Encryption / decryption processing 11 User information 12 Session maintenance information

Claims (5)

A method for authenticating a user during a session in a web application system in which a web client and a web server communicate to realize a series of tasks,
The web client
Sending the first session information notified from the web server at the start of the session and the second session information stored in the web page received from the web server to the web server;
The web server is
Based on the received first session information and second session information, verification information is generated by a reverse generation procedure of the first session information and the second session information, and the session is recorded in advance. By comparing with the information, decide whether to authenticate the user of the session,
The user authentication method characterized by the above-mentioned. The user authentication method according to claim 1,
The web server is
Session maintenance information that can uniquely identify the session is generated and recorded by the first communication request of the session from the Web client.
The user authentication method characterized by the above-mentioned. The user authentication method according to claim 1 or 2,
The web server is
The session maintenance information is encrypted and divided into two to generate the first session information and the second session information.
The user authentication method characterized by the above-mentioned. The user authentication method according to any one of claims 1 to 3,
The first session information is
Stored in Cookie data held by the Web client, and transmitted to the Web client at the start of the session,
The second session information is
It is added as an argument of the URL of the link destination described in the web page requested by the web client, and transmitted to the web client each time a web page is requested.
The user authentication method characterized by the above-mentioned. The user authentication method according to any one of claims 1 to 4,
The first session information has a validity period;
The web client transmits first session information to the web server only within the valid period.
The user authentication method characterized by the above-mentioned.

Images