JP5402301B2 - Authentication program, authentication system, and authentication method - Google Patents

Description

  The present invention relates to an authentication system, and more particularly to an authentication system for authenticating a client certificate.

  2. Description of the Related Art Conventionally, various technologies have been proposed in which an authentication server apparatus authenticates a device using authentication information such as an electronic certificate installed on a client device in a network.

  In the conventional technology, when authentication information possessed by a certain client is issued by an authentication server device of a certain network, authentication by the authentication server device of another network cannot be performed depending on the authentication information. was there.

  In such a case, as a technique for enabling the client to be authenticated by the authentication server device of the other network, for example, as described in Patent Document 1, cooperation between authentication server devices is performed. An authentication system has been proposed.

  In the technique described in Patent Document 1, when a client in which a certificate issued by a home server device is installed requests a network connection to another authentication server device, the other authentication server device Based on the information of the home server device obtained by causing the client to designate, etc., the home server device is redirected. In response to this, the home server device requests authentication information such as an ID and a password from the client, and if the authentication is successful by the authentication information input in response to the request, issues an authentication ticket with a time limit. The authentication ticket is transmitted to both the authentication server device and the other authentication server device. With the authentication ticket, the client can be authenticated by the other authentication server device.

Japanese Patent Laid-Open No. 2007-110377

  In the technique described in Patent Literature 1, when a client user tries to access an authentication server device different from the home server device, a certificate is issued to the user again with respect to the other authentication server device. It is possible to enable communication with the other authentication server device without requiring a procedure for requesting.

  However, in the technique described in Patent Document 1, when the authentication server devices cannot be connected, the authentication ticket is not issued, and the client cannot be authenticated by the other authentication server device. . Further, since an expiration date is set for the issued authentication ticket, another authentication server device is required to redirect from the client to the home server device every time the expiration date expires. Therefore, this increases the load on the other authentication server device.

  The present invention has been conceived in view of the actual situation, and the object thereof is an authentication system including a plurality of authentication server devices, even if the authentication server devices cannot be connected to each other. A client device having authentication information associated with a certificate created by the authentication server device can be authenticated by another authentication server device, and the load on the authentication server device can be suppressed.

An authentication program according to an aspect of the present invention is an authentication executed for authentication of a client device in an authentication system including a first authentication server device, a second authentication server device, and a management server device. A first authentication server device that executes a step of transmitting a certificate issuance request to a first authentication server device in response to a certificate issuance request from a client device. , depending on the certificate request from the management server device, and creating a certificate for a client device, the management server apparatus, to execute a step of transmitting a certificate of the client apparatus, the management server device , that will be sending and creating a related information in the certificate received from the first authentication server device, the client device, the certificate and related information Tsu is executed and flop, the second authentication server, by verifying the certificate of the client apparatus transmitted from the client device; attempting to authenticate the client device, in case of failure in authentication of the client device , to execute the steps of transmitting the information received from the client device to the management server apparatus, the management server apparatus, information received from the second authentication server device whether the related information generated by the own device and determining, with respect to the second authentication server, when information received from the second authentication server determines that the related information created by the own device permits the authentication of the client device Permission information, which is information for authentication, is transmitted, and it is determined that the information received from the second authentication server device is not related information created by itself If the, the authentication further execute a step of transmitting a prohibition information is information that does not allow the client device, the second authentication server, for the client device, receiving the permission information from the management server device And transmitting information indicating that the authentication of the client device has been successful, and transmitting information indicating that the authentication of the client device has failed in response to receiving the non-permission information from the management server device. Let it run further.
An authentication program according to another aspect of the present invention is executed for authentication of a client device in an authentication system including a first authentication server device, a second authentication server device, and a management server device. An authentication program comprising: creating a certificate for a client device in response to a certificate issuance request from a client device in a first authentication server device; and A step of requesting the creation, and causing the management server device to create the relevant information of the certificate in response to the request from the first authentication server device and the relevant information to the first authentication server device. And transmitting the certificate and related information to the client device, and causing the first authentication server device to execute a step of transmitting the certificate and related information. And verifying the certificate of the client device transmitted from the client device, and when the authentication of the client device fails, the information received from the client device is transmitted to the management server device. The management server device determines whether the information received from the second authentication server device is related information created by the own device, and the second authentication server device When it is determined that the information received from the second authentication server device is related information created by the own device, permission information that is information for permitting authentication of the client device is transmitted, and the second information If it is determined that the information received from the authentication server device is not related information created by the device itself, authentication of the client device is permitted. And transmitting the non-permission information, which is information that is not permitted, to the second authentication server device for authenticating the client device in response to receiving the permission information from the management server device to the client device. In response to receiving information indicating success and receiving non-permission information from the management server device, a step of transmitting information indicating failure of authentication of the client device is further executed.

In the authentication program of the present invention, in the step of transmitting the certificate and the related information to the client device, the related information is embedded in the certificate and transmitted .

In addition, the authentication program of the present invention creates a new certificate for the client device in response to receiving the permission information from the management server device to the second authentication server device, and transmits it to the client device. The step to perform is performed further.

In addition, the authentication program of the present invention allows the management server device to provide information to the second authentication server device when the information received from the second authentication server device is related information created by the own device. In the step of transmitting new related information and transmitting a new certificate to the client device, a new certificate in which the new related information is embedded is transmitted to the client device .

  The authentication program according to the present invention further causes the management server device to further execute a step of transmitting information instructing the client device to stop using the certificate to the first authentication server device.

  The authentication program of the present invention causes the management server device to create related information by creating a signature of the management server device.

  The authentication program of the present invention includes a step of receiving a plurality of pieces of information together with a certificate when the second authentication server apparatus requests the client apparatus to verify the certificate of the client apparatus, and the management server apparatus. Transmitting the plurality of information received from the client device to the step of causing the management server device to transmit the permission information, wherein at least one of the plurality of information received from the second authentication server device is If it is determined that the relevant information is created by the own device, permission information is transmitted to the second authentication server device.

  The authentication program according to the present invention further causes the management server device to execute a step of storing the created related information, and whether the information received from the second authentication server device matches the stored related information. Based on the above, it is determined whether the information received from the second authentication server device is related information created by the own device.

  The authentication program of the present invention causes the management server device to store related information in association with the certificate and the domain information of the first authentication server that created the certificate.

An authentication system according to an aspect of the present invention is an authentication system for authenticating a client device, comprising a first authentication server device, a second authentication server device, and a management server device, wherein The server device includes a first transmission unit that transmits a certificate issuance request to the first authentication server device in response to a certificate issuance request from the client device. The first authentication server device is a management server. A first creation unit that creates a certificate of the client device in response to a certificate issuance request from the device, and a second transmission unit that sends the certificate of the client device to the management server device, The server device includes a second creation unit that creates related information of the certificate received from the first authentication server device, and a related information storage unit that stores the related information in association with the certificate of the client. of The communication unit transmits a certificate and related information to the client device, and the second authentication server device verifies the certificate of the client device transmitted from the client device, thereby attempting to authenticate the client device. And a third transmission unit that transmits information received from the client device to the management server device when the authentication unit fails to authenticate the client device. The management server device receives the information from the second authentication server device. The information received from the second authentication server device is stored in the related information storage unit with respect to the comparison unit that compares the obtained information with the related information stored in the related information storage unit and the second authentication server device. If it matches the related information, the permission information, which is information for permitting the authentication of the client device, is transmitted and received from the second authentication server device. A fourth transmission unit that transmits non-permission information that is information for not permitting authentication of the client device when the information does not match the related information stored in the related information storage unit; In response to receiving the permission information from the management server device to the client device, the second authentication server device transmits information indicating that the client device has been successfully authenticated. A fifth transmission unit that transmits information indicating that authentication of the client device has failed in response to reception.

An authentication system according to another aspect of the present invention is an authentication system for authenticating a client device, comprising a first authentication server device, a second authentication server device, and a management server device, In response to a certificate issuance request from the client device, the first authentication server device requests the management server device to create certificate-related information from the first creating unit that creates the certificate of the client device. A first transmission unit that transmits information to be transmitted, and the management server device, in response to a request from the first authentication server device, a second creation unit that creates related information of the certificate, and the related information A related information storage unit that stores the certificate in association with the certificate of the client; and a second transmission unit that transmits the related information to the first authentication server device. The first transmission unit stores the certificate in the client device. And send related information Then, the second authentication server device verifies the certificate of the client device transmitted from the client device, and from the client device when the authentication of the client device fails and the authentication of the client device fails. A third transmission unit that transmits the received information to the management server device, and the management server device compares the information received from the second authentication server device with the related information stored in the related information storage unit. When the information received from the second authentication server device matches the related information stored in the related information storage unit, the authentication of the client device is permitted to the comparison unit and the second authentication server device. The permission information, which is information for sending, is transmitted, and the information received from the second authentication server device does not match the related information stored in the related information storage unit A fourth transmission unit that transmits non-permission information, which is information for not permitting authentication of the client device, and the second authentication server device transmits the client device from the management server device. In response to receiving the permission information, information indicating that the authentication of the client device is successful is transmitted, and in response to receiving the non-permission information from the management server device, information indicating that the authentication of the client device has failed is transmitted. It further includes a fifth transmission unit for transmission.

An authentication method according to a certain station of the present invention is an authentication method for a client device in an authentication system including a first authentication server device, a second authentication server device, and a management server device. The authentication server device according to claim 1 executes all the steps that the authentication program according to claim 1 causes the first authentication server device to execute, and the second authentication server device performs authentication according to claim 1. The program executes all the steps that the second authentication server device executes, and the management server device executes all the steps that the authentication program according to claim 1 causes the management server device to execute .

An authentication method according to another aspect of the present invention is an authentication method for a client device in an authentication system including a first authentication server device, a second authentication server device, and a management server device. The authentication server device according to claim 2 executes all the steps that the authentication program according to claim 2 causes the first authentication server device to execute, and the second authentication server device performs authentication according to claim 2. The program executes all the steps that the second authentication server device executes, and the management server device executes all the steps that the authentication program according to claim 2 causes the management server device to execute .

  According to the present invention, when a client having a certificate issued by the first authentication server requests authentication from the second authentication server, authentication by the second authentication server once fails. In addition, in accordance with the certificate issued by the first authentication server, related information stored in the management server and associated with the client certificate is transmitted to the client. If the client authentication fails in the second authentication server, the second authentication server transmits the related information received together with the certificate from the client to the management server. The management server determines whether the related information received from the second authentication server is the one created by itself, and if so, authenticates the client to the second authentication server. Send information that permits. Otherwise, information that does not permit client authentication is transmitted to the second authentication server.

  That is, the management server outputs information that permits client authentication to the second authentication server on the condition that the related information created by itself is received from the second authentication server. As a result, for the client user who has only the certificate of the first authentication server, the second authentication server does not require an operation for transmitting information for issuing a certificate to the second authentication server. Can be authenticated by an authentication server. Further, even if the first authentication server and the second authentication server cannot communicate directly, the authentication by the second authentication server can be received.

It is a figure which shows typically the structure of 1st Embodiment of the authentication system of this invention. It is a figure which shows typically the structure of the network contained in the domain of FIG. It is a figure which shows typically the hardware constitutions of PC which comprises the client of FIG. It is a figure which shows typically the hardware constitutions of the computer which comprises the management server of FIG. It is a figure which shows typically the hardware constitutions of the computer which comprises the authentication server of FIG. It is a figure which shows typically the functional block of the client of FIG. It is a figure which shows typically the functional block of the management server of FIG. It is a figure which shows typically the functional block of the authentication server of FIG. It is a figure which shows typically the content of the license key management table memorize | stored in the management server of FIG. It is a figure which shows typically the structure of the certificate which was issued by the authentication server and embedded the license key. It is a figure for demonstrating the communication content in the authentication system of FIG. It is a figure which shows typically the structure of 2nd Embodiment of the authentication system of this invention. It is a figure which shows typically the structure of 3rd Embodiment of the authentication system of this invention.

  Hereinafter, an embodiment of an authentication system according to the present invention will be described with reference to the drawings. In the drawings, the same components are denoted by the same reference numerals, and detailed description of common features will not be repeated.

[First Embodiment]
FIG. 1 is a diagram schematically illustrating the configuration of the first embodiment of the authentication system.

  In the authentication system of the present embodiment, a plurality of domains (domain 701 (described as “Area.JP” in FIG. 1) and second domain 801 (described as “Area.EU” in FIG. 1)) are included. Is defined. Then, authentication server devices (authentication server devices 700 and 800) provided in each domain can issue certificates to client devices belonging to each domain.

In FIG. 1, the client device 200 belongs to the domain 701.
The client device 200 can be authenticated by the authentication server device 700 using the certificate issued by the authentication server device 700. Note that the client device 200 basically cannot receive authentication depending on the authentication server device 800.

  In the present embodiment, when the client apparatus 200 transmits a certificate issuance request to the management server apparatus 600, the management server apparatus 600 transmits the certificate issuance request to the authentication server apparatus 700 and responds to the request. Accordingly, a license key is created and embedded in the certificate transmitted from the authentication server device 700, and the certificate after the license key is embedded is transmitted to the client device 200.

  In this embodiment, there is provided a management server device 600 that can communicate with the authentication server devices 700 and 800 provided in each domain and functions as a license management organization (LMA).

  In the present embodiment, together with the certificate created by the authentication server device 700, related information created by the management server device 600 (for example, license data described later) is transmitted to the client device 200.

  The management server device 600 stores a certificate issued by the authentication server device 700, information specifying a domain that can be authenticated by the certificate, and the related information described above in association with each other.

  In the present embodiment, when authentication of the certificate of the client device 200 is requested to the authentication server device 800, the certificate and the related information received together with the certificate from the client device 200 to the authentication server device 800. Is sent.

  When the authentication server device 800 fails to authenticate the certificate, the authentication server device 800 transmits related information to the management server device 600.

  The management server device 600 determines whether or not the received related information is included in the stored related information. If the management server device 600 determines that the received related information is included, the management server device 600 returns information permitting authentication to the authentication server device 800.

  In response to this, the authentication server device 800 transmits information of successful authentication to the client device 200 that has requested authentication.

  Hereinafter, the configuration of the authentication system according to the present embodiment and the contents of processing executed in the authentication system will be described more specifically.

(Request for certificate issuance)
First, the client 200 existing in the domain 701 transmits a certificate issuance request to the authentication server 700. This issuance request includes a code that identifies the domain that uses the certificate (hereinafter referred to as “Region information”) and information that is generally sent as a certificate issuance request (signature request: Certificate Signing Request). included.

  In response to the issue request, the authentication server 600 transmits information requesting the client 200 to issue a certificate to the authentication server corresponding to the Region information included in the issue request.

  In response to the certificate issuance request from the management server 600, the first authentication server 700 signs the information transmitted by the client 200, creates the certificate 10A, and transmits the certificate 10A to the management server 600.

  In response to the issuance request from the client 200, the management server 600 transmits a certificate issuance request to the authentication server corresponding to the Region information included in the issuance request, and the license corresponding to the certificate issued thereby. Create a key. The license key is obtained by, for example, performing a specific calculation process (for example, a hash calculation) on a part of the data of the certificate 10A transmitted from the first authentication server 700 in response to the certificate issuance request. Created. Note that the management server 600 does not extract a part of the certificate 10A but performs a numerical operation (for example, a hash operation) on specific information such as a secret code sent from the client 200 to obtain a license key. Can also be created. The management server 600 can also create a license key using a code stored in the management server 600 in advance.

  Further, the management server apparatus 600 may create a license key by applying a signature of the management server apparatus 600 to the certificate.

  Then, the management server 600 embeds the license key created by the management server 600 in the certificate 10A created and sent by the authentication server 700, and sends it to the client 200 as the certificate 10.

  The certificate created by the authentication server 700 can be authenticated by the authentication server 700, but the authentication server 800 cannot be authenticated.

  In this embodiment, authentication can be performed using a certificate issued by an authentication server 700 whose domain is managed by the same management server 600 as the authentication server 800.

(Network configuration)
FIG. 2 is a diagram schematically illustrating the configuration of a network included in the domain 701 and the domain 801.

  The network includes a plurality of personal computers (PCs) constituting the client device 200. In FIG. 2, each PC2 is indicated by PC (1) to PC (n). Each PC 2 is connected to a hub 4 through a network cable 3. Each PC 2 is configured to be connectable to a terminal, an authentication server device (such as the authentication server device 700), and a management server device 600 connected to another network (not shown) via the hub 4 and the router 5.

(Hardware configuration of client device)
FIG. 3 is a diagram schematically illustrating a hardware configuration of the PC 2 that configures the client device 200.

  Referring to FIG. 3, PC 2 stores a CPU (Central Processing Unit) 250 that controls the overall operation of PC 2, a RAM (Random Access Memory) 254 that functions as a work area for CPU 250, programs, data, and the like. ROM (Read Only Memory) 256, input device 260 such as a keyboard for inputting information to PC 2, communication device 262 for communicating with other PC 2, authentication server device, management server device, monitor 2A, program, A hard disk device (HDD) 264 having a hard disk for storing files, and a recording medium 252A such as a CD-ROM (Compact Disk Read Only Memory) detachably attached to the PC 2 and a media drive 252 for accessing. That is, the PC 2 accepts input of information input via the input device 260, can be connected to other terminals and networks via the communication device 262, and receives information to be processed in the PC 2 on the monitor 2A. Can be displayed.

  The PC 2 executes a certificate issuance request and a certificate authentication request by calculating and processing data by reading and executing the program stored in the hard disk or the recording medium 252A. , Function as a client device.

(Hardware configuration of the management server)
FIG. 4 is a diagram schematically illustrating a hardware configuration of a computer that configures the management server apparatus 600.

  Referring to FIG. 4, management server apparatus 600 includes a CPU 650 that generally controls the operation of management server apparatus 600, a RAM 654 that functions as a work area for CPU 650, a ROM 656 that stores programs and data, and management server apparatus 600. An input device 660 such as a keyboard for inputting information to the computer, a communication device 662 for communicating with other terminals such as the client device 200 and the authentication server devices 700 and 800, and a hard disk comprising a hard disk for storing programs and files. A device (HDD) 664 and a recording medium 652A such as a CD-ROM that can be attached to and detached from the main body of the management server device 600 and a media drive 652 for accessing the storage device 652 are provided. In other words, the management server device 600 can accept input of information input via the input device 660 and can be connected to other terminals and networks via the communication device 662.

  Then, the management server device 600 performs various types of information processing described in the present embodiment by calculating and processing data by reading and executing the program stored in the hard disk or the recording medium 652A. , Function as a management server.

(Hardware configuration of authentication server device)
FIG. 5 is a diagram schematically illustrating a hardware configuration of a computer constituting the authentication server device 700.

  Referring to FIG. 5, authentication server apparatus 700 includes a CPU 750 that controls the operation of authentication server apparatus 700 as a whole, RAM 754 that functions as a work area for CPU 750, ROM 756 that stores programs and data, and authentication server apparatus 700. An input device 760 such as a keyboard for inputting information to the device, a communication device 762 for communicating with other terminals such as the client device 200 and the authentication server devices 700 and 800, and a hard disk comprising a hard disk for storing programs and files. A device (HDD) 764 and a recording medium 752A such as a CD-ROM that can be attached to and detached from the main body of the authentication server device 700 and a media drive 752 for accessing the recording medium 752 are provided. That is, the authentication server device 700 can accept input of information input via the input device 760 and can be connected to other terminals and networks via the communication device 762.

  Authentication server apparatus 700 performs various types of information processing described in the present embodiment by calculating and processing data by reading and executing the program stored in the hard disk or recording medium 752A. , Function as an authentication server.

(Functional configuration of client device)
FIG. 6 schematically shows functional blocks of the client device 200.

  Referring to FIG. 6, data transmitted to client device 200 via hub 4 (see FIG. 2) is received by data receiving unit 202.

  The data receiving unit 202 determines whether or not the received data (packet) is data destined for the own device. If the data receiving unit 202 determines that the data is addressed to the own device, the data receiving unit 202 sends the data to the data analyzing unit 203.

  The data analysis unit 203 extracts data from the received packet, and if the processing instruction is included in the extracted data, the data analysis unit 203 causes the authentication unit 204 or the other processing unit 207 to process the data.

  The authentication unit 204 is an authentication server device (a server device that works in the same manner as a certificate authority (CA)) or other client device when logging into the network 6 (network included in each domain) or periodically. Information for requesting authentication or connection permission is transmitted to (PC2). Here, the information for requesting authentication or connection permission from other client devices is hereinafter referred to as “authentication / connection request”.

  In addition, when an authentication / connection request is transmitted from another client device, the authentication unit 204 extracts information (such as a certificate) used for authentication from the authentication / connection request and verifies the authentication information. To do. Then, the authentication unit 204 transmits the extracted information (certificate) to the authentication server device to which the client device 200 belongs, and requests authentication of the certificate.

  The authentication unit 204 requests the data creation unit 411 to create a message when it is necessary to send a message to another terminal, such as sending an authentication result to another client device.

  When it is necessary to execute processing other than the processing executed by the authentication unit 204 on the data received by the data receiving unit 202, the other processing unit 207 executes the processing.

  The data transmission unit 212 transmits the data created by the data creation unit 211. The data transmission unit 212 converts the data created by the data creation unit 211 into a network packet format and delivers it to the transmission destination via the network 6.

  Each component described above in the client device 200 is realized by the CPU 250 executing various programs.

  A program for executing various processes in the client device 200 and various data are stored in the data holding unit 206.

(Functional configuration of the management server device)
FIG. 7 schematically shows functional blocks of the management server device 600.

  Referring to FIG. 7, data receiving section 602 determines whether or not a packet flowing on network 6 is a packet addressed to its own device. Send to part 603.

  The data analysis unit 203 extracts data from the received packet, and if the extracted data includes a processing instruction, the license key issuance / authentication unit 604, certificate management unit 605, or other processing unit 607 is included. It is made to process with either.

  The license key issuance / authentication unit 604 issues (creates) a license key to a newly participating client apparatus (or device or application), and transmits the license key to the certificate management unit 605.

  When the client device 200 requests issuance of a certificate, the certificate management unit 605 embeds the license key issued by the license key issuance / authentication unit 604 in the certificate issued to the client device 200.

FIG. 10 schematically shows the configuration of a certificate in which a license key is embedded.
Referring to FIG. 10, in certificate 10, license key 10B created by management server apparatus 600 is embedded in certificate 10A created by the authentication server apparatus (authentication server apparatus 700 or authentication server apparatus 800). Yes.

  Returning to FIG. 7, the license key issuance / authentication unit 604 may create a license key using a part of the data of the certificate after issuing the certificate. It may be created independently. The issued license key is sent to the certificate management unit 607.

  The license key issuance / authentication unit 604 determines whether the license key transmitted from the client device 200 is a license key issued by itself.

  When the certificate management unit 605 receives a certificate issuance request from the client device 200 to the authentication server device 700, the certificate management unit 605 transmits the issuance request to the authentication server device 700. That is, the certificate issuance request to the authentication server device 700 is relayed.

  The certificate management unit 605 associates the certificate with the license key issued (created) for the certificate, and stores the information (license key management table) as shown in FIG. 9 in the data holding unit 706. ,to manage.

  Referring to FIG. 9, in the license key management table, a management number is assigned to each certificate, and a license key (848ddd02-4a92-...) And a certificate are stored in association with each management number. Yes. Further, for each management number, information (Region information) for specifying a domain that can be authenticated by the certificate is stored.

  In the present embodiment, the domain 701 and the domain 801 are different jurisdictions for the same company, for example. JP means Japan, for example, and EU means Europe.

  In the table, “JP” indicates that authentication can be performed by the authentication server device 700 in the domain 701, “EU” indicates that authentication can be performed by the authentication server device 800 in the domain 801, and “World” indicates , It indicates that authentication can be performed by authentication server devices all over the world managed by the company.

  In the table, “client device 01”, “client device 02”, “client device 03”, and “client device 04” mean different client devices.

  In the license key management table of the present embodiment, the certificate itself is managed (stored), but information that can uniquely identify each certificate may be stored instead of the certificate itself.

  Returning to FIG. 7, when the data received by the data receiving unit 602 needs to execute processing other than the processing executed by the authentication unit 604 and the certificate management unit 605, the other processing unit 607 Execute the process.

  The certificate management unit 605 requests the data creation unit 611 to create a message when transmitting the certificate in which the license key is embedded to the client device 200.

  The data transmission unit 612 converts the data created by the data creation unit 611 into a network packet format and delivers it to the transmission destination via the network 6.

  Each component described above in the management server device 600 is realized by the CPU 650 executing various programs.

  A program for executing various processes in the management server device 600 and various data are stored in the data holding unit 606.

(Functional configuration of authentication server device)
FIG. 8 schematically shows functional blocks of the authentication server device 700.

  Referring to FIG. 8, data receiving section 702 determines whether or not a packet flowing on network 6 is a packet addressed to its own device. Part 703.

  The data analysis unit 703 extracts data from the received packet, and if the extracted data includes a processing instruction, the data analysis unit 703 executes the issuance / authentication unit 704, the other certificate management unit 705, or the other processing unit 707. Either process.

  The issue / authentication unit 704 issues (creates) a certificate to a newly participating client device (or device or application).

  In addition, when the client apparatus 200 requests certificate authentication, the issue / authentication unit 704 determines whether the certificate is issued by the own device, and determines that the certificate is not issued by the own device. Then, the other certificate management unit 705 is requested to process the license key transmitted together with the certificate.

  The other certificate management unit 705 extracts, from the certificate, the license key that is embedded in the certificate and transmitted together with the certificate. Then, the other certificate management unit 705 requests the management server device 600 to verify the license key. At this time, the other certificate management unit 705 transmits the license key to the management server device 600.

  When the management server device 600 receives the license key transmitted from the authentication server device 700, the management server device 600 refers to the above-described license key management table and determines whether or not the license key is stored in the table. The verification is executed. Then, the management server device 600 replies to the authentication server device 700 that the license key has been successfully verified if stored in the table, and if not stored, the management server device 600 has failed to verify the license key. Is returned to the authentication server device 700.

  When the authentication server apparatus 700 receives a reply indicating that the license key has been successfully verified, the authentication server apparatus 700 returns a reply indicating that the certificate authentication has been successful to the client apparatus 200, and upon receiving a reply indicating that the license key has failed successfully, A message indicating that the certificate authentication has failed is returned to the client device 200.

  When it is necessary to execute processing other than the processing executed by the issuance / authentication unit 704 and the other certificate management unit 705 on the data received by the data receiving unit 702, the other processing unit 707 executes the processing. To do.

  When the issue / authentication unit 704 returns a certificate authentication result to the client apparatus 200 or the like, and when it is necessary to send a message to another device, the data creation unit 711 requests the creation of the message. Made.

  The data transmission unit 712 converts the data created by the data creation unit 711 into a network packet format and delivers it to the transmission destination via the network 6.

  Each component described above in the authentication server device 700 is realized by the CPU 750 executing various programs.

  A program for executing various processes in the authentication server device 700 and various data are stored in the data holding unit 706.

  The other certificate management unit 705 once requests the management server device 600 to verify the license key, and obtains a certificate indicating that the verification is successful, for example, a list in the data holding unit 706 (for example, It may be saved in a safe list. The issuance / authentication unit 704 does not request the management server device 600 to verify the license key when the client device 200 requests authentication for the certificate stored in the safe list next time. A message indicating that the authentication is successful is returned to the client device 200.

  Further, instead of registering the certificate in the safe list, the issuance / authentication unit 704 may issue the certificate to the client device 200 that has transmitted the license key that has been successfully verified.

  Since the block configuration of authentication server apparatus 800 can be the same as the block configuration of authentication server apparatus 700, detailed description thereof will not be repeated here.

(About communication contents in the authentication system)
Hereinafter, in the present embodiment, the communication contents at the start of communication between client apparatuses will be specifically described with reference to FIG. 11 for explaining the communication contents.

  Referring to FIG. 11, in the present embodiment, in domain 701, client apparatus 200 (client apparatus 200X in FIG. 11) that has received a certificate issued from authentication server apparatus 700 changes from domain 701 to domain 801. Suppose that the domain to which it belongs is moved.

  In the moved domain, the client device 200 transmits its own certificate 10 (issued by the authentication server device 700) to the client device 210 in order to start communication with another client device 210. When the client device 210 attempts to authenticate the certificate 10 by the authentication server device 800 of the domain 801 to which the client device 210 belongs, the authentication fails. This is because the certificate 10 is created not by the authentication server device 800 but by the authentication server device 700. This is notified from the client device 210 to the client device 200.

  The client apparatus 200 receives the certificate 11 (issued by the authentication server apparatus 800) of the client apparatus 210 from the client apparatus 210.

  Upon receiving the notification, the client device 200 extracts information for identifying the authentication server device 800 included in the certificate 11 (process (1A) in FIG. 11), and based on the information, the client device 200 sends the information to the authentication server device 800. Then, it requests authentication of its own certificate 10 (certificate issuance and sending in process (1B) in FIG. 11).

  In response to this, the authentication server device 800 authenticates the certificate 10 but fails once because it is not a certificate issued by itself (processing (2) in FIG. 11).

  Then, the authentication server device 800 extracts the license key (license key 10B in FIG. 10) from the certificate 10 (process (3) in FIG. 11) and transmits it to the management server device 600 (process (4) in FIG. 11). ).

  In response to this, the management server apparatus 600 determines whether or not the transmitted license key is a license key created by itself, based on whether or not the transmitted license key is stored in the license management table.

  Note that the management server device 600 does not necessarily have to store the license key management table when determining whether or not the license key has been created by itself, but the management server device 600 does not necessarily have to store the license key management table. Whether the license key is created by the own device depending on whether or not information unique to the device 600 is included in the license key and whether or not the specific information is included and whether or not a condition based on the specific information is satisfied It may be determined whether or not.

  When the certificate 10 includes a plurality of license keys, the authentication server device 80 transmits the plurality of license keys to the management server device 600. If at least one of the plurality of license keys is created by itself, the management server device 600 may transmit information permitting certificate authentication to the authentication server 800, or all license keys may be self-registered. Information that permits authentication of the certificate may be transmitted on the condition that the certificate is created on the machine.

  If it is determined that the license key is created by itself, the management server device 600 updates the area information (Region information) in the license key management table for the client device 200 (process (5) in FIG. 11), and Then, a new common name (CN) for the client device 200 is sent to the authentication server device 800 (process (6) in FIG. 11). In response to this, the authentication server device 800 provides the client device 200 with the client device 200 based on the CN received from the management server device 600, the CSR (Certificate Signing Request) included in the certificate 10, and the like. A new certificate 12 is created (process (7) in FIG. 11) and transmitted to the client apparatus 200 (process (8) in FIG. 11). Accordingly, the client device 200 can communicate with the client device 210 based on the certificate 12 that can be authenticated by the authentication server device 800.

  As a result, when the management server device 600 determines that the received management information is a license key created by itself, the management server device 600 permits the authentication server device 800 to authenticate the certificate of the client device 200. Will be sent.

  On the other hand, if the management server device 600 determines that the received management information is not a license key created by itself, the management server device 600 transmits information for not permitting authentication of the certificate of the client device 200 to the authentication server device 800. To do. In response to this, the authentication server device 800 replies to the client device 200 that the certificate authentication has failed.

  If the management server apparatus 600 has a license key management table, the management server apparatus 600 updates the stored contents of the table according to the new license key.

  When the management server device 600 determines in step (4) of FIG. 11 that the license key has been created by itself, the management server device 600 creates a new license key for the client device 200, and the authentication server device A new certificate 11 in which the new license key is embedded in 800 may be created. In such a case, it is preferable to notify the authentication server device 700 of a process (use stop) that makes it impossible to use the certificate 10 issued to the client apparatus 200 (process (9) in FIG. 11).

  In the present embodiment described above, the authentication server device 700 constitutes a first authentication server, and the authentication server device 800 constitutes a second authentication server.

[Second Embodiment]
FIG. 12 is a diagram schematically illustrating the configuration of the second embodiment of the authentication system.

  In the present embodiment, the client device 200 belonging to the domain 701 tries to communicate with the client device 210 belonging to the domain 801 and transmits the certificate 10 issued by the authentication server device 700 to the client device 210.

  The client device 210 requests the authentication server device 800 of the domain 801 to which the client device 210 belongs to verify the certificate 10 (process (1) in FIG. 12).

  In response to this, the authentication server device 800 authenticates the certificate 10 but fails because the certificate is not issued by itself (processing (2) in FIG. 12).

  Then, the authentication server device 800 extracts the license key (license key 10B in FIG. 10) from the certificate 10 (process (3) in FIG. 12) and transmits it to the management server device 600 (process (4) in FIG. 12). ).

  In response to this, the management server apparatus 600 determines whether or not the transmitted license key is a license key created by itself, based on whether or not the transmitted license key is stored in the license management table. Note that the management server device 600 does not necessarily have to store the license key management table when determining whether or not the license key has been created by itself, but the management server device 600 does not necessarily have to store the license key management table. Information unique to the device 600 may be included in the license key, and it may be determined whether or not the license key is created by the own device depending on whether or not the unique information is included.

  If it is determined that the license key is created by itself (processing (5) in FIG. 12), the management server device 600 transmits information that permits authentication of the client device 200 to the authentication server device 800 (FIG. 12). 12 processes (6)). In response to this, the authentication server device 800 registers the license key of the client device 200 in the safe list (process (7) in FIG. 12), and the fact that the certificate 10 has been successfully authenticated to the client device 210. (Processing (8) in FIG. 12). Accordingly, the client device 200 can communicate with the client device 210 based on the certificate 12 that can be authenticated by the authentication server device 800.

[Third Embodiment]
FIG. 13 is a diagram schematically illustrating the configuration of the third embodiment of the authentication system.

  In the first embodiment described above, the client device 200 transmits the issuance request to the management server device 600 when requesting the certificate issuance by the authentication server device 700.

  In the present embodiment, the client device 200 transmits an issue request directly to the authentication server device 700 (process (1) in FIG. 13).

  In response to receipt of the issue request, the authentication server device 700 issues a certificate (process (2) in FIG. 13) and requests the management server device 600 to create a license key for the client device 200 (FIG. 13). 13 process (3)).

  In response to this, the management server apparatus 600 creates a license key (license key 10B in FIG. 10) (process (4) in FIG. 13) and transmits it to the authentication server apparatus 700 (process (5) in FIG. 13). .

  In response to this, the authentication server device 700 embeds a license key in the created certificate (process (6) in FIG. 13), and transmits the certificate 10 to the client device 10 (process (7) in FIG. 13). In the present embodiment, the license key is created by the management server device 600 and transmitted to the client device 200 via the authentication server device 700.

  The embodiment disclosed this time should be considered as illustrative in all points and not restrictive. The scope of the present invention is defined by the terms of the claims, rather than the description above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.

  2 PC, 2A monitor, 3 network cable, 4 hub, 5 router, 10, 10A, 11, 12 certificate, 10B license key, 250, 650, 750 CPU, 252, 652, 752 Media drive, 252A, 652A, 752 Recording medium, 200, 210 Client device, 202, 602, 702 Data receiving unit, 203, 603, 703 Data analyzing unit, 204 Authentication unit, 206, 606, 706 Data holding unit, 207, 607, 707 Processing unit, 211, 611,711 Data creation unit, 212,612,712 Data transmission unit, 604 License key issuance / authentication unit, 605 Certificate management unit, 700,800 Authentication server device, 701,801 domain, 704 Certificate issuance / authentication unit, 705 Other certificate management department.

Claims (14)

An authentication program executed for authentication of a client device in an authentication system including a first authentication server device, a second authentication server device, and a management server device,
In the management server device,
In response to a certificate issuance request from the client device, the step of transmitting a certificate issuance request to the first authentication server device is executed.
In the first authentication server device,
Depending on the certificate request from the management server device, and creating a certificate for the client device,
Transmitting the certificate of the client device to the management server device ;
In the management server device,
And creating a related information in the certificate received from the first authentication server,
The client device, to execute a step of transmitting said certificate and the related information,
In the second authentication server device,
Attempting to authenticate the client device by verifying the certificate of the client device transmitted from the client device;
If the authentication fails the client device, to execute a step of transmitting the information received from the client device to the management server apparatus,
In the management server device,
A step of information received from the second authentication server to determine whether the related information generated by the own device,
To the second of the authentication server apparatus, information received from the second authentication server apparatus when it is determined that the related information created by the own apparatus, to allow the authentication of the client device If the permission information, which is information, is transmitted and it is determined that the information received from the second authentication server device is not related information created by the own device, the authentication is not permitted for the authentication of the client device. And further transmitting the information,
In the second authentication server device,
For the client device, said from the management server device according to reception of the permission information, and transmits the information indicating successful authentication of the client device, receiving the non permission information from the management server device In response, a computer-readable authentication program for further executing a step of transmitting information indicating that authentication of the client device has failed. An authentication program executed for authentication of a client device in an authentication system including a first authentication server device, a second authentication server device, and a management server device,
In the first authentication server device,
Creating a certificate for the client device in response to a certificate issuance request from the client device;
Requesting the management server device to create certificate related information; and
In the management server device,
Creating certificate related information in response to a request from the first authentication server device;
Transmitting the related information to the first authentication server device;
In the first authentication server device,
Causing the client device to execute the step of transmitting the certificate and the related information;
In the second authentication server device,
Attempting to authenticate the client device by verifying the certificate of the client device transmitted from the client device;
If authentication of the client device fails, transmitting the information received from the client device to the management server device;
In the management server device,
Determining whether the information received from the second authentication server device is related information created by the own device;
If the second authentication server device determines that the information received from the second authentication server device is related information created by the own device, the second authentication server device is used to permit authentication of the client device. If the permission information, which is information, is transmitted and it is determined that the information received from the second authentication server device is not related information created by the own device, the authentication is not permitted for the authentication of the client device. And further transmitting the information,
In the second authentication server device,
In response to receiving the permission information from the management server device to the client device, information indicating that the client device has been successfully authenticated is transmitted, and the non-permission information is received from the management server device. In response, a computer-readable authentication program for further executing a step of transmitting information indicating that authentication of the client device has failed. The authentication program according to claim 1 , wherein in the step of transmitting the certificate and the related information to the client device, the related information is embedded and transmitted in the certificate. In response to receiving the permission information from the management server device, the second authentication server device further creates a new certificate for the client device and transmits the certificate to the client device. The authentication program according to any one of claims 1 to 3, wherein: If the management server device determines that the information received from the second authentication server device is related information created by itself, it sends new related information to the second authentication server device. Execute the send step,
5. The authentication program according to claim 4, wherein in the step of transmitting the new certificate to the client device, the new certificate in which the new related information is embedded is transmitted to the client device. 6. The authentication according to claim 4 or 5, further causing the management server device to further execute a step of transmitting information instructing to stop using the certificate of the client device to the first authentication server device. Program.   The authentication program according to claim 1, wherein the management server device causes the related information to be created by creating a signature of the management server device. In the second authentication server device,
Receiving a plurality of information together with the certificate when requesting verification of the certificate of the client device from the client device;
Transmitting the plurality of pieces of information received from the client device to the management server device;
In the step of causing the management server device to transmit the permission information, if it is determined that at least one of the plurality of pieces of information received from the second authentication server device is related information created by the own device, The authentication program according to claim 1, wherein the permission information is transmitted to the second authentication server device. In the management server device,
Storing the created related information further,
Whether the information received from the second authentication server device is the related information created by the own device based on whether the information received from the second authentication server device matches the stored related information. The program for authentication according to any one of claims 1 to 8, which makes a determination as to whether or not. In the management server device,
The authentication program according to claim 9, wherein the related information is stored in association with a certificate and domain information of the first authentication server device that created the certificate. An authentication system for authenticating a client device, comprising a first authentication server device, a second authentication server device, and a management server device,
The management server device
A first transmission unit for transmitting a certificate issuance request to the first authentication server device in response to a certificate issuance request from the client device;
The first authentication server device includes:
Depending on the certificate request from the management server apparatus, a first creation unit that creates a certificate for the client device,
A second transmission unit that transmits a certificate of the client device to the management server device ;
The management server device
A second creation unit that creates a relevant information in the certificate received from the first authentication server,
And a related information storage unit that stores the related information in association with the certificate of the client,
The first transmission unit to the client apparatus, and transmits the certificate and the related information,
The second authentication server device includes:
An authentication unit that attempts to authenticate the client device by verifying the certificate of the client device transmitted from the client device;
A third transmission unit that transmits information received from the client device to the management server device when the authentication unit fails to authenticate the client device;
The management server device
A comparison unit that compares the information received from the second authentication server device with the related information stored in the related information storage unit;
If the information received from the second authentication server device matches the related information stored in the related information storage unit, the second authentication server device is allowed to authenticate the client device. It sends a permission information is information for, when the information received from the second authentication server device does not match the associated information stored in the related information storage unit, the authentication of the client device And a fourth transmission unit for transmitting non-permission information that is information for not permitting
The second authentication server device includes:
For the client device, said from the management server device according to reception of the permission information, and transmits the information indicating successful authentication of the client device, receiving the non permission information from the management server device In response, the authentication system further includes a fifth transmission unit that transmits information indicating that the authentication of the client device has failed. An authentication system for authenticating a client device, comprising a first authentication server device, a second authentication server device, and a management server device,
The first authentication server device includes:
A first creation unit that creates a certificate of the client device in response to a certificate issuance request from the client device;
A first transmission unit that transmits information requesting creation of certificate-related information to the management server device;
The management server device
A second creation unit for creating certificate-related information in response to a request from the first authentication server device;
A related information storage unit for storing the related information in association with a certificate of the client;
A second transmitter that transmits the related information to the first authentication server device;
The first transmission unit transmits the certificate and the related information to the client device,
The second authentication server device includes:
An authentication unit that attempts to authenticate the client device by verifying the certificate of the client device transmitted from the client device;
A third transmitter that transmits information received from the client device to the management server device when authentication of the client device fails;
The management server device
A comparison unit that compares the information received from the second authentication server device with the related information stored in the related information storage unit;
If the information received from the second authentication server device matches the related information stored in the related information storage unit, the second authentication server device is allowed to authenticate the client device. If the information received from the second authentication server device does not match the related information stored in the related information storage unit, authentication of the client device is performed. A fourth transmission unit for transmitting non-permission information that is information for disallowing,
The second authentication server device includes:
In response to receiving the permission information from the management server device to the client device, information indicating that the client device has been successfully authenticated is transmitted, and the non-permission information is received from the management server device. In response, the authentication system further includes a fifth transmission unit that transmits information indicating that the authentication of the client device has failed. An authentication method for a client device in an authentication system comprising a first authentication server device, a second authentication server device, and a management server device,
The first authentication server device executes all the steps that the authentication program according to claim 1 causes the first authentication server device to execute,
The second authentication server device executes all the steps that the authentication program according to claim 1 causes the second authentication server device to execute,
The authentication method according to claim 1, wherein the management server apparatus executes all the steps that the authentication program according to claim 1 causes the management server apparatus to execute . An authentication method for a client device in an authentication system comprising a first authentication server device, a second authentication server device, and a management server device,
The first authentication server device executes all the steps that the authentication program according to claim 2 causes the first authentication server device to execute,
The second authentication server device executes all the steps that the authentication program according to claim 2 causes the second authentication server device to execute,
The said management server apparatus is an authentication method which performs all the steps which the program for authentication of Claim 2 makes the said management server apparatus perform.

Images