JPH04358249A - User certifying system for network service between various types of computer - Google Patents

Abstract

PURPOSE:To provide the user certifying system for enabling the utilization of network service between various type computers differing the form of a user identifier used for discriminating a user. CONSTITUTION:When the user of a computer A1 requests the network service through a network I to a server 5 on a computer B2, a local user identifier is converted to a wide area user identifier by using a user management list 3, and this identifier is transmitted to the server 5 together with the request. When a user entry coincident with the wide area user identifier in the request exists in a user management list 4, the server 5 converts the identifier to the local form user identifier of the entry.

Description

[Detailed description of the invention]

0001

[Industrial field of application] Use of network services between heterogeneous computers connected via a network, such as computers with different user identifier formats, such as computers with different types of hardware or operating systems. Regarding user authentication method.

0002

[Background Art] Conventionally, user management in a network system in which multiple computers are connected via a network is generally performed on each individual computer, or logically centralized user management among computers that use the same user management method. is being carried out.

Generally, when a user accesses a resource, access rights are checked by comparing the user identifier that the resource has as an attribute with the user identifier of the user requesting access. The same is true in a network environment, when a user of one computer accesses the resources of another computer,
Generally, access rights are checked using the user identifier that is approved when the user starts using each computer.

0004

[Problem to be Solved by the Invention] Conventional user verification when accessing remote resources generally uses a user identifier sent from the requesting side, so it is required that the user identifier format is the same, and different Access to remote resources may not be possible between computers of different types of computer systems that use user identifier formats or computers of different types of operating systems, or even if it is possible, it may not be possible to access remote resources between two types of computers with different user identifier formats. It is not possible to determine that the same user who has the same user registration is the same user in the network service.

[0005] This method provides a user authentication method for network services between heterogeneous computers that solves the above problems.

[0006]

[Means for solving the problem] The user authentication method for the network service between heterogeneous computers of this method is based on the user management list used by each computer on the network.
It has a pair of entries for a user identifier in local format and a global user identifier in a format that does not depend on the local format. A step of converting the identifier into a global identifier format, a step of storing the global user identifier during the request to the remote computer and transmitting it to the server, and a step of converting the global user identifier included in the forwarded request at the server. a step of searching for a matching user entry from the user management list used by the computer; and, if a matching user entry exists, a step of giving a local format user identifier registered in this entry. and, if no matching user entry exists, providing a local format user identifier indicating the special user; and using the local format user identifier format to check access rights to the resource. Be prepared.

[0007]

[Operation] When using a network service between computers that use different user identifier formats, extract the paired global user identifier from the user entry in the user management list of the requesting side, and Make a request to a mote by identifier.

[0008] The service provider uses the global user identifier passed as part of the request to search for a user entry from its own user management list, and if there is a matching entry, registers it as a pair. It is converted into a user identifier format on the service provider side and used to check access rights to resources. If a matching entry does not exist, it is converted into a user identifier indicating a special user on the service provider side, and is used to check resource access rights.

[0009] Computers with the same user identifier format can use the requesting user identifier as is, and only when computers of different types access each other, the global user identifier is used to provide network services. Check the user's access rights.

0010

[Embodiment] This system will be explained in detail with reference to the drawings.

FIG. 1 is a functional block diagram showing an embodiment of this system.

Computer A1 and computer B2 are different types of computers with different user identifier formats, and when user u starts using computer A1, the system software of computer A1 stores its own user management list 3. The user ID 123 is used to check whether the user is a valid user, and if so, a user identifier 123 is given to the user u. This user u can use the network server 5 and access the resources 6 of the computer B2 through the network. In addition, user u is also registered in the user management list 4 used by computer B2, but since a user identifier format such as 123 cannot be registered in the user management list 4, the user identifier format is #σ/ou with different values are given.

User x has a local format user identifier 100 and a global user identifier xyz registered in the user management list 3 of computer A1, but a local format user identifier 100 and a global user identifier Only the identifier #σ/ox is registered.

FIG. 2 shows a user authentication processing procedure in a network service between different types of computers having different user identifier formats.

When the user u accesses the resources 6 of the computer B2 using the server 5 of the computer B2, the computer A1 retrieves the local user identifier 123 from the user management list 3 used by the system software of the computer A1. A matching entry is searched and the global user identifier abc registered in that entry is extracted (step 7). The retrieved global user identifier abc is sent to computer B2 along with the request through network communication (step 8
). The function of the network server 5 on the computer B2 extracts the global identifier abc from the transmitted request (step 9). A user entry matching the global identifier is searched from the user management list 4 used by the system software of computer B2 (step 10). Since a matching user entry exists, extract the local format user identifier #%u of computer B2 registered as a pair, and
This user identifier is used to check the right to access the resource (steps 11 and 13).

When the user x accesses the resource 6 of the computer B2 using the network server 5, the computer A1 uses a local user identifier 100 that matches the local user identifier 100 from the user management list 3 used by the system software of the computer A1. The entry is searched and the global user identifier xyz registered in the entry is extracted (step 7). Send the retrieved global user identifier xyz along with the request to computer B2 through network communication (step 8
). The server 5 that performs the network service function on the computer B2 extracts the global identifier xyz from the transmitted request (step 9). Global identifier xy from user management list 4 used by the system software of computer B2
Search for a user entry that matches z (step 10). Since there is no matching user entry, a user identifier indicating that the user is a special user is given (step 12).
), the user identifier is used to check the access right to the resource (step 13).

[0017]

[Effects of the Invention] As explained above, computers using different user identifier formats can access network resources without changing the local user identifier format, and the global user identifiers can be made to match on both sides. Therefore, in the case of the same user, it can be determined that the user has the right to access remotely held resources as the owner.

[Brief explanation of the drawing]

FIG. 1 is a functional block diagram showing an example of this method;

FIG. 2 is a flowchart of a network service user authentication process.

[Explanation of symbols]

1 Local computer A, 2 Remote computer B,

Claims (1)

[Claims] Claim 1: User management used by each computer in a user authentication method in a network service in which resources on each computer are shared between different types of computers connected via a communication network and having different user identifier formats. The entries in the list include a user identifier in a local format for the user and a global user identifier in a format that does not depend on the computer-specific user identifier format. a step of extracting a global user identifier registered in an entry that matches the local user identifier from the list; a step of storing the global user identifier during a request to a remote computer and transmitting it to the server; A step of searching for a matching user entry from the user management list used on the remote computer using the global user identifier included in the request, and if a matching user entry exists, it is registered. providing a locally formatted user identifier;
If there is no matching user entry in the user management list, providing a local-format user identifier indicating the special user; and checking access rights to the resource using the local-format user identifier form. A user authentication method for a network service between heterogeneous computers characterized by including steps.