JPH05225151A - User certification system - Google Patents

Abstract

PURPOSE:To improve the propriety of a validity term check on a certificate which is attested yet and to improve the accuracy and reliability of the whole network. CONSTITUTION:An attesting server 2 issues the attested certificate which is issued at the start of the utilization of the network system and a server attesting server 3 which issues a service-attested certificate for judging whether or not respective computer systems 4-6 are allowed to utilize service. The term of validity entered into the attested certificate is checked at the time of service utilization after the service attesting server 3 corrects the time of the attesting server 2.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a user authentication system in a network system composed of a plurality of computer systems which are organically connected via any communication medium.

[0002]

2. Description of the Related Art Conventionally, in a user authentication system in a distributed environment in which a plurality of computer systems are arbitrarily connected via a communication medium, a use start procedure is performed by an authentication server which is a specific computer, and it is determined that the user is a correct user. At that time, the authenticated certificate is issued and the computer becomes available. After that, in order to use the service of other computer systems on the network, the procedure of submitting this authenticated certificate to the authentication server again and obtaining the certificate for using the service becomes available. It was being appreciated.

According to such a conventional user authentication system, there is a problem that the load on the authentication server is increasing and cannot follow the expansion of the network scale.

Therefore, it is possible to consider a method in which the authentication server and the computer for judging whether or not to use the service are separately provided. A computer that determines whether or not to permit use of this service is called a service authentication server.

FIG. 4 shows a flowchart for confirming the expiration date by the conventional service authentication server. In FIG. 4, first, the service authentication server extracts the current time TS from the authenticated certificate (step 401). Next, the issue time TT is extracted from the authenticated certificate (step 40).
2). Further, the expiration date TL is extracted from the authenticated certificate (step 403). Then, it is determined whether or not the expression (1) is satisfied (step 404).

Issuing time TT ≦ current time TS ≦ issuing time TT + expiration date TL (1) Next, if the equation (1) is satisfied, it is regarded as an authenticated certificate within the expiration date (step 405) and the equation (1) ) Is not established, the certificate is an authenticated certificate whose expiration date has not yet expired (step 4).
06).

However, there is no problem if the current time of the authentication server and the service authentication server, which is a computer for judging whether or not to permit the use of the service, are the same, but if they are different, the actual expiration date has passed. There is a problem in that the use of the service is permitted or the service is not permitted to be used even though the actual expiration date has not expired, so that the expiration date of the authenticated certificate is not properly checked.

[0008]

As described above, conventionally, in a user authentication system on a network in which a plurality of computer systems are connected via arbitrary communication media, the load on the authentication server is increasing, There is a problem that it cannot follow the expansion of the scale of the network system.

Further, if an authentication server and a computer system for judging whether to permit or prohibit service use are separately provided, if the authentication server and the computer system for judging whether to permit or prohibit service use differ in time, the expiration date of the authenticated certificate There was a problem that the check was not done properly.

Therefore, an object of the present invention is to eliminate such problems, improve the validity of checking the expiration date of an authenticated certificate, and provide a user authentication system with improved accuracy and reliability as a whole. And

[0011]

According to a first aspect of the present invention, a specific computer system collectively manages user information and authenticates a user on a network in which a plurality of computer systems are connected via arbitrary communication media. A user authentication computer that performs the user authentication and issues an authenticated certificate in a user authentication system that performs the above-mentioned procedure and issues an authenticated certificate to permit or prohibit the use of various services of the plurality of computer systems. It is characterized by comprising a system and a service authentication computer system which judges whether or not to use the various services based on an authenticated certificate issued by the user authentication computer system.

According to a second invention, in the service authentication computer system of the first invention, when the expiration date written in the authenticated certificate is different from the reference time in the user authentication computer system, the time is corrected. It is characterized by comprising time correction means for performing and expiration date determination means for determining the expiration date written in the authenticated certificate based on the corrected time.

[0013]

According to a first aspect of the invention, on a network in which a plurality of computer systems are connected via arbitrary communication media,
A user authentication system in which a specific computer system collectively manages user information, performs user authentication, issues an authenticated certificate, and permits or prohibits the use of various services of the plurality of computer systems. The authenticating computer system authenticates the user and issues an authenticated certificate, and the service authenticating computer system determines whether to use the various services based on the authenticated certificate issued by the user authenticating computer system.

According to a second aspect of the present invention, in the service authentication computer system of the first aspect, when the expiration date written in the authenticated certificate by the time correction means is different from the reference time in the user authentication computer system,
The time is corrected, and the expiration date determination means determines the expiration date written in the authenticated certificate based on the corrected time.

[0015]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a block diagram showing the configuration of a user authentication system on a network which is an embodiment of the present invention.
In FIG. 1, in the network, a plurality of computer systems 2 to 6 are connected to a communication medium 1. The computer system 2 is an authentication server, and a user information database management unit 2-2 that collectively manages user information on the network and an authentication processing unit 2-1 that issues an authenticated certificate for determining whether the user is permitted to use the information. It consists of The computer system 3 is a service authentication server, determines a service information database management unit 3-2 that manages service information that the user can use on the network, and determines whether the user is permitted to use the service, and issues a service authentication certificate. The service authentication processing unit 3-1 is provided. Further, the computer systems 4 to 6 are computer systems generally used by users, and authentication request units 4-1, 5-1 and 6-1 for inputting user information such as a user name and a password, and other computers. Service requesting units 4-2 and 5 requesting service from the system
-2, 6-2 and service processing units 4-3, 5-3, which accept service requests from other computer systems
6-3.

Next, a procedure for starting use of a plurality of computer systems will be described. First, the authentication requesting unit 4-1 of the computer system 4, based on the user name and password input by the user, the authentication processing unit 2- of the authentication server 2.
By requesting the user to confirm the user's identity, the certificate is judged to be correct and an authenticated certificate is issued, whereby the user's use start procedure is completed.

FIG. 2 is a format diagram of an authenticated certificate. In FIG. 2, the authenticated certificate stores a network address indicating the position of the service authentication server on the network and a node name which is the name of the service authentication server on the network. Other, user name,
The user ID number indicating the user's identification, the issuing time of the authenticated certificate, and the expiration date are stored. Based on this authenticated certificate, the service request unit 4 of the computer system 4
-2 will access the service authentication server.

When the user of the computer system 4 to which the authenticated certificate is issued requests the service of the computer system 5, the service request unit 4-2 of the computer system 4 requests the service authentication server 3 to perform the authenticated certificate. Request the service authentication certificate by inquiring about the use of the service of the computer system 5.

On the other hand, the service authentication server 3 is a valid request when the submitted authenticated certificate is valid and the requested service information is registered in the service information database 3-3. Issue a service authentication certificate. Here, in order to confirm the validity of the authenticated certificate, the expiration date of the authenticated certificate is checked.

FIG. 3 shows a flowchart for confirming the expiration date in the service authentication server 3. In FIG. 3, first, the service authentication processing unit 3 of the service authentication server.
-1 extracts the current time TS of the service authentication server (step 301). Then, the authentication server is inquired about the time (step 302). On the other hand, the authentication server retrieves the current time TA of the authentication server and responds to the service authentication server (step 303). Next, the service authentication processing unit 3-1 determines whether or not its own time TS matches the time TA of the authentication server (step 304).
If they do not match, the time TA of the authentication server is replaced with the time TS of the service authentication server (step 30).
5) Take out the issue time TT from the authenticated certificate (step 306). Furthermore, from the certified certificate to the expiration date TL
Is taken out (step 307). Then, it is determined whether or not the expression (1) is satisfied (step 308).

Issuing time TT ≦ current time TS ≦ issuing time TT + expiration date TL (2) Next, when the equation (2) is satisfied, it is regarded as an authenticated certificate within the expiration date (step 309) and the equation (2). ) Is not established, the certificate is an authenticated certificate whose expiration date has not yet expired (step 3).
10).

As described above, even when the time of the computer system is different, it is possible to accurately check the expiration date.

[0024]

As described above, according to the present invention, in a user authentication system on a network in which a plurality of computer systems are connected via an arbitrary communication medium, it is determined whether or not to permit user authentication and service use. Separation of computer systems has the advantage that the increase in load due to the expansion of the overall network system can be reduced.

Even if the time of each computer system of the network system is different, the time elapsed from the issuance of the authenticated certificate can be accurately measured by correcting the time, and the control by the expiration date can be performed. Since it can be performed correctly, there is an advantage that the accuracy and safety of user authentication are improved.

[Brief description of drawings]

FIG. 1 is a configuration block diagram of a user authentication system according to an embodiment of the present invention.

FIG. 2 is a format diagram of an authenticated certificate.

FIG. 3 is a flowchart for confirming an expiration date.

FIG. 4 is a conventional flowchart for confirming an expiration date.

[Explanation of symbols]

 1 Communication Medium 2 Authentication Server 2-1 Authentication Processing Unit 2-2 User Information Database Management Unit 2-3 User Information Database 3 Service Authentication Server 3-1 Service Authentication Processing Unit 3-2 Service Information Database Management Unit 3-3 Service Information Database 4 to 6 Computer system 4-1, 5-1 and 6-1 Authentication request unit 4-2, 5-2, 6-2 Service request unit 4-3, 5-3, 6-3 Service processing unit

Claims (2)

[Claims] 1. A specific computer system collectively manages user information, performs user authentication, and issues an authenticated certificate on a network in which a plurality of computer systems are connected via arbitrary communication media. A user authentication system that permits or prohibits the use of various services of the plurality of computer systems, the user authentication computer system performing the user authentication and issuing an authenticated certificate, and the user authentication computer system A user authentication system, comprising: a service authentication computer system that determines whether or not to use the various services based on an authenticated certificate issued. 2. The service authentication computer system, when the expiration date written in the authenticated certificate is different from the reference time in the user authentication computer system, time correction means for correcting the time, the authentication 2. The user authentication system according to claim 1, further comprising an expiration date determination unit that determines the expiration date written in the certificate of completion based on the corrected time.