JPH11102345A - Method and system for authenticated data base management - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve maintainance of an authenticated data base by constituting the authenticated data base with authenticated data of all users in all authentication management areas. SOLUTION: The authenticated data base 1 consists of N records 2, which each consist of a user name field where a user name as a user identifier is written, a password field where a password as a password code is written, and an area field. One record is prepared for each user and user names set uniquely by the users are written in the user name files of the respective records. When a user accesses one of the authentication management areas, a user who has succeeded in authentication by accessing the authentication management area before this access is retrieved preferentially from the authentication data base and matched against the current user to perform authentication.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method and system for dividing a network into a plurality of authentication management areas, installing an authentication server in each of the authentication management areas, and managing an authentication database.

[0002]

2. Description of the Related Art Generally, when connecting to a network such as a personal computer communication or the Internet via a telephone network,
The user connects to access points in various places provided by a personal computer communication company or an Internet provider, and performs communication via the access points.

At this time, in order to confirm whether or not the user is a legitimate user of the network, the authentication server requests each user (hereinafter referred to as a user) to input a password together with a user name. Then, the input user name and the like are collated with an authentication database preset in the network, and if they match, the connection of the user is permitted.

However, in such personal computer communication and the like, since the business is being developed on a nationwide scale, the number of users may reach several million in many places, and it takes time to authenticate the users at the time of access. Take
How to shorten the authentication time has been a problem.

Here, user authentication in a network in general personal computer communication and the like will be described with reference to the drawings. FIG. 6 is an explanatory diagram schematically showing a network such as general personal computer communication. As shown in the figure, the entire network has five authentication management areas 10,
20, 30, 40, and 50, and authentication servers 11, 21, 31, 41, and 51 are installed in each authentication management area.

[0006] Each authentication server has a network access server 12, 22, 3 functioning as a router.
2, 42, and 52 are connected to each other, and each user is connected to the authentication server via these network access servers. Note that both the authentication server and the network access server may be realized by software or may be realized by hardware.

When the network shown in FIG. 6 is applied to a nationwide personal computer communication network, each authentication management area corresponds to a region such as Kanto, Tohoku, and Kinki.
One authentication server is installed in each of these regions. The plurality of network access servers connected to these authentication servers correspond to access points installed in municipalities in each region, for example, Tokyo, Mitaka, Sendai, Osaka, and the like.

Therefore, assuming that the address of the user 13 is Mitaka City, the user 13 accesses the network via the network access server 12 in Mitaka City, which is the nearest access point, and undertakes user authentication in the Kanto region. Is connected to the authentication server 11 which is located.

Also, it is natural that the user 13
Can also be accessed via another network access server other than Mitaka City. For example, if access is through the network access server 22, authentication is performed by the authentication server 21 in the authentication management area 20. As described above, in the related art, the entire network is divided into a plurality of authentication management areas, and an authentication server is prepared for each authentication management area to perform user authentication.

[0010]

However, in the conventional authentication management method and system as described above,
In order to allow access from any of the authentication management areas, an authentication database having data on all users is installed in each authentication management area. for that reason,
There is a problem in that the number of records becomes enormous with the increase in users, and it takes a long time to search for authentication.

In order to solve such a problem,
There is also a method of reducing the size of the authentication database by allocating users for each authentication management area. However, in such a method, when the user corresponding to the authentication database installed in the accessed authentication management area is not registered, other methods are used. Since the authentication database in the authentication management area is referred to, there is also a problem that it takes time.

Further, when the user is allocated to each authentication management area as described above, the registered user is different for each authentication management area. Therefore, when the authentication management area is added or deleted, the other authentication management areas are added. Also, the authentication database in the office had to be changed, and there was a problem in maintainability. In particular, in a network in which such an authentication management area is frequently changed, maintenance of the authentication database is very complicated.

The present invention is intended to solve such a problem. In a network having a plurality of authentication management areas, even if the number of users is large, the authentication time can be shortened, and the authentication management area can be reduced. It is an object of the present invention to provide an authentication database management method and an authentication database management system that can easily perform maintenance even if they are frequently changed.

[0014]

In order to achieve the above object, an authentication database management method according to the present invention comprises:
When the user accesses one of the authentication management areas among the authentication management areas, the user who accesses the one authentication management area before the access and succeeds in the authentication is preferentially selected from the authentication database. The authentication is performed by searching, and comparing the searched user with the accessed user. With this configuration, the authentication database management method according to the present invention can search in a short time even if the number of users is large, and the maintenance of the authentication database is easy.

In the authentication database management system according to the present invention, each authentication management area includes a field in which a user identifier uniquely assigned to each user is written, a field in which a password is written, and an authentication code. An authentication database having a plurality of records each composed of an area field to which a code indicating the success of the user is written, and authenticating the user by referring to the authentication database, and if the authentication of the user succeeds, a record related to the user An authentication server that writes a code indicating successful authentication in the area field of, and, upon receiving an authentication request from the user, preferentially searches for a record in which the code indicating successful authentication is written in the area field and performs authentication. Means, connected to the authentication server means, for transmitting a user authentication request to the authentication server means. And a Tsu network access server means. With such a configuration, the authentication database management system according to the present invention can search in a short time even if the number of users is large, and the maintenance of the authentication database is easy.

[0016]

Next, one embodiment of the present invention will be described with reference to the drawings. FIG. 1 is an explanatory diagram showing one embodiment of the present invention. As shown in the figure, the authentication database 1 is composed of N records 2,
Each record 2 includes a user name field in which a user name as a user identifier is written, a password field in which a password as a password is written, and an area field.

For example, in the record of # 2 in FIG. 1, "taro" is written as a user, and "ABCDwxyz" is written as a password. Then, the value “0” is written in the area field. Similarly, data on the user “jiro” is written in the record #n.

As described above, one record is prepared for one user, a user name uniquely set for each user is written in the user name field of each record, and alphabets and numerals, etc. are written in the password field. A password made with any combination of is written. Then, "0" is written as an initial value in the area field, and "1" is written when accessed once.

Here, the procedure for registering a new user in the authentication database will be described with reference to the drawings. FIG.
FIG. 5 is an explanatory diagram showing a state in which a new user is registered in the authentication database. As shown in the figure, when the user “hanako” is newly registered in the record of # N + 1,
For example, “KLMstuvW” is written in the password field as a password set arbitrarily. Then, the initial value “0” is written in the area field.

Next, the authentication procedure will be described with reference to the drawings. FIG. 5 is a flowchart showing an authentication procedure when the authentication database shown in FIG. 1 is used for the general network shown in FIG. In the following, a procedure in which the user 13 in FIG. 6 accesses the authentication server 11 will be described as an example. However, the procedure is similarly performed for other authentication servers and the like.

First, in step 100, when an authentication request from the user 13 is transmitted to the authentication server 11 via the network access server 12, the authentication server 11
Starts authentication. In step 101, in order to preferentially search for a user who has already accessed the authentication server 11, the authentication server 11 starts searching for a record in the authentication database in which the value of the area field is "1". If there is a corresponding record, the process proceeds to step 102, and if not, the process proceeds to step 105.

In step 102, a corresponding record was found in the authentication database.
Subsequently, the password is collated. That is, the authentication server 11 collates the input password with the password of the searched record, and confirms whether or not they match each other. Then, if they match, the process proceeds to step 103,
If they do not match, the process proceeds to step 106.

In step 103, the authentication server 11
Confirms that the input user name and password match those registered in the authentication database, and notifies the network access server 12 of successful authentication. As a result, the user 13 is permitted to connect to the network, and accesses the network by a normal procedure. In step 104, the authentication server 11 writes a value "1" indicating that access has been completed in the area field, and ends the authentication procedure.

On the other hand, in step 105, the authentication server 11 searches for a record in which the value of the area field is "0". If there is a corresponding record, the process proceeds to step 102, and the password is collated in the same manner as described above. If there is no corresponding record, step 106
Move to.

In step 106, the authentication access server 11 notifies the network access server 12 that the authentication has failed because the passwords do not match or the user who has accessed the authentication database has not been registered. As a result, the user 13 is refused connection to the network.

Next, another embodiment of the present invention will be described. FIG. 2 is an explanatory diagram showing another embodiment of the present invention. As shown in the figure, the configuration is very similar to that of FIG. 1 except that a date field is provided instead of an area field.

That is, if the date (year, month, day, or time) of the authentication is written at the time of successful authentication, the record in which the date is written is preferentially searched at the time of the search, and the case of FIG. Similar effects can be obtained.

In the case of FIG. 2, the date written in the date field is monitored periodically, and after a certain period of time has elapsed from the date, the date field is rewritten to the initial value, so that the user who has a small number of accesses can be monitored. Initialize a date field. As a result, the authentication management area 1
It is possible to preferentially search for a user who accesses within 0, and the authentication time can be further reduced as compared with the case of FIG.

Further, the authentication procedure when the authentication database of FIG. 2 is used is almost the same as that of FIG.
Generally, it follows the flowchart of FIG. However, step 1
The difference is that, instead of writing in the area field in 04, the date of authentication is written in the date field. In addition, the authentication database 11 periodically monitors the date of the date field independently of the authentication procedure, and when a certain period of time has passed since the current time, the value of the date field is changed to a predetermined initial value, for example, “ 00.00.00 "
Rewrite to

FIG. 3 is an explanatory view showing still another embodiment of the present invention. As shown in FIG.
Is combined with the configuration of FIG. 2 and includes an area field and a date field. Therefore, in the authentication procedure of the authentication database of FIG. 3, a step of writing the date of authentication in the date field after step 104 is newly added according to the flowchart of FIG.

[0031]

As described above, according to the present invention, since the authentication database is composed of the authentication data of all the users in all the authentication management areas, even if the authentication management area is changed, the previous authentication database remains unchanged. Can be used. Therefore, the present invention can greatly improve the maintainability of the authentication database. Further, according to the present invention, although an authentication database in which users in all areas are registered is installed for each authentication management area, it is possible to speed up the search by limiting records to be searched using area fields and the like. it can.

[Brief description of the drawings]

FIG. 1 is an explanatory diagram showing one embodiment of the present invention.

FIG. 2 is an explanatory diagram showing another embodiment of the present invention.

FIG. 3 is an explanatory diagram showing another embodiment of the present invention.

FIG. 4 is an explanatory diagram showing a state in which a new user is registered in the authentication database according to FIG. 1;

FIG. 5 is a flowchart showing an authentication procedure according to the present invention.

FIG. 6 is an explanatory diagram showing a network having a plurality of authentication management areas.

[Explanation of symbols]

1 ... authentication database, 2 ... records, 10, 20, 3
0, 40, 50 ... authentication management area, 11, 21, 31,
41, 51 ... authentication server, 12, 22, 32, 42, 5
2 ... Network access server, 13 ... User.

Claims (8)

[Claims] Claims 1. An authentication management area is divided into a plurality of authentication management areas, and an authentication database for all users is set up in each authentication management area. When accessing one of the authentication management areas of the authentication management area, the user who accesses the one authentication management area prior to this access and succeeds in the authentication is preferentially searched from the authentication database, An authentication database management method, wherein authentication is performed by comparing the searched user with the accessed user. 2. The method according to claim 1, wherein when a user accesses one of the authentication management areas, the user accesses the one authentication management area up to a predetermined time before the access to perform authentication. An authentication database management method, wherein a user who has succeeded is preferentially searched in the authentication database, and authentication is performed by comparing the searched user with the accessed user. 3. In a network which is divided into a plurality of authentication management areas, an authentication database for all users is installed in each authentication management area, and a user authentication is performed for each authentication management area. The management area stores a record composed of a field in which a user identifier uniquely assigned to each user is written, a field in which a secret code is written, and an area field in which a code indicating successful authentication is written. Authenticating users with reference to an authentication database having a plurality of authentication databases,
If the user is successfully authenticated, a code indicating the successful authentication is written in the area field of the record related to the user,
Also, upon receiving an authentication request from a user, an authentication server means for preferentially searching for a record in which a code indicating successful authentication is written in the area field and performing authentication, and being connected to the authentication server means, And a network access server for transmitting the authentication request to the authentication server. 4. The apparatus according to claim 3, wherein each record constituting the authentication database further includes a date field in which a date of successful authentication is written, and wherein the authentication server means refers to the authentication database to determine a user's date. When authentication is performed and the user is successfully authenticated, a code indicating successful authentication is written in the area field of the user's record, and the date of authentication is written in the date field of the record for the user, and the user is used again. An authentication database management system, characterized in that when an authentication request is received from a user, the authentication database management system is means for preferentially searching for a record in which a code indicating successful authentication is written in an area field and performing authentication. 5. The authentication database management system according to claim 3, wherein a date field in which a date of successful authentication is written is provided instead of the area field. 6. The authentication server according to claim 4, wherein the authentication server means rewrites the contents of the area field and the date field to predetermined initial values when a predetermined time has elapsed from the date of the date field. And authentication database management system. 7. The authentication server according to claim 3, wherein, when a new record is added to the authentication database, a user uniquely assigned to the user in a user identifier field of the added record. An authentication database management system characterized by means for writing an identifier, writing a predetermined password in a password field, and writing a predetermined initial value in an area field. 8. The authentication server according to claim 4, wherein, when a new record is added to the authentication database, a user uniquely assigned to the user in a user identifier field of the added record. An authentication database management system, comprising: means for writing an identifier, writing a predetermined password in a password field, and writing a predetermined initial value in a date field.