JPH11272614A - Client authentication system and record medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To simply execute authentication without having the client certificate of each user on a WWW server side by registering a condition file in the WWW server and allowing a user to send the client certificate to judge authentication to be OK when a condition item exists in the client certificate. SOLUTION: The WWW server 2 is used for identifying the client of a browser 1 connected through a network and for sending an HTML document of a pertinent page when authentication is OK, and is constituted of an authentication control means 3, a client certificate condition file 5, etc., in this system. A condition item and an item value or an item range to be used for the authentication are set in the file 5. When the condition item set in the file 5 exists in the client certificate and its item value is included when the client certificate is sent from the browser 1, the means 3 judges authentication to be OK and sends the HTML document of the pertinent page.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a client authentication system for authenticating a client and a recording medium.

[0002]

2. Description of the Related Art Conventionally, when a browser accesses a page on a WWW server on which security is set, basic authentication in which a user inputs a user ID and a password to control access is generally used. Basic authentication is a method of defining a user ID that can access each page, checking the user ID with a user ID input from a browser, and controlling access.

[0003]

However, when the basic authentication is used, it is necessary to prepare a management database for managing accessible user IDs on the WWW server side. Also, if the number of users increases,
It is necessary to update the management database, etc.
There was a problem that the W server had to be modified.

[0004] Further, the user must remember the user ID and password, and if the user ID and password are stolen, there is a problem that anyone can access this page.

[0005] The present invention solves these problems,
Register the condition file in the WWW server, send the client certificate to the user, and if the condition item exists in the client certificate, make the authentication OK, and do not have the client certificate of each user on the WWW server side The purpose is to realize authentication easily.

[0006]

Means for solving the problem will be described with reference to FIG. In FIG. 1, a browser 1 accesses a WWW server 2 via a network and
The client sends the L document and displays it on the screen. In this example, the client is a client to be authenticated.

The WWW server 2 authenticates a client of the browser 1 connected via a network, and sends an HTML document of a corresponding page (corresponding URL) when authentication is OK. , An authentication control unit 3, a client certificate condition file 5, and the like.

The authentication control means 3 determines the authentication of the client certificate sent from the browser 1 based on the client certificate condition file 5. The client certificate condition file 5 is a file in which condition items to be authenticated and item values or item ranges are set.

Next, the operation will be described. When the authentication control unit 3 receives the client certificate from the browser 1 and the client certificate includes the condition item set in the client certificate condition file 5 and includes the item value. It is determined that the authentication is OK, and the HTML document of the corresponding page (corresponding URL) is sent.

At this time, the client certificate condition file 5 is set to an arbitrary page, directory, or all provided by the WWW server 2 and the corresponding H is set when the authentication is OK.
The TML document is transmitted to the browser 1 side.

The client certificate condition file 5
A plurality of condition items and item values or item value ranges are set, and it is determined that authentication is OK under these AND conditions. Therefore, by registering the condition file 5 in the WWW server 2 and letting the user send the client certificate and making the authentication OK when the condition item is present in the client certificate, each user on the WWW server 2 side Authentication can be easily realized without the client certificate.

[0012]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Next, an embodiment and operation of the present invention will be described in detail with reference to FIGS.

FIG. 1 shows a system configuration diagram of the present invention.
FIG. 1A shows a configuration diagram. In FIG. 1A, a browser 1 transmits a W through a network such as the Internet.
The client accesses the WW server 2, receives the HTML document, and displays it on a screen. In this case, the client is a client to be authenticated.

The WWW server 2 authenticates the client of the browser 1 connected via a network such as the Internet, or, when the authentication is OK, the H of the corresponding page (corresponding URL).
It sends a TML document or the like, and in this case, it comprises an authentication control unit 3, a security management file 4, a client certificate condition file 5, and the like.

The authentication control means 3 determines the authentication of the client certificate sent from the browser 1 based on the client certificate condition file 5 specified in the security management table 4.

The security management table 4 manages security by registering a client certificate condition file 5 in association with a page (URL). The client certificate condition file 5 is a file in which condition items to be authenticated and item values or item ranges are set.

FIG. 1B shows an example of a client certificate. (B-1) of FIG. 1 shows a client certificate that is authenticated. This is because, in the client certificate condition file 5 of FIG. 1A, {O = AAA Limited U = SEL4-1, SEL4-2, SEL5- *} shown below and the condition item and condition value or Since the condition range is set, the first “O = AAA Limited” is taken out, and it is checked whether it exists in (b-1) of FIG. 1. Limited ”exists, it is OK, and the second eye“ U = SEL4-1, SEL4-2, SEL5- * ”is taken out and it is checked whether it exists in (b-1) of FIG.
Since “U = SEL4-1” exists, the determination is OK, and since the condition items and condition values (or condition ranges) of all the client certificate condition files 5 exist, it is determined that the authentication is OK.

FIG. 1B-2 shows a client certificate serving as an authentication NG. Here, "U = SEL" on the third line
Since “6-2” is not included in the client certificate condition file 5, it is determined that the authentication is NG.

As described above, the WWW server 2 only needs to set the condition items and the condition item values (or condition item ranges) in the client authentication condition file 5, and the browser 1 sends the client certificate of the client. Since authentication OK / NG is determined, the WWW server 2 does not need to manage individual information for each client such as the conventional user ID and password, and updates the database in response to an increase in users or a change in password. There is no need, and authentication OK / NG can be easily determined and managed. This will be described in detail below.

FIG. 2 shows an explanatory diagram of the present invention. here,
The browser (client) 1 and the WWW server 2 are shown in FIG.
(A) corresponds to the browser 1 and the WWW server 2 respectively.

In FIG. 2, S 1 inputs and transmits a “xxx.html” request on the screen of the browser 1. S2 is W
The WW server 2 receives the “xxx.html” transmitted in S1, determines whether the page requires authentication, and transmits a certificate request message. This is because the URL (“xxx.ht.”) of the page received in the security management table 4 of FIG.
ml ") is registered and a page (U
RL), a message requesting transmission of the client certificate is transmitted.

In step S3, a screen is displayed on the browser 1, and a certificate is set on the screen. This is set by selecting one certificate on a certificate selection screen in FIG. 4 described later. Then, it transmits to WWW server 2.

In step S4, client authentication is performed. This determines client authentication OK / NG according to the flowchart of FIG. 3 described later. If OK, the requested HTML document is transmitted, and "xxx.html" is displayed on the screen of the browser 1 in S5. On the other hand, if NG, the process proceeds to S6.

In step S6, the basic authentication request is sent to the browser 1
Send to In step S7, a field for inputting an ID and a password for performing the basic authentication is displayed on the screen of the browser 1, the ID and the password are input, and transmitted to the WWW server 2.

In step S8, basic authentication is performed. this is,
Searches a database (not shown) based on the user ID and password transmitted from the browser 1 and performs authentication OK / N.
Determine G. If OK, the requested HTML document is transmitted, and "xxx.html" is displayed on the screen of the browser 1 in S9.

As described above, when the browser 1 requests an HTML document of a page that requires authentication, the client certificate is sent and collated with the client certificate condition file. Is sent, the screen for basic authentication is displayed on the screen of the browser 1 when NG, the user ID and the password are input and checked, and when OK, the HT of the corresponding page is displayed.
Send and display the ML document and reject it if it is NG.

FIG. 3 shows a flowchart of client authentication according to the present invention. In FIG. 3, S11 receives a certificate. This is received by the WWW server 2 after receiving the client certificate from the browser 1 in S4 of FIG. For example, the client certificate of (b-1) of FIG. 1 described above is received.

In step S12, one condition item of the client certificate condition file 5 is extracted. A step S13 decides whether or not the condition item ends. In the case of YES, the condition items of the client certificate condition file 5 have been checked, so that it is determined that the client authentication is OK in S14, and the HTML document is transmitted to the browser 1 in S15 (from FIG. 2B onward). Process). On the other hand, in the case of NO in S13, S
Proceed to 16.

In step S16, it is determined whether the condition item exists in the client certificate. In the case of YES, the process proceeds to S17. If NO, the client authentication NG in S20
Is determined, and the basic authentication is performed in S21 (the processing after (A) in FIG. 2 is performed).

In step S17, one condition item is extracted. S1
Step 8 determines whether the condition item value ends. In the case of YES, it is determined that the client authentication is NG in S20. on the other hand,
In the case of NO, the process proceeds to S19.

A step S19 decides whether or not the item value of the certificate is included in the condition item value. In the case of YES, the process returns to S12 and is repeated for the next condition item. In the case of NO,
It returns to S17 and repeats.

As described above, the client certificate sent from the browser 1 is authenticated based on the client certificate condition file 5 held by the WWW server 2.
/ NG can be determined.

FIG. 4 shows an example of a certificate selection screen according to the present invention. This is the certificate selection screen displayed on the screen of the browser 1 in S3 of FIG. 2 described above. Here, the client certificate of the page to be authenticated from the certificates 1 and 2 is displayed. The user selects and transmits it to the WWW server 2 to be authenticated.

FIG. 5 shows an example of a document to which the access control of the present invention is applied. Which page of the document is to be set for authentication is set in the security management table 4 of FIG. 1 described above.

FIG. 5A shows an example of a URL. Here, any part (page) such as the part of the URL http://www.xxx.co.jp/DOC/MANUAL/xxx1/html can be set.

FIG. 5B shows an example of an HTML document file unit. In this case, DOC / MANUAL / xxx1 / html
The authentication O shown in FIG.
Access can be made only when K is set.

FIG. 5C shows an example of the entire directory. In this case, the entire directory of / DOC / MANUAL / (all the files under the directory) is set, and can be accessed only when the authentication is OK in FIG. 3 described above.

FIG. 5D shows all examples. In this case, it is set to the whole of / (all directories) and can be accessed only when the authentication is OK in FIG. 3 described above.

[0039]

As described above, according to the present invention,
Since the condition file 5 is registered in the WWW server 2 and the client certificate is sent to the user, and the condition item is authenticated when the condition item exists in the client certificate, the WWW server 2 side Authentication can be easily realized without a client certificate for each user. Accordingly, (1) since the WWW server 2 does not have a client certificate, there is no need to manage the certificate.

(2) Even if the number of users increases, since the information (certificate, ID, password) for each user is not managed, there is no need to update or correct them. (3) Just by defining the security management table 4 and the client certificate condition file 5 on the WWW server 2 side, the range of authentication can be set arbitrarily and easily to any file, directory, or whole.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram of the present invention.

FIG. 2 is an explanatory diagram of the present invention.

FIG. 3 is a flowchart of client authentication of the present invention.

FIG. 4 is an example of a certificate selection screen according to the present invention.

FIG. 5 is an example of a document to which access control of the present invention is applied.

[Explanation of symbols]

 1: Browser 2: WWW server 3: Authentication control means 4: Security management file 5: Client certificate condition file

Claims (4)

[Claims] 1. A client authentication system for authenticating a client, comprising: a condition file in which conditions for permitting client authentication are set on a WWW server side; and a condition file when a client certificate is sent from a browser. A client authentication system comprising: authentication control means for determining that the authentication is OK when the condition item exists and the item value is included. 2. The HTML file according to claim 1, wherein the condition file is set to an arbitrary page, directory, or all provided by the WWW server, and the corresponding HTML document is transmitted to the browser when the authentication is OK. Client authentication system. 3. The client authentication system according to claim 1, wherein a plurality of condition items and item values or item value ranges are set in the condition file, and it is determined that the authentication is OK based on these AND conditions. . 4. A means for setting a condition for permitting client authentication on the WWW server side in a condition file, and when a client certificate is sent from a browser, the condition item set in the condition file exists. A computer-readable recording medium that records a program that functions as an authentication control unit that determines that the authentication is OK when the item value is included.