JPH11282804A - Communication system having user authentication function and user authentication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication system which can improve independence and versatility of both service and authentication servers and also can easily secure the common use of the authentication server among plural services. SOLUTION: When an access is given from a client 12 which does not finish authentication of a user yet, a Web page including a redirect request is returned to the client 12 to access a Web server 16 and then to finish the authentication of the user. If the client 12 receives the Web page and accesses the server 16, the server 16 performs necessary authentication processing. If the server 16 succeeds in authentication processing, the server 16 sets this fact at a cookie and returns a prescribed Web page to the client 12. In this case, a redirect request can be included in a Web page to access again a Web service server 10. As a result, the direct accesses can be eliminated to both servers 10 and 16 and accordingly both reliability and versatility of the server 16 can be improved.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a communication system with a user authentication function and a user authentication method, and more particularly to a technique for increasing the versatility of an authentication server in user authentication between a client / server connected to a network.

[0002]

2. Description of the Related Art In recent years, the World Wide Web (WWW)
2. Description of the Related Art A communication environment using the Internet has rapidly spread, and not only mere use at the academic level, but also commercial use such as online shopping and commercial database services has rapidly spread. For full-scale commercial use of WWW in this way, it is essential to establish a technology for performing highly reliable user authentication on the Web server side, and various technologies have been proposed. .

FIG. 6 is a view for explaining a mechanism of client authentication of a service server having an authentication server generally considered in the WWW. As shown in FIG. 1, in the WWW, a client 100 equipped with a Web browser sends a URL (Uniform Resource) to the Internet.
By transmitting a Locater), a resource (hypertext) specified by the URL can be obtained, and a desired image can be displayed on a display.

At this time, if the resource specified by the URL by the client 100 is a resource stored in the Web service server 102 and relates to a service requiring user authentication, the Web service server 102 A hypertext requesting authentication information such as a password and a password is sent to the client 100. In response, the client 100 transmits predetermined authentication information to the Web service server 102.

[0005] In this manner, the Web service server 102 that has received the authentication information from the client 100 uses the dedicated application interface (API) and sends the authentication information to the authentication server 104 that is usually installed in the same domain, that is, in the same LAN environment. The authentication information is transferred and a user authentication process is requested. Upon receiving this request, the authentication server 104 sends the authentication database 10
User authentication is performed with reference to various types of authentication information stored in 6. If the authentication is successful and the user is confirmed to be a legitimate user, a cookie (Cookie) indicating that the client 100 has been authenticated for use in subsequent communication between the Web service server 102 and the client 100. Issue This cookie is
When the hypertext is returned from the service server 102, the information is included in the header portion thereof.
For the access from 00, the Web service server 102 sends the client 10
It is determined that the access is from 0, and the hypertext desired by the user is returned to the client 100 without performing the user authentication in the authentication server 104 again.

[0006]

According to the conventional general user authentication technology described above, user authentication can be performed based on the authentication information transmitted from the client 100, which is sufficient and sufficient for commercial use of the WWW. Security can be ensured.

However, according to the above prior art,
The authentication server 104 is not built as a Web server, and the Web service server 102 used as a front end and the authentication server 104 used as a back end need a deep dependency, and are required for an authentication request and a result notification. Dedicated software is often installed on both sides. For this reason, even if the highly-functional authentication server 104 is constructed, it is transferred to another Web server.
It is difficult to use the authentication server 104 in a service server or the like, and it is difficult to construct an efficient system in which the authentication server 104 is commonly used by a plurality of services.

The present invention has been made in view of the above problems, and has as its object to increase the independence and versatility of a service server and an authentication server, and to easily use an authentication server for a plurality of services. It is to provide a simple authentication system.

[0009]

(1) In order to solve the above problems, the present invention provides a system including a service server, an authentication server, and a client communicably connected to each other on a network. The server includes means for transmitting redirect request information for requesting the client to access the authentication server, when receiving access from the client that has not completed required user authentication, the authentication server comprising:
Means for performing user authentication of the client when accessed by the client, and transmitting to the client information indicating that the user authentication was successful when the user authentication was successful.

(2) In one aspect of the present invention, the means included in the authentication server, when transmitting the information indicating that the user authentication is successful to the client, also transmits the information to the service server. Send redirect request information requesting access.

(3) In still another aspect of the present invention, the client includes means for accessing the authentication server or the service server when receiving the redirect request information from the service server or the authentication server. .

(4) Further, in another aspect of the present invention, when the client has already received the authenticated information from the authentication server, the client accesses the service server to access the authenticated information. Means for transmitting to the service server.

[0013]

Embodiments of the present invention will be described below in detail with reference to the drawings.

FIG. 1 is a diagram schematically illustrating an authentication system according to an embodiment of the present invention. In FIG.
The system b includes a Web service server 10 and a client 12 connected on the Internet, and a Web authentication server 16 also connected to the Internet via a firewall 14.
The web service server 10, the client 12, and the web authentication server 16 are communicably connected to each other. Further, the Web authentication server 16 can access an authentication database 18 installed in the same LAN environment.

In the Web system shown in FIG.
When the client 12 equipped with the “b” browser accesses the Web service server 10 that has not yet completed valid user authentication, the Web service server 10 transmits a Web page including a redirect request to the client 12, and the Web authentication server 16. Request to access again. The client 12 interprets the redirect request and automatically accesses the Web authentication server 16 without user interference as shown by an arrow A in the figure.

Many web browsers are capable of interpreting the request and automatically reloading the designated web page when a hypertext including a "redirect request" is received. The authentication system actively utilizes this function to enable Web
The direct communication between the service server 10 and the Web authentication server 16 has been eliminated, and the versatility of the Web authentication server 16 has been successfully improved.

Thereafter, as shown by arrow A, if the client 12 redirects the request from the Web service server 10 and accesses the Web authentication server 16,
The eb authentication server 16 performs user authentication against the authentication database 18.

Here, if the user authentication is successful in the Web authentication server 16, the Web authentication server 16 transmits a Web request including another redirect request to the client 12.
It transmits page b, and requests that the Web service server 10 be accessed again. At this time, this We
On page b, information indicating that the user has been authenticated is set in the cookie. Then, when the Web service server 10 receives the URL including the content of the cookie, the Web service server 10 transmits a Web page desired by the user to the client 12.

In the present authentication system, since there is no direct access from the Web service server 10 to the Web authentication server 16, the interface between the Web service server 10 and the Web authentication server 16 is to be made very simple. Can be. As a result, the independence and versatility of the service server and the authentication server are enhanced, and the authentication server can be easily shared by a plurality of services.

Further, in the present authentication system, the Web authentication server 16 and the Web service server 10 only need to be installed so as to be accessible by IP on the Internet. You may not be able to access from outside. Furthermore, the Web authentication server 16 and the Web
The service server 10 is not necessarily the same L as in the prior art.
There is no need to install in an AN environment. For this reason, it is possible to easily request the Web authentication server 16 for user authentication from another Web service server 10 which is also installed so as to be IP accessible on the Internet.

Hereinafter, the configuration and authentication procedure of the authentication system will be described in more detail.

FIG. 2 is a diagram showing the configuration of the Web service server 10 together with the overall configuration of the communication system. As shown in the figure, the Web service server 10
pd (Hyper Text Transfer Protocol Daemon) 20
And a file storage unit 22, and httpd
20, a data receiving unit 24, a data analyzing unit 26, data processing units 28 and 30, a data transmitting unit 32, and an httpd setting file 34 are provided. Here, the data storage unit 24, the data analysis unit 26, the data processing unit 28, the data transmission unit 32, and the file reception unit 22 are the same as those provided in a general Web server, and the data processing unit 30 and the httpd The configuration file 34 is a newly added configuration for realizing the authentication system according to the present embodiment. In addition, the file storage unit 22 stores a file related to an authentication failure page for notifying that the user authentication has failed, in addition to the Web page as the service content. The data processing unit 28 is an execution module that is particularly activated by setting in the httpd setting file 34. The data processing unit 28 implements a conventional general access permission / inhibition check by analyzing an http header as a first-stage security check function. As a step security check function, access permission / inhibition check based on the content of the cookie received from the client 12 is performed.

Next, FIG. 3 is a diagram showing a configuration of the Web authentication server 16. In the figure, the Web authentication server 16
Is mostly the same as the Web service server 10, and corresponding components are denoted by corresponding reference numerals. An authentication database 18 is particularly connected to the Web authentication server 16, and the data processing unit 30 a transmits the authentication database 18 when the received URL requests authentication.
, User authentication can be performed.

In this authentication system, first, the W shown in FIG.
In the eb service server 10, the URL transmitted from the client is received by the data receiving unit 24, and the W
The data analysis unit 26 of the web service server 10 acquires the requested file name and various variables from the received URL. Thereafter, the predetermined file, which is the service content, is normally stored in the file storage unit 2 by the data processing unit 28.
2 is processed as necessary and sent to the Internet by the data transmission unit 32. In the Web service server 10, the data processing unit 30 is specified to be activated by the httpd setting file 34, The data processing unit 30 performs a two-stage access permission / inhibition check.

That is, the data processing unit 30 first analyzes the http header as a first-stage access permission check, and determines whether the URL is transmitted from a certain range of IP addresses, for example, a client having a jp domain. Items such as whether or not the request is received are checked. If the check does not match, a Web page indicating that the authentication has failed is sent to the client 12.
Will be replied to.

On the other hand, if this check is satisfied, the access permission / non-permission check of the second stage is further performed. Is confirmed. That is, in the present authentication system, a cookie indicating that the user has been authenticated is issued to the client 12 for which the user authentication has been normally performed by the Web authentication server 16, and the client 12 having been authenticated for the user has been authenticated. When accessing from the Web server, the cookie is transmitted to the Web service server 10.

When the client 12 accesses the Web service server 10, the contents of the cookie transmitted from the client 12 are checked as a second stage access permission check. If it is determined by this confirmation that the access is accompanied by a cookie indicating that the user has been authenticated, the Web page requested by the client 12 is normally returned. On the other hand, if it is determined that the access does not involve a cookie indicating that the user has been authenticated, the client 12
A redirect request such as transmitting a tagged Web page is performed. The META tag is one of the pieces of redirect request information for the client 12, for example, "<META HTTP-EQUIV =" Refresh "CONTENT ="3; URL =
It has a format like authentication request.html ">" in the web authentication server 16. In this example, the request is
3 seconds after arriving at “authentication request.html” stored in the Web authentication server 16 is accessed.

Next, in the Web authentication server 16 shown in FIG. 3, the URL transmitted by redirecting from the client 12 is received by the data receiving unit 24a, and the file requested from the URL received by the data analyzing unit 26a is received. Get the name and various variables. Then, the access from the client 12 is the authentication request.html
, The data processing unit 30a first analyzes the http header as a first-stage access permission check as in the case of the Web service server 10, and if the access does not conform to this check, it indicates that the authentication has failed. Is transmitted to the client 12 with a META tag requesting that the Web page representing the URL be acquired from the Web service server 10. This META tag is
For example, "<META HTTP-EQUIV =" Refresh "CONTENT ="3; U
RL = “authentication failed.html” in the web service server 10
> ”. In this example, “authentication failure.html” stored in the Web service server 10 is accessed three seconds after the request arrives at the client 12.

On the other hand, when the access permission check of the first stage is cleared, the data processing unit 30a further performs user authentication of the client 12. For the user authentication method, for example, the Web authentication server 16 may request the client 12 to transmit authentication information such as a user ID and a password, or the Web service server 10 may transmit predetermined authentication information from the client 12 in advance. The Web server may be received and transferred to the Web authentication server 16 via the client 12 by a redirect request from the Web service server 10 to the Web authentication server 16 by a method such as setting it in a cookie header. W
The data processing unit 30 of the eb authentication server 16 performs user authentication by appropriately making an inquiry to the authentication database 18 based on the obtained authentication information.

If the user authentication fails, the data processing unit 30a reads a predetermined URL from the file storage unit so as to access the Web page stored in the Web service server 10 and indicating that the authentication has failed. A Web page for requesting a redirect to the URL is transmitted to the client 12. On the other hand, if the user authentication is successful, the data processing unit 30
A predetermined URL is read from the file storage unit so as to access the predetermined Web page stored in the URL, and a Web page for performing a redirect request to the URL is transmitted to the client 12. At this time, the Web
In the page header, a cookie indicating that the user has been authenticated is set.

Then, after this, the client 12
When accessing the web service server 10, a cookie indicating that the user has been authenticated will be transmitted together, and the user of the client 12 will be able to normally perform the desired Web page without performing user authentication again. It can be received from the service server 10.

Here, the Web service server 10 sends the W
An authentication procedure for a case where an inquiry to the eb authentication server 16 occurs will be described based on a communication sequence diagram shown in FIG.

First, when the user of the client 12
URL requesting service to service server 10
Is input (S101), the URL is transmitted to the Internet by the client 12 (S102). Thereafter, the Web service server 10 checks whether access is possible (S103). In the above-described access permission check in the second stage, when it is determined that the access request from the client 10 does not include a necessary cookie, the Web service server 10
Including redirect request from client to client 12
The page is transmitted (S104).

In response to this, the client 12 sends the URL to the Internet according to the redirect request, and accesses the Web authentication server 16 (S10).
5). The Web authentication server 16 performs the first-stage access permission check described above and performs user authentication (S106).

If the user authentication is successful, the information indicating that the user has been authenticated is set in the cookie, and a Web page including a redirect request to access the Web service server 10 is transmitted to the client 12 again (S10).
7). At this time, if the user authentication has failed, information indicating that the user authentication has failed may be set in a cookie, and a predetermined Web page may be returned to the client 12. In this case, for example, the Web service server 1
0, it is possible to promptly determine the access from the client 12 that failed in user authentication.

After that, the client 12 returns to the Web service server 10 in accordance with the redirect request contained in the Web page received from the Web authentication server 16.
Is accessed (S108). In this access, the URL transmitted from the client includes a cookie indicating that authentication has been completed, and the Web service server 10 determines that the access is from a client that has successfully completed user authentication (S109), and The Web page is returned to the client 12 (S110). Then, the client 12 interprets the received Web page and performs display display.

As described above, when a cookie indicating that user authentication has failed is set in the Web authentication server 16, the Web service server 10 executes
At 0, a Web page or the like to the effect that access is denied may be returned in response to an access involving such a cookie.

When the client 12 having the authenticated information recorded as a cookie as described above accesses the Web service server 10 after that, the Web service server 10 sends the information to the Web authentication server 16. Do not ask for. FIG. 5 shows the client 12 and the Web service server 10 in such a case.
FIG. 7 is a communication sequence diagram for explaining communication between the server and the server.

As shown in FIG. 3, when the user of the client 12 inputs a URL for requesting a service to the Web service server 10 (S201), the client 12 sends the URL to the Internet (S2).
02). At this time, a cookie indicating that the user has been authenticated is already recorded in the client 12, and the URL transmitted to the Web service server 10 includes the content of the recorded cookie. Thereafter, the Web service server 10 checks whether or not access is possible (S20).
3).

In the access in this case, since it is determined that the access includes a necessary cookie in the access permission check in the above-described second stage, the data relating to the Web page desired by the user is normally transmitted to the client 12. (S204). And
The client 12 interprets the received Web page and performs display display.

The above-described authentication system can be variously modified.

For example, information indicating the expiration date of the user authentication may be set in the cookie indicating that the user authentication has been completed. In this way, even if the Web service server 10 receives a cookie indicating that the user has been authenticated from the client 12, if the cookie has expired, the Web service server 10 accesses the Web authentication server 16 again as necessary. Then, the client 12 can be requested to perform user authentication.

In the above description, the client 12,
It is assumed that the service server and the authentication server are on the Internet and that they comply with the HTTP protocol. However, the present invention does not depend on the protocol or the form of the network, and all network forms having a necessary configuration are provided. It is applicable to.

[0044]

As described above, according to the present invention, direct access between the service server and the authentication server is eliminated, and user authentication is directly performed between the client and the authentication server. Interdependency between the service server and the authentication server can be reduced. Therefore, it is possible to increase the versatility of the authentication server and share the authentication server with a plurality of service servers.

According to the present invention, when the authentication server transmits the authenticated information to the client, the redirect request information is also transmitted to the client. Therefore, the timing when the client accesses the service server again is determined. Can be provided from the authentication server. As a result, for example, the client 12 can access the service server again with the reception of the redirect request information as a trigger.

According to the present invention, when the client receives the redirect request information from the service server, the client automatically accesses the authentication server, so that the user of the client does not perform any special operation. User authentication can proceed.

Further, according to the present invention, when the client receives the redirect request information from the authentication server, the client automatically accesses the service server. The service server can be accessed again without any special operation.

According to the present invention, when the client has already received the authenticated information, the authenticated information is transmitted to the service server when accessing the service server. The client can know that the client has been successfully authenticated.

[Brief description of the drawings]

FIG. 1 is a diagram showing an overall configuration of a communication system according to an embodiment of the present invention.

FIG. 2 is a diagram showing a Web service server according to an embodiment of the present invention, together with an overall configuration of a communication system.

FIG. 3 is a diagram showing a configuration of a Web authentication server according to the embodiment of the present invention.

FIG. 4 is a communication sequence diagram illustrating a state of an inquiry from a Web service server to a Web authentication server.

FIG. 5 shows a client and W that have successfully completed user authentication.
FIG. 7 is a communication sequence diagram illustrating communication with an eb service server.

FIG. 6 is a diagram illustrating a mechanism of user authentication according to the related art.

[Explanation of symbols]

10 Web service servers, 12 clients, 1
6 Web authentication server, 18 Authentication database.

Claims (5)

[Claims] 1. A system including a service server, an authentication server, and a client communicably connected to each other on a network, wherein the service server receives an access from the client that has not completed required user authentication. Means for transmitting redirect request information for requesting the client to access the authentication server, wherein the authentication server performs user authentication of the client when the client accesses the user, and A communication system comprising: means for transmitting, to the client, authenticated information indicating that user authentication has been successful when the authentication is successful. 2. The communication system according to claim 1, wherein said means included in said authentication server, when transmitting said authenticated information to said client, also requests to access said service server. A communication system for transmitting request information. 3. The communication system according to claim 1, wherein the client includes means for accessing the service server or the authentication server when receiving redirect request information from the service server or the authentication server. A communication system, comprising: 4. The communication system according to claim 1, wherein the client, when receiving the authenticated information from the authentication server, accesses the service server. A communication system, further comprising: means for transmitting the authenticated information to the service server. 5. A method for performing user authentication of a client in a system including a service server, an authentication server, and a client communicably connected to each other on a network, wherein the service server performs necessary user authentication. When receiving access from the client that has not been completed, the client transmits redirect request information requesting the client to access the authentication server, and in the authentication server, when there is access from the client Performing a user authentication of the client, and transmitting, to the client, information indicating that the user authentication is successful when the user authentication is successful.