JP3437044B2 - User authentication method in client-server system operating under WWW environment - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a user authentication method in a client server system operating in a WWW environment, and more particularly to a logical address assigned to a predetermined client computer and a user who uses the logical address. By continuously checking that the instructions to the WWW server are from a legitimate user.

[0002]

2. Description of the Related Art WWW (World Wide We
b) is Tim Berners- of Switzerland in 1989.
The information system proposed by Lee et al.
It is a system that enables seamless access to any information on the Internet via hypertext including characters, images, and sounds.

A client / server system that operates under the WWW environment is composed of a WWW server that transmits a hypertext screen and a client computer that accesses the WWW server and requests a predetermined process.

In WWW, HTTP (hyper text) is used as a communication protocol between a client and a WWW server.
t transfer protocol). Also, HTML (h
yper text markup language
In addition to using the markup language called e), VRM that can express more realistic graphics including 3D images
L (virtual reality modelin)
g language) or the like.

Further, in the WWW, the hypertext screen displayed by the WWW server can be provided with a "link" not only to the data of the server itself but also to a specific screen of another WWW server. According to the "link" function,
By clicking the button with the link with the mouse, the linked screen can be called up by the client computer. In WWW, URL (Uniform Resou) is used to specify the data of the link destination.
The notation of “rce Language” is used.

Further, in WWW, CGI (Common)
WWW called "Gateway Interface"
By using the interface that links with other applications from the server, it is possible to request the processing to the host computer, the database, and other applications of the server and receive the result.

In the client / server system operating under the above WWW environment, the user accesses the WWW server via the client computer to access the WWW server.
By pressing a button on the screen sent from the server (clicking with a mouse etc.), you can access the specific information (other screen) indicated by the button or request a specific process. .

By repeating the above-mentioned button operation, the user can access desired information from a vast amount of information without difficulty, or can perform information processing by easily following a complicated procedure.

The WWW has brought about an explosive spread of the Internet due to the extremely easy usability and flexible applicability, and recently, the so-called "intranet" in which the WWW is incorporated into a computer system in a company.
Also brought about the spread of.

As described above, the WWW has come to be used for various information processing including general business processing. But,
In order to perform general business processing, a stricter authentication method than a conventional authentication method is required for user authentication.

Now, a user authentication method in a conventional client / server system under the WWW environment will be described with reference to FIGS. 3 and 4.

First, referring to FIG. 3, CG is performed in a WWW environment.
An outline of the processing flow between the client computer and the WWW server when performing business processing using I will be described.

Under the WWW environment, a user who wants to perform a predetermined process first accesses the WWW server 1 by the client computer A, and the user I
Send authentication information such as D and password, and try to obtain permission for use.

When the WWW server 1 recognizes the accessed user of the client computer A as a legitimate user, the WWW server 1 assigns a logical address L1 to the client computer A, and thereafter processes an instruction from the logical address L1 as an instruction from the legitimate user. To do. Following the allocation of the logical address L1, the WWW server 1 sends the first HTML screen to the client computer A.

Several buttons are provided in advance on this HTML screen, and a link to a specific screen and an instruction for activating a specific application software are pasted on each button.

When the user clicks a predetermined button on the screen with a mouse or the like, the HTML screen is sent to the WWW server 1 together with the information that the button has been clicked.

Here, FIG. 3 shows a case where the user sends an HTML screen to the WWW server 1 by clicking a button for starting a predetermined application software.

As shown in FIG. 3, when a screen including an instruction to start a predetermined application software reaches the WWW server 1, the WWW server 1 interprets the HTML screen by the HTML screen interpretation / generation unit 1a. ,
The "instruction for activating a predetermined application software" is extracted, and the processing is entrusted to the CGI 1b.

The CGI 1b activates the specified application software 1c, causes it to perform processing, and then returns the processing result to the HTML screen interpretation / generation unit 1a.

Upon receipt of the processing result, the HTML screen interpreting / generating unit 1a takes in the processing result to generate an HTML screen and returns it to the client computer A through the logical address L1.

By repeating the above processing, as described above, complicated processing can be performed without any error by following the procedure.
Further, the information that the user really wants can be collected in the client computer A.

By the action of the WWW, the screen ordered from the WWW server 1 is stored in the client computer A as shown in FIG. These screens can be switched to turn pages, and new commands can be issued using the previously ordered screen.

Now, a method of user authentication in the processing by the client / server system in the conventional WWW environment will be described below with reference to FIG.

As already explained in part in FIG. 3, the client computer A first accesses the WWW server (step S300).

After connecting to the WWW server, the user sends the user authentication information such as the ID and password to the WWW server via the client computer A (step S310).

On the WWW server side, the authentication information transmitted from the client computer A is checked by a registration table or the like to see if it is a legitimate user. Assign logical address L (step S3)
20).

The logical address L is the address of the connected client computer A as seen from the WWW server. This logical address L corresponds to the IP address or the like of the client computer connected via a table called an address management table. The logical address L is maintained for one connection of the client computer A, clears the correspondence relationship with the client computer A that terminates the connection, and is assigned to the next connected client computer.

After allocating the logical address L to the client computer A, the WWW server processes the command from the logical address L as a command from the authorized user (step S330). That is, after the logical address L is allocated, if the command is from the logical address L, it is processed as a command from a legitimate user without particularly checking the authentication information of the user.

When the communication is completed after processing a series of commands in this way, the WWW server clears the allocation of the logical address L to the client computer A (step S340).

Next, another client computer B
However, when the WWW server is accessed, after confirming the authentication information of the client computer B, the logical address L is assigned (step S350), and the processes of steps S330 to S340 are repeated (step S).
360).

The above is the user authentication method in the client-server system operating in the conventional WWW environment.

[0032]

However, the above-mentioned W
In the conventional user authentication method in the client / server system operating under the WW environment, the legitimate user performs a process other than the permitted process, or
It was not possible to prevent a person who is not a legitimate user from impersonating a legitimate user and performing processing.

That is, as described above, the conventional W
In the user authentication method in the client server system under the WW environment, after the first user authentication, the command from the logical address assigned to the user's client computer is regarded as the command from the already authenticated regular user and processed. .

That is, the instruction from the "logical address" once assigned was processed by the WWW server without any restrictions.

Therefore, a legitimate user who has been assigned a logical address can access any data in the WWW server and can perform processing by any application software.

When a certain logical address L1 is assigned to a client computer A, the client computer B impersonates the client computer A by a method such as writing the IP address of the client computer A in a URL sentence, It was possible to perform various processing and data access to the WWW server through the address L1.

This is extremely inconvenient in business processing.

The WWW on the Internet is intended to easily access desired information among information scattered in networks all over the world and to send it to one's own computer without trouble. Therefore, basically, any user can freely access various information.

On the other hand, in business processing, if a user who can access the WWW server as described above can perform arbitrary processing and data access, for example, a file that cannot be updated by that user. Is updated, or the user acquires data that must be kept secret to the user, and other inconveniences occur.

Further, as described above, since an unauthorized user can impersonate a legitimate user and access the WWW server, there is a possibility that an outsider may falsify and acquire the data, which is extremely useful as a client / server system for business processing. It was inconvenient.

Therefore, the problem to be solved by the present invention is that in a business processing client server system incorporating WWW, a command from a logical address during one connection is a command from a legitimate user who is initially authenticated. It is to provide a user authentication method that guarantees the existence of the user and can limit the files and application software that can be accessed according to the user.

[0042]

[Means for Solving the Problems] The "W" according to claim 1 of the present application.
"User authentication method in a client server system operating in a WW environment" is a method of authenticating a user in a client server system operating in a WWW environment when a WWW server makes a connection request from a predetermined client computer. HTM with re-authentication information that assigns a logical address to the client computer and can use only that logical address
The process of transmitting the L screen to the client computer and the H screen when the HTML screen is received from the predetermined client computer through the predetermined logical address.
A process for confirming whether or not the re-authentication information attached to the TML screen is re-authentication information that can be used only for the logical address, and the logical address when the HTML screen is transmitted to the predetermined client computer through the predetermined logical address. And a process of generating re-authentication information that can be used only by the user, attaching the re-authentication information to the HTML screen, and transmitting the re-authentication information.

According to claim 2 of the present application, "a method of authenticating a user in a client-server system operating under a WWW environment" is the method of claim 1, wherein the re-authentication information is only the logical address which is initially permitted to be used. It is characterized in that it is usable information and has one-to-one correspondence with the HTML screen transmitted / received through the logical address.

According to claim 3 of the present application, "a method of authenticating a user in a client-server system operating in a WWW environment" is the method of claim 1, wherein the re-authentication information is the processing access authority of the user who is permitted to connect. The WWW server regulates the processing access right of the user based on the re-authentication information when confirming the re-authentication information.

[0045]

BEST MODE FOR CARRYING OUT THE INVENTION Next, embodiments of the present invention will be described below. FIG. 1 conceptually shows the processing and data access of a client / server system in a WWW environment incorporating the user authentication method of the present invention.

As shown in FIG. 1, the WWW server 1 of this client server system has an HTML screen interpretation / generation unit 1a, a CGI 1b, application software 1c, and a re-authentication information confirmation generation unit 2.

The re-authentication information confirmation / generation section 2 is an information processing section for generating "re-authentication information" described later or confirming the "re-authentication information" added to the HTML screen.
The re-authentication information confirmation generating unit 2 can be realized by the CPU of the WWW server 1 controlled by the program. In FIG. 1, the re-authentication information confirmation generating unit 2 is shown as an independent part, but it may be one function of the CGI 1b.

Note that the re-authentication information confirmation generating unit 2 actually confirms by combining the "re-authentication information" and the logical address L to which the HTML screen is sent. Confirmation ”.

Next, the processing by the client-server system of FIG. 1 will be described, and the "re-authentication information" will also be described therein.

As shown in FIG. 1, a user who wants to perform a predetermined process uses the client computer A to execute W.
Access the WW server 1 and first send authentication information such as a user ID and password to obtain permission for use.

The WWW server 1 confirms whether the user is an authorized user by collating with a user table (not shown) or the like.

When the WWW server 1 recognizes the user of the client computer A who tried to access as a legitimate user, the WWW server 1 assigns a logical address L1 to the client computer A, and the re-authentication information confirmation generating unit 2 gives the "re-authentication information". First HT to generate and start using
The above "re-authentication information" is attached to the ML screen and transmitted to the client computer A.

The above "re-authentication information" has the following information when it is sent from the client computer A again.
It may be arbitrary as long as it can be recognized that it is sent to the same logical address L1 attached to the HTML screen first.

In the present embodiment, in order to make the re-authentication information more useful, the user authentication information, the file that the user can access, the application software 1c that can be processed, and the HTML screen sent from the WWW server 1 in the order. The re-authentication information is obtained by encrypting information such as a serial number (1, 2, ... The re-authentication information is fixed to the attached HTML screen, and when the screen with the above re-authentication information transmitted and received together with the HTML screen is sent to the client computer A, the user sees the HTML screen on the client computer A. While selecting the button on the screen, click with the mouse.

For example, if the user clicks on the button for activating the predetermined application software 1c with the mouse, the HTML screen displays the information on the clicked button (indicated as "activation CGI instruction" in FIG. 1) again. The authentication information and the like are sent to the WWW server 1.

The HTML screen operated by the user is W
When it reaches the WW server 1, the WW server 1
The ML screen interpretation / generation unit 1a interprets the HTML screen and extracts the user operation and re-authentication information.

The re-authentication information is sent to the re-authentication information confirmation generating unit 2. The re-authentication information confirmation generating unit 2 confirms whether the re-authentication information is the re-authentication information attached to the HTML screen transmitted / received through the logical address L1. If you change the words,
The re-authentication information confirmation generation unit 2 confirms whether or not both the logical address L1 and the re-authentication information indicate the HTML screen from the client computer A of the authorized user who has authenticated first.

Based on the above confirmation, a third party uses another client computer B to send H through the logical address L1.
Even if you send a TML screen, the re-authentication information is different, so
Further processing is rejected.

On the other hand, when the re-authentication information confirmation generating unit 2 can confirm that the re-authentication information is correct, the command sent to the HTML screen is processed.

Here, when the re-authentication information includes the authority information of the user as in the present embodiment, when confirming the re-authentication information, the program that the user can process and the accessible data must be restricted. You can

For example, the re-authentication information may define the authority of the user so that the user can only access his account.

As a result, the processing requested by the user is
Only when the process is permitted by the user, the activation CGI instruction is sent to the CGI 1b, the predetermined application software 1c is operated to perform the predetermined process, and the processed result is returned to the CGI 1b.

The CGI 1b sends the processing result to the re-authentication information confirmation generating unit 2. The re-authentication information confirmation generating unit 2 generates re-authentication information based on the processing result. This re-authentication information may be initial re-authentication information, but is preferably one-to-one re-authentication information with the processing result. In the present embodiment, the serial number is incremented by 1 and encrypted and generated.

Next, the HTML screen interpretation / generation unit 1a
Takes in the processing result, generates a screen by HTML, pastes the generated re-authentication information on the screen, and sends it to the client computer A.

By transmitting / receiving the HTML screen as described above, the user can obtain desired information and can perform desired processing.

By performing the transmission / reception n times, the HTML screen with the re-authentication information 1 to n is accumulated in the client computer A. By the function of WWW,
The user of the client computer A can issue a command to the WWW server 1 using the HTML screen received in the past.

In this embodiment, since the re-authentication information including the serial number is added to each screen, the WWW server 1 can detect the same command on the same screen as the command processed in the past. In this case, the user can be notified that the command has already been processed.

As a result, it is possible to prevent double processing which could not be prevented in the past.

Next, the flow of processing of the user authentication method in the client server system operating in the WWW environment according to the present invention will be described below with reference to the flowchart (FIG. 2).

According to the method of the present invention, as shown in FIG. 2, the client computer A first accesses the WWW server (step S100).

Next, client computers A to W
The first user authentication information is transmitted to the WW server (step S110).

For this authentication information, the WWW server
Whether the user is a legitimate user is confirmed, and if the legitimate user is recognized, the logical address L is assigned to the client computer A (step S120).

Next, at the stage of processing via the logical address L, when the HTML screen is transmitted from the WWW server to the client computer A, the WWW server generates re-authentication information and attaches it to the HTML screen. And sends it to the client computer A (step S
130).

On the other hand, client computers A to W
When sending an HTML screen to a WW server,
The re-authentication information previously generated by the WWW server is attached to the TML screen and transmitted to the WWW server (step S140).

When the WWW server receives the HTML screen, the WWW server can confirm that it is the logical address L assigned to the client computer A and the re-authentication information attached to the HTML screen of the client computer A. Only when the command is executed, the command of the HTML screen is processed (step S150).

The above steps S130 to S150 are repeated, and when the user finishes the desired process, the WWW
Terminate communication with the server.

Upon receiving the communication end signal from the user, the WWW server clears the allocation of the logical address to the user, that is, the client computer A (step S160).

The above-mentioned series of processing is the connection with one client computer and the processing between them. Therefore, when another client computer B next makes an access, the logical address L is set to the client computer B.
(Step S170), the above step S10
The processing from 0 to S160 is repeated (step S180).

[0079]

As is apparent from the above description, according to the "user authentication method in the client server system operating in the WWW environment" of claim 1 of the present application, WWW is provided.
The server assigns a logical address to the client computer that has accessed and authenticated the user, and the HTM with re-authentication information that can be used only by the logical address is added.
Send the L screen to the client computer through its logical address.

Next, when the client computer uses the HTML screen to make a request to the WWW server, the WWW server assigns the re-authentication information to the client computer that first authenticates the user. Check whether the re-authentication information can use only the logical address.

If the above confirmation is affirmative, the WWW server performs the necessary processing, and the HTML screen of the processing result shows
Also, re-authentication information that can be used only by the logical address is attached and transmitted to the client computer through the logical address.

As described above, according to the method of the present invention, re-authentication information that can be used only by the client computer (logical address) in a series of HTML screen exchanges from the first user authentication between the predetermined client computer and the WWW server. Is used and confirmed seamlessly.

Thus, even if a third party interrupts the used logical address and issues an illegal command to the WWW server, the third party does not have the re-authentication information generated by the WWW server. Processing of the illegal command can be prevented. In other words, if the instruction is from a logical address that has been conventionally assigned, it is possible to eliminate the adverse effect of not being able to determine whether the instruction is from an authorized user.

Next, according to the "user authentication method in the client server system operating in the WWW environment" according to claim 2 of the present application, the re-authentication information is information that can be used only by the logical address that is initially permitted to be used. Since the information is one-to-one with the HTML screen transmitted / received through the logical address, it is possible to detect that the same HTML screen has performed duplicate processing.

As a result, it is possible to send a message to the user indicating that the process is a duplicate process and prevent the duplicate process due to an error.

Further, according to the "user authentication method in the client server system operating in the WWW environment" according to claim 3 of the present application, the re-authentication information includes information on the processing and access authority of the user, and based on it. W
Since the WW server restricts the processing and access of the user, it is possible to restrict the processing within the WWW server of the user who is permitted to connect.

As a result, it is possible to prevent unauthorized processing and use by a user who is once permitted to connect to the WWW server.

[Brief description of drawings]

FIG. 1 is an explanatory diagram showing means for realizing a “user authentication method in a client server system operating in a WWW environment” according to the present invention and a processing flow between these means.

FIG. 2 is a flowchart showing a flow of processing by a “user authentication method in a client server system operating in a WWW environment” according to the present invention.

FIG. 3 is an explanatory diagram showing conventional means for “user authentication method in client / server system operating in WWW environment” and a flow of processing between those means.

FIG. 4 is a flowchart showing a flow of processing according to a conventional “user authentication method in a client server system operating in a WWW environment”.

[Explanation of symbols]

1 WWW server 1a HTML screen interpretation / generation unit 1b CGI 1c Application software 2 Re-authentication information confirmation generator A client computer L logical address

Continuation of the front page (56) Reference JP-A-8-249253 (JP, A) JP-A-7-46287 (JP, A) JP-A-7-56796 (JP, A) JP-A-10-97483 (JP , A) JP-A-9-265456 (JP, A) JP-A-9-296819 (JP, A) JP-A-9-325906 (JP, A) Hirohiko Kurokawa 3 others, multimedia information system using VGUIDE Construction, NTT Technology Journal, The Telecommunications Association of Japan, December 1, 1995, Volume 7, No. 12, p. 82-85 (58) Fields surveyed (Int.Cl. ⁷ , DB name) G06F 15/00 G06F 13/00 G06F 12/00

Claims (3)

(57) [Claims] 1. In a client-server system operating in a WWW environment, when a WWW server makes a connection request from a predetermined client computer, it executes user authentication and then assigns a logical address to the client computer. A process of transmitting an HTML screen with re-authentication information that can be used only to a logical address to the client computer, and the HTML screen when the HTML screen is received from a predetermined client computer through a predetermined logical address.
A process for confirming whether the re-authentication information attached to the L screen is re-authentication information that can be used only for the logical address, and the logical address when the HTML screen is transmitted to the predetermined client computer through the predetermined logical address. A method of authenticating a user in a client-server system operating in a WWW environment, which comprises: a process of generating re-authentication information that can be used only by a user and transmitting the re-authentication information attached to the HTML screen. 2. The re-authentication information is information that can be used only by a logical address that is initially permitted to be used, and has one-to-one correspondence with an HTML screen transmitted and received through the logical address. WW according to claim 1.
A user authentication method in a client-server system that operates under the W environment. 3. The re-authentication information defines a processing access right of a user who is permitted to connect, and when the WWW server confirms the re-authentication information, the WWW server processes the user according to the re-authentication information. The method for authenticating a user in a client-server system operating in a WWW environment according to claim 1, wherein the authority is restricted.