JP4091812B2 - User authentication system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a user authentication system, and more particularly, to a user authentication system suitable for authenticating access by individual users when a large number of users in a company use a client device to access a server device. .
[0002]
[Prior art]
Computer networks have come to occupy an important position as corporate infrastructure, and are indispensable for smooth corporate activities. A computer network system that is widely used in or between companies is a so-called client and server system, in which a plurality of users access a server device using a client device and exchange necessary data. The business process is executed. Such a client & server system is not limited to use within a company or between companies, but is also used when providing various services to general users over the Internet, such as providing web pages. Yes.
[0003]
Generally, maintaining security is very important in a computer network, and in a client & server system, it is necessary to authenticate that a user who has accessed the server device using the client device is a legitimate user. . For this purpose, it is common to perform user authentication by issuing predetermined user IDs and passwords to individual users and collating them at the time of access. In order to ensure stronger security, a client certificate file is stored in the client device used by the user, and user authentication is performed based on three types of information: user ID, password, and client certificate. The method of doing is also taken. Although there are a wide variety of prior art documents disclosing such a general method of user authentication, the applicant has not made prior art documents that disclose contents directly related to the features of the present invention at this stage. Since it is not recognized, prior art document information is not described in this specification.
[0004]
[Problems to be solved by the invention]
As described above, user authentication using a user ID and password, or user authentication in which a client certificate is further added to this, is an environment where regular access rights are given semi-permanently to individual users. There will be no major obstacles. However, when there is a possibility that the access right given to the user may fluctuate, some measure is required to ensure sufficient security. For example, even if a given user ID and password is given to an employee of a company and some access right is granted, when the employee leaves the company, the access right must no longer be extinguished. . In the case of a general in-house LAN system within a company, when an employee retires, the system administrator invalidates the user ID and password for the employee and revoke the access rights of the employee. Easy. However, in the case of a large-scale inter-company network system in which a large number of companies participate in each other, it is extremely difficult for a system administrator to grasp all the retirement status of individual employees in each participating company. In addition, it is difficult to take a reliable response.
[0005]
Recently, with the spread of the Internet, electronic commerce has been actively carried out, and an inter-company transaction system using an intermediary site called a so-called marketplace has been operated. Thus, in an electronic commerce system on a network in which a large number of companies participate, it is practically difficult for a system administrator to accurately grasp changes in all employees of all participating companies. For this reason, there is a risk that a retired employee will perform unauthorized access as a legitimate user using the user ID and password given during his tenure. Such unauthorized access cannot be completely prevented even by an authentication system that requires a client certificate. Normally, a client certificate is stored as a file in a client device such as a personal computer used by the user. If the client certificate can be copied and taken out to the outside, Unauthorized access as a user can be continued.
[0006]
Therefore, an object of the present invention is to provide a user authentication system capable of easily ensuring sufficient security even when the access right given to a user varies.
[0007]
[Means for Solving the Problems]
(1) A first aspect of the present invention is a user authentication system for authenticating access by individual users when a plurality of users access a server device using a client device.
For each individual user, Respectively, User data including a user ID for identifying a user, a password given to the user, a first email address, and a second email address different from the first email address A registered user data registration unit;
A password update unit for updating a password for each individual user registered in the user data registration unit for each predetermined period;
When the password for the predetermined user is updated by the password updating unit, the updated password is transmitted to the second e-mail address registered for the predetermined user as a new password for the predetermined user. A password transmission unit;
When sending notifications other than passwords to a given user, A general notification transmitter for transmitting notifications other than passwords to the first e-mail address registered for the predetermined user;
Whether or not the access is by a legitimate user by comparing the entered user ID and password with the registered content of the user data registration unit when there is an access accompanied by the user ID and password input from the user A user authentication unit for authenticating
Is provided.
[0009]
(2) Of the present invention Second Aspects of the above First In the user authentication system according to the aspect of
When the update by the password update unit is performed, the information indicating the last update time and the information indicating the next update time are registered in the user data registration unit as part of the user data. The automatic update is performed by referring to the information indicating the next update time.
[0011]
(3) Of the present invention Third Aspects of the above 1st or 2nd In the user authentication system according to the aspect of
The user authentication unit further has a function of authenticating the authenticity of the client certificate stored in the client device, and performs user authentication using all three pieces of information such as a user ID, a password, and a client certificate. It is a thing.
[0012]
(Four) Of the present invention 4th Aspects of the above 1st to 3rd A user data registration unit, a password update unit, a password transmission unit, which are components of the user authentication system according to the aspect of General notification transmitter, As a user authentication unit, a program for causing a computer to function is prepared and stored in a computer-readable recording medium so that it can be distributed.
[0013]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, the present invention will be described based on the illustrated embodiments.
[0014]
<<< §1. Basic concept of the present invention >>
FIG. 1 is a block diagram showing a configuration of a computer network system using a user authentication system according to an embodiment of the present invention. This system is a so-called client and server system, and a plurality of users access the server device using the client device. Here, a general operation form using the Internet N as a network is shown, but the present invention is of course not limited to an embodiment using a large-scale network such as the Internet. The present invention can also be applied to a system using a medium / small network such as an in-house LAN.
[0015]
In FIG. 1, client apparatuses 10 to 40 are personal computers operated by users A to D, respectively, and have a function of accessing a server apparatus via the Internet N. The illustrated component 50 is a user authentication system according to the present invention, and has a function of authenticating that this access is an access from a legitimate user when there is an access from the user via the Internet N. . The illustrated component 60 is a server device main body that is a target of access by the user, and each user A to D is a server device only when authenticated by the user authentication system 50 as a legitimate access. Access to the main body 60 becomes possible.
[0016]
Here, for convenience of explanation, the user authentication system 50 and the server device main body 60 are shown as separate blocks. However, in practice, the user authentication system 50 is a single server device including the server device main body 60. It can be configured as one function. As shown in the figure, the user authentication system 50 is composed of four elements, that is, a user data registration unit 51, a password update unit 52, a password transmission unit 53, and a user authentication unit 54. Is realized by the hardware of the server device and the dedicated software incorporated therein. In addition, here, for convenience, a simple example in which four users A to D access the server device main body 60 using the client devices 10 to 40, respectively, is shown. However, the present invention is actually more users. It is an invention suitable for use in a computer network system used by.
[0017]
The user authentication method by the user authentication system 50 is basically an authentication method using a user ID and a password, as in the conventional method. In other words, each user A to D is given a unique user ID and password, and when accessing the server device main body 60, the user ID and password are transmitted from the client device, and the user authentication system 50 uses them. Will be confirmed. However, as described above, when the access right given to the users A to D is given based on the qualification of an employee in a predetermined company, a problem occurs at the time of retirement. As described above, the user authentication system 50 according to the present invention has a function of easily ensuring sufficient security even when there is a possibility that the access right given to the user may fluctuate.
[0018]
The features of the user authentication method by the user authentication system according to the present invention are summarized in the following three points. Feature 1: Individual users are not authorized to change their passwords. Feature 2: Passwords given to individual users are updated every predetermined period. Feature 3: The updated new password is notified by e-mail to another user other than the user, not the user himself / herself.
[0019]
Feature 1 is effective in ensuring prevention of unauthorized access after retirement when circumstances such as employee retirement occur. In general computer network systems, an initial password is given to each user in advance, and if the user desires, it is often used to permit the initial password to be changed as needed. In practice, it is not preferable from the viewpoint of security to continue to use the same password for a long period of time. Therefore, there is a case where the user is actively encouraged to change the password. On the other hand, in the present invention, the password is forcibly updated from the user authentication system 50 side by the feature 2 described later, and therefore, the same password is not continuously used for a long period of time. According to the feature 1, since the user side is prohibited from changing the password, the password management is performed only on the user authentication system 50 side, and the access right given to the user varies. However, sufficient security can be ensured.
[0020]
Feature 2 has the meaning that a predetermined expiration date is set for each password given to each user. The system administrator can arbitrarily set the predetermined period for updating the password. This period may be a fixed period such as every week, every month, every three months, or an irregular arbitrary period may be set as needed. In addition, for example, a separate update period may be set for each user, such as 3 months for managers of managers or higher, 2 months for managers, and 1 month for general staff. In order to increase the level of security, it is preferable to set the update period as short as possible. However, as will be described later, when updating, it is necessary to notify the user of a new password. If it is too short, the frequency of notification of new passwords will increase, and complicated work will be forced. Therefore, in practice, the system administrator sets an optimal update period in consideration of the degree of security to be secured and the operation mode of password notification.
[0021]
Feature 3 relates to a new password notification method after update. According to the above-described feature 2, each user's password is updated every predetermined period, and each user is notified of the updated new password. This notification is not sent to the user himself / herself but to another user. This is done using e-mail. For example, when a new password is notified to a specific user, the e-mail address of another user (a user who can know a change in the job of the specific user) such as a supervisor or a colleague of the specific user Will be notified. In the normal case, this boss or co-worker will give a new password by giving oral or memos to the specific user (this may be by e-mail or telephone). If so, the new password will not be communicated. In this way, by notifying the user of the new password by e-mail not to the user himself / herself, the access right for the retired user can be automatically invalidated after the password is updated.
[0022]
<<< §2. Operation of the user authentication system according to the present invention >>
As shown in FIG. 1, a user authentication system 50 according to an embodiment of the present invention includes a user data registration unit 51, a password update unit 52, a password transmission unit 53, and a user authentication unit 54. As described above, the substance of the user authentication system 50 is software incorporated in the server device, and each of these components is in the form of a computer program on the assumption that the hardware of the server device is used. This computer program can be distributed by being recorded on a computer-readable recording medium such as a CD-ROM or MO.
[0023]
For each individual user, the user data registration unit 51 includes a user ID for identifying the user, an email address of the user, a password assigned to the user, a transmission destination address indicating a transmission destination of the password, Is a component having a function of registering user data including. The illustrated example is an example in which four users A to D are users of this system. Therefore, in the user data registration unit 51, user data Da for user A, user data Db for user B, A state in which user data Dc for the user C and user data Dd for the user D are stored in the user data registration unit 51 is shown. Each of these individual user data Da to Dd includes information such as a user ID, a password, an e-mail address, and a transmission destination address for each of the users A to D.
[0024]
The first important point here is that the password registered in the user data registration unit 51 cannot be changed at least by access by the person due to the feature 1 described above. In the case of the embodiment shown here, each user can freely change his / her own e-mail address registered in the user data registration unit 51, but other registration information is from the user side. The specification is such that it cannot be changed at all. That is, the user ID, password, and destination address can be registered or changed only by automatic processing by the user authentication system 50 itself or by operation processing of the system administrator.
[0025]
Another important point is that due to the above-described feature 3, the transmission destination address registered in the user data registration unit 51 (the electronic mail address indicating the transmission destination of the new password) is the same as the electronic mail address of the user himself / herself. Is the email address for another different user. For example, the user A's own e-mail address is registered in the user data Da for the user A, but the destination address registered in the user data Da is also the user A's own e-mail address. Instead, it is the email address of another user, for example, user D. Therefore, in this case, when the password for the user A is updated, the updated new password will be notified to the email address of the user D. The user A is notified of the new password. Of course, when the user A has retired, the user D will not be notified of a new password by the user D, so the retired user A will be updated after the password is updated. You can no longer authenticate as a legitimate user.
[0026]
The password update unit 52 is a component having a function of updating the password for each individual user registered in the user data registration unit 51 for each predetermined period. The system administrator sets an update period for each user to an appropriate period for the password update unit 52 in advance. The password update unit 52 automatically performs a process of updating a new password with respect to the password that is about to be updated, while monitoring the update period. Since various methods based on a predetermined algorithm are known for generating a new password, detailed description thereof is omitted here.
[0027]
When the password update unit 52 updates the password for the predetermined user, the password transmission unit 53 uses the updated password as a new password for the predetermined user as a transmission destination address registered for the predetermined user ( A function of transmitting to another user's e-mail address). The new password transmission process may be performed at the same time when the password in the user data registration unit 51 is updated by the password update unit 52, or may be performed without delay after the password update. Since a slight time lag occurs until the password is notified to the user himself / herself, a new password by the password transmission unit 53 is practically earlier by a predetermined period than when the password update by the password update unit 52 is performed. Is preferably transmitted. For example, the password update unit 52 monitors whether there is a password that is about to be updated after 3 days. If such a password exists, the password update unit 52 generates a new password in advance. Then, the password transmitting unit 53 executes a process for notifying this. In this case, the notification content should clearly indicate that a new password will be switched after 3 days. Then, when the update time after three days has come, the password update unit 52 may actually update the password registered in the user data registration unit 51.
[0028]
For example, when the update time for the password of the user A is approaching three days later (July 4) as of July 1, a new password is generated by the password update unit 52 and the password is transmitted. For example, to the user D of the boss (to the transmission destination address in the user data Da) by the section 53, “User A's password will be changed to **** from July 4th. Please send an e-mail saying "Please notify the person to that effect." If the user D transmits a new password to the user A within 3 days, the user A can access with the new password after updating the password. As described above, the password transmission unit 53 has a function of transmitting the updated password when the password for the predetermined user is updated by the password update unit 52. Here, “when the password is updated”. This means not only when the password in the user data registration unit 51 is actually updated, but also before and after that within a range that does not impede practical use of the user.
[0029]
The last user authentication unit 54 compares the input user ID and password with the registered content of the user data registration unit 51 when there is an access accompanied by the input of the user ID and password. Is a component that authenticates whether or not is by a legitimate user. As a result of the user authentication in the user authentication unit 54, if it is determined that the user is a legitimate user (that is, the combination of the user ID and password transmitted from the client device is registered in the user data registration unit 51). If they match, access to the server apparatus main body 60 is permitted for the user. Since such authentication processing is already a known technique, detailed description thereof is omitted here.
[0030]
FIG. 2 is a table showing a specific example of user data stored in the user data registration unit 51. In this example, user data Da to Dd for each of four users A to D are shown for each column. Each individual user data includes data of company name, user ID, password, last update date, next update date, e-mail address, and destination address.
[0031]
In this example, the users A to D are employees who belong to the same company “PATENT Co., Ltd.”. Looking at the user data Da for the user A, the company name “PATENT Co., Ltd.”, the user ID “A” (actually a longer ID code is used), the password “******” (actually Is stored as the password, the data is August 1, 2002 as the last password update date, and September 1, 2002 as the next update date. This is information indicating that the currently valid password is a password updated on August 1, 2002, and that the password should be updated on September 1. By referring to this information, the password update unit 52 performs a password update process when September 1st arrives, and at the same time, updates the data of the last update date and the next update date. In practice, as described above, the password transmission unit 53 transmits a new password at a point earlier than the next update date by a predetermined period (for example, three days ago).
[0032]
As described above, when the update by the password update unit 52 is performed, the information indicating the last update time and the information indicating the next update time are registered in the user data registration unit 51 as a part of the user data. If the password update unit 52 performs automatic update by referring to the information indicating the next update time, the basic operation of the system can be automatically performed. The burden is greatly reduced.
[0033]
In FIG. 2, an e-mail address “aaa@pat.co.jp” registered as user data Da for the user A is the e-mail address of the user A himself, but the destination address “ddd@pat.co.jp”. “jp” is the email address of the user D who is the boss of the user A. In this example, under the setting that the user D is the boss of the users A, B, and C, the transmission destination addresses for the users A, B, and C are all set to the e-mail address “ddd @ pat of the user D. .co.jp ". In addition, the transmission destination address for the user D is the e-mail address “eee@pat.co.jp” of another user E (for example, a user who is a supervisor of the user D or a user of a colleague). . As described above, each user's own e-mail address can be freely changed by the user, but other data is automatically updated by the password update unit 52 or set by a system administrator's instruction. This is data that should be changed by individual users.
[0034]
After all, in the embodiment shown in FIG. 2, the passwords of the users A to C are updated every other month, and each new password is notified by an e-mail addressed to the user D. . Therefore, each of the users A to C receives a notification of a new password from the user D who is a boss and uses this to access the server apparatus main body 60. Even if any of the users A to C is retired, the user D is not notified of a new password. Therefore, after the password is updated, the retired user loses the normal access right. It will be. As described above, when the user authentication system according to the present invention is used, sufficient security can be easily ensured even when the access right given to the user varies.
[0035]
In the above-described embodiment, each user's own e-mail address is registered as data constituting part of the user data in the user data registration unit 51. However, in the user authentication system according to the present invention, The user's own e-mail address is not necessarily prepared. In the above-described embodiment, the user's own e-mail address is registered in the user data registration unit 51 so that a general notice (notification other than a password) can be sent to the user by e-mail. Convenient. For example, if the user data Da as shown in FIG. 2 is registered, if it is necessary for the user authentication system 50 to notify the user A, the notification is a general notification (notification other than password: For example, if it is a notification such as “The server will be inaccessible due to maintenance of the authentication system from 3:00 am to 6:00 am on August 1st”, send it to “aaa@pat.co.jp” However, the user authentication system 50 transmits the information to “ddd@pat.co.jp” if the password is notified, as shown in FIG. Operation to automatically switch destinations becomes possible. Therefore, when it is not necessary to send a general notification to each individual user by e-mail, it is not necessary to register the e-mail address of the user. Of course, the user's own e-mail address may be registered in the server apparatus main body 60 instead of the user authentication system 50.
[0036]
In the above-described embodiment, the authentication process in the user authentication unit 54 is performed based on the user ID and the password. However, it is possible to add authentication using a client certificate. When such an operation is performed, a predetermined client certificate may be prepared as a file in each client device. FIG. 3 is a diagram showing a data configuration for authentication prepared in the storage device 11 (hard disk or the like) of the client device 10. As illustrated, in the storage device 11, “client certificate” is stored in addition to “user ID: A” and “password: *****”. When receiving the access from the client device 10, the user authentication unit 54 further authenticates the client certificate in addition to the authentication by “user ID: A” and “password: ********”. Processing for authentication is performed, and user authentication is performed using all three pieces of information including a user ID, a password, and a client certificate.
[0037]
<<< §3. Specific usage example of the present invention >>
In the case of a general in-house LAN system within a company, when an employee retires, the system administrator invalidates the user ID and password for the employee and performs a process to revoke the employee's access rights. Easy. Therefore, the user authentication system according to the present invention is practically used in a relatively large-scale system in which it is difficult for a system administrator to grasp all retirement situations of individual users, that is, a large number of companies. It is suitable for use in a large-scale enterprise network system that takes the form of mutual participation. Here, an example of such a system will be described based on the block diagram of FIG.
[0038]
The system shown in FIG. 4 is a business transaction support system disclosed in Japanese Patent Application No. 2002-027730, and is a system that falls under the category of an inter-company transaction system using an intermediary site called a so-called market place. In the illustrated example, the persons in charge A to D who belong to the commodity supplier S1 and the persons X to Z who belong to the commodity distributor W1 become users and use this system. The client devices 110 to 140 are personal computers used by the persons in charge A to D, and the client devices 210 to 230 are personal computers used by the persons in charge X to Z. The server device 300 has a function of receiving an access from each of these client devices and mediating an inter-company transaction.
[0039]
Specifically, the server apparatus 300 includes a fixed form providing unit 310, a search processing unit 320, an order processing unit 330, a portal site providing unit 340, and a user authentication system 350. The fixed form providing unit 310 is provided with a fixed form such as a fixed form for information input and a fixed form for ordering. The persons in charge A to D of the commodity supplier S1 download the information input standard form, write various information about the provision target commodity, and upload it to the server apparatus 300 again. On the other hand, the persons in charge X to Z of the merchandise distributor W1 access a predetermined portal site provided by the portal site providing unit 340 and give an instruction to search for a predetermined product to be purchased. Then, the search processing unit performs a search for information uploaded by the product supplier W1, and presents it when information on the target product is searched. If the person in charge X-Z looks at the search result and wants to place an order, he / she downloads the standard form for ordering from the standard form provider 310, writes various information about the product to be ordered, When uploading to the server apparatus 300 again, the order processing unit 330 processes the order contents. That is, an order is automatically made to a predetermined person in charge on the commodity supplier S1 side.
[0040]
Such a commercial transaction brokerage service provided by the server apparatus 300 should, of course, be provided only to specific users to be trusted, and access to the server apparatus 300 is limited only to these specific users. Must be done. Therefore, user authentication is performed by the user authentication system 350. That is, the user authentication system 350 performs a function of permitting original access to the server device 300 after performing authentication for the user when there is an access from the user via the Internet N. FIG. 4 shows only an example in which this server device 300 is used by two companies, that is, the commodity supplier S1 and the commodity distributor W1, but actually, a large number of commodity suppliers S1, S2, S3,. A large number of merchandise distributors W1, W2, W3,... As described above, in an electronic commerce system on a network in which a large number of companies participate, it is a fact that the system administrator who manages the server apparatus 300 accurately grasps changes in all employees (users) of all participating companies. It is difficult.
[0041]
In a large-scale commercial transaction system employing such an operation mode, it is extremely effective to apply the user authentication system according to the present invention. That is, if the user authentication system according to the present invention described above is used as the user authentication system 350 shown in the figure, sufficient security can be secured in practice without complicated system management by the system administrator. become. That is, the password given to each person in charge A to D, X to Z is updated every predetermined period, and the new password after the update is not the person in charge itself, You will be notified by e-mail to another person in charge, such as your boss or colleagues. Therefore, the person in charge of retirement is not notified of a new password, and security is ensured. In addition, the system administrator who manages the server device 300 does not need to accurately grasp the circumstances such as whether or not each user (person in charge) has retired.
[0042]
【The invention's effect】
As described above, according to the user authentication system of the present invention, sufficient security can be easily ensured even when the access right given to the user varies.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a computer network system using a user authentication system according to an embodiment of the present invention.
FIG. 2 is a table showing a specific example of user data registered in a user data registration unit 51 shown in FIG.
FIG. 3 is a diagram illustrating data stored on the client device side when user authentication is performed using a user ID, a password, and a client certificate.
FIG. 4 is a block diagram showing a form in which the user authentication system according to the present invention is used in a system that falls into the category of an inter-company transaction system using a so-called marketplace-based brokerage site.
[Explanation of symbols]
10-40 ... Client device
11 ... Storage device
50 ... User authentication system
51 ... User data registration section
52. Password update unit
53 ... Password transmission part
54: User authentication unit
60 ... Server device body
110-140 ... Client device
210-230 ... Client device
300 ... Server device
310 ... fixed form providing section
320 ... Search processing section
330 ... Order processing section
340 ... Portal site provider
350: User authentication system
A to D, X to Z ... User (person in charge in the company)
Da to Dd: User data
N ... Internet
S1 ... commodity supplier
W1 ... Merchandise distributor

Claims (4)

A user authentication system for authenticating access by individual users when a plurality of users access a server device using a client device,
For each individual user, respectively, and a user ID for identifying a user, and a password allocated to the user, the first e-mail address, a second e-mail that is different from the first e-mail address A user data registration unit in which user data including an address is registered;
A password update unit for updating a password for each individual user registered in the user data registration unit for each predetermined period;
When the password for the predetermined user is updated by the password update unit, the updated password is transmitted to the second e-mail address registered for the predetermined user as a new password for the predetermined user. A password transmission unit;
A general notification transmission unit that transmits a notification other than the password to the first e-mail address registered for the predetermined user when transmitting a notification other than the password to the predetermined user;
When there is an access accompanied by the input of a user ID and a password from the user, the access is made by a legitimate user by comparing the input user ID and password with the registered content of the user data registration unit. A user authentication unit for authenticating
A user authentication system comprising: The user authentication system according to claim 1,
When the update by the password update unit is performed, the information indicating the last update time and the information indicating the next update time are registered in the user data registration unit as part of the user data. A user authentication system, wherein automatic update is performed by referring to information indicating the next update time. The user authentication system according to claim 1 or 2,
The user authentication unit further has a function of authenticating the authenticity of the client certificate stored in the client device, and performs user authentication using all three pieces of information such as a user ID, a password, and a client certificate. A user authentication system.   The program for functioning a computer as a user data registration part, a password update part, a password transmission part, a general notification transmission part, and a user authentication part used as the component of the user authentication system in any one of Claims 1-3.

Images