JP3216602B2 - User authentication system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a user authentication system for authenticating a user for a right to use a specific resource, information, or service in an information processing system.

[0002]

2. Description of the Related Art Conventionally, in order to guarantee the existence, reliability, and validity of an individual or a corporation in an information processing system such as a multi-user system, authentication processing for confirming the validity of user login information has been performed. I have. In order to improve the authentication accuracy, a multi-stage authentication system using a plurality of stages of encryption is employed. In general, this multi-stage authentication system employs a method of performing primary authentication and then performing secondary authentication by a secondary authentication device regardless of the content of the primary authentication. It should be noted that the third and subsequent authentications are similarly executed.

[0003]

However, in such a conventional user authentication system, even if the authentication is performed by using a sufficiently strong authentication method in the primary authentication, if there is a program for executing the secondary authentication, However, even when the secondary authentication is not necessary, the same authentication as the secondary authentication is performed, which wastes machine resources and time, and lowers the efficiency of the authentication. Was.

[0004] The present invention solves the above-mentioned problem. For example, when strong authentication is already performed by checking the authentication result by the primary authentication device, when there is no need to newly perform authentication, the second authentication is performed. An object of the present invention is to provide a user authentication system that can omit authentication by a next authentication device and thereby avoid waste of machine resources and processing time.

[0005]

To achieve the above object, a user authentication system according to the first aspect of the present invention has a client having an application program used by a user and an application program for communicating with the application program. Server, and a primary authentication device that authenticates the user and sends the authentication content is provided, and the secondary authentication device determines an authentication method based on the authentication content sent from the primary authentication device, The authentication of the user is performed.

According to a second aspect of the present invention, in the user authentication system, the primary authentication device authenticates a user by communicating with a device to be authenticated by a client, and sends the authentication contents to the secondary authentication device. It is provided with primary authentication means.

Further, in the user authentication system according to the invention of claim 3, the secondary authentication device determines the secondary authentication method after confirming the authentication content of the user sent from the primary authentication device. A secondary authentication unit is provided for performing secondary authentication by communicating with the authentication target unit of the client based on the determination.

According to a fourth aspect of the present invention, in the user authentication system, the primary authentication device determines a user authentication method based on a primary authentication information file provided in the primary authentication device, and executes an authentication program according to the determination. Primary authentication control means for performing primary authentication by using this is provided.

According to a fifth aspect of the present invention, in the user authentication system, the secondary authentication device includes an authentication content analysis unit for analyzing the authentication content from the primary authentication device, and an analysis content by the authentication content analysis unit. Secondary authentication control means for determining a secondary authentication method for a user based on the secondary authentication information file and performing secondary authentication using an authentication program in accordance with the determination.

[0010]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing a user authentication system according to the present invention. In FIG. 1, reference numeral 1 denotes a client, which is an input / output device 10 for inputting a password, etc., an application program 11 used by a user 0, and a means to be authenticated 12 And a communication unit 14 together with the authentication program 13.

Reference numeral 2 denotes a primary authentication device connected to the client 1 via the network 4, which determines a primary authentication means 21 comprising a primary authentication control means 211 and an authentication content notifying means 212, and an authentication method for the user 0. Primary authentication information file 23 used to perform
An authentication program 22 on the primary side used to perform primary authentication by communicating with the communication unit 14, and a communication unit 24 that communicates with the communication unit 14 and the primary authentication unit 21.

Reference numeral 3 denotes a secondary authentication device connected to the primary authentication device 2 via the network 5, which comprises a secondary authentication means 31 comprising a secondary authentication control means 311 and an authentication content analyzing means 312; The secondary authentication information file 33 used together with the analysis contents obtained by the secondary authentication means 31 to determine the secondary authentication method for the user 0
And a secondary-side authentication program 32 used to perform secondary authentication by communicating with the authenticated unit 12, and a communication unit 34 communicating with the communication unit 24 and the secondary authentication unit 31.

Reference numeral 7 denotes a server, which is an application program 11 on the client 1 side and a communication means 1.
It has an application program 71 for performing communication via 4, 24, 34. The server 7 is connected to the secondary authentication device 3 via the network 6. The communication units 14, 24, and 34 perform communication processing in cooperation with the authenticated unit 12, the primary authentication unit 21, and the secondary authentication unit 12.
Then, the primary authentication unit 21 authenticates the user 0 by communicating with the authenticated unit 12, and sends the authentication contents to the secondary authentication unit 31. Also, the secondary authentication unit 31 confirms the authentication content of the user 0 sent from the primary authentication unit 21, determines an authentication method in the secondary authentication, and communicates with the authenticated unit 12 so that the secondary authentication of the user 0 is performed. Functions to perform the next authentication.

Next, the operation will be described with reference to the flowcharts shown in FIGS. First, in the case where the client 1 and the server 7 share processing and perform one job, in order to enable the application program 11 used by the user 0 to communicate with the application program 71 of the server 7, An access request is sent to the communication means 14 via the input / output device 10 (step A1 in FIG. 2). The communication means 14 sends a request to the communication means 24 to access the server 7, and the user 0
Is started (step A2 in FIG. 2).

The communication means 24 receives the access request via the communication means 14 and instructs the primary authentication means 21 to perform primary authentication (step B1 in FIG. 3). Therefore, the primary authentication control unit 211 in the primary authentication unit 21
Determines the authentication method of the user 0 based on the primary authentication information file 23 (step B2 in FIG. 3), and performs primary authentication by communicating with the means to be authenticated 12 using the authentication program 22 (step B2 in FIG. 3). B3). The user 0 uses the input / output device 10 to input a password or the like as necessary.

Thus, if the primary authentication succeeds,
The communication unit 24 issues an access request to the server 7 to the communication unit 34, and sends the authentication content of the user 0 using the authentication content notification unit 212 (step B4 in FIG. 3). Thereby, the secondary authentication of the user 0 is started (Step A3 in FIG. 1). When the communication means 34 receives the access request and the authentication contents of the user 0 via the communication means 24, it issues an instruction to the secondary authentication means 31 to perform secondary authentication, and passes the authentication contents (step C1 in FIG. 4). Therefore, the authentication content analysis unit 312 analyzes the authentication content, and the secondary authentication control unit 311 determines a secondary authentication method for the user 0 based on the analysis content and the authentication information file 33 (FIG. 4).
Step C2). For this reason, the secondary authentication unit 31 performs secondary authentication by communicating with the authenticated unit 12 using the authentication program 32 (step C3 in FIG. 4). The user 0 uses the input / output device 10 to input a password and the like as needed.

If the secondary authentication succeeds, the secondary authentication device 3 permits access to the server 7 (step C4 in FIG. 4). As a result, the application program 11 of the client 1 can communicate with the application program 72 on the server 7 (Step A4 in FIG. 1). In addition, a predetermined failure process is executed regardless of whether the primary authentication or the secondary authentication fails (step A5 in FIG. 2).

Next, a specific example will be described. The authentication information file 33 of the secondary authentication device 3 is set as shown in FIG. Now, if the user whose user ID is foo is authenticated with the one-time password in the primary authentication device 10.0.0.1 and intends to access the server A, the secondary authentication is omitted. That is, the secondary authentication is successful. In addition, when a user whose user ID is ken is authenticated by a user password method in an arbitrary primary authentication device and intends to access the server B, secondary authentication is performed by a one-time password method.
Furthermore, when the user whose user ID is 0102 has been authenticated by the public key method in an arbitrary primary authentication device, the secondary authentication is omitted. That is, the secondary authentication is successful.

When an arbitrary user who has omitted the primary authentication attempts to access an arbitrary server, the secondary authentication is performed by a public key method. Under this setting, when a user whose user ID is ken tries to access the server B, it is assumed that the user and the user have been authenticated by the primary authentication. In this case, the authentication information as shown in FIG. 6 is passed from the primary authentication device 2 to the secondary authentication device 3. In the secondary authentication device 3, by using this information and the authentication information file,
Decide to perform authentication using the one-time password method.

FIG. 7 shows a client 1, an authentication device 2, 3-
1, 3-2, servers 7-1, 7-2, and 7-3 are connected via networks 4, 5, 6-1, and 6-2. Here, when the authentication device 3-1 performs authentication, the authentication device 2 is a primary authentication device, and the authentication device 3-1.
The authentication device itself is a secondary authentication device, and when the authentication device 3-2 performs authentication, the authentication device 3-1 is a primary authentication device, and the authentication device 3-2 itself is a secondary authentication device.

[0021]

As described above, according to the present invention, a client having an application program used by a user, a server having an application program communicating with the application program, and a user authenticating the user are provided. A primary authentication device for transmitting the authentication content is provided, and an authentication method is determined for the secondary authentication device based on the authentication content transmitted from the primary authentication device.
Since the user is configured to be authenticated, for example, when strong authentication is already performed by checking the authentication result by the primary authentication device, when there is no need to perform new authentication, secondary authentication is performed. The authentication by the device can be omitted, thereby avoiding waste of machine resources and processing time. On the other hand, if the authentication performed earlier is weak,
The effect that a stronger authentication method can be taken is obtained.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a user authentication system according to an embodiment of the present invention.

FIG. 2 is a flowchart showing an operation of the user authentication system shown in FIG.

FIG. 3 is a flowchart showing a procedure of a primary authentication in FIG. 2;

FIG. 4 is a flowchart showing a procedure of secondary authentication in FIG. 2;

FIG. 5 is an explanatory diagram showing setting contents of a secondary authentication information file in FIG. 1;

FIG. 6 is an explanatory diagram showing primary authentication information from the primary authentication device in FIG.

FIG. 7 is a diagram illustrating an example in which a client, an authentication device, and a server are connected via a network.

[Description of Signs] 1 Client 11, 71 Application program 2 Primary authentication device 21 Primary authentication means 211 Primary authentication control means 212 Authentication content notification means 22, 32 Authentication program 23 Primary authentication information file 3 Secondary authentication device 31 Secondary authentication means 311 Secondary authentication control means 312 Authentication content analysis means 33 Secondary authentication information file 7 Server

Claims (5)

(57) [Claims] A client having an application program used by a user; a server having an application program for communicating with the application program; a primary authentication device for authenticating the user and transmitting the contents of the authentication; A user authentication system, comprising: a secondary authentication device that authenticates the user after determining an authentication method based on the authentication content sent from the primary authentication device. 2. The apparatus according to claim 1, wherein the primary authentication device authenticates the user by communicating with a device to be authenticated of a client, and has a primary authentication device for transmitting the contents of the authentication to the secondary authentication device. 2. The user authentication system according to 1. 3. The secondary authentication device determines the secondary authentication method after confirming the content of the user authentication sent from the primary authentication device, and communicates with the authenticated means of the client based on the determination. The user authentication system according to claim 1, further comprising a secondary authentication unit that performs secondary authentication. 4. The primary authentication device according to claim 1, wherein the primary authentication device determines a user authentication method based on a primary authentication information file provided in the primary authentication device, and performs primary authentication using an authentication program according to the determination. The user authentication system according to claim 1, further comprising: 5. The secondary authentication device, comprising: authentication content analyzing means for analyzing the authentication content from the primary authentication device; and a secondary authentication information file based on the analysis content by the authentication content analyzing means and a secondary authentication information file. 2. The user authentication system according to claim 1, further comprising: a secondary authentication control unit that determines an authentication method and performs secondary authentication using an authentication program according to the determination.