JPH1125048A - Method for managing security of network system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To attain single sign-on while holding high level security in a closed network by down-loading a certificate corresponding to a transaction from a certification server according to the input of a synthetic certificate, and executing the certification of a communicated party and the encipherment of communication based on the information of the certificate. SOLUTION: At the time of inputting a synthetic certificate from a client 8 or client 20 connected with another enterprise network system 9, and for example, logging-in a DB server 5, a synthetic certification server 2 confirms the synthetic certificate, and transmits the certificate information of the person concerned to the client 8 or the client 20 and the DB server 5 when access authority is present, and a processing between the client 8 or 20 and the DB server 5 is started. When the client logs in a task server 6, the certificate information of the person concerned is transmitted from the synthetic certification server 2 to the client 8 or the client 20 and the task server 6 so that single sign-on can be realized.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a communication method between a client and a server for performing communication via a network, and more particularly, to a wide area network system having an authentication server for performing user authentication and access control using a certificate. The present invention relates to a security management method for a network system.

[0002]

2. Description of the Related Art With the spread of the Internet, market trends concerning security have changed remarkably. Especially,
An authentication server that integrates the Internet and an intranet is important, and a function of centrally managing users and performing centralized access control in a wide area network system is required.

On the other hand, in recent electronic commerce and communication, authentication processing using a public key-based certificate and communication encryption processing have become mainstream.

[0004]

SUMMARY OF THE INVENTION The inventors of the present invention disclosed in Japanese Patent Application No. 9-76954, filed in Japanese Patent Application No. Hei 9-76954, in order to integrate a wide area network system such as the Internet with an in-company network system. Has applied for a resource access control function, but when considering practical application more practically, it was necessary to consider the management and operation of the certificate itself.

[0005] In the present invention, a single sign-on realization method by referring to user authentication information based on an integrated certificate, and a certificate or a certificate revocation list for each job based on the integrated certificate are communicated to parties involved in communication. This realizes security management for user authentication and communication encryption processing by downloading to a user.

[0006]

According to the present invention, a certificate corresponding to a transaction is downloaded from an authentication server by inputting the integrated certificate, and authentication of a communication partner and encryption of communication are realized based on the information of the certificate.

The present invention is a security management method for a network system in which a client, a business server or a communication partner and an integrated authentication server can communicate with each other via a network. Sends the information and requests the client user to authenticate. The integrated authentication server checks the access authority for the communication request from the client to the business server application or the communication partner. The client encrypts a communication message to the business server or the communication partner using the client-specific key information paired with the certificate information, and the business server or the communication partner uses the certificate information to Check the client and restore the communication message. The business server or the communication partner encrypts the communication message to the client using the key information unique to the business server or the communication partner paired with the certificate information, and the client uses the certificate information to encrypt the communication message to the client. A security management method using an integrated certificate for confirming a partner and decrypting the communication message is characterized.

[0008] Instead of downloading the certificate of the communication party by the integrated authentication server, the communication party manages the certificate and requests the certificate revocation list from the integrated authentication server, so that the client can make the communication request. When checking, the information of the certificate revocation list checks that the certificate of the business server or the communication partner is valid, and if the check is valid, the client transmits a communication message to the business server or the communication partner with the certificate. The information is encrypted using the client-specific key information paired with the information, the business server or the communication partner confirms the client with the certificate information, the communication message is decrypted, and the business server or the communication partner decrypts the client certificate. Is valid in the information on the certificate revocation list. Check Ri, business server or the communication counterpart if the check is valid is encrypted using the business server or the communication partner specific key information comprising a communication message to the client information paired with the certificate,
The client may confirm the business server or the communication partner based on the information of the certificate, and decrypt the communication message.

[0009]

DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 is a configuration diagram of a network system according to the present embodiment.

A wide area network 1 such as the Internet
0, the company network system 1 and the other company network system 9 are connected.

The corporate network system 1 includes an integrated authentication server 2, a server 3 for managing security information, a database (DB) server 5, a business server 6, a groupware server 4, and a key management server 1 in addition to the client 8.
7. Servers such as the certificate issuing server 18 are connected.

The DB server 5 and the business server 6 are servers accessed by the client 8 and used for business processing.

The groupware server 4 is a server that sends the first job menu screen to the client 8, sends an e-mail to the client 8, and manages the schedule of the user.

A client 20 is connected to the other company network system 9, and a user of the client 8 and a user of the client 20 perform a specific task such as an electronic transaction using a certificate.

The server 3 unifies security information including information for controlling access to the DB server 5 and the business server 6 or another company network system 9 and user authentication information including certificate information according to the business. Server to be managed.

The integrated authentication server 2 confirms the integrated certificate sent from the client 8, acquires security information from the server 3, and authorizes the user to access the DB server 5 and the business server 6 or the other company network system 9. The server checks the check, and if the check result is valid, sends a certificate or a certificate revocation list according to the job to the party involved in the communication.

The key management server 17 is a server that generates a key (a pair of a secret key and a public key) of a communication party used for encrypted communication in the enterprise network system 1.

An external certificate issuing server 7 is connected to the wide area network 10. The external certificate issuing server 7 is a server that issues an external certificate according to a predetermined procedure.
The certificate issuing server 18 is a server that issues an integrated certificate in response to a request from the integrated authentication server 2. Note that a server called a directory server may have the information of the server 3. The client 8 and various servers are information processing devices including a personal computer, a workstation, and the like.

Further, by executing a computer program embodied on a storage medium which can be read by the client 8 and various servers, processing of the client 8 and various servers described below can be performed.

When the information of the integrated certificate is input from the client 8 or the client 20 connected to the other company network system 9 and logs in, for example, to the DB server 5, the integrated authentication server 2 confirms the integrated certificate, and performs the integrated authentication. The server 2 obtains security information from the server 3 and checks access authority to the DB server 5. If the user has the access right, the certificate information of the communicating party is sent to the client 8 or the client 20 and the DB server 5, and the processing between the client 8 or 20 and the DB server 5 starts.

The client encrypts a communication message to the DB server 5 using client-specific key information (hereinafter referred to as a secret key) that is paired with the certificate information,
The server 5 confirms the client with the client's public key extracted from the certificate and decrypts the communication message.

The DB server 5 also encrypts the communication message to the client with the secret key of the DB server 5 that is paired with the information of the certificate, and the client uses the public key of the DB server 5 extracted from the certificate. It is possible to identify the other party and decrypt the communication message.

As described above, the certificate information necessary for the transaction is extracted from the information of the integrated certificate, and the validity of these certificates is confirmed by the latest certificate revocation list held by the integrated authentication server 2. Later, it is passed to the communicating party, so that the communicating party does not need to manage the certificate.

When the client next logs in to the business server 6, the integrated authentication server 2 sends the client 8
Alternatively, since the certificate information of the communication party is sent to the client 20 and the business server 6, single sign-on is realized.

FIG. 2 is a diagram for explaining a system in which the server 3 for managing security information manages the security information in a unified manner.

Security information on users and resources (documents, databases, terminal devices, application programs, etc.) managed for each server before the server 3 is introduced is converted into an LDAP by the LDAP information conversion tool.
The data is converted into a format and sent to the server 3 for centralized management. Here, LDAP (Lightweight Data Access Proto
col) is the IETF standard directory access protocol.

FIG. 3 shows an example of the information in the LDAP format.
FIG. 9 is a diagram illustrating a document definition and formats of business server access control information and certificate information.

The definition of a document includes document identification information and document access control information. The document identification information includes the document identifier, the identifier and organization name of the server that manages this document, and the document information (document title, document update date, document manager, keyword for document search, subject,
Abstract, author name).

On the other hand, the access control information of the document includes access control information, final modification information, security policy, and the like. The access control information is information for controlling access to a part of the document, such as access control information for a specific page in the document.

The last modification information is an update date of the access control information. The security policy sets an access level of a user who is permitted to access the document. For example, it is possible to operate such that users having policy numbers 1 to 3 are allowed to access this document.
The document definition is information managed by the business server 6.

FIG. 4 is a diagram for explaining a procedure in which the integrated authentication server 2 obtains user security information from the server 3. LDA is required to obtain security information.
The P protocol is used. The integrated authentication server 2 first establishes an LDAP connection with the server 3 by ldap_open, performs mutual authentication between the integrated authentication server 3 and the server 3 by ldap_simple_bind_s, and then performs ldap_sear
When the integrated certificate number and the user ID of the user are transmitted from the integrated authentication server 2 by ch_s, the server 3 transmits the security information of the user to the integrated authentication server 2.

FIG. 5 is a diagram showing a processing procedure from the time when the user of the client 8 logs in to the corporate network system 1 until the user logs off. Here, a procedure when a user logs in using an integrated certificate will be described.

The client 8 displays a task menu on the display screen of the client 8. The user is the business server 6
Is selected and the integrated certificate information is input from a secret information storage medium such as an IC card, the client 8 encrypts the integrated certificate information with the user's private key and stores it in the storage device. The contents of the integrated certificate encrypted with the user's private key are transmitted to the integrated authentication server 2.

The integrated authentication server 2 checks the integrated certificate after decrypting the encrypted information of the integrated certificate with the user's public key.

The data structure of the integrated certificate is defined by X.509, and its contents include information such as the owner's name, issuer, issuer's signature, and expiration date.

Since the signature of the issuer is encrypted with the private key of the issuer, the signature is first decrypted with the public key of the issuer and compared with the original, and the integrated certificate is valid. Check things. Next, the contents such as the expiration date are confirmed. If the integrated certificate is inappropriate (NG), the client 8
Send a login disallowed message to. If the integrated certificate is appropriate (OK), an inquiry is made to the server 3 to obtain user security information. The procedure is as described above. The user security information includes access control information of the business server 6, access control information of the user, and a certificate of the business server 6 and the user required for the business.

The integrated authentication server 2 compares the access level of the user with the access level of the business server 6 and, if the access of the business server 6 can be permitted, extracts the certificate relating to the business server 6 and the business of the user. By checking the certificate revocation list, the validity of the certificate is confirmed. If the certificate information of both is valid, the access history information indicating that the access of the user is permitted is recorded in the storage device, and the certificate information of both is transmitted to the business server 6 and the user. At this time, since the certificate information is transmitted after being encrypted with the recipient's public key, only the party having the private key can decrypt the certificate information.

The client 8 issues an access request to a document held by the business server 6 to perform business processing. Before that, the mutual authentication process is performed.
This will be described with reference to FIG. After the mutual authentication process is completed, the client 8 can encrypt and send the data to the business server 6. The client 8 encrypts the message using the session key negotiated with the business server 6 during the authentication process. This encryption process is performed by the client 8, so that the user need not be conscious. The encrypted message is decrypted by the session key held by the business server 6, and can be read only by the business server 6. Similarly, when a message is transmitted from the business server 6 to the client 8, the message is encrypted / decrypted using the session key. Since a normal session key uses a one-time-use disposable key, communication confidentiality is high.

In this embodiment, the server creates the session key in the authentication process, but the session key can be created on the client. Also, the method of creating the session key itself follows the protocol sequence of each transaction.

The client 8 records the access history information of the accessed document in the storage device during the business process.

After the business process related to the business server 6 is completed, the business menu is displayed on the display device of the client 8 again. User goes to client 2
Assuming that the electronic transaction processing with 0 has been selected, the client 8 takes out the stored integrated certificate of the user and sends it to the integrated authentication server 2 together with the business request. Therefore,
The user does not need to input the information of the integrated certificate again.

Thereafter, similarly to the above, the integrated authentication server 2 checks the integrated certificate after decrypting the encrypted integrated certificate with the user's public key. The access history information for permitting / disallowing the user to access the electronic transaction processing is recorded.

When the user's access is permitted, the client 8 confirms the validity of the certificate of the client 8 and the client 20 as the business partner, and then transmits the certificate information to the party involved in the communication. The client 8 performs electronic transaction processing with the client 20 using the information of the certificate, and records access history information during the transaction processing.
In this way, when the processing is completed and the user inputs logoff, the client 8 sends the recorded access history information to the integrated authentication server 2 and deletes the information of the integrated certificate stored on the storage device. The integrated authentication server 2
The received access history information is compared with the access history information recorded by the integrated authentication server 2 to check whether the access is appropriate.

FIG. 6 shows an example of a mutual authentication process between the client 8 and the business server 6 which are parties to communication. Although the mutual authentication method follows the transaction protocol, in the example of FIG. 6, mutual authentication is performed by a method of confirming a certificate and a challenge value.

First, the certificate of the user of the client 8 is sent from the client 8 to the business server 6 with the client's digital signature attached. Here, the digital signature is a special data sequence created from the user name using a hash function.
(Eg, a hash value) encrypted with the user's private key.

The business server 6 extracts the hash value by decrypting the received signature with the user's public key included in the certificate. Then, a value is actually created by the hash function from the user name, and it is confirmed whether the value matches the received hash value. Further, it confirms whether the received certificate is valid, and if all the confirmation results are correct, authenticates the user of the client 8.

Next, the business server 6 creates a session key, encrypts it with the user's public key, and transmits it.
The client 8 decrypts the received information with the user's private key and extracts the session key.

Then, on the client 8 side, the created random number (challenge) is encrypted with the session key and transmitted to the business server 6. The business server 6 extracts the challenge by decrypting the received information with the session key. The business server 6 encrypts the challenge and the server name with the business server 6's own private key, and transmits the encrypted server certificate to the client 8 together with its own certificate. The client 8 decrypts the received information with the public key of the business server 6 included in the certificate of the business server 6, takes out the challenge, and confirms whether the challenge matches the information transmitted to the business server 6 by itself. . Further, the electronic signature added to the business server name is verified, and if all the confirmation results are correct, the business server 6 is authenticated.

FIG. 7 shows an example of a process in which the integrated authentication server 2 performs a process of confirming the validity of a certificate and transmitting the certificate by a party involved in communication.

The difference from FIG. 5 is that the communicating party must confirm the validity of the certificate. Before the certificate confirmation processing, the latest certificate is revoked from the integrated authentication server 2. Download the list to see if the peer's certificate is valid. It is also possible to automatically download the certificate revocation list,
For example, when starting the system, starting the first job, ending the job, and the like, the download can be performed in response to the designation.

Although the certificate revocation list is sent to both the client 8 and the business server 6 in the sequence diagram of FIG. 7, the certificate revocation list is sent to the business server 6 and sent from the business server 6 to the client 8. Operation is also possible. Various protocols of electronic trading shall be followed.

As described above, by implementing the present invention, the directory server in the wide area network system centrally manages the information on the resources of the network system. Information and certificate information can be obtained. Thus, the integrated authentication server can authenticate the user with the integrated certificate and control the access of the user, thereby achieving single sign-on for accessing the corporate network system with the integrated certificate. The integrated authentication server can perform user authentication and access control with the integrated certificate, and can transmit a valid certificate to a communication party in response to a user's business request. Since the latest certificate revocation list is also transmitted to the communication party who manages the certificate by himself, mutual authentication using the certificate and encryption processing of the communication are guaranteed. If the user's access request is approved for the user's business or transaction request having the integrated certificate, the business or transaction certificate is transmitted to the communication party. At that time, since the integrated authentication server transmits the certificate after confirming the validity of the certificate with the latest certificate revocation list, the communicating party can start the business assuming that the certificate is valid. On the other hand, when the communicating party manages the certificate and performs communication, the communicating party manages the certificate by himself and checks the validity of the certificate by using the latest certificate revocation list before starting business. Need to get started.

The parties involved in the communication can mutually exchange the authentication and the session key using the information of the certificate, and at the stage when the authentication is completed, the communication can be encrypted using the session key.

Further, the access status of the user can be monitored by cooperation between the client and the integrated authentication server.

[0056]

In a closed network such as a corporate network system connected to a wide area network, single sign-on can be realized while maintaining high security.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a network system according to an embodiment.

FIG. 2 is a diagram illustrating a system in which a server according to an embodiment manages security information in a unified manner.

FIG. 3 is a diagram illustrating an example of information in an LDAP format.

FIG. 4 is a diagram showing a procedure in which the integrated authentication server 2 of the embodiment acquires security information and certificate information from the server 3.

FIG. 5 is a diagram showing a processing procedure of single sign-on using an integrated certificate according to the embodiment.

FIG. 6 is a diagram illustrating a mutual authentication and a session key generation process between communication parties in the processing procedure of FIG. 5;

FIG. 7 is a diagram for explaining a processing procedure in which a communication party manages a certificate and confirms the validity of the certificate by using the latest certificate revocation list.

[Explanation of symbols]

1. Enterprise network system 2. Integrated authentication server
3: server for managing security information, 6: business server, 7: external certificate issuing server, 8: client, 1
7 key management server, 18 integrated certificate issuing server, 20
…client.

Claims (5)

[Claims] 1. A network system in which a client and a server execute communication via a network,
The client sends information of the integrated certificate to the integrated authentication server to make an authentication request, and the integrated authentication server checks the integrated certificate and performs client user authentication processing.
For a communication request from the client to the application of the business server or the communication partner, the integrated authentication server checks the user's access authority to the application or the communication authority to the communication partner. The client transmits a certificate of the client, the business server or the communication partner, and the client encrypts a communication message to the business server or the communication partner using key information unique to the client paired with the information of the certificate. Alternatively, the communication partner confirms the client with the information of the certificate,
The communication message is decrypted, and the business server or the communication partner encrypts the communication message to the client using key information unique to the business server or the communication partner that is paired with the information of the certificate. A security management method for a network system, comprising the steps of: confirming a business server or a communication partner by decrypting the communication message; 2. A method in which a client, a business server, or a communication partner manages a certificate of a communication party in advance and requests a certificate revocation list from the integrated authentication server instead of confirming the integrated certificate by the integrated authentication server. Thus, when the client makes a communication request, the validity of the certificate of the business server or the communication partner is checked by the information of the certificate revocation list, and if the check is valid, the client sends the certificate to the business server or the communication partner. The communication message is encrypted using the client-specific key information that is paired with the certificate information, the business server or the communication partner confirms the client with the certificate information, and decrypts the communication message. Prove that the client's certificate is valid at the communication partner Check with the information in the revocation list, and if the check is valid, the business server or the communication partner encrypts the communication message to the client using key information unique to the business server or the communication partner that is paired with the certificate information. , The client checks the business server or the communication partner based on the information of the certificate,
A security management method for a network system, wherein the communication message is decrypted. 3. The method according to claim 2, wherein the integrated authentication server automatically distributes the certificate revocation list to the client, the business server, or the communication partner. 4. A computer program stored on a storage medium readable by an integrated authentication server of a network system in which a client, a business server or a communication partner and an integrated authentication server can communicate with each other via a network, The program includes the following steps: (a) receiving the information of the integrated certificate transmitted from the client, (b) confirming that the integrated certificate is valid, and (c) receiving the information of the integrated certificate. Check whether the user has the right to access the business server or the communication partner, and if the check results in (d), (b) and (c) are valid, send the certificate to the communication party I do. 5. A computer program stored on a storage medium readable by an integrated authentication server of a network system in which a client, a business server or a communication partner and an integrated authentication server can communicate with each other via a network, The program includes the following steps: (a) transmitting a certificate revocation list to a client that has requested communication, and (b) a certificate revocation list to a business server or a communication partner that requires client authentication. Send