DE10128729A1 - User log-on procedure via service unit connected via authentification unit to user, involves log-on of user after first- and second-authentification via log-on information with service unit - Google Patents

Abstract

A method of logging-on or registering a user with a service unit joined via an authentifying unit to the user, in which the user within the framework of a first authentification communicates first authentification information to the authentification unit, and in a second authentification a second authentification information is communicated to the service unit. The user communicates a log-on information to the authentifying unit and the latter relays this information of the user to the service unit. After first- and second-authentification, the user is logged on or registered by using the log-on information with the service unit.

Description

The invention relates to a user registration process for a service unit associated with the user and a corresponding arrangement for logging in a user.

Such a registration process is known, for example, from [1] and is shown schematically in FIG. 2.

FIG. 2 shows a computer network 200 , a client-server network, with computers connected to one another via data lines 201 . In this client-server network 200 , a server 210 is connected to various users 220 , 230 , so-called clients, via the data lines 201 .

Further basics of a client-server network are from [4] known.

The server 210 performs administrative tasks as well as service tasks in the client-server network 200 . Such administrative tasks are, for example, monitoring and control of data transmitted in the data network, monitoring and administration of the clients networked with the server, administration and access control of data stored on the server computer and transferable in the client-server network.

Service tasks of a server computer can be one Provision of data and / or applications by the Clients used or used and / or accessed can be.  

Typically, not all of a server is in one Client-server network data provided for al clients networked with the server to the same extent cash or available. In particular on confidential data or also for paid applications, which are from a Ser only a limited user can be offered circle of all clients connected to the server, so-called authorized users to be authorized to access.

Furthermore, it is common within a larger client Server network individual smaller sub-networks, so-called intra nets, to which not all clients of the larger, parent client-server network have access.

To limit this network access to authorized clients as well as access to non-generally available data on li mitieren and thus a confidentiality of such protected Attempting to secure data is the result of attempted access or access the identity of the groove seeking access zers (authentication) and the authorization of access checked the user (authorization).

As is known from [1], this check is carried out by a two-stage combined registration method 250 , in which an authentication or identification 251 of the accessing user against the server in a first stage with an authorization or check 252 of the authorization of the accessing user in a second Stage is combined.

The authentication 251 , ie the identification, of a user against a server is usually carried out by a so-called user certificate. Such a user certificate is clearly an electronic passport issued by a trustworthy "authority". This allows its owner to access or use a network, but without authorizing the user to access certain data or certain applications in the network.

The basics of such user certificates can be found in [6] known.

The authorization 252 for access to certain data or certain applications is checked in the second stage, ie when a user is authorized 252 .

This authorization 252 is usually carried out by a password-protected registration process. In the case of such a password-protected registration process, a generally secret password is agreed in advance between the user and the server, as is known. Only this authorizes its owner to access protected data.

Only such a user who owns the agreed and the password authorizing access to the server proves access to the password-protected data granted.

In the known from [1] two-stage combined registration process 250 of requesting the access and access client is prompted by the server to identify themselves to the server.

For this purpose, the user transmits his user certificate to the server 251 . On the basis of this user certificate, the server determines the identity of the user and checks whether the identified user is permitted as a user of the client-server network. For this purpose, the server uses a stored user list, in which all authorized users of the client-server network are stored.

If this check reveals that the identified user is an authorized user, then the authorization to access the desired data is checked, ie the authorization 252 .

The check reveals that the identified user is not allowed, the server aborts the access from 253.

Authorization 252 asks for a login name and a password for the client or user requesting access and transmits them to the server. This checks the login name and password.

If this check shows that the requesting client is authorized to access the protected data, the server grants him access 253 .

If the check shows that the requesting client is not authorized to access the protected data, for example with an incorrect password, the server refuses access to the data 253 .

[3] shows various methods for encrypting Data, especially asymmetric encryption methods, known.

The basics of a smart card are known from [5].

A disadvantage of the two-stage combined known from [1] Registration process is that the server at each individual order go to a network and seek access to data First identify users and then their authori must check.

For this it is necessary on the one hand that the server is all at Knows network access authorized users, d. H. whose names have to stored at the server or at least from this on one be available elsewhere. In addition, the Ser ver all agreed passwords and their respective calculations be known.  

This requires a large amount of memory on the server like a high computing power or a correspondingly long processing time server server times.

It is therefore an object of the invention, an arrangement and a To provide a method by which the above-mentioned disadvantage le of the described two-stage combined registration procedure rens, namely a large memory requirement, a high level of computing performance or a long processing time can.

This task is accomplished through the procedure as well as through the arrangement with the features according to the respective independent Pa claim resolved.

In the procedure for registering a user with a an authentication unit connected to the user The user transmits a service unit as part of a first authentication a first authentication information tion to the authentication unit. The user authenticated to the authentication unit. The Authentication unit transmits as part of a second Authentication a second authentication information the service unit, the authentication being authenticated to the service unit becomes. The user also transmits a registration information to the authentication unit that provides the registration information tion of the user to the service unit. After the first and second authentication, the User using the credentials at Service unit registered.

The arrangement for registering a user with a service power unit has an authentication unit, via which the user connects to the service unit that is.  

The authentication unit is set up in such a way that using one that the user submitted to them first authentication information of users authentifi is decoratable. The authentication unit is also such set up a second authentication information from the authentication unit to the service provider is communicable, using which the authenti unit compared to the service unit au is identifiable.

Furthermore, the arrangement is set up such that the User credentials to the authentication transmission and this registration information from the Au authentication unit to the service unit is conductive.

After the authentications, namely the first Au authentication of the user in relation to authentication unity and the second authentication of authentication unit compared to the service unit, is at the arrangement of users using the registration information tion can be registered with the service unit.

Clearly seen in the procedure and the An order the authentication of a user locally separated of its authorization.

The authentication of a user or several Authentifi adornments with different users takes place opposite the authentication unit. This has to match information stored or has access to such information formations that identify a user or allows multiple users.

Authorization of a user or different groove zer takes place directly at the service unit.  

The authentication unit identifies itself towards the service unit. A direct identification decoration of a user towards the service unit in this case no longer takes place.

The service unit therefore no longer needs everyone authorized users the appropriate authentication to save or maintain formations, but only this for identification of the authentication unit.

By authenticating the authentication unit the Au "guarantees" the service unit authentication unit for the identified train let users or for their forwarded registration information mation. As a result, only the user needs in this case be registered with the service unit.

The authentication unit functions clearly as a central intermediate authentication point, ge against which all users have to identify. is then the authentication unit in turn against the Service unit identified, all users apply, de credentials about this authentication unit be forwarded to the service unit as ord According to the service unit identifi ed.

The arrangement is particularly suitable for carrying out the inventive method or one of the following explained further training.

Preferred developments of the invention result from the dependent claims.

The further developments described below relate both on the procedures and on the arrangement.  

The invention and the training described below conditions can be found in both software and hardware for example using a special electrical Circuit.

Furthermore, an implementation of the invention or one in white teren described further training possible by a computer readable storage medium on which a computer program stores which is the invention or training leads.

Also, the invention or any described below Continuing education realized by a computer program product be, which has a storage medium on which a Computer program is stored, which the invention or Training.

In the case of further training, the first authentication is / is sinformation and / or the second authentication information Certificates / a certificate.

The registration of the user is very easy if the login information contains a user name and / or a user identification number and / or a password has.

The invention can preferably be incorporated into an intranet set, in which case the authentication unit is an intranet server. The service unit can be in In this case, another server, preferably an appli cation server or internet server.

To increase security when the user logs on it is appropriate that the credential and the first Au Identification information on a user's smart card are saved. Using appropriate reading directions at the user this information is read  and can then ü to the authentication unit be transferred.

Another improvement in data security is achieved when there is data between the user and the author tification unit and / or data between the Authentifi decoration unit and the service unit ver keys are transmitted.

Under "data" is any information, but especially also the authentication information and login information mation to understand. Such data can also be an application or an application, a document, sound or image data, which after registration between the user, Authenti fication unit and the. Service unit transferred become.

It is also useful for further training on standard based data protocols when transmitting data access. Such developments have a large user kindness on. This is how the Da format in accordance with an HTTPS data protocol.

In the case of further training, the user is authenticity unit and the service unit within the framework of a Client-server network interconnected, the user a client and the authentication unit and the service power unit each server in the client-server network are.

A training course on one can preferably be used User access to from the service unit Provided data. The user searches the Service unit to access the data after, where when the user searches the service provider unit is registered.  

When registering the user checks the services unit whose authorization to access the data, whereby the user if the access correction is determined has been granted access to the data. Otherwise the user will be denied access to the data defends.

It is useful for the security of the data ßig that the data in addition to the authorization control access encrypted with a secret key and stored encrypted.

When an authorized user accesses the not unencrypted data about possibly un secure data lines are transmitted, but it can data protected by encryption the. In this case, the data is decrypted after access by the authorized user.

The use of such encrypted data has moreover from the advantage that the data is actually only those The key is accessible to users without encryption to decrypt. Possess in such a case only the authorized user has the corresponding key, so even system administrators, who are responsible for the admin data processing and maintenance are responsible for the data in the unencrypted form can be excluded.

An embodiment of the invention is shown in figures represents and is explained below.

Show it

Fig. 1 Schematic representation of a client-server communication network and a registration process in the client-server communication network by a client according to an embodiment

Fig. 2 Schematic representation of a password-protected registration process in a client-server network according to the prior art

Figure 3 Schematic representation. Of process steps in a registering a user in a client-server network according to an embodiment

Fig. 4 Schematic representation of a central directory of people with coded access rights (roles) according to an embodiment

embodiment

Registration procedure of a user in one Intranet and limited data access by the user

Fig. 1 shows a structure schematically shows a portion of a client-server communications network 100, a so-called World-Wide-Web (WWW), as described in [2]. In the illustrated part of the client-server communication network 100 , a so-called intranet, individual computers 110 , 120 , 130 , 140 are connected by connections 111 , 121 , 131 , via which data can be transmitted.

The computer 120 and the computer 130 are each user computers, so-called clients, ie using such a client, a user or communication subscriber in the WWW or intranet can use or retrieve information which is offered in the WWW or Internet ,

The two clients 120 and 130 are each connected to the computer 110 , a so-called intranet server 110 . The intranet server 110 is also connected to the computer 140 , a second server, a so-called application server 140 .

The application server 140 manages and offers information in the intranet 100 .

Such information includes all types of electronics understand data such as text documents, Sound or audio data, image or video data or software pro programs.

Each client 120 , 130 each has a memory 112 , 122 in which a software program, a so-called WWW browser, as described in [2], is stored.

Using such a WWW browser, a communication subscriber can search for specific information on the intranet 100 , transmit found information to himself and display the transmitted information on a screen.

The intranet server 110 and the application server 140 perform administrative tasks and service tasks in the intranet 100 .

Such administrative tasks are, for example, a Ü Monitoring and control of data transmitted in a data network Data monitoring and management with one server network clients, administration and access control of stored on a server computer and in an intra net or client-server communication network transferable data.

Service tasks can be a provision of Data and / or applications used by the clients or can be used.

In the intranet 100 shown in FIG. 1, the Internet server 110 in particular performs an authentication task. This consists in identifying clients who are looking for access to the intranet 100 , for example in the context of access to data available in the intranet 100 .

Such authentication, in which the identity of a user requesting access to the intranet is established, is necessary since not all clients networked in the client-server communication network are authorized to access the intranet 100 .

For example, such an intranet 100 can be a company-internal communication network to which non-companies have no access authorization.

The application server 140 performs an authorization task, ie the application server 140 checks an authorization for data access by a client.

In addition, the application server 140 manages data, data A 160 and data B 161, as well as application programs, applications C 170 and applications D 171, and makes them available to the clients 120 , 130 for use.

This data A 160 and B 161 as well as the applications C 170 and D However, 171 are not for all communication participants freely available or available.

In this case, data A 160 and B 161 each contain confidential meeting minutes, which are only sent by one selected and authorized access part of the communication can be called up.

The same applies to applications C 170 and D 171. Also these are only available for communications authorized to access available to participants.

For this limited access and therefore confidentiality data A 160 and B 161 and applications C 170 and D  171 is ensured if an attempt is made to access a communication subscriber checks its authorization (Authorization).

The above-mentioned authentication and authorization take place by means of a special registration procedure which is carried out between the communication subscriber 120 or client who is seeking access and accessing data, the intranet server 110 and the application server 140 .

This particular registration process 150 will be described later in the discussion below.

Furthermore, a central personal directory 180 is managed by the application server 140 .

This central directory of persons 180 , 400 is shown in FIG. 4.

In this directory of persons 400 , all authorized communication participants of the intranet 100 are contained and stored by name.

For each communication subscriber 410 , 420 stored there, further person-specific information 411 , 421 is also stored, for example an address 412 , 422 , a department 413 , 423 , a telephone number 414 , 424 .

Furthermore, access authorizations 415 , 425 are stored in coded form, so-called roles, for each stored communication subscriber.

These access authorizations or roles 415 , 425 authorize the respective communication subscriber 410 , 420 to certain information provided by the application server 140 in the intranet 100 , in this case the data A 160 and B 161 and the applications C 170 and D 171 to access.

In the case of the intranet 100, the access authorization A or the role A authorizes access to the data A 160. A role D or a role AC authorizes the user to access the application D 171 or the data A 160 and the application C 170. An ABCD role accordingly entitles a communication subscriber to access all the information available on the intranet 100 , namely the data A 160 and B 161 and the applications C 170 and D 171.

This central people directory 180, 400 is plikationsserver of the Ap 140 centrally managed, the Applikati ie onsserver 140 updated centrally and its directory 180th Such an update includes, for example, new additions or deletions of new or leaving communication participants into or from the personal directory 180 . Furthermore, the update includes the assignment or change of access rights for individual communication participants and thus the "distribution" of roles.

Special registration procedure ( Fig. 3)

In the special registration method 300 shown in FIG. 3, the following occurs:

• a) authentication of a client requesting access to the intranet to the intranet server using a user certificate of the client ( 310 )
• b) authentication of the intranet server to the application server using a user certificate of the intranet server ( 320 )
• c) a transfer of the client's login data to the intranet server and further to the application server ( 330 )
• d) a role-based registration of the client with the application server using the registration data ( 340 )

The data transmitted in the special registration method 300 are transmitted in accordance with an HTTP protocol format. The data is also encrypted in accordance with 128-bit encryption.

Step 1 (310)

In a first step 310 , 151 of the special registration method 300 , an authentication of a client requesting access to the intranet takes place. For this purpose, this client sends its personal user certificate to the intranet server. This identifies the client based on the client's user certificate.

Step 2 (320)

In a second step 320 , 152 of the special registration method 300 , the intranet server is authenticated to the application server. To do this, the intranet server sends its personal user certificate to the application server. This identifies the intranet server based on the intranet server's user certificate.

Step 3 (330)

In a third step 330 , 153 of the special registration method 300 , the client transmits registration data, ie his user name and his password, to the intranet server. This forwards the client's login data to the application server.

Step 4 (340)

In a fourth step 340 of the special registration method 300 , role-based registration of the client 120 with the application server 140 takes place .

This role-based registration 340 takes place as part of a password-protected method.

A password-protected procedure generally involves agreed in advance between users and the server, in the Re gel secret passwords used to access to restrict protective data and the authorization of a to check the accessing user.

Only those users who own the agreed and of the password authorizing access to the server access to the password-protected data ten granted.

In the case of role-based registration, the application server ver accesses the central personal directory 180 and checks whether the corresponding role that authorizes access has been assigned to the client requesting access.

The check reveals that the person seeking access Client has been assigned the appropriate role and that the Client has the correct password, see above the client receives access to data A 160. Otherwise the client is denied access.

The following is an alternative to the embodiment described.

Alternative: use a smart card

In an alternative to the embodiment, the special registration procedure of the communication participant or clients used a smart card.

The basics of a smart card are known from [5].  

Such a smart card has a chip in which Da ten, in this case the user certificate and the login formation of a communication participant, d. H. the user name of the smart card holder and the password are. Furthermore, further user-specific data can be stored in the Chip.

In this alternative, the client also has a read Device on what data on a smart card saved, can be read.

Instead of entering the user certificate and login information by the inquiring communication participant In this case, the entry is made by the communication participant inserted his personal smart card into the reading area advises introduces. From this the user certificate and the Registration information read out and in the described spe introduced registration procedures. The special registration Otherwise the procedure is unchanged.  

The following publications are cited in the context of this document:
[1] Basics of a user's registration procedure, available on June 5, 2001 at:
http: / / www.ietf.org/rfc/rfc2617.txt
[2] Basics for the World Wide Web (WWW), available on May 30, 2001 at: http: / / www.w3.org/
[3] Menezes, by Oorschot, Vanstone: "Handbook of Applied Cryptography", Chapter 1, CRC Press, 1997
[4] Tanenbaum, AS, "Computer Networks" Prentice Hall, 1988, excerpt available on June 5, 2001 at http: / / vig.prenhall.com/catalog/academic/product/1.4096, 0133499456.html, 00.html
[5] Rankl, W., Effing, W., "Manual of chip cards. Structure, functionality, use." Hanser Verlag, 1995, excerpt available on June 5, 2001 at http: / / www.hanser.de/buch/1999/3-446-21115-2.htm
[6] Basics for a user certificate, available on June 5, 2001 at: http: / / www.itu.int/itudoc/ itu-t / rec / x / x500up / x509.html

Claims (11)

1. Method for registering a user with a service unit connected to the user via an authentication unit,
in which the user transmits first authentication information to the authentication unit as part of a first authentication, the user being authenticated to the authentication unit,
in which the authentication unit transmits a second piece of authentication information to the service unit as part of a second authentication, the authentication unit being authenticated to the service unit,
in which the user transmits credentials to the authentication unit and the authentication unit forwards the credentials of the user to the service unit,
in which the user is logged on to the service unit after the first and second authentication using the registration information. 2. The method according to claim 1, where the first and second authentication information Certificates are. 3. The method according to claim 1 or 2, where the credentials include a username and a Has user identification number. 4. The method according to any one of the preceding claims, where the authentication unit is an intranet server. 5. The method according to any one of the preceding claims, where the service unit is an internet server. 6. The method according to any one of the preceding claims,  where the credentials and the first authentication Information is stored on a smart card. 7. The method according to any one of the preceding claims, in the data between the user and the authentication entity and / or data between authentication unit and the service unit are each encrypted ü be transferred. 8. The method according to any one of the preceding claims, in which the data according to an HTTPS data protocol format ü will carry over. 9. The method according to any one of the preceding claims, where the user, the authentication unit and the Service unit in the context of a client-server network are interconnected, the user being a client and the authentication unit and the service unit are each servers in the client-server network. 10. Use of a method according to one of the preceding claims for access by the user to data made available by the service unit,
the user searches the service unit for access to the data,
when the user is searched, the user is registered with the service unit,
the user's authorization to access the data is checked when the user logs on,
wherein if the correction to the access has been determined, the user is granted access to the data and
if the authorization to access has not been determined, the user is denied access to the data. 11. Arrangement for registering a user with a service unit connected to the user via an authentication unit,
with the user and the authentication unit, which are set up in such a way that, as part of a first authentication, the user can transmit a first piece of authentication information to the authentication unit, the user being able to be authenticated against the authentication unit,
with the authentication unit and the service unit, which are set up in such a way that, as part of a second authentication, second authentication information can be transmitted from the authentication unit to the service unit, the authentication unit being authenticatable to the service unit,
with the user, the authentication unit and the service unit, which are set up in such a way that a registration information can be transmitted from the user to the authentication unit and this can be forwarded from the authentication unit to the service unit, using those after the first and second authentication of the User can be registered with the service unit.