JP2002366528A - Security method for personal authentication - Google Patents

Abstract

(57) [Summary] [Problem] In the conventional method, despite security enhancement with digital certificates and fingerprints, information is disguised as forgery of digital certificates and fingerprints and maintenance of user information, etc. There is a disadvantage that synchronization cannot be achieved. A fingerprint information storage unit in which a fingerprint for authenticating a person is registered, an application automatic execution information storage unit in which a file for automatically inputting and executing a user ID and a password for each application are registered. Application information for each user, that is, an application accessible by the user and a user information storage unit for registering a user ID and a password required for starting the application, and IP address information for each device and device information for registering a user ID using the device. The problem is solved by providing storage means.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a system in which security is added to a process of automatically performing single sign-on to an application when the application is started.

[0002]

2. Description of the Related Art In recent years, with the development of network technology,
It became possible to connect a plurality of computers via a network and work in cooperation with different computers.
A network system usually has one computer serving as a host, and a plurality of computers are connected to the host computer via a network. There are a plurality of such network systems, and from the viewpoint of one client, a plurality of host computers providing services. Therefore, the end user needs to memorize a plurality of passwords to execute each service. Therefore, as a conventional single sign-on technique, there is a technique in which an electronic certificate, a fingerprint, or the like is used as security at an entrance, and whether or not a service can be provided is determined by recognizing them.

[0003]

However, in the conventional method, although security is enhanced by an electronic certificate or a fingerprint, forgery of an electronic certificate or a fingerprint or the like may cause impersonation or maintenance of user information. There is a drawback that information cannot be synchronized.

The present invention solves such a problem, and enhances security by checking whether or not the user is registered in device management information after fingerprint matching. It is another object of the present invention to provide a system for automatically synchronizing user information, that is, a server for centrally managing user information, and a system for synchronizing user information with a plurality of servers.

[0005]

SUMMARY OF THE INVENTION The above-mentioned problems are solved by a fingerprint information storage unit in which a fingerprint for authenticating a user is registered, and an application in which a file for automatically inputting and executing a user ID and a password is registered for each application. Execution information storage means and application information for each user, that is, user information storage means for registering an application accessible to the user and a user ID required when the application is started, a password, IP address information for each device, and a user ID using the device Is solved by providing a device information storage unit for registering the information.

[0006]

Embodiments of the present invention will be described below.

FIG. 1 is a system configuration diagram of a single sign-on system in personal authentication according to the present invention. As shown in FIG. 1, the system includes a directory server 11, a plurality of business application servers 16, a device management and authentication server 1,
9. It is composed of a plurality of clients 23.

FIG. 2 is a flowchart of single sign-on in the conventional personal authentication. The details of FIG. 2 will be described below. (31) First, the client 23 activates the application automatic execution means 25 and calls the fingerprint recognition means 24. (32) The fingerprint recognizing means 24 of the client 23 is executed, and a message “Please input a fingerprint” is output. Next, the fingerprint 27 is placed on the fingerprint reader 26 and the fingerprint information is transmitted to the fingerprint authentication means 20 of the device management and authentication server 19. (33) Fingerprint authentication means 20 of device management and authentication server 19
Performs a 1: N comparison between the fingerprint information and the fingerprint information storage unit 13 of the directory server 11 to determine whether there is a corresponding user. (34) If there is a corresponding user in the above determination, the application automatic execution information and the user information of the directory server 11 are downloaded to the client 23. (35) If there is no corresponding user in the above determination, the application automatic execution means is ended.

FIG. 3 is a flowchart of the single sign-on in the improved personal authentication. The details of FIG. 3 will be described below. (41) First, the client 23 activates the application automatic execution means 25 and calls the fingerprint recognition means 24. (42) The fingerprint recognizing means 24 of the client 23 is executed, and a message "Please input fingerprint" is output. Next, the fingerprint 27 is placed on the fingerprint reader 26 and the fingerprint information is transmitted to the fingerprint authentication means 20 of the device management and authentication server 19. (43) Fingerprint authentication means 20 of device management and authentication server 19
Performs a 1: N comparison between the fingerprint information and the fingerprint information storage unit 13 of the directory server 11 to determine whether there is a corresponding user. (44) If there is a corresponding user in the above determination, it is checked from the device information storage unit 22 and the acquired user ID whether or not the application execution unit 25 has been activated from the client 23 of the corresponding user. (45) If the device is usable in the above determination, the application automatic execution information and the user information of the directory server 11 are downloaded to the client 23. (46) If the device cannot be used in the above determination, the application automatic execution means ends. (47) If there is no corresponding user in the above determination, the application automatic execution means ends.

FIG. 4 is a fingerprint information management table of the fingerprint information storage means 13. The details of FIG. 4 will be described below.

[0011] Two fingerprint data 1 and two fingerprint data 2 are registered in the fingerprint information storage means 13 for each user. (33),
If at least one of the two pieces of fingerprint data matches in the fingerprint collation in (43), it is determined that the corresponding user exists.

FIG. 5 shows an application automatic execution information storage unit 1.
4 is an application information management table of the application automatic execution information storage means 28. The details of FIG. 5 will be described below.

A recorder file is registered in the application automatic execution information storage means 14 for each application ID. The recorder file is a file for automatically injecting a necessary login ID and password into the screen called by the client.

FIG. 6 is a user information management table of the user information storage means 15, user information storage means 18, and user information storage means 29. The details of FIG. 6 will be described below.

A plurality of application IDs are registered in the user information storage means 15 for each user ID. That is, by specifying an application that can be used by the user and using a necessary login ID and password, a single sign-on can be performed on the screen called by the client.

FIG. 7 is a device information management table of the device information storage means 22. The details of FIG. 7 will be described below.

A user ID and a client IP address are registered in the device information storage means 22 for each device ID.

In other words, by checking the 44 device information and the user information, access and impersonation by others are prevented.

[0019]

As is clear from the above description, according to the present invention, the following effects can be obtained.

The security in performing single sign by the double security function of the fingerprint authentication unit 24 and the device information check unit 21 can be enhanced. In addition, there is an effect that it is possible to prevent an adverse effect that the user information storage unit 18 of the business application server 16 and the user information storage unit 15 of the directory server 11 do not match due to user information maintenance.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram of an embodiment of the present invention.

FIG. 2 is a conventional flowchart for performing single sign-on when an application is activated.

FIG. 3 is an improved flowchart for performing single sign-on when an application is started.

FIG. 4 is a diagram showing the contents of a fingerprint information management table.

FIG. 5 is a diagram showing contents of an application information management table.

FIG. 6 is a diagram showing the contents of a user information management table.

FIG. 7 is a diagram showing the contents of a device information management table.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 11 ... Directory server, 12 ... User information synchronization means, 13 ... Fingerprint information storage means, 14 ... Application automatic execution information storage means, 15 ... User information storage means, 16 ... Business application server, 17 ... User information synchronization means, 18 ... User information storage means, 19 ... device management and authentication server, 20 ...
Fingerprint authentication means, 21 device information checking means, 22 device information storage means, 23 client, 24 fingerprint recognition means, 25 automatic application execution means, 26 fingerprint reader,
27: fingerprint, 28: application automatic execution information storage means, 29
... User information storage means.

Claims (1)

[Claims] 1. A method for realizing single sign-on of an application on a computer connected to a network, wherein a fingerprint authentication unit on a server side inputs fingerprint information on a client side to a fingerprint information storage unit on a directory server. 1: N search to identify the user,
As a means for further increasing security, check whether the corresponding user is registered in the device management information, and then specify an available application from the application automatic execution information storage means and the business application access storage means of the corresponding user, and A method in which a login ID and password required for single sign-on and a recorder file of the application are transmitted to a client to perform single sign-on.