JP2002324049A - Access control method and system - Google Patents

Abstract

(57) [Summary] [PROBLEMS] To provide an access control method and an access control system in which a client terminal does not need to perform authentication work twice or more when requesting processing to a plurality of servers. An agent authentication unit configured to receive a service authentication request from a client terminal and issue an agent authentication certificate through an authentication process;
, And if the authentication certificate attached to the service use request is valid, the client terminal C or the first server S1 specified by the user.
The first server authentication certificate is obtained from the first server S using the authentication information internally held, or, if obtained before, the previously obtained first server authentication certificate is taken out as necessary, Presenting the acquired or retrieved server authentication certificate and issuing a service use request to the first server S1
And an agent service processing unit 2 for returning a transmission result from the first server S1 to the client terminal C.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system in which a plurality of types of servers providing various functions are connected via a network, and a user operates the functions of a plurality of types of servers having different authentication formats using a single client terminal. The present invention relates to an access control method and system that does not require two or more authentication operations when a client terminal or its user operates a plurality of servers in a network computing environment.

[0002]

2. Description of the Related Art FIG. 5 is an explanatory diagram for explaining a prior art related to the present invention.

Conventionally, as shown in FIG.
The client terminal C handling (the first server S1, the second server S2,...) Performs an authentication procedure for each server S, holds an authentication certificate for each server S in the authentication certificate holding unit Cd, and performs processing. Each time a request is made to the server S, the authentication certificate Cs corresponding to the server S (when the request is made to the first server S1, the "authentication certificate for the first server" Cs1, and the second server S
2 when requesting an "authentication certificate for the second server" C
s2, ...) must be presented.

[0004]

As described above, in the related art, there is a problem that the client terminal C itself or its user is burdened with performing the authentication procedure on each server.

The main objects to be solved by the present invention are as follows.

A first object of the present invention is to provide an access control method and system which reduce the burden of performing an authentication procedure on each server for a client terminal itself or a user who handles the client terminal itself.

A second object of the present invention is to provide an access control method and system which eliminates the need for two or more authentication operations when a client terminal requests processing to a plurality of servers.

A third object of the present invention is to provide an access control method and system in which each client terminal itself does not need to hold authentication information for each server necessary for accessing each server. .

[0009] Other objects of the present invention will become apparent from the description of the specification, drawings, and particularly from the claims.

[0010]

According to the present invention, there is provided a method for controlling access to a request from a client terminal to a plurality of servers. When performing a service use request from the client terminal, the access control system that performs an authentication proxy process related to the service use request performs user authentication of a user who uses the client terminal in advance to perform the user authentication. A configuration method is adopted in which the access control is performed by attaching an agent authentication certificate issued to the client terminal to the service use request only when succeeding.

[0011] In order to solve the above-mentioned problems, the system of the present invention is a system for performing an authentication process on behalf of each server by integrating an authentication process for each server from a client terminal. And an agent authentication unit that performs user authentication and issues an agent authentication certificate, receives a service use request from the client terminal, and if the agent authentication certificate attached to the service use request is valid, From the specific server specified by the client terminal, obtain the server authentication certificate of the specific server using the authentication information held in advance in the system, or take out the previously obtained server authentication certificate, The obtained or extracted server authentication certificate is used for service And presented to the appropriate server with the request, it receives the result transmitted from the corresponding server having received the presentation, configuration take steps to anda agent service processing unit to be returned to the client terminal.

More specifically, in order to solve the above-mentioned problems, the present invention achieves the above object by adopting the following novel characteristic configuration method or means.

A first feature of the method of the present invention is a method for controlling access to a request from a client terminal to a plurality of servers, wherein a service use request from the client terminal to a specific server among the plurality of servers is provided. When performing the authentication, the access control system that performs the proxy authentication process related to the service use request performs user authentication of the user who uses the client terminal in advance and performs the authentication only when the user authentication is successful. The present invention is to adopt a configuration of an access control method in which the access control is performed by attaching an agent authentication certificate issued to a client terminal to the service use request.

According to a second feature of the method of the present invention, the user authentication in the first feature of the method of the present invention is such that the authentication data relating to each client terminal or the user stored in the access control system in advance is stored. By comparing with
The present invention resides in adopting a configuration of an access control method to be performed.

According to a third feature of the method of the present invention, the access control for the service use request in the first or second feature of the method of the present invention is performed when the service control request is received by the access control system. After confirming the validity of the agent authentication certificate attached to the request, only when the client terminal makes a request to the server relating to the service use request for the first time, the server performs the proxy authentication process for the server and generates the server authentication certificate. Obtained from the server, the obtained server authentication certificate, or
One aspect of the present invention resides in adopting a configuration of an access control method in which any one of the server authentication certificates acquired by the authentication delegation process performed before is presented to the server and the service use request is mediated.

A fourth feature of the method of the present invention is that the method according to the third feature of the present invention registers the server authentication certificate acquired by the authentication delegation process in the access control system. After that, when a service use request of the client terminal is issued to a server that has issued the server authentication certificate, an access control method of extracting a server authentication certificate from a registration destination and presenting the server authentication certificate to the server is disclosed. In the configuration adoption.

According to a fifth aspect of the method of the present invention, the method according to the third aspect of the present invention is characterized in that the server authentication certificate acquired by the authentication proxy processing is transmitted to the client terminal which has made the service use request. The server authentication certificate attached to the service use request is returned in addition to the agent authentication certificate attached to the service use request. The server authentication certificate is extracted from the agent authentication certificate added thereto, and the access control method is provided for presentation to the server.

According to a sixth aspect of the method of the present invention, the method according to the third aspect of the present invention is arranged such that the server authentication certificate acquired by the authentication delegation process is transmitted to the client terminal which has made the service use request. Then, in addition to returning the agent authentication certificate attached to the service usage request, the server authentication certificate is re-registered inside the access control system as the added agent authentication certificate. At the time of a subsequent service use request, the agent authentication certificate to which the server authentication certificate is added is attached, and the agent authentication certificate to which the attached server authentication certificate is added is re-created inside the access control system. Compare the registered server authentication certificate with the added agent authentication certificate, Determining sex, when clearing the decision, it takes out the server authentication certificate, in the configuration adopting the access control method comprising been subjected to presentation to the server.

On the other hand, a first feature of the system of the present invention is a system for performing authentication proxy processing by integrating authentication processing for each server from a client terminal to each server, wherein an agent authentication request from the client terminal is provided. And an agent authentication unit that performs user authentication and issues an agent authentication certificate, receives a service use request from the client terminal, and if the agent authentication certificate attached to the service use request is valid, From the specific server specified by the client terminal, obtain the server authentication certificate of the specific server using the authentication information held in advance in the system, or take out the previously obtained server authentication certificate, The obtained or extracted server authentication certificate,
Present it to the server with the service usage request,
And an agent service processing unit that receives a result transmitted from the server that has received the presentation and returns the result to the client terminal.

A second feature of the present invention system is that the acquired server authentication certificate in the first feature of the present invention system is maintained in a form added to the agent authentication certificate after the acquisition. It is in the adoption of the configuration of the access control system that has been implemented.

According to a third feature of the system of the present invention, the acquired server authentication certificate in the first feature of the present invention system is stored in the system together with an agent authentication certificate after the acquisition. The present invention resides in adopting a configuration of a managed access control system.

A fourth feature of the system of the present invention is that the acquired server authentication certificate in the first feature of the present invention system is maintained in a form added to the agent authentication certificate after the acquisition. Not only that, but also in the configuration of an access control system that is stored and managed together with the agent authentication certificate in the system.

A fifth feature of the present invention system is that the agent service processing unit in the first, second, third or fourth feature of the present invention system corresponds to each server which can be connected to the system. The configuration of the access control system is provided.

A sixth feature of the system of the present invention resides in that the system according to the first, second, third, fourth or fifth feature of the above-mentioned system of the present invention receives an agent authentication request from the client terminal. An access control system configuration including an authentication data management unit that manages authentication data necessary for authentication of the client terminal or the user to be performed is provided.

A seventh feature of the system of the present invention is that the system according to the first, second, third, fourth, fifth or sixth feature of the present invention system performs an authentication process by the agent authentication unit. An access control system also includes a certificate management unit that manages an agent authentication certificate issued through the access control system.

An eighth feature of the system of the present invention is that the certificate management unit in the seventh feature of the above-mentioned system of the present invention,
An access control system having a functional configuration in which the agent service processing unit performs a process of confirming whether or not an agent authentication certificate attached to the service use request is valid in response to a service use request from the client terminal. In the configuration adoption.

A ninth feature of the system of the present invention is that the system according to the first, second, third, fourth, fifth, sixth, seventh or eighth feature of the above-mentioned system of the present invention is provided for the user. An access control system includes a server authentication information storage unit that stores the authentication information, which is information necessary for an authentication process for the server.

[0028]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, an example of a system and an example of a method according to an embodiment of the present invention will be described with reference to the drawings. (System Example) FIG. 1 is a configuration diagram of an access control system according to an embodiment of the present invention.

The access control system α comprises a client terminal C and a server S (first server S1, second server S2,
..), and basically has an agent authentication unit 1 and an agent service processing unit 2 for each server S (a first agent service processing unit 21 for the first server, and an agent service processing unit 21 for the second server). ), And performs proxy processing for authentication relating to a service use request from the client terminal C.

Here, the agent authentication unit 1 is a means for receiving an agent authentication request from the client terminal C or its user, and issuing an agent authentication certificate through an authentication process (user authentication process).

The agent service processing section 2 receives a service use request from the client terminal C or its user, and receives an agent authentication certificate (with or without a server authentication certificate) attached to the service use request. Judge the validity of the agent authentication certificate), and if it is valid, (-
1); When the client terminal C or the server S specified by the user is accessed for the first time,
A server authentication certificate is acquired from the server S using authentication information held in the system in advance (hereinafter referred to as “server authentication certificate acquisition processing”). On the other hand, (−2); The server authentication certificate previously obtained without performing the server authentication certificate acquisition process is extracted as necessary, and a service use request is presented to the server S together with the server authentication certificate. This is a means for receiving the transmitted result and returning it to the client terminal C or the user.

In one embodiment of the figure, various data (confirmation data of the user's identity) required for authentication of authentication data (user name, password, etc.) transmitted from the client terminal C is stored. Authentication data management unit 3 which manages and manages the agent authentication certificate (preferably, manages both the agent authentication certificate and the server authentication certificate) and the authentication information of each server S And a server authentication information storage unit 5 for storing various types of data, information, and signals in an organic manner with the agent authentication unit 1 and the agent service processing unit 2.

The access control system α comprises a client terminal 1 and each server S (first server S1, second server S
2, ..) are interposed in a distributed or centralized manner on the network connecting the plurality of servers S and the plurality of client terminals C, and have a plurality of types of server functions. One client terminal C provides a server client type computing environment to the user. SA1 to SC4-3 in FIG.
A part of each processing is shown and will be described in detail in the following method example.

(Example of Method) This example of the method is adapted to the above example of the system.
An access control method according to an embodiment of the present invention will be described while further describing each means of the internal configuration.

The access control method according to an embodiment of the present invention is largely divided into a user authentication step and a service use step. Adding other steps as appropriate does not depart from the essential part of the present invention. Is possible.

FIGS. 2, 3, and 4 are specific sequence diagrams of the user authentication stage in the access control method according to an embodiment of the present invention, and the service use when the server authentication certificate is not obtained. It is a specific sequence diagram of a stage, and a specific sequence diagram of a service use stage when a server authentication certificate has been acquired.

<User Authentication Step> The user authentication step, which is executed in response to a user authentication command from the user, comprises:
It is composed of the following first to fourth steps, and the specific procedure is illustrated in FIG.

The first step of the user authentication stage (SA
1): The client terminal C transmits to the agent authentication unit 1 an authentication processing request to which data necessary for authentication processing such as a user name and a password (hereinafter referred to as “authentication data”) is attached.

The second step (SA) of the user authentication stage
2): Upon receiving the transmitted authentication processing request, the agent authentication unit 1 matches the authentication data attached thereto with the data held by the authentication data management unit 3 to determine the identity (validity) of the user. Confirm.

Specifically, when the agent authentication unit 1 receives an authentication processing request from the client terminal C, the agent authentication unit 1 sends the authentication data management unit 3 the authentication information of the user (in FIG.
A request to acquire “user ID password”) is made (SA2
-1) Acquire authentication information (for example, a password) of the user in response to the acquisition request from the authentication data management unit 3 (SA2-2), and store the authentication data attached to the authentication processing request and the authentication information of the user. The validity of the user is confirmed by performing a comparison check (SA2-3). Note that the validity may be confirmed by the authentication data management unit 3 without the agent authentication unit 1.

The third step (SA) of the user authentication stage
3): When the validity of the user is confirmed, the agent authentication unit 1 issues an agent authentication certificate to the client terminal C. Specifically, the agent authentication unit 1 issues an agent authentication certificate for the client terminal C (SA3-1), and returns the issued agent authentication certificate to the client terminal C that has requested authentication (SA3). -2).

The fourth step (SA) of the user authentication stage
4): The agent authentication certificate is stored (registered) in the certificate management unit 4. Specifically, the agent authentication unit 1
Issues a registration instruction to the certificate management unit 4 to register the agent authentication certificate issued in SA3-1, and the certificate management unit 4 can confirm the validity of the agent authentication certificate later. register.

<Service Use Stage> The service use stage, which is executed in response to a service use instruction from the user, comprises the following first to fourth steps. The specific procedure is shown in FIGS. Is illustrated in FIG.

The first step (SB) of the service use stage
1, SC1): After an instruction from the user or after some processing, the client terminal C adds an agent authentication certificate to a context that uniquely specifies a service to be used, and provides the service by providing the service (the first server S1 in the figure). ) To the agent service processing unit 2 (in the figure, the agent service processing unit 21 for the first server).

More specifically, as shown in FIG. 3 (sequence diagram in which the server authentication certificate has not been obtained) and FIG. 4 (sequence diagram in which the server authentication certificate has already been obtained), the specific server S1 which provides the service is provided. A service use request is transmitted to the agent service processing unit 21 together with a service name, information necessary for the service, and an agent authentication certificate.

In the case of FIG. 3, the agent authentication certificate without the first server authentication certificate is transmitted (SB1), and in the case of FIG. 4, the agent with the first server authentication certificate added. The authentication certificate is transmitted (SC1). In the case of FIG. 4, transmitting the agent authentication certificate to which the agent authentication certificate is added is not an essential requirement.

The second step (SB) of the service use stage
2, SC2): Agent service processing unit 2 (FIG. 2,
In FIG. 3, the agent service processing unit 21 transmits the client terminal C (in FIGS. 2 and 3, the client terminal C).
Inquire the certificate management unit 4 about the authenticity of the agent authentication certificate transmitted from 1).

Specifically, in the case of FIG. 3 (sequence diagram in which the server authentication certificate has not been obtained), the agent service processing unit 21 transmits the agent authentication certificate (to which the first server authentication certificate is not added). Attached to the certificate management unit 4 as a user certificate confirmation request (SB2-1), the certificate management unit 4 confirms the validity of the agent confirmation certificate, and sends the result to the agent service processing unit. 21 is notified (SB2-2).

In the case of FIG. 4 (sequence diagram of the server authentication certificate already acquired), the agent service processing unit 2 determines that (the first server authentication certificate is added).
An agent authentication certificate is attached and internally transmitted to the certificate management unit 4 as a user certificate confirmation request (SC2-1).
The certificate management unit 4 simultaneously checks the validity of the agent confirmation certificate and the validity of the first server authentication certificate,
The result is notified to the agent service processing unit 21 (SC2-2).

When at least the validity of the agent authentication certificate is confirmed, the third step (SB3, SB2) following the second step (SB2, SC2) of the service use stage
SC3) differs greatly between the case where the server authentication certificate has not been acquired (specifically, FIG. 3) and the case where the server authentication certificate has already been acquired (specifically, FIG. 4).

The third stage of the service stage (SB3) in the case where the service authentication certificate has not been obtained: when the server authentication certificate is a valid authentication certificate and the server authentication certificate required for accessing the server S does not exist. Performs authentication processing according to a server authentication procedure determined in advance using authentication information stored in the server authentication information storage unit 5 in advance, and
The server authentication certificate is obtained from the server (the server authentication certificate obtaining process described above is performed).

Specifically, as shown in FIG. 3, the agent service processing unit 21 determines whether the authentication certificate of the first server S1 is added to the agent authentication certificate attached to the received service use request. Inquiries,
This is performed for the certificate management unit 4 (SB3-1), and the response is received (SB3-2).

Upon receiving the reply, the agent service processing unit 21 for the first server determines that the first server authentication certificate has not been added to the agent authentication certificate. for,
Information necessary for the authentication processing to the first server S1 is searched (SB3-3), and the search result (I of the first server S1) is obtained.
D, password, etc.) (SB3-4), and requests the first server S1 for an authentication process using the obtained authentication information (SB3-5).

As a result, a first server authentication certificate is obtained ((SB3-6)). However, if the first server S1 receives an authentication request with inappropriate information of the user, the first server authentication certificate is obtained. Then, the acquired first server authentication certificate is added to the agent authentication certificate, re-registered in the certificate management unit 4 (SB3-7), and the process proceeds to the next fourth step (SB4).

In the case where the service authentication certificate has already been acquired, the third stage of the service stage (SC3): a valid authentication certificate, which is a server authentication certificate necessary for accessing the server S by the previous authentication. Since it is confirmed that the server authentication certificate exists, the server authentication certificate is taken out if necessary, and the process proceeds to the fourth service stage (SC4).

Specifically, at the stage of SC2-2,
The agent service processing unit 21 has already determined that a valid first server authentication certificate has been added to the received user certificate. Therefore, the agent service processing unit 21 extracts the first server authentication certificate as necessary, and The process proceeds to the fourth service stage (SC4) (this processing procedure is not shown in FIG. 4).

Here, the certificate management unit 4 first confirms the validity of the simple agent authentication certificate as in SB2-1 and SB2-2, and then the server as in SB3-1 and SB3-2. It may be configured to check for the existence of the authentication certificate and its validity. However, the agent authentication certificate with / without the first server authentication certificate is defined as the user certificate. , SC2-1, S
It is preferable to configure so as to integrally perform C2-2.

The fourth service stage (SB4, SC
4): The server S presents the obtained server authentication certificate when passing through the SB 3 and the server authentication certificate extracted when passing through the SC 3 to the server S to receive the service, and receives the result from the client terminal C. Return to. In the case where the data has passed through SB3, the server authentication certificate is added to the agent authentication certificate and transmitted to the client terminal C.

Specifically, as shown in FIG. 3 and FIG. 4, a service request is made to the first server S1 together with the first server authentication certificate (SB4-1, SC4-1), and as a result (SB4-1, SC4-1) At this time, the server S1 does not accept a service request when presenting an incorrect server authentication certificate) (SB4-2, SC4-2), and returns the obtained result to the client terminal C1. (SB4-3, S
C4-3). In addition, when passing through SB3, the server authentication certificate is added to the agent authentication certificate held by the client terminal C by transmitting an agent authentication certificate to which the first server authentication certificate is added. To

The above is one mode of the access control method. In a specific sequence diagram, the first server authentication certificate is added to the agent authentication certificate through SB1 to SB4-3. In this embodiment, the same first server authentication certificate exists in the client terminal C and the certificate management unit 4 in the form of a first server authentication certificate added agent authentication certificate.

However, in the specific sequence diagram, in SB4-3, the server authentication certificate added agent authentication certificate is not transmitted to the client terminal C, but is registered in the certificate management unit 4 by the processing of SB3-7. The server authentication certificate may be taken out and used for presentation.

In this case, the certificate attached to the service use request from the client terminal C to the specific server is a mere agent authentication certificate (an agent authentication certificate which cannot add / non-add a server authentication certificate). Therefore, it is necessary to determine the validity of the mere agent authentication certificate and confirm with the certificate management unit 4 whether the server authentication certificate of the specific server exists. In this respect, it goes without saying that the specific sequence contents need to be changed.

On the other hand, the authentication management unit 4 determines whether only the agent authentication certificate registered in SA4 is valid, that is, does not determine the validity of each server authentication certificate at all. The corresponding server authentication certificate once issued by each server S is added to the agent authentication certificate by each agent service processing unit 2 (including,
It is also possible to adopt a configuration in which an agent authentication certificate with a server authentication certificate added to the client terminal C is transmitted to the client terminal C by SB4-3. At this time, it goes without saying that the specific sequence contents are changed such that the process of SB3-7 becomes unnecessary.

The above is one form of the access control method. The above is merely one form of the present invention. For example, SB2-1, SB2-2 (SC2-1, SC2-
In 2), the agent service processing unit 2 receives information for confirming the validity of the agent authentication certificate from the authentication management unit 4, and the agent service processing unit 2 determines the validity. Good. Further, each processing procedure of the sequence can be changed within a range where the order before and after can be changed as appropriate.

The system example and the method example which are the modes of the present invention have been described above. However, the present invention can be implemented with appropriate modifications as long as the objects of the present invention are achieved and the following effects are obtained.

[0066]

According to the present invention, when a client terminal requests processing to a plurality of servers, the client terminal does not need to perform authentication work twice or more, and the client terminal itself holds information necessary for accessing the plurality of servers. It has excellent effects such as eliminating the need to do so.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of an access control system according to one embodiment of the present invention.

FIG. 2 is a sequence diagram in a user authentication stage of an access control method using an authentication certificate according to an embodiment of the present invention.

FIG. 3 is a sequence diagram in a service use stage in a case where a server authentication certificate has not been obtained, in an access control method using an authentication certificate according to an embodiment of the present invention.

FIG. 4 is a sequence diagram in a service use stage when a server authentication certificate has been acquired in the access control method using an authentication certificate according to an embodiment of the present invention.

FIG. 5 is an explanatory diagram for explaining a conventional technique.

[Explanation of symbols]

 α: access control system C: client terminal 1: agent authentication unit 2, 21, 22 agent service processing unit 3: authentication data management unit 4: certificate management unit 5: server authentication information storage unit S: server S1: first Server S2: Second server

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Masayoshi Nose 2-3-1 Otemachi, Chiyoda-ku, Tokyo Within Nippon Telegraph and Telephone Corporation (72) Inventor Ryuji Kawasaki 2-3-3 Otemachi, Chiyoda-ku, Tokyo No. 1 F-term in Nippon Telegraph and Telephone Corporation (reference) 5B017 AA03 BB09 5B085 AE02 AE23 BG07 5J104 AA06 AA07 KA01 NA05 PA07

Claims (15)

[Claims] 1. A method for controlling access to a request from a client terminal to a plurality of servers, the method comprising: when making a service use request from the client terminal to a specific server among the plurality of servers, Is issued to the client terminal only when the user authentication of the user who uses the client terminal is performed in advance and the user authentication is successful. The access control method, wherein the access control is performed by attaching an agent authentication certificate to the service use request. 2. The method according to claim 1, wherein the user authentication is performed by comparing with authentication data relating to each client terminal or the user stored in the access control system in advance. Described access control method. 3. An access control for the service use request, wherein when the service use request is received by the access control system, after confirming the validity of an agent authentication certificate attached to the request, the service use request Only when the client terminal requests the server according to the first time, the server performs an authentication proxy process for the server to obtain a server authentication certificate from the server, and the obtained server authentication certificate, or the previously performed server authentication certificate The access control method according to claim 1, wherein any one of the server authentication certificates acquired by the authentication undertaking process is presented to the server to mediate the service use request. 4. The method according to claim 1, wherein the server authentication certificate obtained by the authentication proxy processing is
Registered in the access control system, and when a service use request of the client terminal is made to a server that has issued the server authentication certificate from the next time onward, the server authentication certificate is taken out from the registration destination and the server The access control method according to claim 3, wherein the access control method is provided for presentation. 5. The method according to claim 1, wherein the server authentication certificate obtained by the authentication proxy processing is
The client terminal that has made the service use request is returned in addition to the agent authentication certificate attached at the time of the service use request, and the server authentication certificate is added at the next and subsequent service use requests. Using the agent authentication certificate
4. The access control method according to claim 3, wherein the server authentication certificate is extracted from the agent authentication certificate added to the server and is provided to the server. 5. 6. The method according to claim 1, wherein the server authentication certificate obtained by the authentication proxy process is
To the client terminal that has made the service use request, the agent is returned in addition to the agent authentication certificate attached to the service use request, and the server authentication certificate is added inside the access control system. Re-register as an authentication certificate, attach the agent authentication certificate with the server authentication certificate added to the service request from the next time, and agent authentication with the attached server authentication certificate The certificate is compared with the agent authentication certificate to which the server authentication certificate re-registered inside the access control system is added, and the validity thereof is determined. And providing it to the server for presentation. Access control method according to. 7. A system for performing an authentication surrogate process by integrating an authentication process for each server from a client terminal with respect to each server, wherein an agent authentication request is received from the client terminal and user authentication is performed to perform an agent authentication. An agent authentication unit that issues an authentication certificate, and accepts a service use request from the client terminal, and, if the agent authentication certificate attached to the service use request is valid, from a specific server designated by the client terminal, Obtain the server authentication certificate of the specific server using the authentication information stored in advance in the system, or retrieve the previously acquired server authentication certificate, and acquire or acquire the acquired server authentication certificate. Is presented to the server together with the service usage request, Access control system receives the result transmitted presented from the appropriate server that received, for anda agent service processing unit to be returned to the client terminal, and wherein the. 8. The access control system according to claim 7, wherein the acquired server authentication certificate is maintained in a form added to the agent authentication certificate after the acquisition. 9. The access control system according to claim 7, wherein the acquired server authentication certificate is stored and managed together with an agent authentication certificate in the system after the acquisition. . 10. The acquired server authentication certificate is not only maintained in a form added to the agent authentication certificate after the acquisition, but also stored in the system together with the agent authentication certificate. The access control system according to claim 7, wherein the access control system is managed. 11. The access control system according to claim 7, wherein the agent service processing unit is provided for each server that can be connected to the system. 12. The system according to claim 11, further comprising an authentication data management unit that manages authentication data required for authentication of the client terminal or the user performed in response to an agent authentication request from the client terminal. The access control system according to claim 7, 8, 9, 10 or 11. 13. The system according to claim 7, further comprising a certificate management unit for managing an agent authentication certificate issued through an authentication process by said agent authentication unit. 10, 11, or 1
3. The access control system according to 2. 14. The certificate management unit checks whether the agent authentication certificate attached to the service use request is valid when the service use request from the client terminal is triggered by the agent service processing unit. The access control system according to claim 13, wherein the access control system has a functional configuration for performing a process of performing the following. 15. The system according to claim 7, wherein the system further comprises a server authentication information storage unit for storing the authentication information, which is information necessary for an authentication process of a user to a corresponding server. , 10, 11, 1
15. The access control system according to 2, 13, or 14.