JPH11175335A - User authentication method in multiple business environment - Google Patents

Abstract

(57) [Summary] [Problem] To control the access authority to a program according to the business environment used by a user, and to manage the security of the program in close contact with the business in charge of the user. SOLUTION: A U-ID / IC for each PP of an IC card 1 is provided.
The PW table 7 stores information for each business environment used by the user.
The user ID / password is stored for each program (PP). The PP 11 of the terminal device 3 refers to the U-ID / PW table 7 for each PP input from the IC card 1 and determines whether or not the user has the right to use the program under the current business environment. User ID of the program /
If a password has been set, it is sent to the server 4. The program 15 for authenticating the PP of the server 4 is as follows:
Referring to the U-ID / PW table 14 of each PP, user authentication is performed to determine whether or not the received user ID / password is registered.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method of performing user authentication for a user of a program, and more particularly to a method of performing user authentication at the time of using a program according to a work environment used by the user.

[0002]

2. Description of the Related Art When accessing a computer or using a specific application program, a user uses a user ID / password (hereinafter abbreviated as U-ID / PW) to authenticate that the user is a valid user. Authentication methods are widely used. There is known a method of automatically inputting a U-ID / PW instead of keying in a U-ID / PW via an input device such as a keyboard when a user accesses a computer or a program. For example, Japanese Patent Publication No. Hei 7-61149 discloses that a portable recording medium such as an IC card is used to input a password set on the recording medium to make the password input operation more efficient and avoid human error. Disclose the technology to perform.

[0003] On the other hand, if the user applies the same U-ID / PW to a plurality of programs, the security of all other programs is lost when the U-ID / PW is broken for one program. Therefore, the number of U-IDs / PWs to be input by the user tends to increase.

[0004]

However, in addition to the problem of ensuring security for each application program as in the prior art, there is also the problem of a business environment. For example, there is a business environment in which personnel in the personnel section uses a computer as the personnel section. In this environment, it is necessary to give this user the right to access programs and files that handle personnel information. On the other hand, in a business environment where the same person uses a computer as an individual in the personnel department, it is necessary to restrict access to programs and files that handle personnel information. In addition, the same person may concurrently perform a plurality of tasks. In this case as well, it is desirable to separate the task environments according to the tasks and to limit the programs and files that can be accessed according to each task environment. As described above, it is desirable to clearly separate some business environments used by the same user and to authorize the proper use thereof, and for that purpose, authentication information such as U-ID / PW can be used. However, according to the related art, it has not been possible to perform management such as giving or denying an access right to a user according to the business environment, even for the same program.

FIG. 6 is a diagram showing an example in which user authentication is performed using different U-IDs depending on the business environment even for the same program. 34, 35 and 36 are programs
Product (PP). 32 and 33 are a business environment x and a business environment y used by the user 31, respectively. 37
Is a user ID for using the business environment x, and 38
Is a user ID for using the business environment y. 39
And 40 are PP3 from the business environment x and the business environment y, respectively.
4 is a user ID when the user uses No. 4. As described above, if the U-ID / PW is changed according to the business environment in which the program is used, each user manages as many U-ID / PWs as the maximum number of business environments to be used × the number of programs to be used. Must. As described above, it is desirable to manage the security of the program according to the work environment. However, it is expected that the number of U-IDs / PWs that must be input by the user is expected to further increase. The burden on the user, such as the burden on the operation, increases, and there is a risk of leakage of the password.

An object of the present invention is to control access authority to a program according to a business environment used by a user, and to provide a method for performing user authentication in a direction that does not increase the burden on the user. It is in.

[0007]

According to the present invention, user authentication information, such as U-ID / PW, for a program usable in a business environment used by a user is set on a storage device, and the authentication information is referred to. Accordingly, the method is characterized in that it is determined whether or not the user has a right to use a specific program under a specific business environment. As used herein, the term “work environment” refers to a division or mode of a work field to which a user has authority to execute a task in charge using a computer, as described above. In the present invention, the same user defines a plurality of work environments. It is assumed that it can be used.

[0008]

DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 is a diagram showing a system configuration of the present embodiment. Reference numeral 1 denotes an IC card held by each user, and a card authentication U-ID / PW for authenticating that the IC card belongs to the user in a storage device therein.
6 and a U-ID / PW table 7 for each PP. Reference numeral 2 denotes an IC card reader for reading the IC card 1. Reference numeral 3 denotes a terminal device to which the IC card reader 2 is connected. The storage device has a program 9 for controlling login of a business environment and a program 1 for authenticating an IC card.
0 and each PP (Program) executable by the terminal device 3
Product 11 is stored. Reference numeral 4 denotes a server for connecting the terminal device 3 via the communication line 5, and its storage device has a U-ID / PW table 12 of the business environment, a program 13 for authenticating the business environment, and a U-ID / PW of each PP. P
W table 14 and program 15 for PP authentication
Is stored. U-ID / PW table 14 of each PP and P
There are as many programs 15 for user authentication of P as the number of PP types. The terminal device 3 is a computer such as a personal computer, and the server 4 is a computer such as a personal computer, a workstation, and a mainframe.

[0010] When a program 9 for controlling login of the business environment of the terminal device 3 receives a business environment U-ID / PW from an input device (not shown) for the selected business environment, the program 9 controls the U-ID / PW. Is transmitted to the server 4 via the communication line 5. The program 13 for authenticating the business environment of the server 4 includes a U-ID / PW table 12 of the business environment.
To determine whether the input U-ID / PW is correct or not, and return the determination result to the terminal device 3. If the determination result is true, the program 10 for authenticating the IC card transmits an IC card authentication U
When the ID / PW is input, the card authentication U-ID / PW6 of the IC card 1 is read via the card reader 2, and it is determined whether or not the input U-ID / PW is correct. If the input U-ID / PW is correct, the selected PP 11 is activated, and the PP 11 corresponds to the current business environment and the selected PP 11 from the U-ID / PW table 7 for each PP of the IC card 1. Read U-ID / PW. If the corresponding U-ID / PW exists, the U
-Send the ID / PW to the server 4. The program 15 for authenticating the PP of the server 4 uses the U-ID / PW of each PP.
It is determined by referring to the table 14 whether the U-ID / PW input for the designated business environment and PP is correct, and the result is returned to the terminal device 3 via the communication line 5. If the determination result is true, the terminal device 3 continues the execution of PP11.

FIG. 2 is a diagram showing a data structure of a user ID and a password stored in the IC card 1. Reference numeral 6 denotes a user ID and a password for authenticating that the IC card belongs to the person. A U-ID / PW table 7 stores U-ID / PW when each PP 11 is used in each business environment. For example, P in the business environment x
The U-ID / PW when using Pb is U-ID-
xb / PW-xb.

FIG. 3 shows the U-ID /
FIG. 3 is a diagram illustrating a data configuration of a PW table 12. UI
The D / PW table 12 stores a user ID permitted in each business environment indicated by a business environment number and a corresponding password. When the same user uses a plurality of business environments, a U-ID / PW is set for each business environment.

FIG. 4 shows the U-ID / P of each PP of the server 4.
FIG. 3 is a diagram illustrating a data configuration of a W table. The U-ID / PW table 14 of each PP is provided for each PP, and stores a user ID allowed in each business environment indicated by a business environment number and a password corresponding to the user ID.

FIGS. 5A and 5B are flowcharts showing the flow of processing of the terminal device 3 and the server 4 at the time of login. The program 9 for controlling the login of the business environment of the terminal device 3 displays a display screen relating to the business environment selected via the input device on the display device (step 5).
1). When a U-ID / PW for logging in to the business environment is input from an input device such as a keyboard (step 52), the program 9 for controlling the log-in of the business environment executes the business environment number and the input U-ID. / PW is transmitted to the server 4 (step 53). The program 13 that authenticates the business environment of the server 4 receives these pieces of information and refers to the U-ID / PW table 12 of the business environment (step 54). It is determined whether or not it is registered on the U-ID / PW table 12 (step 55), and the determination result (true / false) is transmitted to the terminal device 3 (step 56). The program 9 for controlling the login of the business environment receives this determination result (step 57), and inputs the U-ID / PW of the input business environment.
Is correct or not (step 58). U entered
If the ID / PW is not correct, the process ends. UI
If the D / PW is correct, control is transferred to the IC card authentication program 10, and the IC card authentication program 10 displays a message on the display device to insert the IC card 1 into the IC card reader 2 ( Step 5
9). When the U-ID / PW is input from an input device such as a keyboard (step 60), the program 10 for authenticating the IC card transmits the U-ID / PW6 of the card from the IC card 1 via the IC card reader 2. Read (step 61).

Next, referring to FIG. 5B, the program 10 for authenticating the IC card includes a UI input to the card.
It is determined whether D / PW is correct (step 62). If the input U-ID / PW is not correct, the IC card 1 is ejected from the IC card reader 2 (step 6).
3), end the process. If the input U-ID / PW is correct, the control returns to the program 9 for controlling the login of the business environment, and the program 9 for controlling the login of the business environment displays the menu of the PP 11 on the display device, and switches the input device. Then, the PP 11 specified through the instruction is activated (step 64). The PP 11 first reads the U-ID / PW corresponding to the current business environment and the identifier of the activated PP from the U-ID / PW table 7 for each PP of the IC card 1 (Step 65). If the U-ID / PW corresponding to the identifier of the PP activated in the current business environment is not set in the U-ID / PW table 7 for each PP, the processing of this PP 11 is immediately terminated. Next, the current business environment number, the identifier of the activated PP, and the read U-ID / PW are transmitted to the server 4 (step 6).
6). The program 15 for authenticating the PP of the server 4 is as follows:
Upon receiving such information, the U-ID / P of the designated PP is received.
With reference to the W table 14 (step 67), it is determined whether or not the U-ID / PW received corresponding to the designated business environment number is registered (step 68), and the determination result (true / false) ) To the terminal device 3 (step 6).
9). The PP 11 of the terminal device 3 receives this determination result (step 70), and the UI input from the IC card 1
It is determined whether D / PW is correct (step 71). If the input U-ID / PW is not correct, the process ends. If the input U-ID / PW is correct, the process of PP11 is continuously executed (step 72).

In steps 61 and 62, the U-ID / PW6 of the card of the IC card 1 is converted to the UI
Although the D / PW is read, at least the PW of the U-ID / PW is transferred to the IC card 1 from the input device, and it is determined whether the PW is correct in the IC card 1 and the determination result is obtained. Only the terminal device 3 may be notified.

A program 9 or PP11 for controlling the log-in of the business environment may be provided on the server 4 side. When the program 9 for controlling the login of the business environment is provided on the server 4 side, the terminal device 3 performs the display function of steps 51 to 53, the function of inputting the U-ID / PW by the user's key-in, the input U-ID. Only the function of transmitting / PW to the server 4 and the display function of step 64 are provided. Further, there is no determination in steps 57 and 58, and only the determination result of the server 4 is displayed. Also, PP11 is transferred to server 4
When the terminal device 3 is provided on the side, the terminal device 3 has a function of inputting the U-ID / PW of the PP in steps 65 and 66 and transmitting it to the server 4, but there is no step 70 to 72, and only the determination result of the server 4 is displayed. It is. In addition, there is no server 4, and the U-ID / PW table 12 of the business environment, the program 13 for authenticating the business environment, the U-ID / PW table 14 of each PP, and the tables and programs of the program 15 for performing the authentication of each PP are provided. All of them may be provided on the terminal device 3 side.
In this case, the terminal device 3 is not a terminal device but a stand-alone computer.

The UI for each PP in the IC card 1
UI for all PPs as D / PW table 7
Instead of setting D / PW, U-ID / PW is set only for PPs that are permitted to be used by the user in the business environment, and U-ID / PWs are set for PPs not permitted to use in the business environment.
The PW may not be set.

In place of the IC card 1 and the IC card reader 2, a magnetic card, an optical card, a floppy disk,
The present invention can be implemented using any storage device such as a hard disk and its driving device. At this time, if the use of the storage device is limited to the user, the processing of the program 10 for authenticating the U-ID / PW6 of the card and the IC card is unnecessary.

In addition, regarding the point of authorizing the work environment used by the user, in order to prevent the user from confusing the use of the work environment and illegally using the inappropriate work environment, In the program 9 for controlling the login of the business environment, the program 13 for authenticating the business environment, or the program 15 for authenticating each PP, the history of the user authentication of the user is collected and the history of the suspicious user is traced. There are methods such as doing.

[0021]

As described above, according to the present invention, the business environment used by the user is clearly separated, and the access authority to the program is controlled according to the business environment used. Security management that is closely related to the tasks to be performed. At this time, the authentication information for using each program is set on the storage device and input from the storage device, so that the operation burden on the user can be reduced.

[Brief description of the drawings]

FIG. 1 is a diagram showing a system configuration of an embodiment.

FIG. 2 is a diagram showing a data configuration of the IC card 1 of the embodiment.

FIG. 3 is a diagram showing a data configuration of a U-ID / PW table 12 of a business environment according to the embodiment.

FIG. 4 is a U-ID / PW table 1 of each PP according to the embodiment.
FIG. 4 is a diagram illustrating a data configuration example of No. 4;

FIG. 5A is a flowchart illustrating a processing flow of the terminal device 3 and the server 4 at the time of login according to the embodiment.

FIG. 5B is a flowchart (continued) illustrating a flow of processing of the terminal device 3 and the server 4 at the time of login according to the embodiment.

FIG. 6 is a diagram illustrating a combination of U-IDs for each business environment and each program.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... IC card, 3 ... Terminal device, 4 ... Server, 7 ... U-ID / PW table for each PP, 9
... Program for controlling login of business environment, 11
... PP, 12 ... U-ID / PW table of business environment, 13 ... Program for authenticating business environment, 1
4 ... U-ID / PW table of each PP, 15 ...
Program to authenticate PP

Claims (1)

[Claims] 1. A user authentication method for inputting predetermined authentication information for a program used by a user and judging the right to use the program, the program being usable in a business environment to be used set on a storage device. A user authentication method in a multi-business environment, comprising: inputting user authentication information to a user and determining whether or not the user has authority to use a specific program under a specific business environment.