JP2004348631A - Account management system, account management method, and account management program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce the loads and costs of account management in respective computers managed by respective different administrators in a wide area distributed type processing environment. <P>SOLUTION: After checking the verification of a user terminal ID, a right imparting server 110 transmits account management right information 102 to a user terminal 100 through the Internet. Even when a calculation utilization request is outputted to all computers 120, the user terminal 100 presents the account management right information 102 received from the right imparting server 110 through the Internet and transmits calculation processing request information. Each computer 120 receiving the account management right information 102 generates user's accounts when account management right indicated by the account management right information 102 is a valid right, and performs a calculation processing in accordance with the user's request. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an account management system, an account management method, and an account management program for managing a user account in a computer system that provides computer resources to a user in response to a request from a user terminal.
[0002]
[Prior art]
As one of the wide-area distributed computing methods (grid computing (hereinafter, simply referred to as grid)) that allows a user to use resources of a plurality of computers managed by different management entities, the user performs different processing such as high-speed calculation processing. There is a method of requesting a plurality of computers installed at a site and managed by different administrators, and in such a computer system, a user must obtain an account for each computer. In general, the computer resources used for computing are the computing power of the computer, and the account is the user's right to use computer resources (a qualification that can be used).
[0003]
As a method of managing accounts in a plurality of computers, there is Active Directory (registered trademark) of Microsoft Corporation. However, these methods are methods for a single administrator to manage accounts of a plurality of computers. That is, one computer manages accounts of all computers to be managed. Therefore, it cannot be applied to account management in an environment where a plurality of management entities exist, such as a grid. The reason is that, in a widely distributed computing environment such as a grid, each managing entity gives a user outside the site a right to use a part of the computer (for example, a right to use the computing power of the computer). Only) and do not want to grant all of the usage rights.
[0004]
Non-Patent Document 1 describes an account management system in a grid-wide distributed computing environment. In the account management system described in Non-Patent Document 1, account management is performed by an authentication unit using a public key cryptosystem and an authorization unit using a method called an access control list. Note that “authentication” refers to confirming that a user is indeed the user himself. "Authorization" means giving a user some authority.
[0005]
In the account management system described in Non-Patent Document 1, authentication means using a public key cryptosystem is used. In the authentication method using public key encryption, a pair of a public key and a secret key is created. Data encrypted with the private key can be decrypted only with the public key, and data encrypted with the public key can be decrypted with only the private key. The user terminal keeps the secret key secret and passes the public key to the computer via the communication network. Therefore, the computer passes data obtained by encrypting a random number or the like with the public key to the user terminal via the communication network, decrypts the received data with the secret key kept secret by the user terminal, and sends it back to the computer via the communication network. This allows the computer to perform user authentication. Only the user terminal that keeps the secret key holds the secret key, so the computer compares the returned data with the original data, and if they match, the computer has determined that the authentication was successful. to decide.
[0006]
When using a public key cryptosystem, it is a problem whether the public key is correct. A method of distributing public keys by another route such as mailing is also conceivable, but a burden is imposed when the number of public keys to be distributed is large. For this purpose, a certificate issued by a CA (Certification Authority) is generally used. That is, data in the form of a certificate including a public key is passed to a computer via a communication network. The certificate includes the name of the certificate holder, the public key of the certificate holder, a digital signature by the CA, and the like.
[0007]
An electronic signature is an electronic signature created by a CA. For example, a hash value is calculated for data included in the certificate based on a one-way function, and data obtained by encrypting the calculated hash value with a private key held by the CA is added to the certificate as an electronic signature. An algorithm called MD (Message-Digest algorithm) 5 or SHA (Secure Hash Algorithm) -1 is used as the primary direction function.
[0008]
The computer compares a hash value calculated from data included in the certificate with data obtained by decrypting an electronic signature included in the certificate with a public key of a CA. If they match, the computer determines that the public key included in the certificate is guaranteed by the CA, and can obtain the public key from the user terminal. The method of obtaining the public key of the CA can be obtained by the computer by using a certificate signed by a higher CA than the CA. If the computer has at least the certificate of the root CA in advance, the computer can obtain the public key of the CA.
[0009]
Further, in the account management system described in Non-Patent Document 1, an authorization unit using a method called an access control list is used. In such an authorization unit, the computer creates an account for each user in advance. Further, the computer holds a correspondence table including correspondence information between each account and a user name. When executing the calculation process on each computer, after confirming the user name by performing authentication confirmation using the public key method, the computer checks the user name included in the certificate based on the correspondence table. Check if the corresponding account exists. Then, the computer executes the process according to the authority granted to the account corresponding to the user name.
[0010]
Non-Patent Document 2 describes another account management system in a grid-wide distributed computing environment. The account management system described in Non-Patent Document 2 is an account sharing type system called a CAS (Community Authorization Service). In the account management system, the authentication system based on the public key method is extended to enable the authority to be transferred to the user terminal side, and the function of the authority transfer is used.
[0011]
In order to transfer the authority, the user terminal to which the authority is to be transferred newly creates a pair of a certificate and a private key. The user terminal signs the created certificate using a private key. The certificate signed by the user terminal is called a proxy certificate. An expiration date is set in the proxy certificate. Then, the terminal holding the secret key corresponding to the proxy certificate is treated as a terminal having the same authority as the user terminal. Therefore, in this method, it can be considered that the user terminal is incorporated in the tree structure of the CA that leads to the root CA.
[0012]
The system using CAS utilizes such a mechanism of authority transfer. In the CAS system, a CAS computer is installed for each community (site). Also, an account is created for each resource (terminal) with the authority of the CAS computer. The user terminal is authenticated by the CAS computer and receives the authority transfer from the CAS computer. In this case, the delegated authority is limited to a predetermined content, and the user terminal is delegated the authority. For example, the user terminal obtains a certificate including information indicating the contents of the authority delegated from the CAS computer.
[0013]
[Non-patent document 1]
Randy Butler, Von Welch, Douglas Engert, Ian Foster, Steven Tuecke, John Volmer, Carl Kesselman, "A National-Scale, International, International, International, International, Infra.
[Non-patent document 2]
Laura Pearlman, Von Welch, Ian Foster, Carl Kesselman, Steven Tuecke, "A Community Authorization Service for Group Collaboration", Proceedings of the IEEE 3rd International Workshop on Policies for Distributed Systems and Networks, 2002 year
[0014]
[Problems to be solved by the invention]
In the account management system described in Non-Patent Document 1, a user account must be created on all computers participating in a wide-area distributed computing environment. In addition, all computers must update the correspondence table between the account and the user name. Therefore, the burden on the administrator of each computer is large and the management cost is large.
[0015]
In the account management system described in Non-Patent Document 2, processing such as addition or deletion of an account may be performed only by a CAS computer. Therefore, there is no need to create an account or update the correspondence table on each computer, and the management burden and cost are reduced. However, in a system using CAS, a user terminal requests processing from a plurality of computers using the same account. That is, a system using CAS can be said to be a reusable model in which a common account is used by each computer. Therefore, there is a possibility that the owner of the file becomes the same person on each computer, and the file created by the user may be viewed or deleted by another person. There is also a problem that it is difficult for a user to perform statistical processing of usage time using the processing capability of a computer.
[0016]
Thus, the present invention provides an account management system, an account management method, and an account that can reduce the burden and cost required for managing a user account in a computer system that provides computer resources to a user in response to a request from a user terminal. The purpose is to provide a management program.
[0017]
[Means for Solving the Problems]
In the account management system according to the present invention, a user terminal presents to a computer self-certification means for transmitting certification information for certifying a user and information indicating account management authority indicating a right to request account management. Means for presenting account management authority, wherein the computer authenticates the user based on the certification information transmitted from the user terminal, and manages the account when the user terminal transmits the account management authority. It is characterized by comprising an authority checking means for judging whether the authority is valid, and an account managing means for executing account management when the authority checking means confirms that the account management authority is effective.
[0018]
The account management system further includes an authorization server having an authority to issue account management authority, wherein the authorization server includes: an authentication unit that authenticates the user based on the authentication information transmitted from the user terminal; It may be configured to include an authority information creating unit that generates information indicating the account management authority when the user is authenticated, and transmits the information to the user terminal.
[0019]
BEST MODE FOR CARRYING OUT THE INVENTION
Embodiment 1 FIG.
Hereinafter, a first embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing an example of a configuration of a wide-area distributed computing environment to which an account management system according to the present invention is applied. As shown in FIG. 1, in a wide-area distributed computing environment, a user terminal (user terminal) 100 used by a user (user), a computer 120 that executes computation processing in response to a user request, and an account management authority Is issued to the user via the Internet. Note that the user terminal 100, the computer 120, and the authorization server 110 may be connected via a communication network other than the Internet. Although only one authorization server 110 is shown in FIG. 1, a plurality of authorization servers may exist.
[0020]
The user can operate the user terminal 100 to make a computer use request to a plurality of computers 120 at different sites. By making a computer use request to a plurality of computers 120, a user can obtain a virtual computing environment that executes computation processing at high speed.
[0021]
The “account management authority” is an authority that allows a user to request the computer 120 to manage an account (create, update, and delete an account). When the user receives one account management right from the right granting server 110, the user presents the account management right to a large number of computers 120, and the management of the account is executed in each computer 120.
Note that each computer 120 has previously given the authority to issue the account management authority to the authority granting server 110. Further, the user can have the plurality of authorization servers 110 issue account management authority. In that case, as long as each computer 120 has given the authority to issue the account management authority to those authority grant servers 110, any of the account management authority issued from the plurality of authority grant servers 110 can be assigned to any computer 120. Account management can be performed.
[0022]
The user terminal 100 is an information processing terminal such as a workstation. As shown in FIG. 1, the user terminal 100 includes a self-ID certifying device 101 as self-certifying means for holding certification information for certifying that the user is a user. The self-ID certification device 101 is, for example, a user identifier (hereinafter, referred to as a user ID) in advance.
) And create and maintain a public key certificate as proof information. Hereinafter, the public key certificate is simply referred to as a certificate. Note that information having a simpler structure using a simple ID and a password may be used as the proof information. In addition, the user terminal 100 includes an account management authority presentation unit (not shown) that presents information indicating the account management authority to the computer 120.
[0023]
Note that the self-ID certifying device 101 and the account management authority presenting unit are realized by a control unit (arithmetic processing device: not shown) that executes processing according to a program stored in a storage device (not shown) of the user terminal 100. .
[0024]
The computer 120 performs calculation processing in response to a request from the user terminal 100. In the present embodiment, the user terminal 100 can access a plurality of computers 120 installed at different sites and having different managers via the Internet. Each computer 120 generates an account for the user terminal 100 separately, and performs processing such as changing or deleting the attribute of the account.
Hereinafter, issuing an account to the user terminal 100 or performing processing such as changing or deleting the attribute of the account is referred to as performing account management. Note that changing the attribute of an account means changing a user group of an account registered in the computer 120 or the like.
[0025]
As shown in FIG. 1, the computer 120 authenticates the user (specifically, authenticates the user ID). The authentication device 121 as an authentication unit, and determines whether the account management authority received from the user terminal 100 is valid. It includes an authority checking device 122 as an authority checking means for determining, and an account management device 123 as an account managing means for performing account management. In addition, a storage device (not shown) of the computer 120 stores account management in which an identifier (hereinafter, referred to as an authorization server ID) of the authorization server 110 to which the computer 120 is authorized to issue account management authority is described. Includes permission authorization server table 124. Note that the authentication device 121, the authority confirmation device 122, and the account management device 123 are realized by a control unit (arithmetic processing device: not shown) that executes processing according to a program stored in a storage device of the computer 120.
[0026]
The authorization server 110 is operated by, for example, an account management company that is authorized to issue account management authority. A process of determining whether to create an account or the like for the user terminal 100 accessed via the Internet, that is, determining whether the user terminal 100 is a terminal capable of requesting account management. The process is a process originally performed by the computer 120 itself. In the present embodiment, the authority granting server 110 is given the authority to determine whether or not the user terminal 100 is a terminal capable of requesting account management on behalf of the computer 120.
[0027]
In the computer 120, the fact that the identifier of the authorization server 110 is described in the account management permission authorization server table 124 means that if the authorization server 110 issues account management authority to the user, the authorization server 110 This means that the computer 120 has recognized the authorization server 110 that the account management authority issued by the computer 110 is trusted and the account management is performed in accordance with the presentation of the account management authority from the user who has been issued. In other words, this means that the authorization server 110 has been given the authority to determine whether or not the user terminal 100 is a terminal that can make an account management request.
[0028]
As shown in FIG. 1, the authorization server 110 authenticates a user, specifically, an authentication device 111 as an authentication unit for authenticating a user ID, and account management authority information 102 that is information indicating account management authority. An authority information generating device 112 as an authority information creating unit to be issued is included. In addition, a storage device (not shown) of the authorization server 110 stores an authorization target user terminal table 113 in which the user ID of a user who has concluded a contract is described in advance. Note that the authentication device 111 and the authority information generating device 112 are realized by a control unit (arithmetic processing device: not shown) that executes processing according to a program stored in a storage device of the authority granting server 110.
[0029]
When the contract is concluded, information such as the address of the user and a credit card number for collecting a usage fee is registered in the storage device of the authorization server 110. When a certificate is used for authentication confirmation of an ID or the like, a CA trusted by the authorization server 110 is specified in advance by a contract. In this case, a plurality of CAs trusted by the authorization server 110 may be designated, and the user may be able to select a CA to be signed from the plurality of CAs.
[0030]
FIG. 2 is a block diagram for explaining processing executed by the self ID certification device 101 in the user terminal 100 and the authentication device 111 in the authorization server 110.
[0031]
The self-ID certifying device 101 generates a secret key 301 and a public key 312 according to an algorithm of a public key cryptosystem. Note that the private key 301 and the public key 312 may be generated by a third party such as a CA. The self ID certification device 101 holds a secret key 301. In addition, the self ID certification apparatus 101 has the CA 320 issue a certificate 311 as certification information including the public key 312 and the ID 313 (in this example, the user ID). The certificate 311 is signed (electronic signature: digital signature) by the CA 320 specified at the time of contract between the account management company and the user. In the present embodiment, the fact that signature data is added to a certificate by a CA is simply referred to as “signed by a CA”. The signature 311a is data obtained by encrypting the hash value of the data included in the certificate 311 with the private key of the CA 320.
[0032]
The storage device of the authorization server 110 stores a certificate 314 of the CA 320 specified in advance. The certificate 314 has a public key 315 of the CA 320.
[0033]
The user terminal 100 transmits a certificate 311 as proof information to the authorization server 110 via the Internet. Upon receiving the certificate 311, the authentication device 111 decrypts the signature 311 a using the CA public key 315 included in the CA certificate 314. The authentication device 111 calculates a hash value of data included in the certificate 311. Then, the authentication device 111 compares the calculated hash value with the hash value obtained by decrypting the signature 311a. If they match, the authentication device 111 determines that the certificate 311 is signed by the CA 320.
[0034]
Next, the authentication device 111 generates data (hereinafter, referred to as random number encrypted data) obtained by encrypting random number data with the public key 312 included in the certificate 311. The authorization server 110 transmits the random number encryption data generated by the authentication device 111 to the user terminal 100 via the Internet. When the user terminal 100 receives the random number encrypted data, the self-ID certifying device 101 decrypts the random number encrypted data into random number data using the private key 301 held. The user terminal 100 transmits the decrypted random number data to the authorization server 110 via the Internet.
[0035]
The authentication device 111 of the authorization server 110 compares the received random number data with the random number data before being encrypted by the public key 312. If they match, the authentication device 111 determines that the ID 313 included in the certificate 311 is the user ID of the user holding the private key 301 corresponding to the public key 312.
[0036]
Note that the method of confirming the user ID is not limited to a method using a public key cryptosystem and a certificate. For example, the user ID may be confirmed by a method using a common key cryptosystem such as Kerberos. Further, for example, the computer 120 may confirm the user ID based on the user ID and the password received from the user terminal 100 via the Internet.
[0037]
The above-described user ID confirmation method is also used between the authentication device 121 in the computer 120 and the self-ID certification device 101 in the user terminal 100.
[0038]
FIG. 3 is a block diagram for explaining operations of the authority information generation device 112 in the authority grant server 110 and the authority confirmation device 122 in the computer 120. Authorization server 110 transmits account management authority information 102 to user terminal 100 in response to a request from user terminal 100. In this example, the account management authority information 102 includes account creation permission information 404 describing that a request for account management from the user terminal 100 to the computer 120 should be granted. As shown in FIG. 3, the account management authority information 102 includes a user ID 402 and an authorization server ID 403. The authorization server ID 403 is information for specifying the authorization server that has issued the account management authority. Further, the account management authority information 102 is signed by the authorization server 110. That is, the account management authority information 102 includes the signature 405 by the authority granting server 110.
[0039]
The computer 120 receives and holds the certificate 423 of the authorization server 110 from the authorization server 110 in advance. The computer 120 stores in advance a certificate 423 of the authorization server acquired by mail or the like at the time of contract with the account management company in a storage device or the like. Further, the computer 120 may receive the certificate 423 of the authorization server together with the account management authority information 102 via the user terminal 100. The certificate 423 of the authorization server includes the public key 424 of the authorization server and the authorization server ID 425. Further, the certificate 423 of the authorization server is signed by the CA 320 specified at the time of the contract. Accordingly, the authorization server certificate 423 includes a signature 426 by the CA 320 that the computer 120 trusts.
[0040]
The computer 120 acquires the certificate 421 of the CA 320 in advance and stores the certificate 421 in a storage device or the like. The computer 120 uses the CA public key 422 included in the CA certificate 421 to confirm that the certificate 423 of the authorization server is a certificate issued by the authorization server 110. In addition, the account management permission authority granting server table 124 of the computer 120 includes an authority granting server ID list 427 that describes the ID of the authority granting server 110 to which authority to issue account management authority is given. Therefore, the certificate 423 of the authorization server not described in the authorization server ID list 427 is invalid.
[0041]
Upon receiving the account management authority information 102 from the user terminal 100, the computer 120 decrypts the signature 405 included in the account management authority information 102 with the public key 424 of the certificate 423 of the authority granting server that has signed the signature 405. Further, the computer 120 calculates a hash value of data included in the account management authority information 102. Then, the computer 120 compares the calculated hash value with the decrypted value of the signature 405. If the values match, the computer 120 determines that the account management authority information 102 has been issued by the authorization server 110. That is, it is determined that the account management authority presented by the user terminal 100 is valid.
[0042]
As described above, when the user terminal 100 presents the account management authority, the authority granting server that has issued the account management authority determines that the authority granting server that has issued the account management authority has the authority to issue the account management authority. Check whether it is a server. Then, when it is confirmed that the server is an authorized server having authority, the account management authority presented by the user terminal 100 is determined to be valid, and the account management device 123 executes the account management.
[0043]
Next, the operation will be described. FIG. 4 is a flowchart showing a process for calculation according to a request from the user terminal 100 and a process of account management. The user operates the user terminal 100 and inputs a command for causing the computer 120 to execute a process.
[0044]
The process to be executed by the computer 120 is generally a calculation process. However, an account management process such as changing or deleting an attribute of an account already registered in the computer 120 may be requested. Therefore, when the user wants to make a computer use request to the computer 120, the user inputs a command for executing the calculation processing. If the user wants to perform an account management process for an account already registered in the computer 120, the user inputs a command for managing the account. When the command is input, the following processes from step S101 to step S118 are automatically executed by the user terminal 100, the authorization server 110, and the computer 120.
[0045]
When a command is input to the user terminal 100, in the user terminal 100, the self ID certification device 101 transmits certification information to the authorization server 110 via the Internet (step S101). When the authorization server 110 receives the certification information, the authentication device 111 of the authorization server 110 checks the user ID based on the received certification information (step S102).
[0046]
After confirming the user ID, the authentication device 111 determines whether the accessing user terminal 100 is a user terminal described in the authorization-given user terminal table 113 (step S103). In the case where it is described in the authority granting user terminal table 113, the authentication device 111 determines that the account management authority may be issued to the user terminal 100.
[0047]
When it is determined that the account management authority can be issued, the authority information generation device 112 of the authority granting server 110 issues the account management authority information 102 (step S104). Then, the authorization server 110 transmits the account management authority information 102 to the user terminal 100 via the Internet (Step S104). When receiving the account management authority information 102, the user terminal 100 temporarily stores the account management authority information 102 in a storage device of the user terminal 100 or the like.
[0048]
If the user ID cannot be confirmed in step S102, the authority information generation device 112 does not issue the account management authority information 102. Also, in step S103, when it is confirmed that the user terminal 100 is a user terminal that should not receive the issuance of the account management authority, that is, it is determined that the user terminal 100 is a user terminal that is not described in the authority granting user terminal table 113. If confirmed, the authority information generation device 112 does not issue the account management authority information 102.
[0049]
Next, in the user terminal 100, the self-ID certification device 101 transmits the certification information to the computer 120 via the Internet (Step S105). Upon receiving the certification information, the authentication device 121 of the computer 120 checks the user ID of the user terminal 100 based on the received certification information (Step S106). The process of confirming the user ID by the authentication device 121 is the same as the process by the authentication device 111 in the authorization server 10.
[0050]
Further, the user terminal 100 transmits the account management authority information 102 to the computer 120 via the Internet (Step S107). Then, the user terminal 100 determines whether the command input by the user requests the computer 120 to perform calculation processing or requests account management (step S108). If the command is a request for calculation processing, the user terminal 100 transmits calculation request information to the effect that the calculation processing is requested to the computer 120 along with the requested calculation content via the Internet (step S109). If the received command is a command for requesting an account management process, the user terminal 100 transmits account management request information for requesting account management to the computer 120 via the Internet (step S110).
[0051]
The computer 120 determines whether the received request information is calculation request information or account management request information (step S111). If it is determined that the information is calculation request information, the account management device 123 of the computer 120 determines whether an account corresponding to the user ID confirmed in step S106 exists (step S112). For example, if the user terminal 100 has made a computer use request to the computer 120 in the past, the user's account has already been registered within the validity period.
[0052]
If it is determined in step S112 that the account does not exist, the authority confirmation device 122 of the computer 120 is configured based on the account management authority information 102 received from the user terminal 100, the contents of the account management permission authority granting server table 124, and the like. Then, it is determined whether an account for the user can be created (step S113).
[0053]
When it is confirmed that the user's account can be created, the account management device 123 generates an account for the user terminal 100 (Step S114). In this embodiment, the computer 120 does not need to notify the user terminal 100 of the generated account.
[0054]
After generating the account, the computer 120 executes the requested calculation processing (step S115). When the calculation process is completed, the computer 120 transmits computer usage information indicating the usage time of the user terminal 100 using the computer 120 to the authorization server 110 via the Internet (step S116). The authorization server 110 performs a charging process for the user terminal 100 based on the received computer usage information.
[0055]
If it is determined in step S112 that an account already exists, the computer 120 does not execute the processing in steps S113 and S114. In this case, the computer 120 executes the requested calculation processing based on the already registered account (step S115). When the calculation process is completed, the computer 120 sends the computer usage information to the authorization server 110 via the Internet (Step S116).
[0056]
If it is determined in step S111 that the received request is the account management request information, the authority confirmation device 122 determines that the user terminal 100 is a terminal of the user having the account management authority based on the account management authority information 102 and the like. It is confirmed whether or not there is (step S117). For example, when a user requests processing such as attribute change or deletion of an already registered account, account management request information is transmitted from the user terminal 100.
[0057]
When it is confirmed that the terminal is a user having the account management authority, the account management apparatus 123 executes the requested account management (step S118). For example, when the deletion of the account is requested, the account management device 123 deletes the account corresponding to the user terminal 100. Further, when a request to change the attribute of the account is made, the account management device 123 performs a process of changing the attribute, such as changing the user group of the account corresponding to the user terminal 100.
[0058]
Note that the user terminal 100 may transmit the account management authority information 102 in response to a request from the computer 120, instead of transmitting the account management authority information 102 to the computer 120 in step 107. For example, if it is confirmed in step S111 that the request is a request for an account management process, or if it is confirmed in step S112 that an account does not exist, the computer 120 stores the account management authority information in the user terminal 100. Request 102. Then, the user terminal 100 transmits the account management authority information 102 to the computer 120 in response to a request from the computer 120.
[0059]
In addition, in step S116, the computer 120 may transmit the computer usage information not every time the calculation process is completed but every predetermined period. For example, the computer 120 may transmit the computer usage information including the total value of the usage time in which the user terminal 100 has used the computer 120 within the predetermined period at every predetermined period defined in the contract.
[0060]
The authorization server 110 collects a charge for using the computer 120 from the user terminal 100 at predetermined intervals determined in advance by a contract. For example, the authorization server 110 collects a usage fee based on credit card information of a user registered in advance. Then, the authorization server 110 distributes the collected usage fee to each computer 120 using an online transfer or the like. The process of collecting and distributing the usage fee may be performed by an artificial procedure instead of the online process.
[0061]
As described above, according to the present embodiment, the user simply presents the account management authority issued from the authorization server 110 to the computer 120 requesting the calculation, and the computer 120 automatically A user account is created. That is, when the authority confirmation device 122 confirms that the account management authority is valid, the account management device 123 automatically creates an account if the account does not exist. Therefore, if all the computers existing in the wide area distributed computing environment have the same functions as those of the computer 120, the user presents the account management authority when requesting any computer to perform the calculation. All you need to do is create an account on any computer.
[0062]
That is, by giving the user the authority to determine whether or not each computer can make an account management request to the authorization server 110, each computer can use the user terminal 100 that has accessed it. It is not necessary to determine whether an account of the user is generated. Therefore, the burden and cost of account management on each computer managed by different administrators can be reduced.
[0063]
In addition, the user does not have to take account management procedures for a large number of computers existing in the wide area distributed computing environment, but only has one or a small number of authorization servers issue account management authority. You will be able to have each computer generate an account. Further, the user can make a request for a calculation process without being conscious of whether the computer 120 to which the calculation process is requested is a computer for which an account is already registered. That is, the user can request the calculation processing in the same procedure regardless of whether the account is a registered computer.
[0064]
Further, according to the present embodiment, since the computer 120 transmits the computer use information to the authorization server 110, the authorization server 110 can perform the accounting process for the user on behalf of the computer 120. Therefore, the authorization server 110 can collect the usage fee on behalf of the computer 120.
[0065]
Embodiment 2 FIG.
Next, a second embodiment of the present invention will be described with reference to the drawings. The configuration of the wide-area distributed computing environment in the present embodiment is the same as the configuration shown in FIG. However, the operations of the authority information generation device in the authority grant server 110 and the authority confirmation device in the computer are different from those in the first embodiment. In the present embodiment, the concept of delegation of authority is used to delegate the account management authority of the authorization server to the user, and the user requests each computer to manage the account based on the delegated account management authority. I do.
[0066]
FIG. 5 is a block diagram for explaining operations of the authority information generation device 112 in the authority grant server 110 and the authority confirmation device 122 in the computer 120. The authorization server 110 generates a public key A512 and a secret key A514 in advance, and has a CA or the like generate a certificate A511 as a first certificate including the public key A512. The certificate A 511 is a certificate for certifying the authorization server 110 and includes an authorization server ID 513. The certificate A 511 is signed by a CA 530 designated in advance. Therefore, the certificate A 511 includes the signature 511 a by the CA 530.
[0067]
The user terminal 100 has generated a public key B502 and a secret key B504 in advance. Further, the user terminal 100 has the CA or the like generate a new certificate B501 as the second certificate. The certificate B501 includes a public key B502 and an authorization server ID 503. Note that the certificate B501 may be generated by the authorization server 110 and received by the user terminal 100 from the authorization server 110 via the Internet. Further, the certificate B501 may specify the contents of the account management authority.
[0068]
In the present embodiment, the authority granting server 110 transfers the account management authority to the user terminal 100 by signing the certificate B501 using the private key A514.
[0069]
When receiving the transfer of authority, the user terminal 100 receives a signature on the certificate B501 and receives the certificate A511 from the authorization server 110 via the Internet. Then, the user terminal 100 transmits the certificate A 511 and the certificate B 501 to the computer 120 via the Internet when requesting a calculation process or requesting an update of an account.
[0070]
The computer 120 holds the certificate 521 of the CA 530 in advance. Upon receiving the certificate A 511 and the certificate B 501, the computer 120 checks whether or not the certificate A 511 is a certificate signed by the CA 530 by using the CA public key 522 included in the CA certificate 521.
[0071]
When the computer 120 confirms that the certificate A511 is a certificate signed by the CA 530, the computer 120 checks whether the certificate B501 is a certificate signed by the authorization server 110 using the public key A512 included in the certificate A511. Check whether or not.
[0072]
Next, the computer 120 performs authentication of the user terminal 100. That is, the computer 120 encrypts the random number data using the public key B502 to generate random number encrypted data, and transmits the random number encrypted data to the user terminal 100 via the Internet. The user terminal 100 decrypts the received random number encrypted data into random number data using the secret key B504. Then, the user terminal 100 transmits the decrypted random number data to the computer 120 via the Internet.
[0073]
The computer 120 compares the received random number data with the random number data before being encrypted by the public key B502. When these random number data match, the computer 120 determines that the authentication of the user terminal 100 has been successful. Through the above processing, the computer 120 determines that the user terminal 100 is the terminal to which the account management authority has been transferred by the authority granting server 110. In other words, the user terminal 100 determines that the delegated account management authority is valid.
[0074]
When it is confirmed that the user terminal 100 is a terminal to which the account management authority has been transferred, the computer 120 determines whether or not the authority server ID 513 included in the certificate A 511 is included in the authority server ID list 524. to decide. If it is included in the authorization server ID list 524, the computer 120 executes an account management process according to the account management authority.
[0075]
As described above, the method of issuing the account authority by the authorization server 110 and the process of confirming the user ID and the authority in the computer 120A are different from those of the first embodiment, but other processes are performed. Is the same as in the first embodiment.
[0076]
According to the present embodiment, it is considered that the user has been delegated the account management authority from the authorization server 110, and the user who has been delegated the account management authority sends a request to the computer 120 based on the delegated account management authority. Calculation and account management processes.
[0077]
Further, similarly to the first embodiment, in a wide-area distributed computing environment, it is possible to reduce the burden and cost of account management of each computer managed by a different administrator.
[0078]
Embodiment 3 FIG.
Next, a third embodiment of the present invention will be described with reference to the drawings. The configuration of the wide-area distributed computing environment in the present embodiment is the same as the configuration shown in FIG. In the first embodiment, when a calculation processing request is made from the user terminal 100 to which no account is registered, the computer 120 automatically generates an account and executes the requested calculation processing. However, in the present embodiment, the computer 120 does not generate an account when a calculation processing request is made from the user terminal 100, but generates an account in response to a request for generating an account. That is, the user requests the computer 120 to perform a calculation process after the registration of the account is completed.
[0079]
FIG. 6 is a flowchart illustrating an account management process including account generation performed in response to a request from the user terminal 100. The user operates the user terminal 100 and inputs a command for requesting account management. For example, when an account is not registered in the computer 120, the user first inputs a command requesting creation of an account. When the command is input, the user terminal 100, the authorization server 110, and the computer 120 automatically execute the processing from step S201 to step S209 described below.
[0080]
The user terminal 100 transmits the certification information to the authorization server 110 via the Internet according to the operation of the user (step S201). When the authorization server 110 receives the certification information, the authentication device 111 confirms the user ID based on the received certification information (Step S202).
[0081]
After confirming the user ID, the authentication device 111 refers to the authorization target user terminal table 113 to determine whether or not the accessing user terminal 100 is a terminal to which account management authority may be assigned (step S1). S203). If it is determined that the terminal can be given the account management authority, the authority information generation device 112 issues the account management authority information 102 (step S204).
[0082]
Next, the user terminal 100 transmits the certification information to the computer 120 via the Internet (Step S205). When the computer 120 receives the certification information, the authentication device 121 checks the user ID of the user terminal 100 based on the received certification information (Step S206). Note that the specific configuration for confirming the user ID is the same as the configuration shown in FIG. 3, and the processing procedure is the same as that in steps S101 and S102 shown in FIG.
[0083]
The user terminal 100 transmits the account management authority information 102 to the computer 120 via the Internet (Step S207). Further, the user terminal 100 transmits the account management request information to the computer 120 via the Internet (Step S207). The above processing is the same as the processing in the first embodiment.
[0084]
The computer 120 confirms whether or not the user terminal 100 is a terminal that can receive the account management authority based on the received account management authority information 102 and the account management permission authority granting server table 124 (step S208). .
[0085]
When it is confirmed in step S208 that the terminal can receive the account management authority, the account management apparatus 123 executes the requested account management process (step S209). For example, when an account generation is requested, the account management device 123 generates an account for the user terminal 100. When a request to change or delete an attribute of an already registered account is made, the account management apparatus 123 changes or deletes the attribute of the account.
[0086]
Next, an operation in the case of executing a calculation process according to a request from the user terminal 100 will be described. FIG. 7 is a flowchart illustrating a process of executing a calculation process requested by the user terminal 100. When the user has already registered an account and requests the computer 120 to perform calculation processing, the user operates the user terminal 100 to input a command for requesting calculation processing or execute a program. When the command is input, the following processes from step S301 to step S305 are automatically executed by the user terminal 100 and the computer 120.
[0087]
When the command is input according to the operation of the user, the user terminal 100 transmits the certification information to the authorization server 110 via the Internet (step S301). When the computer 120 receives the certification information, the authentication device 121 checks the user ID based on the received certification information (step S302). After confirming the user ID and confirming that the user terminal 100 has an account already registered, the computer 120 transmits confirmation information indicating that the user ID and the account have been confirmed to the user terminal 100 via the Internet. I do. Then, the user terminal 100 transmits calculation request information including the content of the calculation to be requested to the computer 120 via the Internet (step S303).
[0088]
Upon receiving the calculation request information, the computer 120 executes the requested calculation process (Step S304). When the calculation process ends, the computer 120 transmits the computer usage information to the authorization server 110 via the Internet (Step S305). Then, the authorization server 110 performs a billing process for the user terminal 100 based on the received computer usage information.
[0089]
As described above, according to the present embodiment, the processing for causing computer 120 to execute the calculation and the processing for account management are executed independently. Therefore, the user transmits information indicating the computer use request to the computer 120 after the account is created. Unlike the case of the first embodiment, the authority confirmation process is not executed when the computer 120 executes the calculation, so that the number of processing steps when a computer use request is made can be reduced. In addition, the existing protocol for requesting calculation processing can be used as it is, and the burden and cost for system construction can be reduced.
[0090]
In the first and third embodiments, the case where the user terminal 100 obtains the account management authority information 102 by receiving it from the authorization server 110 has been described. May be obtained by mail or the like. In this case, for example, in the processes shown in FIGS. 4 and 6, it is not necessary to execute the processes of steps S101 to S104 and steps S201 to S204.
[0091]
Also, there is no need to install the authorization server 110, and the management burden and cost on the account management company can be reduced. Note that the expiration date of the account management authority information 102 is set to be sufficiently long as compared with the case where the account management authority is obtained online from the authorization server 110. Further, the account management company may install a computer for performing only the billing process for the user terminal 100.
[0092]
【The invention's effect】
As described above, according to the present invention, an account management system, an account management method, and an account management program allow a computer to authenticate a user based on certification information transmitted from the user terminal, and It is configured to execute account management after confirming that the management authority is valid, so in a widely distributed computing environment, the burden and cost of account management for each computer managed by a different administrator is reduced. can do.
[0093]
Also, the authorization server which authenticates the user based on the certification information transmitted from the user terminal, generates information indicating the account management authority when the certification means authenticates the user, and transmits the information to the user terminal. If provided, the user terminal can obtain account management authority online.
[Brief description of the drawings]
FIG. 1 is a block diagram showing an example of the configuration of a wide-area distributed computing environment to which an account management system according to the present invention is applied.
FIG. 2 is a block diagram for explaining processing executed by a self-ID certification device and an authentication device.
FIG. 3 is a block diagram for explaining operations of an authority information generation device and an authority confirmation device.
FIG. 4 is a flowchart showing processing for calculation and processing for account management.
FIG. 5 is a block diagram for explaining operations of the authority information generation device and the authority confirmation device.
FIG. 6 is a flowchart illustrating an account management process.
FIG. 7 is a flowchart showing a process for calculation.
[Explanation of symbols]
100 user terminal
101 Self ID certification device
102 Account management authority information
110 Authorization server
111 Authentication device
112 Authority information generation device
113 Authorization target user terminal table
120 Computer
121 Authentication device
122 Authority confirmation device
123 Account management device
124 Account management permission authority grant server table

Claims (13)

An account management system for managing a user account in a computer system that provides computer resources to a user in response to a request from a user terminal,
The user terminal,
A self-certifying means for transmitting certification information for certifying a user,
Account management right presenting means for presenting to the computer information indicating the account management right representing the right to request account management,
The computer is
Authentication means for authenticating a user based on the certification information transmitted from the user terminal;
When the account management authority is transmitted from the user terminal, an authority confirmation unit that determines whether the account management authority is valid,
An account management system comprising: an account management unit that executes account management when the authority confirmation unit confirms that the account management authority is valid. 2. The account management system according to claim 1, wherein when the authority confirmation unit confirms that the account management authority is valid, the account management unit automatically generates an account if the account does not exist. 2. The account management system according to claim 1, wherein the user terminal transmits information indicating a computer use request to the computer after the account is generated. An authorization server having the authority to issue account management authority,
The authorization server,
Authentication means for authenticating a user based on the certification information transmitted from the user terminal;
4. The authority according to claim 1, further comprising: authority information creating means for generating information indicating an account management authority when the certifying means authenticates the user and transmitting the information to the user terminal. Account management system described in section. 5. The account management system according to claim 4, wherein the authority information creating means in the authorization server generates information indicating an account management authority with an electronic signature. The authority confirmation means in the computer receives a certificate certifying the authorization server directly from the authorization server or via a user terminal, the information indicating the account management authority received from the user terminal, and the certificate 6. The account management system according to claim 5, wherein it is determined whether or not the account management authority is valid. The means for presenting account management authority on the user terminal
5. The account management system according to claim 4, wherein the first certificate for certifying the right grant server and the second certificate digitally signed by the right grant server for delegating account management authority are transmitted to the computer. 8. The account management system according to claim 7, wherein the authority checking means in the computer checks whether the account management authority is valid based on the first certificate and the second certificate received from the user terminal. The account management system according to any one of claims 4 to 8, wherein the computer transmits the computer usage information to the authorization server after completing the calculation process. An account management method for managing a user account in a computer system that provides computer resources to a user in response to a request from a user terminal,
The user terminal transmits proof information for certifying a user to the computer,
The computer authenticates a user based on the certification information transmitted from the user terminal;
A step in which the user terminal presents information indicating account management authority indicating a right to request account management to a computer;
The computer determines whether the account management authority received from the user terminal is valid,
Executing the account management when the computer confirms that the account management authority is valid. A step in which the user terminal transmits proof information for certifying the user to an authorization server having an authority to issue account management authority;
The authorization server authenticates the user based on the certification information transmitted from the user terminal;
11. The account management method according to claim 10, further comprising the step of: after authenticating the user, generating information indicating account management authority and transmitting the generated information to the user terminal. An account management program for managing a user account in a computer system that provides computer resources to a user in response to a request from a user terminal,
To the computer,
A process of authenticating the user based on the proof information received from the user terminal, and when receiving the account management right from the user terminal, which indicates the right to request account management, the account management right is valid. Processing to determine whether or not
After confirming that the account management authority is valid, an account management program for executing the process of performing account management. A program mounted on an authorization server having an authority to issue account management authority in a computer system that provides computer resources to a user in response to a request from a user terminal,
In the authorization server,
A process of authenticating a user based on the certification information transmitted from the user terminal;
And a process of generating information indicating account management authority and transmitting the generated information to the user terminal when the user is authenticated.

Images