JP4706165B2 - Account management system, account management method, and account management program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an account management system, an account management method, and an account management program for managing a user account in a computer system that provides computer resources to a user in response to a request from a user terminal.
[0002]
[Prior art]
One of the wide-area distributed computing methods (grid computing (hereinafter simply referred to as grid)) that allows users to use the resources of multiple computers managed by different management entities. There is a method of requesting a plurality of computers installed at a site and managed by different administrators, and in such a computer system, the user must acquire an account for each computer. In general, the computer resource used for the computer is the computer's computing power, and the account is the user's computer resource usage right (qualification that can be used).
[0003]
As a method of managing accounts in a plurality of computers, there is Active Directory (registered trademark) of Microsoft Corporation. However, these methods are methods for a single administrator to manage accounts of a plurality of computers. That is, one computer performs account management for all computers to be managed. Therefore, it cannot be applied to account management in an environment where a plurality of management entities exist like a grid. The reason for this is that in a wide-area distributed computing environment such as a grid, each management entity has the authority to use a part of the computer (for example, the authority to use the computing power of the computer) for users who exist outside the site. Only) and not wanting to give all of the usage rights.
[0004]
Non-Patent Document 1 describes an account management system in a wide-area distributed computing environment using a grid. In the account management system described in Non-Patent Document 1, account management is performed by an authentication means using a public key cryptosystem and an authorization means using a technique called an access control list. Note that “authentication” means confirming that the user is indeed the user. “Authorization” means giving a user some authority.
[0005]
In the account management system described in Non-Patent Document 1, authentication means using a public key cryptosystem is used. In the authentication method using public key cryptography, a public key and private key pair are created. Data encrypted with the private key can be decrypted only with the public key, and data encrypted with the public key can be decrypted with only the private key. The user terminal conceals the secret key and passes the public key to the computer via the communication network. Therefore, the computer passes the data encrypted with a public key such as a random number to the user terminal via the communication network, decrypts the data received with the secret key concealed by the user terminal, and sends it back to the computer via the communication network. Thus, the computer can perform user authentication. Since the secret key is held only by the user terminal that keeps the secret key secret, the computer compares the returned data with the original data, and if they match, the computer is successfully authenticated. to decide.
[0006]
When using a public key cryptosystem, whether the public key is correct becomes a problem. A method of distributing the public key using another route such as mail is conceivable, but it is burdensome when the number of public keys to be distributed is large. For this purpose, a certificate issued by a CA (Certification Authority) is generally used. That is, certificate format data including the public key is passed to the computer via the communication network. The certificate includes a certificate holder name, a public key of the certificate holder, an electronic signature by a CA, and the like.
[0007]
An electronic signature is a digital signature made by a CA. For example, a hash value is calculated for data included in a certificate based on a one-way function, and data obtained by encrypting the calculated hash value with a private key held by the CA is added to the certificate as an electronic signature. As the primary direction function, an algorithm called MD (Message-Digest algorithm) 5 or SHA (Secure Hush Algorithm) -1 is used.
[0008]
The computer compares the hash value calculated from the data included in the certificate with the data obtained by decrypting the electronic signature included in the certificate with the CA public key. If they match, the computer determines that the public key included in the certificate is guaranteed by the CA, and can obtain the public key from the user terminal. Note that the computer can obtain a CA public key by using a certificate signed by a CA higher than the CA. If the computer has at least a root CA certificate in advance, it can obtain the CA public key.
[0009]
Further, in the account management system described in Non-Patent Document 1, an authorization means using a method called an access control list is used. In such authorization means, the computer creates an account for each user in advance. Further, the computer holds a correspondence table including correspondence information between each account and a user name. When executing calculation processing on each computer, after confirming the user name by performing authentication confirmation using the public key method, the computer uses the correspondence table to determine the user name included in the certificate. Check if the corresponding account exists. Then, the computer executes processing according to the authority granted to the account corresponding to the user name.
[0010]
Non-Patent Document 2 describes another account management system in a wide-area distributed computing environment using a grid. The account management system described in Non-Patent Document 2 is an account sharing type system called CAS (Community Authorization Service). In the account management system, the authentication system based on the public key method is extended to enable authority delegation to the user terminal side, and the authority delegation function is used.
[0011]
In order to perform authority delegation, the user terminal to which authority is delegated newly creates a certificate / private key pair. The user terminal signs the created certificate using the private key. The certificate signed by the user terminal is called a proxy certificate. The proxy certificate has an expiration date. A terminal holding a secret key corresponding to the proxy certificate is treated as a terminal having the same authority as the user terminal. Therefore, in this system, it can be considered that the user terminal is incorporated in the CA tree structure leading to the root CA.
[0012]
The system based on CAS uses such a mechanism for delegating authority. In the CAS system, a CAS computer is installed for each community (site). Also, an account is created for each resource (terminal) with the authority of the CAS computer. The user terminal is authenticated by the CAS computer and receives authority transfer from the CAS computer. In this case, the authority to be delegated is limited to a predetermined content, and the user terminal is delegated authority. For example, the user terminal obtains a certificate including information indicating the contents of authority delegated from the CAS computer.
[0013]
[Non-Patent Document 1]
Randy Butler, Von Welch, Douglas Engert, Ian Foster, Steven Tuecke, John Volmer, Carl Kesselman, "A National-Scale Authentication Infrastructure", IEEE Computer, 2000, 33, 12, p60-66.
[Non-Patent Document 2]
Laura Pearlman, Von Welch, Ian Foster, Carl Kesselman, Steven Tuecke, "A Community Authorization Service for Group Collaboration", Proceedings of the IEEE 3rd International Workshop on Policies for Distributed Systems and Networks, 2002
[0014]
[Problems to be solved by the invention]
In the account management system described in Non-Patent Document 1, user accounts must be created in all computers participating in a wide-area distributed computing environment. In addition, all computers must update the correspondence table between accounts and user names. Therefore, the burden on the administrator of each computer is large and the management cost is high.
[0015]
Further, in the account management system described in Non-Patent Document 2, it is only necessary to perform processing such as addition or deletion of an account only by the CAS computer. Therefore, there is no need to create an account or update the correspondence table on each computer, and the management burden and cost are reduced. However, in a system using CAS, the user terminal requests processing from a plurality of computers using the same account. That is, a system using CAS can be said to be a reusable model in which a common account is reused on each computer. Therefore, there is a possibility that the owner of the file will be the same person on each computer, and there is a possibility that the file created by himself / herself will be viewed or deleted by others. In addition, there is a problem that it is difficult for a user to perform statistical processing of usage time using the processing capability of a computer.
[0016]
Therefore, the present invention provides an account management system, an account management method, and an account that can reduce the burden and cost required for managing a user account in a computer system that provides computer resources to a user in response to a request from a user terminal. The purpose is to provide a management program.
[0017]
[Means for Solving the Problems]
An account management system according to the present invention includes a user terminal, a plurality of computers that execute predetermined processing in response to a request from the user terminal, and an account generation Can request Account management request authority information indicating authority Send On behalf of each computer , User terminal Authorization server that determines whether or not is a terminal that can make account generation requests And the user terminal provides proof information for certifying the user. Authorization server A self-certification means to be transmitted to the server, a processing request for requesting execution of a predetermined processing, Authorization server Processing request means for transmitting the account management request authority information received from each computer to each computer, Authorization server On behalf of each computer on the condition that the authentication means for authenticating the user terminal based on the certification information received from the user terminal and that the authentication of the user terminal by the authentication means is successful. Judge that the user terminal is a terminal that can make a request to create an account. An account management request authority information transmitting means for transmitting account management request authority information to the user terminal, and each computer responds to the user terminal based on the account management request authority information received from the user terminal. Account generation means for generating an account, and process execution means for executing a predetermined process indicated by a process request received from a user terminal based on the account generated by the account generation means.
[0019]
DETAILED DESCRIPTION OF THE INVENTION
Embodiment 1 FIG.
Hereinafter, a first embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing an example of a configuration of a wide-area distributed computing environment to which an account management system according to the present invention is applied. As shown in FIG. 1, in a wide-area distributed computing environment, a user terminal (user terminal) 100 used by a user (user), a computer 120 that executes calculation processing in response to a user request, and account management authority Is granted to the user via the Internet. Note that the user terminal 100, the computer 120, and the authorization server 110 may be connected via a communication network other than the Internet. In FIG. 1, only one authorization server 110 is shown, but a plurality of authorization servers may exist.
[0020]
A user can operate the user terminal 100 to make a computer use request to a plurality of computers 120 at different sites. By making a computer use request to a plurality of computers 120, the user can obtain a virtual computing environment for executing calculation processing at high speed.
[0021]
The “account management authority” is an authority that allows the user to request account management (account generation, update, and deletion) from the computer 120. When the user receives one account management authority from the authority granting server 110, the account management authority is presented to a number of computers 120, whereby account management is executed in each computer 120. Each computer 120 has previously given the authority to issue an account management authority to the authority granting server 110. The user can also issue account management authority from a plurality of authority granting servers 110. In that case, if each computer 120 has the authority to issue account management authority to those authority granting servers 110, any account management authority issued from a plurality of authority granting servers 110 can be assigned to any computer 120. Account management can be performed.
[0022]
The user terminal 100 is an information processing terminal such as a workstation. As shown in FIG. 1, the user terminal 100 includes a self ID proving apparatus 101 as self proving means for holding certification information for proving that the user is a user. For example, the self ID certification device 101 has a public key certificate created as certification information including a user identifier (hereinafter referred to as a user ID) in advance and holds it. Hereinafter, the public key certificate is simply referred to as a certificate. Note that information having a simpler structure based on a simple ID and password may be used as proof information. The user terminal 100 also includes account management authority presenting means (not shown) that presents information indicating account management authority to the computer 120.
[0023]
The self ID certification device 101 and the account management authority presenting means are realized by a control unit (arithmetic processing device: not shown) that executes processing according to a program stored in a storage device (not shown) of the user terminal 100. .
[0024]
The computer 120 executes calculation processing in response to a request from the user terminal 100. In the present embodiment, the user terminal 100 can access a plurality of computers 120 installed at different sites and having different managers via the Internet. Each computer 120 separately generates an account for the user terminal 100, and performs processing such as changing or deleting the attribute of the account. Hereinafter, issuing an account to the user terminal 100 or performing processing such as changing or deleting the attribute of an account is referred to as account management. The account attribute change includes changing a user group for an account registered in the computer 120 or the like.
[0025]
As shown in FIG. 1, the computer 120 authenticates a user (specifically, authenticates a user ID), an authentication device 121 as an authentication unit, and whether the account management authority received from the user terminal 100 is valid. It includes an authority confirmation device 122 as authority confirmation means for determining, and an account management device 123 as account management means for performing account management. The storage device (not shown) of the computer 120 is an account management in which an identifier (hereinafter referred to as an authorization server ID) of the authorization server 110 to which the computer 120 is authorized to issue account management authority is described. A permission authority granting server table 124 is included. The authentication device 121, the authority confirmation device 122, and the account management device 123 are realized by a control unit (arithmetic processing device: not shown) that executes processing according to a program stored in the storage device of the computer 120.
[0026]
The authority grant server 110 is operated by, for example, an account manager who is given the authority to issue account management authority. Processing for determining whether or not to create an account for the user terminal 100 accessed via the Internet, that is, whether or not the user terminal 100 is a terminal that can make a request for account management. The process is originally performed by the computer 120 itself. In the present embodiment, the authority granting server 110 is given the authority to determine whether the user terminal 100 is a terminal that can make a request for account management on behalf of the computer 120.
[0027]
In the computer 120, the identifier of the authorization server 110 is described in the account management authorization authority grant server table 124. If the authorization server 110 issues account management authority to the user, the authorization server This means that the computer 120 recognizes the authority grant server 110 that the account management authority issued by the user 110 is trusted and the account management is performed in response to the presentation of the account management authority from the issued user. In other words, this means that the authority granting server 110 is given the authority to determine whether or not the user terminal 100 is a terminal that can request account management.
[0028]
As shown in FIG. 1, the authority granting server 110 authenticates a user, specifically, an authentication device 111 as an authentication means for authenticating a user ID, and account management authority information 102 which is information indicating account management authority. It includes an authority information generating device 112 as authority information generating means to be issued. Further, the storage device (not shown) of the authorization server 110 stores an authorization target user terminal table 113 in which user IDs of users who have concluded a contract in advance are described. Note that the authentication device 111 and the authority information generation device 112 are realized by a control unit (arithmetic processing device: not shown) that executes processing according to a program stored in the storage device of the authority granting server 110.
[0029]
When a contract is concluded, information such as a user's address and a credit card number for collecting a usage fee is registered in the storage device of the authorization server 110. When a certificate is used for authentication confirmation such as an ID, a CA that the authorization server 110 trusts is designated in advance by a contract. In this case, a plurality of CAs trusted by the authorization server 110 may be designated, and the user may be able to select a CA to receive a signature from among the plurality of CAs.
[0030]
FIG. 2 is a block diagram for explaining processing executed by the self ID certification device 101 in the user terminal 100 and the authentication device 111 in the authorization server 110.
[0031]
The self ID certification device 101 generates a secret key 301 and a public key 312 according to an algorithm of a public key cryptosystem. The secret key 301 and the public key 312 can be generated by a third party such as CA. The self ID certification device 101 holds the secret key 301. Further, the self ID certification device 101 has the CA 312 issue a certificate 311 as certification information including the public key 312 and the ID 313 (in this example, a user ID). The certificate 311 is previously signed (electronic signature: digital signature) by the CA 320 designated at the time of the contract between the account manager and the user. In the present embodiment, the fact that signature data is added to a certificate by CA is simply referred to as “signed by CA”. The signature 311a is data obtained by encrypting a hash value of data included in the certificate 311 with a CA320 private key.
[0032]
In addition, the storage device of the authorization server 110 stores a CA 320 certificate 314 designated in advance. The certificate 314 has a CA 320 public key 315.
[0033]
The user terminal 100 transmits a certificate 311 as certification information to the authorization server 110 via the Internet. Upon receiving the certificate 311, the authentication device 111 decrypts the signature 311 a with the CA public key 315 included in the CA certificate 314. Further, the authentication device 111 calculates a hash value of data included in the certificate 311. Then, the authentication device 111 compares the calculated hash value with the hash value obtained by decrypting the signature 311a. If they match, the authentication apparatus 111 determines that the certificate 311 is signed by the CA 320.
[0034]
Next, the authentication device 111 generates data obtained by encrypting random number data with the public key 312 included in the certificate 311 (hereinafter referred to as random number encrypted data). The authorization server 110 transmits the random number encrypted data generated by the authentication device 111 to the user terminal 100 via the Internet. When the user terminal 100 receives the random number encrypted data, the self ID certification device 101 decrypts the random number encrypted data into the random number data using the stored secret key 301. The user terminal 100 transmits the decrypted random number data to the authorization server 110 via the Internet.
[0035]
The authentication device 111 of the authorization server 110 compares the received random number data with the random number data before being encrypted with the public key 312. If they match, the authentication apparatus 111 determines that the ID 313 included in the certificate 311 is the user ID of the user who holds the private key 301 corresponding to the public key 312.
[0036]
Note that the user ID confirmation method is not limited to a method using a public key cryptosystem and a certificate. For example, the user ID may be confirmed by a method using a common key cryptosystem such as Kerberos. For example, the computer 120 may confirm the user ID based on the user ID and password received from the user terminal 100 via the Internet.
[0037]
The above-described user ID confirmation method is also used between the authentication device 121 in the computer 120 and the self ID certification device 101 in the user terminal 100.
[0038]
FIG. 3 is a block diagram for explaining the operation of the authority information generation device 112 in the authority grant server 110 and the authority confirmation device 122 in the computer 120. The authorization server 110 transmits account management authority information 102 to the user terminal 100 in response to a request from the user terminal 100. In this example, the account management authority information 102 includes account creation permission information 404 describing that an account management request from the user terminal 100 to the computer 120 should be granted. Further, as shown in FIG. 3, the account management authority information 102 includes a user ID 402 and an authority server ID 403. The authorization server ID 403 is information for identifying the authorization server that issued the account management authority. Further, the account management authority information 102 is signed by the authority granting server 110. That is, the account management authority information 102 includes a signature 405 by the authority granting server 110.
[0039]
The computer 120 receives and holds the certificate 423 of the authorization server 110 from the authorization server 110 in advance. For example, the computer 120 stores in advance a certificate 423 of the authorization server acquired by mail or the like when contracting with an account manager in a storage device or the like. Further, the computer 120 may receive the authority grant server certificate 423 together with the account management authority information 102 via the user terminal 100. The authorization server certificate 423 includes an authorization server public key 424 and an authorization server ID 425. Further, the certificate 423 of the authorization server is signed in advance by the CA 320 specified at the time of contract. Accordingly, the authorization server certificate 423 includes a signature 426 by the CA 320 that the computer 120 trusts.
[0040]
In addition, the computer 120 acquires the certificate 421 of the CA 320 in advance and stores it in a storage device or the like. The computer 120 uses the CA public key 422 included in the CA certificate 421 to confirm that the authorization server certificate 423 is a certificate issued by the authorization server 110. Further, the account management permission authority granting server table 124 of the computer 120 includes an authorization server ID list 427 in which the IDs of the authority granting servers 110 to which the authority to issue account management authority is given are described. Therefore, the certificate 423 of the authorization server that is not described in the authorization server ID list 427 is invalid.
[0041]
When the account management authority information 102 is received from the user terminal 100, the computer 120 decrypts the signature 405 included in the account management authority information 102 with the public key 424 of the certificate 423 of the authority granting server that performed the signature 405. Further, the computer 120 calculates a hash value of data included in the account management authority information 102. Then, the computer 120 compares the calculated hash value with the decrypted signature 405 value. If these values match, the computer 120 determines that the account management authority information 102 has been issued by the authority grant server 110. That is, it is determined that the account management authority presented by the user terminal 100 is valid.
[0042]
As described above, when the user terminal 100 presents account management authority, the authority confirmation device 122 of the computer 120 has the authority that the authority granting server that issued the account management authority has the authority to issue account management authority. Check if it is a server. If it is confirmed that the server is an authorized authority server, the account management authority presented by the user terminal 100 is assumed to be valid, and the account management apparatus 123 is caused to execute account management.
[0043]
Next, the operation will be described. FIG. 4 is a flowchart showing processing for calculation in response to a request from the user terminal 100 and account management processing. The user operates the user terminal 100 to input a command for causing the computer 120 to execute processing.
[0044]
The process executed by the computer 120 is generally a calculation process. However, an account management process such as attribute change or deletion of an account already registered in the computer 120 may be requested. Therefore, when a user wants to make a computer use request to the computer 120, the user inputs a command for executing a calculation process. If it is desired to perform account management processing for an account already registered in the computer 120, a command for performing account management is input. When a command is input, the following processing from step S101 to step S118 is automatically executed by the user terminal 100, the authorization server 110, and the computer 120.
[0045]
When a command is input to the user terminal 100, in the user terminal 100, the self ID certification device 101 transmits certification information to the authorization server 110 via the Internet (step S101). When the authorization server 110 receives the certification information, the authentication device 111 of the authorization server 110 confirms the user ID based on the received certification information (step S102).
[0046]
When the user ID is confirmed, the authentication device 111 determines whether or not the accessing user terminal 100 is a user terminal described in the authority grant target user terminal table 113 (step S103). If it is described in the authority grant target user terminal table 113, the authentication apparatus 111 determines that the account management authority may be issued to the user terminal 100.
[0047]
If it is determined that the account management authority may be issued, the authority information generating device 112 of the authority granting server 110 issues the account management authority information 102 (step S104). Then, the authority grant server 110 transmits the account management authority information 102 to the user terminal 100 via the Internet (step S104). Upon receiving the account management authority information 102, the user terminal 100 temporarily stores the account management authority information 102 in a storage device or the like of the user terminal 100.
[0048]
If the user ID cannot be confirmed in step S102, the authority information generation device 112 does not issue the account management authority information 102. Further, when it is confirmed in step S103 that the user terminal 100 is a user terminal that should not receive the issue of account management authority, that is, it may be a user terminal that is not described in the authority grant target user terminal table 113. If confirmed, the authority information generating device 112 does not issue the account management authority information 102.
[0049]
Next, in the user terminal 100, the self ID certification device 101 transmits certification information to the computer 120 via the Internet (step S105). When the certification information is received, the authentication device 121 of the computer 120 confirms the user ID of the user terminal 100 based on the received certification information (step S106). Note that the process of confirming the user ID by the authentication apparatus 121 is the same as the process by the authentication apparatus 111 in the authorization server 10.
[0050]
In addition, the user terminal 100 transmits the account management authority information 102 to the computer 120 via the Internet (step S107). Then, the user terminal 100 determines whether the command input by the user is a request for calculation processing from the computer 120 or a request for account management (step S108). In the case of a command requesting calculation processing, the user terminal 100 transmits calculation request information requesting calculation processing together with the requested calculation contents to the computer 120 via the Internet (step S109). In the case of a command requesting account management processing, the user terminal 100 transmits account management request information requesting account management to the computer 120 via the Internet (step S110).
[0051]
The computer 120 determines whether the received request information is calculation request information or account management request information (step S111). If it is determined that the information is calculation request information, the account management device 123 of the computer 120 determines whether an account corresponding to the user ID confirmed in step S106 exists (step S112). For example, if the user terminal 100 has made a computer use request to the computer 120 in the past, the user's account is already registered within the valid period.
[0052]
If it is determined in step S112 that the account does not exist, the authority confirmation device 122 of the computer 120 is based on the account management authority information 102 received from the user terminal 100, the contents of the account management permission authority grant server table 124, and the like. Then, it is confirmed whether or not the user's account can be created (step S113).
[0053]
If it is confirmed that a user account may be created, the account management apparatus 123 generates an account for the user terminal 100 (step S114). In the present embodiment, the computer 120 need not notify the user terminal 100 of the generated account.
[0054]
When the account is generated, the computer 120 executes the requested calculation process (step S115). When the calculation process ends, the computer 120 transmits computer usage information indicating the usage time of the user terminal 100 using the computer 120 to the authorization server 110 via the Internet (step S116). The authorization server 110 performs a charging process for the user terminal 100 based on the received computer usage information.
[0055]
If it is determined in step S112 that an account already exists, the computer 120 does not execute the processes in steps S113 and S114. In this case, the computer 120 executes the requested calculation process based on the already registered account (step S115). When the calculation process is completed, the computer 120 transmits the computer usage information to the authorization server 110 via the Internet (step S116).
[0056]
If it is determined in step S111 that the received request is account management request information, the authority confirmation device 122 is a user terminal for which the user terminal 100 has account management authority based on the account management authority information 102 or the like. It is confirmed whether or not there is (step S117). For example, the account management request information is transmitted from the user terminal 100 when the user requests processing such as attribute change or deletion of an already registered account.
[0057]
If it is confirmed that the terminal is a user terminal having the account management authority, the account management apparatus 123 executes the requested account management (step S118). For example, when the account deletion is requested, the account management apparatus 123 deletes the account corresponding to the user terminal 100. When an account attribute change is requested, the account management apparatus 123 performs an attribute change process such as changing the user group of the account corresponding to the user terminal 100.
[0058]
Note that the user terminal 100 may transmit the account management authority information 102 in response to a request from the computer 120 instead of transmitting the account management authority information 102 to the computer 120 in step 107. For example, when it is confirmed in step S111 that the request is a request for account management processing, or when it is confirmed in step S112 that an account does not exist, the computer 120 sends account management authority information to the user terminal 100. 102 is requested. Then, the user terminal 100 transmits account management authority information 102 to the computer 120 in response to a request from the computer 120.
[0059]
In step S116, the computer 120 may transmit the computer usage information every predetermined period instead of transmitting the computer usage information every time the calculation process is completed. For example, the computer 120 may transmit computer usage information including the total usage time of the user terminal 100 using the computer 120 within the predetermined period for each predetermined period determined in advance in the contract.
[0060]
The authority granting server 110 collects a usage fee for the computer 120 from the user terminal 100 for each predetermined period determined in advance by a contract. For example, the authority granting server 110 collects the usage fee based on the credit card information of the user registered in advance. Then, the authority granting server 110 distributes the collected usage fee to each computer 120 using online transfer or the like. It should be noted that the collection and distribution process of the usage fee may be performed by an artificial procedure, not the online process.
[0061]
As described above, according to the present embodiment, the user can present the account management authority issued from the authorization server 110 to the computer 120 that requests the calculation, and the computer 120 can automatically A user account is created. That is, when the authority confirmation apparatus 122 confirms that the account management authority is valid, the account management apparatus 123 automatically generates an account if the account does not exist. Therefore, if all the computers existing in the wide area distributed computing environment have the same function as that of the computer 120 described above, the user presents the account management authority when requesting the calculation to any computer. Simply create an account on any computer.
[0062]
In other words, each computer uses the user terminal 100 that has been accessed by giving the authority server 110 the authority to determine whether or not the account management request may be issued to each computer. There is no need to decide whether or not to create an account for a user who is currently on the market. Therefore, the burden and cost of account management in each computer managed by different managers can be reduced.
[0063]
In addition, the user only has to issue account management authority to one or a few authorization servers without going through the procedure for account management for each of a large number of computers in a wide area distributed computing environment. Accounts can be created on each computer. Further, the user can make a calculation process request without being aware of whether the computer 120 that is the calculation process request destination is an already registered computer. That is, the user can request the calculation process in the same procedure regardless of whether or not the computer is a registered account.
[0064]
Furthermore, according to the present embodiment, since the computer 120 transmits the computer usage information to the authorization server 110, the authorization server 110 can perform billing processing for the user on behalf of the computer 120. Therefore, the authorization server 110 can collect the usage fee on behalf of the computer 120.
[0065]
Embodiment 2. FIG.
Next, a second embodiment of the present invention will be described with reference to the drawings. The configuration of the wide-area distributed computing environment in the present embodiment is the same as the configuration shown in FIG. However, the operations of the authority information generation apparatus in the authority grant server 110 and the authority confirmation apparatus in the computer are different from those in the first embodiment. In this embodiment, using the concept of authority delegation, the account management authority of the authorization server is delegated to the user, and the user requests account management from each computer based on the delegated account management authority. To do.
[0066]
FIG. 5 is a block diagram for explaining the operation of the authority information generation device 112 in the authority grant server 110 and the authority confirmation device 122 in the computer 120. The authorization server 110 generates a public key A 512 and a private key A 514 in advance, and asks a CA or the like to generate a certificate A 511 as a first certificate including the public key A 512. The certificate A 511 is a certificate that certifies the authorization server 110 and includes an authorization server ID 513. The certificate A511 is signed by a CA 530 designated in advance. Therefore, the certificate A511 includes a signature 511a by the CA 530.
[0067]
The user terminal 100 generates a public key B502 and a secret key B504 in advance. Also, the user terminal 100 has the CA or the like generate a new certificate B501 as the second certificate. The certificate B501 includes a public key B502 and an authorization server ID 503. Note that the certificate B501 may be generated by the authorization server 110 and received by the user terminal 100 from the authorization server 110 via the Internet. The contents of account management authority may be specified in the certificate B501.
[0068]
In the present embodiment, the authority granting server 110 delegates the account management authority to the user terminal 100 by performing the signature 501a on the certificate B501 using the private key A514.
[0069]
When receiving the transfer of authority, the user terminal 100 receives a signature for the certificate B 501 and receives the certificate A 511 from the authority grant server 110 via the Internet. The user terminal 100 transmits the certificate A 511 and the certificate B 501 to the computer 120 via the Internet when requesting calculation processing or requesting account update.
[0070]
The computer 120 holds a CA 530 certificate 521 in advance. Upon receiving the certificate A 511 and the certificate B 501, the computer 120 checks whether the certificate A 511 is a certificate signed by the CA 530 by using the CA public key 522 included in the CA certificate 521.
[0071]
When the computer 120 confirms that the certificate A 511 is a certificate signed by the CA 530, the computer 120 checks whether the certificate B 501 is a certificate signed by the authorization server 110 using the public key A 512 included in the certificate A 511. Confirm whether or not.
[0072]
Next, the computer 120 authenticates the user terminal 100. That is, the computer 120 encrypts random number data with the public key B502 to generate random number encrypted data, and transmits it to the user terminal 100 via the Internet. The user terminal 100 decrypts the received random number encrypted data into random number data using the secret key B504. Then, the user terminal 100 transmits the decrypted random number data to the computer 120 via the Internet.
[0073]
The computer 120 compares the received random number data with the random number data before being encrypted with the public key B502. If these random number data match, the computer 120 determines that the user terminal 100 has been successfully authenticated. Through the above processing, the computer 120 determines that the user terminal 100 is a terminal to which the account granting authority has been transferred by the authority granting server 110. In other words, the user terminal 100 determines that the account management authority delegated is valid.
[0074]
When it is confirmed that the user terminal 100 is a terminal to which the account management authority has been transferred, the computer 120 determines whether or not the authorization server ID 513 included in the certificate A 511 is included in the authorization server ID list 524. to decide. When included in the authorization server ID list 524, the computer 120 executes account management processing according to the account management authority.
[0075]
As described above, the method of issuing the account authority by the authority granting server 110, the process of confirming the user ID in the computer 120A, and the process of confirming the authority are different from those in the first embodiment, but other processes are performed. Is the same as in the case of the first embodiment.
[0076]
According to the present embodiment, it is assumed that the user has received the account management authority from the authority granting server 110, and the user who has received the account management authority has been transferred to the computer 120 based on the transferred account management authority. To request calculation processing and account management processing.
[0077]
Further, similarly to the first embodiment, it is possible to reduce the burden and cost of account management for each computer managed by different administrators in a wide area distributed computing environment.
[0078]
Embodiment 3 FIG.
Next, a third embodiment of the present invention will be described with reference to the drawings. The configuration of the wide-area distributed computing environment in the present embodiment is the same as the configuration shown in FIG. In the first embodiment, when a calculation processing request is made from the user terminal 100 to which no account is registered, the computer 120 automatically generates an account and executes the requested calculation processing. However, in the present embodiment, the computer 120 does not generate an account when a calculation processing request is made from the user terminal 100, but generates an account in response to an account generation request. That is, after the account registration is completed, the user requests the computer 120 for calculation processing.
[0079]
FIG. 6 is a flowchart showing account management processing including account generation executed in response to a request from the user terminal 100. The user operates the user terminal 100 to input a command for requesting account management. For example, when an account is not registered in the computer 120, the user first inputs a command for requesting generation of an account. When a command is input, the user terminal 100, the authorization server 110, and the computer 120 automatically execute processing from step S201 to step S209 described below.
[0080]
The user terminal 100 transmits certification information to the authority grant server 110 via the Internet in accordance with the user operation (step S201). When the authorization server 110 receives the certification information, the authentication device 111 confirms the user ID based on the received certification information (step S202).
[0081]
When the user ID is confirmed, the authentication apparatus 111 refers to the authority grant target user terminal table 113 and determines whether or not the accessed user terminal 100 is a terminal to which account management authority may be granted (step). S203). If it is determined that the terminal can be granted account management authority, the authority information generating apparatus 112 issues account management authority information 102 (step S204).
[0082]
Next, the user terminal 100 transmits certification information to the computer 120 via the Internet (step S205). When the computer 120 receives the certification information, the authentication device 121 confirms the user ID of the user terminal 100 based on the received certification information (step S206). The specific configuration for confirming the user ID is the same as the configuration shown in FIG. 3, and the processing procedure is the same as in steps S101 and S102 shown in FIG.
[0083]
The user terminal 100 transmits the account management authority information 102 to the computer 120 via the Internet (step S207). Further, the user terminal 100 transmits the account management request information to the computer 120 via the Internet (step S207). The above processing is the same as the processing in the first embodiment.
[0084]
Based on the received account management authority information 102 and account management permission authority granting server table 124, the computer 120 confirms whether or not the user terminal 100 is a terminal that can receive the account management authority (step S208). .
[0085]
If it is confirmed in step S208 that the terminal can receive the account management authority, the account management apparatus 123 executes the requested account management process (step S209). For example, when an account generation is requested, the account management apparatus 123 generates an account for the user terminal 100. In addition, when an attribute change or deletion of an already registered account is requested, the account management device 123 changes or deletes the account attribute.
[0086]
Next, an operation when the calculation process is executed according to a request from the user terminal 100 will be described. FIG. 7 is a flowchart showing a process of executing a calculation process requested from the user terminal 100. When the user has already registered an account and requests the computer 120 to perform calculation processing, the user operates the user terminal 100 to input a command for requesting calculation processing or execute a program. When a command is input, the following processing from step S301 to step S305 is automatically executed by the user terminal 100 and the computer 120.
[0087]
When a command is input in accordance with a user operation, the user terminal 100 transmits certification information to the authorization server 110 via the Internet (step S301). When the computer 120 receives the certification information, the authentication device 121 confirms the user ID based on the received certification information (step S302). After confirming the user ID and confirming that the user terminal 100 is already registered, the computer 120 transmits confirmation information indicating that the user ID and the account have been confirmed to the user terminal 100 via the Internet. To do. Then, the user terminal 100 transmits calculation request information including the calculation content desired to be requested to the computer 120 via the Internet (step S303).
[0088]
When the calculation request information is received, the computer 120 executes the requested calculation process (step S304). When the calculation process is completed, the computer 120 transmits the computer usage information to the authorization server 110 via the Internet (step S305). Then, the authorization server 110 performs a charging process for the user terminal 100 based on the received computer usage information.
[0089]
As described above, according to the present embodiment, the process for causing the computer 120 to execute the calculation and the account management process are executed independently. Therefore, the user transmits information indicating a computer use request to the computer 120 after the account is generated. Unlike the case of the first embodiment, since the authority confirmation process is not executed when the computer 120 executes the calculation, it is possible to reduce the processing steps for the computer use request. Further, a conventional protocol for requesting calculation processing can be used as it is, and the burden and cost for system construction can be reduced.
[0090]
In the first embodiment and the third embodiment, the case where the user terminal 100 obtains the account management authority information 102 by receiving the authority management server 102 from the authority grant server 110 has been described. The account management authority information 102 written in a recording medium such as the above may be obtained by mail or the like. In that case, for example, in the processes shown in FIGS. 4 and 6, it is not necessary to execute the processes in steps S101 to S104 and steps S201 to S204.
[0091]
In addition, it is not necessary to install the authorization server 110, and the management burden and cost on the account manager can be reduced. Note that the expiration date of the account management authority information 102 is set to be sufficiently longer than when the account management authority is obtained online from the authority granting server 110. In addition, the account manager may install a computer for performing only the charging process for the user terminal 100.
[0092]
【The invention's effect】
As described above, according to the present invention, the account management system, the account management method, and the account management program are: Authorization server On behalf of each computer on the condition that the user terminal has been successfully authenticated. Judge that the user terminal is a terminal that can make a request to create an account. The account management request authority information is transmitted to the user terminal, and each computer generates an account for the user terminal based on the account management request authority information received from the user terminal, and based on the generated account. Since it is configured to execute the predetermined processing indicated by the processing request received from the user terminal, the burden and cost of account management for each computer managed by each different administrator in a wide-area distributed computing environment Can be reduced.
[Brief description of the drawings]
FIG. 1 is a block diagram showing an example of a configuration of a wide-area distributed computing environment to which an account management system according to the present invention is applied.
FIG. 2 is a block diagram for explaining processing executed by a self ID certification device and an authentication device.
FIG. 3 is a block diagram for explaining operations of an authority information generating apparatus and an authority confirming apparatus.
FIG. 4 is a flowchart showing a calculation process and an account management process.
FIG. 5 is a block diagram for explaining operations of an authority information generation device and an authority confirmation device.
FIG. 6 is a flowchart showing account management processing;
FIG. 7 is a flowchart showing processing for calculation.
[Explanation of symbols]
100 user terminal
101 Self ID certification device
102 Account management authority information
110 Authorization server
111 Authentication device
112 Authority information generation device
113 Authorized user terminal table
120 computers
121 Authentication device
122 Authority confirmation device
123 Account management device
124 Account management permission authority grant server table

Claims (11)

In an account management system for managing a user account in a computer system that provides computer resources to a user in response to a request from a user terminal,
The user terminal;
A plurality of computers that execute predetermined processing in response to a request from the user terminal;
Sending the account management request authorization information indicating the authority can request the generation of accounts, on behalf of each computer, the user terminal determines whether the terminal that allows a request for generation of accounts An authorization server to perform ,
The user terminal is
Self-certifying means for transmitting certification information for certifying a user to the authorization server ;
Processing request means for requesting execution of the predetermined processing, and processing request means for transmitting the account management request authority information received from the authority grant server to each of the computers,
The authorization server is
Authentication means for authenticating the user terminal based on the certification information received from the user terminal;
On the condition that the authentication of the user terminal by the authentication means is successful, it is determined that the user terminal is a terminal that can make an account generation request on behalf of each computer, and the user terminal And account management request authority information transmitting means for transmitting the account management request authority information,
Each computer is
Account generation means for generating an account for the user terminal based on the account management request authority information received from the user terminal;
An account management system comprising: a process execution unit that executes the predetermined process indicated by the process request received from the user terminal based on the account generated by the account generation unit. The account management system according to claim 1, wherein the account generation unit automatically generates an account if the account does not exist after confirming that the received account management request authority information is valid. The account management system according to claim 1, wherein the processing request unit transmits the account management request authority information, and transmits a processing request to each of the computers after an account is generated by the account generation unit. The account management system according to any one of claims 1 to 3, wherein the account management request authority information transmitting unit transmits the account management request authority information with an electronic signature to a user terminal. Each of the computers receives a certificate proving the authorization server directly from the authorization server or via the user terminal, and receives the account management request authority information and the certificate received from the user terminal. The account management system according to any one of claims 1 to 4, wherein whether or not the account management request authority information is valid is confirmed based on a certificate. The processing request means includes a first certificate certifying the authorization server, and a second certificate electronically signed by said authorization server to delegate the right to grant the account management request authorization information The account management system according to claim 1, wherein the account management system is transmitted to each computer. The account management system according to claim 6, wherein each of the computers confirms whether the account management request authority information is valid based on the first certificate and the second certificate received from the user terminal. . The account management system according to any one of claims 1 to 7, wherein each computer transmits computer usage information to the authorization server when the predetermined processing is completed. In an account management method for managing a user account in a computer system that provides computer resources to a user in response to a request from a user terminal,
The user terminal sending proof information for certifying the user to the authorization server ; and
The authorization server authenticating the user terminal based on the certification information received from the user terminal;
On the condition that the authorization server succeeds in the authentication of the user terminal, the user terminal has an account on behalf of a plurality of computers that execute predetermined processing in response to a request from the user terminal. Determining that the terminal is capable of requesting generation, and transmitting to the user terminal account management request authority information indicating authority to request generation of an account;
A step of transmitting the processing request that the user terminal requests execution of the predetermined processing and the account management request authority information received from the authorization server to the computers;
Each computer generates an account for the user terminal based on the account management request authority information received from the user terminal;
Each computer executing the predetermined processing indicated by the processing request received from the user terminal based on the generated account;
An account management method comprising: A user terminal transmits a plurality of computers for executing a predetermined processing in response to a request from the user terminal, the account management request authorization information indicating the authority can request the generation of accounts, each on behalf of the computer, and authorization server, wherein the user terminal determines whether a terminal that allows the request for generation of accounts, wherein the user terminal, certificate information for certifying user self certification means for transmitting to the authorization server, and that the processing request for requesting execution of the predetermined process, and the account management request authorization information received from the authorization server, and transmits to the each computer It includes a processing request means, wherein the authorization server, based on the certification information received from the user terminal, authentication means for authenticating the user terminal The the user condition that a successful authentication of the terminal by the authentication means, wherein determining that the user terminal on behalf of each computer is a terminal that enables a request for generation of accounts to the user terminal Account management request authority information transmitting means for transmitting the account management request authority information to a user account in a computer system that provides a user with computer resources in response to a request from the user terminal. An account management program for managing,
In the computer,
A process for generating an account for the user terminal based on the account management request authority information received from the user terminal;
Based on the generated account, a process of executing the predetermined processing indicated by the processing request received from the user terminal,
Account management program for running. A user terminal transmits a plurality of computers for executing a predetermined processing in response to a request from the user terminal, the account management request authorization information indicating the authority can request the generation of accounts, each on behalf of the computer, and authorization server, wherein the user terminal determines whether a terminal that allows the request for generation of accounts, wherein the user terminal, certificate information for certifying user self certification means for transmitting to the authorization server, and that the processing request for requesting execution of the predetermined process, and the account management request authorization information received from the authorization server, and transmits to the each computer Processing request means, wherein each of the computers is based on the account management request authority information received from the user terminal. An account generation means for generating an account for the process, and a process execution means for executing the predetermined process indicated by the process request received from the user terminal based on the account generated by the account generation means, A program installed in the authorization server in a computer system that provides computer resources to a user in response to a request from a user terminal,
In the authorization server,
A process of authenticating the user terminal based on the certification information received from the user terminal;
The user terminal is determined to be a terminal that can make an account generation request on behalf of each computer on the condition that authentication of the user terminal is successful, and the account management for the user terminal Processing to send request authority information;
A program for running

Images