Access control method and system

BACKGROUND OF THE INVENTION

[0001] The present invention relates to an access control method and system and in particular, to a method and an apparatus for performing access control to a service provider system at a service user side in accordance with a service or the like provided by a service provider side.

[0002] When a general-purpose client system working in cooperation with a server side to which the client system is connected via a network can use a service provided by the server side, this service use may be limited by either of the following two types: a use limit to the general-purpose client system itself which is realized by applying upon shipment of a general-purpose client system, a use limit function to application software used in the general-purpose client system and fetching a license upon use of the software, so that the limit is released at the general-purpose client system side; and a server management method in which a server side controls server access authority of the general-purpose client system, thereby limiting use of a service provided by the server.

[0003] In case of the method of use limit to the general-purpose client system itself, when using a service provided by the server side, a release key is received from a license server to release the limit and installed in the general-purpose client system, so that the service can be used. Moreover, in case of the server management method, the server side has license information (password or the like) of the general-purpose client system and upon use of a service via the client system, the license information is verified before the service can be used.

SUMMARY OF THE INVENTION

[0004] However, in the method of use limit to the general-purpose client system itself, since the client system is a general-purpose system, when the server side wants to apply a use limit for each of the services provided by the server side, a list of services whose use is to be limited should be managed by the client system. Moreover, when the server side wants to provide a new service with use limit, the server cannot add it at once. In the server management method, when a password sent from a general-purpose client system is used to judge whether the general-purpose client system can use a service, the server side should have a system for managing passwords.

[0005] Here, for security to exclude eavesdrop and the like when receiving a service on the Internet, there is a method to assure a safe communication path by using the standard specification such as an SSL (secure socket layer) and a TLS (transport layer security). The current WWW server and the WWW browser contain certification authority certificates (certification authority information including a certification authority public key and self-signed with a secret key of the certification authority) of a plurality of predetermined certification authorities. When a server or a client gets a communication path, the server or the client uses this certification authority certificate so as to verify whether a certificate (client certificate, server certificate) transmitted from a communication mate has been issued from a reliable certification authority, thereby performing access control. However, the current certification authority certificate has its main purpose to perform authentication for assuring a safe communication path and there is no scheme for issuing a certification authority certificate in accordance with the service use limit and other condition, i.e., no use scheme has been established.

[0006] It should be noted that a client certificate is normally issued after an examination on client basis in a certification authority and a user who wants to use a new service should send a client public key, address, and other personal information to the certification authority.

[0007] An object of the present invention is to provide a method and a system capable of performing access control to a service provider side at a service user side.

[0008] Another object of the present invention is to provide a method and a system capable of flexibly performing a use limit for each service.

[0009] To achieve the aforementioned objects, in the present invention, a use limit is added to the information used for judging whether an access authority is present (certification authority certificate including a root certificate), so that only a usable certification authority certificate is used for a certificate verification (verification performed when establishing a safe transmission path by the SSL and the like), thereby performing access control. Moreover, license management is performed in such a manner that license information is added to a certification authority certificate or the like, so that the license information is used to limit use of the certification authority certificate and a usable service can be added when required.

[0010] More specifically, a system (first system) to be accessed such as a service provider system (server system and the like is connected via a network to a system (second system) to access something such as a service user system (client system and the like). An access control method for accessing the first system is realized by management of first information (certification authority certificate including a root certificate and the like) used for judging whether the first system has an access authority to access the second system. The first information is made to a usable state by a predetermined condition and when accessing the first system, second information (a certificate or the like specifying the first system) transmitted from the first system is received. When the first information corresponding to the second information is present in a usable state, the first information is compared to the second information and accessing the first system is enabled in accordance with the comparison result. Here, the predetermined condition is information on use limit of the first information such as a valid period of the first information and information on a connection destination which can use the first information.

[0011] It should be noted that the aforementioned object may be achieved by a program realizing the aforementioned function or a recording medium containing the program.

[0012] Other objects, features and advantages of the invention will become apparent from the following description of the embodiments of the invention taken in conjunction with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

[0013]FIG. 1 shows a system configuration according to a first embodiment of the present invention.

[0014]FIG. 2 is a block diagram of the present invention applied to a client system according to one embodiment.

[0015]FIG. 3 shows data configuration of a token identification information storage area.

[0016]FIG. 4 shows data configuration of license information <b>900</b>.

[0017]FIG. 5 shows data configuration of information in a temporary storage area of usable certification authority certificate information.

[0018]FIG. 6 is a block diagram showing license server configuration according to an embodiment.

[0019]FIG. 7 is a flowchart showing client system processing performed when license information is fetched.

[0020]FIG. 8 shows data configuration of a license information request message.

[0021]FIG. 9 is a flowchart showing license server processing performed when license information is fetched.

[0022]FIG. 10 is a flowchart showing client system processing performed after the license information is fetched.

[0023]FIG. 11 is a flowchart showing client system processing performed when license information is verified.

[0024]FIG. 12 is a flowchart showing processing performed when a client system service is used.

[0025]FIG. 13 is a flowchart of state monitoring about a use token in a usable information management block.

DETAILED DESCRIPTION OF THE INVENTION

[0026] Description will now be directed to preferred embodiments with reference to attached drawings. It should be noted that the present invention is not to be limited to these embodiments.

[0027]FIG. 1 shows system configuration according to an embodiment of the present invention. The system includes a certification authority server <b>100</b>, a license server <b>200</b>, a service provider server <b>300</b>, and a client system <b>400</b> used by a service user. The servers do not necessarily have to a single independent function. For example, the certification authority server <b>100</b> and the license server <b>200</b> may be operated by the same subject. Connection between the servers and between the servers and the client system is established via a network such as Internet when required.

[0028] The certification authority server <b>100</b> has a certification authority certificate and a secret key constituting a pair with a public key stored in the certification authority certificate and provides the certification authority certificate via the license server <b>200</b> to the client system <b>400</b>. The certification authority certificate according to the present invention is, for example, information to identify a certification authority such as a self-signed certificate prepared by self-signing with a self secret key and adding a public key to it. This information can be utilized for server certificate verification. The certification authority certificate according to the present invention may be one usable for the standard protocol SSL or other then this. When used together with the standard protocol SSL, the function of the SSL assures a safe communication path. Moreover, the certification authority certificate issues a digital certificate for a service provider (server certificate). The server certificate in the present invention is, for example, a digital certificate including a public key of a public key pair obtained by the service provider and having a digital signature with a secret key to be pair with the public key stored in the certification authority certificate, thereby specifying a service provider. Validity of a server certificate is verified by suing the public key attached to the certification authority certificate provided from the certification authority server <b>100</b>. The service provider server <b>300</b> provides a service to a service user in accordance with access from the client system <b>400</b>. The license server <b>200</b> provides license information allowing the service user to use the certification authority, so as to use a particular service at the client system <b>400</b>. More preferably, the service user has a self-signed certificate prepared by self-signing with a his/her secret key and adding a public key and digitally signs the license information with a license server secret key and provides it. The client system <b>400</b> has an access control system for service use of the service provider <b>300</b>.

[0029]FIG. 2 is a block diagram showing configuration of the client system according to the present invention. The client system <b>400</b> includes a basic system <b>410</b> for performing license verification for using a service and a client use token <b>510</b> for managing a certification authority certificate used for using a service and license information related to it. The client use token <b>510</b> may be attached and detached to/from the basic system <b>410</b> and can be used, for example, via USB and PCMCIA.

[0030] The basic system <b>410</b> has a communication apparatus <b>415</b>, a storage block <b>420</b>, an input apparatus <b>436</b>, an output apparatus <b>437</b>, and a control block. The control block includes: a license verification block <b>431</b> for verifying validity of license information, a connection control block <b>432</b> for verifying a server certificate and performing access control, a usable information management block <b>435</b> for controlling management of usable certification authority certificates, a charge client block <b>438</b> for performing charge processing with the license server for supplying a license, and a license information request generation block <b>439</b> for generating a message for requesting for license information to the license server. The storage block <b>420</b> includes a license server self-signed digital certificate storage region for storing self-signed certificates, a token storage information reference destination information storage region <b>422</b> indicating a storage position of the certification authority certificate and the license information in the client use token <b>510</b>, a usable certification authority certificate information temporary storage region <b>423</b> for utilizing a certification authority certificate related to license information whose validity has been verified, and a charge ID temporary storage region <b>424</b> for temporarily storing a charge ID as an identifier of charge completion received from the license server.

[0031] The client use token <b>510</b> has a storage block <b>570</b> and an in-token storage verification block <b>560</b> for storing license information for a particular token. The storage block <b>570</b> includes a token identification information storage region <b>571</b> containing information for uniquely identifying a token, and a certification authority certificate and license information storage region <b>572</b> for storing a certification authority certificate required for receiving a service from a service provider by using the basic system and license information for limiting use of the certification authority certificate.

[0032] It should be noted that the function of the present invention realized by the aforementioned client system <b>400</b> can also be provided as software. For example, a recording medium is provided to store a program for realizing a function of the license verification block <b>431</b> and the program is read into the client system <b>400</b> via a drive apparatus connected to the client system <b>400</b> or transferred to the client system <b>400</b> via the Internet, so as to be executed.

[0033]FIG. 6 is a block diagram showing configuration of the license server. The license server <b>200</b> provides a license to the client system <b>400</b> and performs charging management upon provision of a license. There are provided a charge management block <b>210</b> for issuing and managing a charge ID after charging from the client system <b>400</b>, a license information issuing block <b>220</b> for checking validity of a license information request and generating license information, a storage block <b>230</b>, and a communication apparatus <b>240</b>. The storage block <b>230</b> includes a certification authority certificate storage region <b>231</b> for storing a certification authority certificate issued from the certification authority server <b>100</b> and a license server public key pair storage region <b>232</b> used when generating license information.

[0034] Hereinafter, explanation will be given on the processing of the client system <b>400</b> up to the license information fetch request transmission in the license information fetch method according to the present invention with reference to a flowchart of FIG. 7. When fetching license information of a service user, charge processing is completed between the license server <b>200</b> and the client system <b>400</b>, and the license server <b>200</b> issues a charge ID indicating that the charging processing is complete to the client system <b>400</b>. This charge ID is stored in the charge ID temporary storage region <b>424</b> in the client system <b>400</b>. Moreover, a certification authority certificate for which license information is to be issued is also linked with a charge ID in the charge management block <b>210</b> in the license server <b>200</b>.

[0035] The license information request generation block <b>439</b> fetches a token identification number (FIG. 3) uniquely identifying a token stored in the token identification information storage region <b>571</b> in the client use token <b>510</b> (step <b>1010</b>), fetches a charge ID from the charge ID temporary storage region <b>424</b> (step <b>1020</b>), generates a license information request message encrypted with a public key of the license server self-signed certificate stored in the license server self-signed certificate storage region <b>521</b> (step <b>1030</b>) and transmits the license information request message via the communication apparatus <b>415</b> to the license server <b>200</b> (step <b>1040</b>). It should be noted that step <b>1010</b> and step <b>1020</b> may be in a different order.

[0036]FIG. 8 shows data configuration of the license information request message <b>1100</b>. The license request message <b>1100</b> contains a token identification number <b>1101</b> and a charge ID <b>1102</b> which are encrypted by a public key in the license server self certificate. Thus, by requesting for license information by adding a token identification number, a license can be offered and managed on client use token basis. As a result, even when the basis system <b>410</b> used by a user is not fixed, by carrying the client use token, it is possible to reduce the trouble of an authentic user to request for the certification authority certificate and the license information for each of the basic system <b>410</b>. Moreover, when the basic system <b>410</b> is shared by a plurality of users, as will be detailed later, information in the basic system <b>410</b> is deleted in accordance with attachment and removal of a client use token, it is possible to prevent transparent use of a certification authority certificate and license information fetched by another user.

[0037] Next, explanation will be given on the processing of the license server <b>200</b> with reference to a flowchart of FIG. 9. The license information issuing block <b>220</b> receives a license information request message <b>1100</b>, fetches a secret key constituting a pair with its public key in the license server self certificate from the license server public key pair storage region <b>231</b>, decrypts the encrypted license information request message <b>1100</b> (step <b>1210</b>), and checks whether the charge ID <b>1102</b> is valid in the charge management block <b>210</b> (step <b>1220</b>). Unless the charge ID <b>1102</b> is valid, an error message indicating invalidity is transmitted to the client system <b>400</b> and the processing is terminated (step <b>1230</b>). When the charge ID <b>1102</b> is found to be valid, license information is generated in the license information issuing block <b>220</b>.

[0038] The license information issuing block <b>220</b> fetches from the certification authority certificate storage region <b>231</b>, a certification authority certificate to which a license is to be given among the certification authority certificates issued by the certification authority server <b>100</b> (step <b>1240</b>) and generates license information (step <b>1250</b>). The license server <b>200</b> transmits the license information <b>900</b> to the client system <b>400</b> together with a related certification authority certificate (step <b>1260</b>).

[0039]FIG. 4 shows data configuration of the license information <b>900</b>. The license information <b>900</b> has a license basic information including a hash value <b>910</b> of a certification authority certificate to which a license is to be given, a license valid term <b>920</b> indicating a valid term during which the certification authority certificate can be used, and a token identification number <b>930</b>, and digital signature information <b>960</b> signed with a server secret key added to the license basic information <b>940</b>. It should be noted that connection destination information <b>935</b> may be added to the license basic information <b>940</b>. When the connection destination information <b>935</b> is provided, it is possible to set a certification authority certificate use on connection destination basis/service basis. As the connection destination information, there are a method to describe an identifier such as an URL of a connectable destination and a method to describe an identifier of a destination which cannot be connected, and the method can be modified according to an embodiment.

[0040] Next, explanation will be given on the processing of the client system <b>400</b> after the license information is received from the license server with reference to a flowchart of FIG. 10. The basic system <b>410</b> receives a message from the license server <b>200</b> (step <b>1310</b>) and checks whether the message is an error message or license information (step <b>1320</b>). If the message is an error message, the error message is displayed on the output apparatus <b>437</b> and the processing is terminated (step <b>1330</b>). If the message is license information and certification authority certificate, a content of the certification authority certificate is displayed on the output apparatus <b>437</b> (step <b>1330</b>), and check is made whether it is registered in the client use token <b>510</b> in accordance with input from the input apparatus <b>436</b> by a service user (step <b>1350</b>). If not to be registered, a corresponding message is output on the output apparatus <b>437</b> and the processing is terminated (step <b>1330</b>). If to be registered, the certification authority certificate and the license information are sent to the in-token storage verification block <b>560</b>, where the token identification number <b>810</b> is fetched from the token identification information storage region <b>571</b> in the storage block <b>570</b> (step <b>1360</b>) and it is compared to the token identification number <b>930</b> in the license information to determine whether they coincide (step <b>1370</b>). If they coincide, the certification authority certificate and the license are stored in the certification authority certificate and license information storage region <b>572</b> (step <b>1380</b>). If they do not coincide, an error message is displayed on the output apparatus <b>437</b> and the processing is terminated (step <b>1330</b>).

[0041] Next, explanation will be given on the processing of license information verification of the client system <b>400</b> with reference to a flowchart of FIG. 11. The usable information management block <b>435</b> monitor whether the client use token <b>510</b> is connected to the basic system <b>410</b> and can be used (step <b>1405</b>). If the client use token <b>510</b> cannot be used, a corresponding message is displayed on the output apparatus <b>437</b> and the processing is terminated (step <b>1470</b>). If the client use token <b>510</b> can be used, the license verification block <b>431</b> references a license information storage destination in the token stored in the token storage information reference destination information storage region <b>422</b>, fetches all the license information and certification authority certificates stored in the certification authority certificate and license information storage region <b>572</b> (step <b>1410</b>), and performs license information verification for a pair of certification authority certificate and license information as follows. A self-signed certificate for license verification is fetched from the license server self-signed certificate storage region <b>421</b> (step <b>1415</b>) and signature verification is performed to determine whether the license information has been received from an authentic license server (step <b>1420</b>). When the verification fails, an error message is output (step <b>1490</b>) and if other license information is present, control is returned to step <b>1420</b>, and if not, the processing is terminated (step <b>1440</b>). Next, a hash value of the certification authority certificate is calculated and compared to the hash information <b>910</b> of the certification authority certificate stored in the license information to confirm linking with the license information (step <b>1425</b>). When the hash values do not coincide, an error message is output (step <b>1490</b>) and if other license information is present, control is returned to step <b>1420</b>, and if not, the processing is terminated (step <b>1440</b>). Next, the license valid term <b>920</b> is compared to a current time to determine whether the license is valid (step <b>1430</b>). If the license is not valid, an error message is output (step <b>1490</b>) and if other license information is present, control is returned to step <b>1420</b>, and if not, the processing is terminated (step <b>1440</b>). If the license is determined to be valid, information in the license information such as a certification authority certificate related to the license information and the license valid term is stored as usable certification authority certificate information in the usable certification authority certificate information temporary storage region <b>423</b> (step <b>1435</b>) and if other license information is present, control is returned to step <b>1420</b> and if not, the processing is terminated (step <b>1440</b>).

[0042] It should be noted that what is stored in the usable certification authority certificate information temporary storage region <b>423</b> maybe only a certification authority certificate or both of certification authority certificate and license information according to an embodiment.

[0043]FIG. 5 shows data configuration of information <b>522</b> in the usable certification authority certificate information temporary storage region. In the present embodiment, the information <b>522</b> includes a certification authority certificate <b>1001</b>, a license end time <b>1002</b> indicating the usable term of the certification authority certificate, and connection destination information <b>1003</b> indicating a usable destination of the certification authority certificate. Thus, by storing the license end time <b>1002</b> and the connection destination information <b>1003</b> together with the certification authority certificate <b>1001</b>, it is possible to improve the connection verification efficiency of the client system <b>400</b> at service use as will be detailed later.

[0044] Explanation will be given on the processing of the client system <b>400</b> at service use with reference to a flowchart of FIG. 12. The license verification block <b>431</b> verifies whether the license end time <b>1002</b> exceeds the current time when using the certification authority certificate <b>1001</b> (step <b>1510</b>, step <b>1520</b>). If the current time is exceeded, a message indicating that the license valid time has expired is output and the processing is terminated, thereby inhibiting use of the certification authority certificate (step <b>1540</b>). Thus, the certification authority certificate can be used only in the license valid term (step <b>1530</b>). By performing this processing, it is possible to prevent use of a certification authority certificate whose license valid term has expired while stored in the usable certification authority certificate information temporary storage region <b>423</b>.

[0045] Next, the connection control block <b>432</b> specifies a service provider from an URL or the like stored in the service provider certificate transmitted from the service provider <b>300</b> (step <b>1550</b>) and judges whether a usable certification authority certificate having the connection destination information <b>1003</b> corresponding to the specified service provider exists (step <b>1560</b>). If a usable certification authority certificate exists, a service provider certificate is verified by using the certification authority certificate (step <b>1570</b>). If the verification results in that the service provider certificate is authentic, the service provider can be accessed (step <b>1580</b>). When a usable certification authority certificate is absent or when the service provider certificate is found not authentic, access is disabled (step <b>1590</b>).

[0046] By performing such processing, it is possible to limit use of a certification authority certificate on a connection destination basis (service basis).

[0047] It should be noted that the verification of the license valid term of the certification authority certificate by the license verification block <b>431</b> and the verification of the service provider certificate by the connection control block <b>432</b> may be performed in a different order according to an embodiment. In this case, the service provider certificate is verified by using a predetermined certification authority certificate and after this, the valid term of the certification authority certificate which has performed verification is verified. If the certification authority certificate which has performed verification is within a valid term, access to the service provider is enabled. Moreover, a part of the processing may be omitted according to an embodiment.

[0048] Moreover, the certification authority certificate <b>1001</b> in the usable certification authority certificate information temporary storage region <b>423</b> can also be used for a certificate verification upon establishing an SSL communication with the service provider <b>300</b> like the current WWW browser. If there is no certification authority certificate liked to the service provider digital certificate (server certificate), the certificate verification fails and service use cannot be performed from the client system <b>400</b>.

[0049]FIG. 13 is a flowchart of state monitoring about a use token of the usable information management block <b>435</b>. Upon start of the basic system <b>410</b> (step <b>1600</b>), the usable information management block <b>435</b> erases information in the usable certification authority certificate use information temporary storage region <b>423</b> (step <b>1610</b>). After this, monitoring is continued to check whether the use token can be used (step <b>1620</b>). After detecting that the token can be used, monitoring is continued to check whether the token has become unusable (step <b>1630</b>). When the token has become unusable when the use token is removed from the basis system or by other reason, the information in the usable certification authority certificate use information temporary storage region <b>423</b> is erased (step <b>1640</b>) and control is returned to step <b>1620</b>.

[0050] In the aforementioned embodiment, the client system is divided into the basic system and the client use token but they can be a unitary block without departing from the object of the present invention.

[0051] Moreover, in the aforementioned embodiment, all the license information items are simultaneously verified at the license information verification. However, it is also possible to verify license information related to a certification authority certificate upon actual use of the certification authority certificate.

[0052] Moreover, in the aforementioned embodiment, a certification authority certificate and related license information are received from the license server. However, it is also possible that the certification authority certificate is contained in the client system storage block and only the license information is received from the license server.

[0053] Moreover, in the aforementioned embodiment, a certification authority certificate is related to license information by adding hash information of the certification authority certificate to the license information. However, it is possible to use other information capable of relating them such as a serial number of the certificate.

[0054] According to the embodiment of the present invention, in a general-purpose system, it is possible to realize client system use limit for each service only by control of the client side. This reduces the load of the server side. Moreover, it is possible to easily add a service which can be used by using the general-purpose system, by adding a certification authority certificate and license information of the object. Moreover, since a user approves to add a certification authority digital certificate, it is possible to use by limiting only to a necessary service. Moreover, as compared to access control by a server using a client certificate transmitted from a general-purpose client system, a client certificate can be fetched easily and it is possible to realize license management having a high anonymity.

[0055] According to the present invention, access control to a service provider can be performed service user side. Moreover, it is possible to flexibly perform use limit for each service.

[0056] It should be further understood by those skilled in the art that although the foregoing description has been made on embodiments of the invention, the invention is not limited thereto and various changes and modifications may be made without departing from the spirit of the invention and the scope of the appended claims.