Loading patent…
OwnerYoshiaki Kawatsura, Hiroyuki Chiba +2inventors
InventorsYoshiaki Kawatsura, Hiroyuki Chiba, Kiyoshi Watanabe, Akira Morita
Estimating the term…
An access control method used in a client connected to a server. The method manages a certification authority certificate used to judge whether the server has right to access the client. The certification authority certificate is made into a usable state under a predetermined condition. When accessing the server, the client receives a certificate specifying the server transmitted from the server. When a certification authority certificate corresponding to the certificate specifying the server exists in a usable state, access to the server is enables in accordance with a comparison result.
An access control method for controlling access to a first system connected to a second system via a network, the method comprising:
An access control method used in a client connected via a network to a service provider server and to a license server issuing a certification authority certificate enabling service use of the service provider server and license information indicating a use condition of the certification authority certificate, the method comprising:
An access control system used in a client connected via a network to a service provider server, the system comprising:
Dependencies are inferred from the claim text.
Drawings are temporarily unavailable. Open the PDF at USPTO
Backward citations are indexed for grants only.
For authentication of entities: using certificates
Applying verification of the received information: received data contents, e.g. message integrity
Digital communication
Term end not estimated
The present invention relates to an access control method and system and in particular, to a method and an apparatus for performing access control to a service provider system at a service user side in accordance with a service or the like provided by a service provider side.
When a general-purpose client system working in cooperation with a server side to which the client system is connected via a network can use a service provided by the server side, this service use may be limited by either of the following two types: a use limit to the general-purpose client system itself which is realized by applying upon shipment of a general-purpose client system, a use limit function to application software used in the general-purpose client system and fetching a license upon use of the software, so that the limit is released at the general-purpose client system side; and a server management method in which a server side controls server access authority of the general-purpose client system, thereby limiting use of a service provided by the server.
In case of the method of use limit to the general-purpose client system itself, when using a service provided by the server side, a release key is received from a license server to release the limit and installed in the general-purpose client system, so that the service can be used. Moreover, in case of the server management method, the server side has license information (password or the like) of the general-purpose client system and upon use of a service via the client system, the license information is verified before the service can be used.
FIG. 1 shows a system configuration according to a first embodiment of the present invention.
FIG. 2 is a block diagram of the present invention applied to a client system according to one embodiment.
FIG. 3 shows data configuration of a token identification information storage area.
Description will now be directed to preferred embodiments with reference to attached drawings. It should be noted that the present invention is not to be limited to these embodiments.
FIG. 1 shows system configuration according to an embodiment of the present invention. The system includes a certification authority server 100, a license server 200, a service provider server 300, and a client system 400 used by a service user. The servers do not necessarily have to a single independent function. For example, the certification authority server 100 and the license server 200 may be operated by the same subject. Connection between the servers and between the servers and the client system is established via a network such as Internet when required.
The certification authority server 100 has a certification authority certificate and a secret key constituting a pair with a public key stored in the certification authority certificate and provides the certification authority certificate via the license server 200 to the client system 400. The certification authority certificate according to the present invention is, for example, information to identify a certification authority such as a self-signed certificate prepared by self-signing with a self secret key and adding a public key to it. This information can be utilized for server certificate verification. The certification authority certificate according to the present invention may be one usable for the standard protocol SSL or other then this. When used together with the standard protocol SSL, the function of the SSL assures a safe communication path. Moreover, the certification authority certificate issues a digital certificate for a service provider (server certificate). The server certificate in the present invention is, for example, a digital certificate including a public key of a public key pair obtained by the service provider and having a digital signature with a secret key to be pair with the public key stored in the certification authority certificate, thereby specifying a service provider. Validity of a server certificate is verified by suing the public key attached to the certification authority certificate provided from the certification authority server 100. The service provider server 300 provides a service to a service user in accordance with access from the client system 400. The license server 200 provides license information allowing the service user to use the certification authority, so as to use a particular service at the client system 400. More preferably, the service user has a self-signed certificate prepared by self-signing with a his/her secret key and adding a public key and digitally signs the license information with a license server secret key and provides it. The client system 400 has an access control system for service use of the service provider 300.