WO2003105002A1

WO2003105002A1 - General-purpose autentication system in organization

Info

Publication number: WO2003105002A1
Application number: PCT/JP2002/005813
Authority: WO
Inventors: 秀明渡辺; 輝一浅海; 宗樹和田; 敬浅野
Original assignee: 株式会社帝国データバンク
Priority date: 2002-06-11
Filing date: 2002-06-11
Publication date: 2003-12-18
Also published as: AU2002306326A1; JPWO2003105002A1; JP3622789B2

Abstract

A general-purpose system capable of identifying persons in an organization. This system is constructed of an on-line data processing system such as a WEB server accessed by a user terminal, and an authentication institute system connected via a network. The on-line data processing system includes electronic certificate receiving means for receiving an electronic certificate transmitted from a user terminal and authentication means for authenticating the user by communicating data with the authentication institute system. This authentication institute system is provided with an authentication database where organization identification data such as company codes and authentication data for authenticating an individual in an organization by relating the organization to the person. A user is authenticated on the basis of the authentication information which is extracted from the authentication database and which contains at least information on the authority of an individual in an organization.

Description

Description General-purpose in-house personal authentication system Technical field

The present invention relates to a general-purpose in-organization personal authentication system for authenticating individuals belonging to an organization such as a company. Conventional technology

In recent years, with the development of computer networks and communication environments, businesses such as the Internet and other commercial activities have become active. There are many websites for consumer-to-business transactions such as shopping malls and auctions, as well as many sites for business-to-business transactions such as material procurement. Various things have been developed.

In the case of electronic commerce such as electronic procurement, when a seller who wants to sell and sell products, etc. sends transaction information through a network and participates in selling and participating in bidding, etc. The procurement side is uneasy about whether the seller really exists or not, whether they have the power or trust, without looking at each other. For this reason, even a truly trusted business partner may lose business opportunities due to the above problems. Credit information · Credit information · Transaction history information · Personal information · Region, price or payment terms Other transaction condition information · It is necessary to determine other information.

In the above, the example of e-commerce has been given, but there are many other situations in which information about a company is judged.

For example, judgments on tender for goods purchase and construction by the country or local government where the company participates, judgments on tie-ups and contracts with companies etc., judgments on merger and start-up of joint ventures, etc. In such situations, it is necessary to accurately determine this information from an objective viewpoint.

For example, in the construction industry, an objective assessment of construction Can restrict bids and conduct screening, but there is no alternative to a management review in other industries. In order to promote the digitization of goods procurement and applications in an open environment, it is necessary to link with a system that can obtain company information to grasp and determine the status of bidders and applicants. .

By the way, various kinds of digital signatures and digital certificates for authentication have been developed today in transactions and bidding using computer technologies such as the Internet. The Electronic Signature Law stipulates that a corporation can issue a digital certificate by authenticating a corporation by the Commercial Registration Authority of the Ministry of Justice, and a specific private certificate authority certifies pure individuals (natural persons).

However, digital certificates are issued to individuals who are natural persons. Therefore, even if an individual is authenticated and proved to be a real individual, the following serious problems remain.

In other words, for example, in many cases, such as bidding and application of local governments, and procurement of private materials, etc., a certificate at the person in charge is required. At that time, the digital certificate issued to a natural person cannot determine to which company the certificate holder belongs. In addition, the Commercial Registration and Certification Authority is positioned like a seal of a company representative, and only one certificate is issued to the company, and no certificate is issued to the sole proprietor. For these reasons, the work after receiving the tender and application and the work on material procurement will not proceed smoothly.

Whether or not the individual really belongs to a company such as a company, or even if it does, whether or not he or she has the authority to make decisions and make decisions in transactions, bidding, etc. This is because it cannot be determined only by the certificate. In addition, companies may retire, departments and positions may change, and it is necessary to respond to these renewals and changes. In addition, companies themselves often undergo mergers, bankruptcies, changes in credit information, and other fluctuations.

Therefore, the present invention solves the above various problems, and in the present invention, when an individual is authenticated in a transaction, a bid, a contract, or the like in an electronic space such as the Internet, the individual truly belongs to an organization such as a company. J] · Evaluate whether or not you have the authority to make decisions, decisions, etc. It aims at providing a possible system.

Therefore, by incorporating a general-purpose company code or serial number into the electronic certificate and entering the company code, serial number, personal information within the company, basic company information, and authority information into the authentication database, It is possible to perform authentication by associating with a private company, and also to enable authentication of a sole proprietor.

A further object of the present invention is to provide a system in which a single certificate can be used by a user even in a plurality of authentication systems, such as a plurality of authentication sites having different operators.

For conventional digital certificates, a certificate for each authentication system is required. For example, there are multiple certificates for each local government that makes e-bidding, and multiple certificates for each service site. As a result, users must have their own certificates for each, which is cumbersome and inconvenient, is expected to be troublesome, and it is costly for operators to issue their own certificates at a high cost. did not become.

Here, if a general-purpose company code is incorporated into the digital certificate and the use of the authentication database becomes open, both the authentication side of local governments and companies, etc., and the authenticated side of users such as bidders, Acknowledgment that the authentication work is completed with one general-purpose digital certificate.

Further, in the present invention, by linking an authentication database for authentication using an electronic certificate with an organization information database of a company or the like, the authentication is performed based on the latest updated data at the time of authentication. Another object of the present invention is to provide a system capable of performing such processing. Appropriate certification processing can be performed by retiring from companies, changing departments and positions, and responding to mergers, bankruptcies, changes in credit information, and other changes by the companies themselves.

In addition, the data is collected and stored and updated by the certification body, so that the websites that perform the respective certifications can use the certification system of the present invention without constructing a database individually. It becomes possible. Disclosure of the invention

In order to solve the above problems, in the invention described in claim 1, A system in which information processing is performed by operation on a terminal such as a computer including input means, control means, display means, output means, storage means, and the like,

A user-accessible authentication server system connected to the online data processing system via an online data processing network such as a web server accessed from a terminal;

The online data processing system includes an electronic certificate receiving unit that receives an electronic certificate transmitted from a user terminal, and an authentication unit that performs data transmission and reception between the certificate authority system and a user authentication process. At least including

The above-mentioned certification authority system is provided with an authentication database, and the data stored in the authentication database includes organization identification data such as a company code, and an association between the organization and the individual to authenticate individuals within the organization. Personal authentication data and at least

A general-purpose individual in an organization, wherein the authentication means performs user authentication in an online data processing system based on authentication information including at least authority information of the individual in the organization extracted from the authentication database. It is characterized by an authentication system.

In order to solve the above-mentioned problems, in the invention described in claim 2, in the invention described in claim 1,

The above-mentioned electronic certificate can be used to associate an organization with an individual by using an electronic certificate that incorporates organization identification data such as a general-purpose company code. It is a personal authentication system.

In order to solve the above-mentioned problem, in the invention described in claim 3, in the invention described in claim 1,

Using the digital certificate incorporating the serial number written on the digital certificate as the digital certificate,

A general-purpose in-house personal authentication system that specializes in being able to associate an organization with an individual from a tape that corresponds to organization identification data such as a serial number and a company code included in the authentication database. It is characterized by having. Further, in order to solve the above-mentioned problems, in the invention described in Claim 4, 'In the invention described in Claims 1 to 3,

The certification authority system is provided so that it can be accessed from multiple online data processing systems, and can use the same digital certificate to authenticate users accessing multiple online data processing systems such as different web servers. It is a general-purpose in-house personal authentication system. In order to solve the above-mentioned problems, in the invention described in claim 5, in the invention described in claims 1-4,

The above-mentioned authentication database stores organization identification data such as a company code and personal authentication data, and data including at least one of company basic information and authority information. The feature is that it is an in-house personal authentication system.

Further, in order to solve the above-mentioned problem, in the invention described in claim 6, 'in the invention described in claims 1 to 5,

The certification authority system includes an organization authority setting unit that allows a person having a predetermined authority of an organization such as a company to set the authority of an individual holding an electronic certificate belonging to the organization,

Further, in order to solve the above problems, in the invention described in claim 7, in the invention described in claims 1 to 6,

The certification authority system includes use authority setting means for setting which electronic certificate holder can use the person having the predetermined authority of the online data processing system,

A general-purpose individual in an organization, characterized in that the authentication means performs user authentication in an online data processing system based on authentication information including at least personal authority information of an individual of an organization 抽出 extracted from an authentication database. Authentication system Features.

In order to solve the above problems, in the invention described in claim 8, in the invention described in claims 1 to 7,

User authentication in the online data processing system described above includes user authentication about the availability of the use of system services, etc., user authentication about whether or not you have authority over transactions, business negotiations, contracts, etc., bid participation, various applications, examinations, etc. It is characterized by being a general-purpose in-house personal authentication system, characterized by including at least one of the user authentications for qualification.

In order to solve the above-mentioned problem, in the invention described in claim 9, in the invention described in claim 7,

In a case where a person having a predetermined authority of the online data processing system previously stores a setting as to which digital certificate holder can use the authentication database, the authentication database stores:

Registered users who own digital certificates are required to authenticate users regarding the use of the system and services, and to authenticate users who have authority over transactions, negotiations, contracts, etc. General user authentication, which eliminates the need for user registration in online data processing systems, such as websites, through user authentication such as user authentication for eligibility for the use of personal information It is characterized by being a system.

Further, in order to solve the above problems, in the invention described in claim 10, in the invention described in claims 1 to 9,

A use right application unit is provided in the certification authority system, wherein a user having an electronic certificate accesses the user terminal from the user terminal and requests the use right setting unit to set a use right in the online data processing system. This is a general-purpose in-house personal authentication system.

Further, in order to solve the above problems, in the invention described in claim 11, in the invention described in claim 10,

If the application for setting the use authority in the online data processing system is approved and stored in the angle-of-interest authority setting means, the individual who owns the relevant digital certificate belongs. The system is characterized in that it is a general-purpose in-house personal authentication system, characterized in that user authentication is permitted for individuals who satisfy predetermined conditions belonging to an organization. Further, in order to solve the above problems, in the invention described in claim 12, in the invention described in claims 1 to 11,

In the online data processing system, the data processing system that performs various data processing after user authentication is a system that uses organization identification data such as a company code used in the authentication and certification database. It is a general-purpose in-house personal authentication system.

Further, in order to solve the above problems, in the invention described in claim 13, in the invention described in claims 1 to 12,

The authentication database provided in the certification authority system is provided in cooperation with an organization information database that stores, stores, and updates organization information such as company information associated with organization identification data as a key, and The feature is that it is a general-purpose in-house personal authentication system characterized by the ability to perform user-one authentication reflecting information updates and fluctuations.

In order to solve the above-mentioned problems, in the invention described in claim 14, in the invention described in claim 12,

The online data processing system is provided with a user database of customers and the like, and stores and stores organization information such as company information provided in cooperation with the authentication database. It is characterized by being a general-purpose in-house personal authentication system that can be used for database updates and fluctuations.

In order to solve the above-mentioned problems, in the invention described in claim 15, in the invention described in claim 13 or 14,

The data stored in the organization information database includes organization credit information such as credit information of a company,

The authority information stored in the authentication database in advance includes eligibility screening information based on the credit information,

Based on credit information in data processing in online data processing system It specializes in being a general-purpose in-house personal authentication system that features screening processing. BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a system configuration diagram showing an example of a basic configuration of the system of the present invention.

FIG. 2 is a system configuration diagram showing an example of a form in which a certification authority system is provided so as to be accessible from a plurality of online data processing systems.

FIG. 3 is a system outline diagram showing an example of a basic processing flow of the system of the present invention.

FIG. 4 is a system outline diagram showing an example of a basic processing flow of an embodiment of the system of the present invention.

FIG. 5 is a system outline diagram showing an example of a basic processing flow of an embodiment of the system of the present invention.

FIG. 6 is a system outline diagram showing an example of a basic processing flow of an embodiment of the system of the present invention.

FIG. 7 is a system outline diagram showing an example of a basic processing flow of an embodiment of the system of the present invention.

FIG. 8 is a schematic diagram showing an example of a basic processing flow of an embodiment of the system of the present invention. BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

The personal authentication system of the present invention is a system in which information processing is performed by operation on a terminal such as a computer including input means, control means, display means, output means, storage means, and the like.

Online data processing such as a web server accessed from one user terminal It comprises a system and a certification authority system connected to the online data processing system via a network. · The certification body system uses the digital certificate to perform the authentication process that links the organizational identification data of a company etc. with the personal authentication data, which is characteristic of the present invention, and reports the result of the authentication to the website. Function to return to the online data processing system that performs In addition, it links the organization identification data of companies etc. with the personal information belonging to the organizations etc., and performs data maintenance and management.

The online data processing system accepts access from user terminals on the web site and performs electronic commerce, negotiations, bidding, contracts, and other data processing. For personal authentication of a user at the time of data processing, the system is provided so as to perform data processing in cooperation with the certification institution system, and transmits and receives data for personal authentication with the certification institution system.

As a user terminal for connecting to an online data processing system, a computer terminal such as a personal computer or a workstation is usually used. In addition, user terminals include wireless communication terminals such as mobile phones equipped with a browser function that can be connected to the Internet, mobile information terminals, Internet TV, gaming devices, video conference systems, and other devices. Broadly includes appliances such as home appliances with network connection functions.

The computer terminal includes control means, storage means, input means, output means, display means, and the like. In addition, a computer network such as the Internet should have a function to send and receive connectives and data, and should also have an application program such as a browser, e-mail software, a ド -Depth processor, and an operating system (OS). Is a normal form.

The online data processing system is usually composed of a server system, is connected to communication means represented by the Internet, is provided, and is accessed from a user terminal connected to the communication means.

Here, the communication means includes a wide variety of forms, such as the Internet, a network connected by a dedicated line, an intra-company LAN, an inter-company LAN, and a WAN. The form of the communication line used here includes the form of wired communication and wireless communication. Broadly included, including forms using satellite communications and B 1 uetooth.

Next, as an example of the configuration of the online data processing system, the system can be configured by an application server, a database server, an authentication server, a web server, and if necessary, a mail server and other various devices. However, it is not limited to such a form. Each of these servers can be configured in the same physical device, physically configured with multiple devices, or physically configured with multiple devices connected via a network. Including, if various functions are realized, various forms are included.

The online data processing system is equipped with a web server that stores content data and programs for accessing from user terminals when accepting access from users at web sites and the like via the Internet. I have.

Content data includes data files displayed on the website such as HTML files and XML files, and data displayed on mobile phones that can access websites such as C-HTML files. Files etc. are included.

It also stores character data files, audio data files, image data files, moving image data files, animation data files, and other various content data that are displayed or output by being inserted into these files. can do. .

A more specific example of an online data processing system is as follows.

This system is accessed by users belonging to an organization such as a company to make a contract for receiving and placing orders for inter-company transactions and other electronic commerce. In such a case, whether the accessed user is an individual belonging to the organization such as the company, or whether the user is an individual who has authority to conduct transactions, contracts, etc. If authentication is required, personal authentication is performed in cooperation with the certification body system.

Alternatively, it is a system that is accessed by users belonging to organizations such as companies, and provides bids for delivery of goods, provision of services, construction orders, and participation in estimates. And For example, there is a case where the government or local government accepts bid participation. Even in such cases, the accessing user is an individual who belongs to the organization such as the applicable company, or not, or an individual who belongs and has the authority to participate in bids and submit estimates. If authentication is required, personal authentication is performed in cooperation with the certification body system.

Alternatively, the organization is not limited to companies. For example, if qualified users such as lawyers and tax accountants are users, it is assumed that the administrative organizations (bar associations and tax accountants associations) to which these qualified individuals belong are organizations. In the case of submitting various application documents and declaration documents using electronic data, the accessed user is an individual belonging to the organization of the relevant qualified person, the power of an authorized individual, If authentication is required, perform personal authentication in cooperation with the authentication and certification authority system.

These are all examples of the online data processing system, and the personal authentication system of the present invention can be used in various other forms. Further, the online data processing system is not limited to a web site configured by a web server. It can be used in FTP and other access methods, e-mail, peer-to-peer access, and other methods. The online data processing system includes an electronic certificate receiving means for receiving an electronic certificate transmitted from a user terminal.

The electronic certificate receiving means is used for electronic commerce application, contract application, bid participation application, and other personal authentication required when accessing from the user terminal, and the electronic data transmitted from the user terminal together with the necessary data. The one that receives the certificate. The received electronic certificate is stored in the storage means in the online data processing system together with the related data. The digital certificate is used to make an inquiry to the certification authority system for personal authentication.

The above-mentioned online data processing system includes an authentication unit for transmitting and receiving data to and from an authentication institution system and performing a user authentication process.

The transmission of the electronic certificate from the user terminal to the online data processing system is performed by the user terminal holding the electronic certificate, such as the electronic commerce and bidding sites described above. Required information such as commercial transactions and bids (what is sent and presented to the online data processing system of Japan. An electronic certificate is attached to the specified information, or it is encrypted by an electronic certificate. Sent by

In the received online data processing system such as a web site, the means of authentication and proof are organization identification information such as a company code included in the electronic certificate sent from the user terminal, or a serial number for each individual. And other personal identification information, and store it together with the received data of the required predetermined items. The authentication process is performed by transmitting the organization identification information or personal identification information required for the authentication process to the certification institution system described below and referring to the authentication database.

Each sent transaction condition information is securely protected by encrypted communication using an electronic certificate with a company code added.

Here, the authentication using a digital certificate with a company code attached is one in which individuals belonging to organizations such as companies that transmit data by accessing transactions, bidding, and other various online data processing systems are issued. It is.

FIG. 2 is a system configuration diagram showing an example of a form in which a certification authority system is provided so as to be accessible from a plurality of online data processing systems. It is possible to use the same digital certificate for user authentication to access online data processing systems such as different web servers.

Since the personal authentication system of the present invention performs authentication processing using organization identification data such as a general-purpose company code, it can be used in various online data processing systems for general purposes. Each online data processing system, such as e-commerce sites and bidding sites, does not need to have its own authentication database.

Next, the certification body system has a certification database. The data stored in the authentication database includes at least the organization identification data such as the company code, and the personal authentication data for authenticating the individual in the organization by associating the organization with the individual.

The organization identification data is organization identification data such as a general-purpose company code, which is incorporated in a digital certificate as an example of a desirable form, and correspondingly, data that associates an organization with an individual is authenticated. Stored in the database. In addition, it is desirable to store and manage basic company information and authority information in the authentication database.

Still another form of data stored in the authentication database is a form in which an electronic certificate that does not incorporate organization identification data such as a company code as an electronic certificate and that incorporates an individual's serial number is used. Can be

In this case, it is necessary to associate the organization with the individual by providing the authentication database with a correspondence table between the serial number of the individual and the organization identification data such as the company code.

The authority information stored in the authentication database firstly indicates whether the individual to be authenticated belongs to the company or the like, or whether or not he / she has the predetermined authority. There is authority information within the organization.

In order to register and manage such authority information, the certification authority system requires that a person with the prescribed authority of the organization, such as a company, set the authority of the individual holding the digital certificate belonging to the organization. Means are provided.

Administrators of organizations such as corporations-The responsible person, etc. has established a function to set the duties of digital certificate holders in the organization, and when the digital certificate holder accesses the authentication system, On request, provide authority information for the associated “company”. The authentication means performs a user authentication in an online data processing system based on authentication information extracted from an authentication database and including authority information of individuals in an organization.

In the second form of authority information, an online data processing system such as a website that performs e-commerce and bidding can be used for transactions and bidding for organizations such as companies and individuals belonging to them. The power of giving or not giving the authority to apply for and participate in the event is given.

When granting such authority information, the certification authority system has a usage authority setting that sets which electronic certificate holder can use the person who has the predetermined authority of the online data processing system. Means are provided.

Online data processing system administrator · The operator has built a function to set which digital certificate holder can use the company's own system. When the holder accesses the authentication system, the set authority information is provided in response to a request from the authentication system. The authentication means performs user authentication in the online data processing system based on authentication information including authority information of individuals in the organization extracted from the authentication database.

By setting such authority information, using a general-purpose digital certificate issued to an individual who is a natural person, the attribute of a person belonging to a thread, such as a company, government office, organization, school, etc. Authentication based on the use of information and the presence or absence of authority information can be performed. This is because, when using an electronic certificate in electronic bidding, electronic application, and business-to-business electronic commerce between companies and governments, it is necessary to issue an electronic certificate to “business people”. In order to issue and use an electronic certificate to a "corporate person", a function to recognize the existence certificate of the "company" to which it belongs and the attribute information thereof is realized at the same time as the existence certificate of the "person".

An example of the electronic certificate used here is, for example, as follows, which is issued by a certification authority system or the like connected to a network. The certification authority system is preferably a form of a neutral third-party certification authority. In the system of the present invention, the issuance process is performed in a certification authority system described later or a server cooperating therewith. be able to.

Various types of known digital certificates can be used, but a typical example is a digital signature system using a public key cryptosystem.

The public key cryptosystem is a system in which a single key pair (public key and secret key) is used to perform encryption and decryption (decryption). What is encrypted with a private key cannot be decrypted without a public key. Proof that the public key is indeed the authenticity is provided by a trusted third-party certificate authority system. The certification body issues an electronic certificate (electronic certificate) that proves the owner of the public key.

In the personal authentication system of the present invention, the association between a person who is a natural person and has an electronic certificate and a thread belonging to a company or the like to which the person belongs is made using organization identification data such as a general-purpose company code. In order to do so, the following requirements must be met as a desirable method.

First, an organization such as a company to which an individual who is issued a digital certificate belongs It is possible to accurately identify which identification code corresponds to the organization information (corporate information) database used.

Second, when an organization such as a company to which an individual who issues a digital certificate belongs to a company, etc., which is not recorded in a generally distributed company information database, a new identification code is set. As a matter of course, the identification code crosses the type of business and business, and must be managed and operated accurately.

Third, since the minimum required information is disclosed free of charge when using the organization identification code, the information can be used effectively in an online data processing system that uses authentication. Next, an example of an electronic certificate issuance mode performed by the certification authority system will be described. First, access the certification authority system from the user terminal, report the public key to the certification authority system, and request issuance of a digital certificate.

For example, in order for a user belonging to company A to register as a member, the user of company A first submits an application to the certification body after filling in the company name, name, Roman character name, e-mail address, etc. Do.

The certification body confirms that the request was made by the principal. If there is an application for membership, the certification body system will conduct an examination of company A. In the examination, the examination of company A will be conducted using the existing company information database, etc. Can be.

If the examination is passed, the information of the applicant user of Applicant Company A is registered in the certification database in the certification organization system.

When registering in the authentication database, when issuing an electronic certificate by applying from the affiliated organization (company, etc.), the “person” is linked to the “company” to which it belongs. The identification code of the company information database that is generally distributed is used for linking with the organization such as the company.

Incorporate common company identification codes into digital certificates.

Alternatively, for a digital certificate that cannot incorporate a company identification key, the correspondence between the unique information stored in the digital certificate such as a serial number and the company identification code of the relevant company Use a table.

After registration, a digital certificate (with public key) is sent to the requesting user. '' The above-described process for issuing a digital certificate and issuing a digital certificate and a configuration therefor are only examples of desired forms and forms. In the system of the present invention, other forms of digital certificates Things can be used.

Hereinafter, a basic processing flow of the present invention will be described with reference to FIG. FIG. 3 is a system outline diagram showing an example of a basic processing flow of the system of the present invention. .

First, as a prerequisite for the authentication process, an application for a transaction or a bid from an online data processing system such as a website that performs e-commerce or bidding to a company or other thread or an individual belonging to it. Authorization, access to the certification authority system, and registration of authority information (use authority information) in order to grant the authority to grant or deny the authority to use such as participation and participation (S100).

Authority information (usage authority information) is used to determine whether or not an individual who accesses the system belongs to an organization such as a company. This is information such as permission to use by authentication processing such as bidding.

In addition, when the administrator of an organization such as a company assigns authority information (organization authority information) to which of the individuals who belong to the organization in advance, the authority information (organization authority) It is information that, by judging whether or not the information has been granted, the user is authorized to use it by authentication processing such as e-commerce and bidding if it exists.

Next, the user authentication process in the online data processing system will be described.The contents of the user authentication include, for example, user authentication regarding the availability of use of the system and service, and the presence or absence of authority for transactions, User authentication, user authentication for eligibility for bid participation, various applications and examinations, etc.

Access the online data processing system from the user terminal, and the online data processing system, such as e-commerce application and bid participation application, inputs data. Input the data of the specified data item requested to be sent, and send the input electronic document. At this time, the digital certificate is transmitted together (S101). If the digital certificate is a secret key system, the digital certificate is encrypted (digital signature) using this. The electronic certificate contains organization identification data such as a company code or a serial number for identifying an individual. Send electronic documents, ciphertexts, and public keys.

Next, in the online data processing system, the electronic certificate receiving means receives the data transmitted from the user terminal, decrypts the cipher text using the attached public key, and verifies the signature. By checking it against the original electronic document, it can be confirmed that no unauthorized tampering has been performed.

At the same time, the authentication means makes an inquiry to the authentication database of the certification authority system to confirm that the owner of the private key corresponding to the public key has been digitally signed (S102). Based on the authentication information extracted from the authentication database and including at least the authority information of the individual in the organization, the authentication means determines whether or not there is predetermined authority information, and performs user authentication in the online data processing system. I do.

If the authentication database stores in advance the settings of the holder of the above-mentioned online data processing system who has the specified authority and who can use it, A registered user who owns an online data processing system does not need to register as a user by passing the user authentication to the authentication institution system.

It is desirable that the certification authority system provide the attribute information of the linked "company" in response to an inquiry request from the online data processing system.

When the authentication is completed, the result is notified to the user terminal (S103), and predetermined data necessary for data processing is transmitted and received.

As described above, according to the basic embodiment of the present invention, individual authentication in an organization such as a company can be performed.

Also, with multiple authentication systems (multiple authentication sites with different operators), users need only one certificate. In addition, the general-purpose company code is incorporated into the digital certificate and the use of the authentication database is open, so that both the authenticating side (operator of local governments and companies) and the authenticated side (bidders, users, etc.) Two general purpose digital certificates The authentication work is completed.

Next, an example of a processing flow in another embodiment of the system of the present invention will be described with reference to FIG.

In the normal authentication work, a digital certificate must be used and the user must be registered and entered in the authentication database. New applicants will not be able to use the certificate until after registration, and will need to perform registration work when bidding on multiple local governments or using multiple services. · Therefore, as shown in Fig. 4, a user who possesses an electronic certificate accesses from a user terminal and applies to the above-mentioned usage right setting means for setting the usage right in the online data processing system. Preferably, means are provided in said certification authority system.

Here, if a digital certificate incorporating a general-purpose company code is distributed and there is a certification and certificate database in which the authority information has been entered (the information of the parties to whom use is permitted is registered in advance), The user who has obtained the certificate after completing the registration will be able to bid on each local government and use the service site without having to newly register. The website does not need to build its own electronic authentication system.

Next, an example of a processing flow in the present embodiment will be described with reference to FIG. 4 again.

This is a general-purpose application system that allows certificate holders (persons who own digital certificates) to register on other sites with their own hands.

If the application for setting the use authority in the online data processing system is approved and stored in the use authority setting means, user authentication for the individual who satisfies the predetermined conditions belonging to the organization to which the individual who owns the relevant digital certificate belongs Is recognized. For example, if a municipality (A) qualifies for bid participation, and a certificate holder company (A) who is bidding electronically with a digital certificate, and another municipality (B) wants to qualify for bidding, In this case, the user, the certificate holder itself, takes the first action, even if the publisher does not take action to pass the authority information.

After obtaining the local government A's bid participation qualification and accessing the certification body system (S200), the company A that has received the certificate is registered on the use application site when applying for local government B. Apply (s 20 Do

The company application information is transmitted from the application site to the local government B's bidding site (S202), the content is confirmed and qualification is examined. If OK, the company can directly participate in the bidding for the local government B (S203) ₀ This system is effective when there is no prior data for each company on the site operator side It can be an effective means.

In FIG. 5, an online data processing system having at least an electronic certificate receiving means and an authentication means is connected to a Web site for transmitting and receiving data and processing data via the Internet, and is provided with a data processing system. You. A data processing system is a core system in which an administrator who manages and operates a web site and the like performs data processing in the organization and the like. For example, a system that stores received data, performs transactions, billing, accounting, and other data processing, and a system that manages customers for each user is an example.

A data processing system that performs various data processing after user authentication is characterized by using thread identification data such as a company code used for the authentication database.

This will enable seamless business coordination with electronic applications (reception), electronic contracts (starting transactions), and even core systems (such as tori I to billing).

Ordinary digital certificates are only specially designed for authentication. After the certification is completed, the site operator is forced to perform new work such as calling the customer information of the relevant user and linking it to the transaction information in order to proceed to the core business system (actual commercial transaction), If a digital certificate incorporating a general-purpose company code is distributed and the use of an authentication database in which company information is entered becomes open, after authentication, the information of the company concerned will be linked using the company code as a key. It is possible to seamlessly advance to core business.

Next, an example of a processing flow in another embodiment of the system of the present invention will be described with reference to FIG. In the present embodiment, as shown in FIG. 6, the authentication database provided in the certification institution system includes an organization information database for storing and storing and updating organization information such as company information associated with the organization identification data as a key. Provided in cooperation. Companies are living creatures and can undergo a variety of changes, including mergers, bankruptcies, and dormancy. However, for example, in the case of local government bidding, a bankrupt company or a merged company due to a merger loses the eligibility to participate in the bidding, but a system in which these fluctuation information and digital certificates are linked is used by commercial registration certification authorities and ordinary private companies. There is no certificate authority, and no such response can be taken when such a situation occurs. In addition, a digital certificate based on a commercial registration cannot cope with corporate dormancy or unauthorized use of the registration.

Here, by linking the organization information (corporate information) database that reflects the fluctuation information of the company with the authentication database, if the information on the company is updated, the authentication database is updated at any time in real time or close to it. It is reflected (S300).

If there is a data update for a company that has lost access to e-applications and e-bidding due to bankruptcy or merger, the invalidation list (from the certification body system to the online data processing system) CRL) is provided (S301). Invalid processing lists are stored in the online data processing system.

The user accesses the online data processing system from the user terminal, and inputs data of predetermined data items that the online data processing system requests data input and transmission, such as e-commerce application and bid participation application, and the input electronic document Is transmitted (S302). At this time, the electronic certificate is also transmitted, and in the online data processing system, the data transmitted from the user terminal is received by the electronic certificate receiving means.

Then, when verifying the signature, a warning can be issued on the authentication system by collating it with the invalidation list (S303). If it is not in the invalid processing list, perform normal authentication processing.

This allows publishers to interact only with qualified users. Updating organizational information of companies, etc. Have been.

In this embodiment, the online data processing system is provided with a user database of customers and the like. '' The company fluctuates due to changes in trade name, address, etc., but maintenance is difficult (or impossible) in a normal authentication system, and information at the time of registration is often left as it is. .

Here, by linking the organization information (company information) database that reflects the company's fluctuation information with the authentication database, if the data is updated, the authentication database is updated and reflected at any time in real time or close to it (S400). When the data is updated, the certification authority system provides the updated data to the online data processing system by sending it (S401) and updating the user database (S402). ). It can provide information such as business name changes and address changes, and can maintain the customer database on the site operator side.

It is characterized in that the organization information such as company information provided in cooperation with the authentication database is stored, stored, and updated, and the update and fluctuation of the organization information database can be used for the update and fluctuation of the user database. I do.

The customer database can be maintained, and the latest data can be referred to when performing authentication processing by accessing the online data processing system from the user terminal (S403).

For example, in the construction industry, bidding restrictions and screening can be performed by objectively assessing construction capacity through management item screening, but in other industries, there is no alternative to management item screening. In order to promote the digitization of goods procurement and applications in an open environment, it is necessary to link with a system that can obtain company information for understanding the status of bidders and applying companies. . Here, by linking the organization information (corporate information) database with the credit information of the company to the authentication database, the site operator can check the credit status of each user. In addition, if qualified screening information as authority information has been input in the authentication database in advance, automatic company selection becomes possible.

In the present embodiment, the data stored in the organization information database includes organization credit information such as corporate credit information.

For example, organizational credit information can be obtained by a third-party investigator, such as basic information about the company, organizational information, transaction volume, payment results, delivery results and other transaction information, financial information, member information, and other important information. It may include quantitative or qualitative information including item information. Also, based on such information, it is possible to store, accumulate, and update indices, ratings, rankings, and other credit information indicating credit information.

Further, in the present embodiment, it is desirable that the authority information stored in advance in the authentication database include qualifying starry-jung information based on the credit information.

Eligibility screening information is data that serves as a basis for each online data processing system to perform screening processing based on the above-mentioned organizational credit information in order to determine the eligibility of a partner such as a transaction or a bid. By creating in advance data that can be used as a basis for determining the base value or rating value table from company information, it is possible to narrow down promising destinations by making decisions based on whether transactions can be made, whether bids can be made, or priorities. Features.

In this case, first, data is created in advance to determine the standard value or rating value table from the company information.

The reference value is, for example, a numerical value that serves as a criterion such as not performing a transaction with a score of 50 or more, and the rating value is, for example, a ranking of 70 or more with a rating of A, etc. It is.

In the system of the present invention, in addition to the reference value or the rating value, various scales serving as judgment criteria can be set in advance.

Also, for the data that is the source of the judgment, it is it can.

Thus, in the data processing in the online data processing system, a screening process based on the credit information can be performed.

Next, the company information acquisition agent extracts information (such as a company code) for acquiring company information from the transaction condition information to which the company code is added, and makes a search request to the company information providing server. The search request is sent to the company information acquisition server for acquiring company information in real time or in batch processing.

Referring to FIG. 8, the organization credit information stored in the organization information database is stored in association with the data stored in the authentication database and the organization identification data such as the company code. It can be extracted and referenced using a code or the like (S500).

When the automatic screening process is performed, qualified screening information is set in advance in the authentication database from the online data processing system and stored (S501).

The user accesses the online data processing system from the user terminal, and inputs the data of the specified data items that the online data processing system requests data input and transmission, such as e-commerce application and bidding participation application. The electronic document is transmitted (S502). At this time, the digital certificate is also transmitted, and in the online data processing system, the data transmitted from the user terminal is received by the digital certificate receiving means.

Next, an inquiry is made to the authentication database (S503), and information including the credit information of the corresponding company or the like is extracted using the company code or the like (S504). The data searched and extracted using the company code as key is business information and information such as sales and grades. In some cases, the data to be returned is only the judgment itself (Y ES, Ν Ο, etc.).

Using the credit information obtained in this way, it is determined whether or not a transaction can be made, whether or not a bid can be made, and the priority. Through the processing described above, based on the rating value or limit value table, etc., judgment is made based on the feasibility of the transaction, priority, etc., and the promising destinations are narrowed down. Next, from the data of the results obtained from the authentication period system, the above-mentioned judgment result obtained in the online data processing system is transmitted to a company or the like which has transmitted information and made a transaction application and the like. Industrial applicability

As described in detail above, according to the present invention, when an individual is authenticated in a transaction, a bid, a contract, or the like in an electronic space such as the Internet, does the individual really belong to an organization such as a company? It is possible to provide a system that can authenticate whether or not they have the authority to participate, judge, and decide in transactions, bidding, etc. even if they are affiliated.

Therefore, by incorporating a general-purpose company code or serial number into the electronic certificate and entering the company code, serial number, personal information within the company, basic company information, and authority information into the authentication database, It is possible to perform authentication by associating with an individual, and it is also possible to authenticate a sole proprietor. Further, in the present invention, it is possible to provide a system in which a single certificate can be used by a user even in a plurality of authentication systems such as a plurality of authentication sites having different operators. If a general-purpose company code is incorporated into the digital certificate and the use of the authentication database becomes open, one general-purpose digital certificate will be used for both the authentication side of local governments and companies, etc., and the user to be authenticated such as bidders. Certification work can be completed with the certificate.

Further, according to the present invention, by linking an authentication database for authentication using a digital certificate with an organization information database of a company or the like, authentication and the like are performed based on the latest updated data at any time during authentication. It is possible to provide a system capable of performing the above processing. Appropriate authentication processing can be performed by responding to retirement from a company or the like, changes in departments and positions, and in addition, the company itself responds to mergers, bankruptcies, changes in credit information, and other changes. In addition, the data is collected, stored, and updated by the certification body, so that the websites that perform the respective certifications can use the certification system of the present invention without having to construct individual databases. It becomes possible to do.

Claims

Scope of Claim 1. A system in which information processing is performed by operation on a terminal such as a combi- ter having input means, control means, display means, output means, storage means, etc., and is accessed by a user terminal. An authentication institution system connected to the online data processing system via an online data processing network such as a server,

The online data processing system includes an electronic certificate receiving unit that receives an electronic certificate transmitted from a user terminal, an authentication unit that transmits and receives data to and from a certification authority system, and performs a user authentication process. At least

The above-mentioned certification institution system is provided with a certification database, and the data stored in the certification database authenticates individuals in the organization by associating organization identification data such as a company code, etc. with the individual. At least personal authentication data for

A general-purpose individual in an organization, wherein the authentication means performs user authentication in an online data processing system based on authentication information including at least authority information of the individual in the organization extracted from the authentication database. Authentication system.

2. In the invention described in claim 1,

A general-purpose individual in an organization, characterized in that an organization can be associated with an individual by using an electronic certificate in which organization identification data such as a general-purpose company code is incorporated as the electronic certificate. Authentication system.

3. In the invention described in claim 1,

A general-purpose in-house personal authentication system, characterized in that an organization can be associated with an individual by a correspondence table between the serial number and organization identification data such as a company code provided in the authentication database.

4. Claims! In the invention described in any one of (1) to (3), The above certification authority system is provided so as to be accessible from a plurality of online data processing systems, and can perform user authentication for accessing an online data processing system such as a plurality of different web servers using the same digital certificate. This is a general-purpose in-house personal authentication system. "

5. In the invention described in claims 1-4,

The above-mentioned authentication database stores organization identification data such as a company code and personal authentication data, and data including at least one of company basic information and authority information. Personal authentication system in the organization.

6. In the invention described in claims 1 to 5,

7. In the invention described in claims 1 to 6,

8. In the invention described in claims 1 to 7,

User authentication in the online data processing system described above includes user authentication about the availability of the use of system services, etc., user authentication about whether or not you have authority over transactions, business negotiations, contracts, etc., bid participation, various applications, examinations, etc. A general-purpose in-house personal authentication system, characterized by including at least one of user authentication for eligibility.

9. In the invention described in claim 7, In the case where the above-mentioned authentication database stores in advance the setting of which electronic certificate holder can use the person having the predetermined authority of the online data processing system,

Registered users who own digital certificates are required to authenticate users for the availability of systems and services, to authenticate users for transactions, negotiations, contracts, etc. A general-purpose in-house personal authentication system characterized by eliminating the need for user registration in online data processing systems such as websites after user authentication such as user authentication for qualification.

10. In the invention described in claims 1 to 9,

1 1. In the invention described in claim 10,

If the application for setting the usage right in the online data processing system is approved and stored in the usage right setting means, the user who meets the predetermined conditions belonging to the organization to which the individual who owns the relevant digital certificate belongs belongs. A general-purpose in-house personal authentication system characterized in that user authentication is permitted.

1 2. In the invention described in claims 1 to 11,

In the online data processing system, the data processing system that performs various data processing after user authentication is a system that uses organization identification data such as a company code used in the authentication database. General-purpose organization personal identification system. ·

13. In the invention described in claims 1 to 12,

The authentication database provided in the certification authority system is provided in cooperation with an organization information database that stores, stores, and updates organization information such as company information associated with organization identification data as a key, and A general-purpose in-house personal authentication system characterized by the ability to perform user authentication reflecting information updates and fluctuations.

1 4. In the invention described in claim 1,

The online data processing system is provided with a user database of customers and the like, and stores and stores organization information such as company information provided in cooperation with the authentication database. A general-purpose in-house personal authentication system that can be used for database updates and fluctuations.

15. In the invention described in claims 13 or 14,

Authority information stored in advance in the authentication database includes qualifying screening information based on credit information,

A general-purpose in-house personal authentication system characterized in that a screening process based on credit information is possible in data processing in an online data processing system.