JP2008009644A - Authentication system and authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system and an authentication method dispensing with another initial authentication in a different client device. <P>SOLUTION: Identification information for identifying a portable medium is read from the portable medium and transmitted to an authentication server device. The authentication server device issues and stores authentication state information based on the received identification information, while the issued authentication state information is written in the portable medium. The authentication state information is read from the portable medium, and authentication processing is carried out based on the stored authentication state information. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an authentication system and an authentication method for performing authentication using a portable medium that stores authentication state information.

  Authentication techniques for identifying and authenticating communication partners and users are used when using communications and services. As this authentication technique, a single sign-on technique capable of improving the convenience of authentication has attracted attention. In single sign-on technology, the authentication processing is divided into initial authentication and post-authentication, thereby reducing the burden of user authentication processing in a distributed system environment. For example, initial authentication is performed by inputting a password (in many cases, in addition to this, a user identifier). At this time, the authentication state at the time of initial authentication is associated with session information (for example, an HTTP session of a Web server). In post-authentication, using this session information eliminates the need to enter the password again.

  Here, it is desirable to adopt an authentication method with strong user discrimination. However, in an authentication method with strong discrimination power, a special device or application (for example, a biometric scanner for biometric authentication) needs to be installed in all clients (terminals).

On the other hand, technologies that enable single sign-on by sharing the authentication status between different systems have appeared. As this standard specification, SAML (Security Assertion Markup Language) was formulated by OASIS (see Non-Patent Document 1). Using this standard specification, it is easy to introduce a strong authentication method by connecting an authentication device that supports initial authentication to multiple clients.
“Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2.0”, [online], OASIS Security Services (SAML) TC, [Searched on December 27, 2005], Internet <URL: http: // www .oasis-open.org / committees / download.php / 11898 / saml-core-2.0-os.pdf> “An Internet Attribute Certificate Profile for Authorization, RFC 3281”, [online], IETF, [searched on December 27, 2005], Internet <URL: http://www.ietf.org/rfc/rfc3281.txt>

At this time, the issued authentication status information is managed on a specific client. For this reason, single sign-on can be used only by specific clients. For example, when initial authentication is executed using a Web browser of a certain client, single sign-on is possible only through the Web browser (that is, the client).
As a result, when the physical terminal (for example, personal computer) used by the user is not specified, the convenience of the user is impaired. That is, even if the user performs initial authentication on a physical terminal, it is necessary to perform initial authentication again when the physical terminal to be used is changed.
In view of the above, an object of the present invention is to provide an authentication system and an authentication method that do not require re-initial authentication with a different client device.

  An authentication system according to an aspect of the present invention includes first and second client devices and an authentication server device, and the first client device has identification information for identifying the portable medium from a portable medium. A reading unit for reading, a transmitting unit for transmitting the read identification information to the authentication server device, a receiving unit for receiving authentication status information from the authentication server device, and the received authentication status information in the portable medium. A writing unit, and the second client device includes a reading unit that reads authentication status information from a portable medium, and a transmission unit that transmits the read authentication status information. A server device for receiving identification information transmitted from the first client device; an issuing unit for issuing authentication status information based on the received identification information; A storage unit for storing issued authentication status information, a transmitting unit for transmitting the issued authentication status information to the first client device, and receiving authentication status information transmitted from the first client device And a second authentication unit configured to perform authentication processing based on the received authentication status information and the stored authentication status information.

  An authentication method according to an aspect of the present invention is an authentication method using first and second client devices and an authentication server device, wherein the first client device identifies the portable medium from a portable medium. Reading the identification information to be performed, the first client device transmitting the read identification information to the authentication server device, and the authentication server device transmitting the identification information from the first client device Receiving information, a step in which the authentication server device issues authentication status information based on the received identification information, a step in which the authentication server device stores the issued authentication status information, The authentication server device transmitting the issued authentication status information to the first client device; and the first client device. Receiving the authentication status information transmitted from the authentication server device; writing the received authentication status information to a portable medium; and the second client device. Reading the authentication status information from the portable medium, the second client device transmitting the read authentication status information, the authentication server device receiving the authentication status information, The authentication server device includes a step of executing an authentication process based on the received authentication status information and the stored authentication status information.

  According to the present invention, it is possible to provide an authentication system and an authentication method that do not require re-initial authentication at a different client device.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
(First embodiment)
FIG. 1 is a block diagram showing a configuration example of a single sign-on system 100 according to the first embodiment of the present invention.
The single sign-on system 100 includes a portable medium 110, a client device 120 (first and second client devices 120 (1) and 120 (2)), and an authentication server device 130. Service providing apparatuses 140 (140 (1), 140 (2)) that trust the authentication in the single sign-on system 100 and provide services are connected to the single sign-on system 100 via a network.

A. About Authentication Server Device 130 The authentication server device 130 authenticates the user and issues authentication status information for realizing single sign-on based on the authentication result.
FIG. 2 is a block diagram illustrating an example of the internal configuration of the authentication server device 130.
The authentication server device 130 includes a communication unit 131, a portable medium authentication unit 132, an authentication status information issue unit 133, an authentication status information transmission unit 134, an authentication status information management unit 135, and an information storage unit 136.
Note that the description of the (authentication) session management mechanism in single sign-on is omitted.

  The communication unit 131 transmits / receives information (for example, certificate status information) related to user authentication to and from a communication peer (client device 120, service providing device 140) via a network.

The portable medium authentication unit 132 authenticates the portable medium 110 by exchanging an authentication protocol message with the client device 120 via the communication unit 131. At the time of this authentication, the portable medium authentication unit 132 reads the credential (credential) of the portable medium 110 from the information storage unit 136. The portable medium authentication unit 132 notifies the authentication status information issuing unit 133 of the authentication result.
As this credential (credential), for example, a combination of an identifier for identifying the portable medium 110 and a password (a password in a broad sense such as cryptographic secret information) can be cited.

  The authentication status information issuing unit 133 issues authentication status information based on the authentication result of the portable medium 110. That is, the authentication result of the portable medium 110 is used as information for determining whether or not the authentication status information is issued (issuance determination information).

The following (1) to (4) can be used as issue permission determination information.
(1) Identifier (identification information) of the portable medium 110
(2) Combination of identifier and password of portable medium 110 (3) Combination of user ID and fixed password (a kind of user identification information)
(4) Biometric information such as fingerprints and irises (a type of user identification information)
(5) Any combination of (1) or (2) and (3), (4)

The authentication status information is status information for guaranteeing the validity of the user. Single sign-on can be realized based on the authentication status information. As the authentication status information, an authentication statement element (included in the SAML assertion) defined by SAML can be used.
The authentication status information includes additional information (the restriction information (usage restriction) described in the second embodiment is also a kind of additional information) such as the validity period of authentication and the authentication method actually executed. You can control the state.

  The authentication status information transmitting unit 134 transmits a message including the authentication status information issued by the authentication status information issuing unit 133 to the communication peer (client device 120).

The authentication status information management unit 135 stores and manages issued authentication status information. The authentication status information management unit 135 monitors termination conditions such as the expiration date specified in the authentication status information, and deletes the invalidated authentication status information. Note that the authentication status information may be deleted by an invalidation command from the administrator.
Further, the authentication status information management unit 135 responds to the authentication status confirmation in response to an inquiry about the authentication status confirmation from the outside (service providing apparatus 140).

  The information storage unit 136 stores information used by the portable medium authentication unit 132 and the authentication status information issuing unit 133, and provides information in response to requests from these. Examples of information stored in the information storage unit 136 include the credentials of the portable medium 110 and the client device 120.

B. About Client Device 120 The client device 120 is a terminal connected to a network and can use a general computer (for example, a personal computer or a kiosk terminal).

FIG. 3 is a block diagram illustrating an example of the internal configuration of the client device 120. The first and second client devices 120 (1) and 120 (2) can adopt the same configuration.
The client device 120 includes first and second communication units 121a and 121b, an authentication status information receiving unit 122, an authentication status information acquisition unit 123, an authentication status information providing unit 124, a communication peer authentication unit 125, an authentication client unit 126, and information storage. A unit 127, a control unit 128, and a user interface unit 129.

  The first communication unit 121a transmits and receives information (for example, certificate status information) related to user authentication to and from communication peers (the authentication server device 130 and the service providing device 140) via the network.

The second communication unit 121b communicates with the portable medium 110. For this communication, wireless (for example, wireless LAN (IEEE 802.11 series) or Bluetooth (Bluetooth))) or wired (for example, USB (Universal Serial Bus) 1.x / 2.0) can be used.
In addition to the portable medium 110, the second communication unit 121b communicates with a user authentication device (for example, a biometric matching device) and identifies information (for example, a fingerprint, a face image, a user image) from the user authentication device. (Iris, blood vessel shape) may be received. This user authentication device only needs to be included in the client device 120 that performs initial authentication.
In place of the second communication unit 121b, the first communication unit 121a may communicate with the portable medium 110 or the user authentication device.

  The authentication status information receiving unit 122 requests and receives authentication status information from the authentication server device 130. Further, the authentication status information receiving unit 122 stores the received authentication status information in the portable medium 110.

The authentication status information acquisition unit 123 acquires authentication status information from the portable medium 110.
The authentication status information providing unit 124 provides the authentication status information acquired from the portable medium 110 via the authentication status information acquiring unit 123 to the service providing apparatus 140.

The communication peer authentication unit 125 authenticates the communication peer (authentication server device 130, service providing device 140, user authentication device) and proves itself.
The authentication client unit 126 reads the credentials (credentials) from the portable medium 110 when the authentication server device 130 authenticates the user or the portable medium 110. Prior to this reading, the authentication client unit 126 exchanges an authentication protocol with the portable medium 110.

The information storage unit 127 stores information used by the communication peer authentication unit 125 and the authentication client unit 126, and provides information in response to a request from them.
The control unit 128 includes first and second communication units 121a and 121b, an authentication status information receiving unit 122, an authentication status information acquisition unit 123, an authentication status information providing unit 124, a communication peer authentication unit 125, an authentication client unit 126, a user interface. Controls information transmission between the units 129.
The user interface unit 129 is a device for a user to input and output information. The user interface unit 129 may be implemented with a graphical user interface (GUI) or the like.

C. About the portable medium 110 The portable medium 110 is a transportable medium device having a certain degree of calculation capability, and a smart card, a mobile phone, a PDA, or the like can be used. The portable medium 110 preferably has a function of preventing external leakage of internal information.

FIG. 4 is a block diagram illustrating an example of the internal configuration of the portable medium 110.
The portable medium 110 includes a communication unit 111, a communication peer authentication unit 112, an authentication state information storage unit 113, an information provision unit 114, and an information storage unit 115.

The communication unit 111 communicates with the client device 120 to transmit and receive information related to user authentication (for example, authentication status information).
The communication peer authentication unit 112 authenticates the communication peer (client device 120) and proves itself.
The authentication status information storage unit 113 stores the authentication status information provided from the client device 120 in the information storage unit 115.
The information providing unit 114 provides authentication status information stored in the information storage unit 115 or credentials of the portable medium 110 in response to a request from an external device.
The information storage unit 115 stores information used by the communication peer authentication unit 112 and the information providing unit 114, and provides information in response to requests from these.

(Operation of the single sign-on system 100)
Hereinafter, the operation of the single sign-on system 100 will be described.
The operation of the single sign-on system 100 is divided into an initial authentication phase and a post-authentication phase.
The initial authentication phase is an operation until logging in using the first client device 120 (1).
The post-authentication phase is an operation until the service provided by the service providing apparatus 140 is received using the second client apparatus 120 (2) different from the first client apparatus 120 (1). At this time, the user is authenticated to the service providing apparatus 140 using the authentication status information acquired in the initial authentication phase.
FIG. 5 and FIG. 6 are flowcharts showing examples of operation procedures in the initial authentication phase and the post-authentication phase of the single sign-on system 100, respectively.

A. Initial Authentication (1) The first client device 120 (1) requests the authentication server device 130 for login processing (that is, issuance of authentication status information) (step S11). This request is initiated by a user input to the first client device 120 (1).
(2) The authentication server device 130 requests the first client device 120 (1) to execute an authentication process (step S12).

(3) In response to the request, the first client device 120 (1) executes the agreed authentication process (step S13).
The authentication server device 130 designates the authentication method, and the first client device 120 (1) executes the designated authentication method. At this time, a plurality of authentication protocols can be processed, but it is desirable to implement an authentication protocol using the portable medium 110. For example, the portable medium 110 is authenticated using a public key certificate (a kind of credential) stored in the portable medium 110. In this case, the user who holds the portable medium 110 has the right to enjoy the service from the service using device 140.

  1) The portable medium authentication unit 132 of the authentication server device 130 confirms the portable medium 110 that is a storage target of authentication status information in the next step (confirmation of communication peer). Prior to this confirmation, the first client device 120 (1) displays to the user a request to connect the portable medium 110 to the first client device 120 (1).

2) After confirming the connection, the authentication client unit 126 of the first client device 120 (1) reads the credentials stored in the portable medium 110 and executes the client side process of the authentication process (of the portable medium 110). Authentication).
In addition, the credential is not directly read from the portable medium 110, and information (such as a MAC value or a digital signature value necessary for an authentication algorithm of the authentication protocol) that is cryptographically processed based on the credential is requested to the portable medium 110. May be. When reading the credentials directly, it is desirable that the communication peer authentication units 112 and 125 of both the portable medium 110 and the first client device 120 (1) mutually authenticate the communication peer.

  3) When it is determined that authentication of the communication peer is successful and information can be provided, the information on the portable medium 110 can be transmitted to the first client device 120 (1). If the above authentication process is successful, the process proceeds to the next step S14. If any of the authentication processes fails, the process may be terminated, or step S13 may be retried a predetermined number of times.

(4) The authentication server device 130 determines the success or failure of the initial authentication result of single sign-on by verifying the contents of the authentication processing performed by the first client device 120 (1). If it is determined that the result is successful, login is permitted, and authentication status information is issued as information to prove it (step S14).
Information necessary for issuance, such as issuance credentials (such as a private key of a public key certificate pair) used when the authentication server device 130 is issued and an issuance policy for whether or not to permit issuance, are stored in advance in the authentication server device 130. It is assumed that the information is stored in the information storage unit 136.

As the authentication status information at this time, a SAML authentication assertion including an authentication statement element can be used.
It is desirable to encrypt the authentication status information with an encryption key unique to the portable medium 110. The entire authentication status information may be encrypted, or only a part thereof may be encrypted. The encryption key may be shared in advance or may be exchanged via the authentication protocol executed in step S13.
The issued authentication status information is notified to the authentication status information transmission unit 134 and the authentication status information management unit 135 in the authentication server device 130.

(5) The authentication status information transmission unit 134 of the authentication server device 130 transmits the authentication status information issued in step S14 to the first client device 120 (1) (step S15).
(6) The first client device 120 (1) stores the received authentication status information in the portable medium 110 via the second communication unit 121b. The portable medium 110 stores the received authentication status information in the information storage unit 115 (step S16).

B. Post-authentication (1) The second client device 120 (2) requests the service providing device 140 to provide a service (step S21).
(2) The service providing device 140 requests the second client device 120 (2) to acquire authentication status information (that is, perform authentication processing) (step S22).

(3) In response to a request from the second client device 120 (2), the portable medium 110 provides authentication status information (step S23). Prior to this authentication, it is desirable to perform bidirectional authentication processing or one-way authentication on the requesting side (confirmation of communication peer) between the portable medium 110 and the second client device 120 (2).
(4) The second client device 120 (2) submits the acquired authentication status information to the service providing device 140 (step S24).

(5) The service providing apparatus 140 confirms the authentication status information submitted with the authentication server apparatus 130 (step S25).
That is, the service providing apparatus 140 verifies the validity of the authentication status information, confirms the described information (for example, what kind of user it is), and determines whether the service can be provided.
If the service providing apparatus 140 is not the authentication status information itself but the reference information (SAML artifact or the like), the service providing apparatus 140 may inquire the authentication server apparatus 130 about the authentication status information. The service providing apparatus 140 may inquire the authentication server apparatus 130 about the single sign-on session state associated with the authentication state information.

(6) If it is determined that the service can be provided, the service is provided to the second client device 120 (2) (step S26). If it is determined that service provision is rejected, the service request is discarded.

  As described above, single sign-on can be realized using the portable medium 110. That is, it is not necessary to perform the initial authentication process on a different device (client device 120) each time, and single sign-on can be performed on a different device.

  As a result, it is possible to implement a strong user authentication function only in a specific device (first client device 110 (1)) to perform initial authentication, while other devices can make initial authentication unnecessary. For example, a biometric device (for example, a biological scanner) is connected only to a specific device to perform initial authentication, and post-authentication can be performed by another device (for example, an information appliance) that is relatively simple.

  By encrypting the authentication status information, the client device 110 can execute single sign-on without exposing the authentication status information that is the basis to the outside.

(Second Embodiment)
The second embodiment of the present invention will be described below.
In this embodiment, by providing sub-authentication status information based on the authentication status information to the client device 120, unauthorized use of the authentication status information is prevented.

FIG. 7 is a block diagram showing the internal configuration of the portable medium 210 according to this embodiment.
The portable medium 210 is a component of the portable medium 110 (the communication unit 111, the communication peer authentication unit 112, the authentication status information storage unit 113, the information providing unit 114, and the information storage unit 115) and the issue determination unit 216. , A sub-authentication status information issuing unit 217 is added.
The issue determination unit 216 determines whether or not the sub authentication status information can be issued.
The sub authentication status information issuing unit 217 issues the sub authentication status information according to the issue policy.

The relationship between authentication status information and sub-authentication status information will be described below.
For example, SAML V2.0 is used to generate an assertion (subsequent assertion, hereinafter referred to as a successor assertion) from a certain authentication assertion (original assertion, hereinafter referred to as a basic assertion). Basic assertion and successor assertion correspond to authentication status information and sub-authentication status information, respectively.

  A successor assertion is an assertion issued based on the validity of the basic assertion. For example, the relationship is like a root certificate of a public key certificate and individual public key certificates issued by the root certificate. What is important at this time is that the root certificate, which is a higher-level certificate, proves (guarantees) an individual public-key certificate positioned below it. In addition, you may restrict | limit the object (for example, specific client apparatus 120) which issues a succession assertion.

FIG. 8 is a diagram illustrating a representation example of basic assertion constraint information.
The restriction information restricts the behavior of the second client device 120 (2). Here, as an example of constraint information, the <ProxyRestriction> element in the <Condition> element is cited as part of the SAML assertion in SAML V2.0.

The <ProxyRestriction> element is an element for restricting whether successor assertions can be generated.
Here, "1" is set as the value of the Count attribute of the <ProxyRestriction> element. This indicates that only one stage of successor assertion can be generated based on the basic assertion, and it is prohibited to generate further successor assertions from the succeeding assertions. This value may be a set value (that is, “1” or more) that can generate a succeeding assertion.

An <Audience> element can be included in the <ProxyRestriction> element as an element for designating an entity that can generate a successor assertion.
The value of the <Audience> element generally uses URI notation, but “CLIENT2” (in italic notation in the figure) is used as the client name here to simplify the explanation. The client name “CLIENT2” is identification information that can uniquely identify the second client device 120 (2).

  It is desirable that the client name “CLIENT2” matches the identification information for identifying the client device 120 used by the mechanism (service providing device 140) that performs the post-authentication. For example, if TLS (Transport Layer Security) or the like is used to authenticate the second client device 120 (2), the client name “CLIENT2” is described in the X.509 public key certificate for post-authentication. It should match the subject name. Further, if the SAML authentication assertion is used to authenticate the second client device 120 (2), the identification information indicated by the <Subject> element and the client that will be included in the authentication statement in the authentication assertion. The name “CLIENT2” should match.

  When allowing a client device other than the second client device 120 (2) to behave in the same manner as the second client device 120 (2), an <Audience> element corresponding to the client device may be added.

  In the <Subject> element, identification information for identifying the user is described. Here, “USER” is used as identification information.

The authority of the succeeding assertion basically inherits the authority of the basic assertion, but elements and attributes that are assumed to be used for controlling the use of each succeeding assertion may be added.
FIG. 9 is a diagram illustrating a partial expression example of the successor assertion.
In the succeeding assertion, the constraint condition can be expressed by the <Condition> element and the like, as in the basic assertion described above. For example, it is possible to add a condition indicating the valid start time (NotBefore attribute) and the valid period (NotOnOrAfter attribute) of the assertion itself.
However, for these attributes, values within the range of the conditions of the basic assertion are set.

In addition, the <AudienceRistriction> element can indicate the restriction conditions of parties that can use assertions. In the present embodiment, the identification information of the service providing device 140 is specified by the <Audience> element of the <AudienceRistriction> element (in this figure, the URL notation “” is used). Thereby, it is possible to restrict the service providing apparatus 140 that can consume the successor assertion.
These pieces of information may be added if necessary, and may be selectively used according to restrictions such as information exchange processing performance in implementation.

In the <Subject> element indicating the issuer of the successor assertion, the same subject name “USER” as the basic assertion is described in order to identify the user.
Reference information to the assertion as evidence is described as an <Advice> element. The <AssertionIDRef> element in the <Advice> element includes the assertion ID of the basic assertion (in this figure, italicized as “original assertion ID”). A basic assertion is identified by an <AssertionURIRef> element for a URI reference, an <Assertion> element for an assertion itself, and an <EncryptedAssertion> for an encrypted assertion. This associates the basic assertion with the successor assertion. It is also possible to associate the basic assertion with the succeeding assertion by appropriately using other elements.

The issued authority (authentication server device 130) is inquired about information for referring to the basic assertion described in the succeeding assertion or information for referring to the basic assertion itself. As a result, it is possible to confirm the validity of the succeeding assertion (sub-authentication status information) without disclosing the basic assertion (authentication status information).
The elements and attributes shown in FIGS. 8 and 9 are omitted from the prefix and the like.

  In this embodiment, the SAML assertion will be described as an example. However, the sub-authentication state information may be an information structure that satisfies the same requirements. For example, an attribute certificate (An Internet Attribute Certificate Profile for Authorization: RFC3281) based on X.509 may be used. The attribute certificate is an information structure for proving the attribute of a specific subject issued based on the public key certificate. In this case, the authentication status information is an X.509 public key certificate.

(Operation of the single sign-on system 200)
An operation procedure of the single sign-on system 200 will be described.
The operation of the single sign-on system 200 is divided into an initial authentication phase and a post-authentication phase, as in the single sign-on system 100.
The initial authentication phase in the single sign-on system 200 is almost the same as that in the single sign-on system 100. That is, the authentication status information issued by the authentication server device 130 is stored in the portable medium 210. Therefore, the post-authentication phase will be explained.
FIG. 10 is a flowchart showing an example of an operation procedure in the post-authentication phase of the single sign-on system 200.

(1) The second client device 120 (2) requests the service providing device 140 to provide a service (step S31).
(2) The service providing device 140 requests the second client device 120 (2) to acquire the sub-authentication status information (that is, perform the authentication process) (step S32).

(3) In response to a request from the second client device 120 (2), the portable medium 210 provides sub-authentication status information (step S33).
1) The second client device 120 (2) requests the portable medium 110 to acquire sub authentication status information.
2) The portable medium 210 determines whether to issue the sub authentication status information. If the issue is permitted, the sub-authentication status information is issued from the authentication status information held in the portable medium 210 based on the issue policy held inside. At this time, the constraint conditions as described above may be provided.

(4) The second client device 120 (2) submits the sub-authentication status information acquired from the portable medium 210 to the service providing device 140 (step S34).
(5) The service providing apparatus 140 confirms the submitted sub authentication status information (step S35).
At this time, authentication status information is not output from the portable medium 210. Therefore, based on the reference information (for example, an assertion ID reference element or an assertion URI reference element as defined in SAML) described in the sub-authentication state information, the authentication server apparatus 130 that is an issuer. Contact When it is determined that the authentication status information is valid and the description content and the signature part are valid, the sub-authentication status information can be validated.

(6) If it is determined that the service can be provided, the service is provided to the second client device 120 (2) (step S36). If it is determined that service provision is rejected, the service request is discarded.

(Third embodiment)
Hereinafter, the single sign-on system 300 according to the third embodiment will be described. In the present embodiment, it is considered that the portable medium 310 is directly connected to the authentication server device 130.
When the portable medium 110 has a general network connection function (for example, an Internet connection function) like a mobile phone, the portable medium 310 can be directly connected to the authentication server device 130. That is, the portable medium 110 can acquire the authentication status information without going through the client device 120.

(Operation of the single sign-on system 300)
Hereinafter, an operation procedure of the single sign-on system 300 will be described.
In the single sign-on system 300, the portable medium 310 is directly connected to the authentication server apparatus 130 and the service providing apparatus 140, and communication between the portable medium 310 and the client apparatus 120 is not performed.

For example, consider the operation of FIG. 5 described in the first embodiment. Steps S11 to S16 include the operation of the first client device 120 (1). In the present embodiment, the operation in the first client device 120 (1) in FIG.
Similarly, the operation procedure of FIG. 6 is executed by the portable medium 310 instead of the first client device 120 (1).

(Other embodiments)
Embodiments of the present invention are not limited to the above-described embodiments, and can be expanded and modified. The expanded and modified embodiments are also included in the technical scope of the present invention.

It is a block diagram which shows the structural example of the single sign-on system which concerns on the 1st Embodiment of this invention. It is a block diagram showing an example of an internal structure of the authentication server apparatus which concerns on 1st Embodiment. It is a block diagram showing an example of an internal structure of the client apparatus which concerns on 1st Embodiment. It is a block diagram showing an example of the internal structure of the portable medium which concerns on 1st Embodiment. It is a flowchart showing an example of the operation | movement procedure in the initial authentication phase of the single sign-on system which concerns on 1st Embodiment. It is a flowchart showing an example of the operation | movement procedure in the post-authentication phase of the single sign-on system which concerns on 1st Embodiment. It is a block diagram showing the internal structure of the portable medium which concerns on 2nd Embodiment. It is a figure which shows the example of expression of the constraint information of a basic assertion. It is a figure which shows the example of a representation of a part of successor assertion. It is a flowchart showing an example of the operation | movement procedure in the post-authentication phase of the single sign-on system which concerns on 2nd Embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 ... Single sign-on system, 110 ... Portable medium, 111 ... Communication part, 112 ... Communication peer authentication part, 113 ... Authentication status information storage part, 114 ... Information provision part, 115 ... Information storage part, 120 ... Client apparatus, 121a, 121b communication unit, 122 ... authentication status information receiving unit, 123 ... authentication status information acquisition unit, 124 ... authentication status information providing unit, 125 ... communication peer authentication unit, 126 ... authentication client unit, 127 ... information storage unit, 128 ... Control unit, 129 ... User interface unit, 130 ... Authentication server device, 131 ... Communication unit, 132 ... Portable medium authentication unit, 133 ... Authentication status information issue unit, 134 ... Authentication status information transmission unit, 135 ... Authentication status information Management unit, 136 ... information storage unit, 140 ... service providing device, 200 ... single sign-on system, 210 ... portable media 216 ... issue determining unit, 217 ... sub-authentication state information issuing unit

Claims (5)

Comprising first and second client devices and an authentication server device;
The first client device is
A reading unit for reading identification information for identifying the portable medium from the portable medium;
A transmission unit for transmitting the read identification information to the authentication server device;
A receiving unit for receiving authentication status information from the authentication server device;
A writing unit for writing the received authentication status information to the portable medium,
The second client device is
A reading unit for reading authentication status information from a portable medium;
A transmission unit for transmitting the read authentication status information,
The authentication server device is
A first receiver for receiving identification information transmitted from the first client device;
An issuing unit for issuing authentication status information based on the received identification information;
A storage unit for storing the issued authentication status information;
A transmission unit for transmitting the issued authentication status information to the first client device;
A second receiver for receiving authentication status information transmitted from the second client device;
An authentication system, comprising: an authentication unit that executes an authentication process based on the received authentication status information and the stored authentication status information. The authentication server device is
An encryption unit that encrypts the issued authentication status information to generate encrypted authentication status information;
A decryption unit for decrypting the encrypted authentication status information and generating the authentication status information,
The transmitting unit transmits the generated encrypted authentication status information to the first client device;
The second receiving unit receives the encrypted authentication status information transmitted from the second client device;
The authentication system according to claim 1, wherein the authentication unit executes an authentication process based on authentication state information generated from the received encrypted authentication state information and the stored authentication state information. . The portable medium is
A storage unit for storing authentication status information issued by the authentication server device;
An issuing unit for issuing sub-authentication status information for delegating authority based on the stored authentication status information;
A providing unit for providing the issued sub-authentication status information in response to a request from the second client device;
A transmission unit of the second client device transmits the provided sub-authentication status information;
A second receiving unit of the authentication server device receives the sub-authentication state information;
An authentication unit of the authentication server device executes an authentication process based on the received sub-authentication state information and the stored authentication state information;
The authentication system according to claim 1. The issued authentication status information includes information for identifying the second client device as a provision target of sub-authentication status information;
The authentication system according to claim 3. An authentication method using a first and second client device and an authentication server device,
The first client device reading identification information identifying the portable medium from the portable medium;
The first client device transmitting the read identification information to the authentication server device;
The authentication server device receiving identification information transmitted from the first client device;
The authentication server device issuing authentication status information based on the received identification information;
The authentication server device storing the issued authentication status information;
The authentication server device transmitting the issued authentication status information to the first client device;
The first client device receiving authentication status information transmitted from the authentication server device;
The first client device writing the received authentication status information to a portable medium;
The second client device reads authentication status information from the portable medium;
The second client device transmitting the read authentication status information;
The authentication server device receiving authentication status information;
The authentication server device executing an authentication process based on the received authentication status information and the stored authentication status information;
An authentication system comprising:

Images