JP2011018278A - Authentication apparatus, authentication method, authentication program, and authentication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce areas for storing authentication information and to improve the performance of the whole authentication system.SOLUTION: An authentication server receives an authentication request including an authentication identifier from a user authentication terminal apparatus, and when authentication processing in its own apparatus can not be performed only by the authentication identifier, acquires another authentication identifier from another authentication server. The authentication server performs authentication processing by using the authentication identifier received from the user authentication terminal apparatus and the new authentication identifier using the other authentication identifier received from the other authentication server. When receiving authentication permissions from all authentication servers having transmitted authentication requests, the user authentication terminal apparatus permits the authentication of the user terminal.

Description

  The present invention relates to a user authentication termination device that receives an authentication request from a user terminal, an authentication device that performs user authentication processing in response to an authentication request from the user authentication termination device, an authentication method, an authentication program, and an authentication system.

  Conventionally, a RADIUS (Remote Authentication Dial-In User Service) protocol has been used as an authentication method for authenticating a user dialed up to an access server through a telephone line and transmitting an IP (Internet Protocol) address to be assigned to the server. Yes. As a method of processing the RADIUS protocol with high throughput, a cache technology that performs data access on the WWW (World Wide Web) at high speed and with high throughput can be used.

  First, the WWW cache technology will be described with reference to FIG. As shown in FIG. 31, in this system, a WWW cache server corresponding to the number is connected to a user terminal between the WWW server and the user terminal. In the case of FIG. 31, a WWW cache server 103 is arranged for the user terminal 100, and a WWW cache server 104 is arranged for the user terminal 101 and the user terminal 102. The WWW cache server 103 duplicates and stores data on the WWW server 105 once accessed by the user terminal 100. In this way, when the user terminal 100 accesses the same data again, the WWW cache server 103 can directly transmit the accessed data to the user terminal 100 instead of the WWW server 105. . As a result, the user terminal 100 can obtain data at high speed and high throughput.

  Similarly, the WWW cache server 104 duplicates and stores data on the WWW server 105 once accessed by the user terminal 101 or the user terminal 102. In this way, when the user terminal 101 or the user terminal 102 accesses the same data again, the data that has been accessed by the WWW cache server 104 instead of the WWW server 105 is used as the user terminal 101 or the user terminal. 102 can be sent directly. As a result, the user terminal 101 or the user terminal 102 can obtain data at high speed and high throughput.

  Next, an example in which the above-described cache technology is applied to an authentication technology will be described with reference to FIG. As shown in FIG. 32, in this authentication system, a user authentication termination device 107 is connected between a user terminal 106 and an authentication server, and the authentication server includes one or more authentication information cache servers 108 and authentication information. The database server 109 is configured. Here, the authentication information cache server 108 corresponds to the WWW cache server of FIG. 31, and the authentication information database server 109 corresponds to the WWW server. The authentication information cache server 108 stores the authentication information accessed once by the user terminal 106 among the authentication information stored in the authentication information database server 109. The authentication information cache server 108 is held on a storage medium that can be accessed at high speed such as a memory.

  In such a configuration, when the user terminal 106 requests authentication from the user authentication termination device 107, the user authentication termination device 107 transmits an authentication request to the authentication server. Then, the authentication information cache server 108 of the authentication server receives this authentication request, and transmits the result of authentication by the own device to the user authentication termination device 107 when the authentication processing can be performed by the own device. On the other hand, the authentication information cache server 108 of the authentication server transmits an authentication information acquisition request to the authentication information database server 109 when the authentication process cannot be performed by itself, and the authentication information database server 109 authenticates the authentication information. The authentication information cache server 108 transmits the result of authentication using the acquired authentication information to the user authentication termination device 107. Thereafter, the user authentication termination device 107 transmits a response corresponding to the authentication result received from the authentication server to the user terminal 106. In this way, authentication processing can be performed at high speed and with high throughput.

Recently, as a stronger authentication technique, as shown in FIG. 33, N authentication servers with different authentication identifier types _Im are prepared, and only when authentication is permitted by all authentication servers, the user terminal A technique to allow authentication of the above has been implemented. Here, the authentication identifier type I _m illustrated, for example, ID of the authentication by the user ID and password, the user X. The authentication type such as the subject name in the authentication by the 509 certificate, the line number in the authentication of the line to which the user is connected, the contract number in the authentication of the contract, and a part of the user name in the authentication of a subset of the user name such as the domain name An identifier to identify. The authentication identifier type I _m is associated with one or more authentication identifier indicating information used for authentication. For example, in the case of the authentication identifier type _{I m} is, user ID, the authentication identifier, such as "taro" and "hanako", authentication identifier type _{I m} is, in the case of the Subject name, the authentication identifier, "CN = taro, O = kaisha, C = JP "and" CN = hanako, O = kaisha, C = JP ", etc., authentication identifier type _{I m} is, in the case of a line number, the authentication identifier," CHANNEL-0001 "and" CHANNEL- 0021 ", etc., authentication identifier type _{I m} is, in the case of the contract number, the authentication identifier, such as" C010-220-10 "and" C010-222-20 ", authentication identifier type _{I m} is, part of the user name In this case, “domain001.jp” or “domain002.jp” is used as the authentication identifier.

“Remote Authentication Dial In User Service (RADIUS)”, C. Rigney, S. Willens, A. Rubens, W. Simpson, RFC 2865, [online], [Search May 14, 2009], Internet <http: / /www.ietf.org/rfc/rfc2865.txt?number=2865>, IETF, 2000 “RADIUS Accounting”, C.Rigney, RFC2866, [online], [searched on May 14, 2009], Internet <http://www.ietf.org/rfc/rfc2866.txt?number=2866>, IETF , 2000 “RADIUS Accounting Modifications for Tunnel Protocol Support”, G.Zorn, B.Aboba, D.Mitton, RFC2867, [online], [Search May 14, 2009], Internet <http://www.ietf.org /rfc/rfc2867.txt?number=2867>, IETF, 2000 “RADIUS Attributes for Tunnel Protocol Support”, G.Zorn, D.Leifer, A.Rubens, J.Shriver, M.Holdrege, I.Goyret, RFC2868, [online], [May 14, 2009 search], Internet <http://www.ietf.org/rfc/rfc2868.txt?number=2868>, IETF, 2000 "RADIUS Extensions", C.Rigney, W.Willats, R.Calhoun, RFC2869, [online], [Search May 14, 2009], Internet <http://www.ietf.org/rfc/rfc2869. txt? number = 2869>, IETF, 2000 “RADIUS and IPv6”, B.Aboba, G.Zorn, D.Mitton, RFC3162, [online], [Search May 14, 2009], Internet <http://www.ietf.org/rfc/rfc3162 .txt? number = 3162>, IETF, 2000 "Diameter Base Protocol", P.Calhoun, J.Loughney, E, Guttman, G.Zorn, J.Arkko, RFC3588, [online], [May 14, 2009 search], Internet <http: // www .ietf.org / rfc / rfc3588.txt? number = 3588>, IETF, 2000 "Distributed System Principle and Paradigm", by Andrew S. Tanenbaum and Maarten van Stein, Tadanori Mizuno, Taro Andyo, Kenji Suzuki, Satoshi Nishiyama, Fumiaki Sato, Teruo Higashino, Pearson Education, Inc., 2003 “BUILDING SECURE AND RELIABLE NETWORK APPLICATIONS” by Kenneth P. Birman, Manning, 1996

  However, there is a problem that an area for storing authentication information increases and a problem that authentication performance deteriorates.

Specifically, the authentication server 1 authenticates the authentication identifier type I _1, the authentication server 2 authenticates the authentication identifier type I _2, authentication identifier of the authentication identifier authentication identifier authentication identifier of the type I ₂ type I ₁ If it is partially determined by the authentication identifier group to which the ID belongs, it is necessary to hold a table relating to the authentication identifier type I ₁ in both authentication servers and perform a search process.

  For example, the authentication server 1 is a server that performs authentication based on a contract number, and holds it as an authentication information table that stores “C001, P001” as “contract number, password”. Further, the authentication server 2 is a server that performs authentication using a user ID, and stores a table storing “U001G001, 001P” as “user ID, password” and “C001, G001” as “contract number, group”. An authentication information table composed of a table is held and stored.

  In this case, the authentication server 1 performs authentication based on the contract depending on whether or not the authentication information matching “contract number = C001, password = P001” included in the authentication request received from the user authentication termination device is held. Further, the authentication server 2 cannot perform the authentication process only by “user ID = U001, password = 001P” included in the authentication request received from the user authentication termination device. Therefore, the authentication server 2 further receives “contract number = C001” and first specifies “group = G001” corresponding to “contract number = C001”. Thereafter, the authentication server 2 generates “U001G001” as a search key that combines the received “user ID = U001” and the identified “group = G001”. Then, the authentication server 2 determines whether the “password = 001P” stored in the authentication information table and associated with the generated “U001G001” matches the received “password = 001P”. Authenticate.

  As described above, it is necessary to hold a table having “contract number = C001” as a search key in both the authentication server 1 and the authentication server 2 that authenticate different authentication identifiers, and store authentication information as the entire authentication system. It takes a lot of area to do. In addition, when the above-described information having “contract number = C001” as a key is not stored in the authentication information cache server, the authentication information database server performs low-speed authentication processing on both the authentication server 1 and the authentication server 2. The As a result, the frequency of disk access due to database search increases, making it difficult to perform authentication processing at high speed and with high throughput, resulting in degradation of authentication performance.

  The present invention has been made in view of the above, and it is possible to reduce an area for storing authentication information and improve the performance of the entire authentication system, an authentication method, an authentication program, and an authentication system. The purpose is to provide.

  In order to solve the above-described problems and achieve the object, the present invention is an authentication device that performs user authentication processing in response to an authentication request received from a user authentication termination device that receives an authentication request from a user terminal. An authentication identifier for identifying attribute information used for authentication by the authentication device; authentication information holding means for holding authentication information in association with the attribute information; and one of authentication identifiers used by other authentication devices for user authentication processing. When the authentication request is received from the user authentication terminator, the specific information holding unit that associates and holds the other authentication identifier that is a unit and the specific information that specifies the other authentication identifier, An authentication identifier is acquired, user authentication processing is performed using attribute information stored in the authentication information holding unit in association with the acquired authentication identifier, and an authentication result is acquired by the user authentication. Authentication means for transmitting to the terminal device; and identifier transmitting means for acquiring another authentication identifier corresponding to the specific information specified according to a predetermined condition from the authentication information holding means and transmitting to the other authentication device; It is characterized by having.

  The present invention also provides an authentication apparatus that performs user authentication processing in response to an authentication request received from a user authentication termination apparatus that receives an authentication request from a user terminal, and specifies attribute information used by the authentication apparatus for authentication Authentication information holding means for holding authentication information in which the authentication identifier is associated with the attribute information, and a first identifier indicating a part of the authentication identifier when an authentication request is received from the user authentication termination device And the specific information for specifying the second identifier indicating a part of the authentication identifier from the authentication request, and the second identifier is acquired from another authentication device specified by the device information held in advance. The authentication in association with a new authentication identifier using an identifier acquisition means, a second identifier acquired by the identifier acquisition means, and a first identifier acquired from the authentication request It performs user authentication processing by using the attribute information stored in the broadcast holding means, and having an authentication unit that transmits the authentication result to the user authentication terminating device.

  The authentication device, the authentication method, the authentication program, and the authentication system according to the present invention have an effect of reducing the area for storing authentication information and improving the performance of the entire authentication system.

FIG. 1 is a diagram illustrating the overall configuration of the authentication system according to the first embodiment. FIG. 2 is a block diagram showing the configuration of the user authentication termination device 10. FIG. 3A is a diagram illustrating an example of information stored in the user information DB 12a. FIG. 3-2 is a diagram illustrating an example of information stored in the user information DB 12a. FIG. 4 is a diagram illustrating an example of information stored in the authentication order DB 12b. FIG. 5 is a diagram illustrating an example of information stored in the authentication device type information DB 12c. FIG. 6 is a block diagram showing the configuration of the authentication information cache server A20 of the authentication server A. FIG. 7 is a diagram illustrating an example of information stored in the cache 22a. FIG. 8 is a diagram illustrating an example of information stored in the authentication device type information DB 22b. FIG. 9 is a block diagram showing the configuration of the authentication information database server A30 of the authentication server A. FIG. 10 is a diagram illustrating an example of information stored in the authentication information DB 32a. FIG. 11 is a block diagram showing the configuration of the authentication information cache server B 40 of the authentication server B. FIG. 12 is a diagram illustrating an example of information stored in the cache 42a. FIG. 13 is a diagram illustrating an example of information stored in the authentication device type information DB 42b. FIG. 14 is a block diagram showing a configuration of the authentication information database server B50 of the authentication server B. FIG. 15 is a diagram illustrating an example of information stored in the authentication information DB 52a. FIG. 16 is a flowchart showing the flow of processing in the user authentication termination apparatus 10. FIG. 17 is a flowchart showing the flow of processing in the authentication information cache server A20. FIG. 18 is a flowchart showing the flow of the second identifier search process in the authentication information cache server A20. FIG. 19 is a flowchart showing the flow of processing in the authentication information database server A30. FIG. 20 is a flowchart showing the flow of processing in the authentication information cache server B40. FIG. 21 is a flowchart showing the flow of processing in the authentication information database server B50. FIG. 22 is a diagram illustrating the overall configuration of the authentication system according to the second embodiment. FIG. 23 is a diagram illustrating the overall configuration of the authentication system according to the third embodiment. FIG. 24 is a diagram illustrating the overall configuration of the authentication system according to the fourth embodiment. FIG. 25 is a flowchart illustrating a flow of processing in the authentication information cache server j which is the basic authentication device according to the fourth embodiment. FIG. 26 is a flowchart illustrating a process flow in the authentication information cache server k which is the associative authentication apparatus according to the fourth embodiment. FIG. 27 is a diagram illustrating the overall configuration of the authentication system according to the fifth embodiment. FIG. 28 is a diagram illustrating the overall configuration of the authentication system according to the sixth embodiment. FIG. 29 is a flowchart illustrating the flow of processing in the user authentication termination apparatus according to the sixth embodiment. FIG. 30 is a flowchart illustrating a process flow in the authentication information cache server of the authentication server 2 according to the sixth embodiment. FIG. 31 is a diagram for explaining the WWW cache technology. FIG. 32 is a diagram showing a conventional authentication method using the WWW cache technology. FIG. 33 is a diagram showing a conventional technique that enables authentication with a plurality of authentication identifiers using the WWW cache technology.

  Embodiments of an authentication method and an authentication system according to the present invention will be described below in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

[overall structure]
FIG. 1 is a diagram illustrating the overall configuration of the authentication system according to the first embodiment. As shown in FIG. 1, in the authentication system, a user terminal, a user authentication termination device, an authentication server A, and an authentication server B are connected via a network. The number of devices is not limited to this.

  The user terminal is a terminal device that can use various services via the Internet or the like when an authentication request is transmitted to the user authentication termination device and authentication is permitted.

  When receiving the authentication request from the user terminal, the user authentication termination device transmits an authentication request for the user terminal to the authentication server A and the authentication server B, and only when the authentication permission is received from both authentication servers. The terminal authenticates that it is a legitimate user. This user authentication termination device stores the order in which authentication requests are transmitted to the authentication server. “Authentication identifier and attribute information” used for authentication by the authentication server A and the authentication server B include those sent from the user terminal and those stored in the user authentication termination device. The user authentication terminator includes “authentication identifier and attribute information” sent from these users and “authentication identifier and attribute information” stored in the user authentication terminator. ”Is stored to which authentication server.

  In addition, the user authentication termination device is a basic authentication device that can perform authentication processing using information in the device itself, or performs authentication processing using information of another device. Information indicating whether it is an associative authentication device is stored.

  The authentication server A or the authentication server B stores “authentication identifier and attribute information”, and performs user authentication using the authentication identifier and attribute information included in the authentication request received from the user authentication termination device. The authentication server A or the authentication server B is a server that performs different types of authentication. For example, the authentication server A authenticates with a contract number and the authentication server B authenticates with a user ID.

  Further, the authentication server A has an authentication information cache server A and an authentication information database server A. The authentication information database server A has a large-capacity storage unit and holds authentication information associated with “authentication identifier, attribute information” in the storage unit. The authentication information cache server A can perform high-speed access, and holds authentication information used in the past among the authentication information held in the database server A of the authentication apparatus.

  In this state, the user authentication termination device that has received the authentication request from the user terminal determines the order in which the user terminal authentication request is transmitted according to a predetermined condition. Subsequently, the user authentication termination device is a basic authentication device that allows the authentication server to be transmitted to perform authentication processing using information in the own device when transmitting authentication requests to the authentication device in the determined order. It is determined whether it is an associative authentication device that performs authentication processing using information of another device.

  For example, the user authentication termination device determines to transmit authentication requests in the order of authentication server A and authentication server B. The user authentication termination device determines that the authentication server A is a basic authentication device and the authentication server B is an associative authentication device (see (1) in FIG. 1).

  Thereafter, the user authentication terminal device sends an authentication request including “authentication identifier A” and “attribute information A” for specifying authentication information used by the authentication server A, which is the basic authentication device, to the authentication information cache server A of the authentication server A. (See (2) in FIG. 1). Upon receiving this authentication request, the authentication information cache server A responds with an authentication result based on the received “authentication identifier A and attribute information A” (see (3) in FIG. 1).

  For example, when the received “authentication identifier A and attribute information A” is stored in the own apparatus, the authentication information cache server A responds with an authentication permission. Further, the authentication information cache server A is not stored in its own device, but when stored in the authentication information database server A, the “authentication identifier A and attribute information A” is obtained from the authentication information database server A. Acquire it and store it in its own device, and return authentication permission. Further, when the authentication information cache server A is not stored in its own device and is not stored in the authentication information database server A, the authentication information cache server A responds with an authentication rejection.

  Subsequently, the user authentication termination device that has received the authentication response from the authentication information cache server A sends an authentication identifier “authentication identifier” used by the authentication server B for authentication to the authentication server B (associative authentication device) that is the next authentication destination. A first identifier “authentication identifier B” indicating a part of “G”; and specific information “authentication identifier A” for specifying a second identifier “authentication identifier group” indicating a part of the authentication identifier “authentication identifier G”; (See (4) of FIG. 1). At this time, the user authentication termination device also transmits “attribute information G” of the authentication identifier “authentication identifier G” used by the authentication server B for authentication.

  In this way, the authentication information cache server B that has received the authentication request including the specific identifier “authentication identifier A” for specifying the first identifier “authentication identifier B” and the second identifier “authentication identifier group” An acquisition request for the second identifier “authentication identifier group” specified by the specific information “authentication identifier A” is transmitted to the authentication server A that is the association destination (see (5) in FIG. 1).

  Then, the authentication information cache server A that has received the acquisition request for the second identifier “authentication identifier group” uses the second identifier “authentication identifier group = G001” corresponding to the received specific information “authentication identifier A”. Acquired from the apparatus or the authentication information database server A and responds to the authentication information cache server B (see (6) in FIG. 1).

  Thereafter, the authentication information cache server B that has received the second identifier “authentication identifier group = G001” receives the received second identifier “authentication identifier group = G001” and the first identifier “authentication” previously received. The authentication server B generates an authentication identifier “authentication identifier G” used for authentication by combining the identifier B ”(see (7) in FIG. 1).

  Then, the authentication information cache server B responds with an authentication result based on the generated “authentication identifier G” and the received “attribute information G” (see (8) in FIG. 1).

  For example, if the received “attribute information G” is stored in the own device, the authentication information cache server B responds with an authentication permission. In addition, the authentication information cache server B is not stored in its own device, but when stored in the authentication information database server B, the “authentication identifier G and attribute information G” is obtained from the authentication information database server B. Acquire it and store it in its own device, and return authentication permission. Further, when the authentication information cache server B is not stored in its own apparatus and is not stored in the authentication information database server B, the authentication information cache server B responds with an authentication rejection.

  Then, the user authentication termination device permits the authentication of the user terminal when all the authentication results received from the authentication server A or the authentication server B to which the authentication request is transmitted are the authentication permission (see (9) in FIG. 1). ).

[Configuration of authentication system]
Next, the configuration of each device in the authentication system shown in FIG. 1 will be described. Here, each of the user authentication termination device 10, the authentication information cache server A20, the authentication information database server A30, the authentication information cache server B40, and the authentication information database server B50 will be described. The user terminals that can use the device configuration are omitted.

(Configuration of user authentication termination device)
First, the configuration of the user authentication termination device will be described with reference to FIG. FIG. 2 is a block diagram showing the configuration of the user authentication termination device 10. As illustrated in FIG. 2, the user authentication termination device 10 includes a communication control I / F unit 11, a storage unit 12, and a control unit 13.

  The communication control I / F unit 11 controls communication related to various information exchanged between the authentication server A, the authentication server B, and the user terminal. Specifically, the communication control I / F unit 11 receives an authentication request from the user terminal and returns an authentication result to the user terminal. The communication control I / F unit 11 transmits an authentication request to the authentication server A or the authentication server B, and receives an authentication response from the authentication server A or the authentication server B.

  The storage unit 12 stores data and programs necessary for various processes performed by the control unit 13, and particularly includes a user information DB 12a, an authentication order DB 12b, and an authentication device type information DB 12c. Various data and parameters can be arbitrarily changed.

  The user information DB 12a stores information related to users managed by the user authentication termination device 10. The information managed by the user information DB 12a is an authentication identifier of one or a plurality of authentication identifier types and information assigned thereto. For example, as shown in FIG. 3A, the user information DB 12a stores “001, CHANNEL-0021, P001” and the like as “port number, line number, line number password”. Also, as shown in FIG. 3B, “002, AREA-020, P003” and the like are stored as “port number, accommodation area number, accommodation area information password”. In this example, the user information DB 12a is illustrated as a case where information is held in a plurality of tables as shown in FIGS. 3A and 3B. However, the user information DB 12a is not limited to this. A plurality of information may be held. 3A and 3B are diagrams illustrating examples of information stored in the user information DB 12a.

  The “port number” exemplified here is an identifier for uniquely identifying the port to which the user terminal is connected, and can be specified when various types of information are received from the user terminal. The “line number” is information for uniquely identifying the line connecting the user authentication termination device 10 and the user terminal, and the “line number password” is “line number” for authenticating that the “line number” is correct. Is the information assigned to "." The “accommodation area number” is information that uniquely identifies the physical location classification of the end point on the side opposite to the user authentication termination device of the line connecting the user terminal, for example, a number representing a municipality or a prefecture . The “accommodation area number password” is information assigned to the “accommodation area number” in order to authenticate that the “accommodation area number” is correct.

  The authentication order DB 12b stores the order in which authentication requests are transmitted. For example, as shown in FIG. 4, the authentication order DB 12b has “1, authentication server A, 10.1.1.1” or “2, authentication server B, 192.168.” As “order, server name, IP address”. .. 1.1 "or the like is stored. FIG. 4 is a diagram illustrating an example of information stored in the authentication order DB 12b.

  The “order” exemplified here is information indicating the transmission order of authentication requests, and is determined according to a predetermined condition, for example, transmitting an authentication request to the basic authentication type device earlier than the associative type authentication device. The “Server name” is information indicating the name (host name or the like) of the authentication server that is the destination of the authentication request, and “IP address” is the IP address of the authentication information cache server that is the destination of the authentication request. Information.

  The authentication device type information DB 12c is a basic authentication device in which each authentication server that is a transmission destination of an authentication request can perform an authentication process using information in the own device, or an authentication process using information of another device The information which shows whether it is an associative authentication apparatus which implements is stored. For example, as shown in FIG. 5, the authentication device type information DB 12c includes “authentication server A, basic type” as “server name, authentication type, authentication information management source, authentication identifier, attribute information, specific information management source, specific information”. , User terminal, user ID, password,-,-". In this case, the authentication server A is a basic authentication device, indicating that the user ID and password transmitted from the user terminal are transmitted from the user authentication termination device 10 to the authentication server A. Also, “server name, authentication type, authentication information management source, authentication identifier, attribute information, specific information management source, specific information” as “authentication server B, associative type, user authentication terminator, line number + group ID, line number” Password, user terminal, user ID "and the like. In this case, the authentication server B is an associative authentication device, and the line number managed by the user authentication termination device 10, the password for the line number, and the user ID transmitted from the user terminal are transmitted from the user authentication termination device 10 to the authentication server B. Represents what to do. Further, as shown in FIG. 5, the authentication device type information DB 12c includes “authentication server C, basic type” as “server name, authentication type, authentication information management source, authentication identifier, attribute information, specific information management source, specific information”. , User authentication termination device, accommodation area number, accommodation area number password,-,-". In this case, the authentication server C is a basic authentication device, and represents that the accommodation area number and the accommodation area number password managed by the user authentication termination apparatus 10 are transmitted from the user authentication termination apparatus 10 to the authentication server C. . FIG. 5 is a diagram illustrating an example of information stored in the authentication device type information DB 12c.

  The “server name” exemplified here is information indicating the name (host name or the like) of the authentication server that is the transmission destination of the authentication request. “Authentication type” is information indicating whether the authentication server is a basic authentication device or an associative authentication device. In the case of a basic authentication device, “basic type” is stored. In the case of an associative authentication device, “associative type” is stored. Is done. “Authentication information management source” indicates whether “authentication identifier” and “attribute information” are managed by “user terminal” or “user authentication termination device”. “Authentication identifier” is information indicating a search key for searching for authentication information when the authentication server performs authentication processing, and “attribute information” is authentication information used by the authentication server for authentication processing. “Specific information management source” indicates whether “user terminal” or “user authentication termination device” manages “specific information”. The “specific information” is information for specifying a part of an authentication identifier used for authentication by the authentication server, which is an associative authentication device, from the authentication server at the association destination.

  The control unit 13 includes an internal memory for storing a control program such as an OS (Operating System), a program defining various processing procedures, and necessary data. The control unit 13 includes an order determination unit 13a, a device type determination unit 13b, a basic authentication request unit 13c, an associative authentication request unit 13d, and an authentication result transmission unit 13e. Execute.

  When receiving the authentication request from the user terminal, the order determining unit 13a determines the order of transmitting the user terminal authentication request according to a predetermined condition. Specifically, the order determination unit 13a refers to the authentication order DB 12b when receiving an authentication request from the user terminal. Then, the order determination unit 13a determines the authentication server A as the order 1, the authentication server B as the order 2, and outputs the determined information to the device type determination unit 13b.

  Further, when receiving the authentication request from the user terminal, the order determining unit 13a can identify the port number that has received the authentication request, and can identify the user terminal that has transmitted the authentication request from the identified port.

  When the device type determination unit 13b transmits authentication requests to the authentication device in the order determined by the order determination unit 13a, the authentication device that is the transmission target can perform authentication processing using information in the device itself. It is determined whether the device is an authentication device or an associative authentication device that performs authentication processing using information of another device. Here, an example of determining whether the authentication server to be transmitted is a basic authentication device or an associative authentication device when transmitting an authentication request to the authentication device has been described, but is not limited thereto. The determination timing can be arbitrarily set.

  More specifically, in the above example, the device type determination unit 13b refers to the authentication device type information DB 12c for “authentication server A” determined to be in order 1, and determines whether the authentication server A is a basic authentication device or associative authentication. Determine whether the device. In this example, the device type determination unit 13b determines that “authentication server A” is a basic authentication device, and outputs the determination result to the basic authentication request unit 13c.

  Then, upon receiving an authentication response from “authentication server A” determined to be in order 1, device type determination unit 13b refers to authentication device type information DB 12c for “authentication server B” determined to be in order 2, and It is determined whether the authentication server B is a basic authentication device or an associative authentication device. In this example, the device type determination unit 13b determines that “authentication server B” is an associative authentication device, and outputs the determination result to the associative authentication request unit 13d.

  The basic authentication request unit 13c transmits an authentication request including an authentication identifier for specifying authentication information used for authentication by the authentication server to the authentication server determined to be a basic authentication device by the device type determination unit 13b. Specifically, in the above example, the basic authentication requesting unit 13c has “authentication identifier = user ID” and “attribute information = password” of the authentication server A determined by the device type determination unit 13b as a basic authentication device. And “authentication information management source = user terminal” are identified from the authentication device type information DB 12c. Subsequently, the basic authentication request unit 13 c acquires user-specific information “authentication identifier = user ID = U001” and “attribute information = password = P001” from the information received from the user terminal. Thereafter, the basic authentication request unit 13c identifies the IP address of the authentication server A determined to be in order 1 from the authentication order DB 12b, and uses the identified IP address, “authentication identifier = U001” and “attribute information = P001”. Is sent to the authentication server A.

  The associative authentication requesting unit 13d, with respect to the authentication server determined to be an associative authentication device by the device type determining unit 13b, a first identifier indicating a part of the authentication identifier used for authentication by the authentication server, An authentication request including specific information for specifying a second identifier indicating a part of the ID is transmitted. Specifically, in the above example, the associative authentication requesting unit 13d refers to the authentication device type information DB 12c, and the “authentication information management source” of the authentication server B determined as the associative authentication device by the device type determining unit 13b. "Is a" user authentication termination device ". Therefore, the associative authentication request unit 13d specifies the authentication identifier “line number + group ID” and attribute information “line number password” used by the authentication server B for authentication from the authentication apparatus type information DB 12c in its own apparatus. In this case, the associative authentication request unit 13d stores the line number of the identified authentication identifier “line number + group ID” in the user information DB 12a, so that the first identifier is “line number”, Let the second identifier be a “group ID”. Further, the associative authentication request unit 13d refers to the authentication device type information DB 12c, and since the “specific information management source” of the authentication server B is “user terminal”, the specific information specified as the second identifier “group ID” The “user ID” is specified from the information received from the user terminal.

  Then, the associative authentication requesting unit 13d acquires the first identifier “line number” and attribute information “line number password” from the user information DB 12a by using the port number specified by the order determining unit 13a as a key. Further, the associative authentication request unit 13d acquires the specific information “user ID of the authentication server A” from the information received from the user terminal. In this example, the associative authentication request unit 13d acquires the first identifier “line number = CHANNEL-0021”, attribute information “line number password = P001”, and specific information “user ID = U001”. Then, the associative authentication request unit 13d transmits an authentication request including the acquired information to the authentication server B.

  The authentication result transmission unit 13e permits the authentication of the user terminal when all the authentication results received from the authentication server to which the authentication request is transmitted by the basic authentication request unit 13c or the associative authentication request unit 13d are authentication permitted. Specifically, the authentication result transmission unit 13e permits authentication of the user terminal when all authentication results received from the authentication server A and the authentication server B to which the authentication request is transmitted are authentication permission. On the other hand, if any of the authentication results received from the authentication server A and the authentication server B is an authentication rejection, the authentication result transmission unit 13e rejects the authentication of the user terminal.

(Configuration of authentication information cache server A)
Next, the configuration of the authentication information cache server A of the authentication server A will be described with reference to FIG. That is, here, the configuration of an authentication information cache server that is a basic authentication device will be described. FIG. 6 is a block diagram showing the configuration of the authentication information cache server A20 of the authentication server A. As illustrated in FIG. 6, the authentication information cache server A20 includes a communication control I / F unit 21, a storage unit 22, and a control unit 23.

  The communication control I / F unit 21 controls communication related to various information exchanged with the authentication information database server A30, the authentication information cache server B40, and the user authentication termination device 10. Specifically, the communication control I / F unit 21 receives an authentication request from the user authentication termination device 10 and returns an authentication result to the user authentication termination device 10. Further, the communication control I / F unit 21 receives authentication information from the authentication information database server A30, receives an authentication identifier from the authentication information cache server B40, and transmits a group ID to which the received authentication identifier belongs.

  The storage unit 22 stores data and programs necessary for various processes by the control unit 23, and particularly includes a cache 22a and an authentication device type information DB 22b. Various data and parameters can be arbitrarily changed.

  The cache 22a is a high-speed accessible memory that holds authentication information used in the past among the authentication information held in the authentication information database server A30. For example, as shown in FIG. 7, the cache 22a stores “U001, P001, G001” and the like as “authentication identifier (user ID), attribute information (password), authentication identifier group (group ID)”. Although an example in which the attribute information and the authentication identifier group are stored in the same table is shown here, the present invention is not limited to this and may be managed in separate tables. Although the case where the specific information and the authentication identifier are the same is illustrated here, the present invention is not limited to this, and other information may be used as the specific information.

  The “authentication identifier (user ID)” exemplified here is information indicating a search key for searching attribute information, and the “attribute information (password)” is information used for authentication, and the “authentication identifier group (group ID)”. ")" Is information used for authentication by an associative authentication device having the authentication server A as an association destination, such as the authentication server B, for example. FIG. 7 is a diagram illustrating an example of information stored in the cache 22a.

  The authentication device type information DB 22b stores information indicating whether the own device is a basic authentication device or an associative authentication device. For example, as shown in FIG. 8, “authentication type” is “basic type”. Remember. FIG. 8 is a diagram illustrating an example of information stored in the authentication device type information DB 22b.

  The control unit 23 has an internal memory for storing a control program such as an OS (Operating System), a program defining various processing procedures, and required data. In addition, the control unit 23 includes a cache determination unit 23a, an identifier transmission unit 23b, and an authentication processing unit 23c, and executes various processes.

  The cache determination unit 23a acquires an authentication identifier from the authentication request received from the user authentication termination device 10, and searches for attribute information stored in the cache 22a in association with the acquired authentication identifier. Specifically, in the above example, when the cache determination unit 23a receives “authentication identifier” and “attribute information” as an authentication request from the user authentication termination device 10, the cache determination unit 23a refers to the authentication device type information DB 22b. , It identifies that its own device is a basic authentication device. Then, the cache determination unit 23 a acquires the authentication identifier “U001” and the attribute information “P001” from the authentication request received from the user authentication termination device 10. Then, the cache determination unit 23a determines whether or not “attribute information” corresponding to the authentication identifier “U001” acquired from the authentication request is stored in the cache 22a. Then, when stored in the cache 22a, the cache determination unit 23a acquires “attribute information” corresponding to the authentication identifier “U001”, and acquires the “attribute information” acquired from the cache 22a and the “attribute” acquired from the authentication request. "Information" is output to the authentication processing unit 23c.

  If not stored in the cache 22a, the cache determination unit 23a transmits an acquisition request for “authentication information (attribute information)” corresponding to the authentication identifier “U001” acquired from the authentication request to the authentication information database server A30. . After that, when receiving the “attribute information” corresponding to the authentication identifier “U001” from the authentication information database server A30, the cache determination unit 23a stores these in association with each other in the cache 22a and also stores them in the authentication processing unit 23c. Output. On the other hand, when the “attribute information” corresponding to the authentication identifier “U001” cannot be received from the authentication information database server A30, the cache determination unit 23a outputs “no authentication information” to the authentication processing unit 23c.

  The identifier transmission unit 23b acquires another authentication identifier corresponding to the specific information specified according to a predetermined condition from the cache 22a, and transmits it to another authentication device. Specifically, the identifier transmission unit 23b receives the second identifier acquisition request from the authentication information cache server B40 of the authentication server B, and the second identifier corresponding to the specific information included in the acquisition request is stored in the cache 22a. Is stored in the cache 22a, the second identifier is acquired from the cache 22a and transmitted to the authentication information cache server B40. Further, when the second identifier corresponding to the specific information is not held in the cache 22a, the identifier transmission unit 23b acquires the second identifier from the authentication information database server A30 and transmits it to the authentication information cache server B40. To do.

  Specifically, in the above example, when the identifier transmission unit 23b receives an acquisition request including the specific information “user ID = U001” from the authentication information cache server B40, the identifier transmission unit 23b sets the specific information “user ID = U001”. It is determined whether or not the corresponding “authentication identifier group” is stored in the cache 22a. Then, when “authentication identifier group = G001” corresponding to the specific information “user ID = U001” is stored in the cache 22a, the identifier transmission unit 23b sets “authentication identifier group = G001” to the authentication information cache server. Send to B40. On the other hand, when “authentication identifier group = G001” is not stored in the cache 22a, the identifier transmission unit 23b acquires “authentication identifier group = G001” from the authentication information database server A30 and sends it to the authentication information cache server B40. Send.

  The authentication processing unit 23c performs user authentication using the attribute information acquired by the cache determination unit 23a. Specifically, in the above example, the authentication processing unit 23c grants authentication permission when the “attribute information” acquired by the cache determination unit 23a matches the “attribute information” acquired from the authentication request. Responds to the user authentication termination device 10. On the other hand, the authentication processing unit 23c responds to the user authentication termination device 10 with a rejection of authentication when the two pieces of information do not match or when “no authentication information” is notified from the cache determination unit 23a.

(Configuration of authentication information database server A)
Next, the configuration of the authentication information database server A of the authentication server A will be described with reference to FIG. That is, here, the configuration of an authentication information database server that is a basic authentication device will be described. FIG. 9 is a block diagram showing the configuration of the authentication information database server A30 of the authentication server A. As illustrated in FIG. 9, the authentication information database server A30 includes a communication control I / F unit 31, a storage unit 32, and a control unit 33.

  The communication control I / F unit 31 controls communication related to various information exchanged with the authentication information cache server A20. Specifically, the communication control I / F unit 31 receives an authentication information acquisition request from the authentication information cache server A20, and responds with no authentication information or no authentication information.

  The storage unit 32 stores data and programs necessary for various processes by the control unit 33, and particularly includes an authentication information DB 32a. Various data and parameters can be arbitrarily changed.

  The authentication information DB 32a is a large-capacity storage unit that holds authentication information in which authentication identifiers and attribute information are associated with each other. For example, as shown in FIG. 10, "authentication identifier (user ID), attribute information (password)" , “U001, P001, G001”, “U100, P100, G002”, etc. are stored as “Authentication identifier group (group ID)”. Although an example in which the attribute information and the authentication identifier group are stored in the same table is shown here, the present invention is not limited to this and may be managed in separate tables. Although the case where the specific information and the authentication identifier are the same is illustrated here, the present invention is not limited to this, and other information may be used as the specific information. FIG. 10 is a diagram illustrating an example of information stored in the authentication information DB 32a.

  The control unit 33 includes a control program such as an OS (Operating System), a program that defines various processing procedures, and an internal memory for storing necessary data, and a cache response unit 33a. Execute the process.

  When receiving an authentication information acquisition request from the authentication information cache server A20, the cache response unit 33a stores authentication information in which “authentication identifier” and “attribute information” included in the request are associated with each other in the authentication information DB 32a. It is determined whether or not it has been done. When the cache response unit 33a is stored in the authentication information DB 32a, the cache response unit 33a acquires the corresponding authentication information from the authentication information DB 32a and responds to the authentication information cache server A20. Further, the cache response unit 33a responds “no authentication information” to the authentication information cache server A20 when it is not stored in the authentication information DB 32a.

  Further, when the cache response unit 33a receives an authentication identifier acquisition request including specific information from the authentication information cache server A20, and holds the second identifier corresponding to the specific information in the authentication information DB 32a, the authentication information DB 32a The second identifier associated with the specific information held in the DB 32a is returned to the authentication information cache server A20. When the second identifier corresponding to the specific information is not held in the authentication information DB 32a, the cache response unit 33a responds to the authentication information cache server A20 that the second identifier is not held.

(Configuration of authentication information cache server B)
Next, the configuration of the authentication information cache server B of the authentication server B will be described using FIG. That is, here, the configuration of an authentication information cache server that is an associative authentication device will be described. FIG. 11 is a block diagram showing the configuration of the authentication information cache server B 40 of the authentication server B. As illustrated in FIG. 11, the authentication information cache server B 40 includes a communication control I / F unit 41, a storage unit 42, and a control unit 43.

  The communication control I / F unit 41 controls communication related to various information exchanged with the authentication information database server B50, the authentication information cache server A20, and the user authentication termination device 10. Specifically, the communication control I / F unit 41 receives an authentication request from the user authentication termination device 10 and returns an authentication result to the user authentication termination device 10. Further, the communication control I / F unit 41 receives the authentication information from the authentication information database server B50 and transmits an authentication identifier to the authentication information cache server A20.

  The storage unit 42 stores data and programs necessary for various processes by the control unit 43, and particularly includes a cache 42a and an authentication device type information DB 42b. Various data and parameters can be arbitrarily changed.

  The cache 42a is a high-speed accessible memory that holds authentication information used in the past among authentication information held in the authentication information database server B50. For example, as shown in FIG. 12, the cache 42a stores “CHANNEL-0021G001, P002” and the like as “authentication identifier (line number + group ID), attribute information (password)”. The “authentication identifier (line number + group ID)” exemplified here is information indicating a search key for searching for attribute information, and “attribute information (password)” is information used for authentication. FIG. 12 is a diagram illustrating an example of information stored in the cache 42a.

  The authentication device type information DB 42b stores information indicating whether the own device is a basic authentication device or an associative authentication device. For example, as shown in FIG. 13, the authentication device type information DB 42b stores “association type, authentication server A, 10.1.1.1” as “authentication type, association destination, IP address”. FIG. 13 is a diagram illustrating an example of information stored in the authentication device type information DB 42b.

  The “authentication type” exemplified here is information indicating whether the own device is a basic authentication device or an associative authentication device, and the “association destination” is the authentication information (attribute information) of the own device. This is information indicating an authentication server that holds an authentication identifier that is a part of a search key for searching. “IP address” is the IP address of the authentication information cache server of the “association destination” authentication server.

  The control unit 43 has an internal memory for storing a control program such as an OS (Operating System), a program defining various processing procedures, and necessary data. The control unit 43 includes an authentication identifier request unit 43a, a cache determination unit 43b, and an authentication processing unit 43c, and executes various processes using these.

  The authentication identifier request unit 43a indicates a part of the authentication identifier used for authentication by the authentication information cache server B40 based on the specific information included in the authentication request received from the user authentication termination device 10 from the authentication information cache server A20. Get a second identifier.

  Specifically, the authentication identifier request unit 43a refers to the authentication device type information DB 42b when receiving the “authentication identifier” and the “attribute information” as an authentication request from the user authentication termination device 10 in the above example. Thus, the device is identified as an associative authentication device. Subsequently, the authentication identifier request unit 43a uses “line type = CHANNEL-0021” as a first identifier that is a part of the authentication identifier used by the authentication information cache server B40 for authentication, and the authentication information cache server B40 uses the authentication for authentication. User authentication for an authentication request including “user ID = U001” as identification information for identifying “group ID” as a second identifier that is a part of the identifier, and “password = P002” as attribute information to be authenticated Obtained from the end device 10. Then, the authentication identifier request unit 43a transmits the specific information “user ID” to the authentication information cache server A20, and receives the second identifier “group ID = G001” as a response.

  The cache determination unit 43b associates with the new authentication identifier using the second identifier acquired by the authentication identifier request unit 43a and the first identifier included in the authentication request received from the user authentication termination device 10. The attribute information stored in the cache 42a is searched. More specifically, the cache determination unit 43b combines the first identifier “line type = CHANNEL-0021” and the second identifier “group ID = G001” to create a new authentication identifier “ CHANNEL-0021G001 "is generated. Then, the cache determination unit 43b determines whether or not the generated authentication identifier “CHANNEL-0021G001” and “attribute information” corresponding thereto are stored in the cache 42a. Then, the cache determination unit 43b acquires “attribute information” corresponding to the authentication identifier “CHANNEL-0021G001” when stored in the cache 42a, and acquires the “attribute information” acquired from the cache 42a and the authentication request. The “attribute information” is output to the authentication processing unit 43c.

  Further, when not stored in the cache 42a, the cache determination unit 43b transmits an acquisition request for “authentication information (attribute information)” corresponding to the generated authentication identifier “CHANNEL-0021G001” to the authentication information database server B50. Thereafter, when receiving “attribute information = P002” corresponding to the authentication identifier “CHANNEL-0021G001” from the authentication information database server B50, the cache determination unit 43b stores these in association with each other in the cache 42a and performs authentication. The data is output to the processing unit 43d. On the other hand, when the “attribute information” corresponding to the authentication identifier “CHANNEL-0021G001” cannot be received from the authentication information database server B50, the cache determination unit 43b outputs “no authentication information” to the authentication processing unit 43c. .

  The authentication processing unit 43c performs user authentication using the attribute information acquired by the cache determination unit 43b. Specifically, in the above example, the authentication processing unit 43c determines that the authorization is permitted when the “attribute information” acquired by the cache determination 43b matches the “attribute information” acquired from the authentication request. Responds to the authentication termination device 10. On the other hand, when the two pieces of information do not match or when “no authentication information” is notified from the cache determination unit 43b, the authentication processing unit 43c responds to the user authentication termination device 10 with an authentication rejection.

(Configuration of authentication information database server B)
Next, the configuration of the authentication information database server B of the authentication server B will be described using FIG. That is, here, the configuration of an authentication information database server that is an associative authentication device will be described. FIG. 14 is a block diagram showing a configuration of the authentication information database server B50 of the authentication server B. As illustrated in FIG. 14, the authentication information database server B50 includes a communication control I / F unit 51, a storage unit 52, and a control unit 53.

  The communication control I / F unit 51 controls communication related to various information exchanged with the authentication information cache server B40. Specifically, the communication control I / F unit 51 receives an authentication information acquisition request from the authentication information cache server B40, and responds with no authentication information or authentication information.

  The storage unit 52 stores data and programs necessary for various processes by the control unit 53, and particularly includes an authentication information DB 52a. Various data and parameters can be arbitrarily changed.

  The authentication information DB 52a is a large-capacity storage unit that holds authentication information in which authentication identifiers and attribute information are associated with each other. For example, as illustrated in FIG. 15, “CHANNEL” is displayed as “authentication identifier and attribute information (password)”. -0021G001, P002 "," CHANNEL-0100G002, P010 ", etc. are stored. FIG. 15 is a diagram illustrating an example of information stored in the authentication information DB 52a.

  The control unit 53 includes an internal memory for storing a control program such as an OS (Operating System), a program that defines various processing procedures, and necessary data, and a cache response unit 53a. Execute the process.

  When receiving an authentication information acquisition request from the authentication information cache server B40, the cache response unit 53a stores authentication information in which “authentication identifier” and “attribute information” included in the request are associated with each other in the authentication information DB 52a. It is determined whether or not it has been done. Then, when stored in the authentication information DB 52a, the cache response unit 53a acquires the corresponding authentication information from the authentication information DB 52a and responds to the authentication information cache server B40. Further, the cache response unit 53a responds “no authentication information” to the authentication information cache server B40 when it is not stored in the authentication information DB 52a.

[Process flow]
Next, the flow of processing of each device in the authentication system according to the first embodiment will be described with reference to FIGS.

(Processing flow of user authentication termination device)
The flow of processing in the user authentication termination device will be described with reference to FIG. FIG. 16 is a flowchart showing the flow of processing in the user authentication termination apparatus 10.

  As illustrated in FIG. 16, the order determination unit 13a of the user authentication termination device 10 that has received the authentication request from the user terminal determines the order in which the authentication request for the user terminal is transmitted according to a predetermined condition (step S100). At this time, the order determination unit 13a identifies the port number that received the authentication request.

  Subsequently, when the device type determination unit 13b transmits authentication requests to the authentication server in the order determined by the order determination unit 13a, the authentication server as a transmission target is a basic authentication device, or associative authentication Whether the device is a device is determined from the authentication device type information DB 12c using the authentication server name specified by the order determination unit 13a (step S101).

  Then, the basic authentication requesting unit 13c determines an authentication identifier for identifying authentication information used for authentication by the authentication server for the authentication server determined to be a basic authentication device by the device type determining unit 13b (Yes in step S101). The authentication apparatus type information DB 12c, the user information DB 12a, and information acquired from the user terminal are specified, and an authentication request including these is created and transmitted to the authentication server (steps S102 and S103).

  Thereafter, the authentication result transmission unit 13e receives the authentication result from the authentication server to which the authentication request has been transmitted by the basic authentication request unit 13c (step S104). Then, when the received authentication result is authentication permission (Yes at Step S105), the authentication result transmitting unit 13e determines whether the authentication result has been received from all the authentication servers (Step S106).

  When all the authentication results received from all the authentication servers are authentication permission (Yes at Step S106), the authentication result transmitting unit 13e transmits the authentication permission of the user terminal (Step S107).

  On the other hand, returning to step S105, when the received authentication result is not authentication permission (No in step S105), the authentication result transmitting unit 13e transmits authentication rejection of the user terminal (step S108). If the authentication result transmitting unit 13e has not received the authentication results from all the authentication servers (No at Step S106), the authentication result transmitting unit 13e determines the authentication server of the next order determined by the order determining unit 13a (Step S109). The processes after step S101 are repeated.

  On the other hand, returning to step S101, the associative authentication requesting unit 13d determines the authentication identifier used by the authentication server for authentication with respect to the authentication server determined to be an associative authentication device by the device type determining unit 13b (No in step S101). The first identifier indicating a part and the specifying information specifying the second identifier indicating a part of the authentication identifier are specified from the information received from the authentication device type information DB 12c, the user information DB 12a and the user terminal, and include these An authentication request is created (step S110). Thereafter, the processing of step S103 to step S109 is executed.

(Processing flow of authentication information cache server A20)
A processing flow in the authentication information cache server A20 will be described with reference to FIG. FIG. 17 is a flowchart showing the flow of processing in the authentication information cache server A20.

  As illustrated in FIG. 17, when the cache determination unit 23a of the authentication information cache server A20 receives an authentication request from the user authentication termination device 10 (step S120), the cache authentication unit 23a refers to the authentication device type information DB 22b and determines that the own device is a basic authentication device. And an authentication identifier is acquired from the received authentication request, and attribute information stored in the cache 22a in association with the acquired authentication identifier is searched (step S121).

  Subsequently, when the authentication information associated with the authentication identifier exists in the cache 22a (Yes at Step S122), the cache determination unit 23a uses the attribute information acquired by the cache determination unit 23a. User authentication is performed (step S123).

  Then, when the “attribute information” acquired from the cache 22a matches the “attribute information” acquired from the authentication request, the authentication processing unit 23c sets the authentication result as authentication permission (Yes in step S124), and authenticates. To the user authentication terminal device 10 (step S125). Further, the authentication processing unit 23c rejects the authentication result when the “attribute information” acquired from the cache 22a does not match the “attribute information” acquired from the authentication request (No in step S124), and the authentication rejection To the user authentication termination device 10 (step S126).

  On the other hand, returning to step S122, if the attribute information associated with the authentication identifier does not exist in the cache 22a (No at step S122), the cache determination unit 23a obtains an attribute information acquisition request (search request) corresponding to the authentication identifier. ) Is transmitted to the authentication information database server A30 (step S127).

  Then, the cache determination unit 23a receives the attribute information from the authentication information database server A30 (step S128), and if there is a search result (no authentication information) (Yes in step S129), the cache identifier and attribute information are displayed. The associated authentication information is registered in the cache 22a (step S130), and the processes after step S123 are executed. When there is no search result (no authentication information) (No at Step S129), the cache determination unit 23a responds to the user authentication termination device 10 with an authentication rejection (Step S126).

(Second identifier search processing flow in authentication information cache server A20)
The second identifier search processing flow in the authentication information cache server A20 will be described with reference to FIG. FIG. 18 is a flowchart showing the flow of the second identifier search process in the authentication information cache server A20.

  As illustrated in FIG. 18, the identifier transmission unit 23b of the authentication information cache server receives a search request for the second identifier (for example, group ID) corresponding to the specific information from the authentication information cache server B40 (step S140). The cache 22a is searched using the received specific information (step S141).

  Then, when the second identifier corresponding to the received specific information is registered in the cache 22a (Yes at Step S142), the identifier transmission unit 23b acquires the second identifier from the cache 22a, It transmits to authentication information cache server B40 which is an associative type authentication server which is a request source (step S143).

  On the other hand, when the second identifier corresponding to the received specific information is not registered in the cache 22a (No at Step S142), the identifier transmission unit 23b transmits a search request to the authentication information database server A30 ( Step S144).

  After that, the identifier transmission unit 23b receives the second identifier corresponding to the received specific information from the authentication information database server A30 (step S145), registers it in the cache 23a (step S146), and authenticates the authentication information that is the request source. The data is transmitted to the cache server B40 (step S143).

(Processing flow of authentication information database server A30)
A processing flow in the authentication information database server A30 will be described with reference to FIG. FIG. 19 is a flowchart showing the flow of processing in the authentication information database server A30.

  As shown in FIG. 19, the cache response unit 33a of the authentication information database server A30 receives a search request from the authentication information cache server A30 (step S150), and corresponds to an identifier such as an authentication identifier included in the received search request. The authentication information is searched (step S151).

  When the authentication information corresponding to the authentication identifier is stored in the authentication information DB 32a (Yes at Step S152), the cache response unit 33a acquires the authentication information from the authentication information DB 32a and responds to the authentication information cache server A20. (Step S153). On the other hand, when the authentication information corresponding to the authentication identifier is not stored in the authentication information DB 32a (No at Step S152), the cache response unit 33a responds to the authentication information cache server A30 with a search failure (Step S154).

(Processing flow of authentication information cache server B40)
A processing flow in the authentication information cache server B40 will be described with reference to FIG. FIG. 20 is a flowchart showing the flow of processing in the authentication information cache server B40.

As shown in FIG. 20, the authentication identifier request unit 43a of the authentication information cache server B40
When the authentication request is received from the user authentication termination device 10 (step S160), the authentication device type information DB 42b is referred to identify that the device is an associative authentication device and identify the authentication server that is associated with the device itself, Specific information for determining a second identifier for determining a part of the authentication identifier used by the own device for authentication is acquired from the authentication request (step S161).

  The authentication identifier requesting unit 43a transmits a search request (inquiry) for specific information to the authentication information cache server A20 that is the identified authentication server of the association destination (step S162). Thereafter, the cache determination unit 43b receives the second identifier as an inquiry result from the associative authentication information cache server A20 (step S163). Subsequently, the cache determination unit 43b uses the first identifier acquired from the authentication request received from the user authentication termination device 10 and the second identifier received from the authentication information cache server A20 to generate a new authentication identifier. Create (step S164).

  Then, the cache determination unit 43b searches for attribute information stored in the cache in association with the generated new authentication identifier (step S165).

  Subsequently, when the authentication information associated with the new authentication identifier is acquired from the cache 42a by the cache determination unit 43b (Yes in step S166), the authentication processing unit 43c determines the attribute acquired by the cache determination unit 43b. User authentication is performed using the information (step S167).

  Then, when the “attribute information” acquired from the cache 42a matches the “attribute information” acquired from the authentication request, the authentication processing unit 43c sets the authentication result as authentication permission (Yes in step S168) and authenticates. To the user authentication termination device 10 (step S169). In addition, when the “attribute information” acquired from the cache 42a does not match the “attribute information” acquired from the authentication request, the authentication processing unit 43c determines that the authentication result is authentication rejection (No in step S168) and rejects the authentication. To the user authentication termination device 10 (step S170).

  On the other hand, returning to step S166, when the attribute information associated with the authentication identifier does not exist in the cache 42a (No at step S166), the cache determination unit 43b obtains an attribute information acquisition request corresponding to the new authentication identifier ( Search request) is transmitted to the authentication information database server B50 (step S171).

  Then, the cache determination unit 43b receives the attribute information from the authentication information database server B50 (step S172), and if there is a search result (Yes in step S173), the authentication information in which the new authentication identifier is associated with the attribute information. Is registered in the cache 42a (step S174), and the processes after step S167 are executed. If there is no search result (no authentication information) (No at Step S173), the cache determination unit 43b responds to the user authentication termination device 10 with an authentication rejection (Step S170).

(Processing flow of authentication information database server B50)
A processing flow in the authentication information database server B50 will be described with reference to FIG. FIG. 21 is a flowchart showing the flow of processing in the authentication information database server B50.

  As shown in FIG. 21, the cache response unit 53a of the authentication information database server B50 receives the search request from the authentication information cache server B40 (step S180), and the authentication corresponding to the new authentication identifier included in the received search request. Information is searched (step S181).

  Then, when the authentication information corresponding to the new authentication identifier is stored in the authentication information DB 52a (Yes at Step S182), the cache response unit 53a acquires the authentication information from the authentication information DB 52a and sends it to the authentication information cache server B40. A response is made (step S183). On the other hand, when the authentication information corresponding to the new authentication identifier is not stored in the authentication information DB 52a (No at Step S182), the cache response unit 53a responds to the authentication information cache server B40 with a search failure (Step S184).

[Effects of Example 1]
As described above, in the authentication system according to the first embodiment, it is not necessary to hold a table having the same authentication identifier as a search key repeatedly between different authentication servers, so that the disk access frequency can be suppressed. In the authentication system according to the first embodiment, a table using the same authentication identifier as a search key can be held in the authentication information cache server, so that authentication processing can be performed at high speed and with high throughput. As a result, it is possible to reduce the area for storing the authentication information and improve the performance of the entire authentication system.

  Next, an example in which the RADIUS attribute is applied to the method described in the first embodiment will be described as a second embodiment with reference to FIG. FIG. 22 is a diagram illustrating the overall configuration of the authentication system according to the second embodiment.

  As illustrated in FIG. 22, in the authentication system according to the second embodiment, a user terminal, a user authentication termination device, an authentication server 1, an authentication server 2, and an authentication server 3 are connected via a network. The number of devices is not limited to this.

  In this example, the authentication server 1 and the authentication server 2 are basic authentication devices, and the authentication server 3 is an associative authentication device having the authentication server 2 as an association destination. As in the first embodiment, each authentication server stores whether its own device is a basic authentication device or an associative authentication device. In the case of an associative authentication device, it also stores which authentication server is the association destination. That is, the authentication server 2 has the same function as the authentication server A described in the first embodiment, and the authentication server 3 has the same function as the authentication server B.

  The user authentication termination device 10 includes a user information DB 12a for storing information related to a user to be authenticated, an authentication order DB 12b for storing the order of authentication, and whether each of the connected authentication servers is a basic authentication device or an associative authentication device. It has an authentication device type information DB 12c for storing information.

  Further, the authentication server 1 stores “authentication identifier, User-Password, Framed-IP-Address” in association with each other in an authentication information cache server or an authentication information database server. The User-Name attribute is used for transmitting the authentication identifier. The “authentication identifier” exemplified here is a search key used for authentication by the authentication server 1 and is information for uniquely identifying a user. “User-Password” is information for authenticating that the user specified by the authentication identifier is correct, and “Framed-IP-Address” is attribute information assigned to the authentication identifier for specifying the user.

  Further, the authentication server 2 stores “authentication identifier, User-Password, Service-Type, authentication identifier group” in association with each other in the authentication information cache server and the authentication information database server. The User-Name attribute is used for transmitting the authentication identifier. The “authentication identifier” exemplified here is a search key used for authentication by the authentication server 2 and is information that uniquely identifies the user. “User-Password” is information for authenticating that the user specified by the authentication identifier is correct, “Service-Type” is information indicating the service type used by the user, and “Authentication identifier group” Is information indicating a part of the authentication identifier of the authentication server 3 having the authentication server 2 as an association destination.

  Further, the authentication server 3 stores “authentication identifier, User-Password, Framed-Route” in association with each other in the authentication information cache server or the authentication information database server. The User-Name attribute is used for transmitting the authentication identifier. The “authentication identifier” exemplified here is a search key used by the authentication server 3 for authentication, and is attribute information that uniquely identifies the user. “User-Password” is information for authenticating that the user specified by the authentication identifier is correct, and “Framed-Route” is attribute information assigned to the authentication identifier for specifying the user.

  In such a state, the user authentication termination device 10 that has received the authentication request from the user terminal determines the order of transmitting the user terminal authentication request according to a predetermined condition. Here, it is assumed that the user authentication termination device 10 determines to authenticate in the order of the authentication server 1, the authentication server 2, and the authentication server 3.

  Subsequently, the user authentication termination device 10 determines whether the authentication server 1 determined as order 1 is a basic authentication device or an associative authentication device. Here, it is assumed that the authentication server 1 is determined to be a basic authentication device.

  Thereafter, the user authentication terminal device includes an Access-Request including a User-Name attribute value “U001” for specifying authentication information used for authentication by the authentication server 1 which is a basic authentication device, and a User-Password attribute value “PW-U001”. The message is transmitted to the authentication information cache server of the authentication server 1 (see (1) in FIG. 22). These pieces of information can be acquired from the user information DB stored in advance using the port number or the like that received the authentication request as a search key, or can be acquired from information received from the user terminal.

  When the authentication information cache server of the authentication server 1 receives the Access-Request message, the authentication information cache server determines whether or not the attribute information corresponding to the User-Name attribute value “U001” included in the message is stored in the cache ( (See (2) in FIG. 22). At this time, since the attribute information corresponding to the User-Name attribute value “U001” exists in the cache, the authentication information cache server has attribute information “User-Password = PW” corresponding to the User-Name attribute value “U001”. -U001 "and" Framed-IP-Address = 10.1.1.11 "are acquired from the cache.

  The authentication information cache server of the authentication server 1 authenticates because the User-Password attribute value “PW-U001” included in the message matches the attribute information “User-Password = PW-U001” acquired from the cache. Along with the permission, the attribute information “Framed-IP-Address = 10.1.1.11” is transmitted to the user authentication terminal device (see (3) in FIG. 22).

  Subsequently, the user authentication termination device 10 sends a User-Name attribute value “U101” for specifying authentication information used for authentication by the authentication server 2 as the basic authentication device to the authentication server 2 as the next authentication destination, An Access-Request message including the User-Password attribute value “PW-U101” is transmitted (see (4) in FIG. 22).

  When the authentication information cache server of the authentication server 2 receives the Access-Request message, the authentication information cache server determines whether or not the attribute information corresponding to the User-Name attribute value “U101” included in the message is stored in the cache ( (See (5) in FIG. 22). At this time, since the attribute information corresponding to the User-Name attribute value “U101” does not exist in the cache, the authentication information cache server inquires of the authentication information database server about the attribute information corresponding to “U101”. Since the authentication information database server stores attribute information corresponding to “U101” in the memory or on the disk, “authentication identifier = U101, User-Password = PW-U101, Service-Type = 2, “Authentication identifier group = G001” is returned to the authentication information cache server.

  Then, since the “User-Password = PW-U101” received from the authentication information database server matches the User-Password = PW-U101 included in the message, the authentication information cache server matches the attribute information together with the authentication permission. “Service-Type = 2” is transmitted to the user authentication termination device (see (6) in FIG. 22). At this time, the authentication information cache server registers the information received from the authentication information database server in the cache.

  Subsequently, the user authentication termination device 10 is the next authentication destination, and the authentication server 3 that is the associative authentication device, User-Name attribute value “U201” that is a part of the authentication identifier of the authentication server 3; The Authentication Server 3 receives an Access-Request message including a User-Password attribute value “PW-U201G001” and a Calling-Station-Id attribute value “U101” indicating specific information for specifying a part of the authentication identifier of the authentication server 3. To the authentication information cache server (see (7) of FIG. 22).

  When the authentication information cache server of the authentication server 3 receives the Access-Request message, the authentication identifier specified by the Calling-Station-Id attribute value “U101” included in the message of the user authentication termination device 10 belongs. An inquiry about an authentication identifier group representing a group is transmitted to the authentication information cache server of the authentication server 2 (see (8) in FIG. 22).

  Then, as described above, since the authentication information cache server of the authentication server 2 acquires the information corresponding to “U101” from the database server and stores it in the cache, the authentication group associated with “U101” “G001” is acquired from the cache and transmitted to the authentication information cache server of the authentication server 3 (see (9) in FIG. 22).

  The authentication information cache server of the authentication server 3 generates an authentication identifier “U201G001” that combines “U201” included in the message of the user authentication termination device 10 and “G001” acquired from the authentication information cache server of the authentication server 2. Then, a cache search is performed (see (10) in FIG. 22).

  In the authentication information cache server of the authentication server 3, the User-Password attribute value “PW-U201G001” included in the message of the user authentication termination device 10 matches the attribute value “PW-U201G001” retrieved from the cache. Then, along with the authentication permission, the attribute information “Framed-Route = 10.1.1.1” is transmitted to the user authentication terminal device (see (11) in FIG. 22).

  The user authentication termination device permits authentication of the user terminal when all the authentication results received from the authentication servers 1 to 3 that transmitted the authentication request are authentication permission.

  As described above, according to the second embodiment, it is possible to reduce the area for storing the authentication information and improve the performance of the entire authentication system even in the authentication system to which the RADIUS attribute is applied.

  Next, referring to FIG. 23, an example in which the RADIUS attribute is applied to the authentication system, and the user authentication terminal device acquires an authentication identifier (authentication identifier group) from the associative authentication device and transmits it to the associative authentication device. This will be described as 3. FIG. 23 is a diagram illustrating the overall configuration of the authentication system according to the third embodiment.

  As illustrated in FIG. 23, in the authentication system according to the third embodiment, a user terminal, a user authentication termination device, an authentication server 1, an authentication server 2, and an authentication server 3 are connected via a network. The number of devices is not limited to this. In addition to the contents similar to those in the second embodiment, each device stores the association destination of the authentication server 3 that is the associative authentication device, and the authentication server 3 that is the associative authentication device There is no need to store the association destination as in the first and second embodiments.

  In such a state, the user authentication termination device 10 that has received the authentication request from the user terminal determines the order of transmitting the user terminal authentication request according to a predetermined condition. Here, it is assumed that the user authentication termination device determines to authenticate in the order of the authentication server 1, the authentication server 2, and the authentication server 3.

  Subsequently, the user authentication termination device 10 determines whether the authentication server 1 determined as order 1 is a basic authentication device or an associative authentication device. Here, it is assumed that the authentication server 1 is determined to be a basic authentication device.

  Thereafter, the user authentication terminal device 10 includes an Access-Name attribute value “U001” for specifying authentication information used for authentication by the authentication server 1 as a basic authentication device and an Access-Password attribute value “PW-U001”. The Request message is transmitted to the authentication information cache server of the authentication server 1 (see (1) in FIG. 23). Such information can be acquired from the user information DB 12a stored in advance using the port number or the like that received the authentication request as a search key, or can be acquired from information received from the user terminal.

  When the authentication information cache server of the authentication server 1 receives the Access-Request message, the authentication information cache server determines whether or not the attribute information corresponding to the User-Name attribute value “U001” included in the message is stored in the cache ( (See (2) in FIG. 23). At this time, since the attribute information corresponding to the User-Name attribute value “U001” exists in the cache, the authentication information cache server has attribute information “User-Password = PW” corresponding to the User-Name attribute value “U001”. -U001 "and" Framed-IP-Address = 10.1.1.11 "are acquired from the cache.

  The authentication information cache server of the authentication server 1 authenticates because the User-Password attribute value “PW-U001” included in the message matches the attribute information “User-Password = PW-U001” acquired from the cache. Along with the permission, the attribute information “Framed-IP-Address = 10.1.1.11” is transmitted to the user authentication terminal device (see (3) in FIG. 23).

  Subsequently, the user authentication termination device 10 sends a User-Name attribute value “U101” for specifying authentication information used for authentication by the authentication server 2 as the basic authentication device to the authentication server 2 as the next authentication destination, An Access-Request message including the User-Password attribute value “PW-U101” is transmitted to the authentication information cache server of the authentication server 1 (see (4) in FIG. 23).

  When the authentication information cache server of the authentication server 2 receives the Access-Request message, the authentication information cache server determines whether or not the attribute information corresponding to the User-Name attribute value “U101” included in the message is stored in the cache ( (See (5) in FIG. 23). At this time, since the attribute information corresponding to the User-Name attribute value “U101” does not exist in the cache, the authentication information cache server inquires of the authentication information database server about the attribute information corresponding to “U101”. Since the authentication information database server stores attribute information corresponding to “U101” in the memory or on the disk, “authentication identifier = U101, User-Password = PW-U101, Service-Type = 2, “Authentication identifier group = G001” is returned to the authentication information cache server.

  Then, since the “User-Password = PW-U101” received from the authentication information database server matches the User-Password = PW-U101 included in the message, the authentication information cache server matches the attribute information together with the authentication permission. In addition to “Service-Type = 2”, “authentication identifier group = G001” is transmitted to the user authentication terminal device by the Configuration-Token attribute and the Reply-Message attribute (see (6) in FIG. 23). At this time, the authentication information cache server registers the information received from the authentication information database server in the cache.

  Subsequently, the user authentication termination device 10 is the next authentication destination, and the authentication server 3 that is the associative authentication device, User-Name attribute value “U201” that is a part of the authentication identifier of the authentication server 3; The User-Password attribute value “PW-U201G001” and the authentication identifier group = G001 received from the cache server of the authentication server 2 that is a part of the authentication identifier of the authentication server 3 are entered in the Calling-Station-Id attribute value. The included Access-Request message is transmitted to the authentication information cache server of the authentication server 3 (see (7) in FIG. 23).

  Upon receiving the Access-Request message, the authentication information cache server of the authentication server 3 generates an authentication identifier “U201G001” obtained by combining “U201” and “G001” included in the message, and performs a cache search (FIG. 23 (8)).

  The authentication information cache server of the authentication server 3 matches the User-Password attribute value “PW-U201G001” included in the message of the user authentication terminal device and the attribute value “PW-U201G001” retrieved from the cache. In addition to the authentication permission, the attribute information “Framed-Route = 10.1.1.1” is transmitted to the user authentication termination device 10 (see (9) in FIG. 23).

  The user authentication termination device 10 permits authentication of the user terminal when all authentication results received from the authentication servers 1 to 3 that transmitted the authentication request are authentication permission.

  In the first embodiment, an example has been described in which the associative authentication device acquires an authentication identifier (an authentication identifier group acquired by transmitting an authentication identifier group acquisition request) from another authentication device that is an association destination. However, the present invention is not limited thereto. It is not something. For example, when another authentication device as an association destination searches for an authentication identifier group using the authentication identifier as a search key, the authentication identifier and the authentication identifier group are transmitted to the associative authentication device even before the acquisition request is received. May be.

  Therefore, in the fourth embodiment, an example in which an authentication device as an association destination actively transmits an authentication identifier and an authentication identifier group to the associative authentication device will be described with reference to FIGS.

[overall structure]
First, the overall configuration of the authentication system according to the fourth embodiment will be described with reference to FIG. FIG. 24 is a diagram illustrating the overall configuration of the authentication system according to the fourth embodiment.

  As shown in FIG. 24, in the authentication system, a user terminal, a user authentication termination device, an authentication server j, and an authentication server k are connected via a network. The authentication server j is a basic authentication device, and the authentication server k is an associative authentication device with the authentication server j as an association destination. That is, the authentication server j corresponds to the authentication server A described in the first embodiment, and the authentication server k corresponds to the authentication server B.

  Further, the number of each device is not limited to this. In addition to the same contents as in the first and second embodiments, each device stores the information of the authentication server that is the association destination of the authentication server that is the associative authentication device. On the other hand, the authentication server of the associative authentication device does not need to store the associative destination.

  In this state, the user authentication termination device 10 that has received the authentication request from the user terminal determines the order in which the user terminal authentication requests are transmitted according to a predetermined condition. Here, it is assumed that the user authentication termination device 10 determines to authenticate in the order of the authentication server j and the authentication server k.

  Subsequently, the user authentication termination device 10 sends an authentication request including “authentication identifier j” and “attribute information j” for specifying authentication information used by the authentication server j determined to be a basic authentication device to the authentication server j. It is transmitted to the authentication information cache server j (see (1) in FIG. 24). The authentication information cache server j that has received the authentication request stores information including all or part of the received “authentication identifier j” and “attribute information j” in the cache, or stores the authentication information in the authentication information database server j. User authentication is performed based on whether or not it is registered (see (2) in FIG. 24).

  Information including the received “authentication identifier j” and “all or part of the attribute information j” is stored, and the authentication information cache server j determined to be authorized is associated with “authentication identifier j”. The “authentication identifier group” is acquired from the cache or the authentication information database server j, and transmitted to the authentication information cache server k of the authentication server k having the authentication server j as an association destination (see (3) in FIG. 24). Here, as a method for the authentication information cache server j to identify the authentication server k having the authentication server j as an association destination, one or a plurality of pairs of “association source device and association source device IP address” are stored. Just keep it. Specifically, it can be specified by storing in the cache “authentication server k, 192.168.1.1” or the like as “association source device, IP address of association source device”. Further, for example, when the authentication server j is an association destination of a plurality of associative authentication devices, the authentication information cache server j uses a plurality of associative authentications with the identified “authentication identifier group” as the association destination of the authentication server j. It can also be sent to each device.

  Further, the authentication information cache server j determined to be permitted for authentication responds to the user authentication termination device 10 with permission for authentication (see (4) in FIG. 24). At this time, the authentication information cache server k stores “authentication identifier j, attribute information j, authentication identifier group” in association with each other in a dedicated memory or disk.

  Subsequently, the user authentication termination device 10 sends a first identifier “authentication identifier k” indicating a part of “authentication identifier G” used for authentication by the authentication server k to the authentication server k which is the next authentication destination. Then, an authentication request including the specific information “authentication identifier j” for specifying the second identifier “authentication identifier group” indicating a part of the authentication identifier “authentication identifier G” is transmitted (see (5) in FIG. 24). At this time, the user authentication termination device 10 also transmits attribute information G of the authentication identifier “authentication identifier G” used for authentication by the authentication server k.

  Then, the authentication information cache server k of the authentication server k searches the dedicated memory using “authentication identifier j” included in the authentication request received from the user authentication termination device 10 as a search key, and acquires “ Specify an authentication identifier group. Then, the authentication information cache server k combines the acquired “authentication identifier group” and the “authentication identifier k” included in the authentication request to generate an authentication identifier “authentication identifier G”. The authentication information cache server k stores information including all or part of the generated “authentication identifier G” and “attribute information G” included in the authentication request in the cache, or stores the authentication information in the authentication information database server k. User authentication is performed based on whether or not it is registered (see (6) in FIG. 24).

  After that, when information including “authentication identifier G” and “all or part of the attribute information G” is stored in the authentication server k, the authentication information database server k grants authentication permission to the user authentication termination device. 10, if information including “authentication identifier G” and “all or part of the attribute information G” is not stored in the authentication server k, an authentication rejection is returned to the user authentication termination device 10. (See (7) in FIG. 24).

[Process flow]
Next, a processing flow of each device in the authentication system according to the fourth embodiment will be described with reference to FIGS. 25 and 26. Here, only an authentication server having a processing flow different from that of the other embodiments will be described.

(Processing flow of authentication information cache server j)
The flow of processing in the authentication information cache server j, which is a basic authentication device, will be described with reference to FIG. FIG. 25 is a flowchart illustrating a flow of processing in the authentication information cache server j which is the basic authentication device according to the fourth embodiment.

  As shown in FIG. 25, the processing from step S200 to step S205 is the same as the processing from step S120 to step S125 described in the first embodiment. Specifically, when the authentication information cache server j receives an authentication request from the user authentication termination device 10 (step S200), the authentication information cache server j refers to the authentication device type information DB and identifies that the device is a basic authentication device. An authentication identifier is acquired from the received authentication request, and attribute information stored in the cache in association with the acquired authentication identifier is searched (step S201).

  Subsequently, when the authentication information associated with the authentication identifier exists in the cache (Yes in Step S202), the authentication information cache server j performs user authentication using the attribute information acquired from the cache (Step S203). .

  Subsequently, when the “attribute information” acquired from the cache matches the “attribute information” acquired from the authentication request, the authentication information cache server j accepts the authentication result as an authentication permission (Yes in step S204), and authenticates. The permission is returned to the user authentication terminal device 10 (step S2055).

  Thereafter, unlike the first embodiment, when the authentication identifier group to which the authentication identifier to be authenticated by the authentication server belongs determines a part of the authentication identifier of another authentication server, the authentication information cache server j determines that authentication server. Specify (step S206). In other words, the authentication information cache server j identifies an authentication server that is associated with its own device. For example, as a method for the authentication information cache server j to identify an authentication server having the own device as an association destination, one or more pairs of “association source device and association source device IP address” may be stored. . Specifically, it can be specified by storing in the cache “authentication server k, 192.168.1.1” or the like as “association source device, IP address of association source device”.

  Then, the authentication information cache server j transmits the authentication identifier used in the search and the authentication identifier group stored in the cache to the authentication information cache server of the specified authentication server (step S207). That is, the authentication information cache server j includes “attribute information” acquired from the cache, “authentication identifier” included in the authentication request received from the user authentication termination device 10 used to specify “attribute information”, and Corresponding to the “authentication identifier group” registered in the authentication server (authentication information cache server, authentication information database server) in association with the “authentication identifier”, and transmitting it to the authentication server having the device as an association destination .

  On the other hand, returning to step S204, the authentication information cache server j authenticates the authentication result when the “attribute information” acquired from the cache does not include all or part of the “attribute information” acquired from the authentication request. The rejection is made (No at Step S204), and the authentication rejection is responded to the user authentication termination device 10 (Step S208).

  Since the process from step S209 to step S212 is the same as the process from step S127 to step S130 described in the first embodiment, the description thereof is omitted.

(Processing flow in authentication information cache server k which is an associative authentication device)
Next, the flow of processing in the authentication information cache server k which is an associative authentication device will be described using FIG. That is, the process flow in the authentication server that receives the authentication identifier group from the association destination will be described. FIG. 26 is a flowchart illustrating a process flow in the authentication information cache server k which is the associative authentication apparatus according to the fourth embodiment.

  As shown in FIG. 26, the authentication information cache server k indicates a first identifier “authentication identifier k” indicating a part of “authentication identifier G” used for authentication and a part of the authentication identifier “authentication identifier G”. An authentication request including the identification information “authentication identifier j” for specifying the second identifier “authentication identifier group” is received from the user authentication terminal device 10 (step S300).

  Subsequently, the authentication information cache server k receives in advance authentication information corresponding to the specific information “authentication identifier j” included in the authentication request from the authentication information cache server of the authentication server that is the association destination, and a dedicated cache memory or the like. And identifying the identified authentication information as the second identifier “authentication identifier group” (step S301). The area to be registered may be a dedicated memory area or an authentication information area managed by the own apparatus.

  The authentication information cache server k then authenticates itself from the second identifier “authentication identifier group” identified from within the own device and the first identifier “authentication identifier k” obtained from the received authentication request. An “authentication identifier G” that is an authentication identifier to be used is generated (step S302).

  Thereafter, the processing from step S303 to step S312 performed by the authentication information cache server k using the new authentication identifier “authentication identifier G” is the same as step S165 to step S174 described in the first embodiment. Then, detailed explanation is omitted.

  Next, an example in which the RADIUS attribute is applied to the method described in the fourth embodiment will be described as a fifth embodiment with reference to FIG. FIG. 27 is a diagram illustrating the overall configuration of the authentication system according to the fifth embodiment.

  As illustrated in FIG. 27, in the authentication system according to the fifth embodiment, a user terminal, a user authentication termination device, an authentication server 1, an authentication server 2, and an authentication server 3 are connected via a network. That is, the authentication server 2 corresponds to the authentication server A described in the first embodiment, and the authentication server 3 corresponds to the authentication server B. The number of devices is not limited to this. In addition to the same contents as in the second embodiment, each device stores an authentication server that is an association destination of the authentication server of the associative authentication device, and stores an authentication server that uses the authentication server as an association destination. In addition, the authentication server of the associative authentication device does not need to store the association destination.

  In such a state, the user authentication termination device 10 that has received the authentication request from the user terminal determines the order of transmitting the user terminal authentication request according to a predetermined condition. Here, it is assumed that the user authentication termination device 10 determines to authenticate in the order of the authentication server 1, the authentication server 2, and the authentication server 3.

  Subsequently, the user authentication termination device 10 determines whether the authentication server 1 determined as order 1 is a basic authentication device or an associative authentication device. Here, it is assumed that the authentication server 1 is determined to be a basic authentication device.

  Thereafter, the user authentication terminal device 10 includes an Access-Name attribute value “U001” for specifying authentication information used for authentication by the authentication server 1 as a basic authentication device and an Access-Password attribute value “PW-U001”. The Request message is transmitted to the authentication information cache server of the authentication server 1 (see (1) in FIG. 27). These pieces of information can be acquired from the user information DB stored in advance using the port number or the like that received the authentication request as a search key, or can be acquired from information received from the user terminal.

  When the authentication information cache server of the authentication server 1 receives the Access-Request message, the authentication information cache server determines whether or not the attribute information corresponding to the User-Name attribute value “U001” included in the message is stored in the cache ( (See (2) in FIG. 27). At this time, since the attribute information corresponding to the User-Name attribute value “U001” exists in the cache, the authentication information cache server has attribute information “User-Password = PW” corresponding to the User-Name attribute value “U001”. -U001 "and" Framed-IP-Address = 10.1.1.11 "are acquired from the cache.

  The authentication information cache server of the authentication server 1 authenticates because the User-Password attribute value “PW-U001” included in the message matches the attribute information “User-Password = PW-U001” acquired from the cache. Along with the permission, the attribute information “Framed-IP-Address = 10.1.1.11” is transmitted to the user authentication terminal device (see (3) in FIG. 27).

  Subsequently, the user authentication termination device 10 sends a User-Name attribute value “U101” for specifying authentication information used for authentication by the authentication server 2 as the basic authentication device to the authentication server 2 as the next authentication destination, An Access-Request message including the User-Password attribute value “PW-U101” is transmitted (see (4) in FIG. 27).

  When the authentication information cache server of the authentication server 2 receives the Access-Request message, the authentication information cache server determines whether or not the attribute information corresponding to the User-Name attribute value “U101” included in the message is stored in the cache ( (See (5) in FIG. 27). At this time, since the attribute information corresponding to the User-Name attribute value “U101” does not exist in the cache, the authentication information cache server inquires of the authentication information database server about the attribute information corresponding to “U101”. Since the authentication information database server stores the attribute information corresponding to “U101” on the memory or disk, “authentication identifier = U101, User-Password = PW-U101, Service-Type = 2, authentication “Identifier group = G001” is returned to the authentication information cache server.

  Then, since the “User-Password = PW-U101” received from the authentication information database server matches the User-Password = PW-U101 included in the message, the authentication information cache server matches the attribute information together with the authentication permission. “Service-Type = 2” is transmitted to the user authentication termination device (see (6) in FIG. 27). At this time, the authentication information cache server registers the information received from the authentication information database server in the cache.

  Further, the authentication information cache server receives “authentication identifier = U101, User-Password = PW-U101, Service-Type = 2, authentication identifier group = G001” received from the authentication information database server. “Authentication identifier group = G001” is transmitted to the authentication information cache server of the authentication server that is associated with the own device (see (7) in FIG. 27).

  The authentication information cache server that has received “authentication identifier = U101, authentication identifier group = G001” stores “authentication identifier = U101, authentication identifier group = G001” in a dedicated cache (see (8) in FIG. 27).

  Subsequently, the user authentication termination device 10 is the next authentication destination, and the authentication server 3 that is the associative authentication device, User-Name attribute value “U201” that is a part of the authentication identifier of the authentication server 3; An Access-Request message including a User-Password attribute value “PW-U201G001” and a Calling-Station-Id attribute value “Authentication identifier = U101” indicating specific information for specifying a part of the authentication identifier of the authentication server 3 It transmits to the authentication information cache server of the authentication server 3 (see (9) in FIG. 27).

  When the authentication information cache server of the authentication server 3 receives the Access-Request message, the authentication identifier group specified by the Calling-Station-Id attribute value “U101” included in the message of the user authentication termination device is assigned to the dedicated authentication identifier group. (See (10) in FIG. 27).

  Then, since the authentication information cache server of the authentication server 3 stores the authentication identifier group corresponding to “U101” in the dedicated cache as described above, the authentication identifier group “U101” associated with “U101” is stored. G001 "is acquired from the cache, and an authentication identifier" U201G001 "is generated by combining" U201 "included in the message of the user authentication termination device and" G001 "acquired from the authentication information cache server of the authentication server 2, and cache A search is performed (see (11) in FIG. 27).

  In the authentication information cache server of the authentication server 3, the User-Password attribute value “PW-U201G001” included in the message of the user authentication termination device 10 matches the attribute value “PW-U201G001” retrieved from the dedicated cache. Therefore, the attribute information “Framed-Route = 10.1.1.1” is transmitted to the user authentication termination device 10 together with the authentication permission (see (12) in FIG. 27).

  The user authentication termination device 10 permits authentication of the user terminal when all authentication results received from the authentication servers 1 to 3 that transmitted the authentication request are authentication permission.

  In the first embodiment, the associative authentication device transmits an authentication identifier group acquisition request based on the authentication identifier to the authentication device as the association destination, and acquires an authentication identifier group corresponding to the authentication identifier from the authentication device. However, the present invention is not limited to this. For example, a user authentication termination device receives an authentication identifier group based on an authentication identifier from an authentication device as an association destination, creates an authentication identifier used by the associative authentication device, and transmits an authentication request to the associative authentication device. May be.

  Therefore, in the sixth embodiment, with reference to FIGS. 28 to 30, the user authentication termination device creates an authentication identifier used by the associative authentication device that is an association destination and then transmits an authentication request to the associative authentication device. explain.

[overall structure]
First, the overall configuration of the authentication system according to the sixth embodiment will be described with reference to FIG. FIG. 28 is a diagram illustrating the overall configuration of the authentication system according to the sixth embodiment.

  As illustrated in FIG. 28, in the authentication system according to the sixth embodiment, a user terminal, a user authentication termination device, an authentication server 1, an authentication server 2, and an authentication server 3 are connected via a network. The number of devices is not limited to this. That is, the authentication server 2 corresponds to the authentication server A described in the first embodiment, and the authentication server 3 corresponds to the authentication server B. In addition to the contents similar to those in the second embodiment, each device stores the association destination of the authentication server 3 that is the associative authentication device, and the authentication server 3 that is the associative authentication device There is no need to store the association destination as in the first and second embodiments.

  In such a state, the user authentication termination device 10 that has received the authentication request from the user terminal determines the order of transmitting the user terminal authentication request according to a predetermined condition. Here, it is assumed that the user authentication termination device 10 determines to authenticate in the order of the authentication server 1, the authentication server 2, and the authentication server 3.

  Subsequently, the user authentication termination device 10 determines whether the authentication server 1 determined as order 1 is a basic authentication device or an associative authentication device. Here, it is assumed that the authentication server 1 is determined to be a basic authentication device.

  Thereafter, the user authentication terminal device 10 includes an Access-Name attribute value “U001” for specifying authentication information used for authentication by the authentication server 1 as a basic authentication device and an Access-Password attribute value “PW-U001”. The Request message is transmitted to the authentication information cache server of the authentication server 1 (see (1) in FIG. 28). These pieces of information can be acquired from the user information DB stored in advance using the port number or the like that received the authentication request as a search key, or can be acquired from information received from the user terminal.

  When the authentication information cache server of the authentication server 1 receives the Access-Request message, the authentication information cache server determines whether or not the attribute information corresponding to the User-Name attribute value “U001” included in the message is stored in the cache ( (See (2) in FIG. 28). At this time, since the attribute information corresponding to the User-Name attribute value “U001” exists in the cache, the authentication information cache server has attribute information “User-Password = PW” corresponding to the User-Name attribute value “U001”. -U001 "and" Framed-IP-Address = 10.1.1.11 "are acquired from the cache.

  The authentication information cache server of the authentication server 1 authenticates because the User-Password attribute value “PW-U001” included in the message matches the attribute information “User-Password = PW-U001” acquired from the cache. Along with the permission, the attribute information “Framed-IP-Address = 10.1.1.11” is transmitted to the user authentication terminal device (see (3) in FIG. 28).

  Subsequently, the user authentication termination device 10 sends a User-Name attribute value “U101” for specifying authentication information used for authentication by the authentication server 2 as the basic authentication device to the authentication server 2 as the next authentication destination, An Access-Request message including the User-Password attribute value “PW-U101” is transmitted to the authentication information cache server of the authentication server 2 (see (4) in FIG. 28).

  When the authentication information cache server of the authentication server 2 receives the Access-Request message, the authentication information cache server determines whether or not the attribute information corresponding to the User-Name attribute value “U101” included in the message is stored in the cache ( (See (5) in FIG. 28). At this time, since the attribute information corresponding to the User-Name attribute value “U101” does not exist in the cache, the authentication information cache server inquires of the authentication information database server about the attribute information corresponding to “U101”. Since the authentication information database server stores the attribute information corresponding to “U101” on the memory or disk, “authentication identifier = U101, User-Password = PW-U101, Service-Type = 2, authentication “Identifier group = G001” is returned to the authentication information cache server.

  Then, the authentication information cache server 2 matches “User-Password = PW-U101” received from the authentication information database server with “User-Password = PW-U101” included in the message. Information “Service-Type = 2” and “authentication identifier group = G001” are transmitted to the user authentication termination device (see (6) in FIG. 28). For example, the authentication information cache server 2 transmits using a Configuration-Token attribute or a Reply-Message attribute. At this time, the authentication information cache server registers the information received from the authentication information database server in the cache.

  Subsequently, since the authentication server 3 as the next authentication destination is the associative authentication device and the associative destination is the authentication server 2, the user authentication termination device 10 receives the authentication information from the authentication information cache server 2 of the authentication server 2. An authentication identifier “U201G001” combined with “U201” that is a part of the authentication identifier of the authentication server 3 and “Authentication identifier group = G001” is generated. Then, the user authentication termination device 10 transmits an Access-Request message including the generated authentication identifier “U201G001” in the User-Name attribute value and the User-Password attribute value “PW-U201G001” to the authentication server 3. It is transmitted to the authentication information cache server (see (7) in FIG. 28).

  Upon receiving the Access-Request message, the authentication information cache server of the authentication server 3 performs a cache search for the authentication identifier “U201G001” included in the message (see (8) in FIG. 28).

  In the authentication information cache server of the authentication server 3, the User-Password attribute value “PW-U201G001” included in the message of the user authentication termination device 10 matches the attribute value “PW-U201G001” retrieved from the cache. Then, along with the authentication permission, the attribute information “Framed-Route = 10.1.1.1” is transmitted to the user authentication terminal device (see (9) in FIG. 28).

  The user authentication termination device 10 permits authentication of the user terminal when all authentication results received from the authentication servers 1 to 3 that transmitted the authentication request are authentication permission.

[Process flow]
Next, a processing flow of each device in the authentication system according to the sixth embodiment will be described with reference to FIGS. 29 and 30.

(Processing flow of user authentication termination device)
The flow of processing in the user authentication termination device will be described with reference to FIG. FIG. 29 is a flowchart illustrating the flow of processing in the user authentication termination apparatus according to the sixth embodiment.

  As illustrated in FIG. 29, the user authentication termination device 10 that has received the authentication request from the user terminal determines the order in which the user terminal authentication requests are transmitted according to a predetermined condition (step S400). At this time, the user authentication termination device 10 searches the user information DB using the port number that received the authentication request as a search key, or specifies the user information of the user who transmitted the authentication request from the information received from the user terminal. To do.

  Subsequently, when the authentication request is transmitted to the authentication server in the determined order, the user authentication termination device 10 determines whether the authentication server to be transmitted is a basic authentication device or an associative authentication device. The determination is made from the authentication device type information DB (step S401).

  Then, the user authentication termination device 10 determines an authentication identifier for identifying authentication information used for authentication by the authentication server for the authentication server determined to be a basic authentication device (Yes in step S401) and the authentication device type information DB and It identifies from the information received from the user information DB and the user terminal, and creates and transmits an authentication request including these (step S402 and step S403).

  Thereafter, the user authentication termination device 10 receives the authentication result from the authentication server to which the authentication request has been transmitted (step S404). When the received authentication result indicates that the authentication is permitted (Yes at step S405), the user authentication termination device 10 determines whether the authentication result has been received from all the authentication servers (step S406).

  Then, when all the authentication results received from all the authentication servers indicate that the authentication is permitted (Yes at Step S406), the user authentication termination device 10 transmits the authentication permitting the user terminal (Step S407).

  On the other hand, when the received authentication result is not authentication permission (No at Step S405), the user authentication termination device 10 transmits to reject authentication of the user terminal (Step S408). In addition, when the authentication result has not been received from all the authentication servers (No at Step S406), the user authentication termination device 10 determines the next authentication server in the determined order (Step S409), and the processes after Step S401 repeat.

  On the other hand, returning to step S401, the user authentication termination device 10 specifies the association destination of the authentication server from the authentication device type information DB for the authentication server determined to be an associative authentication device (No at step S401) ( Step S410).

  Thereafter, the user authentication termination device 10 specifies a first identifier indicating a part of the authentication identifier used for authentication by the authentication server from the authentication device type information DB, the user information DB, and the information received from the user terminal, and authentication. A second identifier indicating a part of the identifier is specified from information received in advance from the authentication server of the association destination (step S411). Then, the user authentication termination device 10 combines the identified first identifier and second identifier to generate an authentication identifier, and creates an authentication request including this (step S412). Thereafter, the processing of step S403 to step S409 is executed.

(Processing flow in the authentication information cache server of the authentication server 2)
A processing flow in the authentication information cache server of the authentication server 2 will be described with reference to FIG. FIG. 30 is a flowchart illustrating a process flow in the authentication information cache server of the authentication server 2 according to the sixth embodiment.

  As illustrated in FIG. 30, the authentication information cache server of the authentication server 2 that has received the authentication request from the user authentication termination device 10 acquires the authentication identifier from the received authentication request, and stores the authentication identifier in the cache in association with the acquired authentication identifier. The attribute information to be searched is searched (step S450 and step S451).

  Subsequently, the authentication information cache server of the authentication server 2 uses the authentication information (attribute information) acquired from the cache when the authentication information associated with the authentication identifier exists in the cache (Yes in step S452). Authentication is performed (step S453).

  Then, the authentication information cache server of the authentication server 2 permits authentication of the authentication result when all or part of the “attribute information” acquired from the authentication request is included in the “attribute information” acquired from the cache. (Yes in step S454), the authentication permission is returned to the user authentication termination device 10 (step S455). At this time, if the authentication information cache server stores “authentication identifier group” in the cache in association with the authentication identifier included in the received authentication request, the authentication information cache server associates “authentication identifier, authentication identifier group” with each other. Send.

  Further, the authentication information cache server of the authentication server 2 rejects the authentication result when the “attribute information” acquired from the cache does not include all or part of the “attribute information” acquired from the authentication request. (No in step S454), and the authentication rejection is returned to the user authentication termination device 10 (step S456).

  On the other hand, returning to step S452, if the authentication information associated with the authentication identifier does not exist in the cache (No at step S452), the authentication information cache server of the authentication server 2 obtains the authentication information corresponding to the authentication identifier. (Search request) is transmitted to the authentication information database server of the authentication server 2 (step S457).

  Then, the authentication information cache server of the authentication server 2 receives the authentication information from the authentication information database server (step S458). If there is a search result (no authentication information) (Yes in step S459), the authentication information cache server caches the authentication information. (Step S460), and the processing after step S453 is executed. If there is no search result (no authentication information) (No at step S459), the authentication information cache server responds to the user authentication termination device 10 with an authentication rejection (step S456).

  Further, since the authentication information cache server of the authentication server 3 that is the associative authentication device receives the authentication request including the new authentication identifier described in the first to sixth embodiments, the authentication request is received when the authentication request is received. A new authentication identifier is acquired from the above, and the processing from step S165 to step S174 is performed in the same manner as in the first embodiment using the new authentication identifier.

  Although the embodiments of the present invention have been described so far, the present invention may be implemented in various different forms other than the embodiments described above.

(Configuration of authentication server)
For example, the authentication server may be realized by a single housing having a function of an authentication information cache server and a function of an authentication information database server. Further, the authentication information cache server and the authentication information database server may be realized in separate cases. Furthermore, the authentication server may be composed of one or more authentication information cache servers and an authentication information database server. Moreover, you may comprise with one authentication server which has several authentication identifier classification.

(Authentication identifier group search method)
For example, the authentication information cache server may search only the authentication identifier group to which the authentication identifier belongs, or may search all or part of the attribute information corresponding to the authentication identifier in addition to the authentication identifier group. In addition, the authentication information cache server has been described as an example in which the authentication identifier and attribute information registered in the authentication information database server are registered in the cache. However, the inquired identifier is registered in the authentication information database server. It may be possible to register that there is nothing. In this case, a flag indicating whether or not the information is registered on the authentication information database server is prepared in the cache of the authentication information cache server. When the authentication information cache server searches the cache, the authentication information cache server checks the flag to reduce the access frequency to the authentication information database server regardless of the presence or absence on the authentication information database server. Good.

(Authentication identifier group transmission method)
For example, in the above-described embodiment, the example in which the authentication identifier and the authentication identifier group are exchanged between the user authentication termination device and the authentication server has been described. As described above, when an authentication identifier or an authentication identifier group is exchanged between the user authentication termination device and the authentication server, part of the information transmitted from the user authentication termination device to the authentication server, all of the transmitted information, or these A combination of these can also be used as an authentication identifier. Furthermore, information converted from information transmitted from the user authentication termination device to the authentication server using a conversion table or function can be combined and used as an authentication identifier. In this case, the converted information and information transmitted from the user authentication termination device to the authentication server may be combined.

(RADIUS attribute value)
For example, in the above-described embodiment, the User-Name attribute value is used as the RADIUS attribute value, but the present invention is not limited to this. For example, a NAS-Port-Id attribute value, a NAS-Port attribute value, a NAS-IP-Address attribute value may be used, or a combination thereof may be used. Moreover, it is not limited to these, Arbitrary RADIUS attribute values can also be used. Further, the RADIUS attribute value may be used as it is, or a value converted by a function or the like may be used.

  Further, for example, in the above-described embodiment, whether the authentication is permitted or not is determined using the value of the User-Password attribute value received from the user authentication termination device, but the present invention is not limited to this. For example, whether or not a specific RADIUS attribute is included or not included in an Access-Request message may be used as an authentication criterion. It is good also as an authentication judgment standard. The authentication identifier may be assigned to a user or a user group.

(Certification order)
For example, in the above-described embodiment, the case where the authentication order is determined in advance has been described, but the present invention is not limited to this. For example, the order in which authentication is performed can be determined so that information acquired by searching a table performed by one server or a cache in which the acquired information is registered can be used by the other server. Specifically, the order can be determined so that the basic authentication device authenticates before the associative authentication device. If the authentication information cache server registers authentication information in the authentication information database server only for an authentication request from the user authentication terminal device, the basic authentication device is performed in advance for the associative authentication device. In both cases of the authentication request from the user authentication termination device and the authentication identifier group search request from the associative authentication device, authentication can be performed in an arbitrary order.

(Authentication judgment method)
For example, in the above-described embodiment, the authentication permission or the authentication rejection is determined based on whether or not the “attribute information” corresponding to the “authentication identifier” matches, but the present invention is not limited to this. For example, in the case where a plurality of “attribute information” is associated with “authentication identifier”, it can be determined that authentication is permitted only when all “attribute information” matches. It is also possible to determine that authentication is permitted when the “information” matches. It is also possible to specify “attribute information” to be compared from a plurality of “attribute information” in “authentication identifier” and perform the above-described determination.

(Specific information)
For example, in the above-described embodiment, the authentication information cache server B40 has described an example of receiving an authentication request including “authentication identifier”, “attribute information”, and “specific information” from the user authentication termination device. It is not limited to this. For example, the authentication information cache server B40 may receive “specific information” as part of “attribute information”. That is, in the authentication system disclosed in the present application, it is not necessary to strictly distinguish “specific information” and “attribute information”. Therefore, the user authentication termination device can transmit an authentication request including “specific information” in “attribute information” to the authentication information cache server, and the authentication information cache server also receives “attribute information” from the received authentication request. It is also possible to acquire “specific information” from “attribute information”. In the authentication system disclosed in the present application, a part of “attribute information” can be used as “specific information”.

  Furthermore, although the example in which the authentication identifier (authentication identifier = user ID used by the authentication information cache server A20 in the above-described embodiment) matches the specific information (= user ID) has been described, the present invention is limited to this. Instead, the authentication identifier and the specific information may be completely different information. In this case, for example, the basic authentication device such as the authentication information cache server A20 maintains a table in which the “second identifier (authentication identifier group)” and the “specific information” are associated with each other. The same processing as the example can be performed.

(Associative authentication device)
For example, in the embodiment described above, the case has been described in which the associative authentication device acquires the “second identifier (authentication identifier group)” from the basic authentication device of the association destination, but the present invention is not limited to this. For example, the associative authentication device may function as an associative destination of another associative authentication device. In this case, the associative authentication device may hold a “second identifier (authentication identifier group)” associated with “specific information” like the authentication information cache server A20.

(System configuration etc.)
In addition, among the processes described in this embodiment, all or a part of the processes described as being automatically performed (for example, voice recognition process) can be manually performed, or manually. All or part of the processing described as being performed can be automatically performed by a known method. In addition, the processing procedure, control procedure, specific name, and information including various data and parameters shown in the above-described document and drawings can be arbitrarily changed unless otherwise specified. Further, for example, the authentication system may be a system including a user authentication termination device, one or more basic authentication devices, and one or more associative authentication devices, or one or more basic authentication devices and one or more associative devices. A system including an authentication device may be used.

  Further, each component of each illustrated apparatus is functionally conceptual, and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. Further, all or any part of each processing function performed in each device may be realized by a CPU and a program analyzed and executed by the CPU, or may be realized as hardware by wired logic. In the authentication device described above, the authentication type that is information regarding whether the device itself is a basic authentication device or an associative authentication device may be information that is determined at the time of initial setting or at the time of startup, etc. The procedure of sequentially identifying each time a request is received may be omitted.

(program)
Note that the authentication method and authentication apparatus described in the present embodiment can be realized by executing a program prepared in advance on a computer such as a personal computer or a workstation. This program can be distributed via a network such as the Internet. The program can also be executed by being recorded on a computer-readable recording medium such as a hard disk, a flexible disk (FD), a CD-ROM, an MO, and a DVD, and being read from the recording medium by the computer.

  As described above, the authentication device, the authentication method, the authentication program, and the authentication system according to the present invention include a user authentication termination device that receives an authentication request from a user terminal, and a user authentication process in response to an authentication request from the user authentication termination device. It is useful for a system that includes a plurality of authentication devices that implement the authentication, and is particularly suitable for reducing the area for storing authentication information and improving the performance of the entire authentication system.

10 User Authentication Termination Device 11 Communication Control I / F Unit 12 Storage Unit 12a User Information DB
12b Authentication order DB
12c Authentication device type information DB
13 Control unit 13a Order determination unit 13b Device type determination unit 13c Basic authentication request unit 13d Associative authentication request unit 13e Authentication result transmission unit 20 Authentication information cache server A
21 Communication Control I / F Unit 22 Storage Unit 22a Cache 22b Authentication Device Type Information DB
23 control unit 23a cache determination unit 23b identifier transmission unit 23c authentication processing unit 30 authentication information database server A
31 Communication Control I / F Unit 32 Storage Unit 32a Authentication Information DB
33 Control unit 33a Cache response unit 40 Authentication information cache server B
41 Communication Control I / F Unit 42 Storage Unit 42a Cache 42b Authentication Device Type Information DB
43 Control Unit 43a Authentication Identifier Request Unit 43b Cache Determination Unit 43c Authentication Processing Unit 50 Authentication Information Database Server B
51 Communication Control I / F Unit 52 Storage Unit 52a Authentication Information DB
53 Control unit 53a Cache response unit

Claims (18)

An authentication device that performs user authentication processing in response to an authentication request received from a user authentication termination device that receives an authentication request from a user terminal,
Authentication information holding means for holding authentication information that associates the attribute identifier with an authentication identifier that specifies attribute information used by the authentication device for authentication;
Specific information holding means for holding another authentication identifier that is a part of an authentication identifier used by another authentication device for user authentication processing and specific information for specifying the other authentication identifier in association with each other;
When an authentication request is received from the user authentication termination device, an authentication identifier is acquired from the authentication request, and user authentication processing is performed using attribute information stored in the authentication information holding unit in association with the acquired authentication identifier Authentication means for transmitting an authentication result to the user authentication termination device;
An identifier transmitting means for acquiring another authentication identifier corresponding to the specific information specified according to a predetermined condition from the authentication information holding means and transmitting it to the other authentication device;
An authentication apparatus comprising: The authentication device is a device having a database server unit and a cache server unit,
The database server unit is
The authentication information holding means;
The specific information holding means;
An authentication identifier held in the authentication information holding unit when an authentication information acquisition request including an authentication identifier is received from the cache server unit and attribute information corresponding to the authentication identifier is held in the authentication information holding unit If the attribute information corresponding to the authentication identifier is not held in the authentication information holding means, the cache server unit is informed that the attribute information is not held. First response means for responding to the server unit;
When the authentication identifier acquisition request including the specific information is received from the cache server unit and another authentication identifier corresponding to the specific information is held in the specific information holding unit, the authentication information is held in the specific information holding unit. The other authentication identifier associated with the specific information is returned to the cache server unit, and the other authentication identifier corresponding to the specific information is not held in the specific information holding means, the other authentication identifier A second response means for responding to the cache server unit that it does not hold
The cache server unit
Of the authentication information held in the authentication information holding unit of the database server unit, the authentication information used in the past and the information held in the specific information holding unit of the database server unit were used in the past. A cache holding means for holding information;
A cache that, when receiving an authentication request from the user authentication termination device, acquires an authentication identifier from the authentication request, and determines whether or not attribute information corresponding to the acquired authentication identifier is stored in the cache holding unit A determination means;
When the cache determination unit determines that the attribute information corresponding to the authentication identifier is held in the cache holding unit, the attribute information corresponding to the authentication identifier is acquired from the cache holding unit and the user authentication process is performed. And when the cache determination unit determines that the attribute information corresponding to the authentication identifier is not held in the cache holding unit, the attribute information corresponding to the authentication identifier is acquired from the database server unit. Authentication means for performing user authentication processing,
When another authentication identifier corresponding to specific information specified according to a predetermined condition is held in the cache holding unit, the other authentication identifier is acquired from the cache holding unit and the other authentication identifier is acquired. When the other authentication identifier corresponding to the specific information specified in accordance with a predetermined condition is not held in the cache holding unit, the other authentication identifier is acquired from the database server unit. Identifier transmitting means for transmitting to the other authentication device
The authentication apparatus according to claim 1, further comprising:   The identifier transmitting unit obtains another authentication identifier corresponding to the specific information when the cache holding unit or the database server unit searches for another authentication identifier corresponding to the specific information included in the authentication request. The authentication apparatus according to claim 2, wherein the authentication apparatus transmits to the other authentication apparatus.   When the identifier transmission unit receives the acquisition request for the other authentication identifier from the other authentication device, the identifier transmission unit displays the other authentication identifier corresponding to the specific information included in the acquisition request as the cache holding unit or the database. The authentication apparatus according to claim 2, wherein the authentication apparatus is acquired from a server unit and directly transmitted to the other authentication apparatus without passing through the user authentication termination apparatus.   When the authentication request is received from the user authentication termination device, the identifier transmission unit acquires another authentication identifier corresponding to the specific information included in the authentication request from the cache holding unit or the database server unit. The authentication apparatus according to claim 2, wherein the authentication apparatus transmits to the user authentication termination apparatus. An authentication method suitable for an authentication apparatus that performs user authentication processing in response to an authentication request received from a user authentication termination apparatus that receives an authentication request from a user terminal,
When an authentication request is received from the user authentication termination device, an authentication identifier is acquired from the authentication request, and authentication information for identifying attribute information used by the authentication device for authentication is associated with the attribute information. An authentication step of performing user authentication processing using attribute information stored in association with the acquired authentication identifier from the authentication information holding unit holding the authentication information, and transmitting an authentication result to the user authentication termination device;
Identifies other authentication identifiers corresponding to specific information specified according to a predetermined condition, other authentication identifiers that are a part of authentication identifiers used by other authentication devices for user authentication processing, and the other authentication identifiers An identifier transmission step of acquiring from the authentication information holding unit that holds the specific information in association with each other and transmitting it to the other authentication device;
The authentication method characterized by including. An authentication device that performs user authentication processing in response to an authentication request received from a user authentication termination device that receives an authentication request from a user terminal,
Authentication information holding means for holding authentication information that associates the attribute identifier with an authentication identifier that specifies attribute information used by the authentication device for authentication;
When an authentication request is received from the user authentication termination device, a first identifier indicating a part of the authentication identifier and specific information specifying a second identifier indicating a part of the authentication identifier are received from the authentication request. An identifier acquisition means for acquiring the second identifier from another authentication device specified by device information acquired and held in advance;
Using attribute information stored in the authentication information holding unit in association with a new authentication identifier using the second identifier acquired by the identifier acquisition unit and the first identifier acquired from the authentication request. Authentication means for performing user authentication processing and transmitting an authentication result to the user authentication termination device;
An authentication apparatus comprising: The authentication device is a device having a database server unit and a cache server unit,
The database server unit is
The authentication information holding means;
An authentication identifier held in the authentication information holding unit when an authentication information acquisition request including an authentication identifier is received from the cache server unit and attribute information corresponding to the authentication identifier is held in the authentication information holding unit If the authentication information associated with the authentication information is not held in the authentication information holding means in response to the cache server unit and attribute information corresponding to the authentication identifier is not held in the authentication information holding means, Response means for responding to the cache server part of the device,
The cache server unit
Among the authentication information held in the authentication information holding means of the database server unit, a cache holding means for holding authentication information used in the past,
When an authentication request is received from the user authentication termination device, an identifier acquisition unit that acquires the second identifier from the other authentication device, a second identifier acquired by the identifier acquisition unit, and the authentication request Cache determination means for determining whether or not attribute information corresponding to a new authentication identifier using the first identifier included in is stored in the cache holding means;
If the cache determination unit determines that the attribute information corresponding to the new authentication identifier is held in the cache holding unit, the attribute information corresponding to the new authentication identifier is acquired from the cache holding unit. When the cache authentication unit determines that the attribute information corresponding to the new authentication identifier is not held in the cache holding unit, the user authentication process is performed. Authentication means for acquiring attribute information from the database server unit and performing user authentication processing;
The authentication apparatus according to claim 7, further comprising:   The identifier acquisition unit of the cache server unit transmits the specific information to the other authentication device when receiving an authentication request from the user authentication termination device, and the second identifier from the other authentication device. The authentication apparatus according to claim 8, wherein the authentication device is directly acquired.   When the cache determination unit of the cache server unit receives an authentication request including the first identifier and the second identifier from the user authentication termination device, the cache determination unit uses the first identifier and the second identifier. 9. The authentication apparatus according to claim 8, wherein it is determined whether or not attribute information corresponding to the new authentication identifier has been stored in the cache holding unit.   When the cache determination unit of the cache server unit receives an authentication request including a new authentication identifier using the first identifier and the second identifier from the user authentication termination device, the cache determination unit uses the new authentication identifier. 9. The authentication apparatus according to claim 8, wherein it is determined whether or not corresponding attribute information is stored in the cache holding unit. An authentication method suitable for an authentication apparatus that performs user authentication processing in response to an authentication request received from a user authentication termination apparatus that receives an authentication request from a user terminal,
When an authentication request is received from the user authentication termination device, a first identifier indicating a part of the authentication identifier and specific information specifying a second identifier indicating a part of the authentication identifier are received from the authentication request. An identifier acquisition step of acquiring the second identifier from another authentication device specified by the device information acquired and held in advance;
Authentication that specifies attribute information used for authentication by the authentication device in association with a new authentication identifier using the second identifier acquired by the identifier acquisition step and the first identifier acquired from the authentication request An authentication step of performing user authentication processing using attribute information stored in an authentication information holding unit holding authentication information in which an identifier is associated with the attribute information, and transmitting an authentication result to the user authentication termination device; ,
The authentication method characterized by including.   An authentication program for causing a computer to execute each means constituting the authentication apparatus according to any one of claims 1 to 5 and claims 7 to 11. A user authentication termination device that receives an authentication request from a user terminal, a basic authentication device that can perform authentication processing using information in the device itself, and an associative authentication device that performs authentication processing using information of another device An authentication system comprising:
The user authentication termination device is:
Order determination means for determining the order of transmitting authentication requests of the user terminal according to a predetermined condition when an authentication request is received from the user terminal;
An apparatus for determining whether an authentication apparatus to be transmitted is the basic authentication apparatus or the associative authentication apparatus when transmitting authentication requests to the authentication apparatus in the order determined by the order determination means Type determination means;
A first authentication requesting means for transmitting an authentication request including an authentication identifier for identifying authentication information used by the authentication apparatus for authentication to the authentication apparatus determined by the apparatus type determination means to be a basic authentication apparatus;
For an authentication device that is determined to be an associative authentication device by the device type determination means, a first identifier indicating a part of an authentication identifier used by the authentication device for authentication, and a first identifier indicating a part of the authentication identifier A second authentication requesting means for transmitting an authentication request including specific information for identifying the second identifier;
Authentication result transmitting means for permitting authentication of the user terminal when all authentication results received from the authentication apparatus to which the authentication request has been transmitted by the first authentication requesting means or the second authentication requesting means are authentication permission When,
The basic authentication device is:
Authentication information holding means for holding authentication information that associates the attribute identifier with an authentication identifier that specifies attribute information used by the authentication device for authentication;
Specific information holding means for holding the second identifier and the specific information in association with each other;
When an authentication request is received from the user authentication termination device, an authentication identifier is acquired from the authentication request, and user authentication processing is performed using attribute information stored in the authentication information holding unit in association with the acquired authentication identifier Authentication means for transmitting an authentication result to the user authentication termination device;
When the second identifier acquisition request is received from another authentication device that performs user authentication processing using the second identifier, the second identifier corresponding to the specific information included in the acquisition request is An identifier transmitting means for acquiring from the specific information holding means and transmitting to the other authentication device,
The associative authentication device includes:
Authentication information holding means for holding authentication information that associates the attribute identifier with an authentication identifier that specifies attribute information used by the authentication device for authentication;
When the authentication request is received from the user authentication termination device, the first identifier and the specific information are acquired from the authentication request, and the other authentication device specified by the device information held in advance is Identifier acquisition means for acquiring the second identifier by transmitting a request for acquiring the second identifier specified by the specific information;
Using attribute information stored in the authentication information holding unit in association with a new authentication identifier using the second identifier acquired by the identifier acquisition unit and the first identifier acquired from the authentication request. Authentication means for performing user authentication processing and transmitting an authentication result to the user authentication termination device;
An authentication system comprising: A user authentication termination device that receives an authentication request from a user terminal, a basic authentication device that performs authentication processing using information in the own device, and an associative authentication device that performs authentication processing using information of another device An authentication system comprising:
The user authentication termination device is:
Order determination means for determining the order of transmitting authentication requests of the user terminal according to a predetermined condition when an authentication request is received from the user terminal;
An apparatus for determining whether an authentication apparatus to be transmitted is the basic authentication apparatus or the associative authentication apparatus when transmitting authentication requests to the authentication apparatus in the order determined by the order determination means Type determination means;
A first authentication requesting means for transmitting an authentication request including an authentication identifier for identifying authentication information used by the authentication apparatus for authentication to the authentication apparatus determined by the apparatus type determination means to be a basic authentication apparatus;
For an authentication device that is determined to be an associative authentication device by the device type determination means, a first identifier indicating a part of an authentication identifier used by the authentication device for authentication, and a first identifier indicating a part of the authentication identifier A second authentication request means for transmitting an authentication request including the second identifier;
Authentication result transmitting means for permitting authentication of the user terminal when all authentication results received from the authentication apparatus to which the authentication request has been transmitted by the first authentication requesting means or the second authentication requesting means are authentication permission When,
The basic authentication device is:
Authentication information holding means for holding authentication information that associates the attribute identifier with an authentication identifier that specifies attribute information used by the authentication device for authentication;
Specific information holding means for holding the second identifier and specific information for specifying the second identifier in association with each other;
When an authentication request is received from the user authentication termination device, an authentication identifier is acquired from the authentication request, and user authentication processing is performed using attribute information stored in the authentication information holding unit in association with the acquired authentication identifier Authentication means for transmitting an authentication result to the user authentication termination device;
An identifier transmitting unit that acquires a second identifier corresponding to the specific information included in the authentication request from the authentication information holding unit and transmits the second identifier to the user authentication termination device;
The associative authentication device includes:
Authentication information holding means for holding authentication information that associates the attribute identifier with an authentication identifier that specifies attribute information used by the authentication device for authentication;
An identifier acquisition means for acquiring the first identifier and the second identifier from the authentication request when an authentication request is received from the user authentication termination device;
User authentication processing is performed using attribute information stored in the authentication information holding means in association with a new authentication identifier using the first identifier and the second identifier acquired by the identifier acquisition means. Authentication means for transmitting an authentication result to the user authentication termination device;
An authentication system comprising: A user authentication termination device that receives an authentication request from a user terminal, a basic authentication device that performs authentication processing using information in the own device, and an associative authentication device that performs authentication processing using information of another device An authentication system comprising:
The user authentication termination device is:
Order determination means for determining the order of transmitting authentication requests of the user terminal according to a predetermined condition when an authentication request is received from the user terminal;
An apparatus for determining whether an authentication apparatus to be transmitted is the basic authentication apparatus or the associative authentication apparatus when transmitting authentication requests to the authentication apparatus in the order determined by the order determination means Type determination means;
A first authentication requesting means for transmitting an authentication request including an authentication identifier for identifying authentication information used by the authentication apparatus for authentication to the authentication apparatus determined by the apparatus type determination means to be a basic authentication apparatus;
For an authentication device that is determined to be an associative authentication device by the device type determination means, a first identifier indicating a part of an authentication identifier used by the authentication device for authentication, and a first identifier indicating a part of the authentication identifier A second authentication request means for transmitting an authentication request including a new authentication identifier using the second identifier;
Authentication result transmitting means for permitting authentication of the user terminal when all authentication results received from the authentication apparatus to which the authentication request has been transmitted by the first authentication requesting means or the second authentication requesting means are authentication permission When,
The basic authentication device is:
Authentication information holding means for holding authentication information that associates the attribute identifier with an authentication identifier that specifies attribute information used by the authentication device for authentication;
Specific information holding means for holding the second identifier and specific information for specifying the second identifier in association with each other;
When an authentication request is received from the user authentication termination device, an authentication identifier is acquired from the authentication request, and user authentication processing is performed using attribute information stored in the authentication information holding unit in association with the acquired authentication identifier Authentication means for transmitting an authentication result to the user authentication termination device;
An identifier transmitting unit that acquires a second identifier corresponding to the specific information included in the authentication request from the authentication information holding unit and transmits the second identifier to the user authentication termination device;
The associative authentication device includes:
Authentication information holding means for holding authentication information that associates the attribute identifier with an authentication identifier that specifies attribute information used by the authentication device for authentication;
An identifier acquisition means for acquiring a new authentication identifier included in the authentication request when an authentication request is received from the user authentication termination device;
Authentication means for performing user authentication processing using attribute information stored in the authentication information holding means in association with the new authentication identifier acquired by the identifier acquisition means, and transmitting an authentication result to the user authentication termination device When,
An authentication system comprising: A user authentication termination device that receives an authentication request from a user terminal, a basic authentication device that can perform authentication processing using information in the device itself, and an associative authentication device that performs authentication processing using information of another device An authentication system comprising:
The user authentication termination device is:
Order determination means for determining the order of transmitting authentication requests of the user terminal according to a predetermined condition when an authentication request is received from the user terminal;
An apparatus for determining whether an authentication apparatus to be transmitted is the basic authentication apparatus or the associative authentication apparatus when transmitting authentication requests to the authentication apparatus in the order determined by the order determination means Type determination means;
A first authentication requesting means for transmitting an authentication request including an authentication identifier for identifying authentication information used by the authentication apparatus for authentication to the authentication apparatus determined by the apparatus type determination means to be a basic authentication apparatus;
For an authentication device that is determined to be an associative authentication device by the device type determination means, a first identifier indicating a part of an authentication identifier used by the authentication device for authentication, and a first identifier indicating a part of the authentication identifier A second authentication requesting means for transmitting an authentication request including specific information for identifying the second identifier;
Authentication result transmitting means for permitting authentication of the user terminal when all authentication results received from the authentication apparatus to which the authentication request has been transmitted by the first authentication requesting means or the second authentication requesting means are authentication permission When,
The basic authentication device is:
Authentication information holding means for holding authentication information that associates the attribute identifier with an authentication identifier that specifies attribute information used by the authentication device for authentication;
Specific information holding means for holding the second identifier and the specific information in association with each other;
When an authentication request is received from the user authentication termination device, an authentication identifier is acquired from the authentication request, and user authentication processing is performed using attribute information stored in the authentication information holding unit in association with the acquired authentication identifier Authentication means for transmitting an authentication result to the user authentication termination device;
When the second identifier corresponding to the specific information included in the authentication request received from the user authentication termination device is retrieved from the cache holding unit or the database server unit, the second identifier corresponding to the specific information is An identifier transmission unit that is acquired from the specific information holding unit and transmits to another authentication device that performs user authentication processing using the second identifier,
The associative authentication device includes:
Authentication information holding means for holding authentication information that associates the attribute identifier with an authentication identifier that specifies attribute information used by the authentication device for authentication;
When receiving an authentication request from the user authentication termination device, identifier acquisition means for acquiring a first identifier from the authentication request;
Attribute information stored in the authentication information holding unit in association with a new authentication identifier using the first identifier acquired by the identifier acquisition unit and the second identifier received from the basic authentication device. Authenticating means for performing user authentication processing using and transmitting an authentication result to the user authentication termination device;
An authentication system comprising: An authentication system having a basic authentication device and an associative authentication device for performing user authentication processing in response to an authentication request received from a user authentication termination device that receives an authentication request from a user terminal, wherein the basic authentication device comprises: The authentication system according to claim 1, wherein the associative authentication device is the authentication device according to claim 7.

Images