JP2012003338A - Authentication system, authentication proxy server, control program, and authentication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication system, an authentication proxy server, a control program, and an authentication method for executing authentication without notifying the other device of user identification information via a network which is open to a third person.SOLUTION: This authentication system includes: an application (APL) use terminal 10; an authentication proxy server 20 connected to the APL use terminal 10 and the Intranet 50 for executing the authentication of the APL use terminal 10; an APL server 30 connected to a network 60; and an authentication server 40 connected to the network 60 for storing an authentication execution result. The authentication proxy server 20 executes the authentication based on user identification information output from the APL use terminal 10, and transmits an authentication execution result to the APL use terminal 10 and the authentication server 40. The APL server 30 determines APL provision possibility/impossibility with respect to the APL use terminal 10 by using the acquired authentication execution result.

Description

  The present invention relates to an authentication system, an authentication proxy server, a control program, and an authentication method, and in particular, an authentication system used to determine whether an application can be provided, an authentication proxy server used in the authentication system, a control program used in the authentication proxy server, and The present invention relates to an authentication method in an authentication system.

  Generally, the software is configured such that all functions necessary for all users are collected and the same functions can be provided to all users. Such software is redundant with many functions that are not necessary for a certain user. Therefore, such a user pays for a function that is not necessary. Therefore, a software distribution form called SaaS (Software as a service) in which each user can use only a function that is really necessary on demand and pay only for the function has been attracting attention.

  Specifically, SaaS is a software distribution form in which only the functions required by the user are distributed among the functions of the software so that only the functions required by the user can be used. By doing in this way, the user can pay only the charge according to the function to utilize. Moreover, there are the following two forms as a form in which the user uses the software. As a first usage mode, the user can use the software by downloading a necessary function and installing it in his / her terminal. As a second usage mode, the user can use the function of the software operating on the server online via the network.

  In SaaS, the application server can provide an application only to an authenticated user. There is single sign-on as an authentication method in SaaS. Single sign-on is an authentication method that allows a user to use all permitted functions once authenticated. Here, two single sign-on systems will be described with reference to FIGS.

  First, single sign-on using the agent module method will be described with reference to FIG. The SaaS user terminal 100 logs into the single sign-on (SSO) infrastructure 120 via the Internet 150. The SSO infrastructure 120 is arranged in the SaaS data center 110. The SSO infrastructure 120 generates a token using the user ID and password transmitted from the SaaS user terminal 100. The token is associated with an APL-ID that identifies the application and an APL user ID that identifies the SaaS user terminal 100. The SSO infrastructure 120 transmits the generated token to the SaaS user terminal 100.

  The SaaS user terminal 100 accesses the application server 140 using the token transmitted from the SSO infrastructure 120. The application server 140 is arranged in the application data center 130. Based on the access from the SSO user terminal 100, the application server 140 makes an authentication request to the SSO infrastructure 120. The authentication request includes a token transmitted from the Saas user terminal 100. The SSO infrastructure 120 extracts the APL user ID associated with the token included in the authentication request. The SSO infrastructure 120 transmits the extracted APL user ID to the application server 140. The application server 140 displays screen data for displaying a screen after login on the SaaS user terminal 100 when the APL user ID transmitted from the SaaS user terminal 100 and the SSO infrastructure 120 match. Send. Thereby, the Saas user terminal 100 can use the application provided by the application server 140.

  Next, single sign-on using the reverse proxy method will be described with reference to FIG. The same apparatus as that of FIG. 5 is described with the same reference numerals. The SaaS user terminal 100 logs into the single sign-on (SSO) infrastructure 120 via the Internet 150. The SSO infrastructure 120 logs into the application server 140 using the user ID and password transmitted from the SaaS user terminal 100. Furthermore, the SSO infrastructure 120 also transmits the IP address of the SaaS user terminal 100 to the application server 140 at the time of login. In this case, the SSO platform 120 logs into the application server 140 via the Internet 150. The application server 140 performs authentication using the user ID and password of the SaaS user terminal 100 transmitted from the SSO infrastructure 120. When the user ID and password match the user ID and password for identifying the SaaS user terminal 100 registered in advance, screen data for displaying the screen after login is transmitted to the SaaS user terminal 100. To do. Thereby, the Saas user terminal 100 can use the application provided by the application server 140.

  Patent Document 1 discloses a usage form of identification information (ID) in a system capable of simultaneously logging in to a plurality of services on an intranet and the Internet. Specifically, a terminal connected to the intranet first inputs an ID. If the intranet server does not have an intranet account corresponding to the input ID, the server logs in to the service provided by the application server on the Internet using the input ID. When there is an intranet account corresponding to the input ID, the user logs in to the application server on the Internet using another ID obtained by converting the input ID.

JP 2006-92039 A

  However, the above-described agent module method, reverse pro method, and the technique disclosed in Patent Document 1 have the following problems. In order to receive authentication, a terminal receiving service provision needs to notify an SSO base or an application server of an ID and password for identifying itself. However, the SSO platform and the application server are connected to the Internet, which is a network open to third parties. Therefore, when the ID and password are notified to the SSO base or the application server via the Internet, there arises a problem that a third party can obtain the ID and password illegally. In order to prevent this, there are technologies such as SSL (Secure Socket Layer) and VPN (Virtual Private Network) that encrypt data on the Internet and transmit it. However, since the ID and password are transmitted via the Internet, it cannot be completely guaranteed that the ID and password are not obtained illegally by a third party.

  The present invention has been made to solve such a problem, and the user ID and password, which are user-specific identifiers, are authenticated without being notified to other devices via an open network to a third party. It is an object to provide an authentication system, an authentication proxy server, a control program, and an authentication method.

  The authentication system according to the first aspect of the present invention includes an application using terminal, an authentication proxy server connected to the intranet to which the application using terminal is connected, and executing authentication of the application using terminal, and the intranet. An authentication server connected to a different network and providing an application to the application using terminal; and an authentication server connected to a network different from the intranet and holding an authentication execution result in the authentication proxy server. The server performs authentication based on the first user identification information output from the application using terminal, transmits an authentication execution result in the authentication to the application using terminal and the authentication server, and transmits the application. Deployment server, and the application user terminal, by using the authentication execution result with the authentication server, which determines the application provision adequacy for the application use terminal.

  An authentication proxy server according to a second aspect of the present invention includes: an authentication function unit that performs authentication based on first user identification information output from an application using terminal via an intranet; and authentication execution in the authentication function unit An authentication server cooperation unit that outputs a result to the application using terminal via the intranet and outputs to the authentication server that manages the authentication execution result via a network different from the intranet. is there.

  The control program according to the third aspect of the present invention includes a step of executing authentication based on first user identification information output from an application using terminal via an intranet, and an authentication execution result in the step of executing the authentication Are output to an authentication server that manages the authentication execution result via a network different from the intranet, and the authentication execution result is output to the application using terminal via the intranet. This is executed by the computer of the proxy server.

  An authentication method according to a fourth aspect of the present invention includes a step of executing authentication of the application using terminal using first user identification information transmitted from the application using terminal via an intranet, and executing the authentication Transmitting the authentication execution result in step to the application using terminal and an authentication server connected to a network different from the intranet, and from the application using terminal and the authentication server, the intranet Determining whether or not an application can be provided to the application using terminal using the authentication execution result transmitted via a different network.

  According to the present invention, an authentication system, an authentication proxy server, a control program, and an authentication method for performing authentication without a user ID and password, which are user-specific identifiers, being notified to other devices via an open network to a third party Can be provided.

1 is a configuration diagram of an authentication system according to a first exemplary embodiment; 1 is a configuration diagram of an authentication system according to a first exemplary embodiment; 1 is a configuration diagram of a single sign-on base according to a first embodiment; 3 is a sequence for performing authentication in the authentication system according to the first exemplary embodiment; It is a block diagram of the authentication system using an agent module system. It is a block diagram of the authentication system using a reverse proxy system.

(Embodiment 1)
Embodiments of the present invention will be described below with reference to the drawings. The authentication system according to the first exemplary embodiment of the present invention includes an application use terminal 10, an authentication proxy server 20, an application server 30, and an authentication server 40.

  The application using terminal 10 is a terminal that uses an application provided from the application server 30. The application using terminal 10 may download and use an application provided from the application server 30, or may use an application operating on the application server 30 online. The application using terminal 10 is connected to the intranet 50. Furthermore, the application using terminal 10 can communicate with the application server 30 via the network 60. In this case, the application using terminal 10 may not be directly connected to the network 60 but may be connected to the network 60 via a proxy server or the like.

  The authentication proxy server 20 is connected to the same intranet 50 as the intranet to which the application using terminal 10 is connected. The authentication proxy server 20 performs authentication of the application using terminal 10. That is, the authentication proxy server 20 determines whether or not the application use terminal 10 is a terminal that can use an application provided in the application server 30. The authentication proxy server 20 holds in advance information related to a terminal that is permitted to use an application provided in the application server 30 (hereinafter referred to as identification information). The identification information may be directly input to the authentication proxy server 20, or may be periodically acquired from another server device (not shown) connected to the intranet 50.

  The application server 30 is connected to a network 60 that is different from the intranet 50. The application server 30 provides an application to the application using terminal 10. The provided application may be downloaded to the application use terminal 10 in response to a use request from the application use terminal 10, operates on the application server 30, and may be used online by the application use terminal 10.

  The authentication server 40 is connected to a network 60 different from the intranet 50. The authentication server 40 holds the authentication execution result in the authentication proxy server 20. The authentication server 40 acquires the authentication execution result via the network 60.

  Next, a signal flow in the authentication system will be described. The application using terminal 10 outputs identification information for identifying the application using terminal 10 to the authentication proxy server 20 via the intranet 50. For example, the identification information is a user ID or a password.

  The authentication proxy server 20 performs authentication based on the identification information output from the application using terminal 10. For example, the authentication proxy server 20 determines whether or not the identification information of the application using terminal 10 held in advance matches the identification information output from the application using terminal 10. The authentication proxy server 20 transmits the authentication execution result to the application using terminal 10 and the authentication server 40. The authentication execution result may be information such as authentication OK or authentication NG, or may be new identification information used when the application using terminal 10 connects to the application server 30.

  The application server 30 uses the authentication execution result of the application using terminal 10 and the authentication server 40 to determine whether or not an application can be provided to the application using terminal 10. The application server 30 makes an application use request from the application using terminal 10 via the network 60. The application use request includes an authentication execution result.

  The application server 30 requests the authentication server 40 to transmit the authentication execution result of the application using terminal 10 in response to the application use request from the application using terminal 10. The application server 30 requests the authentication server 40 to transmit an authentication execution result via the network 60. Alternatively, the authentication server 40 may transmit the authentication execution result to the application server 30 before the authentication execution result request is made from the application server 30.

  When the contents of the authentication execution results acquired from the application using terminal 10 and the authentication server 40 match, the application server 30 provides an application to the application using terminal 10. If the contents of the authentication execution results acquired from the application using terminal 10 and the authentication server 40 do not match, the application server 30 does not provide an application to the application using terminal 10.

  As described above, by using the authentication system according to FIG. 1, the identification information input in the application using terminal 10 is not output to the application server 30 and the authentication server 40, and the application server 30 Whether or not provision is possible can be determined. That is, the identification information input at the application using terminal 10 is transmitted / received only within the intranet 50 that blocks external access. Therefore, the identification information input by the application using terminal 10 is not output to the network 60. The application server 30 uses the authentication result information generated in the authentication proxy server 20 to determine whether the application can be provided. Therefore, a third party who uses the network 60 cannot acquire the identification information of the application using terminal 10.

  Then, the detailed structural example of the authentication system concerning Embodiment 1 of this invention is demonstrated using FIG. The authentication system of FIG. 2 includes a SaaS user terminal 11, a single sign-on (SSO) proxy base 21, an ISV (Independent Software Vendor) data center 31, and a SaaS data center 41.

  The SaaS user terminal 11 and the SSO proxy base 21 are arranged in the corporate network 70. That is, the SaaS user terminal 11 and the SSO proxy base 21 are connected to the intranet 50 in the corporate network 70. Access from the outside of the corporate network 70 to the SaaS user terminal 11 and the SSO proxy base 21 is restricted. The ISV data center 31 and the SaaS data center 41 are connected to a network 60 open to a third party different from the intranet 50. For example, the network 60 open to a third party is the Internet.

  The SSO proxy infrastructure 21 includes an authentication function unit 22, a token generation function unit 23, and an SSO cooperation function unit 24. The ISV data center 31 has an application server 32. The SaaS data center 41 has an SSO infrastructure 42. In this figure, the description is based on the fact that the SaaS user terminal 11 is authenticated once to perform authentication by SSO that can use all applications permitted to be used in the ISV data center 31. To do.

  The SaaS user terminal 11 logs in to the SSO proxy infrastructure 21 when using the application. The SaaS user terminal 11 transmits a user ID and a password to the SSO proxy base 21 at the time of login. That is, the user ID and password are transmitted / received only within the corporate network 70 and are not transmitted to the Internet. Here, processing in the SSO proxy base 21 will be described with reference to FIG.

  The authentication function unit 22 has a user management table 25. The user management table 25 manages user IDs and passwords. In the user management table 25, user IDs and passwords associated with users or terminals are registered. A user or terminal that has entered a registered user ID and password can use an application in the ISV data center 31.

  The authentication function unit 22 determines whether or not the user ID and password acquired from the SaaS user terminal 11 are registered in the user management table 25. The authentication function unit 22 determines that the user ID and password acquired from the SaaS user terminal 11 are registered in the user management table 25, and when the authentication is completed, the authentication function unit 22 sends a token to the token generation function unit 23. Output generation request. The token generation request includes a user ID. If the authentication function unit 22 determines that the user ID and password acquired from the SaaS user terminal 11 are not registered in the user management table 25, the authentication function unit 22 may notify the SaaS user terminal 11 that authentication has not been performed. .

  The token generation function unit 23 has an application management table 26. The application management table 26 manages user IDs, APL-IDs, and APL user IDs. The APL-ID is an identifier of an application permitted to be used by the SaaS user terminal 11. The APL user ID is an identifier used when the SaaS user terminal 11 accesses the application server 32. The application management table 26 manages a user ID, an APL-ID, and an APL user ID in association with each other.

  The token generation function unit 23 extracts the APL-ID associated with the user ID output from the authentication function unit 22 and the APL user ID. The token generation function unit 23 generates a token that associates the extracted APL-ID and APL user ID with the time when the SaaS user terminal 11 logs into the SSO proxy infrastructure 21. The time when the user logs in the SSO proxy base 21 may be the time when the authentication function unit 22 completes the authentication, or the time when the SaaS user terminal 11 outputs the user ID and password to the authentication function unit 22. The token generation function unit 23 outputs a token information transmission request including the generated token to the SSO cooperation function unit 24.

  The SSO cooperation function unit 24 has a token management table 27. The token management table 27 manages tokens output from the token generation function unit 23. Specifically, the token management table 27 manages a token, a login time, an APL-ID, and an APL user ID in association with each other.

  When receiving the token information transmission request from the token generation function unit 23, the SSO cooperation function unit 24 transmits the token information to the SSO base 42. The token information transmitted to the SSO infrastructure 42 includes a token, an APL-ID, and an APL user ID. When the transmission of the token information to the SSO infrastructure 42 is completed, the SSO cooperation function unit 24 notifies the token generation function unit 23 of the completion of the transmission of token information. Further, when the token generation function unit 23 is notified of the completion of the token information transmission, the token generation function unit 23 notifies the authentication function unit 22 of the token generation completion. The token generation completion notification includes the token information transmitted by the SSO cooperation function unit 24. Upon obtaining the token generation completion notification, the authentication function unit 22 outputs token information to the browser of the SaaS user terminal 11.

  Here, the SSO cooperation function unit 24 may invalidate the generated token when a predetermined time has elapsed from the login time associated with the token. In this case, the SSO cooperation function unit 24 requests the SaaS user terminal 11 to input the user ID and password again via the authentication function unit 22. Further, the SSO cooperation function unit 24 transmits a token (for example, token2) generated based on the re-input user ID and password to the SSO infrastructure 42. The SSO infrastructure 42 may discard the held token (for example, token1) and register the newly transmitted token (token2).

  Returning to FIG. 2, the SaaS data center 41 has an SSO infrastructure 42. The SSO infrastructure 42 manages token information transmitted from the SSO cooperation function unit 24 via the network 60.

  The SaaS user terminal 11 uses a browser such as a Web browser in order to access the application server 32. The browser of the SaaS user terminal 11 accesses the application server 32 using the token information output from the authentication function unit 22. That is, the SaaS user terminal 11 transmits token information via the Internet.

  The ISV data center 31 has an application server 32. When accessed from the browser of the SaaS user terminal 11, the application server 32 acquires an APL user ID corresponding to the token and APL-ID transmitted from the SaaS user terminal 11 from the SSO infrastructure 42. The application server 32 permits the SaaS user terminal 11 to use the application when the APL user IDs transmitted from the SaaS user terminal 11 and the SSO infrastructure 42 match. When the APL user ID transmitted from the SaaS user terminal 11 and the SSO infrastructure 42 does not match, the application server 32 does not permit the SaaS user terminal 11 to use the application.

  Subsequently, a processing sequence in the authentication system will be described with reference to FIG. First, the SaaS user terminal 11 logs in to the SSO proxy base 21 connected to the intranet 50 using a browser (S11). The SSO proxy infrastructure 21 acquires a user ID and a password from the SaaS user terminal 11 when the SaaS user terminal 11 logs in. Next, the SSO proxy infrastructure 21 transmits token information to the SSO infrastructure 42 (S12). Further, the SSO proxy infrastructure 21 transmits the token information to the SSO infrastructure 42, and then transmits the token information to the SaaS user terminal 11 (S13).

  Next, the SaaS user terminal 11 accesses the application server 32 using the acquired token information (S14). Next, the application server 32 makes an authentication request for the SaaS user terminal 11 to the SSO infrastructure 42 (S15). The authentication request includes the token transmitted from the SaaS user terminal 11 and the APL-ID. Next, the SSO infrastructure 42 extracts the APL user ID corresponding to the token transmitted from the application server 32 and the APL-ID, and transmits it to the application server 32 (S16). Next, the application server 32 determines whether or not the APL user ID transmitted from the SaaS user terminal 11 and the SSO infrastructure 42 matches. When the APL user ID transmitted from the SaaS user terminal 11 and the SSO infrastructure 42 matches, the screen data is transmitted to the browser of the SaaS user terminal 11 so that the screen after login is displayed ( S17). Further, when the APL user ID transmitted from the SaaS user terminal 11 and the SSO platform 42 does not match, screen data indicating that login is not permitted may be transmitted.

  As described above, by using the authentication system according to the first embodiment of the present invention, a user ID and a password, which are user-specific identifiers, are transmitted to the application server and the authentication server via a network open to a third party. Without notifying the application server, the application server can determine whether the application can be provided.

  In addition, the SSO proxy base for executing authentication is connected to an intranet in the company. Therefore, even when the user ID and password are acquired by a third party of a company different from the user by some means, the third party cannot access the intranet. Therefore, even when a third party holds a user ID and a password, the third party cannot be authenticated on the SSO proxy base. Thereby, since the third party cannot acquire the APL user ID, the application in the application server cannot be used.

  In addition, even when a third party acquires token information on the network 60, the use of the application by the third party who acquired the token information can be forcibly stopped by setting an expiration date on the token. . For example, the SSO infrastructure 42 may validate the token only when the SaaS user terminal 11 is logged in to the SSO proxy infrastructure 21 and invalidate the token when logging out. Thereby, even if a malicious third party obtains the token information sent from the SSO proxy base 21 to the SSO base 42, the risk of unauthorized access to the application server 32 by the third party can be reduced.

  In the above-described embodiments, the present invention has been described as a hardware configuration, but the present invention is not limited to this. The present invention can also realize the SSO proxy-based processing described in FIG. 3 by causing a CPU (Central Processing Unit) to execute a computer program.

  In the above example, the program can be stored and supplied to a computer using various types of non-transitory computer readable media. Non-transitory computer readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media (for example, flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (for example, magneto-optical disks), CD-ROMs (Read Only Memory), CD-Rs, CD-R / W, semiconductor memory (for example, mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (Random Access Memory)) are included. The program may also be supplied to the computer by various types of transitory computer readable media. Examples of transitory computer readable media include electrical signals, optical signals, and electromagnetic waves. The temporary computer-readable medium can supply the program to the computer via a wired communication path such as an electric wire and an optical fiber, or a wireless communication path.

  Note that the present invention is not limited to the above-described embodiment, and can be changed as appropriate without departing from the spirit of the present invention.

DESCRIPTION OF SYMBOLS 10 Application use terminal 11 SaaS user terminal 20 Authentication proxy server 21 SSO proxy base 22 Authentication function part 23 Token generation function part 24 SSO cooperation function part 25 User management table 26 Application management table 27 Token management table 30 Application server 31 ISV data center 32 Application Server 40 Authentication Server 41 SaaS Data Center 42 SSO Platform 50 Intranet 60 Network

Claims (8)

Application using terminal,
An authentication proxy server that is connected to an intranet to which the application using terminal is connected and executes authentication of the application using terminal;
An application server connected to a network different from the intranet and providing an application to the application using terminal;
An authentication server connected to a network different from the intranet and holding an authentication execution result in the authentication proxy server,
The authentication proxy server is:
Performing authentication based on the first user identification information output from the application using terminal, and transmitting an authentication execution result in the authentication to the application using terminal and the authentication server;
The application server is
An authentication system that determines whether or not an application can be provided to the application using terminal using the authentication execution result of the application using terminal and the authentication server. The authentication proxy server is:
When the first user identification information acquired via the intranet matches the registered identification information registered in advance, second user identification information is generated, and the application using terminal is transmitted via the intranet. The authentication system according to claim 1, wherein the second user identification information is output, and the second user identification information is output to the authentication server via a network different from the intranet. The application server is
The authentication system according to claim 2, wherein the second user identification is acquired from the application using terminal and the authentication server via a network different from the intranet. An authentication function unit that performs authentication based on the first user identification information output from the application using terminal via the intranet;
Authentication server cooperation that outputs an authentication execution result in the authentication function unit to the application using terminal via the intranet and outputs the authentication execution result to an authentication server that manages the authentication execution result via a network different from the intranet And an authentication proxy server. The authentication function unit
When the first user identification information acquired via the intranet matches the registered identification information registered in advance, the second user identification information is generated,
The authentication server cooperation unit
5. The second user identification information is output to the application using terminal via the intranet, and the second user identification information is output to the authentication server via a network different from the intranet. Authentication proxy server. Performing authentication based on the first user identification information output from the application using terminal via the intranet;
Outputting the authentication execution result in the step of executing the authentication to an authentication server managing the authentication execution result via a network different from the intranet;
A control program for causing a computer of an authentication proxy server to execute the step of outputting the authentication execution result to the application using terminal via the intranet. Performing the authentication comprises:
When the first user identification information acquired via the intranet matches the registered identification information registered in advance, the second user identification information is generated,
Outputting to the authentication server comprises:
Outputting the second user identification information to the authentication server via a network different from the intranet;
The step of outputting to the application using terminal includes:
The control program according to claim 6, wherein the second user identification information is output to the application using terminal via the intranet. Performing authentication of the application using terminal using first user identification information transmitted from the application using terminal via the intranet;
Transmitting the authentication execution result in the authentication executing step to the application using terminal via the intranet, and transmitting to the authentication server connected to a network different from the intranet;
An authentication method comprising: determining whether or not an application can be provided to the application using terminal using the authentication execution result transmitted from the application using terminal and the authentication server via a network different from the intranet. .

Images