JP2019139621A - Authentication and approval information integration device and authentication and approval information integration method - Google Patents

Abstract

To reduce a burden on the development of an application using an API of a plurality of API infrastructure and a burden on the management of authentication and approval information.SOLUTION: An authentication and approval information storage unit 12 stores application authentication and approval information on an API infrastructure 2 in association with API-Key shipped to the application, and when receiving an API request including API-Key shipped by an authentication and approval information integration system 1, a request processing unit 13 refers to the authentication and approval information storage unit 12, converts API-Key included in the API request into application authentication and approval information on the API infrastructure 2 at the transfer destination of the API request, and transfers the information to the API infrastructure 2.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a technique for authenticating and authorizing an application.

  The API base bundles and manages an API providing device (hereinafter referred to as “enabler”) that provides functions and information as an API (Application Programming Interface) (for example, Non-Patent Document 1). In recent years, applications developed using API (hereinafter referred to as “applications”) are increasing.

“CA API Gateway”, [online], Japan CA Corporation, [December 22, 2017 search], Internet <URL: https://www.ca.com/jp/products/ca-api-gateway. html> "Security and Privacy Considerations for the OASIS Security Assertion Markup Language (SAML) V2.0", [online], OASIS, 15 March 2005, [December 22, 2017 search], Internet <URL: http: // docs .oasis-open.org / security / saml / v2.0 / saml-sec-consider-2.0-os.pdf>

  In application development, an API provided from a plurality of API platforms may be used. When application authentication / authorization information (API-Key, OAuth2.0 Access token, etc.) paid out from the API base increases, there is a problem that the management burden and development cost of application authentication / authorization information increase.

  SAML of Non-Patent Document 2 is a standard that realizes unified user authentication (single sign-on, etc.) between different net domains, but it is necessary to build a trust relationship between services in advance, It does not solve.

  The present invention has been made in view of the above, and an object thereof is to reduce the burden of developing an application that uses a plurality of API-based APIs and the burden of managing authentication authorization information.

  An authentication / authorization information integration apparatus according to a first aspect of the present invention is an authentication / authorization information integration apparatus for managing a plurality of API-based authentication / authorization information, wherein the first authentication / authorization information acquired from the API base and the authentication authorization When receiving a storage unit that associates and stores the second authentication authorization information generated by the information integration device and a processing request including the second authentication authorization information, the storage unit is referred to And processing means for transferring the processing request to the API base after converting the authentication authorization information of No. 2 into the API-based first authentication authorization information corresponding to the processing request.

  An authentication authorization information integration method according to a second aspect of the present invention is an authentication authorization information integration method executed by an authentication authorization information integration apparatus that manages a plurality of API-based authentication authorization information, A processing request comprising storage means for associating and storing the first authentication authorization information acquired from the API base and the second authentication authorization information generated by the authentication authorization information integration device, and including the second authentication authorization information The second authentication authorization information of the processing request is converted into the API-based first authentication authorization information corresponding to the processing request, with reference to the storage means, and the second authentication And transferring the processing request obtained by converting the authorization information into the API-based first authentication authorization information to the API platform.

  According to the present invention, it is possible to reduce the burden of developing an application that uses a plurality of API-based APIs and the burden of managing authentication authorization information.

1 is an overall configuration diagram including an authentication authorization information integration system of an embodiment. It is an example of the application information table which an authentication authorization information storage part memorize | stores. It is an example of the application authentication / authorization information type table stored in the authentication authorization information storage unit. It is an example of an API-Key conversion table stored in the authentication authorization information storage unit. It is an example of the Access token conversion table which an authentication authorization information storage part memorize | stores. It is an example of an OAuth2.0 information table stored in the authentication authorization information storage unit. It is a flowchart which shows the flow of the pre-registration process of the application authentication / authorization information by an authentication authorization information management part. It is a flowchart which shows the flow of the API-Key payout process by the authentication authorization information management part. It is a flowchart which shows the flow of the payout process of API-Key with respect to the client side application by a request process part. It is a flowchart which shows the flow of a process when the API request by a request process part is received. It is a flowchart which shows the flow of the process which acquires Access token from the API infrastructure by a token acquisition part. FIG. 10 is a sequence diagram illustrating a flow of processing when an API client is a server-side application and an API-based application authentication / authorization information type is API-Key. FIG. 11 is a sequence diagram illustrating a processing flow when an API client is a server-side application and an API-based application authentication / authorization information type is Access token. It is a sequence diagram which shows the flow of a process in case an API client is a client side application.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is an overall configuration diagram including an authentication authorization information integration system according to this embodiment.

  The API platform 2 manages one or more enablers 3 and provides an API for using the managed enabler 3. The API base 2 issues application authentication / authorization information indicating the right to use the enabler 3, accepts an API request including the application authentication / authorization information, and if the application authentication / authorization information is valid, the API request processing is enabled. 3 is requested. In FIG. 1, only one API base 2 is illustrated, but a plurality of API bases 2 are connected to the authentication authorization information integration system 1.

  The enabler 3 is a device that provides functions such as speech synthesis and chat conversation. In FIG. 1, only one enabler 3 is illustrated, but one API base 2 may manage a plurality of enablers 3.

  The API client 4 is an application that executes an API provided by the API base 2. The API client 4 may use a plurality of API infrastructure 2 APIs. The API client 4 may be a client-side application distributed for each user and executed on the user use terminal 5, or a server-side application executed on the server.

  The user use terminal 5 is a terminal used for a user to use an application, and is, for example, a portable terminal such as a personal computer or a tablet. In the case of a client side application, the user using terminal 5 executes the application. In the case of a server side application, the user accesses the server using the user use terminal 5, and the server executes the application.

  The application developer use terminal 6 is a terminal used by the developer of the API client 4. The developer uses the application developer use terminal 6 to input application information and application authentication / authorization information acquired from the API platform 2 to the authentication / authorization information integration system 1.

  The authentication / authorization information integration system 1 manages application authentication / authorization information of a plurality of API platforms 2 and pays out an API-Key (application authentication / authorization information) issued by itself to the API client 4. When the API client 4 is a client side application, an API-Key is paid out to each of the API clients 4 of the user use terminal 5. If the API client 4 is a server-side application, one API-Key is paid out to the server. When the API client 4 calls the API of the API base 2, the API client 4 transmits an API request including the API-Key issued by the authentication authorization information integration system 1.

  Upon receiving an API request including the API-Key issued by itself, the authentication authorization information integration system 1 confirms the validity of the API-Key, and then converts the API-Key to an appropriate API authentication / application of API platform 2. The API request is converted into authorization information, and the API request including the converted application authentication / authorization information is transferred to the API base 2.

  Unless otherwise specified, the apparatuses communicate with each other using HTTP (Hypertext Transfer Protocol).

  Next, the configuration of the authentication authorization information integration system 1 will be described.

  The authentication / authorization information integration system 1 illustrated in FIG. 1 includes an authentication / authorization information management unit 11, an authentication / authorization information storage unit 12, a request processing unit 13, and a token acquisition unit 14. Each unit included in the authentication authorization information integration system 1 may be configured by a computer including an arithmetic processing device, a storage device, and the like, and the processing of each unit may be executed by a program. This program is stored in a storage device included in the authentication / authorization information integration system 1, and can be recorded on a recording medium such as a magnetic disk, an optical disk, or a semiconductor memory, or provided through a network.

  The authentication authorization information management unit 11 receives application information and application authentication / authorization information issued from one or more API platforms 2 used by the application from the application developer using terminal 6, and issues an API-Key for the application. The application information, the application authentication / authorization information, and the paid out API-Key are recorded in the authentication authorization information storage unit 12.

  Further, when the API client 4 is a client-side application, the authentication authorization information management unit 11 generates an API-Key in response to an API-Key issuance request from the API client 4, and authenticates the generated API-Key. Record in the authorization information storage unit 12.

  The authentication authorization information storage unit 12 stores application information input from an application developer, application authentication / authorization information of the API base 2, and API-Key paid out to the application. 2 to 6 show examples of data stored in the authentication / authorization information storage unit 12.

  FIG. 2 is an example of the application information table. The API-Key of the authentication authorization information integration system 1 and the application type (server side application or client side application) are stored.

  FIG. 3 is an example of an application authentication / authorization information type table. Stores the API platform 2 domain and application authentication / authorization information type.

  FIG. 4 is an example of an API-Key conversion table. The API-Key of the authentication authorization information integration system 1 and the API-Key of the API base 2 are stored. When the API authentication / authorization information type of the API platform 2 is API-Key, it is used when converting the API-Key of the authentication / authorization information integration system 1 into the API-Key of the API platform 2.

  FIG. 5 is an example of an Access token conversion table. The API-Key of the authentication authorization information integration system 1 and the Access token of the API base 2 are stored. This is used when the API-Key of the authentication / authorization information integration system 1 is converted to the Access token of the API infrastructure 2 when the application authentication / authorization information type of the API infrastructure 2 is Access token.

  FIG. 6 is an example of an OAuth 2.0 information table. Information necessary for acquiring the Access token of FIG. 5 is stored.

  The request processing unit 13 receives an API request from the API client 4, confirms the validity of the API-Key included in the API request, and converts the API-Key into application authentication / authorization information of the appropriate API base 2. . Then, the request processing unit 13 transfers the API request including the converted application authentication / authorization information to the API base 2 and returns the processing result received from the API base 2 to the API client 4.

  Upon receiving the API-Key issuance request, the request processing unit 13 requests the authentication / authorization information management unit 11 to generate an API-Key, and returns the generated API-Key.

  When the application authentication / authorization information type of the API platform 2 is Access token, the token acquisition unit 14 acquires the Access token from the API platform 2 and records it in the authentication authorization information storage unit 12.

  Next, processing of each unit of the authentication authorization information integration system 1 will be described.

  First, the process of the authentication authorization information management unit 11 will be described.

  FIG. 7 is a flowchart showing a flow of pre-registration processing of application authentication / authorization information by the authentication / authorization information management unit 11.

  Upon receiving the application information and the application authentication / authorization information of the API base 2 from the application developer using terminal 6 (Step S11), the authentication authorization information management unit 11 pays out an API-Key to the application (Step S12). -Key and the received application information and application authentication / authorization information are recorded in the authentication authorization information storage unit 12 (step S13).

  When the application type is a client-side application, the API-Key recorded here is a temporary API-Key. When the API-Key issuance request is received from the API client 4 of the user use terminal 5, the API-Key is issued and recorded.

  Further, since the access token and the validity period of the access token table are acquired from the API base 2 in the course of the authorization process when the API request is received from the API client 4, they are not recorded at this time.

  FIG. 8 is a flowchart showing a flow of API-Key payout processing by the authentication authorization information management unit 11.

  Upon receiving the API-Key issuance request (Step S221), the authentication authorization information management unit 11 generates an API-Key from information included in the API-Key issuance request and records it in the authentication authorization information storage unit 12 (Step S222). ), And returns the generated API-Key to the request processing unit 13 (step S223).

  The authentication authorization information management unit 11 generates an API-Key from the temporary API-Key, the hash value based on the user ID and password in the API-Key issuance request. The user ID and password here are the user ID and password of the authentication authorization information integration system 1, and are notified to the user in advance.

  Subsequently, processing of the request processing unit 13 will be described.

  FIG. 9 is a flowchart showing the flow of API-Key payout processing for the client-side application by the request processing unit 13.

  When the request processing unit 13 receives an API-Key issuance request from the API client 4 that is a client-side application (step S21), the request processing unit 13 requests the authentication authorization information management unit 11 to generate an API-Key, and generates the API-Key. (Step S22). The authentication authorization information management unit 11 executes the process shown in FIG. 8 and generates an API-Key.

  The request processing unit 13 returns the generated API-Key to the API client 4 (step S23).

  FIG. 10 is a flowchart showing the flow of processing when an API request is received by the request processing unit 13.

  When receiving the API request from the API client 4 (step S31), the request processing unit 13 determines whether or not the API-Key included in the API request is regular (step S32).

  If the API-Key is not regular (No in step S32), the request processing unit 13 returns an error to the API client 4 (step S39).

  If the API-Key is valid (Yes in step S32), the request processing unit 13 refers to the application authentication / authorization information type table, and the application authentication / authorization information type of the API base 2 to which the API request is transferred. Is determined to be API-Key (step S33). The API platform 2 to which the API request is transferred can be specified based on a URL (Uniform Resource Locator) included in the API request.

  When the application authentication / authorization information type of the API base 2 of the transfer destination is API-Key (Yes in step S33), the process proceeds to step S36.

  When the application authentication / authorization information type of the API platform 2 at the transfer destination is “Access token” (No in step S33), the request processing unit 13 refers to the Access token conversion table, and the API platform 2 of the API platform 2 at the transfer destination is referred to. It is determined whether or not the Access token has been acquired and is within the expiration date (step S34).

  If Access token has been acquired and is valid (Yes in step S34), the process proceeds to step S36.

  If the access token has not been acquired or if the acquired access token has expired (No in step S34), the request processing unit 13 requests the token acquisition unit 14 for the OAuth 2.0 authorization process, and the access token is acquired. Is acquired (step S35). The token acquisition unit 14 executes a process shown in FIG. 11 described later, and acquires an Access token from the API base 2.

  The request processing unit 13 converts the API-Key included in the API request into application authentication / authorization information of the API base 2 that is the transfer destination, and transmits the API request to the appropriate API base 2 (step S36). When the application authentication / authorization information of the API base 2 at the transfer destination is API-Key, the request processing unit 13 rewrites the API request with reference to the API-Key conversion table, and the application authentication / authentication of the API base 2 at the transfer destination. When the authorization information is Access token, the API request is rewritten with reference to the Access token conversion table.

  When receiving the processing result of the API request from the API base 2 (Step S37), the request processing unit 13 returns the processing result to the API client 4 (Step S38).

  Next, processing of the token acquisition unit 14 will be described.

  FIG. 11 is a flowchart showing a flow of processing for acquiring an Access token from the API base 2 by the token acquiring unit 14.

  When receiving the OAuth 2.0 authorization processing request (Step S351), the token acquisition unit 14 extracts necessary information from the OAuth 2.0 information table and performs authorization processing on the API base 2 (Step S352).

  When the access token is acquired from the API base 2, the access token is recorded in the access token conversion table and notified to the request processing unit 13 (step S353).

  Next, the processing flow of the entire system will be described.

  FIG. 12 is a sequence diagram showing the flow of processing when the API client 4 is a server-side application and the API-based application authentication / authorization information type is API-Key.

  The user accesses the server side application using the user use terminal 5 (step S41).

  The server-side application transmits an API request including the API-Key (aaa-key) issued by the authentication / authorization information integration system 1 to the authentication / authorization information integration system 1 (step S42).

  Upon receiving the API request, the authentication authorization information integration system 1 authenticates the API-Key (aaa-key) included in the API request, and the API-Key (aaa-key) is API-Key (key1) of the API base A. (Step S43).

  The authentication authorization information integration system 1 transmits an API request including the API-Key (key 1) of the API base A to the API base A (step S44).

  The API base A requests the enabler A-1 for processing (step S45) and receives the processing result (step S46). In some cases, the API board and enabler are integrated.

  The authentication authorization information integration system 1 receives the response of the API request from the API base A, and returns it to the server side application (step S47).

  Thereafter, the server-side application transmits an API request for the API base B to the authentication authorization information integration system 1 (step S48). This API request includes the API-Key (aaa-key) of the authentication authorization information integration system 1.

  Upon receiving the API request, the authentication authorization information integration system 1 authenticates the API-Key (aaa-key) included in the API request, and API-Key (aaa-key) is API-Key (key2) of the API base B. (Step S49), and an API request including the API-Key (key2) of the API base B is transmitted to the API base B (step S50).

  The API base B requests the enabler B-1 for processing (step S51) and receives the processing result (step S52).

  The authentication authorization information integration system 1 receives the response of the API request from the API base B, and returns it to the server side application (step S53).

  FIG. 13 is a sequence diagram showing a flow of processing when the API client 4 is a server-side application and the API-based application authentication / authorization information type is Access token. FIG. 13 shows a case of authentication only for an application (Client Credentials Grants) among the authorization methods of OAuth 2.0.

  12, when the user accesses the server-side application (step S41), the server-side application integrates an API request including the API-Key (aaa-key) of the authentication authorization information integration system 1 into the authentication authorization information integration. The authentication authorization information integration system 1 authenticates the server-side application based on the API-Key (aaa-key) included in the API request (Step S43).

  Since the API token A access token has not been acquired or has expired, the authentication authorization information integration system 1 sends an access token request to the API infrastructure A (step S61), and the API token A accesses the token token. Is received (step S62). The received Access token (token1) is recorded in the Access token conversion table.

  The authentication authorization information integration system 1 converts the application authentication / authentication authorization information of the API request received from the server-side application into Access token (token1) (step S63), and sends the API request including Access token (token1) to the API base A (Step S64).

  The API base A requests the enabler A-1 for processing (step S65) and receives the processing result (step S66).

  The authentication authorization information integration system 1 receives the response of the API request from the API base A, and returns it to the server side application (step S67).

  An API request for the API base B is processed in the same manner as described above. When the application authentication / authorization information type of API base B is API-Key, the processing shown in FIG. 12 is performed.

  FIG. 14 is a sequence diagram showing the flow of processing when the API client 4 is a client-side application. It differs from the server side application in that the authentication authorization information integration system 1 pays out an API-Key in response to a request from the API client 4.

  The user operates the user use terminal 5 and inputs a user ID and a password to the client side application (step S71).

  The client-side application transmits an API-Key issuance request including the temporary API-Key and a hash value based on the user ID and password to the authentication authorization information integration system 1 (step S72).

  The authentication authorization information integration system 1 generates an API-Key from the temporary API-Key in the API-Key issuance request, a hash value based on the user ID and password (step S73), and generates the generated API-Key (bbb- key) is returned to the client side application (step S74). The generated API-Key is recorded in the authentication authorization information storage unit 12.

  The client-side application transmits an API request including API-Key (bbb-key) to the authentication / authorization information integration system 1 (step S75).

  The API request processing is the same as the processing for the server-side application described with reference to FIGS.

  After executing the API request, the authentication authorization information integration system 1 returns the response of the API request to the client side application (step S76).

  As described above, according to the present embodiment, the application authentication / authorization information of the API base 2 and the API-Key paid out to the application are associated and stored in the authentication authorization information storage unit 12, and the authentication authorization information integrated system When the API request including the API-Key issued by 1 is received, the request processing unit 13 refers to the authentication authorization information storage unit 12 and sets the API-Key included in the API request to the API platform 2 to which the API request is transferred. By converting the application authentication / authorization information to the API platform 2 and transferring it to the API platform 2, the developer of the application uses only the API-Key issued by the authentication / authorization information integration system 1 and the APIs of the plurality of API platforms 2 Development application corresponding to each of the authentication authorization processing of multiple API platforms 2 and multiple The administrative burden of the application authentication / authorization information of the API base 2 can be reduced.

DESCRIPTION OF SYMBOLS 1 ... Authentication authorization information integrated system 11 ... Authentication authorization information management part 12 ... Authentication authorization information storage part 13 ... Request processing part 14 ... Token acquisition part 2 ... API base 3 ... Enabler 4 ... API client 5 ... User utilization terminal 6 ... Application Developer terminal

Claims (4)

An authentication / authorization information integration device for managing a plurality of API-based authentication / authorization information,
Storage means for storing the first authentication authorization information acquired from the API base and the second authentication authorization information generated by the authentication authorization information integration device in association with each other;
When the processing request including the second authentication authorization information is received, the storage unit is referred to and the second authentication authorization information of the processing request is used as the API-based first authentication authorization information corresponding to the processing request. Processing means for transferring the processing request to the API base,
An authentication authorization information integration device characterized by comprising: The storage means stores acquisition information for acquiring first authentication authorization information from the API base,
When the processing request including the second authentication authorization information is received, the API-based first authentication authorization information corresponding to the processing request is not stored in the storage unit or stored in the storage unit When the first authentication authorization information is not valid, the first authentication authorization information is obtained from the API base using the obtained information, and the obtained first authentication authorization information is recorded in the storage unit The authentication authorization information integration device according to claim 1, further comprising: means. An authentication authorization information integration method executed by an authentication authorization information integration apparatus that manages a plurality of API-based authentication authorization information,
The authentication authorization information integration device includes storage means for storing the first authentication authorization information acquired from the API base and the second authentication authorization information generated by the authentication authorization information integration device in association with each other,
When the processing request including the second authentication authorization information is received, the storage unit is referred to and the second authentication authorization information of the processing request is used as the API-based first authentication authorization information corresponding to the processing request. Converting to
Transferring the processing request obtained by converting the second authentication authorization information into the API-based first authentication authorization information to the API board;
An authentication authorization information integration method characterized by comprising: The storage means stores acquisition information for acquiring first authentication authorization information from the API base,
When the processing request including the second authentication authorization information is received, the API-based first authentication authorization information corresponding to the processing request is not stored in the storage unit or stored in the storage unit If the first authentication authorization information is not valid, the first authentication authorization information is obtained from the API base using the obtained information, and the obtained first authentication authorization information is recorded in the storage means The authentication authorization information integration method according to claim 3, further comprising:

Images