JP2002335239A - Method and system device for authenticating single sign- on - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a method and system device for authenticating signal sign-on which enable reduction of a system construction cost and an operation managing cost by realizing a single sign-on function without requiring an authentication state managing server for unitarily managing an authentication state. SOLUTION: This characteristic configuration method comprises first authentication processing where a first authentication server 601 to which a contents request (ST31) is applied from an authentication client terminal 501 operated by a user, performs (ST32) the authentication of the user, holds the authentication state as a result of the authentication performance and prepares/issues (ST33) an authentication token showing the authentication state and second authentication processing where a second authentication server 701 to which a contents request (ST41) is applied from the authentication client terminal 501 operated by the user and which accepts the request, performs processing (ST43) concerning the authentication of the user by utilizing (ST44) the authentication token prepared/issued in the first authenticating processing.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system in which a plurality of servers (servers) existing on a network such as the Internet share the authentication state of a user and provide a service limited to a specific user. Regarding the preferred one, in particular, single sign-on that enables distributed management of authentication states created by a plurality of authentication servers and enables mutual use without requiring a server for centrally managing authentication states. The present invention relates to an authentication method and a system device.

[0002] That is, the present invention relates to a single sign-on authentication method and a system apparatus suitable for a system in which a plurality of servers existing on a network share an authentication state. Here, the authentication state refers to a state as to whether the user has already been authenticated.

[0003]

2. Description of the Related Art Heretofore, a function called single sign-on that allows a user to access a plurality of servers with one login has been devised.
When a plurality of servers individually authenticate, the user needs to use various user IDs and passwords.

Also, from the viewpoint of management, it is not preferable in view of the trouble of periodically updating a plurality of passwords.
In such an environment, a function called single sign-on is to centrally manage authentication of a plurality of servers and user access control in synchronization with a directory service in order to improve user convenience and management functions.

[0005] Conventionally, in order to provide a service limited to a specific user by using a single sign-on in a plurality of servers existing on a network to provide an authentication state, authentication is performed by centrally managing the authentication state. A state management server was provided. Then, when each authentication server authenticates a user, the authentication status is shared between a plurality of servers by inquiring of the authentication status management server about the authentication status of the user.

FIG. 12 is a schematic conceptual diagram of a conventional system device having a single sign-on function. In FIG. 1, an authentication client terminal 101 is a terminal including a personal computer, a PDA (Personal Digital Assistants), and the like, and has a built-in processing program 102.

[0007] In addition to the authentication client terminal 101, a plurality of authentication servers 201 and 301 exist on the Internet or an intranet.
Reference numeral 301 includes processing programs 202 and 302, respectively. Also, the authentication servers 201 and 301 have contents 203 and 303 to be provided to the client after the authentication processing is completed, respectively.

Further, on the Internet or an intranet, there is an authentication status management server 401 that actually performs authentication processing and holds an authentication status in response to a request from each of the authentication servers 201 and 301. Authentication status management server 401
Has a processing program 402, an authentication database 403 that stores information for authenticating a user such as an ID or a password, and an authentication state management database 404 that holds the authentication state of the user.

FIG. 13 is a flowchart showing a processing procedure of the conventional system device shown in FIG. here,
It is assumed that the user accesses the authentication server 201 (authentication state issuing source) by the authentication client terminal 101 to perform an authentication procedure, and then accesses the authentication server 301 (authentication state use destination).

First, an authentication processing requesting step ST11 (A-
The authentication request from 1) is transmitted to the authentication process reception process ST12 (B
-1), the authentication process ST13 (D-
In 1), an authentication process and an authentication state are stored.
Thereafter, when an authentication request is issued from the authentication processing requesting process ST21 (A-2) to another authentication server 301 again, the authentication request is received in the authentication processing receiving process ST22 (C-1), and then the authentication process ST23 is performed. In (D-2), the authentication processing and the storage of the authentication state are performed.

At this time, if the authentication status created in the authentication process ST13 (D-1) already exists, the authentication is performed using the information on the authentication status, and it is not necessary for the user to perform the process related to the authentication again. Absent. As described above, when a plurality of authentication servers 201 and 301 perform authentication, the authentication status management server 401 collectively performs the authentication status management, thereby realizing single sign-on by sharing the authentication status. I have.

[0012]

As described above, conventionally, a plurality of servers (authentication servers 201 and 301) existing on a network share an authentication state and provide a service limited to a specific user. For this purpose, the authentication status is centrally managed in a special authentication status management server 401 specially provided. As a result, single sign-on is realized, in which the authentication state is reliably managed and the user does not need to repeatedly perform the work related to the authentication.

However, in such a conventional method, since the processing is concentrated on the authentication state management server 401, the authentication state management server 401 is required to have a particularly high processing capacity, and a large amount of operating funds and advanced operation skills are required. Is required. This makes it difficult for small sites to operate as single sign-on in terms of cost and operation.

Further, according to the conventional method, when implementing single sign-on on a network, the reliability of the authentication state of a group of servers performing single sign-on is not always uniform, and the reliability between the servers is not uniform. In this case, the reliability is increased. Further, when exchanging the authentication status on the network, there is a danger unique to the network such as eavesdropping, falsification, and impersonation.

Here, the main objects to be solved by the present invention are as follows. That is, a first object of the present invention is to provide a system having a single sign-on function in which a user can access a plurality of servers by one login without requiring an authentication state management server for centrally managing the authentication state. Another object of the present invention is to provide a single sign-on authentication method and a system device that can reduce system construction costs and operation management costs.

[0016] A second object of the present invention is to provide a communication system in which a plurality of authentication servers are superior in reliability regarding authentication.
It is an object of the present invention to provide a single sign-on authentication method and a system device capable of appropriately managing an authentication state.

A third object of the present invention is to provide a single sign-on authentication method capable of ensuring security even when an authentication state is mutually used between a plurality of authentication servers (servers) via a network. No system device is provided.

Other objects of the present invention will become apparent from the description of the specification, the drawings, and particularly the description of each claim in the claims.

[0019]

In order to solve the above-mentioned problems, the present invention has a configuration comprising a plurality of authentication servers for selectively distributing and managing an authentication status indicating whether a user has already been authenticated. It has the characteristic of taking measures.

The method of the present invention solves the above problems,
When the authentication server receives an authentication token, which is information authenticated by another authentication server, from the authentication client terminal, the authentication server creates an inquiry message for the authentication server that issued the authentication token, and checks the validity of the received authentication token. It has the feature of taking a configuration method to verify.

More specifically, in solving the problem, the present invention achieves the above object by adopting a novel characteristic configuration technique or means ranging from the upper concept to the lower concept, which are enumerated below. It is done as follows.

That is, a first feature of the method of the present invention is provided for an authentication system for providing a service limited to a specific user, and a plurality of servers existing on a network determine the authentication status of the user. A shared single sign-on authentication method, which is a configuration of a single sign-on authentication method in which each of the plurality of servers manages the authentication state of a user in a distributed manner.

A second feature of the method of the present invention is provided for an authentication system for providing a service limited to a specific user, and a plurality of servers existing on a network share the authentication status of the user. In the single sign-on authentication method, a first authentication server, which has been requested for content from an authentication client terminal operated by a user, executes authentication of the user and holds an authentication state as a result of the execution of the authentication. A first authentication process for creating an authentication token indicating the authentication status, and a second authentication server, which has been requested for content from an authentication client terminal operated by a user, transmits the authentication token created in the first authentication process to the first authentication process. And a second authentication process for performing a process related to the authentication of the user by using the configuration of the single sign-on authentication method. That.

A third feature of the method of the present invention is that the first authentication processing in the second feature of the method of the present invention is such that the authentication client terminal requests content from the first authentication server. A first authentication processing requesting step for requesting a user authentication processing for the authentication client terminal; and a first authentication processing reception receiving the first authentication server receiving an authentication processing request generated in the first authentication processing requesting step. Executing the authentication process for the authentication process request received in the first authentication process reception process, holding an authentication status as a result of the authentication execution, and creating an authentication token indicating the authentication status. And the authentication process for issuing to the authentication client terminal are sequentially and consistently performed. The second authentication process is performed by the authentication client terminal when the second authentication server A second authentication processing requesting step of requesting an authentication processing of the user for the authentication client terminal in response to the request for the content, and a request for the authentication processing generated in the second authentication processing requesting step. 2
A second authentication process receiving step received by the authentication server; and the authentication token created in the first authentication process for the authentication process request received in the second authentication process receiving process. An authentication state inquiry process in which the second authentication server inquires the first authentication server, which is a source of the authentication token, about validity of the authentication token, based on the authentication token transmitted from the terminal; In response to the inquiry about the validity of the authentication token generated in the inquiry process, the first authentication server sends an authentication status of the user for the authentication client terminal to the second authentication server in an authentication status response process. It is in the adoption of the configuration of the single sign-on authentication method that is implemented through the whole process.

A fourth feature of the method of the present invention is that the authentication step in the third feature of the method of the present invention is such that, when the authentication token is issued, the first authentication server which is a source of the authentication token. The present invention employs a configuration of a single sign-on authentication method that also performs a signature creation process of including an electronic signature for identifying the authentication token in the authentication token.

According to a fifth aspect of the method of the present invention, the authentication step in the fourth aspect of the present invention uses the common key shared by the first authentication server and the second authentication server. The present invention resides in adopting a configuration of a single sign-on authentication method in which a token is encrypted and a common key encryption process for issuing to the authentication client terminal is also performed.

According to a sixth aspect of the method of the present invention, the single sign-on authentication method according to the fifth aspect of the present invention is arranged such that each of the first authentication server and the second authentication server includes a server for authentication. The authentication level is a parameter indicating the reliability of the first authentication processing. The second authentication processing is performed when the authentication token is received.
A single sign-on authentication method comprising comparing an authentication level of an authentication server with an authentication level of the second authentication server, and performing an authentication token inspection update process for managing the authentication state based on a result of the comparison. In the configuration adoption.

According to a seventh feature of the method of the present invention, in the above-mentioned sixth feature of the present invention, the authentication token check / update processing is performed with the authentication level of the second authentication server being lower than the authentication level of the first authentication server. If the authentication state is higher, the authentication state is managed by the second authentication server, and the authentication state managed by the first authentication server is discarded. In the case where the authentication level of the authentication server is higher, the first authentication server manages the authentication state as it is.

[0029] An eighth feature of the method of the present invention is that the authentication token check / update processing in the seventh feature of the method of the present invention includes a common key decryption processing of decrypting the authentication token using the common key. A signature verification process for verifying a signature included in the authentication token in the signature creation process, an authentication ID verification process for verifying a user authentication ID included in the authentication token, and information included in the authentication token. A client information verification process for verifying information identifying the authentication client terminal, and an expiration date verification process for verifying the expiration date of the authentication token, which is information included in the authentication token, are implemented. The present invention resides in adopting a configuration of a single sign-on authentication method that also performs processing for determining validity.

A first feature of the apparatus of the present invention is that authentication is performed to provide a service limited to a specific user, and a plurality of servers existing on a network share a user authentication state. A sign-on authentication system apparatus, comprising: an authentication client terminal for requesting content; performing authentication in response to a content request from the authentication client terminal; holding an authentication state as a result of the authentication execution; A first authentication server that issues an authentication token indicating the following to the authentication client terminal; and when performing authentication in response to a content request from the authentication client terminal, receiving the authentication token from the authentication client terminal; Inquires about the validity of the authentication token to the first authentication server that is the issuer of That is a second authentication server, the configuration adopted for single sign-on authentication system apparatus comprising a.

A second feature of the device of the present invention resides in that, when the first authentication server in the first feature of the device of the present invention issues the authentication token, the first authentication server that is the source of the authentication token. An aspect of the present invention resides in adoption of a configuration of a single sign-on authentication system apparatus having a signature creation unit for attaching an electronic signature for specifying an authentication server to the authentication token.

A third feature of the device of the present invention is that the first authentication server in the second feature of the device of the present invention uses a common key shared by the first authentication server and the second authentication server. It has a common key encryption unit for encrypting the authentication token, and adopts a configuration of a single sign-on authentication system device that is configured to be able to issue the authentication token encrypted by the common key encryption unit to the authentication client terminal. is there.

A fourth feature of the device of the present invention resides in that the second authentication server in the first, second or third feature of the device of the present invention receives the authentication token when the first authentication server. The authentication level of the second authentication server is compared with the authentication level of the second authentication server. If the authentication level of the second authentication server is higher than the authentication level of the first authentication server, the authentication state is changed to the second authentication server. The present invention resides in adoption of a configuration of a single sign-on authentication system device which is managed by an authentication server and has a configuration in which the authentication state managed by the first authentication server can be discarded.

A fifth feature of the device of the present invention is that the first authentication server and the second authentication server in the fourth feature of the device of the present invention are each trusted to limit the issue destination of the authentication token. A single sign-on authentication system is configured to have a server list and to be able to issue the authentication token only to servers listed in the trusted server list.

A sixth feature of the device of the present invention resides in that the first authentication server and the second authentication server in the fifth feature of the above-described device of the present invention trust each other for use in determining the trust of the received authentication token. A single sign-on authentication system apparatus having a server list and capable of easily confirming whether or not the received authentication token is issued by a server listed in the trusted server list.

A seventh feature of the device of the present invention is that the first authentication server and the second authentication server in the sixth feature of the device of the present invention each include
And an authentication database that holds the user's password and information for identifying the user in association with each other, an ID of the authenticated user, and a temporary ID that is changed for each access of the user. An authentication status management database that holds an address of the authentication client terminal operated by the user, an expiration date of the authentication status of the user, and information identifying the user in association with each other. The present invention resides in adopting the configuration of the single sign-on authentication system device.

As described above, according to the present invention, the authentication status, which has been centrally managed by the authentication status management server in the past, is selectively distributed and managed by each authentication server comparing the authentication levels with each other. The operation / construction cost of the state management server can be reduced. That is, when each authentication server receives information (authentication token) authenticated by another authentication server from the authentication client terminal,
Create an inquiry message to the authentication server that issued the authentication token, and verify the validity of the received authentication token.

In the selective distributed management of the present invention, in order to appropriately manage an authentication state in consideration of the reliability of authentication among a plurality of authentication servers, each authentication server (server) has a trust regarding authentication. A parameter (authentication level) indicating the property is given. Then, when confirming the validity of the authentication token with the authentication server that issued the authentication token, if the authentication level of the authentication server that issued the authentication token exceeds the authentication level of the authentication server that uses the authentication token, the authentication state is changed to It is managed as is by the authentication server that issued the authentication token.

On the other hand, when the authentication level of the authentication server that has issued the authentication token is lower than the authentication level of the authentication token destination, the authentication state is newly managed in the authentication token destination and the authentication server that has issued the authentication token. The information (authentication status) managed by is discarded. By using such means, according to the present invention, it is possible to appropriately manage the authentication state in the case where the authentication level is superior between the authentication servers (servers).

Further, according to the present invention, each authentication server (server)
Regarding the maintenance of security in the mutual use of the authentication state between the authentication servers, each authentication server has a common key in common with each other and encrypts the inquiry message and the response message. In addition, each authentication server has a "list of trusted servers" and a "list of trusted servers", respectively, and when the authentication token is issued, issues an authentication token to the trusted server and issues another server. When using an authentication token, confirm that it is an authentication token issued by a trusted server.

Further, according to the present invention, a message exchanged between the authentication servers is electronically signed with the secret key of each authentication server, thereby preventing forgery, falsification, and spoofing of the authentication status. Thus, the present invention enables the authentication status to be selectively distributed and managed, and enables the authentication status to be shared safely, easily, and flexibly.

[0042]

BRIEF DESCRIPTION OF THE DRAWINGS FIG.
Embodiments of the present invention will be described with reference to an example of an apparatus and an example of a method.

According to the present invention, a plurality of servers share the authentication state of a user on a network, and a single sign-on is provided so that the user can access the plurality of servers with one login. Therefore, authentication status is selectively distributed and managed by multiple servers.
In the present embodiment, the Internet / intranet will be described as a typical example as a network, but
The present invention is not limited to these.

(Example of Apparatus) FIG. 1 is a conceptual diagram of a single sign-on authentication system according to an example of the apparatus of the present invention. In FIG. 1, reference numeral 2 denotes a network including the Internet and an intranet, and reference numeral 501 denotes an authentication client terminal including a personal computer or a PDA.

Reference numeral 601 denotes a first authentication server that executes authentication in response to a content request from the authentication client terminal.
Reference numeral 01 denotes a second authentication server that executes authentication in response to a content request from the authentication client terminal. The authentication client terminal 501, the first authentication server 601 and the second authentication server 701 are mutually connected via the network 2.

The authentication client terminal 501 requests contents from the first authentication server 601 and the second authentication server 701, and has a built-in processing program 502 for defining its own operation. First authentication server 60
1 has a built-in processing program 602 for defining its own operation. The second authentication server 701 has a built-in processing program 702 for defining its own operation.

The first authentication server 601 includes a WWW content 603 to be transmitted to an authenticated client (authentication client terminal 501), an authentication database 604 including data used for an authentication process, and a method for maintaining and managing an authentication state. Authentication status management database 605
And a “trusted server list” 606 that limits the issue destination of the authentication token, and a trusted server list 607 that is used to determine whether to trust the received authentication token.

Similarly to the first authentication server 601, the second authentication server 701 also transmits WWW contents 7 to the authenticated client (authentication client terminal 501).
03, an authentication database 704 including data used for the authentication processing, an authentication state management database 705 for holding and managing the authentication state, and a “trusted server list” 706 for limiting the issue destination of the authentication token. A “trusted server list” 707 used to determine whether to trust the authentication token.

Here, the authentication token is composed of information indicating the authentication status of each client, and in response to a content request from the authentication client terminal 501, the first authentication server 601 (or the second authentication server 701). Is created at the time of authentication, and details will be described later.

In the present embodiment, the first authentication server 601 is used as an authentication token issuing source, and the second authentication server 701 is used as an authentication token destination. However, this is assumed for explanation. That is, the first authentication server 601 and the second authentication server 701 have the same function, respectively, and serve as an authentication token issuer and an authentication token use destination.

That is, the first authentication server 601 executes authentication in response to a content request from the authentication client terminal 501, and holds and manages the authentication status as a result of the authentication execution in the authentication status management database 605. An authentication token indicating an authentication state is issued to the authentication client terminal.

When executing authentication in response to a content request from the authentication client terminal 501, the second authentication server 701 receives the authentication token from the authentication client terminal 501 and issues the first authentication token, which is the source of the authentication token.
The authentication server 601 is inquired about the validity of the authentication token.

FIG. 2 is a flowchart showing the operation of the single sign-on authentication system according to the present example. In the figure, as a first authentication process, after a user accesses the first authentication server 601 (authentication token issuing source) from the authentication client terminal 501 and performs an authentication procedure,
As the second authentication processing, the case where the second authentication server 701 (authentication token use destination) is accessed is shown.

First, the authentication request from the authentication processing requesting step ST31 (A-1) executed by the authentication client terminal 501 is transmitted to the authentication processing receiving step ST1 of the first authentication server 601.
32 (B-1), the first authentication server 6
In an authentication process ST33 (B-2) of 01, an authentication process and an authentication state are stored.

After that, the authentication client terminal 501 is again activated.
In the case where the authentication request from the authentication processing request process ST41 (A-2) is issued to another server (the second authentication server 701), the authentication request is sent to the second authentication server 70
It is received in the authentication processing receiving process ST42 (C-1) of No. 1.

Here, another server (the first authentication server 60)
If the authentication token authenticated by 1) is attached to the authentication request, in the authentication status inquiry process ST43 (C-2) of the second authentication server 701, the authentication status response process ST44 of the first authentication server 601 is performed. The inquiry about the authentication status for (B-3) is executed.

Then, in the authentication status inquiry process ST43 (C-2) of the second authentication server 701, the validity of the authentication token is confirmed, and if the validity is confirmed, which server (the first authentication server 601 or It is determined whether the second authentication server 701) should hold and manage the authentication state, and based on the determination, the holding and management of the authentication state are executed.

As a result, an authentication state is created in the authentication process ST33 (B-1) in the first authentication process.
In the second authentication process, the authentication is performed using the authentication state created in the authentication process ST33 (B-1), and the user does not need to perform the process related to the authentication again.

FIG. 3 is a diagram showing the structure of the databases provided in the first authentication server 601 and the second authentication server 701, respectively.

In the figure, (a) shows an authentication database 604,
704 shows the structure of the authentication status management databases 605 and 705. The authentication databases 604 and 704 hold a user ID, which is an ID of a user to be authenticated, a password of the user, information for specifying the user, and the like in association with each other.

Authentication status management database 605, 705
Is a user ID that is an ID of an authenticated user, an authentication ID that is a temporary ID changed for each access of the user, an address of an authentication client terminal 501 operated by the user, The validity period of the authentication state and information for specifying the user are held in association with each other.

Next, as an example of the method of the present embodiment, after a certain user authenticates with the first authentication server 601, 1) when authenticating again with the first authentication server 601 which is the same server, 2 3) Different authentication server when performing authentication with respect to the second authentication server 701 which is a different server, where (authentication level of the first authentication server 601) ≧ (authentication level of the second authentication server 701). In the case where the authentication is performed for the second authentication server 701, which is the case where (the authentication level of the first authentication server 601) <(the authentication level of the second authentication server 701), there are three cases: I will explain.

Here, the authentication level is a parameter attached to each authentication server and is a parameter indicating the reliability of each authentication server with respect to the authentication. The authentication level managed by the authentication server with the higher authentication level is used. It is assumed that the higher the status, the more reliable the authentication is.

Then, each authentication server (first authentication server 6)
01 and the second authentication server 701) share the authentication state using the authentication token.
When the user is authenticated, the user does not need to perform the authentication process again. That is, single sign-on is performed.

(Method Example 1) A method example 1 of this embodiment applied to the above-described apparatus example will be described with reference to FIGS. Method example 1 is such that a certain user
After authenticating in the first server, the first server which is the same server again
This is a method applied when authenticating to the authentication server 601.

FIG. 4 is a flowchart showing a procedure when a user requests authentication from the authentication server group for the first time. Now, it is assumed that the user authenticates to the authentication server group (the first authentication server 601 and the second authentication server 701) for the first time. That is, this is the case where the authentication client terminal 501 first requests the first authentication server 601 or the second authentication server 701 for a content. FIG. 3 shows a processing procedure at this time.

First, the user enters the authentication client terminal 5
01, and activates the content requesting unit 503 included in the processing program 502.
Requests the content from the authentication start unit 608 of the processing program 602 of the first authentication server 601.

After receiving the content request, the authentication start unit 608 determines whether the content of the request requires authentication, and calls the authentication processing unit 609 if authentication is required. The authentication processing unit 609 confirms that the “authentication authenticated token” is not attached to the content request, acquires data necessary for authentication from the authentication database 604, and performs the authentication processing.

Here, when the authentication is completed normally, the authentication processing unit 609 calls the content return unit 610.
In the content return unit 610, the WWW content 603
From the "trusted server list" 606 to obtain the distribution destination of the authentication token,
The authentication token created by the authentication token creation unit 611 is attached to the acquired content, and the content is returned to the authentication client terminal 501.

FIG. 5 is a flowchart showing a processing procedure in the authentication token creation unit 611. FIG. 6 shows the first
FIG. 4 is a conceptual schematic diagram showing the structure of various messages created by an authentication server 601 and a second authentication server 701. Here, FIG. 6A is a conceptual schematic diagram illustrating the structure of the authentication token created by the authentication token creating unit 611. FIG.
(B), (c), and (d) will be described later.

First, the authentication token creation unit 611 creates an expiration date designated by the expiration date creation unit 612 (expiration date creation process). After that, the authentication ID creation unit 61
In step 3, an authentication ID composed of random numbers is created (authentication ID
Creation process). Thereafter, the created expiration date, authentication ID, and client information for specifying the authentication client terminal 501 are registered in the authentication status management database 605.

After that, the authentication server (the first authentication server 601) that has created the authentication token in the signature creation unit 614.
(Signature creation processing). Thereafter, the common key encryption unit 615 encrypts the entire authentication token using a common key shared by the authentication servers (common key encryption processing). Then, the encrypted authentication token is transmitted to the content return unit 610 and transmitted to the authentication client terminal 501 together with the content.

Next, a case where the user requests authentication again from the first authentication server which has requested authentication in the past will be described. FIG. 7 is a flowchart illustrating a processing procedure when another authentication request is issued to the same authentication server.

First, the processing program 502 of the authentication client terminal 501 is started, and the processing program 50
The content request unit 503 included in the first authentication server 601 requests the authentication start unit 608 of the processing program 602 for the content.

The authentication start unit 608 receiving the request
Judges whether authentication is necessary for the contents of the request, and calls the authentication processing unit 609 if it is determined that authentication is necessary. The authentication processing unit 609 confirms that the authenticated authentication token is attached to the received content request, and calls the authentication token verification / update unit 616.

FIG. 8 shows an authentication token verification / update unit 616.
6 is a flowchart showing the processing procedure of FIG. In the authentication token verification / update unit 616, first, the authentication token issuer verification unit 617 verifies the authentication level of the authentication token using the “trusted server list 607”. In this method example 1, the authentication token issued by the same server (first authentication server) is used by the same server (first authentication server), so that it is not necessary to compare the authentication levels.

Next, the authentication token is decrypted by the common key decryption unit 618 using the common key (common key decryption processing). Subsequently, the signature included in the authentication token is verified by the signature verification unit 619 (signature verification processing). After that, authentication I
The D verification unit 620 verifies the user's authentication ID included in the authentication token (authentication ID verification processing).

Then, the client information verification unit 621 verifies the information included in the authentication token and that specifies the authentication client terminal 501 (client information verification processing). Further, an expiration date verification unit 622
In, the expiration date of the authentication token, which is information included in the authentication token, is verified (expiration date verification process).

The above processing verifies that a valid authentication token has been obtained from a reliable server. Thereafter, a new expiration date is created in the expiration date updating unit 623, and the new authentication ID is output in the authentication ID updating unit 624.
D is generated, and the new expiration date and authentication ID are registered in the authentication status management database 605. Thereafter, a signature is generated together with the client information in the signature creation unit 625, and the entire new authentication token is encrypted with the common key in the common key encryption unit 626.

After these processes, the distribution destination of the authentication token is specified using the “trusted host list 606”.
The content return unit 610 obtains the requested content from the WWW content 603 and sends it to the authentication client terminal 501 together with a new authentication token.

(Method 2) A method 2 of the present embodiment applied to the above-described apparatus will be described with reference to FIGS. The method example 2 is a method applied when a certain user authenticates with the first authentication server 601 and then authenticates with the second authentication server 701 which is a server different from the first authentication server 601. .

In the method example 2, the first authentication server 6
It is assumed that the authentication level of 01 (authentication token issuing source) is equal to or higher than the authentication level of the second authentication server 701 (authentication token use destination). First, similarly to the above-mentioned method example 1,
When the user enters the authentication server group (the first authentication server 601 and the second
It is assumed that authentication is performed for the first time with respect to the authentication server 701). After that, it is assumed that an authentication request is made to a second authentication server 701 different from the first authentication server 601. FIG. 9 shows a processing procedure at this time.

FIG. 9 is a flowchart showing a processing procedure when the authentication level of the authentication server to which the authentication token is issued is equal to or higher than the authentication level of the authentication server to which the authentication token is used.

First, the user enters the authentication client terminal 5
01, and activates the content requesting unit 503 included in the processing program 502.
Transmits the content request information accompanied by the authentication token created by the first authentication server 601 to the authentication start unit 708 of the processing program 702 of the second authentication server 701 to request the content.

After receiving the content request information, the authentication start unit 708 determines whether the content of the request requires authentication, and calls the authentication processing unit 709 if authentication is required. The authentication processing unit 709 confirms that “authenticated authentication token” is attached to the content request information,
By referring to the “trusted server list 707”, it is confirmed that the authentication token is created by the trusted server.

Thereafter, the inquiry message creating unit 727 sends the inquiry message
The inquiry message shown in (b) is created, and the encrypted message is transmitted to the inquiry message reception unit 629 of the processing program 602 of the first authentication server 601 that has issued the authentication token.

FIG. 6B is a conceptual schematic diagram showing the structure of the inquiry message created by the inquiry message creation section 727.
The inquiry message reception unit 629 compares the authentication levels of the first authentication server 601 and the second authentication server 701.

As a result, when it is determined that the authentication level of the first authentication server 601 is equal to or higher than the authentication level of the second authentication server 701, the authentication token is updated and updated in the authentication token inspection / update section 616, In step 630, the reply message shown in FIG. 6C is created and transmitted to the reply message receiving unit 728 of the second authentication server 701.

FIG. 6C is a conceptual schematic diagram showing the structure of the answer message created by answer message creating section 630. After that, the response message reception unit 728 passes the received new authentication token and the “trusted server list” included in the response message to the content return unit 710.

The content return unit 710 attaches the authentication token received from the first authentication server 601 based on the “trusted server list” received from the first authentication server 601, and converts the content obtained from the WWW content 703. , To the authentication client terminal 501.

(Example 3 of Method) An example of method 3 of the present embodiment applied to the above example of the apparatus will be described with reference to FIGS. The method example 3 is such that a certain user authenticates to the first authentication server 601.
This is a method applied when performing authentication in the second authentication server 701 which is a server different from the first authentication server 601 after performing authentication in.

In the method example 3, the first authentication server 6
It is assumed that the authentication level of 01 (authentication token issuer) is lower than the authentication level of the second authentication server 701 (authentication token destination). First, similarly to the above-mentioned method example 1,
When the user enters the authentication server group (the first authentication server 601 and the second
It is assumed that authentication is performed for the first time with respect to the authentication server 701). After that, it is assumed that an authentication request is made to a second authentication server 701 different from the first authentication server 601. The processing procedure at this time is shown in FIG.

FIG. 10 is a flowchart showing a processing procedure when the authentication level of the authentication server to which the authentication token is issued is lower than the authentication level of the authentication server to which the authentication token is used.

First, the user enters the authentication client terminal 5
01, and activates the content requesting unit 503 included in the processing program 502.
Transmits the content request information accompanied by the authentication token created by the first authentication server 601 to the authentication start unit 708 of the processing program 702 of the second authentication server 701 to request the content.

After receiving the content request information, the authentication start unit 708 determines whether the content of the request requires authentication, and calls the authentication processing unit 709 if authentication is required. The authentication processing unit 709 confirms that “authenticated authentication token” is attached to the content request information,
By referring to the “trusted server list 707”, it is confirmed that the authentication token is created by the trusted server.

Next, the inquiry message creation unit 727 sends the
The inquiry message shown in (b) is created, and the encrypted message is transmitted to the inquiry message reception unit 629 of the processing program 602 of the first authentication server 601 that has issued the authentication token.

The inquiry message receiving unit 629 compares the authentication levels of the first authentication server 601 and the second authentication server 701, and determines that the authentication level of the first authentication server 601 is lower than the authentication level of the second authentication server 701. In this case, the authentication token checking / updating unit 616 deletes the authentication token stored in the first authentication server 601, and the answer message creating unit 630 creates the answer message shown in FIG. Response message receiving unit 728 of authentication server 701
Send to

FIG. 6D is a conceptual schematic diagram showing the structure of the answer message created by answer message creating section 630. After that, the response message receiving unit 728 passes the received client information and the expiration date to the authentication token creating unit 711.

The authentication token creation unit 711 creates a new authentication token and passes the authentication token to the content return unit 710. The content return unit 710, based on the “trusted server list” 707,
01 and attach the newly created authentication token to the WW
The content acquired from the W content 703 is transmitted to the authentication client terminal 501.

[0100]

[Embodiment] Finally, a business model in which user billing is performed using the single sign-on authentication system described in the above apparatus example and method example will be described as an embodiment. FIG. 11 is a configuration diagram of a user authentication system device according to an embodiment of the present invention. In FIG.
.. Correspond to the authentication client terminal 501 shown in FIG. 1, and the authentication server 12 is the first authentication server 601 shown in FIG.
And the second authentication server 701.

The user authentication system device δ according to this embodiment includes a plurality of business servers 3 on the network 2.
(The business server group 10), the proxy authentication mechanism 5 set to enable the network connection, and all the terminal devices 1 that use the plurality of business servers 3, 3, 3,. , 1, 1... (Terminal device group 11) are configured to have an authentication server 12 including a password database 4 and a charging database 9 set so as to enable user authentication.

Here, the proxy authentication mechanism 5 in the authentication server 12 stores the total amount of the business server usage fee from each user of all the terminal devices 1, 1, 1,. .., A plurality of business servers 3, 3, 3,...
In order to collect the authentication server usage fee from 3, 3,... As a service server usage fee, the password database 4 and the charging database 9 are referred to, so that all the terminal devices 1, 1, 1,. A processing unit (not shown) for executing a process of periodically counting the business server usage fee for each user is newly provided.

In the above configuration, when a specific terminal device 1 in the terminal device group 11 performs a certain business using one of the business servers 3 included in the business server group 10,
The authentication server 12 collects the business server usage fee from the user of the terminal device 1 by proxy based on the data in the password database 4 and the charging database 9, and reduces the business server usage fee related to the proxy collection to the individual business server 3. , 3, 3,..., And periodically collects (receives payment) an authentication server usage fee as a collection agency fee from each business server 3, 3, 3,.

As described above, the user billing service which should be originally performed by the individual business servers 3, 3, 3,...
2 can be performed collectively, and accordingly, there is no need to individually perform the user billing business in the individual business servers 3, 3, 3,... , 3,... Can be reduced.

The embodiments of the present invention have been described above. However, the present invention is not necessarily limited to the above-mentioned items, and can be appropriately changed and implemented within the scope of achieving the objects of the present invention and achieving the following effects. It is. For example, the first authentication server 601 and the second authentication server 701 are not limited to personal computers, but may be PDAs (Personal Digit
al Assistants), mobile phones, personal handyphone systems (PHS), car navigation systems, game machines, and the like.

The network 2 is not limited to the Internet and an intranet, but may be an extranet, a local area network (LAN), a public telephone line, a dedicated telephone line, or the like.

[0107]

As described above, according to the present invention,
In a system that provides single sign-on that allows a user to access multiple servers with a single login, when the authentication status of a user is shared by multiple servers, each server manages the authentication status of the user in a distributed manner. It is possible to build a single sign-on system without the need for an authentication status management server that centrally manages the authentication status, thereby reducing system construction costs and operation management costs. Become.

Further, when the reliability of the authentication is superior among the plurality of authentication servers, the authentication state of the user is distributed and managed in each server according to the superiority of the reliability. It is possible to select and authenticate information having high reliability, and to increase the reliability of authentication, and to share an authentication state flexibly corresponding to a change in the trust relationship.

[0109] The information (authentication token) indicating the authentication status that is shared between the servers is attached to the server's signature, encrypted, and transmitted over the network, thereby providing high security for authentication. It is possible to secure.

[Brief description of the drawings]

FIG. 1 is a conceptual schematic diagram of an example of an apparatus according to an embodiment of the present invention.

FIG. 2 is a flowchart showing the operation of the above example of the apparatus.

FIG. 3 is a diagram showing a structure of a database in the example of the above device, wherein (a) shows a structure of an authentication database;
(B) shows the structure of the authentication status management database.

FIG. 4 is a flowchart illustrating a procedure when a user first requests authentication from an authentication server group in method example 1 according to an embodiment of the present invention.

FIG. 5 is an authentication token creation unit 6 in the method example 1 of the embodiment.
11 is a flowchart illustrating a processing procedure at 11.

FIGS. 6A and 6B are conceptual schematic diagrams showing the structures of various messages created by the above device example, where FIG. 6A shows the structure of an authentication token, FIG. 6B shows the structure of an inquiry message, and FIG. This is the structure of an answer message, and (d) is the structure of another answer message.

FIG. 7 is a flowchart showing a processing procedure in the same method example 1 when an authentication request is issued again to the same authentication server.

FIG. 8 is a flowchart showing a processing procedure of an authentication token verification / update unit 616 in Method Example 1 of the embodiment.

FIG. 9 is a flowchart illustrating a processing procedure when the authentication token issuer has a higher authentication level than the authentication token destination in the method example 2 which is the embodiment of the present invention.

FIG. 10 shows a method example 3 according to the embodiment of the present invention.
It is a flow chart which shows a processing procedure when an authentication token use destination has a higher authentication level than an authentication token issuer.

FIG. 11 is a configuration diagram of a user authentication system device according to an embodiment of the present invention.

FIG. 12 is a schematic conceptual diagram of a conventional system device having a single sign-on function.

FIG. 13 is a flowchart showing a processing procedure of the above system device.

[Explanation of symbols]

δ: User authentication system device according to one embodiment 1 ... Terminal device 2 ... Network 3 ... Business server 4 ... Password database 5 ... Proxy authentication mechanism 9 ... Billing database 10 ... Business server group 11 ... Terminal device group 12 ... Authentication server 101,501 ... Authentication client terminal 102,202,302,402,502,602,7
02 processing programs 201, 301, 601, 701 authentication servers 203, 303, 603, 703 WWW contents 403, 604, 704 authentication databases 404, 605, 705 authentication state management databases 606, 706 trusted servers Lists 607, 707: Trusted server list 503: Content request unit 504: Authentication processing unit 608 ... Authentication start unit 609 ... Authentication processing unit 610 ... Content return unit 611 ... Authentication token creation unit 612 ... Expiration date creation unit 613 ... Authentication ID Creation unit 614 ... Signature creation unit 615 ... Common key encryption unit 616 ... Authentication token verification / update unit 617 ... Authentication token issuer verification unit 618 ... Common key decryption unit 619 ... Signature verification unit 620 ... Authentication ID verification unit 621 ... Client information Verification unit 622: Validity period Verification unit 623 ... Expiration date update unit 624 ... Authentication ID update unit 625 ... Signature creation unit 626 ... Common key encryption unit 629 ... Query message reception unit 630 ... Reply message creation unit 708 ... Authentication start unit 709 ... Authentication processing unit 710 ... Contents Return unit 711: Authentication token creation unit 727: Inquiry message creation unit 728: Answer message reception unit

 ──────────────────────────────────────────────────続 き Continued from the front page F term (reference) 5B085 AE00 AE02 BC01 5J104 AA08 KA01 KA02 MA03 NA05 PA07

Claims (15)

[Claims] 1. A single sign-on authentication method provided for an authentication system for providing a service limited to a specific user, wherein a plurality of servers existing on a network share the authentication status of the user. A single sign-on authentication method, wherein each of the plurality of servers manages the authentication state of a user in a distributed manner. 2. A single sign-on authentication method provided for an authentication system for providing a service limited to a specific user, wherein a plurality of servers existing on a network share the authentication status of the user. A first authentication server that has been requested for content from an authentication client terminal operated by a user executes authentication of the user, holds an authentication state as a result of the authentication execution, and an authentication token indicating the authentication state And a second authentication server, which has been requested for content from an authentication client terminal operated by the user, uses the authentication token created in the first authentication process to authenticate the user. And a second authentication process for performing the process of (1). 3. The first authentication process, wherein, in response to the authentication client terminal requesting content from the first authentication server, a first authentication process requesting a user authentication process for the authentication client terminal is performed.
An authentication processing requesting step; a first authentication processing receiving step in which the first authentication server receives an authentication processing request generated in the first authentication processing requesting step; and an authentication processing received in the first authentication processing receiving step. For each request, execute authentication, hold an authentication state as a result of the authentication execution, create an authentication token indicating the authentication state, and sequentially issue an authentication process to the authentication client terminal. The second authentication process includes: in response to the authentication client terminal requesting content from the second authentication server, requesting a user authentication process for the authentication client terminal.
An authentication processing requesting step; a second authentication processing receiving step in which the second authentication server receives an authentication processing request generated in the second authentication processing requesting step; and an authentication processing received in the second authentication processing receiving step. In response to the request, the second authentication server, based on the authentication token created in the authentication process of the first authentication process and transmitted from the authentication client terminal, The said first
An authentication status inquiry step of inquiring an authentication server about the validity of the authentication token; and an inquiry about the validity of the authentication token generated in the authentication state inquiry step. 3. The single sign-on authentication method according to claim 2, wherein an authentication status replying step of transmitting the authentication status of the first authentication server to the second authentication server is sequentially and continuously performed. 4. The authentication step includes, when issuing the authentication token, including, in the authentication token, an electronic signature that identifies the first authentication server that has issued the authentication token. 4. The single sign-on authentication method according to claim 3, wherein a signature creation process is also performed. 5. The authentication step includes performing a common key encryption process of encrypting the authentication token using a common key shared by the first authentication server and the second authentication server and issuing the authentication token to the authentication client terminal. The single sign-on authentication method according to claim 4, further comprising: 6. The single sign-on authentication method, wherein each of the first authentication server and the second authentication server holds an authentication level serving as a parameter indicating the reliability of each server regarding authentication. (2) When the authentication token is received, the authentication level is compared with the authentication level of the first authentication server and the authentication level of the second authentication server, and the authentication state is managed based on a result of the comparison. The single sign-on authentication method according to claim 5, wherein an authentication token inspection update process is also performed. 7. The authentication token inspection updating process, wherein when the authentication level of the second authentication server is higher than the authentication level of the first authentication server, the authentication state is managed by the second authentication server. At the same time, the authentication state managed by the first authentication server is discarded, and when the authentication level of the first authentication server is higher than the authentication level of the second authentication server, the authentication state is not changed. 7. The single sign-on authentication method according to claim 6, comprising processing to be managed by a first authentication server. 8. The authentication token inspection update processing includes: a common key decryption processing for decrypting the authentication token using the common key; and a signature verification for verifying a signature included in the authentication token in the signature creation processing. Processing, an authentication ID verification process for verifying an authentication ID of a user included in the authentication token, a client information verification process for verifying information included in the authentication token and identifying the authentication client terminal, Performing an expiration date verification process for verifying the expiration date of the authentication token, which is information included in the authentication token, and also performing a process of determining the validity of the authentication token. 7. The single sign-on authentication method according to 7. 9. A single sign-on authentication system apparatus for performing authentication for providing a service limited to a specific user, wherein a plurality of servers existing on a network share the authentication state of the user. An authentication client terminal that requests content, performs authentication in response to a content request from the authentication client terminal, holds an authentication state that is a result of the authentication execution, and sends an authentication token indicating the authentication state to the authentication client. A first authentication server for issuing to the terminal, when performing authentication in response to a content request from the authentication client terminal, receiving the authentication token from the authentication client terminal; A second authentication server that queries the authentication server for the validity of the authentication token. To, single sign-on authentication system and wherein the. 10. The first authentication server, when issuing the authentication token, adds an electronic signature that identifies the first authentication server that has issued the authentication token to the authentication token. The single sign-on authentication system device according to claim 9, further comprising a signature creation unit to attach. 11. The first authentication server has a common key encryption unit that encrypts the authentication token using a common key shared by the first authentication server and the second authentication server, The single sign-on authentication system device according to claim 10, wherein the authentication token encrypted by an encryption unit is configured to be freely issued to the authentication client terminal. 12. The second authentication server, upon receiving the authentication token, compares an authentication level of the first authentication server with an authentication level of the second authentication server, When the authentication level of the second authentication server is higher than the authentication level, the authentication state is managed by the second authentication server, and the authentication state managed by the first authentication server can be discarded. The single sign-on authentication system device according to claim 9, 10 or 11, wherein: 13. The first authentication server and the second authentication server each have a trusted server list for limiting an issue destination of the authentication token, and a server listed in the trusted server list. 13. The single sign-on authentication system device according to claim 12, wherein the authentication token is configured to be issued only for the user. 14. The first authentication server and the second authentication server each have a trusted server list used for determining the trust of the received authentication token, and the received authentication token is included in the trusted server list. The single sign-on authentication system device according to claim 13, wherein the server is configured to be able to confirm whether the server has been issued by the listed server. 15. The authentication server according to claim 1, wherein the first authentication server and the second authentication server respectively hold an ID of a user to be authenticated, a password of the user, and information for specifying the user in association with each other. A database, an ID of an authenticated user, a temporary ID changed for each access of the user, an address of the authentication client terminal operated by the user, an expiration date of an authentication state of the user, The single sign-on authentication system device according to claim 14, further comprising: an authentication status management database that holds the information specifying the user in association with each other.