JP2005301424A - Distributed authentication system, load distribution device, authentication server, load distribution program, and authentication program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To surely perform authentication even if a system configuration having a plurality of authentication servers for an authentication site in a Pull model of SSO. <P>SOLUTION: In the authentication site S1, this load distribution device 12 distributes an authentication request from a Web user u to one of the authentication servers 11i. The authentication server 11i receiving the authentication request generates a ticket issue certificate when it is determined that the Web user u is already authenticated. Then, the authentication server 11i transmits the ticket issue certificate to the Web user u. In this process, the load distribution device 12 stores the ticket issue certificate and an IP address of the authentication server 11i in association with each other. In receipt of an SAML authentication request including the ticket issue certification from a service site S2, the load distribution device 12 in the authentication site S1 specifies the authentication server issuing the ticket issue certificate based on the stored correspondence table and transfers the SAML authentication request to the authentication server 11i. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a single sign-on (hereinafter referred to as SSO) technology using SAML (Security Assertion Mark-up Language), and more specifically, a distributed authentication system and distributed authentication in an SSO Pull model. The present invention relates to a load distribution device and an authentication server used in the system, and a load distribution program and an authentication program.

  Normally, in order to use a plurality of Web sites that require authentication, a Web user must input authentication information for each site. However, this is troublesome and the management of authentication information (ID, password, etc.) is troublesome. Therefore, recently, there is an increasing demand for SSO that enables the use of a plurality of Web sites with a single authentication. For example, in SSO using SAML, if the Web site supports SAML, the source site and the destination site communicate with each other using the SAML protocol and automatically authenticate when moving to another site. Information is carried over.

  FIG. 7 is a diagram showing the concept of SSO. When the Web user u is first authenticated by the source Web site (authentication site) SWS, it can access the other Web site (target site) DWS without authenticating again using this authentication information later. .

  Here, if SAML is used for SSO, the following two models can be considered. One is called a Pull model, in which the target website DWS that has received the access request inquires of the source website SWS about the authentication information of the Web user u and extracts the authentication information (PULL). The procedure of SSO authentication in the Pull model will be described with reference to FIG.

  First, the web user u is authenticated by the source website SWS (step S1). Next, the web user u requests a link to the target website DWS (step S2). As a result, the source website SWS provides a reference destination (for example, the URL of the source website SWS; a handle of a SAML assertion described later, also referred to as a ticket issue certificate) d1 to the web user u, and the web user u is redirected to the target website DWS (step S3). As a result, the Web user u provides the authentication reference destination d1 to the target Web site DWS, and requests the resources of the target Web site DWS (step S4).

  The target website DWS inquires of the source website SWS about the authentication information of the web user u in accordance with the authentication reference destination d1 (step S5). This is a request for a SAML assertion (hereinafter also referred to as an authenticated ticket) d2 to the source website SWS. The SAML assertion d2 is a statement that proves the content of an inquiry regarding the authentication of the Web user u. On the other hand, when confirming this request, the source website SWS issues a SAML assertion d2 and provides it to the target website DWS (step S6). As a result, the target website DWS provides resources to the web user u, and the web user u can use the resources of the target website DWS (step S7).

  The other is called a Push model, which is a model in which the source website SWS issues authentication information to the target website DWS in response to a request from the web user u. The procedure of SSO authentication in the Push model will be described with reference to FIG.

  First, the web user u is authenticated at the source website SWS (step S11). Next, the web user u requests a link to the target website DWS (step S12). Thereby, the source website SWS transmits a request to use the resource of the target website DWS (step S13). This provides the target Web site DWS with a SAML assertion d2 that proves the access authority. The target website DWS provides an access decision reference destination (for example, the URL of the source website SWS) to the source website SWS that is permitted to access (step S14).

  The source Web site SWS provides the SAML assertion d2 including the determination reference destination to the Web user u, and redirects the Web user u to the target Web site (step S15). As a result, the Web user u presents the reference for determination and requests the resource of the target Web site DWS (step S15). In contrast, the target website DWS provides resources to the Web user u, and the Web user u can use the resources of the target website DWS (step S17).

The prior art document information related to this application includes the following.
Yuichi Suzuki, “(Series) Web Service Security 4th XML Authentication / Authorization Service (SAML) for Strong SSO”, [online], [March 25, 2004 Search], Atmark Corporation IT, Internet <URL: http://www.atmarkit.co.jp/fsecurity/rensai/webserv04/webserv02.html> Takashi Ueda, “SAML Technical Explanation”, [online], [Search on March 25, 2004], XML Consortium, Internet <URL: http://www.xmlconsortium.org/websv/kaisetsu/C10/main.html >

  By the way, it is anticipated that a large amount of authentication requests will occur due to an increase in demand for the above-described SSO, and a system configuration including a plurality of authentication servers that perform authentication processing is considered in the authentication site (source Web site) SWS. However, in the Pull model described above, the authentication reference destination has only information on which site is authenticated (for example, information on the URL), so the ticket issue certificate d1 issued by the authentication site SWS is used as the Web user u. Is transmitted to the target website DWS, and when the target website DWS transmits the ticket issuance proof d1 to the authentication site SWS to obtain the authenticated ticket d2 (steps S4 to S6 in FIG. 8), the communication between servers is an error. There is a possibility. This is because the authentication site SWS that has received the ticket issuance proof d1 cannot recognize which authentication server has issued the ticket issuance proof d1, and the load distribution apparatus may distribute the ticket issuance proof d1 to which authentication server. This is due to the problem of not knowing. That is, there is a problem that even if the source website SWS issues a SAML request, the SAML assertion (authenticated ticket) d2 cannot always be received.

  On the other hand, in the Push model, even if the authentication site SWS has a system configuration including a plurality of authentication servers, the SAML assertion (authenticated ticket) d2 is provided to the Web user u, and the step S5 in the Pull model and Since there is no communication between servers as shown in S6, the above-mentioned problem does not occur.

  The present invention has been made in view of the above circumstances, and in the SSO Pull model, even if the authentication site employs a system configuration in which a plurality of authentication servers are provided and the load is distributed, authentication can be reliably performed. An object of the present invention is to provide a distributed authentication system that can be used, a load distribution device and an authentication server used in the distributed authentication system, and a load distribution program and an authentication program.

  In order to achieve the above object, the present invention according to claim 1 is a distributed authentication system that performs authentication in response to an authentication request from a user under a pull-type single sign-on method, and includes a plurality of authentication servers. And a load balancer that distributes authentication processing to any of the plurality of authentication servers, and the load balancer authenticates the user after any of the plurality of authentication servers authenticates the user. An identification information storage means for storing the temporary authentication information and the identification information that can identify the authenticated authentication server in association with each other when transmitting temporary authentication information indicating the authentication reference destination via the load balancer; When the predetermined site requested by the user requests authentication information and requests the distributed authentication system to include the temporary authentication information, it is stored in the received temporary authentication information and the identification information storage. Based on the information, the user to identify the authentication server that authenticates, and having a a request distributing means for distributing the request received to the specified authentication server.

  The present invention according to claim 2 is load distribution in which authentication processing is distributed to any of a plurality of authentication servers in a distributed authentication system that performs authentication in response to an authentication request from a user based on a pull-type single sign-on method. When the temporary authentication information indicating the authentication reference destination is transmitted to the user via the load balancer after any of the plurality of authentication servers authenticates the user, the temporary authentication Identification information storage means for storing information and identification information for identifying an authenticated authentication server in association with each other, and a predetermined site requested by the user to connect to the distributed authentication system for authenticated information. When a request including temporary authentication information is made, the authentication server that authenticates the user is identified and specified based on the received temporary authentication information and the information stored in the identification information storage means. Characterized in that it has a request distributing means for distributing the request received in testimony server, the.

  According to a third aspect of the present invention, there is provided a distributed authentication system for performing authentication in response to an authentication request from a user based on a pull-type single sign-on method, comprising a plurality of authentication servers and the plurality of authentication servers. And a storage device that can be shared by the plurality of authentication servers, each of the plurality of authentication servers being assigned authentication processing from the load distribution device, and When the user is authenticated, temporary authentication information storage means for storing temporary authentication information indicating a reference destination of the issued authentication in the storage device and a predetermined site requested by the user for connection are requested for authenticated information. When a request including the temporary authentication information is made to the distributed authentication system and the request is distributed from the load balancer, the received temporary authentication information is stored in the information stored in the storage device. Confirmed it based on, and having an authentication check means for issuing the authenticated information.

  According to a fourth aspect of the present invention, there is provided a plurality of authentication servers, a load balancer that distributes authentication processing to any of the plurality of authentication servers, and the plurality of authentication servers based on a pull-type single sign-on method. And a sharable storage device for authenticating an authentication request from a user, wherein the authentication server distributes authentication processing from the load balancer and authenticates the user The temporary authentication information storage means for storing the temporary authentication information indicating the reference destination of the issued authentication in the storage device, and the predetermined site requested by the user to connect to the distributed authentication system for the authenticated information When the request including the temporary authentication information is distributed to the load balancer, the received temporary authentication information is based on the information stored in the storage device. Verify, and having an authentication check means for issuing the authenticated information.

  The present invention according to claim 5 is a distributed authentication system that performs authentication in response to an authentication request from a user based on a pull-type single sign-on method, and includes a plurality of authentication servers and the plurality of authentication servers. A load balancer that distributes the authentication process to any one of the plurality of authentication servers, and each of the plurality of authentication servers is assigned an authentication process by the load balancer and identifies the authenticated authentication server when authenticating the user. Temporary authentication information indicating a reference destination of authentication, to which possible identification information is added, is created and transmitted to the user, and the load balancer has authenticated the predetermined site requested by the user for connection. When a request including the temporary authentication information is made to the distributed authentication system in response to information, the authentication server that authenticates the user is identified from the identification information added to the received temporary authentication information. Characterized in that distributes the requests received in the authentication server has.

  According to the sixth aspect of the present invention, in a distributed authentication system that performs authentication in response to an authentication request from a user based on a pull-type single sign-on method, load distribution that distributes authentication processing to any of a plurality of authentication servers The distributed authentication system authenticates the user and transmits temporary authentication information indicating an authentication reference destination to which the identification information capable of specifying the authenticated authentication server is added to the user. Later, when a predetermined site requested by the user for connection requests for the authenticated information and includes the temporary authentication information in the distributed authentication system, the identification information added to the received temporary authentication information is used. The authentication server authenticating the user is specified, and the received request is distributed to the specified authentication server.

  The present invention according to claim 7 comprises a plurality of authentication servers and a load balancer that distributes the authentication processing to any of the plurality of authentication servers based on a pull-type single sign-on method. An authentication server in a distributed authentication system that performs authentication in response to an authentication request from the server, wherein authentication processing can be assigned from the load balancer and the authenticated server can be identified when the user is authenticated Temporary authentication information indicating an authentication reference destination to which information is added is created and transmitted to the user.

  The present invention according to claim 8 is a load distribution that distributes authentication processing to one of a plurality of authentication servers in a distributed authentication system that performs authentication in response to an authentication request from a user under a pull-type single sign-on method. A load balancing program readable by the apparatus, wherein after any of the plurality of authentication servers authenticates the user, temporary authentication information indicating an authentication reference destination is transmitted to the user via the load distribution apparatus An identification information storage step for storing the temporary authentication information and identification information that can identify the authenticated authentication server in association with each other, and a predetermined site requested by the user to request authentication information. When the request including the temporary authentication information is made to the distributed authentication system, the user is based on the received temporary authentication information and the information stored in the identification information storage means. Identify the authentication server authenticates, characterized in that to execute the request switching step for distributing request received to the identified authentication server, to the load balancer.

  According to a ninth aspect of the present invention, there is provided a plurality of authentication servers, a load balancer that distributes authentication processing to any of the plurality of authentication servers, and the plurality of authentication servers based on a pull-type single sign-on method. An authentication program readable by the authentication server in a distributed authentication system that authenticates an authentication request from a user with a sharable storage device, and the authentication processing can be distributed from the load distribution device, When the user is authenticated, temporary authentication information storing step for storing temporary authentication information indicating a reference destination of the issued authentication in the storage device, and a predetermined site requested by the user to connect the authenticated information When the request including the temporary authentication information is made to the distributed authentication system and the request is distributed from the load balancer, the received temporary authentication information Based on stored in the storage device information to verify, characterized in that to execute the authentication confirmation issuing the authenticated information, to the authentication server.

  According to the tenth aspect of the present invention, in a distributed authentication system that performs authentication in response to an authentication request from a user based on a pull-type single sign-on method, load distribution that distributes authentication processing to one of a plurality of authentication servers A load balancing program readable by a device, wherein the distributed authentication system authenticates the user, and identification information that can identify the authenticated authentication server is added to the load balancing device When a predetermined site requested by the user for connection after transmitting temporary authentication information indicating an authentication reference destination makes a request including the temporary authentication information to the distributed authentication system for authenticated information Identifying the authentication server that has authenticated the user from the identification information added to the received temporary authentication information, and causing the identified authentication server to distribute the received request. And butterflies.

  The present invention according to claim 11 comprises a plurality of authentication servers and a load balancer that distributes the authentication processing to any of the plurality of authentication servers under the Pull-type single sign-on method, An authentication program readable by the authentication server in a distributed authentication system that performs authentication in response to an authentication request from the server, when authentication processing is distributed to the authentication server from the load balancer and the user is authenticated Is characterized in that provisional authentication information indicating an authentication reference destination, to which identification information that can identify an authenticated authentication server is added, is created and transmitted to the user.

  According to the present invention, in the SSO Pull model, even if the authentication site employs a system configuration in which a plurality of authentication servers are provided and the load is distributed, it is used for a distributed authentication system and a distributed authentication system that can perform authentication reliably. The load distribution apparatus and the authentication server, and the load distribution program and the authentication program can be provided.

  As a result, even if a demand for SSO increases and a large amount of authentication requests are generated, it is possible to respond to a large amount of authentication requests. In addition, the SSO Pull model does not depend on the type of user terminal used by the user as compared to the Push model, so that convenience for the user can be improved.

  Specifically, in the present invention, since the load balancer stores the temporary authentication information and the authentication server identification information in association with each other, the load balancer can accurately identify the authentication server that issued the temporary authentication information, There is an effect that authenticated information can be issued with certainty.

  In addition, the present invention includes a storage device that can be shared by each authentication server, and stores temporary authentication information in the storage device. There is an effect that it can be issued.

  Furthermore, since the present invention uses temporary authentication information including the identification information of the authenticated authentication server, the load balancer can accurately identify the authentication server that issued the temporary authentication information, and reliably authenticate information. Can be issued.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

<First Embodiment>
FIG. 1 is a schematic configuration diagram of an SSO system 100 to which the distributed authentication system 10 according to the first exemplary embodiment of the present invention is applied. An SSO system 100 shown in FIG. 1 is a Pull model SSO system using SAML, a distributed authentication system 10 constructed in an authentication site S1, a service server 1 provided in a service site S2, and providing a predetermined service, The system configuration includes a user terminal 2 used by the Web user u and a communication network 3 that enables the authentication site S1, the service site S2, and the user terminal 3 to communicate with each other. With such a system configuration, communication using the SAML protocol is possible between the authentication server (described later) of the authentication site S1 and the service server 1 of the service site S2, and authentication that is a SAML message is performed. Information is exchanged by SOAP (Simple Object Access Protocol).

  Here, the distributed authentication system 10 distributes the authentication requests from the plurality of authentication servers 11i (i = a, b,..., N) that authenticate the Web user u and the Web user u to any one of the authentication servers 11i. The load balancing device 12 is provided. The user terminal 2 has a browser function.

  Note that the authentication server 11i, the load distribution device 122, the service server 1, and the user terminal 3 that constitute the distributed authentication system 10 described above are at least a central processing unit (CPU), a program and data having a calculation function and a control function. Is composed of an electronic device having a main storage device (memory) composed of a RAM or the like having a function of storing data. In addition to the main storage device, these devices may include an auxiliary storage device such as a hard disk. Furthermore, a program for executing various processes according to the present embodiment is stored in the main storage device or the hard disk described above. The program can be recorded on a computer-readable recording medium such as a hard disk, a flexible disk, a CD-ROM, an MO, or a DVD-ROM, or can be distributed via a communication network.

  Next, the operation of the SSO system 100 to which the distributed authentication system 10 according to the present embodiment is applied will be described with reference to FIG. Here, FIG. 2 is a sequence diagram illustrating communication exchanges between the Web user u, the authentication site S1, and the service site S2. The operation of the SSO system 100 in the present embodiment is almost the same as that in the Pull model shown in FIG. 8 in which the source website SWS is replaced with the authentication site S1 and the target website DWS is replaced with the service site S2. There is a difference in the first access destination of the Web user u. That is, in this embodiment, as will be described later, the service site S2 is first accessed, whereas in the Pull model shown in FIG. 8, the source Web site SWS (authentication site S1) is accessed, but the Pull model is used. The operation based on is substantially the same.

  First, the web user u accesses the service site S2 from the user terminal 2 (step S110). In the service site S2, since the web user u is not authenticated, the web user u is redirected to the authentication site S1 (step S120). Thereby, the web user u accesses the authentication site S1 (step S130).

  In the authentication site S1, when an authentication request is received from the Web user u, the load balancer 12 randomly distributes the authentication request and transmits the authentication request to one of the authentication servers 11i (step S140). Upon receiving the authentication request, the authentication server 11i performs an authentication process with the Web user u (for example, the Web user u is input and authenticated), and generates a ticket issuance proof d1 when the authentication is completed. (Steps S150 and S160). Here, the ticket issuance proof d1 is a ticket for obtaining the authenticated ticket d2 as described above. Specifically, the ticket issuance proof d1 is information regarding the session ID and authentication reference destination (information about which authentication site has authenticated). ).

  Next, the authentication server 11i transmits the ticket issuance proof d1 to the web user u via the load balancer 12, and redirects the web user u to the service site S2 (step S170). At this time, the load balancer 12 associates the ticket issuance certificate d1 with the IP address of the authentication server 11i that has issued the ticket issuance certificate d1, and stores them in a predetermined storage unit (step S180).

  The Web user u accesses the service site S2 with the received ticket issue certificate d1 (step S190). When the service site S2 receives the ticket issuance proof d1 from the Web user u, the service site S2 makes a SAML authentication request including the ticket issuance proof d1, that is, a request for the authenticated ticket d2 to the authentication site S1 (step S200). .

  When receiving the SAML authentication request from the service site S2, the load distribution device 12 of the authentication site S1 is included in the SAML authentication request from the correspondence table of the ticket issuance certificate d1 stored in the predetermined storage unit and the IP address of the authentication server 11i. Corresponding information corresponding to the ticket issuance proof d1 is identified, the authentication server 11i that issued the ticket issuance proof d1 is specified according to the IP address of the correspondence information, and the SAML authentication request is transferred to the authentication server 11i (step S210). ).

  As a result, the authentication server 11i can reliably receive the SAML request for the ticket issuance certificate d1 issued by itself, so that it confirms the ticket issuance certificate d1 and issues the authenticated ticket d2, and the service site S2 This authenticated ticket d2 is transmitted as a SAML authentication response (step S220).

  Upon receiving the authenticated ticket d2, the service site S2 can confirm that the Web user u is an authenticated user, and provides a predetermined service to the Web user u (Steps S230 and S240).

  Therefore, according to the SSO system 100 according to the present embodiment, even if the authentication site S1 includes a plurality of authentication servers 11i and distributes the load in the SSO Pull model, the load distribution apparatus 12 can Since the issuance certificate d1 and the IP address of the authentication server 11i that issued the ticket issuance certificate d1 are stored in association with each other, the SAML authentication request from the service site S2 can be accurately distributed to the authentication server 11i that has authenticated the web user u. it can.

  As a result, even if a large number of authentication requests are generated from the Web user u, the authentication site S1 can reliably perform the authentication process and issue the authenticated ticket d2 to the service site S2.

  Further, according to the present embodiment, since no system modification occurs in the distributed server 11i and the service server 1, the SSO system 100 can be constructed using the existing distributed server 11i and the service server 1.

  Furthermore, since the SSO Pull model is not limited by the type of user terminal 2 compared to the Push model, the present invention can be applied to a wide range of user terminals 2 such as mobile phones and PDAs.

<Second Embodiment>
FIG. 3 is a schematic configuration diagram of an SSO system 200 to which the distributed authentication system 20 according to the second exemplary embodiment of the present invention is applied. The SSO system 200 shown in FIG. 3 is a Pull model SSO system using SAML. The distributed authentication system 20 constructed in the authentication site S1, the service server 1 provided in the service site S2, and providing a predetermined service, The system configuration includes a user terminal 2 used by the Web user u and a communication network 3 that enables the authentication site S1, the service site S2, and the user terminal 2 to communicate with each other. With such a system configuration, communication using the SAML protocol is possible between an authentication server, which will be described later, of the authentication site S1 and the service server 1 of the service site S2, and authentication that is a SAML message. Information is exchanged by SOAP. In the present embodiment, only the configuration and functions different from those of the first embodiment will be described, and the other components and functions will be denoted by the same reference numerals and the description thereof will be omitted.

  Here, the distributed authentication system 20 loads a plurality of authentication servers 21i (i = a, b,..., N) that authenticate the user u and an authentication request from the Web user u to any one of the authentication servers 21i. The distributed device 22 and the shared memory 23 accessible by each authentication server 21i are provided. The shared memory 23 may be hardware that is physically separate from the authentication server 21i, or is not physically separate hardware, but logically shares the hardware included in the authentication server 21i. The hardware may be the shared memory 23.

  Note that the authentication server 21i and the load distribution device 222 constituting the distributed authentication system 20 described above include a central processing unit (CPU) having at least a calculation function and a control function, a RAM having a function for storing programs and data, and the like. It is composed of an electronic device having a main memory (memory), and the shared memory 23 has a function of the main memory. In addition to the main storage device, these devices may include an auxiliary storage device such as a hard disk. Furthermore, a program for executing various processes according to the present embodiment is stored in the main storage device or the hard disk described above. The program can be recorded on a computer-readable recording medium such as a hard disk, a flexible disk, a CD-ROM, an MO, or a DVD-ROM, or can be distributed via a communication network.

  Next, the operation of the SSO system 200 to which the distributed authentication system 20 according to the present embodiment is applied will be described with reference to FIG. Here, FIG. 4 is a sequence diagram illustrating communication exchanges between the Web user u, the authentication site S1, and the service site S2. Note that the operation of the SSO system 200 in the present embodiment is similar to that in the first embodiment, in the Pull model shown in FIG. 8, replacing the source website SWS with the authentication site S1, and the target website DWS with the service site S2. The first access destination of the Web user u is different. That is, in this embodiment, as will be described later, the service site S2 is first accessed, whereas in the Pull model shown in FIG. 8, the source Web site SWS (authentication site S1) is accessed, but the Pull model is used. The operation based on is substantially the same.

  First, the web user u accesses the service site S2 from the user terminal 2 (step S310). In the service site S2, since the web user u is not authenticated, the web user u is redirected to the authentication site S1 (step S320). Thereby, the web user u accesses the authentication site S1 (step S330).

  In the authentication site S1, when an authentication request is received from the Web user u, the load distribution apparatus 22 randomly distributes the authentication request and transmits the authentication request to any one of the authentication servers 21i (step S340). Upon receiving the authentication request, the authentication server 21i performs an authentication process with the Web user u (for example, by inputting the ID and password to the Web user u to perform authentication). The ticket issuance certificate d1 is generated and stored in the shared memory 23 (steps S350, S360, S370).

  Next, the authentication server 21i transmits the ticket issuance proof d1 to the web user u and redirects the web user u to the service site S2 (step S380).

  The Web user u accesses the service site S2 with the received ticket issue certificate d1 (step S390). When the service site S2 receives the ticket issuance proof d1 from the Web user u, the service site S2 makes a SAML authentication request including the ticket issuance proof d1, that is, a request for the authenticated ticket d2 to the authentication site S1 (step S400). .

  When receiving the SAML authentication request from the service site S2, the load distribution device 22 at the authentication site S1 transfers the SAML authentication request to any one of the authentication servers 21i at random (step S410).

As a result, when the authentication server 21i receives the SAML authentication request, the authentication server 21i refers to the shared memory 23, confirms the ticket issuance proof d1 included in the SAML authentication request, issues an authenticated ticket d2, and sends this to the service site S2. The authenticated ticket d2 is transmitted as a SAML authentication response (step S420).
Upon receiving the authenticated ticket d2, the service site S2 can confirm that the Web user u is an authenticated user, and provides a predetermined service to the Web user u (Steps S430 and S440).

  Therefore, according to the SSO system 200 according to the present embodiment, even if the authentication site S1 includes a plurality of authentication servers 11i and distributes the load in the SSO Pull model, each authentication server 21i can be accessed. Since the ticket issuer certificate d1 is stored in the shared memory 23, the authentication is surely performed even if the SAML authentication request from the service site S2 is not sent to the authentication server 21i that issued the ticket issuer certificate d1. Processing can be performed, and the authenticated ticket d2 can be issued to the service site S2.

  In addition, the SSO Pull model is not limited by the type of user terminal 2 compared to the Push model, and therefore the present invention can be applied to a wide range of user terminals 2 such as mobile phones and PDAs.

<Third Embodiment>
FIG. 5 is a schematic configuration diagram of an SSO system 300 to which the distributed authentication system 30 according to the third exemplary embodiment of the present invention is applied. An SSO system 300 shown in FIG. 3 is a Pull model SSO system using SAML. The distributed authentication system 30 constructed in the authentication site S1, the service server 1 provided in the service site S2, and providing a predetermined service, The system configuration includes a user terminal 2 used by the Web user u and a communication network 3 that enables the authentication site S1, the service site S2, and the user terminal 3 to communicate with each other. With such a system configuration, communication using the SAML protocol is possible between the authentication server (described later) of the authentication site S1 and the service server 1 of the service site S2, and authentication that is a SAML message is performed. Information is exchanged by SOAP. In the present embodiment, only configurations and functions different from those of the above-described embodiment will be described, and with regard to other configurations and functions, the same portions are denoted by the same reference numerals, and description thereof will be omitted.

  Here, the distributed authentication system 30 distributes the authentication requests from the plurality of authentication servers 31i (i = a, b,..., N) that authenticate the user u and the web user u to any one of the authentication servers 31i. The load balancing device 32 is provided.

  The authentication server 31i and the load distribution device 32 constituting the distributed authentication system 30 described above include a central processing unit (CPU) having at least a calculation function and a control function, a RAM having a function for storing programs and data, and the like. It is composed of an electronic device having a main storage device (memory). In addition to the main storage device, these devices may include an auxiliary storage device such as a hard disk. Furthermore, a program for executing various processes according to the present embodiment is stored in the main storage device or the hard disk described above. The program can be recorded on a computer-readable recording medium such as a hard disk, a flexible disk, a CD-ROM, an MO, or a DVD-ROM, or can be distributed via a communication network.

  Next, the operation of the SSO system 300 to which the distributed authentication system 30 according to the present embodiment is applied will be described with reference to FIG. Here, FIG. 6 is a sequence diagram showing communication exchanges between the Web user u, the authentication site S1, and the service site S2. Note that the operation of the SSO system 300 in the present embodiment is similar to the above-described embodiment, in which the source website SWS is replaced with the authentication website S1 and the target website DWS is replaced with the service website S2 in the Pull model shown in FIG. The first access destination of the Web user u is different. That is, in this embodiment, as will be described later, the service site S2 is first accessed, whereas in the Pull model shown in FIG. 8, the source Web site SWS (authentication site S1) is accessed, but the Pull model is used. The operation based on is substantially the same.

  First, the web user u accesses the service site S1 from the user terminal 2 (step S510). In the service site S2, since the web user u is not authenticated, the web user u is redirected to the authentication site S1 (step S520). Thereby, the web user u accesses the authentication site S1 (step S530).

  In the authentication site S1, when an authentication request is received from the Web user u, the load balancer 32 randomly distributes the authentication request and transmits the authentication request to one of the authentication servers 31i (step S540). Upon receiving the authentication request, the authentication server 31i performs an authentication process with the Web user u (for example, the Web user u is input and authenticated), and when it is authenticated, the ticket issuance proof d1 ′ Is generated (steps S550 and S560). Here, the ticket issue certificate d1 ′ is obtained by adding the IP address of the authenticated authentication server 31i to the ticket issue certificate d1 in the above-described embodiment. Information indicating which authentication site has been authenticated) and the IP address of the authentication server 31i.

  Next, the authentication server 31i transmits the ticket issuance proof d1 'to the web user u and redirects the web user u to the service site S2 (step S570).

  The Web user u accesses the service site S2 with the received ticket issue certificate d1 '(step S580). When the service site S2 receives the ticket issuance proof d1 ′ from the Web user u, the service site S2 makes a SAML authentication request including the ticket issuance proof d1 ′, that is, a request for the authenticated ticket d2 to the authentication site S1 (step S1). S590).

  When receiving the SAML authentication request from the service site S2, the load distribution device 32 of the authentication site S1 extracts the information related to the IP address of the authentication server 31i included in the SAML authentication request, specifies the authentication server 31i, and specifies The SAML authentication request is transferred to the authentication server 31i (step S600).

  As a result, the authentication server 31i can reliably receive the SAML request for the ticket issuance proof d1 ′ issued by itself, so it confirms the ticket issuance proof d1 ′, issues the authenticated ticket d2, This authenticated ticket d2 is transmitted to the site S2 as a SAML authentication response (step S610).

  When receiving the authenticated ticket d2, the service site S2 can confirm that the Web user u is an authenticated user, and provides a predetermined service to the Web user u (steps S620 and S630).

  Therefore, according to the SSO system 300 according to the present embodiment, even if the authentication site S1 includes a plurality of authentication servers 31i and adopts a system configuration in which the load is distributed in the SSO Pull model, the authentication server 31i Since the ticket issuance proof d1 ′ to which the IP address of 31i is added is generated, the load balancer 32 refers to the ticket issuance proof d1 ′ to authenticate the SAML authentication request from the service site S2 by authenticating the Web user u. The server 11i can be accurately distributed.

  As a result, even if a large number of authentication requests are generated from the Web user u, the authentication site S1 can reliably perform the authentication process and issue the authenticated ticket d2 to the service site S2.

  In addition, the SSO Pull model is not limited by the type of user terminal 2 compared to the Push model, and therefore the present invention can be applied to a wide range of user terminals 2 such as mobile phones and PDAs.

  In a system environment in which a private IP address is assigned to the authentication server 31i, even if the ticket issuance certificate d1 ′ with the IP address of the authentication server 31i is issued, the service server 1 issues a SAML authentication request to the ticket issuance certificate. Since it cannot be directly transmitted to the authentication server 31i that issued d1 ′, the SSO system 300 according to the present embodiment can be suitably applied to such a case.

It is a schematic block diagram of the SSO system to which the distributed authentication system which concerns on the 1st Embodiment of this invention is applied. It is a flowchart figure explaining operation | movement of the SSO system to which the distributed authentication system which concerns on the 1st Embodiment of this invention is applied. It is a schematic block diagram of the SSO system to which the distributed authentication system which concerns on the 2nd Embodiment of this invention is applied. It is a flowchart figure explaining operation | movement of the SSO system to which the distributed authentication system which concerns on the 2nd Embodiment of this invention is applied. It is a schematic block diagram of the SSO system to which the distributed authentication system which concerns on the 3rd Embodiment of this invention is applied. It is a flowchart figure explaining operation | movement of the SSO system to which the distributed authentication system which concerns on the 3rd Embodiment of this invention is applied. It is a figure explaining the concept of SSO. It is a figure explaining the procedure of the SSO authentication in a Pull model. It is a figure explaining the procedure of SSO authentication in a Push model.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Service server 3 User terminal 4 Communication network 10, 20, 30 Distributed authentication system 11i, 21i, 31i Authentication server 12, 22, 32 Load balancer 23 Shared memory 100, 200, 300 SSO system u Web user S1 Authentication site S2 Service site SWS Source website DWS Target website d1 Ticket issue certificate (an example of temporary authentication information)
d2 Authenticated ticket (an example of authenticated information)

Claims (11)

A distributed authentication system that performs authentication in response to an authentication request from a user under a pull-type single sign-on method,
A plurality of authentication servers, and a load balancer that distributes authentication processing to any of the plurality of authentication servers,
The load balancer is:
After any of the plurality of authentication servers authenticates the user, the temporary authentication information indicating the authentication reference destination is transmitted to the user via the load balancer. Identification information storage means for storing the identification information that can identify the authentication server in association with each other;
When a predetermined site requested for connection by the user makes a request including the temporary authentication information to the distributed authentication system for authenticated information, the temporary authentication information received and stored in the identification information storage Request distribution means for identifying an authentication server that has authenticated the user based on the information, and distributing the received request to the identified authentication server;
A distributed authentication system comprising: A load balancer that distributes authentication processing to any of a plurality of authentication servers in a distributed authentication system that performs authentication in response to an authentication request from a user under a pull-type single sign-on method,
After any of the plurality of authentication servers authenticates the user, the temporary authentication information indicating the authentication reference destination is transmitted to the user via the load balancer. Identification information storage means for storing the identification information that can identify the authentication server in association with each other;
When the predetermined site requested by the user requests authentication information and requests the distributed authentication system to include the temporary authentication information, it is stored in the received temporary authentication information and the identification information storage means. A request distribution unit that identifies an authentication server that has authenticated the user based on the received information, and distributes the received request to the identified authentication server;
A load balancer comprising: A distributed authentication system that performs authentication in response to an authentication request from a user under a pull-type single sign-on method,
A plurality of authentication servers, a load distribution device that distributes authentication processing to any of the plurality of authentication servers, and a storage device that can be shared by the plurality of authentication servers,
Each of the plurality of authentication servers includes:
Temporary authentication information storage means for storing temporary authentication information indicating a reference destination of the issued authentication in the storage device when authentication processing is distributed from the load balancer and the user is authenticated,
A predetermined site requested by the user to connect is requested when the distributed authentication system is requested to include the temporary authentication information, and received when the request is distributed from the load balancer. Authentication confirmation means for confirming temporary authentication information based on information stored in the storage device, and issuing the authenticated information;
A distributed authentication system comprising: A plurality of authentication servers, a load distribution device that distributes authentication processing to any of the plurality of authentication servers, and a storage device that can be shared by the plurality of authentication servers. The authentication server in a distributed authentication system that performs authentication in response to an authentication request from a user,
Temporary authentication information storage means for storing temporary authentication information indicating a reference destination of the issued authentication in the storage device when authentication processing is distributed from the load balancer and the user is authenticated,
A predetermined site requested by the user to connect is requested when the distributed authentication system is requested to include the temporary authentication information, and received when the request is distributed from the load balancer. Authentication confirmation means for confirming temporary authentication information based on information stored in the storage device, and issuing authenticated information;
An authentication server characterized by comprising: A distributed authentication system that performs authentication in response to an authentication request from a user under a pull-type single sign-on method,
A plurality of authentication servers, and a load balancer that distributes authentication processing to any of the plurality of authentication servers,
Each of the plurality of authentication servers includes:
When authentication processing is distributed from the load balancer and the user is authenticated, identification information that can identify the authenticated authentication server is added, and temporary authentication information indicating an authentication reference destination is created. Send it to the user,
The load balancer is:
When the predetermined site requested by the user requests authentication information and requests the distributed authentication system to include the temporary authentication information, the use is made from the identification information added to the received temporary authentication information. A distributed authentication system characterized by identifying an authentication server that has authenticated a person and distributing a received request to the identified authentication server. A load balancer that distributes authentication processing to any of a plurality of authentication servers in a distributed authentication system that performs authentication in response to an authentication request from a user under a pull-type single sign-on method,
After the distributed authentication system authenticates the user and transmits temporary authentication information indicating an authentication reference destination to which the identification information that can identify the authenticated authentication server is added, to the user When the predetermined site that requested the connection requests authenticated information and requests the distributed authentication system to include the temporary authentication information, the user is authenticated from the identification information added to the received temporary authentication information. A load distribution apparatus characterized by identifying an authenticated server and distributing a received request to the identified authentication server. Based on a pull-type single sign-on method, a plurality of authentication servers and a load balancer that distributes authentication processing to any of the plurality of authentication servers are provided to authenticate authentication requests from users. The authentication server in the distributed authentication system to perform,
When authentication processing is distributed from the load balancer and the user is authenticated, provisional authentication information indicating an authentication reference destination is created, to which identification information that can identify the authenticated authentication server is added, and the use An authentication server characterized by being transmitted to a person. A load balancing program that can be read by a load balancer that distributes authentication processing to one of multiple authentication servers in a distributed authentication system that authenticates user authentication requests under the Pull-type single sign-on method. There,
After any of the plurality of authentication servers authenticates the user, the temporary authentication information indicating the authentication reference destination is transmitted to the user via the load balancer, and the temporary authentication information is authenticated. An identification information storage step for storing the identification information that can identify the authentication server in association with each other;
When the predetermined site requested by the user requests authentication information and requests the distributed authentication system to include the temporary authentication information, it is stored in the received temporary authentication information and the identification information storage means. A request distribution step of identifying an authentication server that has authenticated the user based on the received information, and distributing the received request to the identified authentication server;
Is executed by the load balancer. A plurality of authentication servers, a load distribution device that distributes authentication processing to any of the plurality of authentication servers, and a storage device that can be shared by the plurality of authentication servers. An authentication program that can be read by the authentication server in a distributed authentication system that performs authentication in response to an authentication request from a user,
Temporary authentication information storage step of storing temporary authentication information indicating a reference destination of issued authentication in the storage device when authentication processing is distributed from the load balancer and the user is authenticated,
A predetermined site requested by the user to connect is requested when the distributed authentication system is requested to include the temporary authentication information, and received when the request is distributed from the load balancer. An authentication confirmation step of confirming temporary authentication information based on the information stored in the storage device and issuing authenticated information;
Is executed by the authentication server. A load balancing program that can be read by a load balancer that distributes authentication processing to one of multiple authentication servers in a distributed authentication system that authenticates user authentication requests under the Pull-type single sign-on method. There,
In the load balancer,
After the distributed authentication system authenticates the user and transmits temporary authentication information indicating an authentication reference destination to which the identification information that can identify the authenticated authentication server is added, to the user When the predetermined site that requested the connection requests authenticated information and requests the distributed authentication system to include the temporary authentication information, the user is authenticated from the identification information added to the received temporary authentication information. A load distribution program characterized by identifying an authenticated server and distributing the received request to the identified authentication server. Based on a pull-type single sign-on method, a plurality of authentication servers and a load balancer that distributes authentication processing to any of the plurality of authentication servers are provided to authenticate authentication requests from users. An authentication program readable by the authentication server in the distributed authentication system to perform,
In the authentication server,
When authentication processing is distributed from the load balancer and the user is authenticated, provisional authentication information indicating an authentication reference destination is created, to which identification information that can identify the authenticated authentication server is added, and the use An authentication program characterized by causing a person to transmit.

Images