JP2006244420A - Identification information generation management device, and its system and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To efficiently manage an ID which is generated and provided by a reliable third party for a service provider to identify a user when the user uses service. <P>SOLUTION: When generating an ID required for a previously registered user to use service, a specific code key is used for coding the log-in ID of the user to generate the ID for new service (an ID generating means 32). The code key is only held instead of the generated ID, and when there is an inquiry from a service provider server (the need exists for associating the user with the ID) the generated ID is decoded to be acquired (an ID managing means 33). <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an identification information generation management device, system, and program for generating and managing service use identification information for a user to use a service by performing user authentication.

With the spread of the Internet, the number of providers providing services has increased, and many forms of using services with an authentication function have appeared.
For example, in order to easily change the service contents for the purpose of reducing the amount of work for the user and reducing the burden on the service provider side, specific information according to the purpose of use is received together with the user ID, and whether the server can connect to the network through authentication There is known a network connection device that determines the service content and changes the service content according to the acquired purpose of use (see, for example, Patent Document 1).

In addition, there is a trusted third party (TTP) between the user and the provider, and there is a form in which the TTP manages the user and the service (see, for example, Non-Patent Document 1).
Specifically, the user and the service are each registered in the TTP, and when the user wants to use a certain service, an ID (identification information) generation request for using the service is issued to the TTP. On the other hand, after authenticating the user, the TTP generates an ID for using the service according to the user's request, and provides the generated ID to the user (or both of the service providers). Then, the user presents the provided ID to the service provider, and the service provider identifies the user based on the presented ID and provides the user with a predetermined service. At this time, the service provider does not need to sense who the user is.
JP 2002-111744 A Accessed on February 5, 2005, Internet URL <HTTP://magazine.fujitsu.com/vol48-2/03-3/html> “Security Technology in Network Computing”

In the service usage form as described above, in order for TTP to guarantee the identity of the user to the service, for example, when there is some problem such as when the user performs an illegal act, According to the request, it is necessary to disclose the identity of the user (= user) of the ID used for the service. For this reason, the TTP needs to manage the association between the ID and the user who is the user.
However, when the number of users and service providers registered in TTP is large, the number of IDs generated and provided by TTP is enormous, and storing all the generated IDs in the database is effective for management efficiency. It is not preferable.

  The present invention has been made based on the above circumstances, and when a user uses a service, a reliable third-party organization generates and provides an ID for identifying the user by the service provider. An object of the present invention is to provide an identification information generation management device, system, and program capable of efficiently managing provided IDs.

  In order to solve the above-described problems, the present invention provides an identification in which a user terminal and a service providing server are connected via a network, and user authentication is performed to generate and manage service usage identification information for the user to use the service. An information generation management device, which receives an identification information generation request from the user terminal, encrypts registered login information to generate the service usage identification information, and responds with service identification information generation means, and the service provision Identification information that responds by decrypting the service usage identification information using the encryption key used at the time of the encryption when receiving an inquiry about the association between the user and the generated service usage identification information from the server And a management means.

  In the present invention, the identification information generating means generates a bit combination string of registered users and service use identification information, encrypts it using a unique encryption key prepared in advance, and the identification information management means The bit combination sequence is decrypted with the encryption key, and the correspondence between the user of the bit combination sequence and service use identification information is output.

  In the present invention, the identification information generating means generates the service usage identification information by adding current time information or random number information to the bit combination sequence.

  Further, in the present invention, the identification information generating means encrypts the service use identification information using one of encryption keys prepared in advance for each service stored in a key database, and the identification information management means Receiving the encrypted service usage identification information and the service to be used, obtaining an encryption key corresponding to the service by referring to a database, and using the encryption key to encrypt the service usage identification The information is decrypted, and the association with the user is output.

  In addition, the present invention provides identification information in which a user terminal, a service providing server, and a management server that performs user authentication and generates and manages service usage identification information for a user to use a service are connected via a network. In the generation management system, the management server uses service identification information generating means for encrypting registered login information to generate and respond to the service use identification information, and an encryption key used at the time of the encryption. An identification information management unit that decrypts and responds to the service use identification information, and when receiving an identification information generation request from the user terminal, the service identification information generation unit encrypts the registered login information. The service usage identification information is generated and responded, and the user and the generated service usage identification are received from the service usage terminal. The service identification information management means responds by decrypting the service use identification information using the encryption key used at the time of encryption when receiving an inquiry about the association with information. To do.

  In addition, the present invention provides an identification information generation and management apparatus in which a user terminal and a service providing server are connected via a network and perform user authentication to generate and manage service usage identification information for the user to use the service. Processing for receiving an identification information generation request from the user terminal, encrypting registered login information to generate the service use identification information, and responding, and from the service providing server, And a process of responding by decrypting the service usage identification information using the encryption key used at the time of encryption when receiving an inquiry about the association between the generated service usage identification information and the computer. It is made to perform.

According to the present invention, when the identification information generation management device generates identification information (hereinafter, simply referred to as a service usage ID) required for a user registered in advance to use a certain service, the login ID of the user is set. An ID for using a new service is generated by encrypting using a unique encryption key, and only the encryption key is stored without storing the generated ID. (When it is necessary to associate the user with the generated ID), the generated ID and the user of the ID are associated with each other by generating the ID by using the encryption technique by decrypting and acquiring the generated ID. The ID can be grasped by decrypting the ID, and this eliminates the need for the identification information generation management device to manage all the generated IDs using a database or the like. Only it is possible to reduce the database amount required for need be retained. Therefore, IDs can be managed efficiently.
In addition, when generating an ID, if information such as the time of generation or a random number is given to the login ID of the user, for example, the ID is always unique and added when the ID is decrypted. Information can also be obtained.

FIG. 1 is a diagram showing an example of a system configuration of an identification information generation management system according to an embodiment of the present invention.
The identification information generation management system of the present invention includes a user terminal 1, a service providing server (SP server 2), and a management server (TTP server) that generates and manages a service use ID for performing user authentication and using the service by the user. 3), and the above-described devices 1, 2, and 3 are connected via the network 4.

As will be described later, the TTP server 3 encrypts the user's registered login information to generate a service usage ID, and uses the service ID generation means to respond and the service usage using the encryption key used at the time of encryption. It consists of identification information management means that decrypts and responds to an ID, and when receiving an ID generation request from the user terminal 1, the service ID generation means encrypts the registered login information and notifies the service use ID (response) When the inquiry about the association between the user and the generated service usage ID is received from the SP server 2, the service ID management means decrypts the service usage ID using the encryption key used at the time of encryption. Respond.
Note that the user terminal 1 and the SP server 2 perform service use and service provision according to the service ID authenticated and notified by the TTP server 3.

FIG. 2 is a block diagram showing a functional development of the internal configuration of the identification information generation management device (TTP server 3 shown in FIG. 1) according to the embodiment of the present invention.
The identification information generation management device of the present invention includes a communication management unit 31, an ID generation unit 32, an ID management unit 33, a key DB (Data Base) 34, a user DB 35, and a service DB 36.

The communication management unit 31 receives an ID generation request from the user terminal 1 and transmits a service use ID generated by the TTP server 3, and also receives an inquiry about the user from the SP server 2 and retrieves and outputs the inquiry from the TTP server 3. Has a function to respond to user information.
The ID generation unit 32 receives an ID generation request from the user terminal 1 via the communication management unit 31, encrypts the registered login information, generates a service use ID, and responds as an ID generation unit shown in the claims The ID management unit 33 uses the encryption key previously used for encryption when receiving an inquiry from the SP server 2 regarding information relating to the association between the user and the generated service usage ID. It functions as an ID management means described in the claim that responds by decrypting the service use ID. The key DB 34 stores the encryption key, the user DB 35 stores personal information such as purchase records, and the service DB 36 stores service information related to service contents.

FIG. 3 is a sequence diagram cited for explaining the operation according to the embodiment of the present invention, and shows the operation of the part related to ID generation.
Hereinafter, an operation related to ID generation of the identification information generation management apparatus of the present invention shown in FIG. 2 will be described with reference to the sequence diagram shown in FIG.

First, in using the service, the user terminal 1 issues an ID generation request to the TTP server 3 (S31). The communication management unit 31 receives this, acquires the user ID by referring to the user DB 35 (S32, S33), issues a service ID acquisition request to the service DB 36, and refers to the service DB 36 for service. ID is acquired (S34, S35). Furthermore, the communication management unit 31 issues an encryption key acquisition request and acquires the encryption key by referring to the key DB 34 (S36, S37).
Finally, the communication management unit 31 that has acquired the user ID, service ID, and encryption key issues an ID generation request (encryption request) to the ID generation unit 32 (S38). Waiting for encryption processing, obtains the encrypted service use ID (S39: ID generation response), notifies the requested user terminal 1 and, if necessary, sends it to the SP providing server 2 Is also notified (S40).

FIGS. 4 to 6 are flowcharts cited for explaining the operation of the embodiment of the present invention, and also show the processing procedure of the program of the present invention. Here, three examples of the ID generation method are shown.
In the following, each flowchart will be described in detail, but the symbols appearing in the following description are defined as follows. That is, TTP is a reliable third party organization, U is a user registered in TTP, S is a service registered in TTP, ID_u is the ID of user U in TTP, ID_s is a third party organization of service S ID in TTP, K is an encryption key managed by the third party organization TTP, K_s is an encryption key for the service S managed by the third party organization TTP, and ID_u_s is a user U generated by the third party organization TTP. ID for service S, E_k () is encrypted with key K, D_k () is decrypted with key K, T is the current time, R is a random number, and ST is a bit combination string.

The flowchart shown in FIG. 4 shows the operation of the identification information generation management apparatus according to the embodiment of the present invention when a unique key is used for ID encryption.
Here, the TTP server 3 prepares only one encryption key K for encryption, and holds it in the key DB 34 (S41). At this time, ID_u_s for the user U to use the service S is created as follows. That is, when the TTP server 3 receives the ID generation request (S42 “Yes”), the ID generation unit 32 generates a combined string ST of ID_u and ID_s bits (s43). Then, the bit combination string ST is encrypted using the encryption key K, and the obtained encrypted string E_k (ST) is set as ID_u_s (S44).

  Next, when there is an inquiry request from the SP server 2 (S45 “Yes”), the ID management unit 33 responds by decrypting ID_u_s with the encryption key K stored in the key DB 34 (S46), The service provider knows the association between the user U with ID_u_s and the service S used by U. According to the method described above, only one key is required for the third party organization TTP.

The flowchart shown in FIG. 5 shows the operation of the ID generation management device according to the embodiment of the present invention when the unique encryption key K is used for each service.
Here, the TTP server 3 prepares encryption keys K_s unique to the registered service S by the number of services, and holds the relationship between the service S and the encryption key K_s in the key DB 34. (S51). Then, ID_u_s for the user U to use the service S is created as follows.

  First, when the ID generation unit 32 of the TTP server 3 receives the ID generation request via the communication management unit 31 (S52 “Yes”), the ID_u is encrypted using the encryption key K_s to use the service. An ID is generated, and the encrypted string E_ks (ID_u) obtained here is set as ID_u_s (S53).

  When receiving an inquiry from the SP server 2 to know the user U of ID_u_s (S54 “Yes”), the ID management unit 33 of the TTP server 3 performs the following operation. First, the user terminal 1 presents the ID_u_s and the service S using the ID to the TTP server 3 (S55 “Yes”). The ID management unit 33 that has received this via the communication management unit 31 searches the encryption key K_s corresponding to the service S with reference to the key DB 34 (S56). Subsequently, using the encryption key K_s, ID_u_s is decrypted and responded to the requested SP server 2 via the communication management unit 31 (D_ks (ID_u_s)) (S57). And the correspondence relationship between the user U and the user U can be known.

  According to the above method, the number of encryption keys is required for the number of services, but even if the encryption key K_s is leaked, there is an effect on IDs used in other services. It doesn't reach.

The flowchart shown in FIG. 6 shows the operation of the identification information generation management apparatus according to the embodiment of the present invention when a plurality of IDs for the service of the user U are generated.
Here, as in the example shown in FIG. 4, the TTP server 3 prepares one encryption key K and holds it in the key DB 34 (S61). First, when the TTP server 3 receives an ID generation request from the user terminal 1 via the communication management unit 31 (S62 “Yes”), the ID generation unit 32 includes a combination string ST of bits of ID_u, ID_s, and the current time T. Is generated (S63). Then, the bit combination string ST is encrypted using the encryption key K, and the obtained encrypted bit string E_k (ST) is set as ID_u_s (S64).

  Next, when there is an inquiry request from the SP server 2 (S65 “Yes”), the ID management unit 33 responds by decrypting ID_u_s with the encryption key K stored in the key DB 34 (S66). The service provider knows the association between the user U with ID_u_s and the service S used by U.

According to the above-described embodiment, for example, if T is managed in seconds and ID generation is limited to 1 second or less at a time, all generated ID_u_s are different IDs. Also, by decoding, it is possible to acquire information about the time generated by the user U and ID_u_s.
If a random number R is used instead of the current time, a random ID can be generated for each generation.

As described above, according to the present invention, when an identification information generation management device generates an ID necessary for a user registered in advance to use a certain service, the login ID of the user is used using a unique encryption key. The ID for generating a new service is generated by encryption. Also, only the encryption key is retained without retaining the generated ID, and when the service providing server makes an inquiry (when it is necessary to associate the user with the generated ID), the generated ID is decrypted. To get.
As a result, since the ID is generated using the encryption technology, the association between the generated ID and the user of the ID can be grasped by decrypting the ID. Therefore, it is necessary to manage all the generated IDs by a database or the like. Since only the encryption key needs to be held, the amount of database required can be reduced, and IDs can be managed efficiently.

  In addition, when generating an ID, if information such as the time of generation or a random number is given to the login ID of the user, for example, the ID is always unique and added when the ID is decrypted. Information can also be obtained.

  The procedure executed by each of the communication management unit 31, ID generation unit 32, and ID management unit 33 shown in FIG. 2 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is recorded. The identification information generation management device and system of the present invention can be realized by being read and executed by a computer system. The computer system here includes an OS and hardware such as peripheral devices.

Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiments, and includes designs and the like that do not depart from the gist of the present invention.

It is a figure which shows an example of the system configuration | structure of the identification information production | generation management system concerning this invention embodiment. It is the block diagram which expanded the function and showed the internal structure of the identification information production | generation management apparatus concerning embodiment of this invention. It is the sequence diagram quoted in order to demonstrate operation | movement of this invention embodiment. It is the flowchart quoted in order to demonstrate operation | movement of embodiment of this invention. It is the flowchart quoted in order to demonstrate the operation | movement in other embodiment of this invention. It is the flowchart quoted in order to demonstrate the operation | movement in other embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... User terminal, 2 ... SP server, 3 ... TTP server, 4 ... Network, 31 ... Communication management part, 32 ... ID production | generation part (ID production | generation means), 33 ... ID management part (ID management means), 34 ... Key DB, 35 ... user DB, 36 ... service DB

Claims (6)

The user terminal and the service providing server are connected via a network, and are identification information generation and management devices for generating and managing service use identification information for a user to use a service by performing user authentication,
Service identification information generating means for receiving an identification information generation request from the user terminal, encrypting login information of a registered user, generating the service use identification information, and responding;
When an inquiry about the association between the user and the generated service usage identification information is received from the service providing server, the service usage identification information is decrypted using the encryption key used for the encryption. Identification information management means that responds,
An identification information generation management device comprising: The identification information generating means
Generate a bit combination string of registered user and service usage identification information, encrypt it using a unique encryption key prepared in advance,
The identification information management means includes
Decrypting the bit combination sequence with the encryption key and outputting a correspondence between a user of the bit combination sequence and service use identification information;
The identification information generation management device according to claim 1. The identification information generating means
The identification information generation management apparatus according to claim 2, wherein the service use identification information is generated by further adding current time information or random number information to the bit combination sequence. The identification information generating means
Encrypting the service use identification information using one of encryption keys prepared in advance for each service stored in the key database,
The identification information management means includes
The encrypted service use identification information and the service to be used are received, an encryption key corresponding to the service is obtained by referring to a database, and the encrypted service use identification information is obtained using the encryption key. The identification information generation management apparatus according to claim 1, wherein the identification information is decrypted and the association with the user is output. An identification information generation management system in which a user terminal, a service providing server, and a management server that performs user authentication and generates and manages service use identification information for a user to use a service are connected via a network. ,
The management server encrypts the registered login information to generate and respond to the service use identification information, and uses the encryption key used at the time of encryption to obtain the service use identification information. It comprises identification information management means that decrypts and responds, and when receiving an identification information generation request from the user terminal, the service identification information generation means encrypts the registered login information to obtain the service use identification information. The encryption key used by the service identification information management means at the time of the encryption when receiving an inquiry about the correspondence between the user and the generated service usage identification information from the service usage terminal An identification information generation and management system characterized in that the service use identification information is decrypted and responded using. A user terminal and a service providing server are connected to each other via a network, and are programs used in an identification information generation and management apparatus that performs user authentication and generates and manages service use identification information for a user to use a service. ,
Processing for receiving an identification information generation request from the user terminal, encrypting registered login information to generate the service use identification information, and responding;
When an inquiry about the association between the user and the generated service usage identification information is received from the service providing server, the service usage identification information is decrypted using the encryption key used for the encryption. Processing to respond,
A program that causes a computer to execute.

Images