JP2006251868A - Id management system and id management method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To efficiently and more safely manage authentication information about a plurality of systems even when a server is added to a network. <P>SOLUTION: Networked user terminals 20A to 20M, an application system 10, and affiliated service provision systems 30A to 30N for providing affiliated services for the application system 10 are connected via a network 40. When a new application server is added to the application system 10, a grid management server 12 permitted to use each of the affiliated service provision systems 30A to 30N generates authentication information about the new application server and requests each of the affiliated service provision systems 30A to 30N to register it. At the request of the grid management server 13, each of the affiliated service provision systems 30A to 30N validates the request source according to member information in a member information database 33 and registers the authentication information in the member information database 33. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an ID management technique for efficiently generating and securely managing authentication information for indicating the validity of each of a plurality of systems.

  Non-Patent Document 1 describes a technique for efficiently setting authentication information (for example, ID, password, certificate, etc.) used for authentication when accessing a service providing system (hereinafter referred to as a partner service providing system). The proxy type authentication framework is known. In this proxy type authentication framework, a proxy server executes an authentication process with a partner service providing system instead of an application on a client terminal. For this reason, it is not necessary to set authentication information for each application.

  On the other hand, as a client machine authentication technique that uses unique information (machine specific information) of a client terminal for authentication, a technique described in Patent Document 1 is known. According to this technique, correspondence information between a user ID and machine specific information (HDD-ID, CPU-ID, etc.) is registered in the database in advance, and the server stores the user ID and machine specific information from the client terminal, The validity of the user and the client terminal is authenticated by collating with the corresponding information in this database.

JP-A-10-260939 Randy Butler, 6 others, “Anal-scale authorization infrastructure” (USA), IEEE Computer, December 2000, Vol. 33, No. 12, p. 60-66

  However, according to the proxy authentication framework described in Non-Patent Document 1, one authentication information is used by a plurality of applications. For this reason, it is difficult to use the multiple login prevention function for preventing unauthorized use of the partner service providing system.

  On the other hand, according to the client machine authentication technique described in Patent Literature 1, machine specific information of all client terminals that use the affiliated service providing system needs to be registered in the database. For example, for an autonomous system in which a plurality of information processing apparatuses (servers, terminals) operate autonomously, for example, an autonomous system such as a grid or ubiquitous, such registration work is particularly troublesome.

  Therefore, an object of the present invention is to enable efficient generation and safe management of authentication information for indicating the validity of each of a plurality of systems.

The present invention
An ID management system for managing servers on a network,
Storage means for storing first authentication information indicating the validity of the ID management system for the system on the network;
Service management means for generating second authentication information used by the server to access another system on the network when adding more servers on the network;
Have
The service management means
When the second authentication information is generated, a registration request including the first authentication information and the second authentication information for requesting registration in the system is given to the system, and the first request is sent as a response to the request. When receiving a registration notification of authentication information 2, a registration request including the second authentication information for requesting registration to the server is given to the server.
An ID management system is provided.

Also,
A service providing system for providing a service to an information processing device,
A storage means in which authentication information for determining the legitimacy of access to the service providing system is registered;
When a registration request including second authentication information for requesting registration in the service providing system and the first authentication information is received from the first information processing apparatus, the first authentication information and the storage unit ID management means for registering the second authentication information in the storage means if the authentication information registered in the storage means matches,
A service providing unit for providing the service to the first information processing apparatus when the service providing request including the second authentication information is received and the second authentication information is registered in the storage unit; ,
A service providing system is provided.

  According to the present invention, it is possible to efficiently generate and securely manage authentication information for indicating the validity of each of a plurality of systems.

  Hereinafter, an embodiment according to the present invention will be described with reference to the accompanying drawings.

  First, the overall configuration of the network system according to the present embodiment will be described with reference to FIG.

  The network system according to the present embodiment includes a plurality of information processing systems 10 and 30A to 30N connected to each other via a network 40 such as the Internet. Among these information processing systems, an application system 10 that provides services to user terminals 20A to 20M on a network (hereinafter, a service provided in response to a request from an end user is referred to as an application) and a service ( Hereinafter, a plurality of affiliated service providing systems 30A to 30N that provide services required by the application system 10 accompanying provision of applications to end users are referred to as affiliated services). The network 40 is further connected to a certificate authority terminal 50M of a third party (certification authority) that issues a digital certificate necessary for server authentication in Secure Socket Layer (SSL) communication or the like.

  The application system 10 responds to requests from the user terminals 20A to 20M of registered users authenticated by the user management server 13 and the user management server 13 that manage users who are permitted to use the application system 10 (hereinafter referred to as registered users). A plurality of application servers 11A to 11P that provide applications, a grid management server 12 that manages the application servers 11A to 11P, and a LAN (Local Area Network) 14 that interconnects them.

  Here, each of the servers 11A to 11P, 12, and 13 and the associated service providing systems 30A to 30N in the application system 10 can be realized by a computer system that can execute a program in accordance with an instruction from the outside. .

  For example, as shown in FIG. 2, such a computer system stores a memory 101, various programs for realizing various functions (programs corresponding to functions to be realized, OS, etc.), and information 100 including various data. Secondary storage device (hard disk or the like) 102, a CPU 103 that executes the program 100 loaded from the secondary storage device 102 or the like to the memory 101, an input / output interface 104, and a communication line (bus or the like) 105 that connects these components. , Etc. The input / output interface 104 is connected to a communication device 109 for controlling communication via a network, and if necessary, an output device 106 such as a display, an input device 107 such as a keyboard, and a portable storage medium (such as an optical disk). ) Are mounted, etc.

  In the present embodiment, information 100 necessary for realizing the functions of the servers 11A to 11P, 12, 13 and the affiliated service providing systems 30A to 30N in the application system 10 constitutes these devices. Although stored in advance in the secondary storage device 102 of the computer system, the information 100 is stored in a secondary storage from a portable storage medium mounted on the drive 108 or from another information processing device via a network. It may be installed in the device 102. Alternatively, without being installed in the secondary storage device 102, it may be loaded into the memory 101 from a portable storage medium attached to the drive 108 or from another information processing device via a network.

  Next, the servers 11A to 11P, 12, and 13 in the tie-up service providing systems 30A to 30N and the application system 10 realize the following functional configuration by using such hardware configuration and information 100 prepared for each. To do.

  Each of the affiliated service providing systems 30A to 30N includes an affiliated service providing unit 31 that provides an affiliated service in response to a request from an application system (hereinafter, registered application system) 10 that is permitted to use the affiliated service providing system, and a registered application system. 10, and a member information database 33 referred to by the grid ID management unit 32.

  In the member information database 33, as shown in FIG. 3, member information 330A related to the registered application system 10 is registered for each registered application system, and member information 330B related to an application server belonging to the lower level of the registered application server 10 is stored for each application system. It is registered. Each member information 330A, 330B includes authentication information 331, 332 as a member who is permitted to use the affiliated service providing system, validity period information 333 indicating the validity period of the authentication information, and member ID (parent ID) 334 of the higher system. , Authority information 335 indicating the presence / absence of authority to generate a member ID (child ID) of the lower system, and status information 336 indicating the status (valid, invalid, etc.) of the credential 332. The authentication information used here includes an ID (member ID) 331 and credential information (password or digital certificate obtained from the certificate authority terminal 50) 332 as a member who is permitted to use the partner service providing system. It is. As the parent ID 334 of the member information 330A of the registered application system 10, information “-” indicating that there is no higher system is stored.

  On the other hand, the servers 11A to 11P, 12, and 13 in the application system 10 are as follows.

  Each of the application servers 11A to 11P includes an application providing unit 111 that provides an application to a user terminal on the network, and an affiliated service information database 112 that is referred to by the affiliated service providing unit 111.

  As shown in FIG. 4, information (hereinafter referred to as partner service information) 1120 necessary for accessing the partner service providing system is registered in the partner service information database 112 for each partner service providing system. Each affiliated service information 1120 includes a name 1121 of the provided service, an address 1122 of the affiliated service providing system, an authentication method name 1123 employed in the affiliated service providing system, and authentication information in the affiliated service providing system (members in the affiliated service providing system). ID 1215, credential information 1216) such as a password and an electronic certificate for indicating the legitimacy of access to the partner service providing system, and the like are included.

  The grid management server 12 performs various requests to the server management unit 121 and the affiliated service providing systems 30A to 30N that execute management processing (construction, setting, activation, performance monitoring, failure monitoring, infringement monitoring, etc.) of the application servers 11A to 11P ( Two types of databases (server information database 123, affiliated service information database 124) referenced by the affiliated service management unit 122, the server management unit 121, and the affiliated service management unit 122 for generating a new authentication information registration request and revocation request) ,have.

  As shown in FIG. 5, information (server information) 1230 necessary for accessing the application server is registered in the server information database 123 for each application server. Each application server information 1230 includes application server address information 1232 and authentication information (credential information 1233 such as a password or electronic certificate, server ID 1231) for indicating the validity of access to the application server. Further, the affiliated service information database 124 has the same data structure as the affiliated service information database 112 of FIG. 4 in order to access the affiliated service providing system for each affiliated service providing system to which the grid management server 12 is permitted to access. Necessary partner service information is stored in advance.

  The user management server 13 includes an authentication processing unit 131 that executes user authentication in response to a request from the application server, and a user information database 132 that is referred to by the authentication processing unit 131. In the user information database, user information including a user name and a password is registered for each registered user.

  Note that the application system 10 and the tie-up service providing systems 30A to 30N may be operated and managed by any operating entity. For example, the application system 10 is operated by one or more organizations or individuals. Each of the partner service providing systems 30A to 30N is operated by one or more organizations or individuals who have partnered with the operating body of the application system 10.

  Hereinafter, in FIG. 6, in such a network system, authentication information (member ID, password) generation processing and registration required for an application server newly built in the application system 10 to access the affiliated service providing system Processing will be described.

  In the application system 10, the server management unit 121 of the grid management server 12 regularly monitors the loads on the application servers 11A to 11P. As a result, when it is detected that a load higher than a predetermined load is applied to the application server (in this case, the application server 11B) that provides one of the applications B, the grid management server 12 executes the following processing. The

  First, the server management unit 121 reads the server information of the application server 11B from the server information database 123, and transmits a service information transmission request including authentication information 1231 and 1233 of the server information to the address included in the partner server information. To do. In response to this, the application B retrieves the affiliated service information from the affiliated service information database 112 and returns the affiliated service information. Thereby, the server management part 121 acquires the cooperation server information of the application server 11B.

  Further, the server management unit 121 selects server information of an application server other than the application server 11B (here, the application server 11T) according to a predetermined rule. Further, the server management unit 121 transmits an installation request for the application program b related to the application B including the authentication information 1231 and 1233 of the server information to the address indicated by the address information 1232 of the server information. Thereby, the application program b regarding the application B is installed in the other application server 11T (S601).

  Thereafter, the affiliated service management unit 122 generates a member ID and credential information (hereinafter referred to as authentication information of the application server 11T) used as authentication information indicating the validity of the application server 11T. Specifically, a random character string (in this case, a password) is generated as the credential information of the application server 11T, and the member ID 1124 registered in the affiliated service information database 124 is duplicated as the member ID of the application server 11T. Generate a string that does not.

  Here, the affiliated service management unit 122 generates the authentication information of the application server 11T, but it is not always necessary to do so. For example, in response to a request from the affiliated service management unit 122, the affiliated service providing system uses a character string and an arbitrary character string that do not overlap with any member ID 331 registered in the member information database 33 as authentication information of the application system 11T. You may make it produce | generate and notify it to the affiliated service management part 122. FIG.

  When the authentication information of the application server 11T is generated in this way, the affiliated service management unit 122 further associates service information corresponding to each affiliated service information received from the application server 11B (for example, affiliated service information with matching address information). Is extracted from the partner service information database 124. That is, service information for the grid management server 12 to access the affiliated service providing system that provides the affiliated service to the application server 11T is extracted from the affiliated service information database 124. Then, the affiliate service management unit 122 transmits a member registration request to the address included in each affiliate service information extracted at this time (S602). Each member registration request transmitted here includes the member ID and credential information included in the corresponding partner service information as the authentication information of the grid management server 12, and the authority to generate the member ID of the lower system. Is included as registration target information including authority information (for example, default authority “child ID can be registered”) and authentication information of the application server 11T.

  Thereafter, the affiliated service management unit 122 waits for a response to these member registration requests (S603).

  On the other hand, in each of the affiliated service providing systems 30A to 30N, when these member registration requests are received (S610), the following processing is executed.

  First, the grid ID management unit 32 extracts the authentication information and registration target information of the grid management server 12 from the member registration request, and collates the authentication information with the member ID 331 and the credential 332 registered in the member information database 33 ( S611). This verifies the legitimacy of the sender of the registration request.

  As a result, if the member information including the member ID 331 and the credential 332 matching the authentication information of the grid management server 12 does not exist, that is, if the validity of the transmission source of the member registration request cannot be authenticated, the grid ID management unit 32 Returns a notification that the access is denied to the grid management server 11 (S612).

  Further, if member information including the member ID 331 and the credential 332 matching the authentication information of the grid management server 12 exists, that is, if the validity of the transmission source of the member registration request is authenticated, the grid ID management unit 32 Further, it is checked whether or not the application server 11T can be registered as a subordinate system that has transmitted the member registration request. Specifically, it is determined based on the authority information 335 of the member information whether the authority to generate the member ID of the lower system is given to the application system 10, and overlaps with the member ID included in the registration target information. It is checked whether or not the member ID 331 is registered in the member information database 33 (S613).

  As a result, at least one of the case where the authority for generating the member ID of the lower system is not given to the application system 10 and the case where the member ID included in the registration target information overlaps with the registered member ID is applicable. For example, the grid ID management unit 32 returns a notification that the registration is rejected to the grid management server 11 (S614).

  On the other hand, if none of the cases is applicable (when a member ID generation authority of the lower system is given to the application system 10 and the member ID included in the registration target information does not overlap with the registered member ID), the grid The ID management unit 32 newly registers member information 330 </ b> B including registration target information (member ID, credential, authority information) in the member information database 33. In the member information 330B registered at this time, information indicating a date when a predetermined period has elapsed from now, a member ID included in the authentication information of the grid management server 12, and a member ID included in the registration target information are valid. Is included as valid period information 333, parent ID 334, and status information 336.

  When the registration of the new member information 339B related to the application server 11T is completed in this way, the affiliated service management unit 122 returns a notification that the registration is successful to the grid management server 11 (S615).

  When the affiliated service management unit 122 of the grid management server 11 receives one of the above three types of notifications as a response to the member registration request (S603), it checks whether it is a registration notification ( S604).

  As a result, if it is not a registration notification (if it is an access rejection notification or a registration rejection notification), the affiliated service management unit 122 ends the process.

  On the other hand, if it is a registration notification, the affiliated service management unit 122 extracts predetermined information (information 1121 to 1123 other than the authentication information 1124 and 1125) from each affiliated service information received from the application server 11B, and information 1121 thereof. To 1123 and the application server 11T authentication information are generated. Then, a registration request including these partner service information is transmitted to the application server 11T (S605). This registration request includes the authentication information 1231 and 1233 of the affiliated server information of the application server 11T extracted in S601.

  In response to this, in the application server 11T, after the application providing unit 111 performs device authentication based on the authentication information included in the registration request, the partner service information included in the registration request is further stored in the partner service information database 112. A new registration is performed and the application program b is activated (S620). As a result, the application server 11T and the other application server 11T can then provide the application B in response to an external request.

  Thereafter, when the application server 11T is accessed from a Web client program (such as a Web browser) on any user terminal (for example, the user terminal 20A) (S621), the application providing unit 111 first authenticates from the user terminal 20A. An authentication request including information (user name, password) is transmitted to the user management server 13. In response to this, in the user management server 13, the authentication processing unit 131 performs user authentication by comparing the user information registered in the user information database 132 with the authentication information from the user terminal 20A. Reply.

  If the response from the user management server 13 indicates successful user authentication, the application providing unit 111 provides the application B to the user terminal 20A. At this time, if necessary, the partner service information is extracted from the partner service information database 124, and the service provision request including the member ID 1124 and the credential 1125 of the partner service information as the authentication information is included in the address information 1121 of the partner service information. Is transmitted to the address indicated by (S622).

  In each of the affiliated service providing systems 30A to 30N, when the affiliated service providing unit 31 receives the service provision request (S616), the authentication information included in the service provision request and the member information database 33 are registered. The validity of the application server 11T is verified by checking the member ID 331 and the credential 332 (S617).

  As a result, if the authentication of the application server 11T fails, the affiliated service providing unit 31 returns a notification that the access is denied to the application server 11T (S618). Upon receiving this notification (S623), the application server 11T returns to the standby state for access from the user terminal (S621).

  On the other hand, if the authentication of the application server 11T is successful, the tie-up service providing unit 31 provides the requested tie-up service to the application server 11T (S619). Furthermore, the application server 11T provides the affiliated service provided at this time to the user terminal 20A (S624).

  According to the above processing, in an application system having a plurality of application servers, for example, when a new application server that accesses the affiliated service providing system is constructed, the validity of the new application server is confirmed with respect to the affiliated service providing system. Authentication information for showing is automatically generated and registered in the affiliated service providing system. That is, authentication information is added autonomously as the number of application servers increases.

  Accordingly, since it is possible to save time and effort for registering authentication information for each application server, it is possible to efficiently manage authentication information of a plurality of application servers. In addition, since individual authentication information is assigned to all application servers, unauthorized use of the affiliated service providing system can be prevented by the multiple login prevention function on the affiliated service providing system side. That is, it is possible to efficiently generate and securely manage authentication information for indicating the validity of each of a plurality of systems.

  Further, since individual authentication information is assigned to each application server, unlike the system described in the background art section, each application server does not need to access the affiliated service providing system via the proxy server. For this reason, for example, it is possible to prevent performance degradation that may occur when the physical distance between the application server and the proxy server is large.

  In the above, the member ID and password are used as authentication information, but it is not always necessary to do so. For example, a secret key generated by an ID-based signature technique may be used as credential information.

  Hereinafter, such a case will be described with reference to FIG. In this case, a sufficiently long private key and mapping parameter information necessary for performing an ID-based signature are registered as credential information of the partner service information, and the certificate authority terminal 50 is used as credential information of the member information. It is assumed that the public key corresponding to the private key and mapping parameter information included in the digital certificate issued by is registered.

  In the grid management server 12, the server management unit 121 acquires the affiliate server information of the application server 11B and installs the application program B related to the application b in the application server 11T in a predetermined situation, as in the case described above. (S701).

  Thereafter, the affiliated service management unit 122 generates a member ID and credential information used as authentication information of the application server 11T as described below (S702).

  The affiliated service management unit 122 reads the credential information (secret key) and mapping parameter information of the application system 10 from the affiliated service information database 124, and encrypts the member ID of the application server 11T with the credential information and mapping parameter information of the application system 10. To do. Thereby, a secret key used as credential information of the application server 11T is generated.

  In addition, the affiliated service management unit 122 adds a character string to which a partition character (for example, a period “.”), A character string “child”, and a sequential number are added following the member ID of the application system 10 to which the application server 11T belongs. It is generated as a member ID of the application server 11T. For example, when the member ID of the application system 10 is “pay-ID”, the affiliated service management unit 122 generates “pay-ID.child1” as the member ID of the application server 11T. When generating a member ID of a lower system of the application server 11T (a grandchild ID of the member ID of the application system 10), a partition character (for example, a period “.”), A character, following the member ID of the application server 11T. A character string to which a column “grdchild” and a sequential number are added is generated. For example, when the member ID of the application server 11T is “pay-ID.child1”, the first child ID is “pay-ID.child1.grdchild1”. As a result, a member ID that can identify a hierarchical relationship with the host system, that is, a child ID from which a parent ID can be extracted is generated.

  When the authentication information of the application server 11T is generated in this way, the affiliated service management unit 122 extracts predetermined information (information 1121 to 1123 other than the authentication information 1124 and 1125) from each affiliated service information received from the application server 11B. Then, the affiliated service information including the information 1121 to 1123 and the authentication information of the application server 11T is generated. Further, the affiliated service management unit 122 transmits a registration request including the affiliated service information to the application server 11T (S703).

  In response to this, in the application server 11T, the application providing unit 111 newly registers the affiliated service information included in the registration request in the affiliated service information database 112 and starts the application program b as in the case described above. (S721). Thereby, thereafter, the application server 11T becomes ready to provide the application B in response to a request from the outside.

  After that, when there is an access to the application server 11T from a Web client program (for example, the user terminal 20A) from any user terminal (S722), the application providing unit 111 sends the user to the user management server 13 as described above. Authentication is requested, and the application B is provided to the user terminal 20A according to the result (S725). At this time, if necessary, the application providing unit 111 extracts the member ID 1124 from the affiliated service information in the affiliated service information database 124, and sends a service provision request including the member ID 1124 to the address indicated by the address information 1121 of the affiliated service information. (S723).

  In each of the affiliated service providing systems 30A to 30N, when these service providing requests are received (S710), the following processing is executed.

  First, the grid ID management unit 32 searches the member information database 33 for the member ID included in the service provision request (S711).

  As a result, if the corresponding member ID has already been registered, the grid ID management unit 32 generates a random bit string as challenge data and returns it to the application server 11T (S715).

  On the other hand, if the corresponding member ID is not registered, the grid ID management unit 32 extracts the parent ID from the member ID included in the service provision request, and stores the member information including the parent ID 334 as the member information database 33. Search by. Furthermore, the grid ID management unit 32 determines whether or not the member ID included in the service provision request is newly registered based on the status information 336 and the authority information 335 associated with the parent ID 334. Specifically, it is checked whether or not the parent ID has expired and at least one of the cases where the child ID generation authority is not granted (S712).

  In the case of at least one of the cases, that is, when the member ID included in the service provision request cannot be newly registered, the grid ID management unit 32 returns an access request rejection notice to the application server 11T (S713).

  If none of the cases applies, that is, if the member ID included in the service provision request can be newly registered, first, credential information to be associated with the member ID is generated. Specifically, based on the credential information associated with the parent ID (credential information included in the member information including the parent ID: public key and mapping parameter) and the member ID included in the service provision request. To generate a public key. Furthermore, the grid ID management unit 32 provides the credential information including the public key and mapping parameters generated at this time, the member ID, the parent ID, and the default authority (for example, “child ID can be registered”) included in the service provision request. New member information including authority information to be expressed and status information to indicate “valid” is generated, and this is newly registered in the member information database 33 (S714).

  Thereafter, as in the case where the member ID included in the service provision request has already been registered, the grid ID management unit 32 generates a random bit string as challenge data and returns it to the application server 11T (S715).

  In the application server 11T, when the application providing unit 111 of the application server 11A receives the challenge data from the affiliated service providing system (S726), the challenge data is signed with the secret key of the affiliated service information registered in S721. Is sent back to the affiliated service providing system as response data (S723).

  In each of the affiliated service providing systems 30A to 30N, when the grid ID management unit 32 receives the response data (S716), the digital signature is verified (S717). Specifically, the public key of the credential information included in the member information of the application server 11T is extracted from the member information database 33, and the electronic signature of the response data is verified with this public key.

  As a result, if the verification of the electronic signature fails, the grid ID management unit 32 transmits a notification that the access is denied to the application server 11T (S718).

  On the other hand, if the authentication of the electronic signature is successful, the affiliated service providing unit 31 provides the requested affiliated service to the application server 11T (S719). Furthermore, if necessary, the application server 11T transmits the provided affiliate service to the user terminal 20A (S729).

  According to such processing, every time the grid management server 11 generates authentication information, it is not necessary to request the affiliated service providing system to register the authentication information. For this reason, the process of the grid management server 11 is simplified. Further, since it is not necessary to transmit the credential information to an external system over and over, security can be further improved.

  In the above description, the processing (the processing shown in FIGS. 6 and 7) that is executed when it is detected that the application server is heavily loaded has been described. However, the application server that provides a new application is described. Even in the case of newly constructing, authentication information for indicating the validity of the new application server can be automatically generated and registered by the same processing. However, in this case, for example, the administrator designates in advance an affiliated service providing system to be used by the new application server, and in S605, the affiliated service management unit 122 associates with the designated affiliated service providing system. It is necessary to generate partner service information including predetermined information (information other than the member ID and credential information) of the service information and authentication information (member ID and credential information) of the new application server.

  By the way, as a measure for ensuring the safety of the application server itself and the affiliated service providing system when the unauthorized use of the member ID is detected in the application system 10, the illegally used member ID is used. I want to make it expire.

  Hereinafter, a process of revoking the member ID in response to a request from the grid management server 12 will be described with reference to FIG. Here, a case where the authentication information of the application server 11T is registered in the member information database 33 by the process shown in FIG.

  The server management unit 15 periodically monitors for security breaches such as fraudulent acts (for example, unauthorized use of administrator authority) on the application server 11T, for example, by referring to log information or the like. When the server management unit 15 detects a security breach for the application server 11T (S801), the server management unit 15 transmits an invalidation request for authentication information of the application program on the application server 11T to each of the affiliated service providing systems 30A to 30N (S802). These revocation requests include authentication information of the application system and a member ID for requesting revocation (member ID of the application server 11T).

  In the affiliated service providing system that has received these revocation requests, each of the grid ID management units 32 performs authentication information included in the revocation request and authentication information (member ID and credential) registered in the member information database. The verification verifies the validity of the source of the invalidation request (grid management server 11) (S804).

  As a result, if the authentication fails, the grid ID management unit 32 returns a notification that access is denied to the grid management server 11 (S805).

  On the other hand, if the authentication is successful, the grid ID management unit 32 revokes the member ID for which revocation is requested and the lower ID of this member ID.

  Specifically, first, member information including a member ID for which revocation is requested is searched in the member information table 33, and the status information 336 of the member information obtained as a result is updated with information indicating “revocation” ( S806). Next, the member information database 33 is searched for member information whose parent ID 334 is the member ID whose revocation is requested. As a result, if the corresponding member information exists, the member information database 33 is searched for member information having the member information included in the member information as a parent ID (S807). When all member information including the lower ID of the member ID for which revocation has been requested is acquired in this way, the status information 336 of these member information is updated with information indicating “revocation” (S806).

  As described above, when the member ID requested to be revoked and the lower ID of this member ID are revoked, a revocation notification including a list of all revoked member IDs is returned to the grid management server 11 (S808).

  According to such processing, when the authentication information of any application server is illegally used, the member ID of the authentication information and the member ID generated by the authority of the member ID, that is, the security breach In the unlikely event that the authentication information of any application server is leaked, the influence of the application server's own member ID and the member ID of the lower system derived from this application server will be minimized. It can be limited.

  Although not particularly mentioned above, in any of the processes described above (FIGS. 6 to 8), between the user terminal and the application system, between the application system and the affiliated service providing system, It is desirable that a secure communication channel is established by an encrypted communication technique such as Secure Socket Layer (SSL).

  In addition, any application can be provided as long as it is an autonomous system such as a grid, ubiquitous, or the like in which a plurality of information processing apparatuses (servers, terminals) operate autonomously. Such an application system 10 can be obtained. Specific examples include application systems that provide services on the Web (digital content sites, shopping sites, etc.), in-house application systems that provide services within a company, sensor systems having a plurality of sensors and servers that manage these, and home appliances Examples include media systems in which products (televisions, video cameras) and media servers cooperate.

  In addition, any service providing system that is necessary in connection with the provision of an application can be an affiliated service providing system according to the present embodiment. Specific examples include a content distribution agency service and a billing settlement agency service.

1 is a diagram illustrating an overall configuration of a network system according to an embodiment of the present invention. It is a hardware block diagram of the computer system which can implement | achieve each server contained in the network system which concerns on one Embodiment of this invention, and a cooperation service provision system. It is the figure which showed notionally the data structure of the affiliated service information table which concerns on one Embodiment of this invention. It is the figure which showed notionally the data structure of the server information table which concerns on one Embodiment of this invention. It is the figure which showed notionally the data structure of the member information table which concerns on one Embodiment of this invention. It is a flowchart of a production | generation process of the authentication information required for access to the cooperation service provision system based on one Embodiment of this invention. It is a flowchart of the registration process of the authentication information of an application server based on one Embodiment of this invention. It is a flowchart of the member ID revocation process which concerns on one Embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Application system, 11A-11P ... Application server, 12 ... Grid management server, 13 ... User management server 13, 20A-20M ... User terminal, 30A-30N ... Cooperation service provision system, 40 ... Network, 50 ... Certification authority terminal

Claims (8)

An ID management system for managing servers on a network,
Storage means for storing first authentication information indicating the validity of the ID management system for the system on the network;
Service management means for generating second authentication information used by the server to access another system on the network when adding more servers on the network;
Have
The service management means
When the second authentication information is generated, a registration request including the first authentication information and the second authentication information for requesting registration in the system is given to the system, and the first request is sent as a response to the request. When receiving a registration notification of authentication information 2, a registration request including the second authentication information for requesting registration to the server is given to the server.
An ID management system characterized by that. A service providing system for providing a service to an information processing device,
A storage means in which authentication information for determining the legitimacy of access to the service providing system is registered;
When a registration request including the first authentication information indicating the validity of the first information processing apparatus and the second authentication information for requesting registration in the service providing system is received from the first information processing apparatus If the first authentication information matches the authentication information registered in the storage means, an ID management means for registering the second authentication information in the storage means;
A service providing unit for providing the service to the second information processing apparatus when the service providing request including the second authentication information is received and the second authentication information is registered in the storage unit; ,
A service providing system comprising: The service providing system according to claim 2,
In the storage means, the first authentication information is registered in association with authority information indicating whether or not the first information processing apparatus has the authority to generate the second authentication information.
When the ID management unit receives the registration request from the first information processing apparatus, the authority information registered in the storage unit in association with the first authentication information generates the second authentication information. If it indicates that it is possible, the second authentication information is registered in the storage means, and if the authority information does not indicate that the second authentication information can be generated, the second authentication information is registered. Refuse to register information,
A service providing system characterized by that. The service providing system according to claim 2,
When the registration request including the third authentication information for requesting registration in the service providing system and the second authentication information is received from the second information processing apparatus, the ID management unit If the authentication information registered in the storage means matches the third authentication information, the third authentication information is registered in the storage means in association with the second authentication information,
When the revocation request including the second authentication information is received from the first information processing apparatus, the ID management unit registers the second authentication information and the second authentication registered in the storage unit. Revoking the third authentication information associated with the information;
A service providing system characterized by that. An ID management method in which an information processing apparatus manages an ID of a server that accesses a service providing system,
The information processing apparatus includes:
Storage means for storing first authentication information indicating validity of the information processing apparatus for the service information system;
Service management means;
With
The ID management method is
When the server is added on the network, the service management means generates second authentication information used by the server to access the service providing system;
The service management means gives the system a registration request including the first authentication information and the second authentication information for requesting registration from the service providing system, and the second authentication as a response to the registration request. When receiving a registration notification of information from the service providing system, a process of giving the server a registration request including the second authentication information for requesting the server to register; A service providing method in which a service providing system provides a service to an information processing apparatus,
The service providing system includes:
A storage means in which authentication information for determining the legitimacy of access to the service providing system is registered;
Arithmetic processing means;
Have
The service providing method is as follows:
The service providing system includes, from the first information processing apparatus, first authentication information indicating the validity of the first information processing apparatus and second authentication information for requesting registration in the service providing system. When receiving a registration request, the arithmetic processing means determines whether or not the first authentication information matches the authentication information registered in the storage means. A process of registering the second authentication information;
In the service providing system, when a service providing request including the second authentication information is received, the arithmetic processing unit determines whether or not the second authentication information is registered in the storage unit, and is registered. If so, a process of providing the service to the second information processing apparatus;
A service providing method characterized by comprising: An ID management system for managing servers on a network,
Storage means in which a first secret key and mapping parameters corresponding to a public key registered in another system are registered;
When the number of servers accessing the system is increased on the network, a character string from which the first identification information of the ID management system can be extracted is generated as the second identification information of the server, and the second identification information and Service management means for generating a second secret key from the first secret key and the mapping parameter;
Have
The service management means includes
When the second identification information and the second secret key are generated, register the second identification information and the second secret key as authentication information used by the server to access the system. Requesting the server,
An ID management system characterized by that. A service providing system for providing a service to an information processing device,
Storage means in which a first public key, mapping parameters, and first identification information are registered as authentication information of a first information processing apparatus permitted to access the service providing system;
When a service providing request including second authentication information from which the first identification information can be extracted is received from the second information processing apparatus, the second identification information is not registered in the storage unit. Second from the first identification information extracted from the second identification information and the first public key and the mapping parameter registered in the storage means in association with the first identification information ID management means for generating the public key and registering the second identification information, the second public key, and the mapping parameter as authentication information of the second information processing apparatus in the storage means,
If the second identification information is registered in the storage means, the challenge data is transmitted to the second information processing apparatus, and the second information processing apparatus receives an electronic signature applied to the challenge data. Verifying the electronic signature with the second public key registered in the storage means, and if the electronic signature is successfully verified, a service providing means for providing the service to the second information processing apparatus;
A service providing system comprising:

Images