JP2007026294A - Authentication method and authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication method making a plurality of authentication proxy servers cooperate with one another to perform authentication. <P>SOLUTION: When a service server receives the requirement of service from a user terminal, the service server transmits the authentication requirement of a user to a first authentication proxy server when the authentication state of the user terminal is an unauthenticated state. The first authentication proxy server receives the authentication requirement, transmits an authentication response of authentication completion to the service server when the user terminal is already authenticated, executes the authentication in the first authentication proxy server itself when the user terminal is unauthenticated, and transmits the authentication requirement to a second authentication proxy server when the authentication cannot be executed in the first authentication proxy server itself. The second authentication proxy server executes the authentication, and transmits an authentication response including the result of the authentication to the first authentication proxy server. The first authentication proxy server receives the authentication response, and transmits authentication result information showing the authentication completion to the service server when authentication contents thereof are effective and when the authentication of the first authentication proxy server itself is effective. The service server provides the service when the authentication result information is effective. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a single sign-on authentication technique in a network configuration in which a user terminal receives a service provided from a service server via a network, and particularly relates to an authentication method and an authentication system for the purpose of enhancing security.

There is a single sign-on technology that enables access to a plurality of Web servers on a network by a single authentication procedure. This single sign-on technology has a reverse proxy type and an agent module type. The former receives all the traffic addressed to the Web server with a dedicated single sign-on server, and compares it with the access list defined for each user. This is a method for selecting whether or not packet transfer is possible. On the other hand, in the latter case, the authentication status of the user authentication is determined by each Web server, and if it is not authenticated, the user access request is transferred to the single sign-on server for authentication. When authentication is successful, a certificate is issued, and each Web server verifies the certificate in the received access request to determine whether the user can access.
Single sign-on servers that perform the operations described above are already sold by various companies in the world and are also used in commercial services for consumers. In addition, in the Liberty Alliance project (http://www.projectliberty.org, http://www.projectliberity.org/jp/), an ID federation standard single sign-on related to ID-FF (Identity Federation Framework) is used. Defines specifications.

Such a single sign-on technique is proposed in the following document, for example.
Japanese Patent Laying-Open No. 2005-062556

However, the above-described conventional techniques have the following problems.
First, even when the authentication proxy server supports a plurality of authentication means, actual authentication is performed by one of the authentication means.
Second, the authentication method used when authenticating a user on the authentication proxy server is limited to the authentication means supported by the authentication proxy server. Here, for example, when a plurality of business entities have authentication proxy servers each having their own authentication information and authentication means, it is impossible to perform authentication by combining those individual authentication means. It is.

The present invention has been made in view of such circumstances, and an object of the present invention is to provide an authentication method and an authentication system capable of performing authentication in cooperation with a plurality of authentication proxy servers. Further, the present invention provides an authentication method and authentication in which a service server that requests authentication from an authentication proxy server can specify a combination of a plurality of authentication means among authentication means supported by a plurality of authentication proxy servers as an authentication means. To provide a system.

  In order to solve the above-described problems, the present invention provides a user terminal, a service server that provides services to the user, and a plurality of authentication agent servers that perform authentication of the user for service provision of the service server. An authentication method in an authentication system connected via the step of requesting a service from the user terminal to the service server, and when the service server determines an authentication state of the user terminal and has been authenticated. Providing a service to the user terminal; transmitting a user authentication request to a first authentication proxy server when the authentication status of the user terminal is unauthenticated; and the first authentication proxy server Receiving the authentication request and determining an authentication method required in the authentication request; and the first authentication A row server determines an authentication state of the user terminal with respect to the authentication method, and if authenticated, generates authentication result information indicating that the user terminal has been authenticated, and sends an authentication response including the authentication result information to the service server. And when the authentication status of the user terminal is unauthenticated, if the local server can authenticate, the local server executes authentication. If the local server cannot authenticate, the authentication request is sent to the second authentication proxy server. Transmitting or executing both, a step in which the second authentication proxy server receives the authentication request and determining an authentication method required in the authentication request, and the second authentication proxy server includes: An authentication state of the user terminal with respect to the authentication method is determined, and if authenticated, authentication result information indicating that authentication has been performed is generated, and the authentication result information is included. Transmitting an authentication response to the first authentication proxy server, and if the authentication status of the user terminal is unauthenticated, executing authentication and sending an authentication response including the authentication result to the first authentication proxy server Transmitting to the server, and the first authentication proxy server receives the authentication response, determines the authentication content, the authentication content is valid, and if the authentication is performed by itself, the authentication is valid In this case, authentication result information indicating that authentication has been completed is generated, an authentication response including the authentication result information is transmitted to the service server, and the content of the authentication response is invalid or the authentication is performed by itself. If the authentication is invalid, generating authentication result information indicating that the authentication is invalid, and transmitting an authentication response including the authentication result information to the service server; and A server determining the authentication response, providing a service to the user if it is valid, and notifying the user that the service cannot be provided if the server is invalid.

Further, the present invention is characterized in that, in the above-described authentication method, the second authentication proxy server further has a step of requesting authentication from another (third) authentication proxy server C.
Further, the present invention is characterized in that, in the above-described authentication method, the first authentication proxy server requests authentication to the second authentication proxy server and the third authentication proxy server.
According to the present invention, in the above authentication method, the second authentication proxy server performs authentication in advance and transmits an authentication result to the first authentication proxy server before the service request is transmitted from the user terminal to the service server. It is characterized by notifying.
According to the present invention, in the above-described authentication method, the second and third authentication proxy servers perform authentication in advance before the service request is transmitted from the user terminal to the service server, and the first authentication proxy server The authentication result is notified.

  In the present invention, a user terminal, a service server that provides a service to a user, and a plurality of authentication proxy servers that perform authentication of the user for providing the service of the service server are connected via a network. An authentication method in an authentication system, the step of transmitting an authentication request from the user terminal to a second authentication proxy server and a third server, and the second authentication proxy server receiving the authentication request and authenticating at the own server If possible, perform authentication on the server itself, generate authentication result information indicating that authentication has been completed, and send an authentication response including the authentication result information to the first proxy server And when the third authentication proxy server receives the authentication request and can authenticate with the own server, the authentication is executed with the own server, and the authentication is performed when the authentication is established. Generating authentication result information indicating that the authentication result information is included, transmitting an authentication response including the authentication result information to the first authentication proxy server, requesting a service from the user terminal to the service server, The service server determines an authentication state of the user terminal, and provides a service to the user terminal if the user terminal is authenticated; and if the authentication state of the user terminal is unauthenticated, the first authentication agent Transmitting the user authentication request to a server; receiving the authentication request by the first authentication proxy server; determining an authentication method requested by the authentication request; and the first authentication proxy server. Determines the authentication state of the user terminal with respect to the authentication method, and indicates that the authentication result in the second authentication proxy server is authenticated. Received and held from the third proxy server and received from the third authentication proxy server that the authentication result in the third authentication proxy server has been authenticated. If the result of executing the authentication is valid, generating authentication result information indicating that the authentication has been completed, sending an authentication response including the authentication result information to the service server; and Determining the authentication response, and providing the service to the user if it is valid, and notifying the user that the service cannot be provided if invalid.

Further, the present invention is characterized in that, in the above-described authentication system, the second authentication proxy server further has a step of requesting authentication from another (third) authentication proxy server C.
Further, the present invention is characterized in that, in the above-described authentication system, the first authentication proxy server requests the second authentication proxy server and the third authentication proxy server to perform authentication.
According to the present invention, in the above-described authentication system, the second authentication proxy server performs authentication in advance and sends an authentication result to the first authentication proxy server before the service request is transmitted from the user terminal to the service server. It is characterized by notifying.
Further, according to the present invention, in the above authentication system, the second and third authentication proxy servers perform authentication in advance before the service request is transmitted from the user terminal to the service server. The authentication result is notified.

  As described above, according to the present invention, the service server that requests authentication from the authentication proxy server designates a plurality of authentication means as a combination of authentication means freely supported by the plurality of authentication proxy servers. Accordingly, it is possible to freely set the security strength according to the service to be provided. In addition, when multiple business entities have authentication means based on user information held by each business entity, it is possible to implement strong authentication in cooperation with each authentication means, and improve security. .

Hereinafter, an authentication method and an authentication system according to an embodiment of the present invention will be described with reference to the drawings.
As shown in FIG. 1, in the configuration of a system including a user terminal (100), a service server (110), an authentication proxy server 1 (120), and an authentication proxy server 2 (130), two authentication proxy servers cooperate with each other. A processing procedure for performing user authentication will be described.
In FIG. 1, the authentication proxy server 1 supports “A authentication”, the authentication proxy server 2 supports “B authentication”, and the service server requests authentication based on “A authentication + B authentication”. Both 1 and 2 show the flow of information when the authentication status of the user is terminal authentication.
First, the user terminal 100 transmits a service request request to the service server 110 based on a request input from the user (step Sa1).
The service server 110 checks the authentication status of the user of the user terminal 100 that is the request source. Here, for end authentication, “A authentication + B authentication” is designated as the authentication method, and an authentication request is transmitted to the authentication proxy server 1 (step Sa2).
The authentication proxy server 1 receives the authentication request from the service server 110, determines the requested authentication method, and determines whether or not the user has been authenticated for the requested authentication method. Here, for end authentication, an authentication proxy server that can be implemented for the requested authentication method is detected. Since “A authentication” can be performed by the own server, “A authentication” is executed between the own server and the user terminal. After the authentication is successful, the authentication status of the user is stored in the internal storage area as “authenticated by A authentication” (step Sa3). Since “B authentication” cannot be performed by the own server, the authentication request “B authentication” is designated and transmitted to the authentication proxy server 2 that performs “B authentication” (step Sa4).

The authentication proxy server 2 receives this authentication request, determines the requested authentication method, and determines whether or not the user has been authenticated for the requested authentication method. Here, for end authentication, “B authentication” is executed between the own server and the user terminal. After this authentication is successful, the authentication status of the user is stored in the internal storage area as “authenticated by B authentication” (step Sa5). The authentication proxy server 2 transmits an authentication response storing the authentication result to the authentication proxy server 1 (step Sa6).
The authentication surrogate server 1 refers to the authentication result of “B authentication” included in the authentication response received from the authentication surrogate server 2 and determines whether or not the authentication is successful. Here, since the B authentication is successful, the authentication state of the user is stored in the internal storage area as “authenticated by B authentication”. Then, the authentication proxy server 1 generates an authentication result by combining the result of “A authentication” performed by the server itself and the result of “B authentication” included in the authentication response received from the authentication proxy server 2, It is stored in the response and transmitted to the service server (step Sa7).

The service server determines whether or not the authentication included in the authentication response received from the authentication proxy server 1 is valid, and provides the service if it is valid (step Sa8).
Next, when another service server designates the authentication method “A authentication”, “B authentication” or “A authentication + B authentication” and sends the authentication request for the same user to the authentication proxy server 1 Since the authentication status of the authentication method for the user is already stored as “authenticated” in the authentication proxy server 1, authentication processing is not performed, and authentication result information including “authentication success” is provided as a service. Notify the server. In this case, the user does not need to perform an authentication operation and can enjoy a service by so-called single sign-on.

Next, referring to FIG. 2, a system constituted by a user terminal (100), a service server (110), an authentication proxy server 1 (120), an authentication proxy server 2 (130), and an authentication proxy server 3 (140). In the configuration, a processing procedure when three or more authentication proxy servers perform user authentication in cooperation with each other will be described.
In FIG. 2, the authentication proxy server 1 supports “A authentication”, the authentication proxy server 2 supports “B authentication”, the authentication proxy server 3 supports “C authentication”, and the service server supports “A authentication + B authentication + C authentication”. 4 shows the flow of information when the authentication by the authentication is requested, and both of the authentication proxy servers 1, 2 and 3 are in the terminal authentication status.
The user terminal 100 transmits a service request request to the service server 110 based on the request input from the user (step Sb1). The service server 110 checks the authentication status of the user of the user terminal 100 that is the request source. Here, for end authentication, “A authentication + B authentication + C authentication” is designated as the authentication method, and an authentication request is transmitted to the authentication proxy server 1 (step Sb2).
The authentication proxy server 1 receives the authentication request from the service server 110, determines the requested authentication method, and determines whether or not the user has been authenticated for the requested authentication method. Here, since authentication is not performed, an authentication proxy server that can be implemented for the requested authentication method is detected. Since “A authentication” can be performed by the own server, “A authentication” is performed between the own server and the user terminal. After this authentication is successful, the authentication status of the user is stored in the internal storage area as “authenticated by A authentication” (step Sb3). Since “B authentication” and “C authentication” cannot be performed by the server itself, an authentication method “B authentication + C authentication” is designated and sent to the authentication proxy server 2 (step Sb4).

The authentication proxy server 2 receives this authentication request, determines the requested authentication method, and determines whether or not the user has been authenticated for the requested authentication method. Here, since authentication is not performed, an authentication proxy server that can implement the requested authentication method is determined.
Since “B authentication” can be performed by the local server, “B authentication” is performed between the local server and the user terminal. After this authentication is successful, the authentication status of the user is stored in the internal storage area as “authenticated by B authentication” (step Sb5). Since “C authentication” cannot be performed by the own server, the authentication method “C authentication” is designated to the authentication proxy server 3, and an authentication request is transmitted (step Sb6).
The authentication proxy server 3 receives this authentication request, determines the requested authentication method, and determines whether or not the user has been authenticated for the requested authentication method. Here, for end authentication, “C authentication” is executed between the own server and the user terminal. After this authentication is successful, the authentication status of the user is stored in the internal storage area as “authenticated by B authentication” (step Sb5). The authentication proxy server 3 transmits an authentication response storing the authentication result to the authentication proxy server 2 (step Sb8).
The authentication surrogate server 2 refers to the result of “C authentication” included in the authentication response received from the authentication surrogate server 3 to determine whether authentication has been established. Here, since the C authentication is successful, the authentication status of the user is stored as “authenticated by C authentication” in the internal storage area. Then, the authentication proxy server 2 generates an authentication result that combines the result of “B authentication” performed by the server itself and the result of “C authentication” included in the authentication response received from the authentication proxy server 3, It is stored in the response and transmitted to the authentication proxy server 1 (step Sb9).

  The authentication proxy server 1 refers to the authentication results of “B authentication” and “C authentication” included in the authentication response received from the authentication proxy server 2, and the authentication of “B authentication” and “C authentication” is effectively established. If it is valid, the user's authentication status is stored in the internal storage area as “authenticated by B authentication and C authentication”. Then, the authentication proxy server 1 authenticates the result of “A authentication” performed by itself and the result of “B authentication” and “C authentication” included in the authentication response received from the authentication proxy server 2. Is stored in the authentication response and transmitted to the service server (step Sb10).

The service server refers to the authentication result included in the authentication response received from the authentication proxy server 1, and provides the service if the authentication is valid (step Sb11).
With the authentication method shown in the present embodiment, in principle, N authentication proxy servers (N is an integer equal to or greater than 1) can perform authentication in cooperation.

As shown in FIG. 3, in the system configuration including the user terminal (100), the service server (110), the authentication proxy server 1 (120), the authentication proxy server 2 (130), and the authentication proxy server 3 (140), three Another processing procedure when the above authentication proxy server performs user authentication in cooperation will be described.
In FIG. 3, the authentication proxy server 1 supports “A authentication”, the authentication proxy server 2 supports “B authentication”, the authentication proxy server 3 supports “C authentication”, and the service server uses “A authentication + B authentication + C authentication”. The flow of information is shown when authentication is requested, and the authentication proxy servers 1, 2, and 3 are both unauthenticated.
First, the user terminal 100 transmits a service request request to the service server 110 based on a request input from the user (step Sc1).
The service server 110 checks the authentication status of the user of the user terminal 100 that is the request source. Here, “A authentication + B authentication + C authentication” is designated as an authentication method for terminal authentication, and an authentication request is transmitted to the authentication proxy server 1 (step Sc2).
The authentication proxy server 1 receives the authentication request from the service server 110, determines the requested authentication method, and determines whether or not the user has been authenticated for the requested authentication method. Here, since authentication is not performed, an authentication proxy server that can be implemented for the requested authentication method is determined. Since “A authentication” can be performed by the own server, “A authentication” is executed between the own server and the user terminal. After this authentication is successful, the authentication status of the user is stored in the internal storage area as “authenticated by A authentication” (step Sc3). Since “B authentication” and “C authentication” cannot be performed by the own server, “B authentication” is transmitted to the authentication proxy server 2 by designating “B authentication” as an authentication method (step Sc4). “C authentication” is transmitted to the authentication proxy server 3 by specifying the authentication method “c authentication”. The authentication proxy server 2 receives this authentication request, determines the requested authentication method, and determines whether or not the user has been authenticated for the requested authentication method. Here, since it is unauthenticated, “B authentication” is executed between the own server and the user terminal. After this authentication is successful, the authentication status of the user is set as “authenticated by B authentication” and set in the internal storage area (step Sc5). The authentication agent server 2 transmits an authentication response storing the authentication result to the authentication agent server 1 (step Sc6).
The authentication proxy server 3 receives the authentication request from the authentication proxy server 2, determines the requested authentication method, and determines whether the user has been authenticated for the requested authentication method. Here, since it is unauthenticated, “C authentication” is executed between the local server and the user terminal. After this authentication is successful, the authentication status of the user is stored as “authenticated by C authentication” in the internal storage area (step Sc5). The authentication proxy server 3 transmits an authentication response storing the authentication result to the authentication proxy server 1 (step Sc6).
The authentication proxy server 1 performs authentication by referring to the result of “B authentication” included in the authentication response received from the authentication proxy server 2 and the result of “C authentication” included in the authentication response received from the authentication proxy server 3. It is determined whether or not it is successful, and since both “B authentication” and “C authentication” have succeeded, the authentication status of the user is stored as “authenticated by B authentication and C authentication” in the internal storage area. . Then, the authentication proxy server 1 receives the result of “A authentication” performed by itself, the result of “B authentication” included in the authentication response received from the authentication proxy server 2, and the authentication response received from the authentication proxy server 3. An authentication result is generated by combining the results of “C authentication” included in, stored in the authentication response, and transmitted to the service server (step Sc7).
The service server determines whether or not the authentication included in the authentication response received from the authentication proxy server 1 is valid, and provides the service if it is valid (step Sc8).

As described above, according to the method shown in this embodiment, in principle, N authentication proxy servers (N is an integer of 1 or more) can perform authentication in cooperation.
In the description of FIGS. 1, 2, and 3, the authentication method (“A authentication”, “B authentication”, “C authentication”) is arbitrary. For example, ID / password authentication and fingerprint authentication. In addition, a protocol and a network for exchanging each information are arbitrary. For example, the HTTP (HTTPS) over Internet can be considered. In the case of using HTTP (HTTPS), a method of transferring information via the user terminal 100 by means of HTTP redirection for Sa2, Sa4, Sa6, and Sa7 in FIG. HTTP redirect can be applied).

  In addition, when the authentication cannot be performed by the own server, a method for determining an authentication proxy server that can perform the authentication is arbitrary. For example, the correspondence between the authentication proxy server address and the authentication method supported by the authentication proxy server is statically held in advance as system information. Alternatively, it is possible to search dynamically using a directory service. The method for specifying the authentication method is arbitrary. For example, as shown in FIG. 1, the service server specifies “A authentication + B authentication” in Sa2, and the authentication proxy server 1 specifies and requests “B authentication” to the authentication proxy server 2, or the service server For example, “X authentication” is designated in Sa2, and “X authentication = A authentication + B authentication” is determined in the authentication proxy server 1, and “B authentication” is specified and requested to the authentication proxy server 2. Here, for the information “X authentication = A authentication + B authentication”, a method of holding information statically in advance can be considered. There may also be a case where the service server does not specify an authentication method. In this case, the authentication proxy server 1 may conceivably set a default operation in which an authentication method is not specified at the time of an authentication request, for example, “default authentication method = A authentication + B authentication” in advance.

In FIG. 4, the authentication proxy server 1 supports “A authentication”, the authentication proxy server 2 supports “B authentication”, and the service server requests authentication by “A authentication + B authentication”, and the authentication proxy server 1 and 2 show a sequence diagram when the authentication status of the user is not authenticated.
The user terminal 100 transmits a service request request to the service server 110 based on a request input from the user (step S10).
The service server 110 checks the authentication status of the user (step S11). Here, if authenticated, the service is provided to the user terminal at this time. If unauthenticated, “A authentication + B authentication” is designated as the authentication method and an authentication request is transmitted to the authentication proxy server 1 ( Step S12).
The authentication surrogate server 1 checks the authentication status of the user for the authentication method specified in the authentication request (step S13), and if authenticated, returns an authentication response to the service server at this point, and is unauthenticated. If this happens, “A authentication” is executed with the user (step S14).
If the authentication is successful, an authentication session in which the user ID is associated with the authenticated authentication method is generated (step S15). When the authentication fails, an authentication response including the authentication failure is transmitted to the service server at this time.

The authentication proxy server 1 designates “B authentication” as the authentication method and transmits an authentication request to the authentication proxy server 2 (step S18).
The authentication agent server 2 checks the authentication state of the user for the authentication method specified in the authentication request (step S17). Here, if authenticated, an authentication response is transmitted to the authentication proxy server 1 at this point, and if not authenticated, “B authentication” is executed with the user (step S18).

If the authentication is successful, the authentication proxy server 2 generates an authentication session in which the user ID is associated with the authenticated authentication method (step S19). If the authentication is unsuccessful, the authentication response including the authentication failure at this point Is sent to the service server.
Then, the authentication agent server 2 transmits an authentication response to the authentication agent server 1 (step S20).
The authentication surrogate server 1 verifies the authentication response from the authentication surrogate server 2, and generates an authentication session in which the user ID is associated with the authenticated authentication method because the user is authenticated by “B authentication” (step S21). . Then, the authentication proxy server 1 transmits an authentication response to the service server (step S22).
The service server verifies the authentication response from the authentication proxy server 1, and generates an authentication session in which the user ID is associated with the authenticated authentication method because the user has been authenticated by “A authentication + B authentication” (step S23). . Then, the service server provides a service to the user (step S24).

FIG. 5 is a processing flow diagram for explaining the operation of the service server.
When the service server receives the service request from the user terminal (step F1), the service server detects an authentication method required for the service requested by the user terminal (step F2). Here, a case where “A authentication + B authentication” is necessary as the service will be described.
Here, it is determined from the authentication session whether or not the user has already been authenticated by “A authentication + B authentication” (step F3). If the user has been authenticated, the service is provided to the user (step F8).
On the other hand, if it is not authenticated, “A authentication + B authentication” is designated as the authentication method, and an authentication request is transmitted to the authentication proxy server 1 (step F4). The method for determining the authentication proxy server is arbitrary. For example, the correspondence between the authentication proxy server address and the authentication method supported by the authentication proxy server is statically held in advance as system information, or by a directory service. It is possible to search dynamically.

  Next, when the service server receives the authentication response from the authentication proxy server 1 (step F5), the service server determines the authentication response (step F6). If the authentication response determination fails or the authentication result is NG, the user terminal is notified of the authentication failure (step F9). On the other hand, if the determination of the authentication response is OK, an authentication session in which the user ID is associated with the authenticated authentication method is generated (step F7), and the service is provided to the user (step F8).

FIG. 6 is a process flow diagram for explaining the operation of the authentication proxy server 1.
The authentication proxy server 1 receives an authentication request in which “A authentication + B authentication” is designated as an authentication method from the service server (step F10). When the authentication request is received, it is determined from the authentication session whether the requested user has already been authenticated by “A authentication + B authentication” (step Fl). If authenticated, an authentication response is transmitted to the service server (step F19).
On the other hand, if it is not authenticated, an authentication proxy server capable of performing the requested authentication method is determined (step F12). Here, a case where “A authentication” can be performed by the authentication proxy server 1 and “B authentication” can be performed by the authentication proxy server 2 will be described.
The authentication proxy server 1 executes “A authentication” with the user terminal (step F13). If authentication fails, an authentication response (authentication failure) is sent to the service server at this point (step F20). If “A authentication” succeeds, an authentication session that associates the user ID with the authenticated authentication method is generated. (Step F14). Then, an authentication proxy request is transmitted to the authentication proxy server 2 by designating “B authentication” as the authentication method (step F15).

On the other hand, when an authentication response is received from the authentication proxy server 2 (step F16), the received authentication response is determined (step F17). If the determination of the authentication response fails or the authentication result is NG, an authentication response (authentication failure) is transmitted to the service server at this time (step F20).
If the verification of the authentication response is OK, an authentication session that associates the user ID with the authenticated authentication method is generated (step F18), and the authentication response is transmitted to the authentication proxy server 1 (step F19).

FIG. 7 is a processing flowchart for explaining the operation of the authentication proxy server 2.
When the authentication proxy server 2 receives an authentication proxy request specifying “B authentication” as the authentication method from the authentication proxy server 1 (step F21), the authentication proxy server 2 authenticates whether or not the user has already been authenticated by “B authentication”. It judges from a session (step F22). If the determination result is authenticated, an authentication response is transmitted to the authentication proxy server 1 (step F26). On the other hand, if it is not authenticated, an authentication proxy server capable of performing the requested authentication method is determined (step F23). Here, a case where “B authentication” can be performed by the authentication proxy server 2 will be described.

  The authentication proxy server 2 executes “B authentication” with the user (step F24). If the authentication fails, an authentication response (authentication failure) is transmitted to the service server at this time (step F27). On the other hand, if “B authentication” is successful, an authentication session in which the user ID is associated with the authenticated authentication method is generated (step F25), and an authentication response is transmitted to the authentication proxy server 2 (step F26).

Next, another embodiment will be described.
FIG. 8 is a view for explaining another embodiment of the authentication system in FIG. In this embodiment, the difference from the embodiment of FIG. 1 is that “authentication B” is performed in advance before making a service request between the authentication server 2 and the user terminal, and the authentication result is sent to the authentication proxy server. It is a point kept at 1.

First, before making a service request from the user terminal to the service server, the user terminal transmits an authentication request to the authentication proxy server 2. The authentication proxy server 2 receives this authentication request and executes “B authentication” between the server and the user terminal (step Sd1). If this authentication is successful, the authentication status of the user is notified as “authenticated by B authentication” and notified to a representative authentication proxy server (in this case, authentication proxy server 1) by PUSH distribution (step Sd2).
The authentication proxy server 1 stores the authentication result of “B authentication” included in the authentication response received from the authentication proxy server 2 in an internal storage area.
Thereafter, when a service request is transmitted from the user terminal to the service server (step Sd3), the service server 110 checks the authentication status of the user of the user terminal 100 that is the request source (step Sd4). Here, in the case of terminal authentication, “A authentication + B authentication” is designated as the authentication method, and an authentication request is transmitted to the authentication proxy server 1 (step Sd5).
The authentication proxy server 1 receives the authentication request from the service server 110, determines the requested authentication method, and determines whether or not the user has been authenticated for the requested authentication method (step Sd6). . Here, referring to the internal storage area as to whether or not “A authentication” and “B authentication” have been authenticated, if both “A authentication” and “B authentication” are unauthenticated, When “A authentication” has been completed and “B authentication” has not been authenticated, an error is transmitted to the service server. Thereby, an error is notified from the service server to the user terminal.

On the other hand, when “A authentication” is unauthenticated and “B authentication” is authenticated, “A authentication” is executed between the own server and the user terminal (step Sd7). Then, after the authentication is successful, the authentication status of the user is stored in the internal storage area as “authenticated by A authentication”, and “authentication successful” indicating that both “A authentication” and “B authentication” have been established. Is sent to the service server (step Sd8). Upon receiving this notification, the service server provides a service to the user terminal (step Sd9).
On the other hand, if both “A authentication” and “B authentication” have been authenticated, the process proceeds to step Sd8.

Next, a modification of FIG. 8 will be described using the drawings. FIG. 9 is a diagram for explaining another embodiment of the authentication system.
In this embodiment, in step Sd6 of FIG. 8, when “B authentication” is unauthenticated, an error is transmitted to the service server. However, in this embodiment, an error is not transmitted. A case will be described in which an authentication request is made to perform “B authentication” to the authentication proxy server 2 at the time, and the service is provided when the authentication is completed.
Here, before making a service request from the user terminal to the service server, the user terminal transmits an authentication request to the authentication proxy server 2 and executes “B authentication” with the authentication proxy server 2 (step S1). Se1). If this authentication is successful, the authentication status of the user is notified as “authenticated by B authentication” and notified to the representative authentication proxy server (in this case, authentication proxy server 1) using PUSH distribution or the like (step Se2).
The authentication proxy server 1 stores the authentication result of “B authentication” included in the authentication response received from the authentication proxy server 2 in an internal storage area.

After the B authentication is performed or when the B authentication is unauthenticated, when a service request is transmitted from the user terminal to the service server (step Se3), the service server 110 receives the request from the user terminal The authentication status of 100 users is checked (step Se4). Here, when it is authenticated, the service is provided to the user terminal (step Se13). On the other hand, in the case of terminal authentication, “A authentication + B authentication” is designated as the authentication method, and an authentication request is transmitted to the authentication proxy server 1 (step Se5).
The authentication proxy server 1 receives the authentication request from the service server 110, determines the requested authentication method, and determines whether or not the user has been authenticated for the requested authentication method (step Se6). . Here, referring to the internal storage area as to whether or not “A authentication” and “B authentication” have been authenticated, if both “A authentication” and “B authentication” are unauthenticated, the user terminal Then, “A authentication” is performed (step Se7), and since “B authentication” cannot be authenticated by itself, a request for “B authentication” is transmitted to the authentication proxy server 2 (step Se8).

  When the authentication proxy server 2 receives the request for “B authentication”, the authentication proxy server 2 refers to the storage area provided inside to determine the authentication status of the user, and if “B authentication” is already authenticated, The authentication proxy server 1 is notified (step Se11), and if “B authentication” is unauthenticated, “B authentication” is executed with the user terminal (step Se10). Then, after storing the authentication result of “B authentication” in the internal storage area, the authentication result is transmitted to the authentication proxy server 1 (step Se11).

On the other hand, if “A authentication” is not authenticated and “B authentication” is already authenticated in step Se6, “A authentication” is performed on the user terminal (step Se7), and the authentication result is stored in the internal storage area. Then, an authentication result in which both “A authentication” and “B authentication” are established is transmitted to the service server (step Se12).
On the other hand, if “A authentication” has been authenticated and “B authentication” has not been authenticated, “B authentication” cannot be authenticated by itself, so a request for “B authentication” is transmitted to the authentication proxy server 2 (step Se8). After receiving the authentication result indicating that “B authentication” has been authenticated from the authentication proxy server 2, the authentication result indicating that “B authentication” has been established is stored in the internal storage area, and “A authentication”, An authentication result in which both “B authentication” is established is transmitted to the service server (step Se12).
On the other hand, if both “A authentication” and “B authentication” have been authenticated, an authentication result in which both “A authentication” and “B authentication” are established is transmitted to the service server (step Se12).
When the service server receives the notification of the authentication result from the authentication proxy server 1, the service server stores in the internal storage area that the authentication status of the user is “A authentication” and “B authentication”, and the user terminal A service is provided to (step Se13).

In the embodiment of FIGS. 8 and 9 described above, as shown in FIG. 10, in the B authentication phase, “B authentication” is executed in advance from the user terminal to the authentication proxy server 2, and the authentication result is sent to the authentication proxy server. 1, and in the service request phase, the authentication status for “A authentication” and “B authentication” can be inquired from the service server to the authentication proxy server 1. The authentication proxy server 1 may return an error when receiving an authentication request from the service server without holding a notification indicating that “B authentication” has been established, and at that time The authentication proxy server 2 may execute “B authentication”.
In the above-described embodiments of FIGS. 8 and 9, the case where the authentication request is transmitted from the user terminal to the authentication proxy server 2 has been described. However, triggered by the transmission of the authentication request from the authentication proxy server 2 to the user terminal. An authentication process may be performed.

Moreover, the modification of embodiment of FIG. 8 and FIG. 9 demonstrated above is demonstrated using drawing. FIG. 11 is a diagram for explaining another embodiment of the authentication system.
First, in the B authentication and C authentication phases, an authentication request is transmitted from the user terminal to the authentication proxy server 2 and the authentication proxy server 3. The authentication agent server 2 performs “B authentication” with the user terminal and notifies the authentication agent server 1 of the authentication result. The authentication proxy server 3 performs “C authentication” with the user terminal, and notifies the authentication proxy server 1 of the authentication result.
In the service request phase, when there is a service request from the user terminal, the service server transmits an authentication request to the authentication proxy server 1. The authentication surrogate server 1 determines whether or not “B authentication” in the authentication surrogate server 2 and “C authentication” in the authentication surrogate server 3 are both effectively established, and “A” is established between the server and the user terminal. When authentication is established by executing “authentication”, an authentication response indicating that all of “A authentication”, “B authentication”, and “C authentication” are established is transmitted to the service server. The service server that has received this provides the service to the user terminal.

The authentication surrogate server 1 does not hold a notification indicating that “B authentication” has been established or does not hold a notification that indicates that “C authentication” has been established. When an authentication request is received, an error may be returned, and since “B authentication” and “C authentication” cannot be authenticated by themselves, the authentication proxy server 2 executes “B authentication” at that time. The authentication proxy server 3 may execute “C authentication”.
In the embodiment of FIG. 10 described above, the case where the authentication request is transmitted from the user terminal to the authentication proxy server 2 and the authentication proxy server 3 has been described. However, the authentication request from the authentication proxy server 2 and the authentication proxy server 3 to the user terminal Authentication processing may be performed in response to the transmission of.

  A program for realizing the functions of the user terminal (100), service server (110), authentication proxy server 1 (120), authentication proxy server 2 (130), and authentication proxy server 3 (140) in the embodiment described above. The user authentication process may be performed by creating and recording the program on a computer-readable recording medium, causing the computer system to read and executing the program recorded on the recording medium. The “computer system” here includes an OS and hardware such as peripheral devices.

Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Further, the “computer-readable recording medium” includes a medium that holds a program for a certain period of time, such as a volatile memory inside a computer system. The program may be a program for realizing a part of the functions described above, and may be a program capable of realizing the functions described above in combination with a program already recorded in a computer system.

  Although the invention made by the present inventor has been specifically described based on the above embodiment, the present invention is not limited to the above embodiment, and various modifications can be made without departing from the scope of the invention. Of course.

It is a system configuration and information flow chart when two authentication agent servers cooperate to implement authentication. It is a system configuration and information flow diagram when three or more authentication proxy servers cooperate to perform authentication. It is a system configuration and information flow diagram when three or more authentication proxy servers cooperate to perform authentication. It is a basic sequence diagram in the case where two authentication proxy servers cooperate to implement authentication. It is a processing flow figure of a service server at the time of receiving a service request from a user. It is a processing flow figure of the authentication proxy server 1 at the time of receiving the authentication proxy request from a service server. It is a processing flow figure of the authentication proxy server 2 at the time of receiving the authentication proxy request from the authentication proxy server 1. It is drawing for demonstrating other embodiment of the authentication system in FIG. It is drawing for demonstrating other embodiment of an authentication system. It is drawing for demonstrating other embodiment of an authentication system. It is drawing for demonstrating other embodiment of an authentication system.

Explanation of symbols

100 User terminal 110 Service server 120 Authentication proxy server 1 130 Authentication proxy server 2
140 Authentication proxy server 3

Claims (10)

An authentication method in an authentication system in which a user terminal, a service server that provides a service to a user, and a plurality of authentication proxy servers that perform authentication of the user for service provision of the service server are connected via a network. There,
Requesting a service from the user terminal to the service server;
The service server determining an authentication state of the user terminal and providing a service to the user terminal when the user has been authenticated;
Transmitting the user authentication request to a first authentication proxy server when the authentication state of the user terminal is unauthenticated;
The first authentication proxy server receiving the authentication request and determining an authentication method required in the authentication request;
The first authentication proxy server determines an authentication state of the user terminal with respect to the authentication method, and if authenticated, generates authentication result information indicating that authentication has been performed, and an authentication response including the authentication result information Sending to the service server;
If the authentication status of the user terminal is unauthenticated, if the local server can authenticate, the local server executes authentication, and if the local server cannot authenticate, sends an authentication request to the second authentication proxy server, or A step to do both,
The second authentication proxy server receiving the authentication request and determining an authentication method required in the authentication request;
The second authentication proxy server determines an authentication state of the user terminal with respect to the authentication method, and if authenticated, generates authentication result information indicating that it has been authenticated, and includes an authentication response including the authentication result information Transmitting to the first authentication surrogate server;
When the authentication state of the user terminal is unauthenticated, executing authentication, and transmitting an authentication response including the authentication result to the first authentication proxy server;
The first authentication proxy server receives the authentication response, determines the authentication content, and if the authentication content is valid and if the authentication is performed by itself, the authentication is valid. Generating authentication result information indicating that, and transmitting an authentication response including the authentication result information to the service server;
If the content of the authentication response is invalid, or if the authentication is invalid when the authentication is performed by itself, the authentication response information indicating that the authentication was invalid is generated, and the authentication response including the authentication result information is sent to the service Sending to the server;
The service server determines the authentication response, provides service to the user if valid, and notifies the user that service cannot be provided if invalid;
An authentication method characterized by comprising: An authentication method in an authentication system in which a user terminal, a service server that provides a service to a user, and a plurality of authentication proxy servers that perform authentication of the user for service provision of the service server are connected via a network. There,
A second authentication proxy server receiving an authentication request from the first authentication proxy server and determining an authentication method required in the authentication request;
The second authentication proxy server determines an authentication state of the user terminal with respect to the authentication method, and if authenticated, generates authentication result information indicating that it has been authenticated, and includes an authentication response including the authentication result information Sending to the first authentication surrogate server;
If the authentication status of the user terminal is unauthenticated, if authentication can be performed by the local server, authentication is performed by the local server, and if authentication cannot be performed by the local server, an authentication request is transmitted to the third authentication proxy server, or A step to do both,
The third authentication proxy server receiving the authentication request and determining an authentication method required in the authentication request;
The third authentication proxy server determines an authentication state of the user terminal with respect to the authentication method, and if authenticated, generates authentication result information indicating that the user terminal is authenticated, and an authentication response including the authentication result information Sending to the second authentication surrogate server;
When the authentication state of the user terminal is unauthenticated, executing authentication, and transmitting an authentication response including the authentication result to the second authentication proxy server;
The second authentication surrogate server generates authentication result information by combining the authentication result information included in the authentication response received from the third authentication surrogate server and the result information when the authentication is performed by itself. Transmitting an authentication response including authentication result information to the first authentication proxy server;
The first authentication surrogate server generates authentication result information by combining the authentication result information included in the authentication response received from the second authentication surrogate server and the result information when the authentication is performed by itself. Transmitting an authentication response including the authentication result information to the service server. An authentication method in an authentication system in which a user terminal, a service server that provides a service to a user, and a plurality of authentication proxy servers that perform authentication of the user for service provision of the service server are connected via a network. There,
A first authentication agent server receiving an authentication request from a service server and determining an authentication method required in the authentication request;
The first authentication proxy server determines an authentication state of the user with respect to the authentication method, and if authenticated, generates authentication result information indicating that the user is authenticated, and sends an authentication response including the authentication result information. Transmitting to the service server;
If the authentication status of the user is unauthenticated, if the local server can authenticate, the local server performs authentication. If the local server cannot authenticate, the authentication request is sent to the second authentication proxy server and the third authentication proxy server. Sending or sending both, and
The second authentication proxy server receiving the authentication request and determining an authentication method required in the authentication request;
The second authentication proxy server determines an authentication state of the user with respect to the authentication method, and if authenticated, generates authentication result information indicating that the user has been authenticated, and sends an authentication response including the authentication result information. Transmitting to the first authentication proxy server;
If the authentication status of the user is unauthenticated, executing authentication, and transmitting an authentication response including the authentication result to the first authentication proxy server;
The third authentication proxy server receiving the authentication request and determining an authentication method required in the authentication request;
The third authentication proxy server determines an authentication state of the user with respect to the authentication method, and if authenticated, generates authentication result information indicating that the user is authenticated, and sends an authentication response including the authentication result information. Transmitting to the first authentication proxy server;
If the authentication status of the user is unauthenticated, executing authentication, and transmitting an authentication response including the authentication result to the first authentication proxy server;
The first authentication surrogate server receives an authentication response from the second authentication surrogate server and the third authentication surrogate server, determines the contents, both of which are valid, and performs the authentication itself If the authentication is valid, generating authentication result information indicating that the authentication has been completed, and transmitting an authentication response including the authentication result information to the service server;
If any of the contents of the authentication response is invalid, or if the authentication is invalid when the authentication is performed by itself, authentication result information indicating that the authentication was invalid is generated, and the authentication response includes the authentication result information Sending to the service server;
An authentication method characterized by comprising: An authentication method in an authentication system in which a user terminal, a service server that provides a service to a user, and a plurality of authentication proxy servers that perform authentication of the user for service provision of the service server are connected via a network. There,
Performing user authentication between the user terminal and a second authentication proxy server;
Generating authentication result information indicating that authentication has been completed when authentication is established, and transmitting an authentication response including the authentication result information to the first authentication proxy server;
Requesting a service from the user terminal to the service server;
The service server determining an authentication state of the user terminal and providing a service to the user terminal when the user has been authenticated;
Transmitting the user authentication request to the first authentication proxy server when the authentication status of the user terminal is unauthenticated;
The first authentication proxy server receiving the authentication request and determining an authentication method required in the authentication request;
The first authentication proxy server determines an authentication state of the user terminal with respect to the authentication method, and receives and holds from the second authentication proxy server that the authentication result in the second authentication proxy server has been authenticated. And when the authentication is performed by itself, if the authentication is valid, authentication result information indicating that the authentication has been completed is generated, and an authentication response including the authentication result information is sent to the service server. Sending to
If the content of the authentication response is invalid, or if the authentication is invalid when the authentication is performed by itself, an authentication result indicating that the authentication was invalid is generated, and the authentication response including the authentication result information is sent to the service server. Sending to
The service server determines the authentication response, provides service to the user if valid, and notifies the user that service cannot be provided if invalid;
An authentication method characterized by comprising: An authentication method in an authentication system in which a user terminal, a service server that provides a service to a user, and a plurality of authentication proxy servers that perform authentication of the user for service provision of the service server are connected via a network. There,
Performing user authentication between the user terminal and a second authentication proxy server and between the user terminal and a third server;
If the second authentication proxy server can authenticate with its own server, it performs authentication with its own server, and generates authentication result information indicating that it has been authenticated when authentication is established, and includes the authentication result information Sending an authentication response to the first authentication proxy server;
If the third authentication proxy server can authenticate with its own server, it performs authentication with its own server, and generates authentication result information indicating that it has been authenticated when authentication is established, and includes the authentication result information Sending an authentication response to the first authentication proxy server;
Requesting a service from the user terminal to the service server;
The service server determining an authentication state of the user terminal and providing a service to the user terminal when the user has been authenticated;
Transmitting the user authentication request to the first authentication proxy server when the authentication status of the user terminal is unauthenticated;
The first authentication proxy server receiving the authentication request and determining an authentication method required in the authentication request;
The first authentication proxy server determines an authentication state of the user terminal with respect to the authentication method, and receives and holds from the second authentication proxy server that the authentication result in the second authentication proxy server has been authenticated. And the fact that the authentication result in the third authentication proxy server has been authenticated is received from the third authentication proxy server and held, and if the authentication is performed by itself, the authentication result Generating authentication result information indicating that the authentication has been completed if is valid, and transmitting an authentication response including the authentication result information to the service server;
If the content of the authentication response is invalid, or if the authentication is invalid when the authentication is performed by itself, an authentication result indicating that the authentication was invalid is generated, and the authentication response including the authentication result information is sent to the service server. Sending to
The service server determines the authentication response, provides service to the user if valid, and notifies the user that service cannot be provided if invalid;
An authentication method characterized by comprising: An authentication system formed by connecting a user terminal, a service server that provides services to a user, and a plurality of authentication proxy servers that perform authentication of the user for providing services of the service server,
The first authentication proxy server is
Means for receiving an authentication request from the service server;
Means for determining an authentication method required in the authentication request;
Means for determining an authentication state of the user with respect to the authentication method, generating authentication result information indicating that the user has been authenticated, and transmitting an authentication response including the authentication result information to the service server; ,
If the authentication status of the user is unauthenticated, if the local server can authenticate, the local server executes authentication, and if the local server cannot authenticate, sends an authentication request to the other second authentication proxy server, or Means to do both,
Means for receiving an authentication response from the second authentication proxy server;
The content of the authentication response is determined, and if the content is valid and the user has performed authentication, authentication result information is generated indicating that the authentication has been completed if the authentication is valid, and the authentication is performed. Means for transmitting an authentication response including result information to the service server;
If the content of the authentication response is invalid, or if the authentication is invalid when the authentication is performed by itself, the authentication response information indicating that the authentication was invalid is generated, and the authentication response including the authentication result information is sent to the service Means for sending to the server,
The second authentication proxy server is:
Means for receiving an authentication request from the first authentication proxy server;
Means for determining an authentication method required in the authentication request;
An authentication state of the user with respect to the authentication method is determined, and if authenticated, authentication result information indicating that the user has been authenticated is generated, and an authentication response including the authentication result information is sent to the first authentication proxy server. Means for transmitting;
Means for executing authentication when the user's authentication status is unauthenticated, and transmitting an authentication response including the authentication result to the first authentication proxy server;
The service server determines the authentication response, provides service to the user if valid, and notifies the user that service cannot be provided if invalid;
An authentication system characterized by comprising: An authentication system formed by connecting a user terminal, a service server that provides services to a user, and a plurality of authentication proxy servers that perform authentication of the user for providing services of the service server,
The second authentication proxy server
Means for receiving an authentication request from the first authentication proxy server and determining an authentication method required in the authentication request;
The second authentication proxy server determines an authentication state of the user with respect to the authentication method, and if authenticated, generates authentication result information indicating that the user has been authenticated, and sends an authentication response including the authentication result information. Means for transmitting to the first authentication proxy server;
If the authentication status of the user is unauthenticated, if the local server can authenticate, the local server executes authentication. If the local server cannot authenticate, it sends an authentication request to another third authentication proxy server. Or a means to do both,
The authentication result information included in the authentication response received from the third authentication proxy server and the authentication result information when the authentication is executed by itself are generated, and an authentication response including the authentication result information is generated. Means for transmitting to the first authentication proxy server;
The third authentication proxy server is:
Means for receiving the authentication request and determining an authentication method required in the authentication request;
The authentication state of the user with respect to the authentication method is determined, and if authenticated, authentication result information indicating that the user is authenticated is generated, and an authentication response including the authentication result information is sent to the second authentication proxy server. Means for transmitting;
Means for executing authentication when the user's authentication status is unauthenticated, and transmitting an authentication response including the result of the authentication to the second authentication proxy server;
The first authentication proxy server is:
The authentication result information included in the authentication response received from the second authentication proxy server and the authentication result information generated by itself when the authentication is performed are generated, and an authentication response including the authentication result information is generated. An authentication system comprising: means for transmitting to the service server. An authentication system formed by connecting a user terminal, a service server that provides services to a user, and a plurality of authentication proxy servers that perform authentication of the user for providing services of the service server,
The first authentication proxy server
Means for receiving an authentication request from a service server and determining an authentication method required in the authentication request;
Means for determining an authentication state of the user terminal with respect to the authentication method, generating authentication result information indicating that the user terminal has been authenticated, and transmitting an authentication response including the authentication result information to the service server; When,
If the authentication status of the user is unauthenticated, if authentication can be performed on the own server, authentication is performed on the own server. If authentication cannot be performed on the own server, a plurality of other authentication proxy servers, second authentication proxy server, Means for transmitting an authentication request to the authentication proxy server 3 or both,
Receive authentication responses from the second authentication proxy server and the third authentication proxy server, determine the contents, and the contents are both valid, and if the authentication is performed by itself, the authentication is valid Means for generating authentication result information indicating that authentication has been completed, and transmitting an authentication response including the authentication result information to the service server;
If any of the contents of the authentication response is invalid, or if the authentication is invalid when the authentication is performed by itself, authentication result information indicating that the authentication was invalid is generated, and the authentication response includes the authentication result information Means for transmitting to the service server,
The second authentication proxy server is:
Means for receiving the authentication request and determining an authentication method required in the authentication request;
The second authentication proxy server determines an authentication state of the user with respect to the authentication method, and if authenticated, generates authentication result information indicating that the user has been authenticated, and sends an authentication response including the authentication result information. Means for transmitting to the first authentication proxy server;
Means for executing authentication when the user's authentication status is unauthenticated, and transmitting an authentication response including the authentication result to the first authentication proxy server;
The third authentication proxy server is:
Means for receiving the authentication request and determining an authentication method required in the authentication request;
The third authentication proxy server determines an authentication state of the user for the authentication method, generates authentication result information indicating that the authenticated hot water has been authenticated, and an authentication response including the authentication result information Means for transmitting to the first authentication proxy server;
Means for executing authentication when the user authentication state is unauthenticated, and transmitting an authentication response including the result of the authentication to the first authentication proxy server;
An authentication system characterized by comprising: An authentication system formed by connecting a user terminal, a service server that provides services to a user, and a plurality of authentication proxy servers that perform authentication of the user for providing services of the service server,
A second authentication proxy server for performing user authentication with the user terminal;
If authentication can be performed by the local server, authentication is performed by the local server, and when authentication is established, authentication result information indicating that the authentication has been completed is generated, and an authentication response including the authentication result information is first authenticated. Means for sending to the proxy server,
The first authentication proxy server is:
Means for receiving the authentication request from the service server and determining an authentication method required in the authentication request;
Determining an authentication state of the user terminal with respect to the authentication method, receiving from the second authentication proxy server that the authentication result in the second authentication proxy server has been authenticated, and holding the authentication result; Means for generating authentication result information indicating that the authentication has been completed if the authentication is valid, and transmitting an authentication response including the authentication result information to the service server;
If the content of the authentication response is invalid, or if the authentication is invalid when the authentication is performed by itself, an authentication result indicating that the authentication was invalid is generated, and the authentication response including the authentication result information is sent to the service server. Means for transmitting to
The service server
Means for determining an authentication state of the user terminal and providing a service to the user terminal when the user terminal has been authenticated;
Means for transmitting the user authentication request to the first authentication proxy server when the authentication status of the user terminal is unauthenticated;
Means for determining the authentication response, providing service to the user if valid, and notifying the user that service cannot be provided if invalid;
An authentication system characterized by comprising: An authentication system in which a user terminal, a service server that provides a service to a user, and a plurality of authentication proxy servers that perform authentication of the user for service provision of the service server are connected via a network,
The second authentication proxy server
Means for performing user authentication with the user terminal;
If authentication can be performed by the local server, authentication is performed by the local server, and when authentication is established, authentication result information indicating that the authentication has been completed is generated, and an authentication response including the authentication result information is first authenticated. Means for sending to the proxy server,
The third authentication proxy server
Means for performing user authentication with the user terminal;
If authentication can be performed by the local server, authentication is performed by the local server, and when authentication is established, authentication result information indicating that the authentication has been completed is generated, and an authentication response including the authentication result information is first authenticated. Means for sending to the proxy server,
The first authentication proxy server is:
Receiving the authentication request from the service server, and determining an authentication method required in the authentication request,
Determining an authentication state of the user terminal with respect to the authentication method, receiving from the second authentication proxy server that the authentication result in the second authentication proxy server has been authenticated, and holding, and 3 that the authentication result in the authentication proxy server 3 has been authenticated and received from the third authentication proxy server and has been authenticated if the authentication result is valid when the authentication is executed by itself. The authentication result information indicating that the authentication response information is generated and the authentication response including the authentication result information is transmitted to the service server and the content of the authentication response is invalid or the authentication is performed when the authentication is executed. A means for generating an authentication result indicating that the authentication result is invalid, and transmitting an authentication response including the authentication result information to the service server.
The service server
Means for determining an authentication state of the user terminal and providing a service to the user terminal when the user terminal has been authenticated;
Means for transmitting the user authentication request to the first authentication proxy server when the authentication status of the user terminal is unauthenticated;
Means for determining the authentication response, providing service to the user if valid, and notifying the user that service cannot be provided if invalid;
An authentication system characterized by comprising:

Images