JP2007226470A - Authority management server, authority management method, and authority management program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To access external resources without notifying an external system of identification information on a user. <P>SOLUTION: A user side authority management server requests an external authority management server to issue a token by using Kana (Japanese syllabary) identification information and, in response to this, the external authority management server issues a token to the Kana identification information. The external authority management server stores information on the issued token in a token storage part. The user side authority management server transmits the token issued by the external authority management server to a user terminal. The user transmits the token to a resource server from the user terminal to access the external resources. The resource server which has received the token from the user terminal and the external authority management server to which the token has been transferred by the resource server collate the received token with information on the token stored in the token storage part to verify the validity of the token. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a technology for managing access authority to a user's resource, and in particular, identification information used by a user managed by a certain authority management server to access a resource managed by this resource management server. It is related with the access authority management technique which can access the resource under management of another authority management server, without notifying.

Conventionally, in a system that limits users who can access resources such as a content server, many access control techniques closed by the system have been proposed.
For example, Patent Document 1 describes a shared resource management system using a delegation authority certificate.
In this shared resource management system, a transfer client issues a delegation authority certificate that proves temporary or limited transfer of access authority to a managed resource using a delegation authority certificate issuance function. The delegation authority certificate is acquired through the delegation authority certificate storage function, the digital proxy signature that is an access request based on the acquired delegation authority certificate is generated by the digital proxy signature generation function, the resource management server receives the digital proxy signature, Through the digital proxy signature verification function and the delegation authority verification function, it is verified whether an access request to the management target resource by the transferred client is proper.

JP 2002-163235 A

However, with the conventional access control technology, in order to be able to access content servers of different systems in an environment where there are multiple systems that limit users, a large-scale authority management server that includes multiple systems is constructed. There was a need to do.
Therefore, in a system having a large-scale authority management server including a plurality of systems, there is a problem that user management is concentrated and the load on the authority management server increases.
In addition, when a user under the management of a certain system tries to use a resource under the management of another system with a different administrator, it is necessary to convey the user information (for example, user ID) of the user to the other system. There was a problem that there was. This means that there is a risk that customer information will be leaked to competitors from the standpoint of the system administrator, and personal information will also be leaked to other systems from the standpoint of the user. It is not preferable.

  Therefore, the present invention provides a user who belongs to each system uses resources of other systems in an environment where there are a plurality of systems having an authority management server that manages the authority of users and users to access resources such as a content server. In this case, it is possible to access the content server of another system without leaking the user information managed by the authority management server to the authority management server of the other system, and transfer the access authority of the content server between users belonging to different systems. It is an object of the present invention to provide an authority management system or the like that can use the assigned access authority without leaking user information even if it is performed.

  The authority management server of the present invention generates pseudonym identification information, transmits the pseudonym identification information to the external authority management server that manages the access authority of the external resource, and gives the user corresponding to the pseudonym identification information the access right to the external resource. Token issuing request means for requesting the issuance of a token for granting the token, and token transmitting means for transmitting the token to the user terminal used by the user (claims 1 to 3).

According to the authority management server, the external authority management server is requested to issue a token using the kana identification information, and the token issued for the kana identification information is transmitted to the user terminal. The user can access an external resource using this token.
Since the pseudonym identification information is different from the normal identification information (for example, user ID) used by the user to access the resource under the management of the authority management server, the user can change the normal identification information to another External resources can be accessed without notifying the system.

  In the authority management server, the token transmission means has a function of generating an issuance certificate including a token hash value, pseudonym identification information, and information for identifying the authority management server, and transmitting the issuance certificate to the user terminal. Operates when an issuance certificate encrypted with the public key of the authority management server and a usage certificate including plaintext pseudonym identification information are received from the external authority management server, and the encrypted issuance certificate corresponds to the public key. It is decrypted with the private key, and it is determined whether or not the pseudonym identification information included in the encrypted issuance certificate matches the plaintext pseudonym identification information, and the determination result is transmitted to the external authority management server. And a sex verification means (claim 2).

In this way, the external authority management server or the like that acquired the token and the issuance certificate sends the issuance certificate to the issuance authority management server, and the token corresponds to the pseudonym identification information included in the issuance certificate. The user can be requested to verify whether it has been issued.
Therefore, unauthorized access to external resources by a third party due to unauthorized acquisition of tokens or the like can be prevented. Here, since normal user identification information is not included in the usage certificate, normal user information is not leaked to the external system.

  In the above authority management server, the usage certificate is attached with a digital signature using a token usage signature key corresponding to the pseudonym identification information, and the token usage includes the token usage public key corresponding to the token usage signature key and the pseudonym identification information. You may make it provide the token utilization public key certificate production | generation means which produces | generates a public key certificate (Claim 3).

In this way, the external authority management server that acquired the token can verify the usage certificate using the public key of the authority management server that issued the usage certificate, and verify the validity of the usage certificate. it can.
For this reason, it is possible to prevent unauthorized access to external resources due to falsification or unauthorized acquisition of usage certificates.

The authority management system of the present invention includes a user-side authority management server, an external limit management server, a user terminal, and a resource server.
The user-side authority management server generates pseudonym identification information, transmits the pseudonym identification information to the external authority management server, and requests token issuance request means for requesting the issuance of a token that gives the user access rights to the external resources; Token transmitting means for transmitting the token to the user terminal.
The user terminal includes token use processing means for transmitting a token to the resource server.
The external authority management server includes token issuing means for generating a token and transmitting the token to the user authority management server and storing information about the token in the token storage unit.
Either or both of the external authority management server and the resource server operate when a token is received, and the token is verified by the external authority management server by collating the received token with the information stored in the token storage unit. Token verifying means for verifying whether or not the certificate is issued to the client is provided (claims 4 to 6).

According to the above authority management system, the user authority management server requests the external authority management server to issue a token using the pseudonym identification information, and the external authority management server sends a token to the pseudonym identification information accordingly. Issue. At this time, the external authority management server stores information on the issued token in the token storage unit.
The user-side authority management server transmits the token issued by the external authority management server to the user terminal. The user can access the external resource by transmitting the token to the resource server at the user terminal.
The resource server that has received the token from the user terminal and the external authority management server that has transferred the token from the resource server verify the validity of the token by comparing the received token with the information about the token stored in the token storage unit. be able to.
Since the pseudonym identification information is different from the normal identification information used by the user to access resources managed by the authority management server, the user does not notify the external system of the normal identification information. Can access external resources.

  In the authority management system, the token transmission means has a function of generating an issuance certificate including a token hash value, pseudonym identification information, and information for identifying the use-side authority management server, and transmitting the issuance certificate to the user terminal. The token use processing means has a function of generating an issuance certificate encrypted with the public key of the use-side authority management server and a use certificate including plaintext pseudonym identification information and transmitting it to the resource server. Operates when a certificate and token are received from the resource server, sends a usage certificate to the user-side authority management server, and requests verification of the validity of the user who sent the usage certificate. The user-side authority management server operates when receiving a usage certificate from the external authority management server, decrypts the encrypted issuance certificate with the private key corresponding to the public key, User legitimacy verification means for determining whether or not the pseudonym identification information included in the issued certificate matches the plaintext kana identification information and transmitting the determination result to the external authority management server. You may make it (Claim 5).

In this way, the external authority management server or the like that has acquired the token and the issuance certificate sends the issuance certificate to the user-side authority management server, and the token corresponds to the pseudonym identification information included in the issuance certificate. It can be requested to verify whether it has been issued to a person.
Therefore, unauthorized access to external resources by a third party due to unauthorized acquisition of tokens or the like can be prevented. Here, since normal user identification information is not included in the usage certificate, normal user information is not leaked to the external system.

  In the authority management system, the usage certificate is attached with a digital signature using a token usage signature key corresponding to the pseudonym identification information, and the usage-side authority management server includes a token usage public key corresponding to the token usage signature key. Token use public key certificate generation means for generating a token use public key certificate including pseudonym identification information is provided, and either or both of the external authority management server and the resource server operate when receiving the use certificate. Further, a use certificate verifying unit that verifies the validity of the use certificate using the token use public key acquired from the token use public key certificate may be provided.

In this way, the external authority management server or the like that acquired the token first verifies the validity of the token use public key using the token use public key certificate, and further uses the token use public key. Can be verified.
For this reason, it is possible to prevent unauthorized access to external resources due to falsification or unauthorized acquisition of usage certificates.

The authority management system of the present invention includes a use-side authority management server, an external limit management server, a user terminal, a resource server, a transfer destination user terminal, and a transfer destination authority management server.
The user-side authority management server generates pseudonym identification information, sends the pseudonym identification information to the external authority management server, and issues a token issue request means for requesting the user to issue a token that grants access rights to unmanaged resources. And token transmitting means for transmitting the token to the user terminal.
The user terminal includes token transfer means for transmitting the token to the transfer destination user terminal.
The transfer destination user terminal includes token use processing means for transmitting the token to a resource server holding external resources.
The external authority management server includes token issuing means for generating a token and transmitting it to the user-side authority management server and storing information about the token in the token storage unit.
Either or both of the external authority management server and the resource server operate when a token is received, and the token is verified by the external authority management server by collating the received token with the information stored in the token storage unit. Token verifying means for verifying whether or not the certificate is issued to the client is provided (claims 7 to 9).

According to the above authority management system, the user authority management server requests the external authority management server to issue a token using the pseudonym identification information, and the external authority management server sends a token to the pseudonym identification information accordingly. Issue. At this time, the external authority management server stores information on the issued token in the token storage unit.
The user-side authority management server transmits the token issued by the external authority management server to the user terminal. The user can transfer the access right to the external resource to the transfer destination user by transmitting the token to the transfer destination user terminal using the user terminal. The transfer destination user can access the external resource by transmitting the token transferred to the resource server at the transfer destination user terminal.
The resource server that received the token from the transfer destination user terminal and the external authority management server that transferred the token from the resource server collate the received token with the information about the token stored in the token storage unit to verify the validity of the token. Can be verified.
Since the pseudonym identification information is different from the normal identification information used by the user to access resources managed by the authority management server, the user does not notify the external system of the normal identification information. The token is transferred to the transfer destination user, and the transfer destination user can access the external resource using the token.

  In the authority management system, the token transmission means has a function of generating an issuance certificate including a token hash value, pseudonym identification information, and information for identifying the use-side authority management server, and transmitting the issuance certificate to the user terminal. The token transfer means has a function of generating a transfer certificate including an issuance certificate encrypted with the public key of the user-side authority management server and plain text pseudonym identification information and transmitting the transfer certificate to the transfer destination user terminal. The token usage processing means is a plaintext different from the transfer certificate encrypted with the public key of the transferee authority management server and the identification information used by the transferee user to access the resources managed by the transferee authority management server. And a function to generate a usage certificate including the transfer destination user kana identification information and send it to the resource server together with the token. The external authority management server receives the usage certificate from the resource server. It operates when a token is received, and includes a verification request means for requesting verification of the legitimacy of the user who transmitted the usage certificate to the transfer destination authority management server and sent the usage certificate. It operates when the usage certificate is received from the external authority management server, decrypts the encrypted transfer certificate with the private key corresponding to the public key of the transferee authority management server, and converts it into an encrypted transfer certificate. User legitimacy judging means for judging whether or not the included transferee user pseudonym identification information and the plaintext transferee user pseudonym identification information match, and the decrypted transfer certificate is sent to the user authority management server User validity verification requesting means for requesting verification of the validity of the user who sent the transfer certificate, the determination result by the user validity determining means, and the authority on the user side for the request by the user validity verification requesting means Management service Response means for transmitting a response from the server to the external authority management server, and the user-side authority management server operates when receiving the transfer certificate from the transferee authority management server, and receives the encrypted issuance certificate. Determining whether or not the pseudonym identification information included in the encrypted issuance certificate and plaintext pseudonym identification information match with the private key corresponding to the public key of the user authority management server Confirmation response means for transmitting to the transferee authority management server.

In this way, the external authority management server etc. that acquired the token and usage certificate sends the transfer certificate included in the usage certificate to the transferee authority management server, and the pseudonym whose token is included in the usage certificate The user corresponding to the identification information can be requested to verify whether it has been transferred or not. Also, the transferee authority management server that acquired the transfer certificate sends the issuance certificate included in the transfer certificate to the user authority management server, and the token corresponds to the pseudonym identification information included in the issuance certificate. It can be requested to verify whether it has been issued to a person.
Therefore, unauthorized access to external resources by a third party due to unauthorized acquisition of tokens or the like can be prevented. Here, since the normal user identification information is not included in the use certificate and the transfer certificate, the normal user information is not leaked to the external system.

  In the authority management system, a digital signature using a token transfer signature key corresponding to the pseudonym identification information is attached to the transfer certificate, and a token usage signature corresponding to the transferee user pseudonym identification information is attached to the usage certificate. A digital signature using a key is attached, and the user authority management server generates a token transfer public key certificate that includes a token transfer public key corresponding to the token transfer signature key and a token transfer public key certificate including pseudonym identification information. A transfer destination authority management server including a token use public key certificate generating unit that generates a token use public key certificate corresponding to the token use signing key and a transfer destination user pseudonym identification information; Activates when the transfer certificate is received and verifies the validity of the transfer certificate using the token transfer public key obtained from the token transfer public key certificate One or both of the external authority management server and the resource server operate when receiving the usage certificate, and use the token usage public key obtained from the token usage public key certificate. It is also possible to provide usage certificate verification means for verifying the validity of the usage certificate (claim 9).

In this way, the external authority management server or the like that acquired the token first verifies the validity of the token use public key using the token use public key certificate, and further uses the token use public key. Can be verified. Also, the transferee user terminal that acquired the transfer certificate first verifies the validity of the token transfer public key using the token transfer public key certificate, and then uses the token transfer public key to verify the validity of the transfer certificate. The sex can be verified.
Therefore, it is possible to prevent unauthorized access to external resources due to falsification or unauthorized acquisition of the usage certificate and transfer certificate.

  In the authority management method of the present invention, a user authority management server generates pseudonym identification information, transmits the pseudonym identification information to an external authority management server, and issues a token that gives the user access to unmanaged resources. A token issuance request step for requesting, a token issuance step for the external authority management server to generate and send a token to the user side authority management server and store information on the token in the token storage unit, and a user side authority management server, The token sending step for sending the token to the user terminal used by the user, the token use processing step for sending the token to the resource server holding the external resource, and the external authority management server receiving the token Sometimes the token is externally authorized by checking the received token against the information stored in the token storage. The token verification step of verifying whether or not issued to the user by management server manages access to external resources (claim 10).

According to the above authority management method, the user authority management server uses the pseudonym identification information to request the external authority management server to issue a token, and the external authority management server accordingly issues a token to the pseudonym identification information. Issue. At this time, the external authority management server stores information on the issued token in the token storage unit.
The user-side authority management server transmits the token issued by the external authority management server to the user terminal. The user can access the external resource by transmitting the token to the resource server at the user terminal.
The external authority management server that has received the token from the user terminal via the resource server can verify the validity of the token by comparing the received token with information on the token stored in the token storage unit.
Since the pseudonym identification information is different from the normal identification information used by the user to access resources managed by the authority management server, the user does not notify the external system of the normal identification information. Can access external resources.

  In the authority management method of the present invention, a user authority management server generates a pseudonym identification information, notifies the external authority management server of the pseudonym identification information, and issues a token that gives the user access to an unmanaged resource. A token issuance request step for requesting a token, a token issuance step in which the external authority management server generates a token and transmits it to the user side authority management server, and stores information on the token in the token storage unit, and a user side authority management server Token issuance step for sending tokens to user terminals used by users, and token transfer for sending tokens to transfer destination user terminals used by transfer destination users who transfer tokens from users to tokens A token use processing step in which the transfer destination user terminal sends the token to a resource server holding an external resource, Operates when the authority management server receives the token, and checks whether the token is issued to the user by the external authority management server by collating the received token with the information stored in the token storage unit The access authority to the external resource is managed by the token verification step for verifying the above (claim 11).

According to the above authority management method, the user authority management server requests the external authority management server to issue a token using the pseudonym identification information, and the external authority management server sends a token to the pseudonym identification information accordingly. Issue. At this time, the external authority management server stores information on the issued token in the token storage unit.
The user-side authority management server transmits the token issued by the external authority management server to the user terminal. The user can transfer the access right to the external resource to the transfer destination user by transmitting the token to the transfer destination user terminal using the user terminal. The transfer destination user can access the external resource by transmitting the token transferred to the resource server at the transfer destination user terminal.
The resource server that received the token from the transfer destination user terminal and the external authority management server that transferred the token from the resource server collate the received token with the information about the token stored in the token storage unit to verify the validity of the token. Can be verified.
Since the pseudonym identification information is different from the normal identification information used by the user to access resources managed by the authority management server, the user does not notify the external system of the normal identification information. The token is transferred to the transfer destination user, and the transfer destination user can access the external resource using the token.

  In the authority management program of the present invention, a user-side authority management server generates pseudonym identification information in a computer, transmits the pseudonym identification information to an external authority management server, and grants the user access rights to unmanaged resources. Token issuance request function that requests token issuance, token transmission function that external authority management server generates a token and sends it to the user authority management server, and stores information about the token in the token storage unit, and user authority management The server transmits a token to the user terminal that the user uses, the token transmission function that the user terminal transmits the token to the resource server that holds the external resource, and the external authority management server uses the token It is activated when the token is received, and the token is removed by comparing the received token with the information stored in the token storage unit. Managing access to external resources by executing a token verification function for verifying whether or not issued to the user by the authorization management server (claim 12).

According to the above authority management program, the user authority management server requests the external authority management server to issue a token using the pseudonym identification information, and the external authority management server sends a token to the pseudonym identification information accordingly. Issue. At this time, the external authority management server stores information on the issued token in the token storage unit.
The user-side authority management server transmits the token issued by the external authority management server to the user terminal. The user can access the external resource by transmitting the token to the resource server at the user terminal.
The external authority management server that has received the token from the user terminal via the resource server can verify the validity of the token by comparing the received token with information stored in the token storage unit.
Since the pseudonym identification information is different from the normal identification information used by the user to access resources managed by the authority management server, the user does not notify the external system of the normal identification information. Can access external resources.

  In the authority management program of the present invention, a user-side authority management server generates pseudonym identification information in a computer, notifies the external authority management server of the pseudonym identification information, and gives the user access rights to unmanaged resources. Token issuance request function for requesting token issuance, token issuance function for the external authority management server to generate a token and send it to the user authority management server, and store information about the token in the token storage unit, and user authority The management server sends a token to the user terminal used by the user, and the user terminal sends the token to the transfer destination user terminal used by the transferee user to whom the token is transferred from the user. A token transfer function, a transfer destination user terminal transmits a token to a resource server holding an external resource, and a token use processing function It operates when the external authority management server receives the token, and the token is issued to the user by the external authority management server by checking the received token against the information stored in the token storage unit. The access authority to the external resource is managed by executing the token verification function for verifying whether or not.

According to the authority management program, the user authority management server requests the external authority management server to issue a token using the pseudonym identification information, and the external authority management server sends a token to the pseudonym identification information accordingly. Issue. At this time, the external authority management server stores information on the issued token in the token storage unit.
The user-side authority management server transmits the token issued by the external authority management server to the user terminal. The user can transfer the access right to the external resource to the transfer destination user by transmitting the token to the transfer destination user terminal using the user terminal. The transfer destination user can access the external resource by transmitting the token transferred to the resource server at the transfer destination user terminal.
The resource server that received the token from the transfer destination user terminal and the external authority management server that transferred the token from the resource server verify the validity of the token by comparing the received token with the information stored in the token storage unit. be able to.
Since the pseudonym identification information is different from the normal identification information used by the user to access resources managed by the authority management server, the user does not notify the external system of the normal identification information. The token is transferred to the transfer destination user, and the transfer destination user can access the external resource using the token.

According to the present invention, the authority management server requests the external authority management server to issue a token using the kana identification information, and transmits the token issued for the kana identification information to the user terminal. The user can access an external resource using this token.
Since the pseudonym identification information is different from the normal identification information used by the user to access resources managed by the authority management server, the user does not notify the other systems of the normal identification information. Can access external resources.

The configuration and operation of the authority management system 70 according to an embodiment of the present invention will be described below with reference to the drawings.
FIG. 1 is a diagram showing the overall configuration of the authority management system 70.
The authority management system 70 includes a plurality of subsystems connected to the network 71 and under the management of different administrators. Although the number of subsystems constituting the authority management system 70 is not limited, FIG. 1 shows an example composed of three subsystems 1, 2, and 3 as an example.
The subsystem 1 includes one or more content servers 50a, one or more user terminals 30a that access the content server 50a, and one authority management server 10a that manages access authority to the content server 50a. It has. The authority management server 10a, the user terminal 30a, and the content server 50a are connected to, for example, a LAN and can communicate with each other.
The subsystem 2 and the subsystem 3 also have the same components as the subsystem 1.

  In the authority management system 70, the user terminal can access not only the content server of the subsystem to which the user terminal belongs, but also the content server of another subsystem. Further, the user terminal can transfer the access authority not only to other user terminals of the subsystem to which the user terminal belongs, but also to user terminals belonging to other subsystems. The authority management system 70 uses such a temporary user name for signature access key, signature verification key, and signature verification for access to content servers of other systems and transfer of access authority to user terminals of other systems. By using a key certificate, user information is prevented from leaking to other subsystems.

FIG. 2 is a diagram showing an outline of the operation of the authority management system 70.
The user terminal 30a (an example of a user terminal) of the subsystem 1 obtains a token for accessing a resource (an example of an external resource) held by the content server 50c (an example of a resource server) of the subsystem 3 of the subsystem 2. An example will be described in which a user terminal 30b (an example of a transfer destination user terminal) is transferred and the user terminal 30b accesses the content server 50c using the token.
The user terminal 30a makes a token issuance request to the authority management server 10a (an example of a user-side authority management server) in order to obtain authority to access the content server 50c (S101).
The authority management server 10a transmits a token issuance request to the authority management server 10c (an example of an external authority management server) that manages the access authority of the content server 50c (S102).
The authority management server 10c that has received the token issue request generates a token and transmits the token to the authority management server 10a (S103).
The authority management server 10a transmits the received token to the user terminal 30a (S104). At that time, the authority management server 10a also transmits to the user terminal 30a an issue certificate that proves that the token has been issued to the user terminal 30a.

The user terminal 30a transfers the token representing the authority to access the content server 50c received in S104 to the user terminal 30b (S105). At that time, the user terminal 30a generates a transfer certificate including information on the issued certificate using temporary user information different from the user information for authentication by the authority management server 10a, and the user terminal together with the token. To 30b.
The temporary user information is a temporary user name (an example of pseudonym identification information) for use in another system registered in advance in the authority management server of the system to which the user belongs and a signature generation key that is secretly managed by the user Point to. The user terminal 30a also registers the signature verification key of the temporary user name in advance in the authority management server 10a of the system to which the user terminal 30a belongs, and from the authority management server 10a the transfer public key certificate that is the certificate of the signature verification key. Certificate and token use public key certificate.

The user terminal 30b sends the token received from the user terminal 30a to the content server 50c and makes an access request. At that time, the user terminal 30b uses the temporary user information (an example of the transfer destination pseudonym identification information) different from the user information for authentication by the authority management server 10b (an example of the transfer destination authority management server). A usage certificate including the certificate information is generated and transmitted to the content server 50c (S106).
The content server 50c transmits the token and usage certificate received from the user terminal 30b to the authority management server 10c, and requests confirmation of access authority (S107).
The authority management server 10c transmits a usage certificate to the authority management server 10b, and requests user validity confirmation of the user terminal 20b included therein (S108).
The authority management server 10b transmits a transfer certificate to the authority management server 10a, and requests user validity confirmation of the user terminal 30a that is a transfer source of the token included therein (S109).
The authority management server 10a returns the result of the validity confirmation to the authority management server 10b (S110).
The authority management server 10b returns the result of the validity confirmation to the authority management server 10c (S111).
The authority management server 10c confirms the result of the validity confirmation from the authority management server 10b and the validity of the token, and returns the result to the content server 50c (S112).
The content server 50c determines whether or not to respond to the access request from the user terminal 30b based on the result of the authority confirmation from the authority management server 10c.

FIG. 3 is a functional block diagram illustrating the configuration of the authority management servers 10a, 10b, and 10c.
The authority management server 10a or the like is a server computer including a CPU (Central Processing Unit), for example, an input unit 11 such as a keyboard, an output unit 12 such as a display device, and a data communication unit 13 such as a LAN (Local Area Network) adapter. A data storage unit 15 such as a data processing unit 14 and a RAM (Random Access Memory).
The data processing unit 14 includes a token issuance request processing unit 16, a token issuance processing unit 17, an issuance certificate generation processing unit 18, a use token verification processing unit 19, a user validity confirmation requesting unit 20, a user validity confirmation unit 21, and an issuance certificate. User validity confirmation response means 22 for certificate verification, user validity confirmation response means 23 for transfer certificate verification, and access right confirmation response means 24.
Each means constituting the data processing unit 14 is realized by, for example, a CPU such as the authority management server 10a executing a computer program and controlling the hardware of the authority management server 10a.
The data storage unit 15 includes a user information storage unit 25, a signature generation key storage unit 26, a token storage unit 27, an encryption / decryption key storage unit 28, and a signature verification key storage unit 29.

  When the token issuance request processing unit 16 (an example of the token issuance request unit) receives a token issuance request from the user terminal via the data communication unit 13, the token issuance request processing unit 16 generates a pseudonym ID of the user and associates the pseudonym ID with the original ID. At the same time, it is stored in the user information storage unit 25, and a token issuance is requested to the authority management server of the subsystem to which the content server from which the access right is to be acquired from the data communication unit 13 belongs.

  When the token issuance processing unit 17 (an example of the token issuance unit) receives a token issuance request from another authority management server via the data communication unit 13, the token issuance processing unit 17 generates a signature of the authority management server from the signature generation key storage unit 26. The token 81 is issued and stored in the token storage unit 27 using the key for use. Then, the token is returned to the requesting authority management server via the data communication unit 13.

  When the issuance certificate generation processing unit 18 (an example of a token transmission unit) receives a token from another authority management server via the data communication unit 13, it generates the signature of the authority management server read from the signature generation key storage unit 26. An issuance certificate 82 is generated using the key for use. Then, the data communication unit 13 returns the issue certificate 82 and the token 81 to the user terminal.

  When the usage token verification processing unit 19 (an example of the token verification unit) receives the token 81 and the usage certificate 87 from the content server via the data communication unit 13, the usage token verification processing unit 19 refers to the token storage unit 27 and the received token is already used. Consistency check is performed to determine whether or not the received token is satisfied and whether the access authority information is satisfied.

When the user validity confirmation requesting unit 20 (an example of the verification requesting unit) receives the transfer certificate 83 when the token is transferred only once from the content or the server via the data communication unit 13, the user validity check requesting unit 20 stores the transfer certificate 83. The encrypted issue certificate part and the transfer source user name (kana ID) included are transmitted from the data communication unit 13 to the authority management server to which the transfer source user belongs.
When the transfer certificate 84 is received when the token is transferred twice or more from the content server via the data communication unit 13, the encrypted transfer certificate part included in the transfer certificate 84 and the transfer source user name (Kana ID) is transmitted from the data communication unit 13 to the authority management server to which the transfer source user belongs.
When the usage certificate 86 is received from the content server via the data communication unit 13, the encrypted issuance certificate part and usage user name (kana ID) included in the usage certificate 86 are sent from the data communication unit 13 to the content. Sent to the authority management server of the authority management system to which the user trying to access the server belongs.
When the usage certificate 87 is received from the content server via the data communication unit 13, the encrypted transfer certificate part and the usage user name (kana ID) included in the usage certificate 87 are received from the data communication unit 13. Sent to the authority management server of the authority management system to which the user trying to access the server belongs.

When the user validity checking means 21 receives the encrypted issuance certificate portion and the transfer source user name (kana ID) included in the transfer certificate 83 from another authority management server via the data communication unit 13, the user validity check means 21 The encrypted issuance certificate is decrypted using the decryption key known only by the authority management server read from the decryption key storage unit 28. The token request user name of the decrypted issue certificate and the received transfer source user name (kana ID) are compared, and the token request user name stored in the user information storage unit 25 and the received transfer source user name (kana ID) ) Are from the same user.
When the encrypted transfer certificate portion and transfer source user name (kana ID) included in the transfer certificate 84 are received from another authority management server via the data communication unit 13, the encryption / decryption key storage unit 28 receives the transfer source user name (kana ID). Using the decryption key known only by the read authority management server, the encrypted transfer certificate is decrypted. The destination user name (kana ID) of the decrypted transfer certificate is compared with the received transfer source user name (kana ID), and the token request user name stored in the user information storage unit 25 and the received transfer source user are compared. Check whether the first name (kana ID) belongs to the same user.
In addition, when the encrypted issuance certificate portion and usage user name (kana ID) included in the usage certificate 86 are received from another authority management server via the data communication unit 13, they are read from the encryption / decryption key storage unit 28. The encrypted issuance certificate is decrypted using the decryption key known only to the right management server. The token request user name of the decrypted issued certificate is compared with the received user name (kana ID), and the token request user name stored in the user information storage unit 25 and the received user name (kana ID) are Check if they are from the same user.
Further, when the encrypted transfer certificate part and the use user name (kana ID) included in the use certificate 87 are received from another authority management server via the data communication unit 13, they are read from the encryption / decryption key storage unit 28. The encrypted transfer certificate is decrypted using the decryption key known only to the authority management server. The transfer destination user name (kana ID) of the decrypted transfer certificate is compared with the received user name (kana ID), and the token request user name stored in the user information storage unit 25 and the received user name ( Check whether the pseudonym IDs belong to the same user.

  The user certificate check response means 22 for issuing certificate verification sends the user validity check result, the hash value of the token included in the issued certificate, and the pseudonym ID acquired from the user information storage unit 26 from the data communication unit 13 to the authority management server. Send to.

  When the user validity confirmation response means 23 of the transfer certificate verification receives the user validity confirmation result, the token hash value, and the pseudonym ID from another authority management server via the data communication unit 13, the user who has confirmed the user validity Is generated. Then, the kana ID of the user who has confirmed the user validity is added to the received validity check result of the user, the hash value of the token, and the kana ID, and the data communication unit 13 returns the result to the authority management server.

  When the access right confirmation response means 24 receives the user validity confirmation result, the hash value of the token included in the usage certificate, and the pseudonym ID from the other authority management server via the data communication unit 13, the token storage unit 27 Get a token from, and check whether it matches the hash value of the received token. The confirmation result is returned from the data communication unit 13 to the content server.

In the user information storage unit 25, a pseudonym ID issued to a user is stored in association with a normal user ID used to access resources in the subsystem.
The signature generation key storage unit 26 stores a key used for digitally signing a token and an issuance certificate.
The token storage unit 27 stores information on tokens issued by itself and tokens received from other authority management servers, resource servers, and user terminals.
The encryption / decryption key storage 28 includes a secret key for decrypting the encrypted issue certificate included in the transfer certificate and a secret key for decoding the encrypted transfer certificate included in the issue certificate. It is remembered.
The signature verification key storage unit 29 stores a user's public key for verifying the electronic signature attached to the transfer certificate and the usage certificate. This public key is generated corresponding to a pseudonym ID, not a normal user ID.

FIG. 4 is a functional block diagram illustrating the configuration of the user terminals 30a, 30b, and 30c.
The user terminal 30a or the like is a personal computer having a CPU, for example, and includes an input unit 31 such as a keyboard, an output unit 32 such as a display device, a data communication unit 33 such as a LAN adapter, a data processing unit 34, and a data storage such as a RAM. A portion 35 is provided.
The data processing unit 34 includes a token issuance request processing unit 36, an issuance token verification unit 37, an issuance certificate verification unit 38, a token transfer processing unit 39, a token transfer verification unit 40, a transfer certificate verification unit 41, and a token use processing unit 42. Consists of.
Each means constituting the data processing unit 34 is realized by, for example, a CPU such as the user terminal 30a executing a computer program and controlling the hardware of the user terminal 30a.

  The token issue request unit 36 acquires user information from the user information storage unit 43 and sends it to the data communication unit 33 together with token request information indicating the access authority of the content server input by the user via the input unit 31.

  When the issuance token verification unit 37 receives the token 81 from the authority management server via the data communication unit 33, the issuance token verification unit 37 uses the signature verification key of the authority management server acquired in advance from the signature verification key storage unit 44. The token 81 is verified. Then, the token is stored in the token storage unit 45.

  When the issuance certificate verification means 38 receives the issuance certificate 82 from the authority management server via the data communication unit 33, the issuance certificate verification means 38 uses the signature verification key of the authority management server acquired from the signature verification key storage unit 44 to issue The certificate 82 is verified and stored in the issued certificate storage unit 46.

  When the token transfer processing unit 39 (an example of the token transfer unit) receives the transfer destination user name (kana ID) and the transfer processing request input from the user via the input unit 31, the token transfer processing unit 39 receives the transfer processing request from the user information storage unit 43 in the other system. A transfer source user name (a pseudonym ID), which is a temporary user name for use, is acquired, and a transfer certificate is obtained using the signature generation key of the transfer source user (a pseudonym ID) read from the signature generation key storage unit 47 A token 83 to be transferred is acquired from the token storage unit 45, and is transmitted from the data communication unit 13 to the transfer destination user terminal together with the transfer certificate 83.

  When the token transfer verification unit 40 receives the token 81 transferred from another user terminal via the data communication unit 33, the token transfer verification unit 40 performs signature verification of the authority management server acquired in advance from the signature verification key storage unit 44. The token 81 is verified using the key. Then, the token is stored in the token storage unit 45.

  When the transfer certificate verification unit 41 receives the transfer certificate 83 from another user terminal via the data communication unit 33, the transfer certificate verification unit 41 uses the transfer public key acquired in advance from the signature verification key storage unit 44. The transfer certificate 83 is verified, and when the verification is passed, the transfer certificate 83 is stored in the transfer certificate storage unit 48.

  When the token usage processing means 42 receives the token usage processing request input by the user from the input unit 31, the token usage processing unit 42 uses the signature generation key of the token usage user (pseudonym ID) acquired from the signature generation key storage unit 47. A document 87 is generated, a token 81 to be used is acquired from the token storage unit 45, and transmitted from the data communication unit 33 to the content server together with the usage certificate 87.

The user information storage unit 43 stores a user ID and a pseudonym user ID of a user who uses the user terminal.
In the signature verification key storage unit 44, the public key of the authority management server that generated the token used for verifying the token, the public key of the user terminal that generated the transfer certificate used for verifying the transfer certificate, The public key of the authority management server that generated the issuance certificate used for verifying the issuance certificate is stored.
The token storage unit 45 stores a token received from the authority management server.
The issue certificate storage unit 46 stores the issue certificate of the token received from the authority management server.
The signature generation key storage unit 47 stores a user's private key used for applying a digital signature to the transfer certificate and the usage certificate. This secret key is generated for the pseudonym ID.
The transfer certificate storage unit 48 stores transfer certificates received from other user terminals.

FIG. 5 is a functional block diagram showing the configuration of the content servers 50a, 50b, and 50c.
The content server 50a or the like is a personal computer having a CPU, for example, and includes an input unit 51 such as a keyboard, an output unit 52 such as a display device, a data communication unit 53 such as a LAN adapter, a data processing unit 54, and a data storage such as a RAM. A portion 55 is provided.
The data processing unit 54 includes a usage token verification unit 56, a usage certificate verification unit 57, an access right confirmation request unit 58, and an access permission determination unit 59.
Each means constituting the data processing unit 54 is realized by, for example, a CPU such as the content server 50a executing a computer program and controlling the hardware of the content server 50a.
The data storage unit 55 includes a signature verification key storage unit 60 and a token storage unit 61.

  When the use token verification unit 56 (an example of the token verification unit) receives the token 81 from the user terminal via the data communication unit 53, the signature verification of the authority management server that issued the token acquired from the signature verification key storage unit 60 The token 81 is verified using the service key. Then, the token is stored in the token storage unit 61.

  When the usage certificate verification unit 57 receives the usage certificate 87 from the user terminal via the data communication unit 53, the usage certificate verification unit 57 transfers the usage certificate acquired in advance from the signature verification key storage unit 60. The use certificate 87 is verified using the public key.

  The access right confirmation request means 58 transmits the token 81 and the usage certificate 87 from the data communication unit 53 to the authority management server in the same subsystem, and requests verification of these data.

  When the access permission determination unit 59 receives the user validity check result and the token validity check result from the authority management server in the same subsystem via the data communication unit 53, the user access permission using the token is determined based on the result. To decide.

The signature verification key storage unit 60 stores the public key of the user who issued the usage certificate used to verify the usage certificate received from the user terminal.
The token storage unit 61 stores a token received from the user terminal.

Next, the data structure of main data used in the authority management system 70 will be described.
FIG. 9A shows an example data structure of the token 81.
The token 81 includes a token ID, a content server name, a token issuer authority management server name, access authority information, and an issuer authority management server digital signature.
FIG. 9B shows an example of the data structure of the issue certificate 82.
The issue certificate 82 includes a token hash value, a token request user name, an authority management server name of the issue certificate generator, and a digital signature of the authority management server of the issue certificate generator.

FIG. 10A shows an example of the data structure of the transfer certificate 83 when the first transfer is performed.
The transfer certificate 83 at the time of the first transfer is an issue certificate encrypted with the public key of the authority management server to which the transfer source user belongs, a transfer destination user name (a pseudonym ID), and a transfer source user name ( (Kana ID), the authority management server name to which the transfer source user belongs, and the digital signature of the transfer source user (kana ID).
FIG. 10B shows an example of the data structure of the transfer certificate 83 when the second and subsequent transfers are performed.
The transfer certificate 84 for the second and subsequent transfers is a transfer certificate encrypted with the public key of the authority management server to which the transfer source user belongs, a transfer destination user name (a pseudonym ID), and a transfer source user name. (A pseudonym ID), an authority management server name to which the transfer source user belongs, and a digital signature of the transfer source user (other system).
FIG. 10C shows an example of the data structure of the upper public key certificate 85.
The transfer public key certificate 85 includes a transfer public key, a transfer source user name (a pseudonym ID), an authority management server name, a validity period, and a digital signature of the authority management server to which the transfer source user belongs.

FIG. 11A shows an example of the data structure of the usage certificate 86 when it is used without being transferred.
When used without being transferred, the usage certificate 86 is an issuance certificate encrypted with the public key of the authority management server to which the token user belongs, the content server name, the user name (kana ID), and the user Of the authority management server to which the user belongs and the digital signature of the token user (other system).
FIG. 11B shows an example of the data structure of the usage certificate 87 when the transfer is performed once or more.
The usage certificate 87 when the transfer is performed once or more includes a transfer certificate encrypted with the public key of the authority management server to which the token user belongs, a content server name, a user name (a pseudonym ID), and a user Of the authority management server to which the user belongs and the digital signature of the token user (other system).
FIG. 11C shows an example of the data structure of the token use public key certificate 88.
The token use public key certificate 88 includes a token use public key, a use user name (a pseudonym ID), an authority management server name, a validity period, and a digital signature of the authority management server to which the token use user belongs.

Next, the operation of the authority management system 70 will be described with reference to FIGS. Here, as in FIG. 2, the user terminal 30a of the subsystem 1 transfers a token for accessing the content server 50c of the subsystem 3 to the user terminal 30b of the subsystem 2, and the user terminal 30b transfers the token. A case where the content server 50c is used to access will be described as an example.
FIG. 6 is a sequence diagram showing an operation in which the authority management server 10a issues a token for accessing the content server 50c in response to a request from the user terminal 30a.
The token issue request unit 36 of the user terminal 30a requests the authority management server 10a of the subsystem 1 to which the user terminal 30a belongs to issue a token representing the access authority of the content server 50c of another system (S121). This request includes user information acquired from the user information storage unit 43 and information specifying the requested access authority input by the user.

The token issuance request processing means 16 of the authority management server 10a generates a pseudonym ID so that the user information of the user who has requested the token issuance is not leaked to other systems (S122), and the authority management server 10c with the pseudonym ID. The token issuance request is transmitted to (S123).
This pseudonym ID is desirably updated by the authority management server 10a after a certain period of time has passed.

The token issuance processing means 17 of the authority management server 10c issues a token 81 with the pseudonym ID received from the authority management server 10a (S124), and the token ID, content server name, token issuer authority management server name, and access authority information. And the like are registered in a database managed by the authority management server 30c (S125).
Then, the token issuing unit 17 returns the generated token 81 to the authority management server 10a via the data communication unit 33 (S126).

  The issuance certificate generation processing means 18 of the authority management server 10a generates an issuance certificate 82 for the user terminal 30a that requested the issuance of the token (S127), and the token 81 and the issuance certificate received from the authority management server 10c. 82 is transmitted to the user terminal 30a via the data communication unit 13 (S128).

  When the data communication unit 33 of the user terminal 30a receives the token 81 and the issuance certificate 82, the issuance token verification unit 37 verifies the token 81 with the public key of the authority management server 10c, and the issuance certificate verification unit 38 The certificate 82 is verified with the public key of the authority management server 10a (S129). If the verification is successful, the issue token verification unit 37 and the issue certificate verification unit 38 store the token 81 and the issue certificate 82 in the data storage unit 35, respectively.

FIG. 7 is a sequence diagram showing an operation when the user terminal 30a transfers the token 81 representing the access right to the content server 50c to the user terminal 30b.
The token transfer processing means 39 of the user terminal 30a generates a transfer certificate 83 for transferring the token 81 to the user terminal 30b (S131), receives it from the authority management server 10a to the user terminal 30b, and stores it in the token storage unit 45. The token 81 and certificate 83 that have been registered are transmitted (S132).

When the data communication unit 33 of the user terminal 30b receives the token 81 and the transfer certificate 83, the token transfer verification unit 40 verifies the token 81 with the public key of the authority management server 10c, and the transfer certificate verification unit 41 The transfer certificate 83 is verified with the transfer public key of the user terminal 30a (S133).
Upon confirming that the verification has passed, the token transfer verification unit 40 and the transfer certificate verification unit 41 store the token 81 and the transfer certificate 83 in the storage unit 35, respectively (S134).

FIG. 8 is a sequence diagram illustrating an operation when the user terminal 30b accesses the content server 50c using the transferred token 81.
The token usage processing unit 42 of the user terminal 30b generates a usage certificate 87 for accessing the content server 50c (S141), and transmits the token 81 and the usage certificate 87 to the content server 50c (S142).

When the data communication unit 53 of the content server 50c receives the token 81 and the usage certificate 87, the usage token verification unit 56 verifies the token 81 with the public key of the authority management server 10c, and the usage certificate verification unit 57 The usage certificate 87 is verified with the token usage public key of the user terminal 30b (S143).
When the access right confirmation requesting means 58 of the content server 50c confirms that the two verifications have been passed, in order to make a request for confirming whether the transfer of the token 81 and the usage history are valid to the authority management server 10c. The token 81 and the usage certificate 87 are transmitted to the authority management server 10c (S144).

The usage token verification processing unit 19 of the authority management server 10c receives the token 81 and the usage certificate 87 via the data communication unit 13, and matches with a database such as whether the token has been used so far. A validity check is performed to confirm the validity of the token 81 (S145).
Further, the user validity check requesting unit 20 of the authority management server 10c inquires each authority management server 10b whether the transfer history and the user history are correct, and the encrypted transfer included in the usage certificate 87. The certificate and the user name (kana ID) are transmitted to the authority management server 10b (S146).

The user validity checking means 21 of the authority management server 10b receives the encrypted transfer certificate and the user name (kana ID) and uses a secret key that only the authority management server 10b knows the encrypted transfer certificate. Decrypt. The user validity checking means 21 checks whether or not the transfer destination user name and the use user name (pseudonym ID) of the decrypted transfer certificate 83 belong to the same user (S147).
When the user validity confirmation requesting unit 20 of the authority management server 10b confirms that the user is the same user, the authority management is performed on the encrypted issue certificate and the transfer source user name (kana ID) included in the transfer certificate 83. The data is transmitted to the server 10a (S148).

The user validity checking means 21 of the authority management server 10a receives the encrypted issuance certificate and the transfer source user name (a pseudonym ID), and the secret key that only the authority management server 10a knows the encrypted issuance certificate. Decrypt with. The user validity confirmation unit 21 confirms whether the token request user name and the transfer source user name (kana ID) of the decrypted issue certificate 82 belong to the same user (S149).
If it is confirmed that they are the same user, the user validity check response means 22 for verifying the issued certificate of the authority management server 10a stores the check result, the hash value of the token included in the issued certificate 82, and the issuance time. The pseudonym ID of the user who made the token issuing request is returned to the authority management server 10b (S150).

  Upon confirming that the confirmation result received from the authority management server 10a is acceptable, the user validity confirmation response means 23 for verifying the transfer certificate of the authority management server 10b generates a pseudonym ID of the user (S151). , The token hash value, the token issue requesting user's pseudonym ID, and the user's pseudonym ID are returned to the authority management server 10c (S152).

The access right confirmation response means 24 of the authority management server 10c receives the user's validity confirmation result, the hash value of the token included in the usage certificate, the token name requesting user's pseudonym ID, and the user's pseudonym ID. In order to confirm that the usage certificate 87 is a usage certificate for the token 81, it is verified that the hash value of the token is correct. In addition, in the event of any fraud, a pseudonym ID is stored in the database in order to track who has performed the fraud (S153).
The access right confirmation response means 24 returns the result of the user's validity confirmation and the token validity confirmation result to the content server 50c (S154).
The access permission determination unit 59 of the content server 50c receives the user validity check result and the token validity check result, and determines whether or not to permit an access request from the user terminal 30b (S155).

In the above operation example, in addition to the form in which the token transfer destination user terminal obtains the transfer source user's transfer public key certificate in advance and stores it in the signature verification key storage unit, the transfer source user terminal transfers The transfer public key certificate may be transmitted to the transfer destination user terminal together with the certificate.
Similarly, in addition to the form in which the content server prepares the token use public key certificate in advance, the user terminal that uses the token sends the token use public key certificate to the content server together with the use certificate. May be.

  Further, the content server 50c transmits the token 81 and the usage certificate 87 transmitted from the user terminal 30b to the authority management server 10c without verifying them, and the authority management server 10c verifies the token 81 and the usage certificate 87. You may do it. By doing so, the content server 50c does not need to store the signature verification key or token nor verify the token or usage certificate. Therefore, the configuration of the content server 50c can be simplified and the load on the content server 50c can be reduced.

The token can be transferred more than once. In this case, the user terminal that performs the second and subsequent transfers transmits the transfer certificate 84 of FIG. 10B to the transfer destination user terminal. The transfer certificate 84 is a transfer certificate acquired from the user terminal that is the transfer source of the encrypted token instead of the encrypted issue certificate of the transfer certificate 83 in FIG. Contains an encrypted issuance certificate).
Then, the user terminal using the token generates a usage certificate 87 and transmits it to the target content server.
The content server that has received the token and the usage certificate 87 sequentially requests certificate verification from the authority management server to which the user terminal that issued the transfer certificate or usage certificate belongs, in the same procedure as in FIG.

In the authority management system 70, a user terminal that has been issued a token can use the token itself without transferring it. Here, a case where the token acquired by the user terminal 30a is transmitted to the content server 50c to access the content server 50c will be described as an example. The operation until the user terminal 30a acquires a token is the same as that in FIG.
FIG. 12 is a sequence diagram showing the operation of the authority management system 70 in such a case.
The token usage processing unit 42 of the user terminal 30a generates a usage certificate 87 for accessing the content server 50c (S161), and transmits the token 81 and the usage certificate 87 to the content server 50c (S162).

When the data communication unit 53 of the content server 50c receives the token 81 and the usage certificate 87, the usage token verification unit 56 verifies the token 81 with the public key of the authority management server 10c, and the usage certificate verification unit 57 The usage certificate 87 is verified with the token usage public key of the user terminal 30a (S163).
When the access right confirmation requesting means 58 of the content server 50c confirms that the two verifications have been passed, in order to make a request for confirming whether the transfer of the token 81 and the usage history are valid to the authority management server 10c. The token 81 and the usage certificate 87 are transmitted to the authority management server 10c (S164).

The usage token verification processing unit 19 of the authority management server 10c receives the token 81 and the usage certificate 87 via the data communication unit 13, and matches with a database such as whether the token has been used so far. A validity check is performed to confirm the validity of the token 81 (S165).
Further, the user validity confirmation requesting unit 20 of the authority management server 10c uses the encrypted issuance certificate included in the usage certificate 87 to inquire each authority management server 10a whether the user history is correct. The user name (kana ID) used is transmitted to the authority management server 10a (S166).

The user validity checking means 21 of the authority management server 10a receives the encrypted issue certificate and the user name (kana ID) and uses a secret key that only the authority management server 10a knows the encrypted issue certificate. Decrypt. The user validity checking unit 21 checks whether or not the token request user name and the use user name (pseudonym ID) of the decrypted issue certificate 82 belong to the same user (S169).
If it is confirmed that they are the same user, the user validity check response means 22 for verifying the issued certificate of the authority management server 10a stores the check result, the hash value of the token included in the issued certificate 82, and the issuance time. The pseudonym ID of the user who made the token issuing request is returned to the authority management server 10c (S170).

The access right confirmation response means 24 of the authority management server 10c receives the user's validity confirmation result, the hash value of the token included in the usage certificate, the token name requesting user's pseudonym ID, and the user's pseudonym ID. In order to confirm that the usage certificate 87 is a usage certificate for the token 81, it is verified that the hash value of the token is correct. In addition, in the event that any fraudulent activity occurs, the pseudonym ID is stored in the database in order to track the person who has performed the fraudulent activity (S173).
The access right confirmation response unit 24 returns the result of the user's validity confirmation and the token validity confirmation result to the content server 50c (S174).
The access permission determination unit 59 of the content server 50c receives the user validity check result and the token validity check result, and determines whether to permit an access request from the user terminal 30a (S175).

  Here, since the data structure of the transfer certificate 83 when the first transfer is performed and the data structure of the use certificate 86 when used without transfer are essentially the same, either one of the certificates Can be substituted. Similarly, the transfer certificate 84 when the second and subsequent transfers are performed and the use certificate 87 when the transfer is performed one or more times can be unified and replaced with either one. Similarly, a transfer public key certificate and a token use public key certificate can be substituted.

Next, the effect of the authority transfer system 1 will be described.
The first effect is that an authority management server is used when a user belonging to each content server uses a content server of another system in an environment where there are a plurality of systems having an authority management server for managing access to the content server. It is possible to access the content server of the other system without leaking the user information managed in the above to the authority management server of the other system.
The reason is that when using another system, a usage certificate is generated using a pseudonym user name for use with another system and a signature generation key for use with another system, and the authority management server of the other system also uses it. You can see the usage certificate, but the user information included in the usage certificate and the user information included in the token public key certificate used for verification are temporary user names for use in other systems. For this reason, official user information is not leaked to the authority management server of another system. On the other hand, the validity of the usage certificate is verified by the authority management system to which the user belongs, and the result is notified to the authority management system on the side where the user is used, so that the user cannot use another person's token.
In addition, encryption with the public key of the authority management server that belongs to the transfer source user in the issued certificate is that the temporary user name used in other systems is more than 2 ahead as the transfer is repeated between users. This is to prevent the transfer destination user, that is, the next transfer destination user after the transfer destination user, and the authority management server of another system from being seen. If the transfer destination user after the second transfer or the authority management server of another system knows the temporary user name of the transfer source, it is easy to track who the token was transferred from.
Similarly, encrypting the transfer certificate with the public key of the authority management server that belongs to the transfer source user prevents the temporary user name from leaking to two or more transfer destination users or authority management servers of other systems. It is in.

The second effect is that even when access authority is transferred between users belonging to different systems, the transferred access authority can be used without leaking user information.
The reason is that when using another system, a transfer certificate is generated using a temporary user name for use in another system and a signature generation key for use in another system, and the authority management of the other system is performed. Although the transfer certificate can be viewed on the server, the user information included in the transfer certificate and the user information included in the transfer public key certificate used for verification are temporary users for use in other systems. Because it is a name, official user information is not leaked to the authority management server of other systems.

The third effect is that when a token is illegally used or illegally transferred, an unauthorized user can be traced.
The reason is that the verification of the validity of the transfer certificate is performed by the authority management system to which the user belongs, and the result is notified to the authority management system on the side where the user is used. Is used to notify the authority management system on the side where the user is used, and if any token is illegally used / assigned, it is possible to track the user who made the fraud by inquiring each authority management server for its pseudonym ID. I can do it.

1 is an overall view of an authority management system according to an embodiment of the present invention. It is a figure explaining the outline | summary of operation | movement of an authority transfer system. It is a functional block diagram of an authority management server. It is a functional block diagram of a user terminal. It is a functional block diagram of a content server. It is a sequence diagram which shows the token issuing operation | movement of an authority transfer system. It is a sequence diagram which shows the token transfer operation | movement of an authority transfer system. It is a sequence diagram which shows the token utilization operation | movement of an authority transfer system. FIG. 9A shows an example of the data structure of a token. FIG. 9B shows an example of the data structure of the issued certificate. FIG. 10A and FIG. 10B are diagrams showing examples of the data structure of the transfer certificate. FIG. 10C shows an example of the data structure of the transfer public key certificate. Fig.11 (a) and FIG.11 (b) are figures which show the example of a data structure of a utilization certificate. FIG. 11C is a diagram illustrating an example of the data structure of the token use public key certificate. It is a sequence diagram which shows the token utilization operation | movement of an authority management system.

Explanation of symbols

1, 2, 3 Subsystems 10a, 10b, 10c Authority management server 16 Token issuance request processing means 17 Token issuance processing means 18 Issuance certificate generation processing means 19 Use token verification means 20 User validity check request means 21 User validity confirmation Means 22 Issuance certificate verification user validity confirmation response means 23 Transfer certificate verification user validity confirmation response means 24 Access right confirmation response means 25 User information storage section 26 Signature generation key storage section 27 Token storage section 28 Encryption Decryption key storage unit 29 Signature verification key storage units 30a, 30b, 30c User terminal 36 Token issuance request unit 37 Issued token verification unit 38 Issued certificate verification unit 39 Token transfer processing unit 40 Token transfer verification unit 41 Transfer certificate verification unit 42 token use processing means 43 user information storage unit 44 Signature verification key storage unit 45 Token storage unit 46 Issuance certificate storage unit 47 Signature generation key storage unit 48 Transfer certificate storage units 50a, 50b, 50c Content server 56 Usage token verification unit 57 Usage certificate verification unit 58 Access right Confirmation request means 59 Access permission determination means 60 Signature verification key storage section 61 Token storage section 70 Authority management system

Claims (13)

In the authority management server that manages access rights to resources by users,
Used when the user accesses an external resource that is not managed by the authority management server, and generates pseudonym identification information that is different from the identification information used to access the resource managed by the authority management server, A token that transmits the pseudonym identification information to an external authority management server that manages the access authority of the external resource, and requests the user corresponding to the pseudonym identification information to issue a token that grants the access right to the external resource Issuance request means;
An authority management server, comprising: token transmission means for transmitting the token to a user terminal used by the user. The token transmission means has a function of generating an issuance certificate including information identifying the hash value of the token, the kana identification information, and the authority management server, and transmitting the issuance certificate to the user terminal,
It operates when the issued certificate encrypted with the public key of the authority management server and a usage certificate including the plaintext pseudonym identification information are received from the external authority management server, and the encrypted issuance certificate is Decrypting with the private key corresponding to the public key, determining whether the pseudonym identification information included in the encrypted issuance certificate and the plaintext kana identification information match, and the determination result is The authority management server according to claim 1, further comprising: a user validity verification unit that transmits to the external authority management server. The usage certificate is attached with a digital signature using a token usage signature key corresponding to the pseudonym identification information,
The token use public key certificate generating means for generating a token use public key certificate including the token use public key corresponding to the token use signature key and the pseudonym identification information is provided. Authority management server. A user-side authority management server that manages user access to external resources not under its control, an external limit management server that manages access authority to the external resources, a user terminal used by the user, and the external In an authority management system comprising a resource server that holds resources,
The user-side authority management server
Generating pseudonym identification information that is used when the user accesses the external resource and is different from the identification information used for accessing the resource under the management of the user-side authority management server; Token issuing request means for transmitting the pseudonym identification information and requesting the user to issue a token for granting access rights to the external resource;
Token transmitting means for transmitting the token to the user terminal;
The user terminal is
Token use processing means for transmitting the token to the resource server;
The external authority management server
A token issuing unit that generates the token and transmits the token to the user authority management server and stores information about the token in a token storage unit;
Either or both of the external authority management server and the resource server are activated when the token is received, and the token is verified by comparing the received token with information stored in the token storage unit. An authority management system comprising a token verification unit that verifies whether or not an external authority management server has issued the user. The token transmission means has a function of generating an issuance certificate including information identifying the hash value of the token, the pseudonym identification information, and the user-side authority management server, and transmitting the issuance certificate to the user terminal. ,
The token usage processing means has a function of generating a usage certificate including the issued certificate encrypted with the public key of the usage-side authority management server and the pseudonym identification information in plain text and transmitting the usage certificate to the resource server,
The external authority management server
Operates when the certificate and the token are received from the resource server, sends the usage certificate to the usage-side authority management server, and requests verification of the validity of the user who sent the usage certificate. A verification request means, and the user-side authority management server includes:
Operates when the usage certificate is received from the external authority management server, decrypts the encrypted issue certificate with a private key corresponding to the public key, and is included in the encrypted issue certificate Claims comprising: user validity verification means for determining whether or not the kana identification information matches the plaintext kana identification information and transmitting the determination result to the external authority management server. Item 5. The authority management system according to item 4. The usage certificate is attached with a digital signature using a token usage signature key corresponding to the pseudonym identification information,
The user-side authority management server
A token use public key certificate generating means for generating a token use public key certificate corresponding to the token use signature key and a token use public key certificate including the pseudonym identification information;
One or both of the external authority management server and the resource server are
And a usage certificate verifying unit that operates when the usage certificate is received, and that verifies the validity of the usage certificate using the token usage public key acquired from the token usage public key certificate. The authority management system according to claim 5, wherein A user-side authority management server that manages user access to external resources not under its own management, an external limit management server that manages access authority to the external resources, a user terminal used by the user, and A resource server that holds external resources, a transfer destination user terminal that is used by a transfer destination user who has been transferred access authority to the external resource by the user, and transfer destination authority management that manages the transfer destination user In a privilege management system with a server,
The user-side authority management server
Generating pseudonym identification information that is used when the user accesses the external resource and is different from the identification information used for accessing the resource under the management of the user-side authority management server; Token issuing request means for transmitting the pseudonym identification information and requesting the user to issue a token that grants the user access to the unmanaged resource;
Token transmitting means for transmitting the token to the user terminal;
The user terminal is
Token transfer means for transmitting the token to the transfer destination user terminal;
The transferee user terminal is
Token use processing means for transmitting the token to a resource server holding the external resource,
The external authority management server
A token issuing unit that generates the token and transmits the token to the user authority management server and stores information about the token in a token storage unit;
Either or both of the external authority management server and the resource server operate when the token is received, and the token is compared with the information stored in the token storage unit by comparing the received token with the information stored in the token storage unit. An authority management system comprising token verification means for verifying whether or not an authority management server has issued the user. The token transmission means has a function of generating an issuance certificate including information identifying the hash value of the token, the pseudonym identification information, and the user-side authority management server, and transmitting the issuance certificate to the user terminal. ,
The token transfer means generates a transfer certificate including the issued certificate encrypted with the public key of the user-side authority management server and the plaintext pseudonym identification information, and transmits the transfer certificate to the transfer destination user terminal With
The token use processing means is an identifier used for accessing the transfer certificate encrypted with the public key of the transfer destination authority management server and the resource under control of the transfer destination authority management server by the transfer destination user. A function of generating a usage certificate including plain text transferee user kana identification information different from the information and transmitting it to the resource server together with the token;
The external authority management server
Operates when the usage certificate and the token are received from the resource server, sends the usage certificate to the transferee authority management server, and requests verification of the validity of the user who sent the usage certificate A verification request means to
The transferee authority management server
Operates when the usage certificate is received from the external authority management server, decrypts the encrypted transfer certificate with a private key corresponding to the public key of the transferee authority management server, and User validity determination means for determining whether or not the transfer destination user kana identification information included in the transfer certificate matches the plain text transfer destination user kana identification information;
User validity verification requesting means for requesting verification of the validity of the user who transmitted the decrypted transfer certificate to the user-side authority management server and transmitted the transfer certificate;
A determination result by the user validity determination means, and a response means for transmitting a response from the user authority management server to the request by the user validity verification request means to the external authority management server,
The user-side authority management server
It operates when the transfer certificate is received from the transferee authority management server, and the encrypted issuance certificate is decrypted with a private key corresponding to the public key of the user authority management server and encrypted. A confirmation response means for determining whether or not the kana identification information included in the issued certificate matches the kana identification information of the plaintext and transmitting the determination result to the transferee authority management server. The authority management system according to claim 7, wherein: The transfer certificate is attached with a digital signature using a token transfer signing key corresponding to the pseudonym identification information,
The use certificate is attached with a digital signature using a token use signature key corresponding to the transferee user kana identification information,
The user-side authority management server
A token transfer public key certificate generating means for generating a token transfer public key certificate including the token transfer public key corresponding to the token transfer signature key and the pseudonym identification information;
The transferee authority management server
A token usage public key certificate generating means for generating a token usage public key certificate including the token usage public key corresponding to the token usage signature key and the transferee user pseudonym identification information;
A transfer certificate verifying unit that operates when receiving the transfer certificate, and that verifies the validity of the transfer certificate using the token transfer public key acquired from the token transfer public key certificate;
One or both of the external authority management server and the resource server are
And a usage certificate verifying unit that operates when the usage certificate is received, and that verifies the validity of the usage certificate using the token usage public key acquired from the token usage public key certificate. The authority management system according to claim 8, wherein the authority management system is characterized. A user-side authority management server that manages user access to external resources that are not under its own management uses resources that are managed by the user-side authority management server when the user accesses the external resources. Generating pseudonym identification information that is different from the identification information used for accessing, sending the pseudonym identification information to the external authority management server, and issuing a token that grants the user access rights to the unmanaged resources. Request token issue request step;
A token issuance step in which the external authority management server generates the token and transmits it to the user-side authority management server and stores information on the token in a token storage unit;
A token transmission step in which the user-side authority management server transmits the token to a user terminal used by the user;
A token use processing step in which the user terminal transmits the token to a resource server holding the external resource;
It operates when the external authority management server receives the token, and the token is verified to the user by the external authority management server by collating the received token with information stored in the token storage unit. An authority management method comprising a token verification step for verifying whether or not a certificate has been issued. A user-side authority management server that manages user access to external resources that are not under its own management uses resources that are managed by the user-side authority management server when the user accesses the external resources. Generating pseudonym identification information that is different from the identification information used for accessing, sending the pseudonym identification information to the external authority management server, and issuing a token that grants the user access rights to the unmanaged resources. Request token issue request step;
A token transmission step in which the external authority management server generates the token and transmits the token to the user-side authority management server and stores information on the token in a token storage unit;
A token transmission step in which the user-side authority management server transmits the token to a user terminal used by the user;
The user terminal is a token transfer step of transmitting the token to a transfer destination user terminal used by a transfer destination user to which the token is transferred from the user;
A token use processing step in which the transfer destination user terminal transmits the token to a resource server holding the external resource;
It operates when the external authority management server receives the token, and the token is verified to the user by the external authority management server by collating the received token with information stored in the token storage unit. An authority management method comprising: a token verification step for verifying whether or not the certificate has been issued. On the computer,
A user-side authority management server that manages user access to external resources that are not under its own management uses resources that are managed by the user-side authority management server when the user accesses the external resources. Generating pseudonym identification information that is different from the identification information used for accessing, sending the pseudonym identification information to the external authority management server, and issuing a token that grants the user access rights to the unmanaged resources. The requested token issue request function,
A token issuance function for the external authority management server to generate the token and send it to the user-side authority management server and store information about the token in a token storage unit;
The user-side authority management server transmits a token to a user terminal used by the user; a token transmission function;
A token use processing function in which the user terminal transmits the token to a resource server holding the external resource;
It operates when the external authority management server receives the token, and the token is verified to the user by the external authority management server by collating the received token with information stored in the token storage unit. An authority management program characterized by executing a token verification function for verifying whether or not it has been issued. On the computer,
A user-side authority management server that manages user access to external resources that are not under its own management uses resources that are managed by the user-side authority management server when the user accesses the external resources. Generating pseudonym identification information that is different from the identification information used for accessing, sending the pseudonym identification information to the external authority management server, and issuing a token that grants the user access rights to the unmanaged resources. The requested token issue request function,
The external authority management server generates the token and transmits it to the user-side authority management server, and stores the token-related information in a token storage unit;
The user-side authority management server transmits a token to a user terminal used by the user; a token transmission function;
The user terminal has a token transfer function for transmitting the token to a transfer destination user terminal used by a transfer destination user to which the token is transferred from the user;
The transfer destination user terminal transmits a token to a resource server holding the external resource, a token use processing function;
It operates when the external authority management server receives the token, and the token is verified to the user by the external authority management server by collating the received token with information stored in the token storage unit. An authority management program characterized by executing a token verification function for verifying whether or not it has been issued.

Images