JP2007272542A - Access controller, access control method and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent reduction of an overall security level in single sign-on. <P>SOLUTION: This access controller having a function providing the single sign-on has: an authentication level decision means determining an authentication level of user authentication for permitting the single sign-on when receiving access for the single sign-on from a user device, and selecting a service provision device having an authentication means corresponding to the determined authentication level; a proxy login means performing login requirement to the service provision device selected by the authentication level decision means as proxy of the user device; a reception means receiving a result of authentication processing performed to the user device according to the login requirement from the service provision device; and a means permitting the single sign-on by the user device when the result of the authentication processing is normal. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to single sign-on (SSO) in which a user can use a plurality of network services that require authentication by performing authentication processing such as ID and password input only once.

  Conventionally, in order for a user to receive various network services from a plurality of service providing apparatuses, the user has to authenticate each service providing apparatus. On the other hand, single sign-on that allows a user to receive services from a plurality of service providing apparatuses without performing authentication again once has been widely used.

  There are various single sign-on methods, and one of them is a method that is being standardized by the Liberty Alliance Project. In this method, single sign-on is realized by linking information relating to user authentication as an identity between a single sign-on providing device (referred to as an SSO providing device) and each service providing device. An example of the Liberty Alliance Project type single sign-on will be described with reference to FIG.

  In the example illustrated in FIG. 1, there are an SSO providing apparatus 10 that provides a single sign-on service, and service providing apparatuses 1 and 2 that provide various network services. Hereinafter, it is assumed that the user of the user terminal 20 has already been registered in each of the SSO providing apparatus 10 and the service providing apparatuses 1 and 2, and the user uses each authentication method (ID, password, etc.) for each apparatus. You can log in locally at Further, it is assumed that the SSO providing apparatus 10 and the service providing apparatuses 1 and 2 are connected in a trust relationship (referred to as “trust circle” in the Liberty Alliance Project).

  When the user uses single sign-on for the service providing apparatuses 1 and 2, the user first requests authentication for each of the service providing apparatuses 1 and 2, receives authentication by each service providing apparatus, Request to work together. As a result, identity linking is performed, and thereafter, single sign-on can be used.

  In order to use single sign-on, the user terminal 20 accesses the SSO providing apparatus 10 and performs authentication by inputting an ID and a password for the SSO providing apparatus 10 (initial authentication) (step 1).

  Thereafter, when the user terminal 20 uses the service of the service providing apparatus 1, when the user terminal 20 accesses the service providing apparatus 1 (step 2), the service providing apparatus 1 transmits an authentication request to the SSO providing apparatus 10 (step 2). 3). The authentication request can include an authentication level required by the service providing apparatus 1. Upon receiving this authentication request, the SSO providing apparatus 10 confirms that initial authentication for the user is performed and that the cooperation with the service providing apparatus 1 is performed, and provides authentication information (referred to as an authentication assertion). Issued to the service providing apparatus 1 (step 4).

The service providing apparatus 1 checks the authentication information, and if it is correct, provides the service to the user terminal 20. As a result, the user can use the service of the service providing apparatus 1 without re-entering the ID and password for the service providing apparatus 1. It should be noted that actual ID information is not exchanged between devices in the process of identity linkage and single sign-on, but identification information that can identify the user is exchanged only between the relying parties.
Further, transmission / reception of information related to authentication between the service providing apparatus and the SSO providing apparatus 10 may be performed via the user terminal 20 by redirection, but is simplified in FIG.

The Liberty Alliance project identity collaboration and single sign-on are described in detail in each document disclosed in Non-Patent Document 1. Patent Document 1 is a prior art document related to single sign-on.
Liberty Alliance Project, [online], [March 28, 2006 search], Internet: URL: http://www.projectliberty.org/jp/resources/index.html#Presentations JP 2004-355073 A

  In the above prior art, the service of each service providing apparatus can be used only by the initial authentication using the ID, password, etc. for the SSO providing apparatus 10, so that the overall security level becomes the security level of the initial authentication.

  In general, since single sign-on places importance on user convenience, the SSO providing apparatus 10 often adopts a simple authentication method such as an ID and a password. Therefore, even if some of the service providing devices adopt an authentication method (for example, IC card authentication) that is higher than the ID / password method, the security level when using single sign-on is in principle The service providing apparatus is of a lower level than when performing authentication locally. That is, the conventional single sign-on has a problem that the overall security level is lowered as long as a simple authentication method that emphasizes user convenience is employed.

  The present invention has been made in view of the above points, and an object of the present invention is to provide a technique for preventing a decrease in the overall security level in single sign-on.

  The above-described problem is an access control device having a function that allows a user device to access a network service by single sign-on. When an access for single sign-on is received from the user device, An authentication level determination unit that determines an authentication level of user authentication for permitting sign-on and selects a service providing apparatus including an authentication unit corresponding to the determined authentication level; and selected by the authentication level determination unit Proxy login means for making a login request to the service providing apparatus as a proxy for the user apparatus, and receiving means for receiving, from the service providing apparatus, a result of authentication processing performed on the user apparatus in response to the login request. If the result of the authentication process is normal, Can be solved by the access controller being characterized in that a means for permitting a sign-on.

  The authentication level determination means may select a service providing apparatus having the maximum authentication level among service providing apparatuses accessible by single sign-on.

  The access control apparatus holds authentication level corresponding data in which an authentication level for each service providing apparatus is recorded, and the authentication level determination unit selects the service providing apparatus by referring to the authentication level corresponding data. It is good as well. Further, the authentication level determination means may select a service providing apparatus corresponding to a preset authentication level.

  Further, the access control device includes means for transmitting the authentication level determined by the authentication level determination means to the user device, and when the user device designates another authentication level, the authentication level determination The means may select a service providing apparatus provided with an authentication means corresponding to the other authentication level.

  Further, when the access control apparatus receives a user authentication request from a service providing apparatus accessed by the user apparatus in a state where single sign-on is performed from the user apparatus, the access control apparatus performs authentication. By comparing the history of used authentication levels with the authentication level requested by the service providing apparatus, it may be possible to determine whether the user apparatus is permitted to access the service providing apparatus.

  Further, when the access control apparatus receives a user authentication request from a service providing apparatus that has received access from the user apparatus in a state where single sign-on is performed from the user apparatus, the access control apparatus performs authentication. Based on the history and the authentication condition of the service providing apparatus, whether or not the user apparatus can access the service providing apparatus may be determined.

  The present invention can also be configured as an access control method executed by the access control apparatus. The present invention can also be configured as a program for causing a computer to function as the access control device.

  According to the present invention, it is possible to prevent a decrease in the overall security level in single sign-on.

  Embodiments of the present invention will be described below with reference to the drawings. The overall configuration of the system in this embodiment is the same as that shown in FIG. Further, in the present embodiment, identity linkage and single sign-on schemes based on the Liberty Alliance project are premised, but the single sign-on scheme to which the present invention is applied is not limited to this.

  In the present embodiment, the SSO providing apparatus 10 holds an authentication level correspondence table as shown in FIG. This authentication level correspondence table records the authentication level for each service providing apparatus including the SSO providing apparatus 10. In the authentication level determination, the SSO providing device 10 is handled as one of the service providing devices. Authentication levels are defined in advance for authentication methods locally provided by each service providing apparatus, and recorded in the authentication level correspondence table accordingly. For example, ID password authentication: level 1, one-time password authentication: level 2, IC card authentication: level 3, biometric authentication: level 4, etc. are defined.

  Also, instead of registering the level size as shown in Fig. 2, authentication is performed as PW (ID password authentication) <OTPW (one-time password authentication) <ICC (IC card authentication) <BIO (biometric authentication) By defining the level relationship, the authentication method for each SSO providing device 10 and each service providing device may be recorded in the table. Hereinafter, description will be made assuming that an authentication level table in which levels as shown in FIG. 2 are described.

  In the present embodiment, when the SSO providing apparatus 10 receives access from the user terminal 20, the SSO providing apparatus 10 refers to the authentication level correspondence table and can provide a service that can provide a service to the user terminal 20 by single sign-on. Normal single sign-on when the user authentication processing by the service provider is normal when the service provider takes over the service provider with the maximum authentication level among the providers (including the SSO provider) In the same way as above, the user is permitted to use the service of each service providing apparatus.

  Next, the flow of processing in the present embodiment will be described with reference to FIG. In FIG. 3, the cooperation processing necessary for single sign-on has been completed for the user of the user terminal 20, and the service of each service providing apparatus can be used if authentication for single sign-on is successful. Shall. Further, it is assumed that the service providing apparatus 1 provides a home page of a portal site and displays an ID and password input column for logging in to the SSO providing apparatus 10.

  First, the user terminal 20 accesses the service provider device 1 and logs in to the SSO providing device 10 by inputting an ID and password for the SSO providing device 10 (step 11). The service providing apparatus 1 transmits the login information from the user terminal 20 to the SSO providing apparatus 10 to take over the process for single sign-on to the SSO providing apparatus 10 (step 12).

  The SSO providing apparatus 10 that has received the login information and has permitted the login by the user refers to the authentication level table shown in FIG. 2 and is the most authenticated among the service providing apparatuses that the user can access by single sign-on. A high level is selected (step 13). In the present embodiment, it is assumed that the authentication level of the service providing apparatus 2 is the maximum.

  The SSO providing device 10 logs in to the service providing device 2 obtained by the determination in step 13 instead of the user terminal 20 (step 14). In other words, proxy login is performed. In this proxy login, for example, user identification information given by identity cooperation can be used. The service providing apparatus 2 transmits an authentication request to the SSO providing apparatus 10 that is the login request source in the same manner as in a normal case (local login) other than single sign-on (step 15).

  This authentication request is for level 3 authentication as described in the authentication level table of FIG. This authentication request is sent from the SSO providing device 10 to the user terminal 20 (step 16), and the user performs processing for the requested authentication (for example, causing the IC card reader to read the IC card information (authentication information)). . Then, the authentication information is sent to the service providing apparatus 2 via the SSO providing apparatus 10 (Steps 17 and 18). The service providing apparatus 2 performs an authentication process using the received authentication information, and if authentication is OK, transmits information to that effect to the SSO providing apparatus 10 that is the proxy login source (step 19). Thereafter, the SSO providing apparatus 10 performs the same processing as when the initial authentication in the normal single sign-on is completed. For example, information indicating that authentication is OK is sent to the user terminal 20 to display an accessible service providing apparatus.

  FIG. 4 shows a processing flow when the authentication level of the SSO providing apparatus 10 is the maximum. In this case, single sign-on is possible based on ID and password authentication by the first SSO providing apparatus 10 without performing proxy login to any service providing apparatus.

  With the above method, it is possible to prevent the overall security level from being lowered when using single sign-on. When there are a plurality of devices corresponding to the determined authentication level, a priority order between the devices is determined in advance, and an authentication unit of a device having a higher priority in the authentication level is used. That's fine.

  FIG. 5 shows a functional configuration diagram of the SSO providing apparatus 10 in the present embodiment. As illustrated in FIG. 5, the SSO providing apparatus 10 according to the present embodiment includes an SSO providing unit 11, a level determination unit 12, a proxy login unit 13, a communication unit 14, and a setting information storage unit 15.

  The SSO providing unit 11 is a functional unit for realizing single sign-on, and has a function for realizing, for example, Liberty Alliance Project type identity linkage and single sign-on. Further, the SSO providing unit 11 includes a function of performing authentication by the authentication method of the SSO providing apparatus 10 itself. The level determination unit 12 has a function of determining which device authentication means is used by referring to the authentication level table stored in the setting information storage unit 15.

  The proxy login unit 13 logs in to the service providing device on behalf of the user when the level determining unit 12 determines that the authentication unit of the service providing device other than the SSO providing device 10 is used, and provides the service A function of transmitting an authentication processing request from the apparatus to the user terminal 20, transmitting authentication information from the user terminal 20 to the service providing apparatus, and notifying the SSO providing unit 11 of an authentication result from the service providing apparatus. Yes. When the authentication result from the proxy login unit 13 is normal, the SSO providing unit 11 allows access by single sign-on.

  The communication unit 14 has a function of performing data communication via a network, and the setting information storage unit 15 has a function of storing various setting information.

  The SSO providing apparatus 10 can be realized by mounting a program for executing the processing of each functional unit described above on a computer including a CPU, a storage device, and the like.

(Other examples of authentication level judgment methods)
The method for determining the authentication level is not limited to the method for selecting the authentication level having the maximum level as described above. For example, the following method can be employed.

  (1) If the authentication method of the maximum authentication level is always used for single sign-on, the user convenience may be reduced. Therefore, an authentication level that the user wants to use at normal times may be defined. In this case, the user notifies the SSO providing apparatus 10 in advance of the authentication level (for example, authentication level 2) desired to be used. The SSO providing apparatus 10 holds the user and “authentication level 2” in association with each other, and when accessing from the user, the apparatus of the level 2 authentication method is selected to perform proxy login. Note that if there are a plurality of level 2 authentication method apparatuses, a higher priority apparatus is selected.

  (2) In addition, the service provider who is the operator of each service providing apparatus indicates to which level the user is authenticated at what level or higher to permit access based on single sign-on to the SSO providing apparatus 10 It may be registered in advance.

  In this case, for example, in the determination of step 13 in FIG. 3, the authentication method of the maximum authentication level is selected from the authentication levels registered by the plurality of service providing apparatuses linked to perform proxy login. As a result, the service provider can perform access by performing authentication at an authentication level higher than the authentication level that can be provided by the service provider.

  (3) The operator of the SSO providing apparatus 10 may define an authentication level when providing single sign-on to the user and hold it in the SSO providing apparatus 10.

  If only one of the user, service provider, and SSO provider has the desired authentication level as described above, determine the authentication method according to the setting and perform authentication. Can do.

  In addition, when a plurality of parties register authentication levels, priorities are set in advance among users, service providers, and SSO providers, and the above (1) to (3) according to the desire of the person with the highest priority. It is good also as determining an authentication system by either of these.

  (4) Now, in some cases, such as when a user accesses a service using a mobile terminal from outside, high-level authentication such as IC card authentication may not be performed. Assuming such a case, the result of the level determination may be changed by a user operation. The processing flow in this case will be described with reference to FIG. In FIG. 6, the service providing apparatus 1 is not shown.

  In this case, when the determination result of the authentication level is higher than the authentication level of the SSO providing device 10, the determination result of the authentication level is returned to the user terminal 20 (step S33). For example, information indicating that authentication at level 2 is required is displayed on the screen of the user terminal 20. Information is also displayed on the screen for selecting other levels of authentication.

  If the result of level 2 is displayed but the user terminal 20 cannot perform the authentication process, the user selects level 1 on the screen and transmits it to the SSO providing apparatus 10 (step 34). The SSO providing device 10 selects a device that performs level 1 authentication (step 35) and performs authentication processing (step 36). Alternatively, since the authentication of level 1 is completed when accessing the SSO providing apparatus 10, it is possible to permit single sign-on access when it is determined that level 1 is selected.

(Access control function)
In the case of (1) and (4) among the above, there may be a service providing apparatus that does not allow service provision to a user who has performed single sign-on using a low-level authentication method. In this way, when the authentication level at the time of single sign-on requested by the service providing apparatus may be higher than the authentication level at the time of actual single sign-on, the SSO providing apparatus 10 is provided with an access control function. Is possible. The processing procedure in this case will be described with reference to FIG.

  FIG. 7 shows an operation after the initial authentication at the time of single sign-on from the user terminal 20 to the SSO providing apparatus 10 is completed. Further, it is assumed that the user terminal 20 uses the service of the service providing apparatus 2. Further, it is assumed that the authentication level at the time of single sign-on is level X, and the SSO providing apparatus 10 holds the information.

  The user terminal 20 accesses the service providing apparatus 2 in order to use a specific service in the service providing apparatus 2 (step 41). When the service providing apparatus 2 sets only the users who are authenticated at the level Y or higher as the users who provide the specific service, the service providing apparatus 2 authenticates the SSO providing apparatus 10 including the request authentication level (level Y). A request is transmitted (step 42). The SSO providing apparatus 10 compares the required authentication level (level Y) with the authentication level at the time of single sign-on (level X) (step S43), and the required authentication level is equal to or lower than the authentication level at the time of single sign-on (level Y). When ≦ level X), the user is permitted to use the specific service of the service providing apparatus 2 (step S44), and the service is provided.

  If the requested authentication level is higher than the authentication level at the time of single sign-on, the service providing apparatus 2 receives the authentication NG (step 45), and the service providing apparatus 2 itself performs level Y authentication for the user. (Step 46). Alternatively, the service may be rejected.

  In the above case, if the authentication by the service providing apparatus 2 itself is OK, the user has received the authentication of the level Y higher than the initial level X. Accordingly, the service providing apparatus 2 notifies the SSO providing apparatus 10 that the authentication in the service providing apparatus 2 for the user is OK (step 47), and the SSO providing apparatus 10 holds this information. Then, at the time of receiving an authentication request from each service providing apparatus thereafter, the level comparison at step 43 in FIG. 7 can be performed by regarding the authentication level at the time of single sign-on as level Y.

  As described above, when local authentication is performed by the linked service providing device, the SSO providing device 10 holds the history of the authentication level, the authentication method, the information of the service providing device, and the like. If level authentication is performed, then the possibility of performing local authentication processing decreases.

  There may be a service providing apparatus in which only a user who has been authenticated by a specific authentication method accepts access even at the same authentication level. For example, a certain service providing apparatus may provide a specific service only when authentication by the IC card of company B is performed in single sign-on. In this case, even if the authentication by the IC card of company A is performed as the authentication at the maximum authentication level in the initial authentication or authentication history by single sign-on, the service providing condition of the service providing apparatus is satisfied. Absent. In order to cope with such a case, the SSO providing apparatus 10 may be provided with a function for determining not only a comparison of authentication levels but also more complicated conditions.

  The processing flow in this case will be described with reference to FIG. As a premise of the processing in this case, the SSO providing apparatus 10 holds conditions as shown in FIG. 9 in advance. This condition can be described in an existing policy description language, and the SSO providing apparatus 10 determines access permission by interpreting the condition. Also in this case, the history of local authentication is managed in the same manner as described above. However, the authentication method information is recorded in more detail in the history.

  In FIG. 8, the user terminal 20 accesses the service providing apparatus 2 in order to use a specific service in the service providing apparatus 2 (step 51). The service providing apparatus 2 transmits an authentication request to the SSO providing apparatus 10 (step 52). The SSO providing device 10 interprets the conditions shown in FIG. 9 (step S53), and refers to the authentication history to determine whether or not authentication conforming to the conditions is performed (step 54). If authentication conforming to the conditions is performed, the user is permitted to use the specific service of the service providing apparatus 2 (step S55), and the service is provided.

  If the conditions are not met, the service providing apparatus 2 receives the authentication NG (step 56), and the service providing apparatus 2 itself performs IC card authentication for the user (step 57). Of course, the authentication level for each service providing apparatus may be simply described in the table shown in FIG. 9, and access may be permitted when authentication at or above the authentication level is performed.

  The present invention is not limited to the above-described embodiment, and various modifications and applications can be made within the scope of the claims.

It is a figure for demonstrating an example of the single sign-on of a Liberty Alliance project system. It is a figure which shows an authentication level corresponding table. It is a figure for demonstrating the flow of the process in embodiment of this invention. It is a figure which shows the flow of a process when the authentication level of the SSO provision apparatus 10 is the maximum. 2 is a functional configuration diagram of an SSO providing apparatus 10. FIG. It is a figure which shows the flow of a process in the case of changing the result of level determination by a user's operation. It is FIG. (1) which shows the flow of a process in the case of performing access control. It is FIG. (2) which shows the flow of a process in the case of performing access control. It is a figure which shows the example of the conditions which the SSO provision apparatus 10 hold | maintains.

Explanation of symbols

1, 2 Service providing device 20 User terminal 11 SSO providing unit 12 Level determining unit 13 Proxy login unit 14 Communication unit 15 Setting information storage unit

Claims (9)

An access control device having a function of allowing access to a network service by single sign-on for a user device,
A service providing apparatus including an authentication unit that determines an authentication level of user authentication for permitting single sign-on when an access for single sign-on is accepted from a user apparatus, and corresponds to the determined authentication level. An authentication level determination means to select;
Proxy login means for making a login request on behalf of the user apparatus to the service providing apparatus selected by the authentication level determination means;
Receiving means for receiving, from the service providing apparatus, a result of authentication processing performed on the user apparatus in response to the login request;
An access control apparatus comprising: means for permitting single sign-on by the user apparatus when the result of the authentication process is normal.   The access control apparatus according to claim 1, wherein the authentication level determination unit selects a service providing apparatus having a maximum authentication level among service providing apparatuses accessible by single sign-on.   The access control device holds authentication level correspondence data in which an authentication level for each service providing device is recorded, and the authentication level determination means selects the service providing device by referring to the authentication level correspondence data. The access control apparatus according to claim 1, wherein:   The access control apparatus according to claim 1, wherein the authentication level determination unit selects a service providing apparatus corresponding to a preset authentication level.   The access control device includes means for transmitting the authentication level determined by the authentication level determination means to the user device, and when the user device designates another authentication level, the authentication level determination means 2. The access control apparatus according to claim 1, wherein a service providing apparatus provided with authentication means corresponding to the different authentication level is selected.   When the access control apparatus receives a user authentication request from a service providing apparatus that has received access from the user apparatus in a state where single sign-on is performed from the user apparatus, the access control apparatus is used for authentication. The access authorization of the user device to the service providing device is determined by comparing the history of the authentication level and the authentication level requested by the service providing device. The access control apparatus according to claim 1.   When the access control apparatus receives a user authentication request from a service providing apparatus that has received access from the user apparatus in a state where single sign-on has been performed from the user apparatus, the access control apparatus 6. The access control apparatus according to claim 1, wherein access permission / rejection of the user apparatus for the service providing apparatus is determined based on an authentication condition of the service providing apparatus. An access control method executed by an access control device having a function of allowing access to a network service by single sign-on for a user device,
A service providing apparatus including an authentication unit that determines an authentication level of user authentication for permitting single sign-on when an access for single sign-on is accepted from a user apparatus, and corresponds to the determined authentication level. An authentication level determination step to be selected; and
A proxy login step for making a login request on behalf of the user device to the service providing device selected in the authentication level determination step;
Receiving from the service providing device a result of authentication processing performed on the user device in response to the login request;
An access control method comprising: permitting single sign-on by the user apparatus when a result of the authentication process is normal. A program for causing a computer to function as an access control device having a function of allowing a user device to access a network service by single sign-on,
A service providing apparatus including an authentication unit that determines an authentication level of user authentication for permitting single sign-on when an access for single sign-on is accepted from a user apparatus, and corresponds to the determined authentication level. Authentication level determination means to be selected,
Proxy login means for making a login request on behalf of the user apparatus to the service providing apparatus selected by the authentication level determination means;
Receiving means for receiving, from the service providing apparatus, a result of authentication processing performed on the user apparatus in response to the login request;
Means for allowing single sign-on by the user device when the result of the authentication process is normal;
Program to function as.

Images