JP2008033638A - Registered information management system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a registered information management system facilitating batch processing for information registered in a plurality of sites. <P>SOLUTION: The registered information management system is provided with; a means for receiving processing request information for requesting processing for a plurality of registered attribute information files having the same person's attribute information registered in the plurality of sites on a network; a means for creating a batch processing message for requesting batch processing for the plurality of registered attribute information files based on the received processing request information; a means for creating a plurality of individual processing messages for requesting processing for each of the plurality of registered attribute information files based on the created batch processing message; and a means for transmitting the plurality of created individual processing messages to the plurality of sites. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a registration information management system for managing registration information on a network.

  In an electronic service, attribute information (identity) such as a user account, address, name, telephone number, and age of the user of the service may be registered. For example, when shopping using a certain portal site, a user (user, hereinafter referred to as “principal”) needs to register an identity on the portal site. When using multiple services, a principal typically registers with multiple services, and each service manages the life cycle of the identity.

  Recently, network identity technology that enables cross-referencing of identities distributed across a network is being established. This makes it possible to utilize highly reliable identities while ensuring interoperability of distributed identities. Identity cross-reference makes it easier to provide services that are more suitable for principals.

For example, in the Liberty Alliance specification established by the Liberty Alliance Project, Liberty ID-WSF Discovery Service Specification (hereinafter referred to as Discovery Service) and identity information acquisition / correction are used as service specifications for identity resource resolution. Liberty ID-WSF Data Services Template Specification (hereinafter referred to as DST) as a template specification for data services to be performed, and ID-SIS Personal Profile Service Specification (as a specific identity service specification published on Liberty ID-WSF) (Hereinafter referred to as ID-SIS-PP) and the like are disclosed (see Non-Patent Documents 1 to 3).
Liberty Alliance Project, “Liberty ID-WSF Discovery Service Specification, Version 1.1”, [online], November 12, 2003, [searched December 24, 2004], Internet <URL: http: //www.projectliberty .org / specs / liberty-idwsf-disco-svc-v1.1.pdf> Liberty Alliance Project, “Liberty ID-WSF Data Services Template Specification, Version 1.0”, [online], November 12, 2003, [searched December 24, 2004], Internet <URL: http: // www. projectliberty.org/specs/liberty-idwsf-dst-v1.0.pdf> Liberty Alliance Project, “Liberty ID-SIS Personal Profile Service Specification, Version 1.0”, [online], November 12, 2003, [searched December 24, 2004], Internet <URL: http: // www. projectliberty.org/specs/liberty-idsis-pp-v1.0.pdf>

  However, it is not always easy for the identity owner (principal) to manage all the identities managed in a distributed manner. For example, if a principal registers his / her identity with various services, he / she needs to maintain his / her identity information himself / herself. However, maintaining individual identities managed in multiple locations is a burden on the principal. For example, when the principal's address is changed, the service in which the address information is registered must be found and the address information must be corrected from the identity information managed by each service.

  An object of the present invention is to provide a registered information management system that facilitates batch processing of information registered in a plurality of sites.

  The registered information management system according to one aspect of the present invention receives processing request information for requesting processing to a plurality of registered attribute information files that are respectively registered at a plurality of sites on the network and have the same individual attribute information. Processing request information receiving means, batch processing message generating means for generating batch processing messages for requesting batch processing to the plurality of registered attribute information files based on the received processing request information, and the batch generated Based on the processing message, individual processing message generating means for generating a plurality of individual processing messages for requesting processing to each of the plurality of registered attribute information files, and transmitting the generated plurality of individual processing messages to the plurality of sites And an individual processing message transmitting means.

  According to the present invention, it is possible to provide a registered information management system that facilitates batch processing of information registered in a plurality of sites.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
(First embodiment)
FIG. 1 is a block diagram showing a registration information management system 100 according to the first embodiment of the present invention.
The registration information management system 100 includes a principal computer 110, a portal site server 120, an attribute provider server 130, and a resource information search provider server 140.

  The registration information management system 100 is a Facade Data Service (hereinafter referred to as FDS) that collectively processes data operations such as structure information and attribute information of resources managed by a plurality of attribute provider servers 130 corresponding to different domains. I will provide a. Processing such as acquisition and correction, which has been performed individually for each attribute provider server 130, can be executed in a batch.

  In the present embodiment, the main body that provides the FDS is the portal site server 120. In a second embodiment to be described later, an FDS is provided by cooperation between a portal site server and an FDS server, and the FDS server functions as a principal agent. In the present embodiment, since the principal itself is the subject of batch processing, authentication processing is not included.

  An example of an FDS is an identity service (Facade Query and Modify Service (hereinafter referred to as FQMS)) that performs batch processing of principal (electronic service user) attribute information (identity).

The principal attribute is personal information such as the principal's user account, address, name, telephone number, and age registered on the electronic service. In an electronic service, the attributes of each principal are registered in a file called a resource (registered attribute information file). That is, resources exist corresponding to each principal.
Resource information includes all information related to resources, including principal resource structure information and location information (location information).

  The principal computer 110 is a computer operated by the principal (service user). The principal computer 110 includes input means for requesting a list of attribute information of the principal, for example, a keyboard, and a display unit for displaying a list of attribute information of the principal in response to the request, for example, a liquid crystal display device.

  The portal site server 120 is a computer connected to the principal computer 110 via a network (for example, the Internet), and is disposed at a portal site on the Internet, for example. The portal site server 120 includes a batch processing message generation unit 121, a message batch processing unit 122, a resource resolution unit 123, and an application 124.

The batch processing message generation unit 121 and the message batch processing unit 122 are responsible for batch processing of attribute information as a proxy of the application 124 and can be constructed using a library of the portal site server 120.
The batch processing message generation unit 121 generates a batch processing message used when batch processing (acquisition or correction) of attribute information managed by the attribute provider server 130.

The message batch processing unit 122 includes a batch processing message interpretation unit 125 and a batch proxy processing unit 126.
The batch processing message interpretation unit 125 interprets the batch processing message.
The collective proxy processing unit 126 makes a processing request to the attribute provider server 130 that provides the attribute information, collects the results, and returns the result to the application 124. The collective proxy processing unit 126 functions as an individual processing message generation unit that generates an individual processing message and an individual processing message transmission unit that transmits an individual processing message to the plurality of sites.

The resource resolution unit 123 resolves resources and provides principal resource location information, and functions as an extraction unit that extracts attribute items included in a copy of the registered attribute information file. In other words, the resource solution here is to extract the item of the principal attribute.
The resource resolution unit 123 sends a principal identifier for identifying the principal to the resource information search provider server 140, requests a search for resource information search, and receives resource information (including resource location information). The resource resolution unit 123 analyzes the resource information, and extracts attribute items included in the resource information.

  The source resolution unit 123 has a database (resource structure definition DB) that holds a resource structure definition table including resource structure definition information that defines the structure of resource information (registered attribute information file). The source resolution unit 123 extracts attribute items from the resource information using the resource structure definition table. An example of resource structure definition is <ResourceOffering> in Discovery Service.

  For resource information whose structure is not defined in the resource structure definition table, attribute items are extracted using the resource structure definition information acquired from the attribute provider server 130. When the structure definition information of the acquired resource information is not stored in the resource structure definition DB, the source resolution unit 123 requests the attribute provider server 130 to search the structure of the resource information and acquires the resource structure definition information. To do.

  The application 124 serves as a user interface with the principal computer 110, sends a request to the resource resolution unit 123 to perform batch processing of attribute information, and provides the result to the principal computer 110. The application 124 functions as a presenting means for presenting extracted attribute items and a processing request information receiving means for receiving processing request information.

  The attribute provider server 130 is a computer connected to the portal site server 120 via a network (for example, the Internet), and corresponds to an attribute provider that manages principal attribute information. The attribute provider server 130 includes an attribute information providing unit 131 that provides attribute information in response to a request.

  The resource information search provider server 140 is a computer connected to the portal site server 120 via a network (for example, the Internet), and manages resource information owned by the principal. The resource information search provider server 140 includes a resource information search unit 141 that searches for resource information in response to a request.

  The resource information search unit 141 has a database (resource information DB). The resource information DB retains the principal identifier and the principal resource information (including the address (resource location information) of the attribute provider server 130 in which the principal attribute information is registered). That is, the resource information DB functions as a storage unit that stores a principal (individual) and a copy of the resource (registered attribute information file) correspondingly.

  When the resource information search unit 141 searches the resource information database based on the principal identifier, the resource information and resource location information of the principal can be obtained. A combination of resource information and resource location information exists for each electronic service in which the principal attribute information is registered.

  The attribute information included in the resource information is not essentially different from the attribute information registered in the attribute provider server 130. However, the attribute information on the attribute provider server 130 is the registered attribute information (registered attribute information) itself, whereas the attribute information on the resource information database is a copy of the registered attribute information (copy attribute information). ).

For this reason, the resource information on the resource information database may conflict with the registered resource information (a change to the registered resource information is not necessarily guaranteed to be reflected in the copy registration information). Conversely, changing the copy registration information does not change the registered resource information.
As described above, the resource information on the resource information database is an accumulation of copies (copy resource information) of registered resource information (registered resource information) for the convenience of the principal.

(Operation of Registration Information Management System 100)
FIG. 2 is a sequence diagram showing an outline of the processing flow in the registration information management system 100. FIG. 3 is a sequence diagram showing details of the processing flow in the registration information management system 100. 4 to 6 are diagrams showing examples of screens displayed on the principal computer 110. FIG. FIG. 7 is a diagram illustrating an example of a message structure for collectively acquiring attribute information.

The flow of processing is as follows.
(1) Resource information search request 1) The principal computer 110 accesses the portal site server 120.
At this time, the portal site server 120 can recognize the principal by transmitting a principal identifier from the principal computer 110 or the like.

2) The portal site server 120 displays a resource information search screen on the principal computer 110 (see FIG. 4).
Since the portal site server 120 recognizes the principal, “Welcome, Mr. XX” is displayed on the screen of the principal computer 110 as shown in FIG.

3) The principal computer 110 requests the portal site server 120 to search for resource information.
The principal inputs or selects information (search request information) for requesting search for resource information from the resource information search screen (see FIG. 4). Search request information for searching for the input / selected resource information is sent from the principal computer 110 to the portal site server 120.
Here, as shown in FIG. 4, it is considered that the principal requests to search for resource information by selecting “name” and “address” as search items as attribute information and pressing a “search” button. .

(2) Resource information search 1) When the portal site server 120 receives the search request information, the application 124 generates an instance of the resource resolution unit 123.
2) The application 124 sends a principal identifier to the resource resolution unit 123 and requests a search for resource information of the principal.

  3) The resource resolution unit 123 sends a principal identifier to the resource information search provider server 140 and requests a search for the resource information of the principal. That is, it requests acquisition of the address (resource location information) and resource information of the attribute provider server 130 in which the principal attribute is registered.

4) The resource information search provider server 140 returns the resource information and the resource location information to the resource resolution unit 123.
The resource information search unit 141 searches the resource information database for resource information and resource location information corresponding to the principal, and returns the resource information to the resource resolution unit 123.

(3) Analysis of resource information 1) The resource resolution unit 123 analyzes resource information and extracts attribute items included in the resource. When the structure information of the resource is held in the resource structure definition DB of the resource resolution unit 123 (for example, in the case of a resource using a standard schema such as ID-SIS-PP), the resource resolution unit 123 Analyzing the resource structure, you can extract the attribute items included in the resource.
Here, the attribute information of the principal is registered in the attribute providers (1) to (3) (attribute provider servers 130 (1) to 130 (3)), and the attribute items are “name” and “address”. And That is, three sets of resource information and resource location information corresponding to the attribute providers (1) to (3) are acquired, and attribute items “name” and “address” are extracted from the resource information.

  2) When the resource cannot be resolved, the resource resolution unit 123 acquires the resource structure information from the attribute provider server 130. Based on the acquired structural information, the attribute item included in the resource is extracted.

(4) Attribute Information Batch Acquisition Request 1) The application 124 displays a resource information display screen for displaying a list of resource information on the principal computer 110 (see FIG. 5).
As shown in the figure, the attribute providers (1) to (3) corresponding to the three resource location information and the attribute items “name” and “address” are displayed correspondingly.

  2) The principal computer 110 designates attribute information to the portal site server 120 and requests the batch acquisition thereof. That is, collective acquisition request information (information requesting collective acquisition processing of attribute information selected by the principal from the list) is sent from the principal computer 110 to the portal site server 120.

(5) Generation of attribute information batch acquisition message 1) When portal site server 120 receives batch acquisition request information, application 124 generates an instance of batch processing message generation unit 121.
2) Upon receiving the request, the batch processing message generator 121 generates a batch acquisition message and returns it to the application 124 (see FIG. 7).

FIG. 7 schematically shows the structure of an FDS Query message (hereinafter referred to as FDSQuery), which is a message for performing batch acquisition of attribute information.
The description part D10 represents the entire FDSQuery message, and the description part D11 represents details of a part of the description part D10.
The description part D11 is a message generated by the batch processing message generation part 121. The description part D11 is the basis of a message for batch acquisition, and is prepared for extending the DExt <Extension> element of a Query message defined in the DST (hereinafter referred to as a DSTQuery message). Element) and the resource information that is the target of batch acquisition is included. As resource information, a <ResourceOffering> element (element for providing resource information) defined in the Discovery Service is used.

(6) Batch acquisition of attribute information 1) The application 124 requests the batch processing of the message batch processing unit 122.
2) The message batch processing unit 122 uses the batch processing message interpretation unit 125 to interpret the batch processing message.

  3) The collective proxy processing unit 126 of the message batch processing unit 122 generates and transmits an attribute request message to each of the attribute information providing units 131 (1) and 131 (2). The attribute information providing units 131 (1) and 131 (2) return attribute information in response to the attribute request message. As a result, the message batch processing unit 122 acquires attribute information from each of the attribute information providing units 131 (1) and 131 (2).

(7) Batch display of attribute information 1) The batch processing message interpretation unit 125 of the message batch processing unit 122 collects attribute information acquired from each attribute provider server 130 into a response message.
2) The batch processing message interpretation unit 125 of the message batch processing unit 122 sends attribute information to the application 124 as a response to the batch processing.

3) The application 124 receives the attribute information and displays a list of attribute information on the principal computer 110 (see FIG. 6).
The attribute items “name” and “address” registered in the attribute providers (1) and (2) are displayed. As a result, the principal can confirm the registration status of “name” and “address” in each of the attribute providers (1) and (2).

By using the registered information management system 100, maintenance of principal identities (attribute information) managed in a distributed manner on different domains is facilitated. That is, the identity reference can be executed collectively. By processing in a lump, the amount of data required for processing can be reduced compared to the case of individual processing.
Note that general processing such as changing or deleting attribute information other than referring to attribute information can also be executed in a batch.

(Second Embodiment)
FIG. 8 is a block diagram showing a registration information management system 200 according to the second embodiment of the present invention.
The registration information management system 200 provides an FQMS, and includes a principal computer 210, a portal site server 220, an attribute provider server 230, a resource information search provider server 240, an FDS server 250, and an authority server 260.

  In the present embodiment, FDS is provided by cooperation between the portal site server 220 and the FDS server 250, and the FDS server functions as a principal agent. In addition, an authentication process is performed to ensure the reliability of the process by the agent, and the authority server 260 plays a central role.

  The principal computer 210 is a computer operated by the principal (service user). The principal computer 210 includes input means for requesting a list of attribute information of the principal, for example, a keyboard, and a display unit for displaying a list of attribute information of the principal in response to the request, for example, a liquid crystal display device.

  The portal site server 220 is a computer connected to the principal computer 210 via a network (for example, the Internet), and is disposed at a portal site on the Internet, for example. The portal site server 220 includes a batch processing message generation unit 221, a message batch processing unit 222, a resource resolution unit 223, and an application 224.

The batch processing message generation unit 221 and the message batch processing unit 222 are responsible for batch processing of attribute information as a proxy of the application 224, and can be constructed using the library of the portal site server 220.
The batch processing message generation unit 221 generates a batch processing message used when batch processing (acquisition or correction) of attribute information managed by the attribute provider server 230.

The message batch processing unit 222 includes a batch processing message transmission unit 227.
The batch processing message transmission unit 227 transmits the batch processing message generated by the batch processing message generation unit 221 to the FDS server 250.

The resource resolution unit 123 resolves resources and provides principal resource location information, and functions as an extraction unit that extracts attribute items included in a copy of the registered attribute information file. In other words, the resource solution here is to extract the item of the principal attribute.
The resource resolution unit 123 sends a principal identifier for identifying the principal to the resource information search provider server 140, requests a search for resource information search, and receives resource information (including resource location information). The resource resolution unit 123 analyzes the resource information, and extracts attribute items included in the resource information.

  The source resolution unit 223 has a database (resource structure definition DB) that holds a resource structure definition table including resource structure definition information that defines the structure of resource information (registered attribute information file). The source resolution unit 223 extracts attribute items from the resource information using the resource structure definition table. An example of resource structure definition is <ResourceOffering> in Discovery Service.

  For resource information whose structure is not defined in the resource structure definition table, attribute items are extracted using the resource structure definition information acquired from the attribute provider server 230. When the structure definition information of the acquired resource information is not stored in the resource structure definition DB, the source resolution unit 223 requests the attribute provider server 230 to search the structure of the resource information and acquires the resource structure definition information. To do.

The application 224 serves as a user interface with the principal computer 210, sends a request to the resource resolution unit 223 to perform batch processing of attribute information, and provides the result to the principal computer 210. The application 224 functions as a presenting means for presenting extracted attribute items and a processing request information receiving means for receiving processing request information.
The application 224 requests authority delegation information for delegating the authority to process resource operations to the authority server 260. The application 224 transmits the authority delegation information received from the authority server 260 to the FDS server 250.

  The FDS server 250 can prove to the attribute provider server 230 that it is a legitimate agent of the subject by the authority delegation information. Further, the attribute provider server 230 can confirm that the request source of the resource operation is the principal from the reliability information based on the authority transfer information.

  The attribute provider server 230 has an attribute information providing unit 231. The attribute provider server 230 requests reliability information from the authority server 260, verifies it, and then performs attribute processing.

The resource information search provider server 240 manages resource information owned by the principal, and has a resource information search unit 241 that searches for resource information in response to a request.
The resource information search unit 241 has a database (resource information DB). The resource information DB retains a principal identifier and principal resource information (including the address (resource location information) of the attribute provider server 230 in which the principal attribute information is registered). That is, the resource information DB functions as a storage unit that stores a principal (individual) and a copy of the resource (registered attribute information file) correspondingly.

The FDS server 250 includes a message batch processing unit 251.
The message batch processing unit 251 includes a batch processing message interpretation unit 252 and a batch proxy processing unit 253.

  The batch processing message interpreting unit 252 performs batch processing of attribute information as a proxy for the subject, and interprets the batch processing message. Further, when receiving the batch processing message, the batch processing message interpretation unit 252 requests authority delegation information from the portal site server 220. The batch processing message interpretation unit 252 functions as a delegation request message transmission unit that transmits a delegation request message and a delegation permission message reception unit that receives a delegation permission message.

The collective proxy processing unit 253 requests the attribute provider server 230 that provides the attribute information to acquire attribute information on behalf of the attribute, and returns the result to the application 224 as one. The collective proxy processing unit 253 functions as an individual processing message generation unit that generates an individual processing message and an individual processing message transmission unit that transmits an individual processing message to the plurality of sites.
The collective proxy processing unit 253 includes authority delegation information in a message requesting attribute information from the attribute provider server 230. This is to prove his credibility, that is, he is a legitimate representative of the subject.

The authority server 260 stores the principal's identity information and authenticates the subject. The authority server 260 is managed by, for example, a third party organization.
The authority server 260 sends the authority delegation request message (authorization subject (FDS server 250), authorization target operation (for example, read)), authorization target resource (resource identification information, for example, resource location information) from the portal site server 220. (Including) and return the authority delegation response message.
After that, the authority server 260 receives the reliability information request message (including information on the authorization subject (FDS server 250), the authorization target operation, and the authorization target resource) from the attribute provider server 230, and returns a reliability information message. .

At this time, the authority server 260 determines whether the information included in the authority delegation request message and the reliability information request message (information identifying the authorization subject, the authorization target operation, and the authorization target resource) matches. , The permission target entity determines whether or not the authorization target operation is permitted (access permission or not), and returns the reliability information message including this access permission information.
Based on this reliability information message, the attribute provider server 230 permits or prohibits resource access to the FDS server 250. As a result, the reliability of the FDS server 250 as the principal agent is guaranteed.

(Operation of Registration Information Management System 200)
FIG. 9 is a sequence diagram showing an outline of the processing flow in the registration information management system 200. FIG. 10 is a sequence diagram showing details of the processing flow in the registration information management system 200. FIG. 11 is a sequence diagram illustrating an example of a processing flow for establishing reliability in the registration information management system 200.
12 to 21 are diagrams illustrating examples of the structure of messages transmitted and received by the registration information management system 200. FIG.

The flow of processing is as follows.
(1) Resource information search request 1) The principal computer 210 accesses the portal site server 220.
2) The portal site server 220 displays a resource information search screen on the principal computer 210 (see FIG. 4).
3) The principal computer 210 requests the portal site server 220 to search for resource information.
When the principal inputs or selects information (search request information) for requesting search of resource information from the resource information search screen (see FIG. 4), search request information is sent from the principal computer 210 to the portal site server 220.

(2) Resource information search 1) When the portal site server 220 receives the search request information, the application 224 generates an instance of the resource resolution unit 223.
2) The application 224 sends a principal identifier to the resource resolution unit 223 and requests a search for resource information of the principal.
3) The resource resolution unit 223 sends a principal identifier to the resource information search provider server 240 and requests acquisition of the resource information of the principal.
4) The resource information search provider server 240 returns resource information (including resource location information) to the resource resolution unit 223.

(3) Analysis of resource information 1) The resource resolution unit 223 analyzes resource information and extracts attribute items included in the resource. When the structure information of the resource is held in the resource structure definition DB of the resource resolution unit 223 (for example, in the case of a resource using a standard schema such as ID-SIS-PP), the resource resolution unit 223 Analyzing the resource structure, you can extract the attribute items included in the resource.
2) When the resource cannot be resolved, the resource resolution unit 223 acquires the structure information of the resource from the attribute provider server 230. Based on the acquired structural information, the attribute item included in the resource is extracted.

(4) Attribute Information Batch Acquisition Request 1) The application 224 causes the principal computer 210 to present a resource information display screen for displaying a list of resource information (see FIG. 5).
2) The principal computer 210 designates attribute information to the portal site server 220 and requests the batch acquisition thereof. That is, collective acquisition request information (information requesting collective acquisition processing of attribute information selected by a principal from a list from the list) is sent from the principal computer 210 to the portal site server 220.

(5) Generation of attribute information batch acquisition message 1) When portal site server 220 receives batch acquisition request information, application 224 generates an instance of batch processing message generation unit 221.
2) Upon receiving the request, the batch processing message generation unit 221 generates a batch acquisition message and returns it to the application 224 (see FIGS. 12A and 12B).
3) The message batch processing unit 222 of the portal site server 220 transmits the batch processing message to the message batch processing unit 251 of the FDS server 250.

FIG. 12A shows an entire example of a batch processing message for acquiring attribute information. FIG. 12B shows an enlarged <Delegation> element portion A11 of the batch processing message of FIG. 12A. 12A and 12B is based on the Liberty ID-WSF Soap Binding Specification. In the header part (Header) of the batch processing message, a <DelegationRef> element is arranged immediately below the <Delegation> element part A11 defined by extending this specification independently. The <DelegationRef> element includes an identifier (itemID attribute), a type of processing for delegating authority (type attribute), a reference to a proxy process target (ref attribute), and a resource (resourceID attribute) that is a proxy process target. This resourceID attribute corresponds to the resource location information.
This header part corresponds to the <Extension> element of the body part (Body). That is, the itemID attribute in the <Extension> element (A12 in the figure) in the body part matches the ref attribute in the header part.

Here, two sets of itemID, type attribute, ref attribute, and resourceID attribute are displayed corresponding to attribute providers (1) and (2) ("" query # 000000001 "," Query "," 000000001 ","" , "" Query # 000000001 "," Query "," 000000002 ",""").
A plurality of <Extension> elements are arranged in the body part (Body) corresponding to a plurality of sets of attributes included in the header part. In FIG. 12A, the <Extension> elements of the body part are arranged so as to overlap each other in correspondence with the ref attributes “000000001” and “000000002” of the header part.
Note that the mustUnderstand attribute and actor attribute are defined in the SOAP specifications.

(6) Authority delegation processing 1) When the message batch processing unit 251 receives the batch processing message, it requests authority delegation to the portal site server 220 so that proxy processing can be performed (transmission of authority delegation request message).
FIG. 13 is a diagram illustrating an example of the authority delegation request message. In this figure, the subject name (<Subject> element, FDS server 250) to be authorized, the action to be authorized (<Action> element), <DelegationRef> element immediately under the <DelegationAuthorityRequest> element defined independently, The resource (<Resource> element) to be authorized is included.

2) The portal site server 220 requests the authority server 260 to perform authority delegation processing (transmission of authority delegation request message).
14A and 14B are diagrams illustrating an example of the authority delegation request message. FIG. 14A shows the entire authority transfer request message. FIG. 14B is a diagram showing details of the <DelegationRequest> element A20 in FIG. 14A. In the <Delegation> element directly under the <DelegationRequest> element defined independently, the subject name (<Subject> element (A21), FDS server 250) to be authorized, and the action to be authorized (<Action> element (A22)) ), A resource to be authorized (<Resource> element (A23)).

The <Resource> element corresponds to the resource location information, and identifies the resource by the resource location information. Here, the <Action> element is “Read”. This authority delegation request message includes an AuthenticationQuery (Authentication Request Query) message of Security Assertion Markup Language (hereinafter referred to as SAML), as shown in FIG. 12A.
In addition to Liberty ID-WSF Soap Binding Specification, standard specifications such as SPML (Service Provisioning Markup Language) can be used.

3) The authority server 260 grants proxy processing authority to the FDS server 250 (reply of authority transfer response message).
FIG. 15 is a diagram illustrating an example of the authority delegation response message. In this figure, Security Assertion Markup Language (hereinafter referred to as SAML) Assertion is used as authority delegation information. An <Assertion> element (A24) includes an authentication assertion to the subject subject to authorization (FDS server 250).

4) The portal site server 220 includes the authority delegation information in the message and transmits it to the FDS server 250 (transmission of authority delegation message).
FIG. 16 is a diagram illustrating an example of the authority delegation message. The <Assertion> element (A25) includes an authentication assertion to the subject subject to authorization (FDS server 250).

(7) Batch Acquisition of Attribute Information 1) The message batch processing unit 251 interprets the batch processing message using the batch processing message interpretation unit 252 and divides the message for each attribute provider server 230.

2) The collective proxy processing unit 253 of the message batch processing unit 251 generates an individual attribute request message including the received authority transfer information for each attribute provider server 230.
FIG. 17 is a diagram illustrating an example of an individual attribute acquisition request message. In this figure, the <Assertion> element (A31) in the SOAP header defined in the Liberty ID-WSF SOAP Binding Specification includes an assertion of assertion to the subject subject to authorization (FDS server 250) ( (The <saml: Assertion> element is included immediately below the <wsse: Security> element.) Here, only one <Query> element (A32) is provided for each attribute provider server 230.

  3) The FDS server 250 transmits an attribute request message to the attribute provider servers 230 (1) and 230 (2) to request acquisition of attribute information.

(8) Confirmation of reliability 1) The attribute provider servers 230 (1) and 230 (2) use the authority delegation information included in the attribute request message in order to verify the reliability of the FDS server 250. Request reliability information from server 260 (transmission of reliability information request message).
FIG. 18 is a diagram illustrating an example of the reliability information request message. In this figure, SAML AuthorizationDecisionQuery (Authorization Decision Query Request) message is used to obtain reliability information. The message structure of AuthorizationDecisionQuery is described in the SAML specification.
The Assertion> element (A33) of the reliability information request message includes an assertion of assertion to the authorization subject (FDS server 250). The reliability information request message includes information requesting access to the resource (A34).

2) The authority server 260 returns, to the attribute provider servers 230 (1) and 230 (2), reliability information that proves that the FDS server 250 is a valid agent of the portal site server 220 from the authority delegation information ( Send reliability information message).
FIG. 19 is a diagram illustrating an example of the reliability information message. In this figure, a SAML AuthorizationStatement message is shown as the reliability information message. The message structure of AuthorizationStatement is described in the SAML specification.
The reliability information message includes access permission information (A35) indicating permission / prohibition of access to the resource and information (A36) indicating the subject (FDS server 250) to be authorized.
In this figure, since the value of the Decision attribute is “Permit (permitted)”, it means a valid proxy (access permission).

  3) The attribute provider servers 230 (1) and 230 (2) verify the reliability information, and the attribute provider server 230 (1) is the portal site server 220 as the request source, and the FDS server 250 is the portal site server. Confirm that 220 is a legitimate agent. As described above, the existence of a valid proxy can be confirmed by the value of the Decision attribute of the reliability information message.

(9) Transmission of attribute information 1) If the reliability of the FDS server 250 can be verified, the attribute provider servers 230 (1) and 230 (2) acquire the attribute information.
2) The attribute provider server 230 returns a message including attribute information to the FDS server 250 (transmission of an attribute acquisition response message).
FIG. 20 is a diagram illustrating an example of an attribute acquisition response message. In this figure, since there is one <Query> element in FIG. 17, there is also one <QueryResponse> element (A41). That is, the FDS server 250 receives attribute information separately from the attribute provider servers 230 (1) and 230 (2).

(7) Batch display of attribute information 1) The batch processing message interpretation unit 252 of the message batch processing unit 251 collects attribute information acquired from the attribute provider servers 230 (1) and 230 (2) into a response message.
2) The batch processing message interpretation unit 252 of the message batch processing unit 251 returns attribute information to the message batch processing unit 222 of the portal site server 220 as a response to the batch processing request (transmission of batch processing response message). The batch processing results are combined into one and included immediately below the SOAP Body of the batch processing response message.
FIG. 21 is a diagram illustrating an example of a batch processing response message. Since the results of batch processing are collected, there are multiple <QueryResponse> elements.
3) The FDS server 250 returns a batch processing response message to the portal site server 220.
4) The application 224 receives the attribute information and displays a list of attribute information on the principal computer 210 (see FIG. 6).

By using the registration information management system 200, maintenance of principal identities (attribute information) managed in a distributed manner on different domains is facilitated. That is, the identity reference can be executed collectively. By processing in a lump, the amount of data required for processing can be reduced compared to the case of individual processing.
In addition, it is easy to ensure the legitimacy of the agent (FDS server 250) who has been delegated the authority of batch processing from the principal.
Note that general processing such as changing or deleting attribute information other than referring to attribute information can also be executed in a batch.

(Third embodiment)
In the first and second embodiments, the object of data operation is attribute information, but the object of data operation can also be resource structure information. That is, negotiation acquisition of resource structure information can be performed collectively.
When the resource provider and the subject have agreed in advance on the resource information and attribute information, that is, when the structure of the identity information is made common, there is no problem in resource resolution. For example, when using a standard schema such as ID-SIS-PP.

However, if the standard schema is independently extended or a uniquely defined schema is used, it will not be possible to grasp what kind of resource information it is, and it will be difficult to exchange attribute information as well as resource resolution. turn into.
It is conceivable to dynamically resolve resources by acquiring the structure information (schema etc.) of the resources and analyzing it. In some cases, it is assumed that the resource structure information is acquired for a plurality of attributes instead of one attribute provider server.

As described above, it is useful to collectively acquire the structure information of resources. For example, the resource resolution units 123 and 223 can acquire the structure information from the attribute provider servers 130 and 230 at once.
Since the present embodiment is not essentially different from the first and second embodiments except that the data manipulation target is different, detailed description thereof will be omitted.

(Other embodiments)
Embodiments of the present invention are not limited to the above-described embodiments, and can be expanded and modified. The expanded and modified embodiments are also included in the technical scope of the present invention.

It is a block diagram showing the registration information management system which concerns on 1st Embodiment of this invention. It is the sequence figure which showed the outline | summary of the flow of the process in the registration information management system which concerns on 1st Embodiment. It is the sequence diagram which showed the detail of the flow of the process in the registration information management system which concerns on 1st Embodiment. It is a figure which shows the example of the screen displayed on a principal computer. It is a figure which shows the example of the screen displayed on a principal computer. It is a figure which shows the example of the screen displayed on a principal computer. It is a figure which shows the example of the structure of the message for acquiring attribute information collectively. It is a block diagram showing the registration information management system which concerns on 2nd Embodiment of this invention. It is the sequence diagram which showed the outline | summary of the flow of the process in the registration information management system which concerns on 2nd Embodiment. It is the sequence diagram which showed the detail of the flow of the process in the registration information management system which concerns on 2nd Embodiment. It is the sequence diagram which showed the flow of the process for the reliability establishment in the registration information management system which concerns on 2nd Embodiment. It is a figure which shows the whole example of the structure of the message transmitted / received by the registration information management system which concerns on 2nd Embodiment. It is a figure which shows a part of example of the structure of the message transmitted / received by the registration information management system which concerns on 2nd Embodiment. It is a figure which shows the example of the structure of the message transmitted / received by the registration information management system which concerns on 2nd Embodiment. It is a figure which shows the whole example of the structure of the message transmitted / received by the registration information management system which concerns on 2nd Embodiment. It is a figure which shows a part of example of the structure of the message transmitted / received by the registration information management system which concerns on 2nd Embodiment. It is a figure which shows the example of the structure of the message transmitted / received by the registration information management system which concerns on 2nd Embodiment. It is a figure which shows the example of the structure of the message transmitted / received by the registration information management system which concerns on 2nd Embodiment. It is a figure which shows the example of the structure of the message transmitted / received by the registration information management system which concerns on 2nd Embodiment. It is a figure which shows the example of the structure of the message transmitted / received by the registration information management system which concerns on 2nd Embodiment. It is a figure which shows the example of the structure of the message transmitted / received by the registration information management system which concerns on 2nd Embodiment. It is a figure which shows the example of the structure of the message transmitted / received by the registration information management system which concerns on 2nd Embodiment. It is a figure which shows the example of the structure of the message transmitted / received by the registration information management system which concerns on 2nd Embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 ... Registration information management system, 110 ... Principal computer, 120 ... Portal site server, 121 ... Batch processing message generation part, 122 ... Message batch processing part, 123 ... Resource resolution part, 124 ... Application, 125 ... Batch processing message interpretation part 126 ... Collective proxy processing unit, 130 ... Attribute provider server, 131 ... Attribute information providing unit, 140 ... Resource information search provider server, 141 ... Resource information search unit, 200 ... Registration information management system, 210 ... Principal computer, 220 ... Portal site server, 221 ... batch processing message generation unit, 222 ... message batch processing unit, 223 ... resource resolution unit, 224 ... application, 227 ... batch processing message transmission unit, 230 ... attribute provider server, 23 ... Attribute information providing unit, 240 ... Resource information search provider server, 241 ... Resource information search unit, 250 ... FDS server, 251 ... Message batch processing unit, 252 ... Batch processing message interpretation unit, 253 ... Batch proxy processing unit, 260 ... Authority server

Claims (5)

Processing request information receiving means for receiving processing request information for requesting processing to a plurality of registered attribute information files respectively registered at a plurality of sites on the network and having the same individual attribute information;
Batch processing message generation means for generating batch processing messages for requesting batch processing to the plurality of registered attribute information files based on the received processing request information;
Individual processing message generating means for generating a plurality of individual processing messages for requesting processing to each of the plurality of registered attribute information files based on the generated batch processing message;
Individual processing message transmitting means for transmitting the plurality of generated individual processing messages to the plurality of sites;
A registration information management system comprising: A delegation request message transmitting means for transmitting a delegation request message for requesting delegation of authority to the registration attribute information file based on the received processing request information;
A delegation permission message receiving unit that receives a delegation permission message that is returned in response to the transmitted delegation request message and includes delegation permission information that permits the delegation of authority; and
The registration information management system according to claim 1, wherein, in response to the received delegation permission message, the collective processing message generation means generates a collective processing message including delegation permission information. The batch processing message further includes an identifier representing a subject of authority delegation;
The registration information management system according to claim 2, further comprising a reliability confirmation unit that confirms the reliability of authority delegation based on the identifier. The registration information management system according to claim 1, wherein the processing is at least one of acquisition, correction, and acquisition of structure information of the plurality of registration attribute information files. Storage means for correspondingly storing the individual and a copy of the registered attribute information file;
Extraction means for extracting attribute items included in a copy of the stored registered attribute information file;
Presenting means for presenting the extracted attribute item;
The processing request information transmitting means receives processing request information for requesting processing to an item of an attribute selected from the plurality of registered attribute information files;
The registered information management system according to claim 1.

Images