JP2010073001A - Authentication control apparatus and authentication control program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication control apparatus and an authentication control program that can reduce the trouble of inputting authentication information when using different types of authentication information. <P>SOLUTION: The authentication control apparatus 2A includes a plurality of authentication processing parts 23-25 for performing authentication processes based on different types of authentication information, a reception part 20A for receiving authentication information, and an authentication control part 21 for identifying the type of the authentication information received by the reception part 20, instructing one of the plurality of authentication processing parts 23-25 which corresponds to the identified type to perform the authentication process, and if the authentication is successful, controlling the others of the plurality of authentication processing parts than the relevant one as deeming that authentication is also successful in the others. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an authentication control device and an authentication control program.

  Conventionally, a system is known in which a client computer, a front-end computer, and a back-end computer are connected to an authentication information management apparatus that manages authentication information (see, for example, Patent Document 1).

In this system, the authentication information management device includes storage means for storing authentication information corresponding to the user for each post-computer, and identification information for the post-computer received when accessing the post-computer via the pre-computer. Search means for searching the post-computer authentication information from the storage means based on the user information and communication means for returning the authentication information searched by the search means to the pre-computer.
JP-A-9-34822

  An object of the present invention is to provide an authentication control apparatus and an authentication control program that can reduce the trouble of inputting authentication information when different types of authentication information are used.

  In order to achieve the above object, one aspect of the present invention provides the following authentication control apparatus and authentication control program.

[1] A plurality of authentication processing units that perform authentication processing based on different types of authentication information, a reception unit that receives authentication information, a type of the authentication information received by the reception unit, and determine the plurality of authentications When the authentication processing unit corresponding to the determined type among the processing units performs the authentication processing and, as a result, authentication is successful, the authentication processing unit other than the authentication processing unit among the plurality of authentication processing units And an authentication control apparatus comprising a control unit that controls the other authentication processing unit.

[2] Furthermore, when authentication as a result of authentication processing by the authentication processing unit corresponding to the type is successful, management information in which user information including authentication information is managed on a user basis based on the authentication information The authentication control device according to [1], further including a user specifying unit that searches for a user who specifies the user who has received the authentication information.

[3] When the authentication is successful as a result of the authentication processing by the authentication processing unit corresponding to the type, the control unit transmits authentication status information indicating that the authentication is successful to the reception source of the authentication information. The authentication control device according to [1].

[4] The accepting unit accepts the authentication status information, and the control unit has succeeded in authentication in the plurality of authentication processing units when the authentication status information accepted by the accepting unit is appropriate. The authentication control apparatus according to [3], which regards the plurality of authentication processing units.

[5] A reception step for receiving authentication information;
The type of the authentication information received by the receiving step is determined, and the authentication processing unit corresponding to the determined type is identified among the plurality of authentication processing units that perform authentication processing based on different types of authentication information. When the authentication is successful as a result, it is assumed that the authentication processing unit other than the authentication processing unit among the plurality of authentication processing units has been authenticated, and the other authentication processing unit is controlled. An authentication control program for causing a computer to execute a control step.

  According to the first and fifth aspects of the present invention, when different types of authentication information are used, it is possible to reduce the trouble of inputting the authentication information.

  According to the second aspect of the present invention, even when different types of authentication information are received, the user corresponding to the authentication information can be easily specified.

  According to the third aspect of the invention, it is possible to notify the authentication information reception source that the authentication has succeeded.

  According to the invention which concerns on Claim 4, while inputting the authentication information is abbreviate | omitted, the safety | security of authentication can be ensured.

  An authentication control device according to an embodiment of the present invention includes a plurality of authentication processing units that perform authentication processing based on different types of authentication information, a reception unit that receives authentication information, and the authentication information received by the reception unit And the authentication processing unit corresponding to the determined type among the plurality of authentication processing units performs the authentication processing. As a result, when the authentication is successful, the authentication processing unit among the plurality of authentication processing units The authentication processing unit other than the authentication processing unit is also regarded as having been successfully authenticated, and includes a control unit that controls the other authentication processing unit.

  The type of authentication information is, for example, a user ID, an e-mail address, a password, a signature, an electronic certificate, and information combining at least two of these, but is not limited thereto.

  In the above configuration, when a user who requests authentication inputs authentication information using a terminal device or the like, authentication processing is performed by the authentication control device according to the type of the authentication information. As a result, if the authentication is successful, it is considered that the authentication is successful in the other authentication processing units. Therefore, the user only has to input authentication information without being aware of the type of authentication information handled by the authentication processing unit, so that the trouble of inputting authentication information is reduced.

[First Embodiment]
FIG. 1 is a schematic diagram showing a configuration example of an authentication system according to the first embodiment of the present invention. The authentication system 1A includes an authentication control device 2A, a terminal device 3, an LDAP (Lightweight Directory Access Protocol) authentication server 4, a PKI (Public Key Infrastructure) authentication server 5, an authentication control device 2A, a terminal device 3, and an LDAP. The network 10 includes an authentication server 4 and a PKI authentication server 5 that are connected to each other.

  The network 10 is a communication network such as a LAN (local area network) that transmits and receives data by wired communication (electric cable, optical cable, etc.), wireless communication (radio waves, infrared rays, etc.), and the like.

  The terminal device 3 is configured by an information processing device such as a computer, a personal digital assistant (PDA), and a mobile phone, for example. When the terminal device 3 receives an input of authentication information by a user input operation, the terminal device 3 transmits the authentication information to the authentication control device 2A. The authentication information may be transmitted directly from the terminal device 3 to the authentication control device 2 or may be transmitted to the authentication control device 2A via the LDAP authentication server 4 and the PKI authentication server 5.

  The LDAP authentication server 4 is used to access a directory database, for example, X.264 by the International Telecommunication Union (ITU-T). A server in which a protocol such as 500 (ISO / IEC 9594-1) is implemented. In the LDAP authentication server 4, LDAP authentication information that is a verification source when performing authentication processing is registered in advance for each user.

  The PKI authentication server 5 uses a public key infrastructure, for example, X. 509 (ISO / IEC 9594-8).

(Authentication control device)
FIG. 2 is a block diagram showing a configuration example of the authentication control apparatus according to the first embodiment of the present invention. The authentication control apparatus 2A includes a receiving unit 20A, an authentication control unit (control unit) 21A, authentication control information 22, a local authentication processing unit 23, an LDAP authentication processing unit 24, a PKI authentication processing unit 25, a user A profile DB (management information) 26 and a user specifying unit (user specifying unit) 27 are provided.

  20 A of reception parts receive the authentication information transmitted from the terminal device 3 via the network interface card etc. which were connected to the network 10, for example.

  21 A of authentication control parts discriminate | determine the authentication type (classification) of the authentication information received by the reception part 20A, and perform an authentication process to the authentication process part corresponding to the determined authentication type among several authentication process parts 23-25. As a result, when the authentication is successful, the authentication processing unit other than the authentication processing unit among the plurality of authentication processing units is regarded as being successfully authenticated, and the other authentication processing unit is controlled.

  The local authentication processing unit 23 includes local authentication information 230 that is registered in advance for each user and serves as a verification source of authentication processing. When receiving the authentication information from the authentication control unit 21A, the local authentication processing unit 23 determines whether or not the authentication is successful by comparing the received authentication information with the local authentication information 230, and indicates the determination result. The determination result information is sent to the authentication control unit 21A.

  The LDAP authentication processing unit 24 performs authentication processing in cooperation with the LDAP authentication server 4. When receiving the authentication information from the authentication control unit 21A, the LDAP authentication processing unit 24 sends the received authentication information to the LDAP authentication server 4. Then, the LDAP authentication processing unit 24 receives determination result information indicating a result of the authentication processing performed by the LDAP authentication server 4 from the LDAP authentication server 4, and sends the determination result information to the authentication control unit 21A.

  The PKI authentication processing unit 25 performs authentication processing in cooperation with the PKI authentication server 5. Upon receiving the authentication information from the authentication control unit 21A, the PKI authentication processing unit 25 sends the received authentication information to the PKI authentication server 5. Then, the PKI authentication processing unit 25 receives determination result information indicating the result of the authentication processing performed by the PKI authentication server 5 from the PKI authentication server 5, and sends the determination result information to the authentication control unit 21A.

  When the authentication is successful as a result of the authentication process, the user specifying unit 27 uses the authentication information as a search key (search element) from the user profile DB 26 managed for each user, and specifies the user who has received the authentication information.

  FIG. 3A shows an example of the user profile DB. The user profile DB 26 is information in which user information including authentication information is managed in units of users. The user profile DB 26 stores, for each user, profile information (user information) such as a user ID, a mail address, a password, and a signature issued from a trusted certificate authority.

  FIG. 3B is a diagram illustrating an example of authentication control information. In the authentication control information 22, an authentication type and a user identification field are recorded for each authentication method. In this embodiment, local authentication, LDAP authentication, and PKI authentication are employed as the authentication method, but other authentication methods may be employed.

  Note that the authentication control unit 21A, the authentication control information 22, the local authentication processing unit 23, the LDAP authentication processing unit 24, the PKI authentication processing unit 25, and the user specifying unit 27 are realized by a calculation unit such as a CPU, for example. The authentication control information 22 and the user profile DB 26 are realized by a storage unit such as a ROM, a RAM, and a hard disk, for example.

(Operation of the first embodiment)
Hereinafter, an example of the operation of the authentication control apparatus 2A according to the first embodiment of the present invention will be described with reference to the flowchart of FIG.

  First, for example, when receiving an operation for accessing the authentication system 1A, the terminal device 3 displays a login screen. When the terminal device 3 receives an input operation of authentication information by the user on the login screen, the terminal device 3 transmits the authentication information to the authentication control device 2A via the network 10.

  Next, the receiving unit 20A of the authentication control device 2A receives the authentication information transmitted from the terminal device 3, and sends the authentication information to the authentication control unit 21A (S1).

  Next, the authentication control unit 21A determines the authentication type of the received authentication information, and determines whether there is an authentication method that matches the determined authentication type with reference to the authentication control information 22 (S10). . As a method for determining the authentication type by the authentication control unit 21A, for example, when the character “@” is included in the authentication information, it is determined as “mail address + password” and the authentication information is HTTPS (Hypertext). When conforming to a communication protocol such as Transfer Protocol over Secure Socket Layer, it is determined as “signature”. When the authentication type of the authentication information is specified by the user on the login screen or the like, the authentication control unit 21A may determine the specified authentication type.

  Next, when the authentication control unit 21A determines that there is no matching authentication method (S10: No), the authentication control unit 21A transmits to the terminal device 3 that the authentication has failed for the authentication information (S30).

  On the other hand, when the authentication control unit 21A determines that there is a matching authentication method (S10: Yes), the authentication control unit 21A selects an authentication processing unit corresponding to the authentication type among the authentication processing units 23 to 25. decide. Here, the case where the authentication type discriminated by the authentication control unit 21A is “mail address + password” will be described. The authentication control unit 21A provides the LDAP authentication processing unit 24 with an authentication processing unit corresponding to the authentication type. decide.

  Next, the authentication control unit 21A sends authentication information to the LDAP authentication processing unit 24 and sends an execution instruction to execute the authentication processing. Upon receiving the execution instruction, the LDAP authentication processing unit 24 executes authentication processing in cooperation with the LDAP authentication server 4 (S11).

  Next, the LDAP authentication processing unit 24 sends determination result information indicating the result of the authentication processing to the authentication control unit 21A, and the authentication control unit 21A determines whether or not the authentication is successful based on the determination result information. (S12).

  Next, when the authentication control unit 21A determines that the authentication is successful (S12: Yes), the authentication control unit 21A instructs the user specifying unit 27 to specify the user who has been successfully authenticated. Send. In response to the specifying instruction, the user specifying unit 27 receives the e-mail included in the authentication information from the e-mail addresses registered in the user specifying field corresponding to the authentication type in the user profile DB 26, that is, the “email address” field. A user matching the address is searched (S20).

  Then, the user specifying unit 27 specifies a user who has been successfully authenticated (hereinafter referred to as an “authenticated user”) as a user having the same e-mail address (S21). 21 A of authentication control parts transmit that the authentication was successful with respect to the authentication information to the terminal device 3. In addition, the authentication control unit 21A sends information related to the authentication successful user to other authentication processing units other than the authentication processing unit that performed the authentication processing, that is, the local authentication processing unit 23 and the PKI authentication processing unit 25, and the local authentication processing Also in the unit 23 and the PKI authentication processing unit 25, it is considered that the authentication is successful for the authentication successful user.

  On the other hand, if the authentication control unit 21A determines in step S12 that the authentication has not succeeded (S12: No), the process returns to step S10 to determine whether there is another authentication method with a matching authentication type. The determination is made (S10), and the process proceeds to the subsequent steps according to the determination result.

  As described above, authentication processing is performed by the authentication control device 2A according to the authentication type of the authentication information transmitted from the terminal device 3, so that even a user who uses a plurality of authentication information of different authentication types, There is no need to input multiple pieces of authentication information. Further, when a new authentication type is added to the authentication system 1A, the authentication control information 22 of the authentication control device 2A may be updated, so the burden of operating and managing the authentication system 1A is reduced.

[Second Embodiment]
FIG. 5 is a schematic diagram showing a configuration example of an authentication system according to the second embodiment of the present invention. The authentication system 1B includes an authentication control device 2B, first and second terminal devices 3A and 3B, an LDAP authentication server 4 and a PKI authentication server 5 configured in the same manner as in the first embodiment, And the second service providing servers 6A and 6B, and the authentication control device 2B, the terminal devices 3A and 3B, the LDAP authentication server 4, the PKI authentication server 5, and the network 10 connecting the service providing servers 6A and 6B to each other. Has been. The first and second terminal devices 3A and 3B are configured in the same manner as the terminal device 3 of the first embodiment.

  The first and second service providing servers 6A and 6B are servers that provide services (functions) such as a web server and a file server.

(Authentication control device)
FIG. 6 is a block diagram showing a configuration example of an authentication control apparatus according to the second embodiment of the present invention. In addition to the authentication control information 22, the local authentication processing unit 23, the LDAP authentication processing unit 24, the PKI authentication processing unit 25, the user profile DB 26, and the user specifying unit 27, the authentication control device 2B is similar to the first embodiment. A reception unit 20B, an authentication control unit 21B, an SSO (Single Sign On) processing unit 28, and session management information 29 are provided. The authentication control unit 21B and the SSO processing unit 28 constitute a control unit.

  The accepting unit 20B accepts an authentication request instead of the authentication information. The authentication request may or may not include authentication information. The authentication request may or may not include a session ID as information recorded in a cookie, for example. The receiving unit 20B may directly receive the authentication request transmitted from the first and second terminal devices 3A and 3B, or may receive the request via the first and second service providing servers 6A and 6B. Also good.

  When the authentication is successful in any of the authentication processing units 23 to 25, the SSO processing unit 28 generates session information (authentication state information) indicating that the authentication is successful and a session ID associated with the session information. The session ID is registered in the session management information 29, and the session ID is transmitted to the terminal device that has received the authentication information.

  In addition, when the session ID is included in the authentication information received by the receiving unit 20B, the SSO processing unit 28 determines whether the session information associated with the session ID is valid (appropriate). When the session information is determined to be valid, a session validity notification indicating that is sent to the authentication control unit 21B.

  Upon receiving the session validity notification from the SSO processing unit 28, the authentication control unit 21B considers that the authentication is successful in the plurality of authentication processing units 23-25, and controls the plurality of authentication processing units 23-25.

  FIG. 7 is a diagram illustrating an example of session management information. The session management information 29 manages a plurality of pieces of session information using the session ID as a key. The session information includes, for example, a login user indicating a user who has been successfully authenticated, a valid period indicating a period during which the login user's authentication success state is maintained, and the like.

(Operation of Second Embodiment)
Below, an example of operation | movement of the authentication control apparatus 2B which concerns on the 2nd Embodiment of this invention is demonstrated according to the flowchart of FIG. Here, a case where the user operates the first terminal device 3A to access the first service providing server 6A will be described.

  First, when using the service provided by the first service providing server 6A, the first terminal device 3A transmits an authentication request received through a user input operation to the first service providing server 6A. When the first service providing server 6A receives the authentication request, the first service providing server 6A transfers (redirects) the authentication request to the authentication control device 2B.

  Next, when the receiving unit 20B of the authentication control device 2B receives the authentication request (S1), the SSO processing unit 28 determines whether or not the session ID is included in the authentication request (S2).

  If it is determined that the session ID is included (S2: Yes), the SSO processing unit 28 determines whether the session information is valid (S3). Specifically, the SSO processing unit 28 refers to the session management information 29 and acquires session management information corresponding to the session ID. The SSO processing unit 28 determines that the session information is valid when the expiration date of the session management information has not passed.

  Next, when the SSO processing unit 28 determines that the session information is valid (S3: Yes), a session validity notification is sent to the authentication control unit 21B. Upon receiving the session validity notification, the authentication control unit 21B considers that the authentication has been successful, and transmits the fact that the authentication has been successful to the first service providing server 6A (S4).

  On the other hand, when the SSO processing unit 28 determines that the session information is not included (S2: No), or when it is determined that the session information is not valid (S3: No), the authentication control unit 21B It is determined whether authentication information is included in the authentication request (S5).

  If it is determined that the authentication information is not included (S5: No), the authentication control unit 21B transmits an authentication information input request to the first service providing server 6A (S40).

  On the other hand, when the authentication control unit 21B determines that the authentication information is included (S5: Yes), the authentication control unit 21A determines the authentication type of the authentication information and matches the determined authentication type. Whether there is an authentication method to be determined is determined with reference to the authentication control information 22 (S10).

  If the authentication control unit 21B determines that there is no matching authentication method (S10: No), the fact that authentication has failed for the authentication information is transmitted to the first terminal device 3A (S30). . For example, when it is determined in step S3 that the session information is not valid (S3: No), the SSO processing unit 28 clears the session information from the session management information 29 (S31).

  On the other hand, when the authentication control unit 21B determines that there is a matching authentication method (S10: Yes), an authentication processing unit corresponding to the authentication method is determined from the authentication processing units 23 to 25, and the authentication processing is performed. Send execution instructions to the department. Upon receiving the execution instruction, the authentication processing units 23 to 25 execute an authentication process (S11).

  Next, the authentication processing units 23 to 25 send determination result information indicating the result of the authentication processing to the authentication control unit 21B, and the authentication control unit 21B determines whether or not the authentication is successful based on the determination result information. (S12).

  Next, when the authentication control unit 21B determines that the authentication is successful (S12: Yes), the authentication control unit 21A sends a specific instruction to the user specifying unit 27, and receives the specific instruction. 27 searches for a user specifying field in the user profile DB 26 (S20), and specifies a user who has succeeded in authentication (S21).

  Next, the SSO processing unit 28 records the session information related to the successful authentication user in the session management information 29, and transmits the session ID to the first terminal device 3A (S22). Then, when the first terminal device 3A receives the session ID, the first terminal device 3A stores the session ID in its own storage unit.

  On the other hand, if the authentication control unit 21B determines in step S12 that the authentication has not succeeded (S12: No), the process returns to step S10 to determine whether there is another authentication method with the same authentication type. The determination is made (S10), and the process proceeds to the subsequent steps according to the determination result.

  Thereafter, when the first terminal device 3A transmits an authentication request to use one of the first and second service providing servers 6A and 6B, the first terminal device 3A is stored in the storage unit of the first terminal device 3A. The session ID is added to the authentication request and transmitted. Then, when the SSO processing unit 28 of the authentication control device 2B determines that the session information associated with the session ID is valid, it is considered that the authentication has succeeded, so that the user inputs the authentication information again. Is no longer necessary.

(Other embodiments)
The present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the spirit of the present invention. For example, the reception unit, authentication control unit, authentication control unit, authentication control information, local authentication processing unit, LDAP authentication processing unit, PKI authentication processing unit, user identification unit, SSO processing unit, etc. May be realized by a calculation unit such as a CPU and an authentication control program, or a part or all of them may be realized by hardware such as an application specific integrated circuit (ASIC).

  The program used in each of the above embodiments may be read from a recording medium such as a CD-ROM into a storage unit in the apparatus, or from a server or the like connected to a network such as the Internet to the storage unit in the apparatus. You may download it.

  Further, in each of the above-described embodiments, the functions, data, and the like possessed by the authentication system may be provided as a whole authentication system. For example, the authentication control information and the user profile DB are stored in another storage device. Also good.

  In addition to key input, the terminal device accepts authentication information by, for example, reading authentication information from an ID card or the like owned by the user using a contactless card reader or the like, or a voice print, fingerprint, vein or face Physical feature information of each user such as an image may be received as authentication information.

FIG. 1 is a schematic diagram showing a configuration example of an authentication system according to the first embodiment of the present invention. FIG. 2 is a block diagram showing a configuration example of the authentication control apparatus according to the first embodiment of the present invention. FIG. 3A shows an example of the user profile DB. FIG. 3B is a diagram illustrating an example of authentication control information. FIG. 4 is a flowchart showing an example of the operation of the authentication control apparatus according to the first embodiment of the present invention. FIG. 5 is a schematic diagram showing a configuration example of an authentication system according to the second embodiment of the present invention. FIG. 6 is a block diagram showing a configuration example of an authentication control apparatus according to the second embodiment of the present invention. FIG. 7 is a diagram illustrating an example of session management information. FIG. 8 is a flowchart showing an example of the operation of the authentication control apparatus according to the second embodiment of the present invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1A, 1B ... Authentication system, 2A, 2B ... Authentication control apparatus, 3, 3A, 3B ... Terminal device, 4 ... LDAP authentication server, 5 ... PKI authentication server, 6A, 6B ... Service provision server, 10 ... Network, 20A, 20B ... Reception unit, 21A, 21B ... Authentication control unit, 22 ... Authentication control information, 23 ... Local authentication processing unit, 24 ... LDAP authentication processing unit, 25 ... PKI authentication processing unit, 26 ... User profile DB, 27 ... User identification , 28 ... SSO processing unit, 29 ... session management information, 230 ... local authentication information

Claims (5)

A plurality of authentication processing units for performing authentication processing based on different types of authentication information;
A reception unit for receiving authentication information;
When the type of the authentication information received by the receiving unit is determined, and the authentication processing unit corresponding to the determined type among the plurality of authentication processing units is caused to perform the authentication process, and as a result, the authentication is successful An authentication control device comprising: a control unit that controls the other authentication processing unit by assuming that the authentication processing unit other than the authentication processing unit among the plurality of authentication processing units has succeeded in authentication.   Further, when authentication as a result of authentication processing by the authentication processing unit corresponding to the type is successful, search for management information in which user information including authentication information is managed on a user basis based on the authentication information. The authentication control device according to claim 1, further comprising a user specifying unit that specifies a user who receives the authentication information.   The said control part transmits the authentication status information which shows that the said authentication was successful to the reception origin of the said authentication information, when authentication as a result of the authentication process by the said authentication process part corresponding to the said type is successful. The authentication control device described. The reception unit receives the authentication status information,
The control unit determines whether or not the authentication status information received by the receiving unit is appropriate, and when the authentication status information is determined to be appropriate, authentication is successful in the plurality of authentication processing units. The authentication control apparatus according to claim 3, wherein the authentication control device controls the plurality of authentication processing units. A reception step for receiving authentication information;
The type of the authentication information received by the receiving step is determined, and the authentication processing unit corresponding to the determined type is identified among the plurality of authentication processing units that perform authentication processing based on different types of authentication information. When the authentication is successful as a result, it is assumed that the authentication processing unit other than the authentication processing unit among the plurality of authentication processing units has been authenticated, and the other authentication processing unit is controlled. An authentication control program for causing a computer to execute a control step.

Images