JP2011145754A - Single sign-on system and method, authentication server, user terminal, service server, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To achieve a single sign-on system which prevents specification of individuals by collecting user information, while performing the data management of a user by a database. <P>SOLUTION: The single sign-on system includes: a user terminal; a service server; and an authentication server for performing authentication when the user terminal logs in each service server. When authentication is successful, the authentication server connects user ID with an identifier unique to the service server which has made a request for authentication, and generates encrypted new ID, and transmits it to the user terminal. The user terminal imparts the new ID to a service use request to the service server. When receiving the service use request from the user terminal, the service server imparts the new ID to the service use request, and requests user information. When the user information is requested from the service server, the authentication server decodes the new ID, and returns the requested user information to the service server. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  In the present invention, an SSO (Single Sign On) can be used for a plurality of functions that can be used by being authenticated by the server, by receiving only one authentication. About the system.

  When a user terminal device such as a personal computer possessed by the user logs in to the system desired by the user, it is necessary to log in at the authentication server. When a user terminal device logged in to a predetermined system tries to log in to another system, it is necessary to log in again with another authentication server.

  As described above, when a user logs in to a plurality of systems, a login procedure is required for each system, and the convenience of the user is impaired. Therefore, a cooperative authentication method has been proposed. This cooperative authentication method can realize an SSO system that can log in to another cooperative system once authentication is performed by an authentication server (hereinafter referred to as IdP). In other words, in this SSO system, all authorized functions can be used once the user is authenticated once.

  An example of the SSO system is disclosed in Patent Document 1 (Japanese Patent Laid-Open No. 2007-293760) and Patent Document 2 (Japanese Patent Laid-Open No. 2006-331444).

  The system disclosed in Patent Document 1 is a system composed of a user client terminal, an SSO authentication server, and a plurality of service sites that are connected via a network. It has information to determine whether or not it is possible, determines whether the client terminal logged in with the individual login ID and password from the individual login screen is an SSO user, and if it is an SSO user, redirects the client terminal to the SSO authentication server and logs in individually The ID information and the login success information of the service site are passed to the SSO authentication server. The SSO authentication server acquires the SSO login ID information associated with the received individual login ID information, and performs the SSO authentication of the client terminal. Is what you do.

  In Patent Document 1, by providing the above configuration, an SSO user changes an access destination and an individual login ID for logging in to the service site in an environment where users who use SSO and users who do not use are mixed in each service site. In this case, the SSO authentication server can be authenticated, and convenience for SSO users is improved.

  The system disclosed in Patent Document 2 includes a single sign-on server for selecting and executing a single sign-on module that realizes single sign-on stored as knowledge and a single sign-on module that analyzes and applies login communication of a business system. It provides single sign-on without requiring knowledge of lower layers such as HTTP and HTML.

  In Patent Document 2, by providing the above configuration, single sign-on can be realized without requiring the system engineer to know the lower layer such as HTTP and HTML. I can do it.

  As described above, in an SSO system, a user terminal, an IdP, and a service server (hereinafter referred to as SP) used by a service provider to provide a service, and once authenticated by the IdP, It is possible to log in to other linked systems and use the service functions provided by all authorized SPs once the user is authenticated.

  However, in ID collaboration between networks, it is possible to identify an individual by collecting attribute information (user information) associated with an ID provided for each SP. There is a risk that “name identification” is possible.

JP 2007-293760 A JP 2006-331044 A

  The above-described cooperative authentication method realizes an SSO that can log in to another cooperative system once authenticated by IdP, and uses the SSO to provide a predetermined service provider provided by a service provider. Since the service can be used, it has a feature that can improve the convenience of the user. However, in ID collaboration between networks, name identification may be possible by collecting user information for each service site.

  An object of the present invention is to realize an SSO system capable of managing user data in a database and preventing name identification.

A single sign-on system according to the present invention includes a user terminal, a plurality of service servers associated with the user terminal that provide services to the user terminal, and the plurality of service servers that provide services to the user terminal. A single sign-on system having an authentication server that manages user information required at the time and performs authentication when the user terminal logs in to each service server,
The authentication server is
A database that stores the information of the service server associated in advance and the information of the user necessary for each of the plurality of service servers to provide each service, corresponding to the user ID;
When an authentication request including the user ID and the address of the user terminal is received from the service server, an input for authenticating the address of the user terminal is requested, and then the returned contents and storage of the database Authenticate according to the contents, and if authentication is successful, concatenate the user ID and the identifier unique to the service server that made the authentication request, generate an encrypted new ID, and send it to the user terminal. When a request for user information together with a new ID is received from the service server, the request is obtained when the service server that has decrypted the new ID and requested the user information is a service server associated in advance. An encryption / decryption class for returning user information;
When the user terminal logs in to the system, the user terminal transmits a login request including an address and a user ID to the service server, and then receives the new ID from the authentication terminal. Make a request to the server to use the service,
When the service server accepts a login request from the user terminal, the service server sends an authentication request to the authentication server with the address of the user terminal and the user ID, and uses the service from the user terminal. Is received, a new ID is assigned and a request for user information is transmitted to the authentication server.

The single sign-on method according to the present invention includes a user terminal, a plurality of service servers associated with the user terminal that provide services to the user terminal, and the plurality of service servers that provide services to the user terminal. A single sign-on method performed in a single sign-on system having an authentication server that manages user information required at the time and performs authentication when the user terminal logs in to each service server,
The authentication server is
The information of the service server associated in advance and the information of the user required for each of the plurality of service servers to provide each service are stored corresponding to the user ID,
When an authentication request including the user ID and the address of the user terminal is received from the service server, an input for authenticating the address of the user terminal is requested, and then the returned contents and storage of the database Authenticate according to the contents, and if authentication is successful, concatenate the user ID and the identifier unique to the service server that made the authentication request, generate an encrypted new ID, and send it to the user terminal. When a request for user information together with a new ID is received from the service server, the request is obtained when the service server that has decrypted the new ID and requested the user information is a service server associated in advance. Return user information,
When the user terminal logs in to the system, the user terminal transmits a login request including an address and a user ID to the service server, and then receives the new ID from the authentication terminal. Make a request to the server to use the service,
When the service server accepts a login request from the user terminal, the service server sends an authentication request to the authentication server with the address of the user terminal and the user ID, and uses the service from the user terminal. Is received, a new ID is assigned and a request for user information is transmitted to the authentication server.

  In the method of the present invention, by using a unique identifier in each service site and paying out a new ID using encryption and decryption, the user information DB can be managed by the ID paid out for each site. And secure login.

  The first effect is that the user cannot be specified.

  The reason is to use the ID paid out for each SP.

  The second effect is that name identification can be prevented.

The reason is that the user cannot be specified from the ID. )
The third effect is that the user can be managed by the DB while generating a huge ID.

  The reason is that the user ID can be restored by decryption.

It is a block diagram which shows the structure of one Embodiment of the SSO system by this invention. It is a block diagram which shows the structure of IdP3 in FIG. 1 in detail. It is a sequence diagram which shows each operation | movement of the user terminal 1, SP2, and IdP3 when the user terminal 1 in FIG. 1 logs in to SP2. FIG. 2 is a diagram illustrating a method for generating a new ID 7 from an identifier 4 for each SP2 and a user ID 6 in FIG. 1 and a method for restoring an identifier 4 and a user ID 6 for each SP2 from the new ID 7, wherein (a) is an identifier for each SP2. 4 shows a method for generating a new ID 7 from the user ID 6 and (b) shows a method for restoring the identifier 4 and the user ID 6 for each SP 2 from the new ID 7.

  Next, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram showing a configuration of an embodiment of an SSO system according to the present invention.

  This embodiment is comprised from the user terminal 1, SP2, and IdP3. The user terminal 1, SP2, and IdP3 are configured by a general computer including a control device, a storage device, a display device, an input device, and a communication device, and can be used by a specific user (user). They are connected via a known communication network such as the Internet. In the figure, components characteristic of IdP3 are shown, but these are virtually constructed on the storage device by the control device, and the present invention includes a program for constructing these in the computer. It is.

  A plurality of user terminals 1, SP 2, and IdP 3 are provided, and each SP 2 linked as an SP that performs SSO provides a unique service to the user terminal 1 and performs authentication. The previous IdP3 information is registered in advance. The IdP3 includes a database 3a that stores a user ID 6 for authentication and an encryption / decryption class 3b that realizes payout of a new ID for each SP2. The database 3a is associated with SSO authentication. The SP is registered in advance.

  The IdP3 performs authentication when the user terminal 1 logs in to the SP2, and the user ID 6 and password required when the user terminal 1 first logs in to each SP2 associated as the SP performing SSO. Then, the user terminal 1 issues a new ID 7 that is necessary when receiving service by each SP 2 constituting the SSO system.

  A user who uses the user terminal 1 performs user registration in advance with respect to the IdP3. In response to this, the IdP3 issues a user ID 6 and a password to the user terminal 1, and the SP2 in the database 3a of the IdP3 together with the password. User data for use in the service, for example, name, age, occupation, etc. are stored corresponding to the user ID 6.

  FIG. 2 is a block diagram showing in detail the configuration of IdP3, and FIG. 3 is a sequence diagram showing the operation of each of user terminals 1, SP2, and IdP3 when user terminal 1 logs in to SP2. The operation of this embodiment will be described in detail below with reference to FIGS.

  In order to receive the service by SP2, as shown in FIG. 3, a login request is made from user terminal 1 to SP2 (step S1). The login request includes the user ID 6 issued by Idp3 and the password. In this embodiment, the user ID 6 specifies IdP indicating which IdP should be requested for cooperation. Is given information specifying IdP3.

  The SP 2 that has received the login request uses the information specifying the IdP included in the login request (user ID 6) to make an authentication request for the user terminal 1 to the linked IdP 3 (step S2). This authentication request includes the address of the user terminal 1 and the user ID 6.

  The IdP 3 that has received the request for the cooperation ID requests the user terminal 1 to input a password with the user terminal ID (step S3).

  Next, the password is sent from the user terminal 1 that has received the password input request to the IdP 3 (step S4).

  The IdP3 performs authentication processing for comparing the password sent from the user terminal 1 with the password stored in the database 3a. If they match, the IdP3 is linked as the SP that performs SSO from the address of SP2. Authentication session information indicating the expiration date of each SP or SSO is generated, stored in the database 3a as user information of the user terminal 1, and generation of a new ID 7 necessary for performing SSO is started.

  In the generation of the new ID 7, the SP 2 unique identifier 4 is requested to the SP 2 (step S 5), and the SP 2 that has received the request transmits the unique identifier 4 to the IdP 3, thereby obtaining the SP 2 unique identifier 4. Performed (step S6). When information already held such as website information is used as the unique identifier 4, it is not necessary to request the unique identifier 4 from the IdP 3 to the SP 2.

  Next, the hash value 5 is acquired using the unique identifier 4 of SP2 and the hash function 8 stored in advance. A new ID 7 for realizing cooperation is generated by concatenating the acquired hash value 5 and the user ID 6 registered in the database 3a and encrypting it using the encryption key 9 (see FIG. 2) held in advance. Then, payout to the user terminal 1 is performed (step S7). The user terminal 1 can request a service from the SP 2 using the new ID 7 that has been paid out.

  When the user terminal 1 makes a service use request in SP2 with respect to SP2 (step S8), SP2 requests the IdP3 to disclose user information necessary for providing the service with a new ID7. (Step S9).

  IdP3 presents only necessary information to SP2 (step S10).

  The SP 2 provides the service to the user terminal 1 using the presented information (step S11).

  FIG. 4 is a diagram showing a method for generating a new ID 7 from the identifier 4 for each SP 2 and the user ID 6 and a method for restoring the identifier 4 and the user ID 6 for each SP 2 from the new ID 7 in this embodiment. (B) shows a method for restoring the identifier 4 and the user ID 6 for each SP 2 from the new ID 7. Hereinafter, a method for generating the new ID 7 and a method for restoring the user I6D will be described with reference to FIG.

  As shown in FIG. 4A, the IdP 3 creates a character string by concatenating the user ID 6 and the hash value of the identifier 4 of the SP 2 and encrypts the character string using the encryption key 9. Thus, a different new ID 7 is generated for each SP2 (step S7 in FIG. 3).

  When the SP 2 requests the IdP 3 to disclose user information necessary for providing the service, the SP 2 attaches a new ID 7 together with the request (step S9 in FIG. 3). The IdP 3 decrypts the new ID 7 using the encryption key 9, decrypts the user ID 6 and the hash value 5, and decrypts the identifier 4 of the SP 2 from the hash value 5 and the hash function 8.

  The IdP3 first confirms the authentication session information among the user data corresponding to the user ID 6 decrypted from the database 3a, and determines whether SP2 is the SSO target of the user ID 6 and is within the SSO expiration date. If the information is applicable, the user information requested as necessary for providing the service is extracted.

  Thereafter, even when the user terminal 1 transitions to SP, a service use request is performed using the new ID 7 as in step S8 in FIG. 3, and thereafter, the operations in steps S9 to S11 are performed.

  As described above, in the present embodiment, a new ID 7 is created for each SP2. However, since the new ID is encrypted including the identifier for each SP and the user ID 6, IdP3 decrypts the new ID 7. , SP2 and user can be specified. Since reverse lookup is possible even if a huge number of new IDs 7 are generated for each SP, IdP3 can manage users without registering and holding the generated new IDs 7 for each SP2 in the database. It becomes.

  INDUSTRIAL APPLICABILITY According to the present invention, the present invention can be applied to uses such as purchase of merchandise at an SP with an ID that cannot identify a user and collective payment by an ISP after using the service. It can also be applied to applications such as consultation with medical institutions and law firms while maintaining anonymity.

1 User terminal 2 SP (service server)
3 IdP (authentication server)
3a Database (DB)
3b Encryption / decryption class 4 Identifier 5 Hash value 6 User ID
7 New ID
8 Hash function 9 Cryptographic key S1-S11 Step

Claims (8)

Managing a user terminal, a plurality of service servers linked in advance to provide services to the user terminals, and user information required when the service servers provide services to the user terminals And an authentication server that performs authentication when the user terminal logs in to each service server, and a single sign-on system,
The authentication server is
A database that stores the information of the service server associated in advance and the information of the user necessary for each of the plurality of service servers to provide each service, corresponding to the user ID;
When an authentication request including the user ID and the address of the user terminal is received from the service server, an input for authenticating the address of the user terminal is requested, and then the returned contents and storage of the database Authenticate according to the contents, and if authentication is successful, concatenate the user ID and the identifier unique to the service server that made the authentication request, generate an encrypted new ID, and send it to the user terminal. When a request for user information together with a new ID is received from the service server, the request is obtained when the service server that has decrypted the new ID and requested the user information is a service server associated in advance. An encryption / decryption class for returning user information;
When the user terminal logs in to the system, the user terminal transmits a login request including an address and a user ID to the service server, and then receives the new ID from the authentication terminal. Make a request to the server to use the service,
When the service server accepts a login request from the user terminal, the service server sends an authentication request to the authentication server with the address of the user terminal and the user ID, and uses the service from the user terminal. In the single sign-on system, a request for user information with a new ID is transmitted to the authentication server. When a single sign-on system is configured together with a user terminal and a plurality of service servers linked in advance to provide services to the user terminals, and the plurality of service servers provide services to the user terminals An authentication server that manages required user information and performs authentication when the user terminal logs in to each service server,
When the user terminal logs in to the system, the user terminal transmits a login request including an address and a user ID to the service server, and then receives the new ID from the authentication terminal. Make a request to the server to use the service,
When the service server accepts a login request from the user terminal, the service server sends an authentication request to the authentication server with the address of the user terminal and the user ID, and uses the service from the user terminal. Is received, a new ID is assigned and a request for user information is sent to the authentication server,
A database that stores the information of the service server associated in advance and the information of the user necessary for each of the plurality of service servers to provide each service, corresponding to the user ID;
When an authentication request including the user ID and the address of the user terminal is received from the service server, an input for authenticating the address of the user terminal is requested, and then the returned contents and storage of the database Authenticate according to the contents, and if authentication is successful, concatenate the user ID and the identifier unique to the service server that made the authentication request, generate an encrypted new ID, and send it to the user terminal. When a request for user information together with a new ID is received from the service server, the request is obtained when the service server that has decrypted the new ID and requested the user information is a service server associated in advance. An authentication server comprising: an encryption / decryption class for returning user information. A plurality of service servers linked in advance to provide a service to the user terminal, and user information required when the plurality of service servers provide a service to the user terminal and the user terminal Is a user terminal that constitutes a single sign-on system together with an authentication server that performs authentication when logging in to each service server,
The authentication server is
A database that stores the information of the service server associated in advance and the information of the user necessary for each of the plurality of service servers to provide each service, corresponding to the user ID;
When an authentication request including the user ID and the address of the user terminal is received from the service server, an input for authenticating the address of the user terminal is requested, and then the returned contents and storage of the database Authenticate according to the contents, and if authentication is successful, concatenate the user ID and the identifier unique to the service server that made the authentication request, generate an encrypted new ID, and send it to the user terminal. When a request for user information together with a new ID is received from the service server, the request is obtained when the service server that has decrypted the new ID and requested the user information is a service server associated in advance. An encryption / decryption class for returning user information;
When the service server accepts a login request from the user terminal, the service server sends an authentication request to the authentication server with the address of the user terminal and the user ID, and uses the service from the user terminal. Is received, a new ID is assigned and a request for user information is sent to the authentication server,
When logging in to the system, a login request including an address and a user ID is transmitted to the service server, and when the new ID is received from the authentication terminal, a new ID is assigned and a service is provided to the service server. A user terminal characterized by making a request to use the. A user server and an authentication server together constitute a single sign-on system, and a plurality of service servers that provide services to the user terminal are linked in advance,
The authentication server is
A database that stores the information of the service server associated in advance and the information of the user necessary for each of the plurality of service servers to provide each service, corresponding to the user ID;
When an authentication request including the user ID and the address of the user terminal is received from the service server, an input for authenticating the address of the user terminal is requested, and then the returned contents and storage of the database Authenticate according to the contents, and if authentication is successful, concatenate the user ID and the identifier unique to the service server that made the authentication request, generate an encrypted new ID, and send it to the user terminal. When a request for user information together with a new ID is received from the service server, the request is obtained when the service server that has decrypted the new ID and requested the user information is a service server associated in advance. An encryption / decryption class for returning user information;
When the user terminal logs in to the system, the user terminal transmits a login request including an address and a user ID to the service server, and then receives the new ID from the authentication terminal. A request to the server to use the service,
When a login request is received from the user terminal, an address and a user ID of the user terminal are given, an authentication request is transmitted to the authentication server, and a request to use a service is received from the user terminal A service server that sends a request for user information to which the new ID is assigned to the authentication server. Managing a user terminal, a plurality of service servers linked in advance to provide services to the user terminals, and user information required when the service servers provide services to the user terminals And a single sign-on method performed in a single sign-on system having an authentication server that performs authentication when the user terminal logs in to each service server,
The authentication server is
The information of the service server associated in advance and the information of the user required for each of the plurality of service servers to provide each service are stored corresponding to the user ID,
When an authentication request including the user ID and the address of the user terminal is received from the service server, an input for authenticating the address of the user terminal is requested, and then the returned contents and storage of the database Authenticate according to the contents, and if authentication is successful, concatenate the user ID and the identifier unique to the service server that made the authentication request, generate an encrypted new ID, and send it to the user terminal. When a request for user information together with a new ID is received from the service server, the request is obtained when the service server that has decrypted the new ID and requested the user information is a service server associated in advance. Return user information,
When the user terminal logs in to the system, the user terminal transmits a login request including an address and a user ID to the service server, and then receives the new ID from the authentication terminal. Make a request to the server to use the service,
When the service server accepts a login request from the user terminal, the service server sends an authentication request to the authentication server with the address of the user terminal and the user ID, and uses the service from the user terminal. In the single sign-on method, a request for user information with a new ID is transmitted to the authentication server. A program for realizing the authentication server according to claim 2 on a computer. The program which implement | achieves the user terminal of Claim 3 on a computer. A program for realizing the service server according to claim 4 on a computer.

Images