JP2012203781A - Authentication system, authentication linkage device, and authentication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform authentication without providing a third party with a login ID used inside a company even while requesting processing of single sign-on for utilizing a plurality of computer resources to the third party.SOLUTION: An authentication information converter receives the login ID from a use terminal authenticated on the basis of the login ID, generates a converted ID which is a calculation result of performing irreversible calculation on the basis of the received login ID, and transmits the generated conversion ID to an authentication linkage device. The authentication linkage device stores the combination of the user ID and a password predetermined for each information provision device beforehand corresponding to the converted ID, reads the combination of the user ID and the password corresponding to the converted ID transmitted from the authentication information converter, transmits it to the information provision device, and makes the information provision device perform authentication processing.

Description

  The present invention relates to a technique for performing single sign-on authentication.

  When using various computer resources by running an application on a terminal such as a PC (Personal Computer) or connecting to another computer device via a network, a different user ID and password are used for each computer resource used. May be required. In this case, the user has to input the user ID and password into the user terminal for each computer resource to be used, which is troublesome. Therefore, a single sign-on technique that enables a plurality of computer resources to be used by a single authentication process is provided (for example, Patent Document 1).

  For example, FIG. 11 is a diagram showing an outline of authentication processing by single sign-on. Here, an example will be described in which the use terminal 902 connects to a cloud server 900 that provides a so-called cloud service via a network. In the cloud authentication DB 901 referred to by the cloud server 900 on the cloud side, a combination of a user name, a user ID, and a user password (PASS) is created and stored in advance. In the authentication DB (database) 905 referred to by the authentication server 904 in the company, the name of the user who uses the use terminal 902, the combination of the login ID and the login password are associated and stored in advance. In the authentication conversion DB 906 referred to by the SSO (single sign-on) authentication server 903, a combination of a user login ID, a user ID when the user uses the cloud service, and a user password is stored in advance in association with each other. ing.

  When the usage terminal 902 is activated, the usage terminal 902 activates its own computer resource, and displays a login ID and password input screen for connecting to the corporate network. When the user inputs a login ID and password to the use terminal 902, the use terminal 902 transmits an authentication request to the authentication server 904, and when it is determined that the authentication is successful, the computer resource of the use terminal 902 becomes available. When the use terminal 902 transmits an access request to the cloud server 900 in response to an input from the user (step S101), the SSO authentication server 903 receives the access request. The SSO authentication server 903 cooperates with the authentication server 904 to determine whether or not the use terminal 902 that has transmitted the access request is authenticated (step S102). If authenticated, the SSO authentication server 903 reads a combination of a user ID and a user password corresponding to the user login ID from the authentication conversion DB 906 and transmits the combination to the cloud server 900 (step S104). The cloud server 900 performs authentication processing by comparing the combination of the user ID and user password transmitted from the SSO authentication server 903 with the combination of the user ID and user password stored in advance in the authentication DB 901. If the authentication is successful, the cloud server 900 permits use from the use terminal. As described above, according to single sign-on, the user can use computer resources such as a cloud server only by inputting his / her login ID and login password when the user terminal is activated.

JP 2006-252418 A

  However, various cloud services have been provided in recent years, and the operation of an SSO authentication server that manages a large number of user IDs and user passwords can be complicated. Therefore, as shown in FIG. 12, it is conceivable to entrust the management of the SSO authentication server 912 that performs single sign-on processing to an external outsource company. However, in this case, the authentication conversion DB 913 managed by the outsource company stores the combination of the user ID and the user password in association with the login ID of the user in the company. That is, the company provides the login ID to an outsource company that is a third party. Here, it is desirable that a login ID having a strong authority to log in to a use terminal in a company and connect to a network in the company is kept secret from the outside as much as possible.

  The present invention has been made in view of such a situation, and while entrusting a single sign-on process for using a plurality of computer resources to a third party, a login ID used by a user within a company is provided. Provide an authentication system, an authentication cooperation device, and an authentication method for performing authentication without providing them to a third party.

  In order to solve the above-described problems, the present invention performs an authentication process based on a combination of a predetermined user ID and password, and connects a network to a plurality of information providing apparatuses that provide information when it is determined that the authentication is successful. Single sign-on for a plurality of information providing devices based on login IDs of predetermined use terminals connected to the authentication information conversion device connected to the use terminals connected via the authentication information conversion device and the information providing device An authentication system comprising a third-party authentication cooperation device acting on behalf of the user, wherein the authentication information conversion device includes a login ID receiving unit that receives a login ID from a user terminal authenticated based on the login ID, a login A conversion ID generation unit that generates a conversion ID that is a calculation result obtained by performing an irreversible calculation based on the login ID received by the ID reception unit; A transmission unit that transmits the conversion ID generated by the conversion ID generation unit to the authentication cooperation device, and the authentication cooperation device associates the conversion ID with the user ID and password that are determined in advance for each information providing device. The combination of the ID stored in advance and the combination of the user ID and password associated with the conversion ID transmitted from the authentication information conversion device are read out and transmitted to the information providing device, and the information providing device is authenticated. And an authentication proxy unit that performs processing.

  Further, according to the present invention, the authentication cooperation apparatus includes a line information acquisition unit that acquires line information for identifying a line connected to the authentication information conversion apparatus, and the conversion ID storage unit stores a conversion ID for each conversion ID. The line information for identifying the authentication information conversion device to be transmitted is associated and stored in advance, and the authentication agent is transmitted from the authentication ID conversion device and the conversion ID and line information stored in the conversion ID storage unit. When the conversion ID is compared with the line information of the line to which the conversion ID is transmitted, acquired by the line information acquisition unit, and the conversion ID matches the line information, the user ID and password associated with the conversion ID The combination is read out and transmitted to the information providing apparatus.

  In addition, the present invention performs an authentication process based on a combination of a predetermined user ID and password, and a use terminal connected via a network to a plurality of information providing apparatuses that provide information when it is determined that the authentication is successful The login ID receiving unit that receives the login ID from the user terminal authenticated based on the login ID, and the conversion ID that is the calculation result of the irreversible calculation based on the login ID received by the login ID receiving unit Are connected to an authentication information conversion device, an authentication information conversion device, and an information providing device, which are provided in advance, and include a conversion ID generation unit that generates a conversion ID and a transmission unit that transmits the conversion ID generated by the conversion ID generation unit. A third-party authentication cooperation device that performs single sign-on for a plurality of information providing devices based on the login ID of the used terminal. A conversion ID storage unit that stores a combination of a user ID and a password determined in advance for each information providing device in association with the conversion ID, and an authentication information conversion device. An authentication agent that reads a combination of a user ID and a password associated with the conversion ID to be transmitted, transmits the combination to the information providing apparatus, and causes the information providing apparatus to perform an authentication process.

  In addition, the present invention performs an authentication process based on a combination of a predetermined user ID and password, and a use terminal connected via a network to a plurality of information providing apparatuses that provide information when it is determined that the authentication is successful Are connected to the authentication information conversion device, the authentication information conversion device and the information providing device, and a combination of a user ID and a password predetermined for each information providing device is stored in advance in association with the conversion ID. An authentication method for an authentication system comprising a conversion ID storage unit and a third-party authentication cooperation device acting as a single sign-on for a plurality of information providing devices based on login IDs of predetermined use terminals. The authentication information conversion device receives the login ID from the user terminal authenticated based on the login ID, and the received log-in A step of generating a conversion ID which is a calculation result obtained by performing an irreversible calculation based on the ID, a step of transmitting the generated conversion ID to the authentication cooperation device, and a conversion ID transmitted from the authentication information conversion device by the authentication cooperation device And a step of reading a combination of a user ID and a password associated with the password and transmitting the combination to the information providing apparatus, and causing the information providing apparatus to perform an authentication process.

  As described above, according to the present invention, the authentication information conversion apparatus receives a login ID from a user terminal authenticated based on the login ID, and performs a irreversible calculation based on the received login ID. The conversion ID is generated, and the generated conversion ID is transmitted to the authentication cooperation device. The authentication cooperation device associates the conversion ID with the combination of the user ID and the password predetermined for each information providing device in advance. Since the combination of the user ID and the password stored in correspondence with the conversion ID transmitted from the authentication information conversion device is read out and transmitted to the information providing device, the information providing device performs authentication processing. A third-party login ID is used by the user while outsourcing single sign-on processing to use other computer resources. It is possible to perform authentication without providing to.

It is a block diagram which shows the structural example of the communication system by one Embodiment of this invention. It is a figure which shows the detailed block structure of the authentication information conversion apparatus and authentication cooperation apparatus by one Embodiment of this invention. It is a figure which shows the example of data memorize | stored in the authentication information conversion data storage part by one Embodiment of this invention. It is a figure which shows the example of data memorize | stored in the authentication cooperation DB apparatus by one Embodiment of this invention. It is a sequence diagram which shows the operation example of the communication system by one Embodiment of this invention. It is a sequence diagram which shows the operation example of the communication system by one Embodiment of this invention. It is a flowchart which shows the operation example of the authentication information conversion apparatus by one Embodiment of this invention. It is a flowchart which shows the operation example of the authentication cooperation apparatus by one Embodiment of this invention. It is a figure which shows one Example of this invention. It is a figure which shows one Example of this invention. It is a figure which shows the outline | summary of the single sign-on by a prior art. It is a figure which shows the outline | summary of the single sign-on by a prior art.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing a configuration of a communication system 1 according to the present embodiment. Here, an example is shown in which the user terminal 200 used by the user A in the company entrusts the single sign-on when using the cloud service on the cloud side to a communication carrier. The communication system 1 includes a plurality of cloud servers 100 (cloud server 100-1, cloud server 100-2, cloud server 100-3,...) That provide cloud services on the cloud side, and authentication processing in each cloud service. Cloud authentication DB device 110 (cloud authentication DB device 110-1, cloud authentication DB device 110-2, cloud authentication DB device 110-3,...) That is referred to at the time. Here, each cloud service may provide a different service, but performs the same authentication process. Therefore, unless otherwise distinguished, “−1”, “−2”, etc. are used. It abbreviate | omits and demonstrates as the cloud server 100 and the cloud authentication DB apparatus 110. FIG. Here, three cloud services by three cloud servers 100 and three cloud authentication DB devices 110 are illustrated and described, but each cloud service may be configured by two or more cloud servers 100, Four or more cloud services may be used. The communication system 1 includes a use terminal 200, a line connection device 210, an authentication DB device 220, an authentication server 230, and an authentication information conversion device 300 in the company. Further, the communication provider side includes a communication device device 400, an authentication collaboration DB device 500, and an authentication collaboration device 600.

The cloud server 100 is a computer device that performs authentication processing based on a predetermined combination of a user ID and a password in response to an authentication request from the use terminal 200 and provides information when it is determined that the authentication is successful. The authentication process is performed by determining whether or not the combination of the user ID and the password that matches the combination of the user ID and the password included in the transmitted use request is stored in the cloud authentication DB device 110. If the combination of the matching user ID and password is stored in the cloud authentication DB device 110, it is determined that the authentication is successful, and if it does not match, it is determined that the authentication is unsuccessful. When the authentication is successful, the cloud server 100 may provide, for example, an application such as word processing software or spreadsheet software in the SaaS (Software as a Service) format, or provide other information. There may be.
The cloud authentication DB device 110 is a computer device in which a combination of a user ID and a user password of a user permitted to use a service provided by the cloud server 100 is stored in advance.

  The usage terminal 200 is a computer device that logs in to a corporate network and uses computer resources, and is connected to the cloud server 100 via the authentication collaboration device 600 and the network. Here, one user terminal 200 connected to a corporate network is shown and described, but a plurality of user terminals 200 can be connected to the corporate network. In addition, the user terminal 200 transmits a login ID and a login password input by the user to the authentication server 230 to perform an authentication process. If the user is logged in, his / her login ID is encrypted with a predetermined encryption key and transmitted to the authentication information conversion apparatus 300. At this time, the user terminal 200 can transmit the unique information stored in the authentication DB device 220 to the authentication cooperation device 600 together with the login ID.

The line connection device 210 is a computer device that connects a network on the telecommunications carrier side and a network in a company. The line connection device 210 receives the unique information of the communication device device 400 transmitted from the communication device device 400. The unique information is information that only the communication carrier can know. For example, a contract identifier that identifies a contract of a line connecting the communication device 400 of the communication carrier and the line connection device 210, and a company connected by the line. A company identifier for identifying, line information for identifying the line, and the like can be applied. The line connection device 210 stores the received unique information in the authentication DB device 220.
The authentication DB device 220 is a computer device in which unique information received by the line connection device 210 from the communication device device 400 is stored.

  The authentication server 230 is a computer device that authenticates the user terminal 200 connected to the corporate network. The authentication server 230 stores in advance a combination of the login ID and login password of the user who is permitted to connect to the corporate network in its own storage area, and the combination of the login ID and login password input to the use terminal 200 is stored. Receive and perform authentication. The authentication process is performed by determining whether or not a combination of a user ID and a password that matches the combination of the user ID and the password included in the authentication request transmitted from the use terminal 200 is stored in advance. If a combination of the matching user ID and password is stored in advance, it is determined that the authentication is successful, and if it is determined that they do not match, it is determined that the authentication has failed. Further, when the authentication server 230 determines that the authentication is successful in response to the authentication request from the use terminal 200, the authentication server 230 uses the login ID of the user as information indicating that the user is logging in. Is stored in the storage area.

  The authentication information conversion device 300 is a computer device that is connected to the use terminal 200 and generates a conversion ID based on the login ID of the use terminal 200. FIG. 2 is a diagram showing in detail the block configurations of the authentication information conversion apparatus 300 and the authentication cooperation apparatus 600. The authentication information conversion apparatus 300 includes an authentication information analysis processing unit 310, a line information acquisition unit 320, an authentication conversion processing unit 330, an authentication information conversion data storage unit 340, and a communication unit 350.

  The authentication information analysis processing unit 310 is a login ID receiving unit that receives a login ID being logged in from the use terminal 200 authenticated by the authentication server 230 based on the login ID. Upon receiving the encrypted login ID transmitted from the use terminal 200, the authentication information analysis processing unit 310 reads and decrypts the decryption key stored in the authentication information conversion data storage unit 340.

The line information acquisition unit 320 reads the unique information stored in the authentication DB device 220.
The authentication conversion processing unit 330 receives a conversion ID, which is a calculation result of irreversible calculation, based on the login ID received and decrypted by the authentication information analysis processing unit 310 and the unique information read by the line information acquisition unit 320. Generate. The irreversible calculation is a hash calculation based on, for example, a login ID and unique information. Here, the authentication conversion processing unit 330 can read the irreversible calculation key stored in the authentication information conversion data storage unit 340 and perform hash calculation based on the login ID, the unique information, and the irreversible calculation key. In this way, a unique conversion ID can be more reliably generated by performing the load reverse calculation based on not only the login ID but also the login ID and the unique information. That is, for example, even when users having the same login ID exist in different companies, different conversion IDs are generated based on such unique information.

The authentication information conversion data storage unit 340 stores information used for converting the login ID. FIG. 3 is a diagram illustrating a data example of information stored in the authentication information conversion data storage unit 340. When there are a plurality of branches corresponding to a company, the authentication information conversion data storage unit 340 stores a decryption key and an irreversible operation key in association with a branch ID for identifying the branch.
The communication unit 350 performs communication via a network connected to the authentication cooperation device 600 of the communication carrier. For example, the communication unit 350 transmits the conversion ID generated by the authentication conversion processing unit 330 to the authentication cooperation apparatus 600.

Returning to FIG. 1, the communication device 400 is a computer device that connects a network of a telecommunications carrier and a company network.
The authentication collaboration DB device 500 is a computer device that stores in advance a combination of a user ID and a user password predetermined for each cloud service in association with the conversion ID. Further, here, for each conversion ID, line information for identifying the authentication information conversion apparatus 300 that transmits the conversion ID is associated and stored in advance. 4 is a diagram illustrating an example of data stored in an authentication collaboration DB device 500. FIG. Here, a line ID, a cloud ID, a cloud URL, a user ID, and a user password are stored in association with the conversion ID. The line ID is information for identifying a line with which the user terminal 200 that has transmitted the corresponding conversion ID has previously contracted. The cloud ID is information for identifying a cloud service permitted to be used by the user terminal 200 that has transmitted the corresponding conversion ID. The cloud URL (Uniform Resource Locator) is a URL for connecting to the cloud server 100 that provides the cloud service indicated by the cloud ID. The user ID and the user password are authentication information predetermined for using the corresponding cloud service. These pieces of information are input and stored in advance.

  The authentication cooperation device 600 is connected to the authentication information conversion device 300 and the cloud server 100, and is a computer device of a communication carrier that performs single sign-on for a plurality of cloud servers 100 based on a predetermined login ID of the use terminal 200. It is. As shown in FIG. 2, the authentication collaboration apparatus 600 includes a company side communication unit 610, a used line information acquisition unit 620, an authentication information analysis unit 630, a cloud authentication information acquisition unit 640, and a communication preprocessing unit 650. And a cloud side communication unit 660.

The company-side communication unit 610 communicates with a company network.
The used line information acquisition unit 620 acquires line information for identifying a line connected to the authentication information conversion apparatus 300 in the company from the communication device apparatus 400.
The authentication information analysis unit 630 reads information stored in the authentication cooperation DB device 500 and determines whether or not the line information acquired by the used line information acquisition unit 620 is line information corresponding to the conversion ID. . Further, the authentication information analysis unit 630 determines whether the cloud service requested by the use terminal 200 is a cloud service corresponding to the conversion ID.

  The cloud authentication information acquisition unit 640 reads a combination of a user ID and a password associated with the conversion ID transmitted from the authentication information conversion apparatus 300, transmits the combination to the cloud server 100, and causes the cloud server 100 to perform an authentication process. . At this time, the cloud authentication information acquisition unit 640 is acquired by the conversion ID and the line information stored in the authentication cooperation DB device 500, the conversion ID transmitted from the authentication information conversion device 300, and the used line information acquisition unit 620. The line information of the line to which the conversion ID is transmitted is compared. If the conversion ID and the line information match, the combination of the user ID and password associated with the conversion ID is read and transmitted to the cloud server 100. be able to.

The communication pre-processing unit 650 performs processing that passes between a domain in the corporate network and a domain in the cloud. For example, when the URL indicating the communication device in the communication carrier is disclosed in the corporate network in order to make the cloud access from the corporate network via the authentication cooperation device 600, the use terminal 200 The domain name included in the usage request sent from is converted to the corresponding cloud domain name.
The cloud side communication unit 660 communicates with the cloud server 100 via a network.

Next, an operation example of the communication system 1 according to the present embodiment will be described. 5 and 6 are sequence diagrams showing an example of single sign-on operation by the communication system 1.
First, when the line connection device 210 transmits a line connection request to the communication device 400 (step S1), the communication device 400 transmits unique information to the line connection device 210 (step S2). When the line connection device 210 receives the unique information transmitted from the communication device 400, the line connection device 210 stores the received unique information in the authentication DB device 220 (step S3). When the authentication DB device 220 stores the unique information transmitted from the line connection device 210, the authentication DB device 220 transmits information indicating the storage to the line connection device 210 (step S4). The line connection device 210 transmits information indicating that the unique information has been received to the communication device device 400 (step S5). The communication device 400 notifies the line connection device 210 of the completion of the line connection (step S6).

  When the user terminal 200 is connected to the corporate network, the user terminal 200 transmits a login ID and a login password input by the user to the authentication server 230 (step S7). The authentication server 230 performs an authentication process based on the transmitted login ID and login password. If the authentication is successful, the connection of the user terminal 200 is permitted and the connection completion is notified (step S8). When the usage terminal 200 transmits a usage request to the cloud server 100 in response to an input from the user (step S9), the authentication cooperation device 600 receives the usage request transmitted from the usage terminal 200. The authentication cooperation apparatus 600 refers to the data stored in the authentication cooperation DB apparatus 500, and determines whether or not access to the cloud server 100 is permitted in response to the use request transmitted from the use terminal 200 To read the corresponding cloud URL and perform domain conversion (step S10).

  When the authentication collaboration apparatus 600 transmits a cloud use request to the cloud server 100, the cloud server 100 transmits an authentication request to the authentication collaboration apparatus 600 (step S12). Upon receiving the authentication request transmitted from the authentication collaboration device 600, the authentication collaboration device 600 transmits a request for confirming whether or not authentication has been performed in the corporate network to the use terminal 200 (step S13). The user terminal 200 transmits a login ID and an authentication result acquisition request to the authentication server 230 (step S14). The authentication server 230 transmits the login ID and the authentication result to the use terminal 200 (step S15). The use terminal 200 encrypts the login ID, and transmits the encrypted login ID and the authentication result to the authentication information conversion apparatus 300 (step S16). The authentication information conversion device 300 reads the unique information stored in the authentication DB device 220 (steps S17 and S18). The authentication information conversion apparatus 300 decrypts the login ID, and generates a conversion ID based on the decrypted login ID and the unique information (step S19).

  Proceeding to FIG. 6, the authentication information conversion apparatus 300 transmits the generated conversion ID to the use terminal 200 (step S20). When receiving the conversion ID transmitted from the authentication information conversion apparatus 300, the usage terminal 200 transmits a cloud authentication request including the conversion ID to the authentication information conversion apparatus 300 (step S21). The authentication information conversion apparatus 300 transmits the conversion ID and the unique information to the authentication cooperation apparatus 600 (step S22). The authentication collaboration apparatus 600 determines whether the unique information corresponding to the conversion ID, the use line, and the availability of cloud access (step S23), and the user ID and user password corresponding to the conversion ID from the authentication collaboration DB apparatus 500 Is read out (steps S24 and S25). The authentication cooperation apparatus 600 performs processing such as domain conversion of the authentication request (step S26), and transmits an authentication request including the user ID and the user password to the cloud server 100 (step S27). The cloud server 100 performs an authentication process based on the user ID and the user password transmitted from the authentication collaboration apparatus 600, and transmits an authentication OK notification to the authentication collaboration apparatus 600 if it is determined that the authentication is successful (step S28).

  The authentication collaboration apparatus 600 transmits an authentication OK notification transmitted from the cloud server 100 to the authentication information conversion apparatus 300 (step S29). The authentication information conversion apparatus 300 transmits an authentication OK notification to the user terminal 200 (step S30). When the usage terminal 200 transmits a cloud usage request to the authentication collaboration device 600 (step S31), the authentication collaboration device 600 performs processing such as domain conversion (step S32) and transmits the cloud usage request to the cloud server 100 (step S31). S33). The cloud server 100 transmits information corresponding to the use request to the authentication collaboration apparatus 600 (step S34). The authentication collaboration apparatus 600 performs processing such as domain conversion (step S35), and transmits the information transmitted from the cloud server 100 to the user terminal 200 (step S36).

  FIG. 7 is a flowchart showing detailed processing of the authentication information conversion apparatus 300. When HTTP (HyperText Transfer Protocol) (S) data is input, the authentication information conversion apparatus 300 determines whether or not cloud authentication has been completed if the data is input from the use terminal 200 (step S40: Yes). Is determined (step S41). If the cloud authentication has not been completed (step S41: No), the authentication result of the in-company network is read (step S42). If the authentication result indicates that the authentication has succeeded (step S42: Yes), the authentication DB apparatus 220 is unique Information is read (step S43). If the reading is successful (step S44: Yes), a conversion ID is generated (step S45). In this calculation, an irreversible calculation is performed based on unique information such as a contract identifier, a company identifier, and line information, and a login ID, and the calculation result is used as a conversion ID. If the conversion ID generation process is successful (step S46: Yes), the generated conversion ID is transmitted to the authentication collaboration apparatus 600 (step S47). If the transmission is successful, return to A.

  FIG. 8 is a flowchart showing detailed processing of the authentication collaboration apparatus 600. When the HTTP (S) data is input, the authentication cooperation device 600 determines whether or not cloud authentication has been completed if the data is input from the authentication information conversion device 300 (step S60: Yes) ( Step S61). If cloud authentication has been completed (step S61: Yes), after processing such as domain conversion, it is transferred to the authentication collaboration apparatus 600 (step S62). If the transfer is successful (step S63: Yes), the process returns to A. If the transfer fails (step S63: No), an error is output to the request source and the process returns to A. If the cloud authentication is not completed (step S61: No), and the conversion ID is received (step S65: Yes), the use line corresponding to the conversion ID is checked (step S72). S73: Yes), a cloud access permission check is performed (step S74). If the check result is valid (step S75: Yes), the user ID and user password corresponding to the conversion ID are read (step S76). When the user ID and the user password are read (step S77: Yes), the user ID and the user password are transmitted to the cloud server 100 to perform authentication processing (step S78). If authenticated, the process returns to A and the authentication fails. If an error is output to the request source, the process returns to A.

  FIG. 9 is a diagram illustrating an example of the present embodiment. User A is permitted to use the business and accounting cloud from line 1, and user B is set to be permitted to use the communication cloud for communication from line 1 and line 2. And In this case, the user ID corresponding to the conversion ID and the user password are not associated with each other even if the user A tries to connect to the cloud via the line 2 from the use terminal 200-3 of the T branch. Can not do it.

FIG. 10 is a diagram illustrating an example of the present embodiment. It is assumed that the user A is permitted to use the business system and the accounting system cloud from the line 1. At this time, even if the user J connects to the authentication cooperation apparatus 600 in order to guess the login ID of the user A from the user terminal 200-2 in the malicious company B, the authentication to the cloud can be performed. There is no way to guess the login ID. On the other hand, even if the user K who knows the login ID of the user A tries to connect to the cloud using the login ID of the user A, the conversion ID generated based on the line 2 is not permitted to connect. ,can not connect. Even if the conversion ID of the user A is stolen by the user L, the connection from the line 2 is not permitted and cannot be connected. Also, even if the conversion ID is stolen, the conversion ID is different from the login ID that can log in to the company A's corporate network. Can not.
In the present embodiment, an example in which the authentication process when using the cloud service from the use terminal 200 is performed by single sign-on has been described, but there are various cases in which a company entrusts the single sign-on process to a third party. The present embodiment can be applied to a scene.

  In the present embodiment, an example in which the cloud server 100 performs form authentication and basic authentication is shown. However, the configuration of the present embodiment is similarly applied to authentication such as SAML (Security Assertion Markup Language) and OpenID. it can. In this case, an authentication result such as SAML or OpenID performed by the authentication collaboration apparatus 600 is transmitted to the cloud server 100. Specifically, when the authentication collaboration apparatus 600 is connected to the cloud server 100 in step S11 of FIG. 5, if the use terminal 200 is not authenticated, the cloud server 100 transmits an authentication result request to the authentication collaboration apparatus 600. To do. Then, the authentication collaboration apparatus 600 reads the user conversion ID and line ID from the authentication collaboration DB apparatus 500 and transmits the authentication result to the cloud server 100. When the authentication result transmitted from the authentication collaboration apparatus 600 indicates a successful authentication, the cloud server 100 transmits an authentication OK notification to the authentication collaboration apparatus 600.

  As described above, according to the present embodiment, a company can use the single sign-on function provided by a third party safely and securely without the login ID being known by the third party. it can. Also, even if the conversion ID is leaked, the login ID is not known. As described above, by performing single sign-on using the conversion ID, various cloud services can be efficiently used.

  Note that a program for realizing the function of the processing unit in the present invention is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system and executed for authentication. Also good. Here, the “computer system” includes an OS and hardware such as peripheral devices. The “computer system” includes a WWW system having a homepage providing environment (or display environment). The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

DESCRIPTION OF SYMBOLS 1 Communication system 100 Cloud server 110 Cloud authentication DB apparatus 200 User terminal 210 Line connection apparatus 220 Authentication DB apparatus 230 Authentication server 300 Authentication information conversion apparatus 310 Authentication information analysis process part 320 Line information acquisition part 330 Authentication conversion process part 340 Authentication information conversion Data storage unit 350 Communication unit 400 Communication device 500 Authentication collaboration DB device 600 Authentication collaboration device 610 Enterprise communication unit 620 Used line information acquisition unit 630 Authentication information analysis unit 640 Cloud authentication information acquisition unit 650 Communication preprocessing unit 660 Cloud side communication Part

Claims (4)

Authentication information connected to a user terminal connected via a network to a plurality of information providing apparatuses that perform authentication processing based on a combination of a predetermined user ID and password and provide information when it is determined that authentication is successful A conversion device and a third-party authentication linkage that is connected to the authentication information conversion device and the information providing device, and performs single sign-on for the plurality of information providing devices based on a predetermined login ID of the user terminal An authentication system comprising a device,
The authentication information conversion device includes:
A login ID receiving unit that receives the login ID from the user terminal authenticated based on the login ID;
A conversion ID generation unit that generates a conversion ID that is a calculation result obtained by performing an irreversible calculation based on the login ID received by the login ID reception unit;
A transmission unit that transmits the conversion ID generated by the conversion ID generation unit to the authentication cooperation device,
The authentication linkage device
A conversion ID storage unit in which a combination of the user ID and password predetermined for each of the information providing devices is stored in advance in association with the conversion ID;
An authentication agent that reads a combination of the user ID and password associated with the conversion ID transmitted from the authentication information conversion apparatus, transmits the combination to the information providing apparatus, and causes the information providing apparatus to perform the authentication process When,
An authentication system comprising: The authentication linkage device
A line information acquisition unit for acquiring line information for identifying a line connected to the authentication information conversion apparatus;
In the conversion ID storage unit, for each conversion ID, line information for identifying the authentication information conversion apparatus that transmits the conversion ID is associated and stored in advance.
The authentication substitution unit includes the conversion ID and the line information stored in the conversion ID storage unit, the conversion ID transmitted from the authentication information conversion apparatus, and the conversion acquired by the line information acquisition unit. The information providing apparatus reads out the combination of the user ID and the password associated with the conversion ID when the conversion ID matches the line information with the line information of the line to which the ID is transmitted. The authentication system according to claim 1, further comprising: A login ID that is connected to a user terminal connected via a network to a plurality of information providing apparatuses that perform authentication processing based on a combination of a predetermined user ID and password and provide information when it is determined that authentication is successful. A login ID receiving unit that receives the login ID and a conversion ID that is a calculation result obtained by performing an irreversible calculation based on the login ID received by the login ID receiving unit is generated from the user terminal authenticated based on Connected to the authentication information conversion device, the authentication information conversion device, and the information providing device, the conversion ID generation unit that performs the conversion ID generation, and the transmission unit that transmits the conversion ID generated by the conversion ID generation unit. A first sign-on for the plurality of information providing devices is performed on the basis of the defined login ID of the user terminal. Wherein an authentication linkage apparatus in a user authentication system comprising an authentication linkage device,
A conversion ID storage unit in which a combination of the user ID and password predetermined for each of the information providing devices is stored in advance in association with the conversion ID;
An authentication agent that reads a combination of the user ID and password associated with the conversion ID transmitted from the authentication information conversion apparatus, transmits the combination to the information providing apparatus, and causes the information providing apparatus to perform the authentication process When,
An authentication linkage apparatus comprising: Authentication information connected to a user terminal connected via a network to a plurality of information providing apparatuses that perform authentication processing based on a combination of a predetermined user ID and password and provide information when it is determined that authentication is successful A conversion ID that is connected to the conversion device, the authentication information conversion device, and the information providing device, and stores a combination of the user ID and password that is predetermined for each information providing device in association with the conversion ID. An authentication method for an authentication system, comprising: a storage unit; and a third-party authentication cooperation device that performs single sign-on for the plurality of information providing devices based on a predetermined login ID of the user terminal. ,
The authentication information conversion device is
Receiving the login ID from the user terminal authenticated based on the login ID;
Generating a conversion ID that is a calculation result obtained by performing an irreversible calculation based on the received login ID;
Transmitting the generated conversion ID to the authentication collaboration device;
The authentication collaboration device is
A step of reading a combination of the user ID and password associated with the conversion ID transmitted from the authentication information conversion apparatus, transmitting the combination to the information providing apparatus, and causing the information providing apparatus to perform the authentication process;
An authentication method comprising:

Images