JP2013073416A - Authentication repeating apparatus, authentication repeating system and authentication repeating method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To solve the problem since an authentication system installed in a user terminal is not considered in a conventional technology, an authentication system which is unavailable for the user terminal may be requested.SOLUTION: The authentication repeating apparatus includes: an authentication request reception part for receiving an authentication request from a service provision device to which a user has transmitted a service request, and for acquiring user information and requested service information; an authentication system selection part for acquiring an authentication system installed in the user terminal from a user information database on the basis of the user information and an authentication level necessary for service use from a service policy database and the combination of authentication systems and an authentication level to be acquired from this from an authentication system combination database, and for acquiring the combination of the authentication systems necessary and available for the user to use the service; and an authentication request part for transmitting an authentication request to the authentication service provision device on the basis of the acquired combination information.

Description

  The present invention relates to a technique for relaying authentication provided by an authentication providing apparatus when a user uses a service of the service providing apparatus.

  In recent years, a single sign-on technique that enables a plurality of systems to be used with a single authentication has attracted attention.

  However, there is a problem that the single sign-on technology does not function properly when services requiring different levels of identity verification (hereinafter referred to as levels) are mixed. This is because if the level of authentication once performed for single sign-on is low, it may be inappropriate to access services such as government procurement that require a high level.

  In order to solve such a problem, for example, there is a technique as disclosed in Patent Document 1. Patent Document 1 confirms the authentication level related to the user terminal device, and provides a predetermined service to the user when the authentication level related to the user terminal device satisfies the request of the service provider device. It is described that when the request is not satisfied, a new authentication is requested to the user.

JP 2010-225078 A

  However, in the technique of Patent Literature 1, no consideration is given to the authentication method provided in the user terminal. In recent years, terminals used by users have been diversified in the same way as services, and the use of services by not only personal computers (PCs) but also mobile phones, smartphones, tablet PCs, and the like is increasing. For this reason, terminals other than PCs have a problem in that there are not as many authentication methods available as PCs. For example, a PC may be equipped with a fingerprint reader or IC card reader, or may be connected externally, but a powerless terminal such as a mobile phone may not have such a device installed. There are many things that cannot be connected.

  Since the above-mentioned method does not consider such diversification of user use terminals, there is a problem that an authentication method that cannot be used by a user terminal trying to access a service may be requested. For example, when accessing a service using a mobile phone that does not have an IC card reader, authentication using an IC card is required, and authentication may not be performed.

  In order to solve the above problems, one embodiment of the present invention includes the following configuration. That is, the authentication relay device is provided in the user terminal from the service information receiving unit that receives the user information and the requested service information from the service providing device from which the user has transmitted the service request, and from the user information database based on the user information. Authentication method selection unit that obtains the authentication method required for the service from the service policy database, and the combination information of the authentication method necessary for the user to use the service from the authentication method combination database, and the combination information When presented to the user and the user is successfully authenticated by the presented authentication method, the user and the service are connected.

  According to the present invention, when a user performs authentication for access to a service, authentication is requested by an authentication method that can be used in a terminal used by the user, so that convenience for the user is improved.

  In addition, the authentication relay device according to the second embodiment can improve the convenience of the user in authentication, and can reduce the risk of fraudulent activities such as impersonation.

It is a network block diagram of the single sign-on system containing the authentication relay apparatus in 1st embodiment. It is a hardware block diagram of the authentication relay apparatus in 1st embodiment. It is a block diagram of the authentication relay apparatus in 1st embodiment. It is a figure which shows the user authentication state database in 1st embodiment. It is a figure which shows the user terminal database in 1st embodiment. It is a figure which shows the authentication system database in 1st embodiment. It is a figure which shows the authentication system combination database in 1st embodiment. It is a figure which shows the service policy database in 1st embodiment. It is a flowchart which shows the process of the authentication system selection part in 1st embodiment. It is a flowchart which shows the authentication process which is a part of process of the authentication method selection part in 1st embodiment. It is a flowchart which shows the authentication selection process which is a part of process of the authentication system selection part in 1st embodiment. It is a flowchart which shows the process of the authentication request | requirement part in 1st embodiment. It is a sequence diagram showing the sequence for service utilization in the single sign-on system in 1st embodiment. It is a figure which shows the interface shown with respect to a user in the authentication method acquisition part in 1st embodiment. It is a block diagram of the authentication relay apparatus in 2nd embodiment. It is a figure which shows the user log database in 2nd embodiment. It is a figure which shows the difference with 1st embodiment among the processes of the authentication system selection part in 2nd embodiment.

  Hereinafter, a mode for carrying out the present invention (referred to as “the present embodiment”) will be described in detail with reference to the drawings.

FIG. 1 is a network configuration diagram of a single sign-on system 100 including an authentication relay apparatus 101 according to the first embodiment.
The authentication relay device 101 is connected to the service providing device 102 via the network 105. Further, the authentication relay apparatus 101 is further connected to the authentication service providing apparatus 103 via the network 106. Further, the authentication relay apparatus 101 is further connected to the user terminal 104 via the network 107.
The authentication relay apparatus 101 is an authentication relay apparatus disclosed in this embodiment. The service providing apparatus 102 is an apparatus that provides a service to a user via a network. The authentication service providing apparatus 103 is an apparatus having a function for authenticating a user. The user terminal 104 is a device used when a user uses a service provided by the service providing apparatus 102 such as a PC, a mobile phone, and a smartphone.

In FIG. 1, the network 105, the network 106, and the network 107 are depicted as different ones, but any two or all of them may be the same network. These networks may be a local area network (LAN) such as a corporate network, or may be not only the LAN but also the Internet. Further, the network 105, the network 106, and the network 107 may be connected to a terminal or a communication device that is not shown.
In FIG. 1, three service providing apparatuses 102, authentication service providing apparatuses 103, and user terminals 104 are illustrated. However, the number is not limited to three, but one, two, or four, respectively. There may be more than one.

FIG. 2 is a hardware configuration diagram of the authentication relay apparatus 101 according to the first embodiment.
The authentication relay device 101 includes a communication device 201 such as a network card, an input device 202 such as a keyboard and a mouse, a display device 203 such as an LCD (Liquid Crystal Display), an arithmetic device 204, a memory 205, and a storage device 206 such as a hard disk. . The arithmetic device 204 executes a program stored in the storage device 206 and controls each unit. The storage device 206 stores a program executed by the arithmetic device 204, data used by the arithmetic device 204, and the like. The communication device 201 receives data from other devices via the network 207 and sends the data to the arithmetic device 204, and transmits the data generated by the arithmetic device 204 to other devices via the network 106. Here, the network 207 is the network 105, the network 106, and the network 107 shown in FIG. The authentication relay device 101 may have a configuration in which a plurality of communication devices 201 are provided and connected to the respective networks, or a configuration in which a single communication device 201 is connected to a plurality of networks. The arithmetic device 204 controls the input device 202 and the display device 203, inputs data from the input device 202, and outputs the data to the display device 203. The storage device 206 stores programs and data necessary for processing. The program is loaded from the storage device 206 to the memory 205 and executed by the arithmetic device 204. The authentication relay device 101 loads these programs from the storage device 206 and executes them, but as other examples, optical recording media such as CD and DVD, magneto-optical recording media such as MO, tape media, magnetic recording media, Alternatively, this program may be loaded from a recording medium such as a semiconductor memory. As another example, these programs may be loaded from another device via a communication medium. A communication medium refers to a network or a digital signal or carrier wave that propagates through the network.

FIG. 3 is a configuration diagram of the authentication relay apparatus 101 according to the first embodiment. Hereinafter, the database may be abbreviated as “DB” in the drawings and specification.
The authentication relay apparatus 101 includes a user authentication state database 301, a user terminal database 302, an authentication method database 303, an authentication method combination database 304, a service policy database 305, a service policy acquisition unit 306, an authentication request reception unit 307, and an authentication method selection unit 308. The authentication request unit 309 and the authentication method acquisition unit 310 are connected to the service providing apparatus 102, the authentication service providing apparatus 103, and the user terminal 104 via a network. The network involved in the connection is not shown in FIG. Further, only one service providing device 102, one authentication service providing device 103, and one user terminal 104 are illustrated, but a plurality of these may exist as described above. In the following description, it is assumed that there are a plurality.
The user authentication status database 301 will be described in FIG. 4, the user terminal database 302 in FIG. 5, the authentication method database 303 in FIG. 6, the authentication method combination database 304 in FIG. 7, and the service policy database 305 in FIG. .

Here, the service policy acquisition unit 306 will be described.
The service policy acquisition unit 306 acquires service policy information (request level, authentication method selection method, behavior at the time of authentication failure, allowable number of authentication failures) provided by the service providing apparatus 102, and stores it in the service policy DB 305. . Although the processing here is not shown in the drawing, an interface for input is prepared and the service manager inputs it, a data format for defining a policy is prepared, and policy data is transmitted from the service side in accordance with the format. It is possible to adopt a configuration in which policy-related information is transmitted using a route (such as a telephone) other than the network illustrated in the present embodiment, and the administrator of the authentication relay apparatus 101 inputs policy information.

Next, the authentication request receiving unit 307 will be described.
The authentication request receiving unit 307 receives the authentication request from the service, calls the authentication method selection unit 308, receives the authentication result from the authentication method selection unit 308, and transmits the authentication result to the service providing apparatus 102. The authentication request receiving unit 307 acquires the identifier of the user who is trying to access, the service and session identifier of the access destination, and assigns them as parameters when calling the authentication method selection unit 308. Although the user identifier acquisition method is not shown in the figure, in the present embodiment, if it is given at the time of authentication request from the service, it is used, and if it is not given, an interface for user identifier input is provided to the user. Prepare and obtain a user identifier by user input. As for the acquisition of the session identifier, when it is presented by the user, it is used, and when it is not presented, it is determined that the session is a new session and a new session identifier is generated.

Next, the authentication method selection unit 308 will be described.
The authentication method selection unit 308 is called from the authentication request reception unit 307, collects information from the user authentication state DB 301, the user terminal DB 302, the authentication method DB 303, the authentication method combination DB 304, and the service policy DB 305, and selects an optimum authentication method for the user. The authentication request unit 309 is called to perform authentication relay to an authentication service that provides authentication according to the selected authentication method. Also, the result of authentication by the authentication service is acquired from the authentication request unit, and the authentication result is transmitted to the authentication request receiving unit 307. If authentication is not required, authentication relay to the authentication service by calling the authentication request unit 309 is not performed, and an authentication result indicating that authentication has been performed is transmitted to the authentication request receiving unit 307.

Next, the authentication request unit 309 will be described.
The authentication request unit 309 is called during the processing of the authentication method selection unit 308 (S1106 in FIG. 11), and requests authentication of the user from the authentication service. Also, the authentication result in each authentication service is received and returned to the authentication method selection unit 309.

Next, the authentication method acquisition unit 310 will be described.
The authentication method acquisition unit 310 acquires an authentication method that can be used by the user terminal and stores it in the user terminal DB 302. As an acquisition method of available authentication methods, an interface for inputting the terminal and the authentication method available there is prepared, and the user or the administrator of the organization to which the user belongs is input in advance, An agent that acquires and sends authentication methods that can be used for user terminals and then sends them automatically or manually when accessing the authentication relay device. It can be used when the user accesses the authentication relay device. There is a method of preparing and selecting an interface for selecting an appropriate interface on the spot.

Hereinafter, these components constituting the authentication relay apparatus 101 will be described.
First, the user authentication state DB 301 will be described.
FIG. 4 is a configuration diagram of the user authentication state DB 301 in the first embodiment. The user authentication status DB 301 is a database that stores what authentication processing the user who performs authentication via the authentication relay apparatus 101 has currently completed, and includes a user identifier 401, an authenticated service 402, an authentication time 403, an authentication It consists of a result expiration date 404, an authentication result 405, and a session identifier 406. The user authentication state DB 301 is information updated in FIG.

  A user identifier 401 is an identifier for uniquely identifying a user. The authenticated service 402 is a service identifier of a service authenticated by the user indicated by the user identifier 401. The authentication time 403 is the time when the user indicated by the user identifier 401 performs authentication, and the authentication result expiration date 404 is the authentication expiration date. After this time, the user is treated as unauthenticated in the authentication service. . The authentication result 405 represents whether the user's authentication in the authentication service was successful or unsuccessful. The authentication result represented by the authentication result 405 is valid until the authentication result expiration date 404. The session identifier 406 is an identifier that uniquely identifies a series of communications by the user.

Next, the user terminal DB 302 will be described.
FIG. 5 is a configuration diagram of the user terminal DB 302 in the first embodiment. The user terminal DB 302 is a database that stores information about the terminals owned by the user and the authentication methods available there, and includes a user identifier 501, a terminal identifier 502, an available authentication method 503, and a terminal type 504. . The user terminal DB 302 is information acquired in advance from the user.

  A user identifier 501 is an identifier for uniquely identifying a user. A terminal identifier 502 is an identifier for uniquely identifying a terminal possessed by the user. The terminal identifier 502 may be an identifier that is uniquely determined for each user, or may be an identifier that is uniquely specified by a combination of user identifiers that have the same identifier among a plurality of users. The latter configuration works effectively when a single terminal is used by a plurality of users, or when a plurality of users are using the same type of terminal. An available authentication method 503 represents a list of authentication methods that can be used in a terminal indicated by a terminal identifier or a terminal indicated by a combination of a user identifier and a terminal identifier. The terminal type 504 stores what type of terminal the terminal is. Examples include desktop PCs, notebook PCs, and mobile phones.

  Regarding the authentication methods 502 that can be used, some authentication methods are based on information stored by the user, and some are based on the user's belongings, but the certification does not require special equipment. The former example is password authentication, and the latter example is authentication using a random number table. In these cases, since there is no restriction on the terminals that can use these authentication methods, the terminal identifier 502 is information representing “all terminals”.

  The available authentication method 503 may store the same information stored in the authentication method 603 of the authentication method DB 303 described later, or may store information representing a plurality of information of the authentication method 603. Also good. For example, the user can generally use a password when there is information representing multiple strengths even with the same password authentication such as “password (4 characters)” and “password (8 characters or more)” as a method stored in the authentication method 603. In this case, since passwords of various strengths can be used, the available authentication method 503 may store information “password” including password authentications of all strengths.

Next, the authentication method DB 303 will be described.
FIG. 6 is a configuration diagram of the authentication method DB 303 in the first embodiment. The authentication method DB 302 is a database that stores what authentication is possible in each of the authentication services provided by the authentication service providing device 103. The authentication method identifier 302, the authentication service providing device identifier 602, the authentication method 603, the timeout It consists of time 604. The authentication method DB 303 is information input in advance by an administrator or the like.

  The authentication service identifier 601 is an identifier that uniquely represents an authentication service provided in the authentication service providing apparatus indicated by the authentication service providing apparatus identifier 602. The authentication service providing apparatus identifier 602 is an identifier that uniquely represents an authentication service providing apparatus that provides the authentication service. Since a plurality of authentication services may be provided by one authentication service providing apparatus, the authentication service providing apparatus identifier 602 may appear multiple times in the entire authentication method DB 303. In addition, the authentication service identifier 601 alone need not be information that uniquely represents the authentication service in the entire single sign-on system 100, and the authentication service identifier 601 and the authentication service providing apparatus identifier 602 may be unique. That's fine. In this embodiment, the authentication service identifier 601 is expressed as “AuthService A”, and the authentication service providing device identifier is expressed as “AuthService Device A”. However, the present invention is not limited to such a form. Information such as a URL (Uniform Resource Locator) uniquely representing an access destination for using the authentication service may be stored. The authentication method 603 is information representing the authentication method used by the authentication service.

  In this embodiment, the authentication method is simply divided according to the difference in the method. For example, even if the authentication is performed using the same password, if there is a difference in the strength of the password that can be used, the authentication method 603 includes information on the strength of the password. It may be stored. In addition to fingerprint authentication, there can be a method of authenticating using the fingerprint of one finger or a method of using two fingers, and even with authentication using a random number table, the types of numbers listed in the random number table The strength of authentication varies with the number. As described above, when the authentication methods are classified into the same authentication method, but the strength changes depending on the authentication service, the authentication method may be subdivided to reflect the authentication strength. In addition, even if the authentication method is the same and the authentication strength is the same, if the authentication service is different, the value stored in the authentication method 603 may be different for each authentication service. The timeout time 604 is information indicating how long the authentication once performed is valid. When the time indicated by the timeout time 604 elapses after authentication, the performed authentication is invalidated. Although not shown in FIG. 6, possible values of the timeout time 604 include information such as “invalidation immediately after use of authentication result” and “valid indefinitely unless explicitly invalidated once authenticated”. There may be a value to represent.

Next, the authentication method combination DB 304 will be described.
FIG. 7 is a configuration diagram of the authentication method combination DB 304 in the first embodiment. The authentication method combination DB 304 is a database that stores information on levels obtained by authentication by individual authentication methods and levels obtained when authentication by a plurality of authentication methods is performed. Level 702 and authentication method 703. The authentication method combination DB 304 is information input in advance by an administrator or the like.

  The combination identifier 701 is an identifier for uniquely identifying a combination of authentication methods. The achieved level 702 is a level obtained when authentication by all the authentication methods indicated by the authentication method 703 is performed. The authentication method 703 is a set of authentication methods represented by 703-1 to 703-3. The authentication method 703 is information composed of three authentication methods, but the number of component authentication methods may be only one or two. In addition, the configuration including three authentication schemes is an example in the present embodiment, and the number is not limited to three, and a level defined by a combination of four or more authentication schemes is defined. It may be a configuration.

Next, the service policy DB 305 will be described.
FIG. 8 is a configuration diagram of the service policy DB 305 according to the first embodiment. The service policy DB 305 is a database for storing a policy such as a required level for each service, and includes a service identifier 801, a service providing apparatus identifier 802, a request level 803, an authentication method selection method 804, and an authentication failure allowable number of times 805. Is done. The service policy DB 305 is information input in advance by an administrator or the like.

  The service identifier 801 is an identifier that uniquely represents a service provided in the service providing apparatus indicated by the service providing apparatus identifier 802. The service providing device identifier 802 is an identifier that uniquely represents a service providing device that provides the service. Since it is conceivable that a single service providing apparatus provides a plurality of services, the service providing apparatus identifier 802 may appear multiple times in the entire service policy DB 305. Further, the service identifier 801 alone does not need to be information that uniquely represents the service in the entire single sign-on system 100, and the service identifier 801 and the service providing apparatus identifier 802 may be unique. In this embodiment, the service identifier 801 is expressed in the form of “Service A” and the service providing device identifier is expressed in the form of “Service Device A”. However, the present invention is not limited to such a form. Information such as a URL (Uniform Resource Locator) uniquely representing an access destination to be used may be stored. The request level 803 is an authentication level required by the service. The authentication method selection method 804 is information on a method for determining which authentication method to use when there are a plurality of authentication methods satisfying the request level 803. In the present embodiment, the authentication relay device selects the one that provides the highest user convenience, “the authentication relay device selects”, and presents the options to the user and selects which authentication method the user himself uses. It is assumed that two types of “user selection” can be stored. The number of allowable authentication failures 805 is the number of allowable authentication failures. If the failure is not allowed, the authentication failure allowable count 805 is zero.

FIG. 9 is a flowchart showing operations of the authentication request receiving unit 307, the authentication method selection unit 308, and the authentication request unit 309 in the first embodiment.
First, in step S901, the authentication request receiving unit 307 receives an authentication request from a service providing apparatus from which a user has transmitted a service request via a user terminal, and receives a service identifier that is service information of an access destination service and a user identifier that is user information. , And a session identifier.
In step S902, the authentication method selection unit 308 refers to the user authentication state DB 301, the user identifier 401 is equal to the user identifier, the authentication result 405 is “success”, and the session identifier 406 is Get the authentication status equal to the session identifier. At this time, if there is an authentication state that has passed the authentication expiration date (404 in FIG. 4), the authentication state is removed from the acquired authentication state and user authentication state DB 301. If there is no authentication state that satisfies the above conditions, nothing is acquired and the process proceeds to step S903.

In step S903, the authentication method selection unit 308 refers to the authentication method DB 303 to acquire an authentication method in which the authentication service 402 in the authentication state and the authentication service identifier 601 are equal, and the authentication method (a combination of a plurality of authentication methods). The level in the current state is derived with reference to the authentication method combination DB 304 in which the authentication method combination DB 304 stored in association with the authentication level achieved thereby is included. Here, when there are a plurality of obtained levels, the highest level is set as the current level. For example, if the user has performed both password authentication and IC card authentication, level 1 and level 2 can be obtained, respectively. As the current level, the higher one is selected and level 2 is selected. Suppose that
Subsequently, in step S904, the authentication method selection unit 308 refers to the service policy DB 305 storing policy information for each service, and acquires a request level corresponding to the service identifier of the access destination service.
In step S905, it is determined whether or not the current level satisfies the service request level. If the current level satisfies the service level, an authentication result indicating that authentication has already been performed is generated in step S906, and the authentication request receiving unit 307 performs step S907. Then, the authentication result is transmitted to the service providing apparatus 102. If the current level does not satisfy the service request level in step S905, the authentication method selection unit 308 and the authentication request unit 309 send an authentication request to the authentication service providing apparatus 103 so as to perform authentication processing in step S908. The authentication service providing apparatus 103 performs authentication, the authentication result is transmitted to the authentication relay apparatus, and the authentication request receiving unit 307 transmits the obtained authentication result to the service providing apparatus 102 in step S907.

  FIG. 10 is a flowchart showing the flow of authentication processing performed in step S908 of FIG. The subsequent processing is a part of the operations of the authentication method selection unit 308 and the authentication request unit 309 shown in FIG. 9, and the user authentication status information, authentication method information, and authentication method combination information acquired in the steps in FIG. Assume that service policy information is retained.

In the authentication process, first, in step S1001, the authentication method selection unit 308 acquires the terminal identifier 502 of the user's terminal from the information transmitted by the browser used by the user at the time of the access request. As a method for acquiring the terminal identifier of the user terminal from the transmission information of the browser, there is a method of using agent information (User-Agent header). In addition to acquiring the terminal identifier from the transmission information of the browser, a method of preparing an interface for selecting one from the terminal list registered in the user terminal DB and allowing the user to select it may be used. .
In step S1002, the authentication method selection unit 308 refers to the user terminal DB 302, and acquires the authentication method 503 that can be used in the terminal from the terminal identifier 502 acquired in step S1001.
In step S1003, the authentication method selection unit 308 acquires a combination group of authentication methods satisfying the service request level 803 acquired in step S904 from the information stored in the authentication method combination DB 304. At this time, if there is an authenticated authentication method 603 obtained from the user authentication state information, it is removed. As an example, consider a case where the request level is 3. The authentication method combination DB 304 shown in FIG. 7 that achieves level 3 is “password and random number table”, “random number table and IC card”, and “password and random number table and IC card”. Achieve 4. These are a combination group of authentication methods that satisfy the required level. If the user has already authenticated using the random number table, the random number table is removed from the combination group, level 3 is achieved with “password”, level 3 is achieved with “IC card”, “password and IC card” ”Achieves level 4 and a combination group of authentication methods is obtained.
In step S1004, the authentication method selection unit 308 extracts from the combination group obtained in step S1003, the authentication method selection unit 308 that includes only the available authentication methods 503 acquired in step S1002. That is, the authentication method selection unit 308 selects an authentication method necessary for the user to use the service based on the authentication method based on the user information and the request level based on the service information. In the above example, if only password authentication (and authentication using an already authenticated random number table) is possible at the user terminal, a combination consisting only of password authentication is extracted from the obtained combination group, and “password” ”To obtain a combination group of authentication methods that level 3 is achieved. Also, in step S1004, when there is no group composed only of the available authentication methods acquired in step S1002 from the combination group obtained in step S1003, the process skips the process of step S1104 in FIG. It is good.
In step S1005, an authentication selection process is performed in which the authentication method selection unit 308 and the authentication request unit 309 select which combination is actually used from the authentication method combination group obtained by the authentication method and perform authentication. carry out. Step S1005 will be described in detail with reference to FIG.
In step S1006, the authentication method selection unit 308 determines whether or not the authentication result returned as a result of the processing in step S1005 is successful. If it fails, an authentication result indicating that the authentication has failed is generated in step S1008. The generated authentication result is passed to step S907 in FIG. 9 as a result of step S908 in FIG.

FIG. 11 is a flowchart showing the flow of authentication selection processing performed in step S1005 of FIG.
In step S1101, the authentication method selection unit 308 determines whether the “authentication method selection method” (804 in FIG. 8) in the service policy acquired in S904 is “select authentication relay device”. If this is the case, in step S1102, the authentication method combination groups are sorted in order from the lowest level to which the authentication methods are combined and from the lowest number of required authentications. In step S1103, a combination that has the lowest achieved level and requires a small number of authentications is acquired from the combination group after sorting. Thereafter, in step 1106, in order to make an authentication request for the authentication service using the method, the authentication request unit 309 is called with the combination of authentication methods as a parameter. Step 1106 will be described in detail with reference to FIG.

  In the present embodiment, in order to maximize the convenience for the user, when selecting a combination for authentication from a group of authentication schemes, the order in which the level is achieved and the order in which the required number of authentications is small is selected. However, the selection method is not limited to this. For example, it may be a method of selecting after sorting in the order registered in the authentication method combination DB 304 or in the reverse order, or a level achieved so that authentication is not required even if a service with a higher request level is accessed thereafter. It is also possible to select after sorting in descending order. Also, a method of selecting one from a combination group of authentication methods completely randomly may be used.

  In step S1101, the authentication method selection unit 308 determines that the “authentication method selection method 804” of the service policy 305 is not “selection of authentication relay device” (that is, “user selects”). In step S1104, an interface is prepared to present a combination group of authentication methods to the user, and one is selected. In step S1105, a combination of authentication methods selected by the user is acquired. In step S1106, the authentication request unit 309 is called using the combination of authentication methods as a parameter in order to issue an authentication request to an authentication service using the method. That is, the authentication request unit 309 transmits an authentication request to the authentication service providing apparatus.

  Here, the selection by the user may be a method in which a combination group of authentication methods satisfying the required level is presented and the user selects one, or a method in which the user selects a method by presenting a list of authentication methods constituting them. But you can. In the case of presenting a list of authentication methods, after authentication, the process returns to step S902 in FIG. 9 to determine whether the current level is derived and the required level is satisfied, and authentication is performed until it is determined that the required level is satisfied. The flow is to present a list of methods. Additional information at the time of presentation is attached to the authentication method, and information on whether or not access to the service becomes possible when authentication by the authentication method is successful, and if it is not, it is further necessary For example, a list of various authentication methods may be presented.

  In step S1107, the authentication method selection unit 308 receives the authentication result from the authentication request unit, and determines in step S1108 whether authentication has succeeded in all authentication methods in the combination of authentication methods. If all the authentications are successful, it is determined in step S1109 that the authentication is successful. If all are not successful, the number of authentication failures is incremented in step S1110. If it is the first failure, the number of authentication failures is set to 1. Next, in step S1111, it is determined whether or not the number of authentication failures exceeds the “number of allowable authentication failures” (806 in FIG. 8) in the service policy. If exceeded, it is determined in step S1112 that the authentication result is an authentication failure. If not exceeded, the process advances to step S1113 to remove the authentication method combination used earlier from the authentication method combination group. In step S1114, it is determined whether there is any remaining authentication method combination group. If there is a remainder, the process returns to step S1101 to authenticate by another method. If there is no remaining information, it is determined in step S1112 that the authentication has failed.

  In step S1113, all authentication results constituting the authentication method combination are acquired and then removed from the authentication method combination group. However, as another method, the authentication method constituting the authentication method combination is used. It is also possible to take a method in which authentication results are acquired one by one and combinations of authentication methods including authentication methods that fail authentication each time are removed. For example, it is assumed that “password, IC card, fingerprint authentication”, “password, IC card, random number table”, “password, one-time password” are in this order as a combination group of authentication methods. Of these, the combination of “password, IC card, fingerprint authentication” is tried first, then the authentication succeeds with password authentication, the authentication fails with IC card authentication, the authentication succeeds with fingerprint authentication, and as a result, the authentication combination fails with this authentication method combination. Suppose. In the method in step S1113 described above, the remaining authentication method combination groups are “password, IC card, random number table” and “password, one-time password”, and then the combination of “password, IC card, random number table” is selected and authenticated. Is tried. In the case of the method given as an example of another method in this paragraph, first, “authentication success” is acquired as a result of password authentication, and then “authentication failure” is acquired as a result of IC card authentication. At this point, the ones that include IC card authentication are removed from the combination groups of authentication methods that are held, and the rest are only combinations of “password, one-time password”, and this combination is enforced.

In the present embodiment, the authentication method selection method is defined as a service policy (in FIG. 8, the authentication method selection method 804 of the service policy DB 305). This method defines the authentication method selection method as a service policy. The present invention is not limited to this, and another method may be taken. As an example, a method may be used in which the authentication relay apparatus determines whether the authentication relay apparatus selects or the user selects each time. As another example, a method may be used in which the authentication relay apparatus selects the first authentication trial and allows the user to select it after having failed once.
Further, in this embodiment, the selection is made such that the authentication method that has once failed in authentication is not used, but the present invention is not limited to this, and a method that uses the authentication method that has failed in authentication again may be used.

  FIG. 12 is a flowchart showing the operation of the authentication request unit 309 in the first embodiment. In step S1201, a combination of authentication methods is acquired from the authentication method selection unit 308. One authentication method that has not yet transmitted an authentication request is extracted from the combination obtained in step S1202, and the authentication request is transmitted to an authentication service providing apparatus that provides authentication based on the authentication method. Thereafter, the authentication service providing apparatus requests authentication from the user, transmits the authentication result to the relay apparatus, and the authentication request unit 309 of the relay apparatus receives the authentication result in step S1203. In step S1204, the authentication request unit determines whether the authentication is successful. In step S1205, the user authentication state DB 301 is updated (information on authentication success and authentication failure as authentication results is stored), and the process advances to step S1206. Specifically, the identifier of the user in “User identifier”, the identifier of the authentication service in “Authentication service”, the current time in “Authentication time”, and the authentication method DB 303 at the current time in “Authentication result expiration” As a result of adding “timeout time” (604 in FIG. 6), success or failure is stored in “authentication result”, and session identifier is stored in “session identifier”. In step S1206, it is determined whether there is an authentication method that does not transmit an authentication request in the combination. If there is, the process returns to step S1202. If authentication requests have been transmitted for all authentication methods, authentication results for all authentication methods are returned to the authentication method selection unit 308 in step S1207.

  In this embodiment, authentication is attempted in all the authentication methods constituting the combination of authentication methods, and the result is returned. However, as another method, if there is an authentication method that fails authentication, there is A method of aborting the authentication attempt and returning the authentication result up to that point may be adopted.

  FIG. 14 is a diagram illustrating an interface for inputting terminal information provided by the authentication method acquisition unit 310 according to the first embodiment. Reference numeral 1401 denotes a browser program screen used by the user, and the interface includes a registered terminal display unit 1402 and terminal information and authentication method adding unit 1403. The registered terminal display unit 1402 shows a list of the user terminals already registered and the authentication methods available there, and a terminal identifier can be input to the terminal information and authentication method adding unit 1403 A text box, a combo box for selecting an available authentication method, and an add button for adding input information to the database are provided. To add an authentication method (password, random number table, etc.) that can be used by all terminals, enter “*” as the terminal identifier.

  The above is the description for each component of the authentication relay apparatus 101.

  Next, the operation of the authentication relay apparatus 101 will be described based on an actual sequence example. FIG. 13 is a sequence diagram thereof. As a premise, it is assumed that the information registered in each database is the same information as shown in FIGS. 4, 5, 6, 7, and 8.

  Now, at the time before all the authentication expiration dates in the user authentication status DB 301, the user with the user identifier “User A” uses the terminal with the terminal identifier “Device B” to execute the service with the service identifier “Service A”. Access to use is made (S1301). The service “Service A” that has received the service request transmits an authentication request to the authentication relay apparatus 101 (S1302). At this time, the service “Service A” is transmitted using the browser redirection function used by the user “User A”. In the authentication relay apparatus 101 that has received the authentication request, the authentication method selection unit 308 selects an appropriate authentication method (S1303). The flow until selection is as follows.

  First, the authentication state of the user “User A” is acquired, and it has been authenticated by the authentication service “AuthService A” and has not yet expired. Next, it can be seen that the authentication method of the authentication service “AuthService A” is password authentication, and the level achieved by password authentication is 1. Next, when the request level of the service “Service A” of the access destination is confirmed, it can be seen that the request level is 2, and the request level is not achieved at the current level. When a combination that achieves level 2 or higher is acquired from the authentication method combination DB 304, password authentication, which is an already authenticated method, is removed, and a combination composed only of authentication methods that can be used by the user terminal “Device B” is extracted. It can be seen that the combination of “Combination C” remains, and level 2 which is the required level can be achieved by additionally performing fingerprint authentication.

  Since it has been found that the necessary authentication method is fingerprint authentication, an authentication request is transmitted to the “AuthService B” authentication service having fingerprint authentication as an authentication method using redirection (S1304). An authentication process is performed between “User A” and “AuthService B” (S1305). It is assumed that the authentication result here is a successful authentication. “AuthService B” transmits the authentication result to the authentication relay apparatus using redirection (S1306). Upon receiving the authentication result, the authentication relay apparatus confirms that the authentication is successful, and that the request level of “Service A” is satisfied, and transmits the authentication result to “Service A” using a redirect. (S1307). In “Service A”, the transmitted authentication result is verified, and after confirming that the requested level is achieved (S1308), the service is provided to “User A” (S1309). .

  This embodiment is merely an example, and modifications for improving user convenience are allowed. For example, although the level in the current state is derived in step S903 of FIG. 9, the authentication expiration date stored in the user authentication state DB 301 may be considered at this time. In other words, if there is something near the expiry date, the expiry date will soon be reached even if it is determined that authentication has been completed here, and authentication will be required again when accessing the next service, reducing convenience. There is a possibility that it will end. Therefore, it is determined that authentication with an expiry date close to, for example, only one minute remaining is invalid, and the current level is derived low, thereby prompting re-authentication or higher-level authentication. Since the user's convenience may be improved by extending the authentication expiration date, the current level may be derived in consideration of such an authentication expiration date.

  Since the authentication relay device disclosed in the present invention is used in user authentication for logging in to a service, the processing at the time of authentication has been described above. When a user uses a service, the authentication relay apparatus may perform processing related to logout from the user service since log-in starts and logout ends. Although the logout process is not shown, an example of the process is shown below.

  When the user claims logout from the service, the service sends a message to that effect to the authentication relay device. When receiving the logout of the user from the service, the authentication relay apparatus acquires the user identifier and the session identifier, and deletes the information in the user state DB 301 that matches the user identifier and the session identifier. As a result, the user is not authenticated by any authentication service, and logout is realized.

  An authentication relay apparatus according to the second embodiment will be described. According to the authentication relay apparatus in the second embodiment, it is possible to improve the convenience of the user in authentication and reduce the risk due to unauthorized activities such as impersonation. In the description of the present embodiment, descriptions of components, functional units, and processing steps that are denoted by the same reference numerals as those illustrated in the drawings described in the first embodiment are omitted.

  FIG. 15 is a configuration diagram of the authentication relay device according to the second embodiment. In the authentication relay apparatus according to the second embodiment, a user log database 1501 is added to the configuration of the authentication relay apparatus according to the first embodiment illustrated in FIG. In addition, the processing content of the authentication method selection unit 308 is added.

  FIG. 16 is a configuration diagram of the user log database 1501 according to the second embodiment. The user log database 1501 is a database that stores a history of user actions, and includes a user identifier 1601, an access time 1602, a use terminal 1603, an access source 1604, a use service 1605, and a continuous authentication failure count 1606. The user identifier 1601 is an identifier that uniquely identifies the accessed user. An access time 1602 represents the time when the authentication relay apparatus is accessed. The use terminal 1603 is an identifier of a terminal used for access. The access source 1604 is information representing the location or network where the user was at the time of access. In the present embodiment, an IP (Internet Protocol) address is stored. The use service 1605 is an identifier of a service that was to be used when accessing the authentication relay apparatus. The number of consecutive authentication failures 1606 is stored when the authentication has failed continuously so far. If the authentication is successful, the number of consecutive authentication failures is zero.

  FIG. 17 is a main part of the difference between the processing content of the authentication method selection unit 308 in the second embodiment and the processing content of the authentication method selection unit 308 in the first embodiment. The main processing in the second embodiment is inserted between S904 and S905 in FIG. 9 in the first embodiment. In step S904, after the authentication method selection unit 308 acquires the level requested by the service, the user log DB 1501 is referred to in step S1701 to determine whether there is an abnormal point in the user's action history. If it is a situation that seems abnormal in step S1702, the level in the current state is lowered by 1 in step S1703. That is, when the access history satisfies a predetermined condition, it is determined to be abnormal, and when it is determined to be abnormal, the authentication level is updated or the service request level is increased. For example, when the level in the current state is 0 (no authenticated service), the request level of the access destination service is increased by 1. If the situation does not seem abnormal, the process proceeds to step S905 as in the first embodiment, and it is determined whether or not the level required by the service is satisfied.

  Specific examples of the abnormality determination method in step S1701 include the following. These examples of abnormality determination methods are not only used individually, but using a plurality of methods, when it is determined that there is an abnormality in one of them, it is determined that there is an abnormality in step S1701, and it is determined that all methods are abnormal. If it is determined that there is an abnormality in step S1701, or if the number of methods determined to be abnormal exceeds a certain number, it is determined that there is an abnormality in step S1701, etc. A combined determination method may be used.

  One of the abnormality determination methods is a method of referring to the access time 1602 and the number of consecutive authentication failures 1606, and determining that it is abnormal when a large number of authentication attempts occur at short intervals and fails.

  As another method, there is a method of referring to the access time 1602 and the use terminal 1603 and determining that there is an abnormality when a large number of terminals are switched and used at short intervals.

  Another method is to refer to the access time 1602 and the access source 1603 and determine that there is an abnormality when accessing from a large number of access sources at short intervals.

  As another method, it is abnormal when referring to the access time 1602 and the access source 1603 to determine the location of the country or region from the access source 1603 and moving between countries or regions at an unimaginable speed. There is a method of judging.

  As another method, there is a method in which a network used for normal access, such as a user's workplace network, is defined in advance, and it is determined that there is an abnormality when the access is from a different network. This is not limited to networks such as the IP address band, but it is abnormal depending on whether access is from a normal country by judging geographical information such as the country or region where the user is currently located from the IP address of the access source or other information. Or whether the access source IP address is that of a cellular phone network, a dedicated line, a general ISP (Internet Service Provider), an optical fiber Internet access, or an ADSL (Asymmetric Digital Subscriber) It may be a method of determining whether or not there is an abnormality from information such as whether the Internet access is based on (Line).

  As another method, there is a method of checking a terminal used by a user and determining that the terminal is abnormal when it is a mobile phone. Here, the case of being a mobile phone is considered to be abnormal. In the case of a terminal such as a mobile phone, loss by the user and acquisition by others are relatively likely to occur, and the other person impersonates the original user of the terminal. This is because there is a high possibility of access. Further, when a terminal that is not registered in the user terminal DB 302 is used, a terminal that is registered but is used for the first time, or a terminal that has not been used for a long time as a result of referring to the access time 1602 A method of determining that there is an abnormality in some cases may be used.

  As another method, there is a method of defining a normal access time for a user and determining that an abnormality occurs when there is an access at a time different from the defined time. For example, registering the working hours of the workplace, judging that access outside that hour is abnormal, judging that access in the late night hours from 10:00 to 6:00 am is abnormal, access in the morning is There is a method of judging that it is abnormal. Also, in the determination using time, the time difference between the point where the user is currently located and the point where the authentication relay device is installed, the time difference between the point where the user is currently located and the land where the user belongs is considered. It may be structured.

  Further, in the abnormality determination using information based on the access source, the access source is determined not only from the IP address assigned to the user terminal and the location that can be determined therefrom, but also from the identifier of the used line, the staying room, and the IP address. The system may be identified by a required FQDN (Fully Qualified Domain Name), a part thereof, or the like.

  In this embodiment, the amount of change in the current state level or the required level is set to 1, but this does not limit the amount of change to 1. The amount of change may be a value of 2, 3, or more depending on the degree of abnormality determined in step S1701.

  In this embodiment, an abnormal state is determined. However, not only an abnormal state but also a normal state and a more reliable state are determined, and the current state level and access destination are determined accordingly. The service request level may be changed. For example, if a user is accessing the service from the company network to which the user belongs and the terminal installed in the company network can be used by a person who has the right to enter the company in advance If the company knows that the company is reliable by a contract or the like, there is a method of raising the current state level by 1 assuming that the user can be trusted to some extent.

  Further, although not shown, in the second embodiment, the access information is added to the user log database 1501 in step S907 of FIG. At that time, if the authentication result is successful, the consecutive authentication failure count 1606 is set to 0, and if the authentication result is unsuccessful, the access time 1602 is the highest among the logs of the user recorded in the user log database 1501. A value obtained by adding 1 to the number of consecutive authentication failures 1606 of the new log is a value stored in the number of consecutive authentication failures 1606 of the additional log.

  By adding the processing as shown in FIG. 17, if it is determined that there is some abnormal situation, the current level is lowered or the request level of the service is raised, and the level is increased even when the same service is used. High authentication is required. In this way, it is possible to prevent the attack from succeeding by detecting that it is abnormal when a user masquerade or password brute force attack is being attempted and reflecting it in the current level or service request level. become.

100 Single Sign-On System 101 Authentication Relay Device 102 Service Providing Device 103 Authentication Service Providing Device 104 User Terminal 301 User Authentication Status Database 302 User Terminal Database 303 Authentication Method Database 304 Authentication Method Combination Database 305 Service Policy Database 306 Service Policy Acquisition Unit 307 Authentication Request receiving unit 308 Authentication method selection unit 309 Authentication request unit 310 Authentication method acquisition unit 1501 User log database

Claims (13)

An authentication relay device that relays authentication required when a user uses a service provided by a service providing device,
An authentication request receiving unit that receives an authentication request from the service providing apparatus from which the user has transmitted a service request via a user terminal, and acquires user information and service information;
A user information storage unit that stores the user information and an authentication method included in the user terminal in association with each other;
A service policy storage unit that stores the service information and a request level that is an authentication level necessary for using the service;
An authentication method combination storage unit that stores the authentication method and the authentication level obtained by the authentication method in association with each other;
An authentication method selection unit that selects an authentication method necessary for the user to use a service based on the authentication method based on the user information and the request level based on the service information;
An authentication request unit that transmits an authentication request to an authentication service providing apparatus that provides an authentication method required by the user;
The authentication method selection unit is an authentication relay apparatus that transmits the authentication result to a service providing apparatus when the authentication requested by the authentication service providing apparatus is successful. The authentication relay device according to claim 1,
An authentication relay apparatus that selects an authentication method that is close to the service authentication level and has a small number of authentications from a plurality of authentication methods when the user has a plurality of authentication methods necessary for using the service. The authentication relay device according to claim 1,
When there are a plurality of authentication methods necessary for the user to use the service, the authentication method selection unit transmits a plurality of the authentication methods to the user terminal, receives the user's selection,
The authentication request unit is an authentication relay device that transmits the authentication method selected by the user to the authentication service providing device. The authentication relay device according to any one of claims 1 to 3,
If at least one of the requested authentication methods fails,
The authentication method selection unit is an authentication relay device that further selects an authentication method excluding the failed authentication method. An authentication relay device according to any one of claims 1 to 4,
If at least one of the requested authentication methods fails,
The authentication method selection unit stores the number of failures, and when the number exceeds a certain value, selects authentication failure,
The authentication request unit is an authentication relay device that transmits an authentication failure to the service providing device. An authentication relay device according to any one of claims 1 to 5,
Furthermore, a user log storage unit for storing the past access history of the user is provided,
The authentication method selection unit determines that the access history is abnormal if the access history satisfies a predetermined condition. If the access history is determined to be abnormal, the authentication method selection unit decreases the authentication level or increases the service request level. Authentication relay device to be updated. An authentication relay system in an authentication relay device that relays authentication required when a user uses a service of a service providing device,
The authentication relay device receives an authentication request from the service providing device from which the user has transmitted a service request via a user terminal, acquires user information and service information,
Storing the user information and an authentication method included in the user terminal in association with each other;
Storing the service information and a request level which is an authentication level necessary for using the service;
Store the authentication method and the authentication level obtained by the authentication method in association with each other,
Based on the authentication method based on the user information and the request level based on the service information, the user selects an authentication method necessary for using the service,
Transmitting an authentication request to an authentication service providing apparatus that provides an authentication method required by the user;
The authentication service providing apparatus transmits an authentication result to the authentication relay apparatus,
The authentication relay system, wherein the authentication relay apparatus transmits the authentication result to a service providing apparatus when the authentication result is successful. The authentication relay system according to claim 7,
The authentication relay system, when the user has a plurality of authentication methods necessary for using the service, selects an authentication method that is close to the service authentication level and has a small number of authentications from the plurality of authentication methods. The authentication relay system according to claim 7,
When there are a plurality of authentication methods necessary for the user to use the service, the authentication relay device transmits a plurality of the authentication methods to the user terminal, receives the user's selection,
An authentication relay system that transmits the authentication method selected by the user to the authentication service providing apparatus. The authentication relay system according to any one of claims 7 to 9,
If at least one of the requested authentication methods fails,
The authentication relay system further selects an authentication method excluding the failed authentication method. The authentication relay system according to any one of claims 7 to 10,
If at least one of the requested authentication methods fails,
The authentication relay device stores the number of failures, and when the number exceeds a certain value, selects authentication failure,
An authentication relay system that transmits an authentication failure to the service providing apparatus. The authentication relay system according to any one of claims 7 to 11,
The authentication relay device further stores a past access history of the user,
An authentication relay system that determines that the access history is abnormal if the access history satisfies a predetermined condition, and updates the service level to lower the authentication level or increase the service request level if it is determined to be abnormal. An authentication relay method for relaying authentication required when a user uses a service provided by a service providing apparatus,
Receiving an authentication request from the service providing apparatus from which the user has transmitted a service request via a user terminal;
Obtaining user information of the user and service information of the service;
Storing the user information and an authentication method included in the user terminal in association with each other;
Storing the service information and a request level which is an authentication level necessary for using the service;
Storing the authentication method and the authentication level obtained by the authentication method in association with each other;
Selecting an authentication method necessary for the user to use a service based on the authentication method based on the user information and the request level based on the service information;
Transmitting an authentication request to an authentication service providing apparatus that provides an authentication method required by the user;
An authentication relay method comprising: when the authentication requested by the authentication service providing apparatus is successful, transmitting the authentication result to the service providing apparatus.

Images