JP2016062362A - Method for authentication service, authentication service server, and authentication service system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To increase the convenience of user authentication.SOLUTION: The object set forth above can be achieved by a method for authentication service including the steps of: storing in a storage unit a user ID of a user belonging to an organization and authentication server identification information of an authentication server in the organization, where authentication information of the users of the organization is managed, in relation to an organization ID of the organization; making a request for issuing a certificate containing the organization ID to an authentication station if there is received a request for issuing a certificate to the user; issuing the certificate to the user if the certificate containing the organization ID is received from the authentication station; connecting to the authentication server in the organization based on the organization ID in the certificate received in response to a request for authentication from a user terminal of the user; and making a computer perform processing for authentication in the authentication server.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an authentication processing technique.

  In recent years, when using the Internet via SSL (Secure Sockets Layer), the authenticity of a communication partner is authenticated using a certificate issued by a certificate authority.

  The certificates held are sorted and stored for each group generated based on the certificate authority and the authentication policy, and a valid certificate is selected from the group associated with the authentication server according to the authentication request from the authentication server. Technology to encrypt the client certificate in the extension area of the electronic certificate and send it to the server, and the server authenticates the client by decrypting the client certificate containing the personal information in the extension area of the electronic certificate. ing.

JP 2007-104044 A WO2008 / 05792

  In an authentication service that performs user authentication using a repository server that contracts with multiple companies and manages user authentication information for each company, the user is authenticated by identifying the repository server of the company to which the user belongs. Processing is performed.

  In such an authentication service, each user must be uniquely identified among all companies. Since the above prior art does not have a mechanism for identifying the organization to which the user belongs, even if the user authentication uses the repository server of the company to which the user belongs, if the identification information of the company to which the user belongs is not input, the user There is a problem that authentication cannot be performed.

  Therefore, in one aspect, the present invention aims to improve convenience during user authentication.

  According to one aspect, the authentication server of the authentication server in the organization in which the user ID of the user belonging to the organization and the authentication information of each user included in the organization are managed in association with the organization ID of the organization When the identification information is stored and a certificate issuance request is received for the user, a certificate issuance request including the organization ID is made to the certificate authority, and a certificate including the organization ID is received from the certificate authority. And issuing the certificate received to the user and connecting to an authentication server in the organization of the organization based on an organization ID included in the certificate received in response to an authentication request from the user terminal of the user Then, there is provided an authentication service method in which a computer performs a process of performing authentication with the authentication server.

  Further, as means for solving the above-described problems, an authentication service server, an authentication service system, an authentication service program for causing a computer to execute the above processing, and a storage medium storing the authentication service program can be used.

  Convenience at the time of user authentication can be improved.

It is a figure which shows the network structural example of a system. It is a figure which shows the function structural example of an authentication service. It is a figure which shows the hardware constitutions of an authentication service server. It is a figure which shows the relationship between tables. It is a figure which shows the example of a data item of an organization information table. It is a figure which shows the example of a data item of a subscriber information table. It is a figure for demonstrating the process which acquires the public key of a certification authority. It is a figure for demonstrating a service application process. It is a figure which shows a service application sequence. It is a figure for demonstrating a client certificate issuing process. It is a figure which shows a client certificate issue sequence. It is a figure which shows the format of a client certificate. It is a figure for demonstrating an authentication process. It is a figure which shows an authentication sequence.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. When outsourcing the authentication function in an organization, a method is adopted in which an external authentication service server that performs an authentication service and a repository server that manages user information held by a company are linked without taking out user information to the outside. Yes. As a result, an authentication service server that provides an authentication service cooperates with a repository server for each of a plurality of organizations.

  Regarding the authentication, the end user's user ID is unique within each organization. However, in the authentication service server that manages the user ID of each user of a plurality of organizations, the user ID is not unique. In two or more organizations, user IDs may match even for different users.

  Therefore, in order for the authentication service to identify the end user's organization information and access the repository server for each organization, it is necessary for the end user to input an organization ID that identifies the organization to which the end user belongs. In this case, the end user in the organization must input the organization ID of the organization to which he belongs, despite using the organization's repository server.

  Alternatively, measures such as changing the URL of the authentication service for each organization can be considered. In this case, every time the number of organizations that use the authentication service increases or decreases, processing operations by the authentication service administrator such as setting for the authentication service server are required.

  Therefore, in the embodiment described below, the convenience related to the authentication input of the end user of each organization is improved, and a mechanism that does not become a work burden on the authentication service manager is provided.

  FIG. 1 is a diagram illustrating an example of a network configuration of a system. The authentication service server 100 in FIG. 1 includes an administrator for each organization (hereinafter referred to as an organization administrator), an end user (hereinafter simply referred to as a user), an authentication service accessed by the authentication service administrator, and a root certification authority 4r. And an intermediate certificate authority 4 having an intermediate certificate digitally signed with a root certificate issued by. The authentication service server 100 and the intermediate certificate authority 4 provide the authentication service 3 to a plurality of organizations such as organization A,... Organization N, etc., and in the authentication service 3, each organization provides a service provider for authentication. Equivalent to.

  The authentication service server 100 is connected to the repository server 8 of each organization such as the organization A repository server 8a, the organization B repository server 8b,. The authentication service server 100 authenticates users in units of organizations instead of the service server 9 that provides various services. An organizational unit is a company, a department, or the like.

  The intermediate certificate authority 4 and the authentication service server 100 are connected to the authentication service manager terminal 5 and managed by the authentication service manager of the authentication service manager terminal 5. The intermediate certificate authority 4 and the authentication service server 100 may be individual servers or may be realized by one server.

  Each organization that uses the authentication service 3 includes an organization manager terminal 61 of the manager of the organization, an organization user terminal 62 of a user who uses the service 9, and an organization repository server 8 held by the organization. The organization repository server 8 corresponds to an authentication server in each organization.

  Organization administrator terminals 61 such as organization A administrator terminals 61 a to 61 n of organization A to organization N and organization user terminals 62 such as organization N user terminals 62 a to 62 n are connected to authentication service server 100.

  The organization manager terminal 61 is an information processing terminal used by the organization manager, and is connected to the authentication service server 100 via the Internet 2 to perform processing related to organization authentication for each organizational unit.

  The organization user terminal 62 is an information processing terminal used by users belonging to the organization. In order for the user to use the service 9, user authentication within the organization is required. When the user accesses the service server 9 to use the service via the Internet 2, the authentication service server 100 authenticates the user using the organization repository server 8 to which the user belongs instead of the service server 9.

  In this embodiment, every time a user uses each service server 9, user authentication can be performed without inputting an organization ID that identifies the organization to which the user belongs. By using the authentication service, the user of the organization integrates authentication for using the service server 9 on the Internet 2 into the authentication service server 100 to realize single sign-on (SSO).

  The authentication service manager receives a service application from the organization manager of each organization and performs a connection operation with the organization repository server 8. The service application may be made electronically by being transmitted from the Internet 2 to the authentication service server 100 via the organization manager terminal 61.

  FIG. 2 is a diagram illustrating a functional configuration example of the authentication service. In FIG. 2, the authentication service server 100 includes a service portal 171, a cooperation server 172, and a database server 173.

  The service portal 171 corresponds to a Web server, receives a request from the organization manager terminal 61, the organization user terminal 62, and the authentication service manager terminal 5, and returns a result of processing performed according to the request.

  The cooperation server 172 performs cooperation processing with the intermediate certificate authority 4 and the organization repository server 8 by the authentication service server 100. The database server 173 performs management processing of various databases related to organization information, administrator information, user information, and the like.

  The database server 173 manages an authority master 131, an organization billing information table 132, a subscriber information table 133, an organization authentication information table 134, an organization information table 135, a service information table 136, and the like.

  The authority master 131 is a database that stores and manages authorities such as authentication service managers and organization managers. The organization billing destination information table 132 is a table for storing and managing the usage fee and billing destination of each organization.

  The subscriber information table 133 is a table for storing and managing user registration information related to users who use the service server 9 for each organization. The organization authentication information table 134 is a table for storing and managing repository address information for each organization. The organization information table 135 is a table for storing and managing organization information for each organization. The service information table 136 is a table for storing and managing information of the service server 9 to be used.

  Although the configuration in which the service portal 171, the cooperation server 172, and the database server 173 are realized by one authentication service server 100 is shown as a processing unit for realizing each, the respective may be realized by individual servers.

  When realized by one authentication service server 100, an authority master 131, an organization billing destination information table 132, a subscriber information table 133, an organization authentication information table 134, an organization information table 135, a service information table 136, and the like will be described later. Stored in the storage unit 130 of the authentication service server 100. When managed by an individual database server 173, it is stored in the storage unit of the database server 173.

  The organization repository server 8 is a server that manages user information of each organization, and is provided from the organization. The organization repository server 8 and the linkage server 172 are connected by the Internet 2 or a dedicated line.

  The intermediate certificate authority 4 includes a registration authority 41, an issuing authority 42, and a repository 43. The registration authority 41 functions as an RA (Registration Authority) that receives a client certificate issuance application and examines owner information submitted by an electronic certificate applicant. The issuing authority 42 functions as an IA (Issuing Authority) that issues, suspends, and discards an electronic certificate.

  The repository 43 is a database for the purpose of disclosing electronic certificates and other related information. Other related information includes a certificate revocation list (CRL), a certification practice statement (CPS), and the like.

  FIG. 3 is a diagram illustrating a hardware configuration of the authentication service server. In FIG. 3, the authentication service server 100 is a terminal controlled by a computer, and includes a CPU (Central Processing Unit) 11, a main storage device 12, an auxiliary storage device 13, an input device 14, and a display device 15. , A communication I / F (interface) 17 and a drive device 18 are connected to the bus B.

  The CPU 11 controls the authentication service server 100 according to a program stored in the main storage device 12. The main storage device 12 uses a RAM (Random Access Memory), a ROM (Read Only Memory) or the like, and is obtained by a program executed by the CPU 11, data necessary for processing by the CPU 11, and processing by the CPU 11. Store or temporarily store the data.

  The auxiliary storage device 13 uses an internal HDD (Hard Disk Drive) or the like, and stores data such as a general-purpose OS (Operating System) and programs for executing various processes. A part of the program stored in the auxiliary storage device 13 is loaded into the main storage device 12 and executed by the CPU 11, whereby various processes are realized. The storage unit 130 includes the main storage device 12 and / or the auxiliary storage device 13.

  The input device 14 includes a mouse, a keyboard, and the like, and is used for a user to input various information necessary for processing by the authentication service server 100. The display device 15 displays various information required under the control of the CPU 11.

  The communication I / F 17 includes a NIC (Network Interface Card) and the like, and performs communication with the outside via the Internet 2. When storing a database or a large amount of information, the external storage 130e may be accessible via FC (Fiber Channel) or NIC.

  A program for realizing the processing performed by the authentication service server 100 is provided to the authentication service server 100 by a storage medium 19 such as a CD-ROM (Compact Disc Read-Only Memory).

  The drive device 18 performs an interface between the storage medium 19 (for example, a CD-ROM) set in the drive device 18 and the authentication service server 100.

  In addition, the storage medium 19 stores a program for realizing various processes according to the present embodiment, which will be described later, and the program stored in the storage medium 19 is installed in the authentication service server 100 via the drive device 18. Is done. The installed program can be executed by the authentication service server 100.

  The medium for storing the program is not limited to a CD-ROM, and any medium that can be read by a computer may be used. As a computer-readable storage medium, in addition to a CD-ROM, a portable recording medium such as a DVD disk or a USB memory, or a semiconductor memory such as a flash memory may be used.

  The relationship between tables related to user authentication will be described. FIG. 4 is a diagram illustrating a relationship between tables. In FIG. 4, an organization information table 135 is a table for managing organization registration information for each organization, and each of an organization authentication information table 134, a subscriber information table 133, and a service information table 136 is assigned by a uniquely assigned organization ID. Associated with The organization registration information will be described later with reference to FIG.

  The organization authentication information table 134 manages repository address information and authentication policy information for specifying the organization repository server 8 for each organization. The repository address information is a URL for inquiring user authentication information. The authentication policy information indicates a user authentication method determined by the organization.

  The subscriber information table 133 manages registration information of users belonging to the organization for each subscriber ID and organization ID. The user registration information will be described later with reference to FIG. The service information table 136 manages service server information that identifies the service server 9 used by the organization. The service server information indicates a URL for receiving a service.

  Next, the organization information table 135 and the subscriber information table 133 related to the processing according to the present embodiment will be described.

  FIG. 5 is a diagram illustrating an example of data items in the organization information table. In FIG. 5, the organization information table 135 is a table for storing organization information registered in the authentication service server 100 from the organization manager terminal 61 in the organization by the organization manager. The organization ID, organization name, organization name ( Kana), address, phone number, contract date, cancellation date, status, creation date, update date, etc.

  The organization ID indicates organization identification information, and is uniquely assigned by the service portal 171 when the organization is registered. The organization ID is a primary key of the organization information table 135. The organization name indicates the name of the organization. If it is a company, the company name is shown. The organization name (kana) indicates the organization name in kana notation.

  The address indicates the location of the organization. The telephone number indicates a company telephone number. The contract date indicates the date on which the contract is concluded between the provider of the authentication service 3 and the organization. The cancellation date indicates the date when the contract of the authentication service 3 is canceled. The status indicates the contract status. The contract status includes unregistered, registering, registered, and canceled. The creation date indicates the date when the record was created. The update date indicates the date when the record was updated.

  A record having the items as described above is created for each organization, and the organization registration information received from the organization manager terminal 61 is stored. After registering the organization, information on the user who belongs to the organization and uses the service server 9 (user registration information) is registered in the subscriber information table 133.

  FIG. 6 is a diagram illustrating an example of data items in the subscriber information table. 6, the subscriber information table 133 stores, for each organization, subscriber information registered in the authentication service server 100 from the organization manager terminal 61 by the organization manager or from the organization user terminal 62 by the organization user. The table includes subscriber ID, name, name (kana), address, telephone number, organization ID, contract date, cancellation date, status, creation date, update date, and the like.

  The subscriber ID indicates an ID for identifying a user in the organization, and is used as an ID for subscriber identification in the authentication service server 100. The subscriber ID is a primary key of the subscriber information table 133.

  A full name shows a user's full name. The name (kana) indicates the kana notation of the user's first and last name. The address indicates the user's address, but may be the location of the user's affiliation. The telephone number indicates the contact information of the user, and may be the telephone number of the department to which the user belongs. The organization ID indicates the ID of the organization to which the user belongs. The subscriber information table 133 and the organization information table 135 (FIG. 5) are associated with each other by the organization ID.

  The contract date indicates the date when the user became a subscriber of the authentication service 3 or the date when the user's organization signed a contract with the provider of the authentication service 3. The cancellation date indicates the date when the user cancels the contract as a subscriber or the date when the organization cancels the authentication service 3 contract. The status indicates the contract status. The contract status includes unregistered, registering, registered, and canceled.

  The creation date indicates the date when the record was created. The update date indicates the date when the record was updated.

  After the organization contracts with the provider of the authentication service 3, a record having the items as described above is created for each user, and the user registration information received from the organization manager terminal 61 or the organization user terminal 62 is stored. .

  Hereinafter, processing performed by the authentication service 3 will be described. First, in order to implement the secure authentication service 3, as shown in FIG. 7, the public key of the certificate authority is acquired. FIG. 7 is a diagram for explaining processing for obtaining the public key of the certificate authority.

  In FIG. 7, the authentication service 3 is certified as a valid certificate authority by the trusted root certification authority 4r via the intermediate certificate authority 4, and obtains the public key of the certificate authority from the intermediate certificate authority 4, whereby the authentication service 3 3 proves the authenticity of the client certificate issued by

  Next, a service application sequence related to service application from each organization to the authentication service 3 will be described with reference to FIGS. In FIG. 8 and FIG. 9, the case where the organization A applies for a service will be described.

  FIG. 8 is a diagram for explaining the service application process. In FIG. 8, the organization A administrator transmits a service application from the organization A administrator terminal 61a to the authentication service server 100 (step S11). The service application includes the URL of the organization A repository server 8a.

  In the authentication service server 100, when the service portal 171 receives a service application from the organization A administrator terminal 61a, the organization registration information of the organization A is added to the organization information table 135 via the database server 173, and the repository address information is authenticated by the organization. Stored in the information table 134. The repository address information indicates the URL of the organization A repository server 8a.

  The organization A repository server 8a specified by the repository address information is connected to the authentication service server 100 (step S12). When the connection is completed, the service portal 171 of the authentication service server 100 transmits a service application completion notification to the organization A administrator. Notification of service application completion may be made by e-mail. The organization A administrator receives a notification of service application completion at the organization A administrator terminal 61a.

  FIG. 9 is a diagram showing a service application sequence. In FIG. 9, when the service portal 171 of the authentication service server 100 receives a service application from the organization A administrator terminal 61a (step S21), the service portal 171 checks the contents of the service application (step S22). Based on the contents of the service application, the organization information is registered in the organization information table 135 via the database server 173 (step S23).

  The service portal 171 generates an organization ID for the organization A, stores the generated organization ID and organization information in the organization information table 135, and sets the status during registration. Further, the service portal 171 stores the repository information of the organization repository server 8 in the organization authentication information table 134 based on the contents of the service application, and service server information such as the URL of the service server 9 used by the organization A. Stored in the service information table 136.

  The service portal 171 transmits an application reception email to the authentication service manager (step S24). When the authentication service manager receives the application acceptance mail at the authentication service manager terminal 5 (step S25), the authentication service manager performs a connection operation with the organization A repository (step S26). When the connection work is completed, the authentication service manager inputs setting completion to the service portal 171 from the authentication service manager terminal 5 (step S27).

  On the other hand, the service portal 171 transmits a reception completion to the organization A administrator after transmitting the application reception mail to the authentication service manager in step S24 (step S28). When the setting completion is received from the authentication service administrator terminal 5 (step S29), the service portal 171 changes the status of the organization A in the organization information table 135 to registered (step S30), and applies to the organization A administrator. A completion mail is transmitted (step S31).

  Registration of organization A is completed by the service application sequence described above. Other organizations are registered by the same process.

  Next, a client certificate issuance sequence by registration of users belonging to an organization will be described with reference to FIGS. FIG. 10 is a diagram for explaining the client certificate issuing process.

  In FIG. 10, the service portal 171 of the authentication service server 100 receives the certificate issuance application for the user of the organization A from the organization A administrator terminal 61a (step S41). The certificate issuance application for the user of the organization A includes the organization ID and the user ID of the organization A.

  The service portal 171 acquires the repository address information of the organization A from the organization authentication information table 134 via the database server 173 and is designated by the received certificate issuance request of the user of the organization A from the organization A repository server 8a. The user information of the current user is acquired (step S42). The service portal 171 newly registers an organization ID, subscriber ID, and user registration information including user information in the subscriber information table 133 via the database server 173.

  When the user information is acquired, the service portal 171 applies a client certificate issuance application to the registration authority 41 of the intermediate authentication authority 4 via the cooperation server 172 (step S43). The client certificate issuance application includes an organization ID.

  In the intermediate certificate authority 4, the registration authority 41 examines the owner information provided by the organization A administrator who is the applicant for the electronic certificate, based on the contents of the client certificate issuance application. After examining the owner information, the registration authority 41 makes a request for issuing a client certificate to the issuing authority 42. The issuing authority 42 generates a client certificate that is an electronic certificate and stores information related to the client certificate in the repository 43. The client certificate is X. In accordance with the 509 certificate, the organization ID is set in the extended area.

  The registration authority 41 transmits a client certificate including the organization ID generated by the issuing authority 42 to the service portal 171 of the authentication service server 100 via the cooperation server 172 (step S44).

  The service portal 171 requests the authentication service administrator to issue the user's ID card. When the authentication service administrator receives the user's ID card issuance request at the authentication service administrator terminal 5, the service ID 171 Is issued (step S45). The user's ID card is mailed to the organization A manager (step S46).

  The mailed ID card is distributed to users in the organization A, and the user can receive a service from the service server 9 after authentication by the authentication service 3 using the ID card. The ID card has an organization ID X. The client certificate stored in the extension area of the 509 certificate and the user ID are stored. Instead of the ID card, the organization ID is X. An ID data file storing a client certificate and a user ID stored in the extended area of the 509 certificate may be provided from the authentication service 3 to the organization A.

  FIG. 11 is a diagram showing a client certificate issuing sequence. In FIG. 11, the service portal 171 of the authentication service server 100 receives a client certificate issuance application for a user in the organization from the organization A administrator terminal 61a (step S51).

  The service portal 171 checks the contents of the client certificate issuance application, and acquires the user information of the user specified in the issuance application from the organization A repository server 8a (step S53). The service portal 171 acquires the repository address information by referring to the organization authentication information table 134 using the organization ID of the organization A, and can access the organization A repository server 8a.

  The service portal 171 registers the organization ID, the user ID specified in the issuance application form, and the user information acquired from the organization A repository server 8a in the subscriber information table 133 via the database server 173 (step S54). Set the status during registration.

  Next, the service portal 171 generates a client certificate issuance request (step S55). The service portal 171 requests the database server 173 to acquire the organization ID from the subscriber ID record that matches the user ID specified in the issuance application in the subscriber information table 133, and acquires the organization ID. The service portal 171 uses the acquired organization ID as an X. 509 is set in the extension area of the certificate.

  Then, the service portal 171 transmits a client certificate issuance request to the intermediate certificate authority 4 via the cooperation server 172 (step S57). X. with an organization ID set in the extended area. A 509 certificate is provided to the intermediate certificate authority 4.

  In the intermediate certificate authority 4, when the registration authority 41 receives a client certificate issuance request from the authentication service server 100, the registration authority 41 performs a client certificate issuance process (step S58). The registration authority 41 requests the issuing authority 42 to issue a client certificate for the user of the organization A.

  Issuing station 42 has the X.X with the organization ID set in the extension area. The client certificate is issued using the 509 certificate, the issued client certificate is stored in the repository 43, and provided to the registration authority 41. A public key used when authenticating the user with the organization A user terminal 62 a is generated and registered in the repository 43.

  The registration authority 41 provides the service portal 171 with the notification of the completion of setting including the client certificate including the user ID and the organization ID set in the extension area, issued by the issuing authority 42 (step). S59).

  On the other hand, after making a request for issuing a client certificate to the intermediate certificate authority 4, the service portal 171 notifies the organization A administrator of the completion of acceptance. Notification of acceptance completion may be made by e-mail. The organization A administrator receives a notification of acceptance completion at the organization A administrator terminal 62a.

  When the notification of the completion of setting is received from the intermediate certificate authority 4 (step S61), a record in which the organization ID specified in the issuance application matches the subscriber ID in the subscriber information table 133 via the database server 173. Is changed to registered (step S62).

  Thereafter, the service portal 171 requests the authentication service administrator to send a client certificate (step S63). The request for sending the client certificate may be made by e-mail. A client certificate is attached to the e-mail.

  The service manager receives the client certificate sending request at the authentication service manager terminal 5 (step S64), and acquires the client certificate. The service administrator has an organization ID X. An ID card storing the client certificate stored in the extended area of the 509 certificate and the user ID is created and sent to the organization A administrator (step S65). Organization ID is X. An ID data file storing a client certificate and a user ID stored in the extended area of the 509 certificate may be provided from the authentication service 3 to the organization A.

  Users belonging to the organization A can receive a service from the service server 9 after authentication by the authentication service 3 using an ID card or an ID data file.

  FIG. 12 is a diagram showing a format of a client certificate. In FIG. It conforms to 509 certificate, and has pre-signature certificate, signature algorithm, and signature value areas.

  The pre-signature certificate area includes version, serial number, algorithm identifier, issuer, validity period, start time, end time, subject, subject public key information, algorithm, subject public key, issuer unique identifier, And the subject unique identifier, and the area of the pre-signature certificate has an extension area 69. The extension area 69 is an area added in version 3 and is used in this embodiment.

  In the present embodiment, by storing the organization ID in the extended area 69, the user can save time and effort for inputting the organization ID every time authentication is performed. Further, since the authentication service server 100 can acquire the organization ID from the client certificate, the organization repository server 8 can be specified.

  FIG. 13 is a diagram for explaining the authentication process. In FIG. 13, the user of the organization A accesses the service server 9 to receive a desired service from the organization A user terminal 62a (step S71). This site access is redirected to the authentication service server 100.

  The service portal 171 of the authentication service server 100 makes an authentication request to the organization A user terminal 62a in response to the redirected site access (step S72). An authentication screen is displayed on the organization A user terminal 62a, and the organization A user inputs a user ID and a password. The organization A user may input the user ID and password that have been used in the organization. The user ID and password input by the organization A user are encrypted with the client certificate and transmitted to the authentication service server 100. SSO can be realized by using SAML (Security Assertion Markup Language) OpenID Connect or the like for the authentication protocol.

  The service portal 171 of the authentication service server 100 decrypts the client certificate with the public key of the certificate authority, acquires the user ID and password, and acquires the organization ID from the extended area of the client certificate (step S73). .

  In step S73, the service portal 171 requests repository address information from the organization authentication information table 134 to the database server 173 using the organization ID. When the repository address information is acquired from the database server 173, the service portal 171 transmits the user ID and password received from the organization A user terminal 62a to the organization A repository server 8a via the cooperation server 172, and the organization A repository server Request authentication by user ID and password to 8a. The organization A repository server 8a performs an authentication process with the user ID and password received from the authentication service server 100, and transmits the authentication result to the authentication service server 100.

  The service portal 171 of the authentication service server 100 transmits the authentication result to the service server 9 via the organization A user terminal 62a (step S75). When the authentication result indicates that the authentication is successful, the service server 9 transmits a service use screen to the organization A user terminal 62a, and the use of the service by the organization A user is started (step S76). When the authentication result indicates an authentication failure, the service server 9 notifies the organization A user terminal 62a that the authentication has failed.

  FIG. 14 is a diagram showing an authentication sequence. In FIG. 14, when the service server 9 detects site access from the organization A user terminal 62a (step S81), the service server 9 transmits an authentication redirect request to the organization A user terminal 62a (step S82). The authentication redirect request includes a Redirect URL specifying the service portal 171 of the authentication service server 100 as a redirect destination.

  In the organization A user terminal 62a, the site access to the service site 9 is redirected to the service portal 171 of the authentication service server 100 by the Redirect URL (step S83).

  The service portal 171 acquires authentication information (user ID and password) of the organization A user from the organization A user terminal 62a in response to the redirect. The authentication information of the organization A user is guaranteed by the client certificate. The service portal 171 checks the session ID, organization ID, remote IP address, and the like (step S84). The service portal 171 acquires the user ID and password by decrypting the client certificate with the public key of the certificate authority.

  Then, the service portal 171 makes an acquisition request for the authentication policy of the organization A specifying the organization ID set in the extension area of the client certificate to the database server 173 (step S85).

  The database server 173 acquires the authentication policy information from the record that matches the organization ID specified in the authentication policy acquisition request in the organization authentication information table 134, and transmits it to the service portal 171 (step S86).

  The service portal 171 starts authentication of the organization A user (step S87), and transmits an authentication request specifying the user ID and password received from the organization A user terminal 62a to the organization A repository server 8a (step S88).

  In response to the authentication request, the organization A repository server 8a executes an authentication process using the user ID and password specified in the authentication request (step S90), and transmits an authentication response indicating the authentication result to the service portal 171. (Step S91). When the service portal 171 receives the authentication response via the cooperation server 172, the service portal 171 transmits a response to which the authentication result is given and redirected to the organization A user terminal 62a (step S92).

  The service server 9 receives the authentication result redirected from the organization A user terminal 62a (step S93). When the authentication result indicates that the authentication is successful, the service server 9 notifies the organization A user terminal 61a of the start of service use for the site access in step S81 (step S94). The organization A user of the organization A user terminal 61a can use the service of the service server 9. On the other hand, when the authentication result indicates an authentication failure, the service server 9 does not permit the use of the service to the organization A user.

  In the above description, the organization A has been described as an example. Similarly, the organization repository server 8 for each organization can be specified for each other organization, and the input of the organization ID by the user can be omitted. Convenience during authentication can be improved.

  In the present embodiment, in a service usage mode in which one or more services are provided across organizations, the authentication service server provides the authentication service 3 to a plurality of organizations, and the in-organization authentication server unique to the organization in the course of authentication When authentication is required, it is possible to save the labor of inputting the organization ID for specifying the organization to which the user belongs with a simple configuration. In addition, SSO can be realized without any change from when authentication was performed in the organization.

  The present invention is not limited to the specifically disclosed embodiments, and various modifications and changes can be made without departing from the scope of the claims.

The following additional notes are further disclosed with respect to the embodiment including the above examples.
(Appendix 1)
A storage unit that stores a user ID of a user belonging to the organization and authentication server identification information of an authentication server in the organization in which authentication information of each user included in the organization is managed in association with the organization ID of the organization Remember
Upon receiving a certificate issuance request for the user, a certificate issuance request including the organization ID is made to the certificate authority, and when the certificate including the organization ID is received from the certificate authority, the user receives the certificate Issue a certificate,
A process for connecting to an authentication server in the organization of the organization based on the organization ID included in the certificate received in response to an authentication request from the user terminal of the user and performing authentication by the authentication server Authentication service method performed by.
(Appendix 2)
The authentication service method according to appendix 1, wherein the computer performs a process of setting the organization ID in an extension area of a standard specification of the certificate and making the issue request to the certificate authority.
(Appendix 3)
When an authentication request is received by a redirect by a service server for access from the user terminal, the authentication information is requested from the user terminal, and the certificate including the organization ID and the authentication information are received from the user terminal. And
The computer uses the organization ID in the certificate to acquire the authentication server identification information from the storage unit and cause the authentication server to authenticate the user with the authentication information acquired from the user terminal. The authentication service method according to Supplementary Note 1 or 2, wherein the authentication service method is performed.
(Appendix 4)
Receiving the authentication result from the authentication server;
The authentication service method according to claim 3, wherein the computer performs a process of transmitting the authentication result to the service server via the user terminal by redirection.
(Appendix 5)
In association with the organization ID of the organization, a user ID of a user belonging to the organization and authentication server identification information of an authentication server in the organization that manages authentication information of each user included in the organization are stored. A storage unit;
Upon receiving a certificate issuance request for the user, a certificate issuance request including the organization ID is made to the certificate authority, and when the certificate including the organization ID is received from the certificate authority, the user receives the certificate A certificate issuing unit for issuing a certificate;
Based on an organization ID included in the certificate received in response to an authentication request from the user terminal of the user, a user authentication unit that connects to an authentication server in the organization of the organization and performs authentication by the authentication server When,
An authentication service server.
(Appendix 6)
An authentication server in the organization that manages authentication information of users belonging to each of a plurality of organizations;
A certificate authority issuing a certificate certifying the legitimacy of the user belonging to the organization;
An authentication service server for authenticating the user,
The authentication service server
In association with the organization ID of each organization, a user ID of a user belonging to the organization and authentication server identification information of an authentication server in the organization in which authentication information of each user included in the organization is managed are stored A storage unit to
When a certificate issuance request is received for the user, a certificate issuance request including an organization ID is made to the certificate authority, and a certificate containing an organization ID is received from the certificate authority. A certificate issuing unit that issues the certificate;
By referring to the storage unit, an authentication server associated with the organization ID included in the certificate received in response to an authentication request from the user terminal of the user is connected, and authentication by the authentication server is performed. A user authentication unit to perform;
An authentication service system.
(Appendix 7)
The authentication service server
The authentication service system according to appendix 6, wherein the authentication server is connected to the authentication server associated with an organization ID of an organization to which the user belongs, instead of one or more service servers used by the plurality of organizations.
(Appendix 8)
In association with the organization ID of the organization, a user ID of a user belonging to the organization and authentication server identification information of an authentication server in the organization that manages authentication information of each user included in the organization are stored. ,
Upon receiving a certificate issuance request for the user, a certificate issuance request including the organization ID is made to the certificate authority, and when the certificate including the organization ID is received from the certificate authority, the user receives the certificate Issue a certificate,
A process for connecting to an authentication server in the organization of the organization based on the organization ID included in the certificate received in response to an authentication request from the user terminal of the user and performing authentication by the authentication server Authentication service program to be performed.

2 Internet (or leased line)
3 Authentication Service 4 Intermediate Certificate Authority 4r Root Certification Authority 5 Authentication Service Administrator Terminal 8 Organization Repository Server 9 Service Server 11 CPU 12 Main Storage Device 13 Auxiliary Storage Device 14 Input Device 15 Display Device 17 Communication I / F
18 drive, 19 storage medium 41 registration authority (RA), 42 issuance authority (IA)
43 repository 61 organization administrator terminal 62 organization user terminal 100 authentication service server 131 authority master 132 organization billing destination information table 133 subscriber information table 134 organization authentication information table 135 organization information table 136 service information table 171 service portal ( Web server)
172 Cooperation server, 173 Database server

Claims (5)

A storage unit that stores a user ID of a user belonging to the organization and authentication server identification information of an authentication server in the organization in which authentication information of each user included in the organization is managed in association with the organization ID of the organization Remember
Upon receiving a certificate issuance request for the user, a certificate issuance request including the organization ID is made to the certificate authority, and when the certificate including the organization ID is received from the certificate authority, the user receives the certificate Issue a certificate,
A process for connecting to an authentication server in the organization of the organization based on the organization ID included in the certificate received in response to an authentication request from the user terminal of the user and performing authentication by the authentication server Authentication service method performed by.   2. The authentication service method according to claim 1, wherein the computer performs a process of setting the organization ID in an extension area of a standard specification of the certificate and making the issue request to the certificate authority. When an authentication request is received by a redirect by a service server for access from the user terminal, the authentication information is requested from the user terminal, and the certificate including the organization ID and the authentication information are received from the user terminal. And
The computer uses the organization ID in the certificate to acquire the authentication server identification information from the storage unit and cause the authentication server to authenticate the user with the authentication information acquired from the user terminal. The authentication service method according to claim 1, wherein the authentication service method is performed. In association with the organization ID of the organization, a user ID of a user belonging to the organization and authentication server identification information of an authentication server in the organization that manages authentication information of each user included in the organization are stored. A storage unit;
Upon receiving a certificate issuance request for the user, a certificate issuance request including the organization ID is made to the certificate authority, and when the certificate including the organization ID is received from the certificate authority, the user receives the certificate A certificate issuing unit for issuing a certificate;
Based on an organization ID included in the certificate received in response to an authentication request from the user terminal of the user, a user authentication unit that connects to an authentication server in the organization of the organization and performs authentication by the authentication server When,
An authentication service server. An authentication server in the organization that manages authentication information of users belonging to each of a plurality of organizations;
A certificate authority issuing a certificate certifying the legitimacy of the user belonging to the organization;
An authentication service server for authenticating the user,
The authentication service server
In association with the organization ID of each organization, a user ID of a user belonging to the organization and authentication server identification information of an authentication server in the organization in which authentication information of each user included in the organization is managed are stored A storage unit
When a certificate issuance request is received for the user, a certificate issuance request including an organization ID is made to the certificate authority, and a certificate containing an organization ID is received from the certificate authority. A certificate issuing unit that issues the certificate;
By referring to the storage unit, an authentication server associated with the organization ID included in the certificate received in response to an authentication request from the user terminal of the user is connected, and authentication by the authentication server is performed. A user authentication unit to perform;
An authentication service system.

Images