JP2023034929A - Information processing device, information processing system, information processing method, and program - Google Patents

Abstract

To prevent the same user authenticated by different authentication services from being treated as another user.SOLUTION: An information processing device for using different authentication services in order to authenticate a user using a plurality of applications includes: a first communication part for receiving user information of the user from an authentication server which authenticates the user; a verification part for determining that a first user and a second user are the same user in the case that a content of a predetermined item of user information of the first user using a first application and the second user using a second application is the same; and an integration part for generating integrated user information obtained by integrating the first user information and the second user information of the same user in order to use the first application and the second application as the same user.SELECTED DRAWING: Figure 3

Description

The present invention relates to an information processing device, an information processing system, an information processing method, and a program.

In recent years, various applications and services have been provided in in-house networks and cloud networks, and users may be given user information such as different user names for each application, service, or authentication service. Here, when using a function that links applications and services, it is necessary to have a mechanism that allows users to be treated as the same user even if the user information such as the user name is different. Patent Literature 1 discloses a technique of performing authentication as the same user even with different user names (individual names) using information that integrates user names (individual names) of different authentication services for the same user. .

However, in the conventional technology, in order to handle users authenticated by different authentication services as the same user, there is a problem that it is necessary to integrate user information of the same user in each authentication service in advance.

In view of the above problems, the embodiments of the present invention prevent the same user authenticated by different authentication services from being treated as a different user without creating in advance information integrating user information of the same user in different authentication services. intended to avoid.

In order to solve the above-described problems, the present invention provides an information processing apparatus that uses different authentication services to authenticate a user who uses a plurality of applications, wherein an authentication server that authenticates the user authenticates the user. When the content of the predetermined items of the user information of the first communication unit that receives the information, the first user using the first application, and the second user using the second application are the same, a verification unit that assumes that the first user and the second user are the same user; and an integration unit that generates integrated user information by integrating information.

According to the embodiment of the present invention, users in different authentication services can be treated as the same user without creating in advance information integrating user information in different authentication services of the same user.

BRIEF DESCRIPTION OF THE DRAWINGS It is a figure which shows an example of the schematic diagram of the information processing system which concerns on embodiment of this invention. It is a figure showing an example of hardware constitutions, such as a server device concerning an embodiment of the present invention. It is a figure showing an example of the lineblock diagram of the functional block of the information processing system concerning the embodiment of the present invention. It is a figure which shows an example of the user information which concerns on embodiment of this invention. It is a figure which shows an example of the integrated setting which concerns on embodiment of this invention. It is a figure which shows an example of the integrated user information which concerns on embodiment of this invention. It is a figure which shows an example of the flowchart of the integrated authentication process which concerns on embodiment of this invention. FIG. 7 is a diagram showing an example of a password display screen for integrated authentication according to the embodiment of the present invention; FIG. 7 is a diagram showing an example of a password request screen for integrated authentication according to the embodiment of the present invention; It is a figure which shows an example of the mail document containing URL which concerns on embodiment of this invention. It is a figure which shows an example of the sequence of the integrated authentication process which concerns on embodiment of this invention. It is a figure which shows an example of the menu screen which concerns on embodiment of this invention. It is a figure which shows an example of the authentication information input screen which concerns on embodiment of this invention. It is a figure which shows an example (2) of integrated user information which concerns on embodiment of this invention. It is a figure which shows an example (3) of integrated user information which concerns on embodiment of this invention. FIG. 5 is a diagram showing an example of a screen of application B (storage service) according to the embodiment of the present invention; It is a figure which shows an example of ID token based on embodiment of this invention.

Hereinafter, embodiments of an information processing apparatus, an information processing system, an information processing method, and a program according to the present invention will be described in detail with reference to the accompanying drawings.

[First Embodiment]
<System overview>
FIG. 1 is a diagram showing an example of a schematic diagram of an information processing system according to an embodiment of the present invention. In an information processing system 5 shown in FIG. 1, terminal devices 4 (4A, 4B, . . . ), an integrated authentication server 2, and an authentication server 3 (3A, 3B, . An application server 6 is connected to the integrated authentication server 2 . The integrated authentication server 2 also includes a storage device 10 having a user information storage unit 7 , an integrated setting storage unit 8 , and an integrated user information storage unit 9 . The terminal device 4 may be a notebook computer, a desktop computer, a tablet terminal, a smartphone, or the like. Details of each storage unit included in the storage device 10 will be described later.

The user operates the terminal device 4 to access the integrated authentication server 2 via the communication network 1 in order to request use of the application (application A) provided by the application server 6 . The integrated authentication server 2 causes the authentication server 3 to perform user authentication corresponding to the application (application A) that the user requests to use. When user authentication succeeds, the integrated authentication server 2 issues user verification information (password or access information) for verifying whether the user is the same, and furthermore, information about the user (user name, home directory, etc.) is stored in the integrated user information storage unit 9 . Next, when the same user requests the use of another application (application B), the integrated authentication server 2 causes the authentication server 3 to perform user authentication corresponding to the application B. FIG. After that, the integrated authentication server 2 uses the user verification information to verify whether or not the users who requested to use the applications A and B are the same user. When the user verification is successful, the integrated authentication server 2 updates the information stored in the integrated user information storage unit 9 using the information about the user acquired at the time of user authentication when using the application B.

These processes enable the user to execute application A and application B as the same user. For example, assuming that application A is a document creation application and application B is a storage service, the integrated user information storage unit 9 includes the storage location (home directory, etc.) as the user information of application B. FIG. Therefore, the user can save the document file created by the application A in the storage provided by the application B. FIG.

That is, when a user uses a plurality of applications, the information processing system 5 performs user verification for verifying whether or not users of different authentication services are the same user, and generation of integrated user information shared between applications. conduct.

Also, the configuration of the information processing system 5 shown in FIG. 1 is an example, and other configurations may be used. For example, the application server 6 may be included inside the integrated authentication server 2 or connected to the communication network 1 . Also, the authentication server 3 may be configured to be connected to the integrated authentication server 2 . Also, hereinafter, the application may be simply abbreviated as an application.

<Hardware configuration example>
FIG. 2 is a diagram showing an example of a hardware configuration of a server device (integrated authentication server 2, authentication server 3, application server 6, terminal device 4) etc. according to the embodiment of the present invention. As shown in FIG. 2, the server device or the like is constructed by a computer, and includes a CPU 501, a ROM 502, a RAM 503, a HD (Hard Disk) 504, a HDD (Hard Disk Drive) controller 505, a display 506, and an external device connection I/F. (Interface) 508 , network I/F 509 , bus line 510 , keyboard 511 , pointing device 512 , DVD-RW (Digital Versatile Disk Rewritable) drive 514 , and media I/F 516 .

Among these, the CPU 501 controls the overall operation of the server device and the like. The ROM 502 stores programs used to drive the CPU 501 such as IPL. A RAM 503 is used as a work area for the CPU 501 . The HD 504 stores various data such as programs. The HDD controller 505 controls reading or writing of various data to/from the HD 504 under the control of the CPU 501 . A display 506 displays various information such as cursors, menus, windows, characters, or images. The external device connection I/F 508 is an interface for connecting various external devices. The external device in this case is, for example, a USB (Universal Serial Bus) memory, a printer, or the like. A network I/F 509 is an interface for data communication using the network N2. A bus line 510 is an address bus, a data bus, or the like for electrically connecting each component such as the CPU 501 shown in FIG.

Also, the keyboard 511 is a type of input means having a plurality of keys used for inputting characters, numerical values, various instructions, and the like. A pointing device 512 is a kind of input means for selecting and executing various instructions, selecting a processing target, moving a cursor, and the like. A DVD-RW drive 514 controls reading or writing of various data to a DVD-RW 513 as an example of a removable recording medium. The DVD-RW drive 514 is not limited to DVD-RW, and may be DVD-R or the like. A media I/F 516 controls reading or writing (storage) of data to a recording medium 515 such as a flash memory.

<About functions>
FIG. 3 is a diagram showing an example of a configuration diagram of functional blocks of the information processing system 5 according to the embodiment of the present invention.

The integrated authentication server 2 has a verification section 20 , an integration section 21 and a first communication section 22 . These units are functions or means implemented by the CPU 501 executing commands included in one or more programs installed in the integrated authentication server 2 . The integrated authentication server 2 also includes a storage device 10 . The storage device 10 has a user information storage section 7 , an integrated setting storage section 8 and an integrated user information storage section 9 .

The verification unit 20 verifies whether users of different authentication services are the same user. The verification unit 20 first verifies whether the authenticated user is the same as the already registered user by using the user information acquired at the time of user authentication and the integration setting that is the rule for user integration. Further, the verification unit 20 verifies the user by a method of using a password for user verification (password method) or a method of sending access information such as a URL to the user's mail address (mail method).

In the case of the password method, the verification unit 20 issues a password for use in verification and notifies the user when authenticating the user for the first time. Next, when the same user is authenticated by another authentication method, the verification unit 20 requests a password from the user and confirms whether or not the issued password and the received password match. Run validation.

In the case of the email method, when the user is first authenticated, the verification unit 20 issues access information such as a URL (Uniform Resource Locator) for use in verification, and sends an email containing the issued URL to the user's email address. Send documents. Furthermore, the verification unit 20 verifies the user by confirming whether the user has accessed the URL within a predetermined period of time. Next, when the same user is authenticated by another authentication method, the verification unit 20 also sends an e-mail document containing the issued URL to the user's e-mail address, and the user confirms the URL within a predetermined time. User verification is performed by checking whether or not access has occurred.

The integration unit 21 integrates user information of the same user successfully authenticated by different authentication services, and stores the information in the integrated user information storage unit 9 . First, the integration unit 21 adds the information of the authentication service to the user information of the user authenticated by the first authentication service to obtain integrated user information. Next, when integrating the user information of the same user authenticated by the second authentication service into the integrated user information, the integration unit 21 integrates the information of the second authentication service and the first user information that is not included in the first user information. The information in the user information of 2 is integrated into the integrated user information. Here, integrating the second user information with the integrated user information that includes only the first user information may be called integrating the first user information and the second user information.

The first communication unit 22 is a communication function that the integrated authentication server 2 has, and performs information transmission/reception with the third communication unit 42 of the terminal device 4 via the communication network 1, for example.

The control unit 23 controls various processes executed within the integrated authentication server 2 .

The user information storage unit 7 stores user information about users who have been successfully authenticated. FIG. 4 is a diagram showing an example of user information according to the embodiment of the present invention. User information 100 shown in FIG. 4 has items of line number 101 , authentication service 102 , user name 103 , user alternate name 104 , display name 105 , group name 106 , mail address 107 , and home directory 108 . The user information 100 may have different information items depending on the type of the authentication service 102 . For example, if the authentication service 102 is LDAP, it does not have information about entries in the home directory 108 . Each item will be described below.

A line number 101 is a line number in the user information 100 .

The authentication service 102 is a type of authentication service used in the authentication server 3, and includes types such as LDAP (Lightweight Directory Access Protocol), Kerberos, and OpenID Connect.

The user name 103 is the name of the user, and is information used as authentication information along with the password when authenticating the user.

A user alternate name 104 is another username that can be used as an alternate username.

The display name 105 is the name of the user displayed on the application screen or the like.

Group name 106 is the name of the group to which the user belongs.

The email address 107 is the email address of the user.

A home directory 108 is a storage location where files owned by a user can be stored.

Returning to FIG. 3, description will be made.

The integration setting storage unit 8 stores settings (referred to as integration settings) used when verifying whether or not the user information 100 of users of different authentication services is information of the same user and integrating the information. FIG. 5 is a diagram showing an example of integrated settings according to the embodiment of the present invention. The integrated setting 110 shown in FIG. 5 has items of an integrated setting ID 111 , an integrated authentication service 112 , and a verification item 113 .

The integration setting ID 111 is an ID for specifying integration settings. ID is an abbreviation for Identification. Here, a three-digit number is used as the integrated setting ID. Henceforth, ID is used by the same meaning.

Integrated authentication service 112 is the name of each of the two authentication services that integrate user information 100 .

The verification item 113 is an item to be verified when judging whether the user information of the same user is for users of different authentication services. For example, in the integrated setting with the integrated setting ID 111 of "001", whether or not the user information 100 of the same user is determined by whether or not the user name 103 in the user information 100 of the integrated authentication service LDAP and Kerberos match. or verification. Here, it is assumed that not the user name 103 but the user alternate name 104 may match. That is, if the user name 103 or user alternate name 104 of the first authentication service matches the user name 103 or user alternate name 104 of the second authentication service, it is assumed that the user information 100 belongs to the same user. Similarly, in the integrated setting with the integrated setting ID 111 of "002", whether or not the user information 100 of the same user is identified by whether the items of the mail address 107 in the user information 100 of the integrated authentication service LDAP and OpenID Connect match. Validate.

Returning to FIG. 3, description will be made.

The integrated user information storage unit 9 stores integrated user information 120 that integrates user information 100 of users of different authentication services. By integrating the user information 100, for example, even if there are items that are not set in the user information 100 of the first authentication service, they are set by the user information 100 of the second authentication service. By using the integrated user information 120, it becomes possible to share the user information of the same user between a plurality of applications. FIG. 6 is a diagram showing an example of integrated user information according to the embodiment of the present invention. Integrated user information 120 shown in FIG. 6 has items of integrated user ID 121 , authentication service 122 , user name 123 , user alternative name 124 , display name 125 , group name 126 , mail address 127 , and home directory 128 .

The integrated user ID 121 is an ID that identifies the integrated user information 120 of the same user that integrates the user information 100 of users of different authentication services.

The authentication service 122 is an authentication service for the user information 100 registered in the integrated user information 120. If there are multiple authentication services, all of them are described. The user information 100 of the three authentication services 122 is integrated into the integrated user information 120 with the integrated user ID 121 of "001".

The user name 123 is the same information as the user name 103 in the user information 100 of the integrated user, but may be the user alternate name 124 in some cases.

The user alternate name 124 is the same information as the user alternate name 104 in the user information 100 of the integrated user, but may be the user name 103 in some cases.

The display name 125 is the same information as the display name 105 in the user information 100 of the integrated user.

The group name 126 is the same information as the group name 106 in the user information 100 of the integrated users.

The mail address 127 is the same information as the mail address 107 in the user information 100 of the integrated user.

The home directory 128 is the same information as the home directory 108 in the user information 100 of the integrated user.

Here, information other than these items (telephone number, etc.) may be used as items of the user information 100 and the integrated user information 120 . Also, when the authentication service is OpenID Connect, the token ID obtained at the time of authentication may be used as items of the user information 100 and the integrated user information 120 . FIG. 17 is a diagram showing an example of an ID token according to the embodiment of the invention. FIG. 17 shows an ID token 150 obtained when user authentication is performed using OpenID Connect. In the ID token 150, the left side of the string delimited by ":" indicates the item, and the right side indicates its value.

Returning to FIG. 3, description will be made.

The authentication server 3 has an authentication section 30 and a second communication section 31 . These units are functions or means realized by the CPU 501 executing commands included in one or more programs installed in the authentication server 3 .

The authentication unit 30 confirms whether or not the authentication information (user name and password) input by the user received from the terminal device 4 matches the authentication information held by the authentication server 3, thereby performing user authentication. to run.

The second communication unit 31 is a communication function that the authentication server 3 has, and performs information transmission/reception with the first communication unit 22 of the integrated authentication server 2 via the communication network 1, for example.

The terminal device 4 has a display control section 40 , an operation reception section 41 and a third communication section 42 . These units are functions or means implemented by the CPU 501 executing instructions included in one or more programs installed in the terminal device 4 .

The display control unit 40 displays image information such as a menu screen and an authentication screen on the screen of the terminal device 4 .

The operation reception unit 41 receives operations such as character input and button depression by the user via the keyboard and pointing device of the terminal device 4 .

The third communication unit 42 is a communication function that the terminal device 4 has and, for example, transmits and receives information to and from the first communication unit 22 of the integrated authentication server 2 via the communication network 1 .

<Flowchart of integrated authentication processing>
FIG. 7 is a diagram showing an example of a flowchart of integrated authentication processing according to the embodiment of the present invention. Upon receiving an application usage request from a user, the integrated authentication server 2 causes the authentication server 3 corresponding to the application to perform user authentication, and registers the acquired user information. At this time, for a registered user who is already running another application, the integrated authentication server 2 performs user verification to verify whether the user is the same user, and then transfers the integrated user information 120 between applications. share with Processing of each step will be described below.

Step S81: The authentication unit 30 of the authentication server 3 authenticates the user who sent the application use request. Authentication is performed by confirming whether or not the authentication information (user name and password) sent by the user matches the authentication information held by the authentication server 3 .

Step S82: The control unit 23 of the integrated authentication server 2 shifts the process to step S83 if the user authentication in step S81 is successful, otherwise shifts the process to step S91.

Step S<b>83 : The first communication unit 22 of the integrated authentication server 2 acquires the user information 100 of the authenticated user from the authentication server 3 .

Step S84: If the same information as the user information 100 acquired in step S83 is not stored in the user information storage unit 7, the verification unit 20 of the integrated authentication server 2 stores the acquired user information in the user information storage unit 7. be memorized. Next, the verification unit 20 of the integrated authentication server 2 uses the integrated settings 110 to verify whether the acquired user information 100 is stored as the integrated user information 120 in the integrated user information storage unit 9 . That is, the following two points corresponding to the integrated setting 110 are confirmed, and if any one of them matches, the user information 100 is already registered in the integrated user information storage unit 9 (the user has been registered).
• Whether the user name 103 or user alternate name 104 in the acquired user information 100 matches the user name 123 or user alternate name 124 in the integrated user information 120 . (Verification corresponding to "001" of integrated setting ID 111)
・Does the mail address 107 in the acquired user information 100 match the mail address 127 in the integrated user information 120? (Verification corresponding to "002" of integrated setting ID 111)
Alternatively, the verification unit 20 determines whether the user (user information 100) is registered based on whether or not the contents of the items predetermined by the administrator match in the items of the user information 100 obtained at the time of user authentication and the integrated user information 120. may decide whether it has been completed.

If the user has already been registered, the control unit 23 of the integrated authentication server 2 shifts the process to step S85; otherwise, shifts the process to step S86.

Step S85: The integration unit 21 of the integrated authentication server 2 records the acquired user information 100 in the integrated user information storage unit 9 in order to register the user authenticated in step S81 as a new user. Further, the verification unit 20 of the integrated authentication server 2 thereafter issues user verification information (password or access information) for verifying whether the users in different authentication services are the same user. There are two verification methods: a method using a password for user verification (password method) and a method of sending access information such as a URL to the user's e-mail address (email method).

In the case of the password method, first, the verification unit 20 of the integrated authentication server 2 issues a password used for verification. Next, the first communication unit 22 of the integrated authentication server 2 transmits the issued password to the terminal device 4 of the user and displays the password on the screen. FIG. 8 is a diagram showing an example of a password display screen for integrated authentication according to the embodiment of the present invention. An integrated authentication password 141 is displayed on the password display screen 140 shown in FIG. When the user executes another application (that is, executes user authentication with another authentication service), the verification unit 20 of the integrated authentication server 2 uses this password to verify the user. FIG. 9 is a diagram showing an example of a password request screen for integrated authentication according to the embodiment of the present invention. A password request screen 142 shown in FIG. 9 displays an authentication password input field 143 and a confirmation button 144 for confirming and transmitting the entered password.

Returning to FIG. 7, description will be made.

In the case of the email method, first, the verification unit 20 of the integrated authentication server 2 issues access information such as a URL (Uniform Resource Locator) used for verification. Next, the first communication unit 22 of the integrated authentication server 2 transmits the issued URL to the user's email address to allow the user to access the URL. Here, if the user information 100 does not contain the information of the mail address 107, the mail method cannot be used. The verification unit 20 of the integrated authentication server 2 confirms that the user accesses the URL within a predetermined period of time. FIG. 10 is a diagram showing an example of a mail document containing URLs according to the embodiment of the present invention. An authentication URL 146 is displayed in the mail document 145 shown in FIG.

Returning to FIG. 7, description will be made.

Step S86: The verification unit 20 of the integrated authentication server 2 confirms that the authentication service 102 of the user information 100 is registered in the authentication service 122 of the integrated user information 120 in the integrated user information 120 that matches the user information 100 acquired in step S83. Check whether or not If it is registered, the control unit 23 of the integrated authentication server 2 shifts the process to step S90, otherwise shifts the process to step S87.

Step S87: The verification unit 20 of the integrated authentication server 2 executes user verification by the password method or the email method described in step S85.

In the case of the password method, the first communication unit 22 of the integrated authentication server 2 transmits a screen requesting password input to the third communication unit 42 of the user's terminal device 4, and receives the password input by the user. If the verification unit 20 of the integrated authentication server 2 can confirm that the received password matches the password issued in step S85, the user verification succeeds; otherwise, the user verification fails.

In the case of the e-mail method, the first communication unit 22 of the integrated authentication server 2 sends an e-mail document including access information such as a URL to the e-mail address sent in step S85 to allow the user to access the URL. If the verification unit 20 of the integrated authentication server 2 can confirm that the user has accessed the URL within a predetermined period of time, the verification is considered successful. If not, the verification fails.

Step S88: The control unit 23 of the integrated authentication server 2 shifts the process to step S89 if the user verification executed in step S87 is successful, otherwise shifts the process to step S91.

Step S89: The integration section 21 of the integrated authentication server 2 stores the user information 100 of the user authenticated in step S81 in the integrated user information storage section 9. FIG. Specifically, the authentication service 102 of the user information 100 of FIG. 4 is added to the authentication service 122 of FIG. Add if any.

Step S90: User authentication succeeds, and the first communication unit 22 of the integrated authentication server 2 transmits a message requesting the application server 6 to execute the application requested by the user. Also, in step S<b>89 , when the integrated user information 120 is updated, the first communication unit 22 of the integrated authentication server 2 transmits the updated integrated user information 120 to the application server 6 .

Step S91: The user authentication fails, and the first communication unit 22 of the integrated authentication server 2 transmits a message to notify the user's terminal device 4 of the user authentication failure.

<Sequence of Integrated Authentication Processing>
FIG. 11 is a diagram showing an example of the integrated authentication processing sequence according to the embodiment of the present invention. In this sequence, first, the user (user name: user_b) operates the terminal device 4 to send a usage request for a document creation application (assumed to be application A) to the integrated authentication server 2 . The integrated authentication server 2 causes the authentication server 3A to perform user authentication by LDAP. Next, the user operates the terminal device 4 to send a usage request for the storage service application (assumed to be application B) to the integrated authentication server 2 . The integrated authentication server 2 causes the authentication server 3B to perform user authentication using Kerberos. Here, the user starts the sequence without using application A and application B. Processing of each step will be described below.

Step S<b>51 : The third communication unit 42 of the terminal device 4 transmits a request message for displaying a menu screen to the first communication unit 22 of the integrated authentication server 2 .

Step S<b>52 : The first communication section 22 of the integrated authentication server 2 transmits the screen information of the menu screen to the third communication section 42 of the terminal device 4 .

Step S53: The display control unit 40 of the terminal device 4 displays the menu screen on the screen of the terminal device 4 using the received screen information. FIG. 12 is a diagram showing an example of a menu screen according to the embodiment of the invention. Menu screen 130 shown in FIG. 12 has a button 131 for sending a message requesting use of application A (application A) and a button 132 for sending a message requesting use of application B (application B). is displayed.

Returning to FIG. 11, description will be made.

The operation accepting unit 41 of the terminal device 4 accepts pressing of the button 131 shown in FIG. 12 by the user. The third communication unit 42 of the terminal device 4 transmits a message requesting use of the application A to the first communication unit 22 of the integrated authentication server 2 .

Step S54: The first communication unit 22 of the integrated authentication server 2 sends an authentication request to the second communication unit 31 of the authentication server 3A that provides the authentication service for the application A based on the received message requesting the use of the application A. Send.

Step S55: The second communication unit 31 of the authentication server 3A transmits the screen information of the authentication information input screen to the first communication unit 22 of the integrated authentication server 2. FIG.

Step S<b>56 : The first communication section 22 of the integrated authentication server 2 transmits the screen information of the authentication information input screen to the third communication section 42 of the terminal device 4 .

Step S<b>57 : The display control unit 40 of the terminal device 4 displays an authentication information input screen on the screen of the terminal device 4 . FIG. 13 is a diagram showing an example of an authentication information input screen according to the embodiment of the invention. An authentication information entry screen 133 shown in FIG. 13 displays an entry field 134 for entering a user name, an entry field 135 for entering a password, and a confirm button 136 for confirming and transmitting the entered authentication information.

Returning to FIG. 11, description will be made.

The operation accepting unit 41 of the terminal device 4 accepts input of authentication information (user name and password) and pressing of the confirmation button 136 by the user. The third communication unit 42 of the terminal device 4 transmits the authentication information input by the user to the first communication unit 22 of the integrated authentication server 2 .

Step S58: The first communication unit 22 of the integrated authentication server 2 transmits the received authentication information to the second communication unit 31 of the authentication server 3A.

Step S59: The authentication section 30 of the authentication server 3A executes user authentication using the received authentication information. User authentication is performed by checking whether the received authentication information (user name and password) matches (authentication success) or does not match (authentication failure) the authentication information held by the authentication server 3A.

Step S60: The second communication unit 31 of the authentication server 3A transmits the authentication result and the user information 100 shown in FIG. do.

Step S61: The integrated authentication server 2 executes integrated authentication processing based on the flowchart shown in FIG. Here, the user authentication in step S81 of FIG. 7 is the same as the user authentication in step S59. It is assumed that this user authentication is successful, and since the user has not been registered in step S84 of FIG. 7, new user registration processing is executed in step S85 of FIG. In the process of new user registration, the integration unit 21 of the integrated authentication server 2 records the user information 100 shown in FIG. As shown in FIG. 14, the integrated user information storage unit 9 stores the new integrated user ID 121 "002" in the integrated user information 120 in a new line, and the line number 101 of the user information 100 is stored in the item of this line. Store the information of "4". Specifically, "LDAP" for authentication service 122, "user_a" for user name 123, "a_user" for user alternative name 124, "user A" for display name 125, "group A" for group name 126, and email address 127 stores "user_a@abc.com".

Returning to FIG. 11, description will be made.

Step S62: Here, it is assumed that the user authentication succeeds in step S59. However, if the user authentication fails because the user entered the password incorrectly, the first communication unit 22 of the integrated authentication server 2 An authentication failure notification is transmitted to the third communication unit 42 of the terminal device 4 . The display control unit 40 of the terminal device 4 displays an authentication failure message on the screen of the terminal device 4 .

Step S63: The first communication unit 22 of the integrated authentication server 2 sends the message requesting the application server 6 to execute the application A and the integrated user information 120 shown in FIG. information).

Step S<b>64 : The application server 6 executes the application A and transmits the screen information of the application A to the first communication unit 22 of the integrated authentication server 2 .

Step S<b>65 : The first communication unit 22 of the integrated authentication server 2 transmits the screen information of the application A to the third communication unit 42 of the terminal device 4 . The display control unit 40 of the terminal device 4 displays the screen of the application A on the screen of the terminal device 4 using the received screen information.

Step S66: After creating a sentence with the document creation application (application A), the user requests the menu screen again in order to save the created document file in the storage service (application B). The third communication unit 42 of the terminal device 4 transmits a request message for displaying the menu screen to the first communication unit 22 of the integrated authentication server 2 .

Step S<b>67 : The first communication section 22 of the integrated authentication server 2 transmits the screen information of the menu screen to the third communication section 42 of the terminal device 4 .

Step S68: The display control unit 40 of the terminal device 4 displays the menu screen on the screen of the terminal device 4 using the received screen information. The operation accepting unit 41 of the terminal device 4 accepts pressing of the button 132 for transmitting a message requesting use of the application B on the menu screen shown in FIG. 12 by the user. The third communication unit 42 of the terminal device 4 transmits a message requesting use of the application B to the first communication unit 22 of the integrated authentication server 2 .

Step S69: The first communication unit 22 of the integrated authentication server 2 sends an authentication request to the second communication unit 31 of the authentication server 3B that provides the authentication service for the application B based on the received message requesting the use of the application B. Send.

Step S70: The second communication unit 31 of the authentication server 3B transmits the screen information of the authentication information input screen to the first communication unit 22 of the integrated authentication server 2. FIG.

Step S<b>71 : The first communication unit 22 of the integrated authentication server 2 transmits screen information of the authentication information input screen to the third communication unit 42 of the terminal device 4 .

Step S72: The display control section 40 of the terminal device 4 displays the authentication information input screen 133 shown in FIG. The operation accepting unit 41 of the terminal device 4 accepts input of authentication information (user name and password) and pressing of the confirmation button 136 by the user. The third communication unit 42 of the terminal device 4 transmits the authentication information input by the user to the first communication unit 22 of the integrated authentication server 2 .

Step S73: The first communication unit 22 of the integrated authentication server 2 transmits the received authentication information to the second communication unit 31 of the authentication server 3B.

Step S74: The authentication unit 30 of the authentication server 3B executes user authentication using the received authentication information. User authentication is performed by confirming whether the received authentication information (user name and password) matches (authentication success) or does not match (authentication failure) the authentication information held by the authentication server 3B.

Step S75: The second communication unit 31 of the authentication server 3B transmits the authentication result and the user information 100 shown in FIG. do.

Step S76: The integrated authentication server 2 executes integrated authentication processing based on the flowchart shown in FIG. Here, the user authentication in step S81 of FIG. 7 is the same as the user authentication in step S74. It is assumed that this user authentication succeeds. Furthermore, in step S84 of FIG. 7, the user has been registered, and in step S86 of FIG. 7, the authentication service (Kerberos) has not been registered, so the user registration update process is executed in step S89 of FIG. The integration unit 21 of the integrated authentication server 2 records the user information 100 shown in FIG. Here, in step S61, the integrated user information 120 with the integrated user ID 121 of "002" as shown in FIG. stores "\\server\user_b" in the item of the home directory 128 of the integrated user information 120 whose integrated user ID 121 is "002" as shown in FIG.

Returning to FIG. 11, description will be made.

Step S77: Here, it is assumed that the user authentication succeeds in step S74. However, if the user fails to enter the password correctly, the first communication unit 22 of the integrated authentication server 2 An authentication failure notification is transmitted to the third communication unit 42 of the device 4 . The display control unit 40 of the terminal device 4 displays an authentication failure message on the screen of the terminal device 4 .

Step S78: The first communication unit 22 of the integrated authentication server 2 receives the message requesting the application server 6 to execute the application B, and the integrated user information 120 shown in FIG. information). Here, the application server 6 shares the received integrated user information 120 between the document creation application (application A) and the storage service (application B) used by the user (user_b). As a result, it becomes possible to save the document file created by the user in the user's storage service (home directory).

Step S<b>79 : The application server 6 executes the application B and transmits the screen information of the application B to the first communication unit 22 of the integrated authentication server 2 .

Step S<b>80 : The first communication unit 22 of the integrated authentication server 2 transmits the screen information of the application B to the third communication unit 42 of the terminal device 4 . The display control unit 40 of the terminal device 4 displays the screen of the application B (storage service) on the screen of the terminal device 4 using the received screen information. FIG. 16 is a diagram showing an example of a screen of application B (storage service) according to the embodiment of the present invention. A screen 147 displays a file name 149 (document.doc) stored in the home directory 148 as the screen of application B (storage service).

The integrated authentication processing in steps S51 to S80 has been described above. Here, regarding steps S69 to S75, which are the authentication processing after the user requests to use application B, since the user has already been authenticated by application A, the user authentication is assumed to be successful, and these steps are omitted. can be

Also, the first communication unit 22 of the integrated authentication server 2 transmits the user information 100 obtained in the user authentication process (steps S59 and S74) and the integrated user information 120 obtained in the integrated authentication process (steps S61 and S76) to the terminal device 4. may be transmitted to the third communication unit 42 of the

<About effect>
In the first embodiment of the present invention, the information processing system 5 performs user verification to verify whether users of different authentication services are the same user when the user uses a plurality of applications. Further, the information processing system 5 generates integrated user information that integrates user information for different authentication services of the same user, and shares the integrated user information between applications. Accordingly, it is possible to realize an integrated authentication system capable of treating users in different authentication services as the same user without previously creating information integrating user information in different authentication services of the same user. In addition, since there is no need to create integrated information in advance, it is possible to reduce the initial cost of system construction and the cost of design changes and extensions related to applications and users.

Although several modes for carrying out the present invention have been described above, the present invention is by no means limited to such embodiments, and various modifications and replacements can be made without departing from the gist of the present invention. be able to.

For example, the configuration diagram of the functional blocks in FIG. 3 is divided according to main functions in order to facilitate understanding of the processing by the information processing system 5 . The present invention is not limited by the division method or name of the processing unit. The processing of the information processing system 5 can also be divided into more processing units according to the content of the processing. Also, one processing unit can be divided to include more processing.

Also, each function of the embodiments described above can be implemented by one or more processing circuits. Here, the "processing circuit" in this specification means a processor programmed by software to perform each function, such as a processor implemented by an electronic circuit, or a processor designed to perform each function described above. ASICs (Application Specific Integrated Circuits), DSPs (digital signal processors), FPGAs (field programmable gate arrays), conventional circuit modules, and other devices.

Moreover, the described devices are only representative of one of several computing environments for implementing the embodiments disclosed herein. In some embodiments, information handling system 5 includes multiple computing devices, such as a server cluster. Multiple computing devices are configured to communicate with each other over any type of communication link, including a network, shared memory, etc., to perform the processes disclosed herein.

Further, the first communication unit 22, the second communication unit 31, and the third communication unit 42 may simply be referred to as communication units, and the user information storage unit 7, integrated setting storage unit 8, and integrated user information storage unit 9 may simply be referred to as storage units. You can call it

1 communication network 2 integrated authentication server 3 authentication server 4 terminal device 5 information processing system 6 application server 7 user information storage unit 8 integration setting storage unit 9 integrated user information storage unit 10 storage device 20 verification unit 21 integration unit 22 first communication unit 23 control unit 30 authentication unit 31 second communication unit 40 display control unit 41 operation reception unit 42 third communication unit

Patent No. 5434441

Claims (7)

An information processing device that uses different authentication services to authenticate a user who uses a plurality of applications,
a first communication unit that receives user information of the user from an authentication server that has authenticated the user;
When the content of the predetermined items of the user information of the first user using the first application and the second user using the second application are the same, the first user and the second user is the same user, and
an integration unit that generates integrated user information by integrating first user information and second user information of the same user in order to use the first application and the second application as the same user;
Information processing device having The first communication unit transmits user verification information to a terminal device used by the first user when authenticating the first user,
2. Information according to claim 1, wherein the verification unit verifies whether the first user and the second user are the same user using the user verification information when authenticating the second user. processing equipment. The verification unit confirms that the access information included in the email sent to the email address included in the user information of the user is accessed at the time of authentication of the user, thereby verifying that the first user and the second user are authenticated. 2. The information processing apparatus according to claim 1, which verifies that users are the same user. 2. The information processing apparatus according to claim 1, further comprising a storage unit for storing said integrated user information. An information processing system having an information processing device that uses different authentication services to authenticate a user who uses a plurality of applications and an authentication server that provides the authentication services,
a first communication unit that receives user information of the user from an authentication server that has authenticated the user;
When the content of the predetermined items of the user information of the first user using the first application and the second user using the second application are the same, the first user and the second user is the same user, and
an integration unit that generates integrated user information by integrating first user information and second user information of the same user in order to use the first application and the second application as the same user;
an information processing device having
an authentication unit that authenticates the user;
a second communication unit that transmits user information of the user to the information processing device;
an authentication server having
An information processing system having An information processing method executed by an information processing device that uses different authentication services to authenticate a user using a plurality of applications,
receiving user information for the user from an authentication server that authenticated the user;
When the content of the predetermined items of the user information of the first user using the first application and the second user using the second application are the same, the first user and the second user are the same user;
generating integrated user information that integrates first user information and second user information of the same user in order to use the first application and the second application as the same user;
An information processing method comprising: In an information processing device that uses different authentication services to authenticate a user who uses multiple applications,
receiving user information for the user from an authentication server that authenticated the user;
When the content of the predetermined items of the user information of the first user using the first application and the second user using the second application are the same, the first user and the second user are the same user;
generating integrated user information that integrates first user information and second user information of the same user in order to use the first application and the second application as the same user;
program to run.

Images