JP4898299B2 - Authentication information integration system, authentication information integration method, and authentication information integration program - Google Patents

Description

  The present invention relates to an authentication information integration system capable of integrating authentication information such as a password.

  When integrating multiple large systems that manage hundreds of thousands of customers, authentication information such as passwords must be integrated. In general, authentication information is managed by the system after being converted using a one-way function such as a hash function to ensure security, and the integration destination system uses a different one-way function. The authentication information after the conversion cannot be used in the integration destination system.

  Therefore, conventionally, when authentication information such as a password is integrated in such a large-scale system, the authentication information is sent in writing from a customer and input to the integration destination system.

  However, in this method, there is a problem that it takes time and effort to the customer, and there is a possibility that the short-time concentration of registration office work, registration office error, and customer inquiry handling processing may be concentrated.

On the other hand, systems that perform password change processing, registration processing, and the like for all systems have been developed (see Patent Document 1). Such a system is provided at the front of each system. When a password is changed, a site provided by the system provided at the front serves as an entrance for the user.
JP 2002-169777 A

  However, in the case where a device for changing a password or the like is provided at the front of each system, there is a problem that the customer has to access the device, and extra time is spent on the customer.

  In addition, when integrating a large-scale system, there is a problem that a computer having high capability must be prepared for the device because access concentrates on the device provided at the front.

  The present invention has been made in view of the above circumstances, and when performing authentication information integration such as passwords, the authentication is performed without the customer being aware of the authentication information integration and overloading the system. An object of the present invention is to provide an authentication information integration system capable of integrating information.

According to the first aspect of the present invention, the first authentication device that converts the authentication information by the first one-way function and performs the authentication process is connected to the first authentication device, and the second one In an authentication information integrated system comprising a second authentication device that performs authentication processing by converting authentication information using a directionality function, the first authentication device is associated with customer identification information and the customer identification information. a database for storing the first authentication information of the own system, in order to log in to the first authentication device, the second authentication information corresponding to the customer identification information and the customer identification information is transmitted from the customer computer Means for receiving, means for converting the received second authentication information using the first one-way function, the converted second authentication information, and the first authentication information. Detect matching And means for converting the received second authentication information using the second one-way function when it is detected that the data matches, the received customer identification information, and the converted information. And means for transmitting the second authentication information to the second authentication device , wherein the second authentication device includes the customer identification information transmitted from the first authentication device and the converted second authentication information. An authentication information integration system comprising means for storing the authentication information of No. 2 in its own database .

  According to the present invention, when integrating authentication information such as passwords, the authentication information can be integrated without the customer being aware of the authentication information and without overloading the system. An information integration system can be provided.

  Hereinafter, an authentication information integration system according to an embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram showing an environment in which an authentication information integration system according to an embodiment of the present invention is used.

  As shown in the figure, a customer computer 2, 3, a company A server computer 4 and a company B server computer 5 are connected to a network 1 such as the Internet.

  The customer computer 2 uses a service provided by the server computer 4 of the company A, and logs in to the service by transmitting authentication information such as a password to the server computer 4 of the company A.

  The customer computer 3 uses a service provided by the server computer 5 of the company B, and logs in to the service by transmitting authentication information such as a password to the server computer 5 of the company B.

  The server computer 4 of the company A provides a service provided by the company A, and performs authentication information integration processing according to the embodiment of the present invention. The server computer 5 of the company B provides a service provided by the company B, and receives and stores the authentication information of the customer sent from the server computer 4 of the company A. The authentication information according to the embodiment of the present invention. Integration processing is performed.

  In the embodiment of the present invention, a case where authentication information such as a password in the server computer 4 of the company A is integrated into the server computer 5 of the company B will be described.

  FIG. 2 is a diagram illustrating a configuration of the server computer 4 of the company A.

  As shown in the figure, in the server computer 4, a CPU 12, a communication I / F 13, a memory 14, and a storage device 15 are connected to a bus 11.

  The CPU 12 manages the entire processing according to the embodiment of the present invention in cooperation with the authentication information integration program 21 stored in the storage device 15.

  The communication I / F 13 controls communication with external devices via the network 1.

  The memory 14 is used as a work area required when the authentication information integration program 21 is executed.

  The storage device 15 is for storing data required for authentication information integration processing, and is, for example, a hard disk drive (HDD). The storage device 15 stores an authentication information integration program 21, a database 22, and encryption programs 23 and 24.

  The authentication information integration program 21 is an application program that operates on an OS (Operating System), and implements the authentication information integration processing according to the embodiment of the present invention in cooperation with the CPU 12.

  The database 22 includes a customer ID 31 in the server computer 4 of the company A, authentication information 32 such as a password after being encrypted by the encryption program 23 used in the computer 4, account number, customer information, account type, deposit balance, etc. Are stored in association with each other.

  The encryption program 23 is an encryption program for the server computer 4 of the company A, and when logging in to the service provided by the service computer 4 of the company A using the hash function for the computer 4 that is a one-way function. The authentication information sent from the customer computer 2 is encrypted.

  The encryption program 24 is an encryption program for the server computer 5 of the company B, and logs in to a service provided by the service computer 4 of the company A by a hash function for the computer 5 that is a one-way function. The authentication information sent from the customer computer 2 is encrypted. At this time, the encryption program 24 performs the encryption process by using the memory 14 as a work area without storing the encrypted authentication information in the database 22.

  The authentication information integration processing according to the embodiment of the present invention will be described below with reference to the flowchart of FIG. 3 and the operation explanatory diagram of FIG.

  When the customer computer 2 logs in to a service provided by the server computer 4 of the company A, the customer identification information in this service and authentication information such as a password corresponding to the customer identification information are transmitted to the server computer 4 of the company A. (T1, T2).

  The server computer 4 of the company A receives the customer identification information in the service provided by the server computer 4 of the company A and the authentication information such as a password corresponding to the customer identification information from the customer computer 2 (S1).

  The server computer 4 of the company A stores the received customer identification information and authentication information corresponding to the customer identification information in a memory (S2, T3), and encryption used in the service provided by the server computer 4 of the company A The authentication information is encrypted by the program 23 (S3, T4).

  Thereafter, the database 22 is searched on the condition of the received customer identification information to obtain the encrypted authentication information corresponding to the received customer identification information stored in the database 22, and the authentication information encrypted in S3 And whether or not the encrypted authentication information stored in the database 22 matches (S4, T5).

  If it is determined in S4 that they do not match, login error processing is performed and the process ends (S5). On the other hand, if it is determined that they match, the received authentication information is encrypted by the encryption program 24 (S6, T6). That is, the authentication information received by the one-way function used in the service provided by the server computer 5 is encrypted.

  Thereafter, the received customer identification information and the authentication information encrypted in S6 are transmitted to the server computer 5 via the network 1 (S7, T7). In this embodiment, authentication information is transmitted in a state encrypted with a one-way function in this way, so that the security of the authentication information with respect to a third party is ensured.

  The server computer 5 receives the authentication information encrypted by the one-way function used in the service provided by the server computer 5 corresponding to the customer identification information and the customer identification information from the server computer 4 (S8), Store in its own database (S9). Thereby, the authentication information of the server computer 4 can be integrated into the server computer 5.

  Therefore, according to the embodiment of the present invention, authentication information is integrated using the authentication information input when the customer logs in to the system of the integration source, so that there is no extra work for the customer. Authentication information integration processing can be performed.

  In addition, since the integration processing load can be distributed to the integration source computer and the integration destination computer, it is not necessary to provide a system with high processing performance as compared with the case where a separate front system is prepared. As a result, an integrated processing system with high cost performance can be provided.

  Note that the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. In addition, various inventions can be formed by appropriately combining a plurality of components disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements over different embodiments may be appropriately combined.

  In addition, the method described in the embodiment uses, as a program (software means) that can be executed by a computer (computer), for example, a magnetic disk (hard disk, etc.), an optical disk (CD-ROM, DVD, MO, etc.), a semiconductor memory, etc. It can also be stored in a recording medium such as (ROM, RAM, flash memory, etc.), or transmitted and distributed via a communication medium. The program stored on the medium side includes a setting program that configures software means (including not only the execution program but also a table and data structure) in the computer. A computer that implements this apparatus reads a program recorded on a recording medium, constructs software means by a setting program as the case may be, and executes the above-described processing by controlling the operation by this software means. The recording medium referred to in this specification is not limited to distribution, but includes a storage medium such as a magnetic disk or a semiconductor memory provided in a computer or a device connected via a network.

It is a figure which shows the use environment of the authentication information integrated system which concerns on embodiment of this invention. 2 is a diagram showing a configuration of a server computer 4. FIG. It is a flowchart for demonstrating the integration process which concerns on embodiment of this invention. It is a figure for demonstrating the integration process which concerns on embodiment of this invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Network 2, 3 ... Customer computer, 4 ... Company A server computer, 5 ... Company B server computer, 11 ... Bus, 12 ... CPU, 13 ... Communication I / F, 14 ... Memory, 15 ... Storage device , 21 ... authentication information integration program, 22 ... database, 23 ... encryption program for server computer 4 of company A, 24 ... encryption program for server computer 5 of company B, 31 ... customer ID, 32 ... authentication information after encryption 33 ... Customer information.

Claims (6)

A first authentication device that performs authentication processing by converting authentication information by a first one-way function;
An authentication information integration system comprising: a second authentication device connected to the first authentication device and converting authentication information by a second one-way function to perform authentication processing;
The first authentication device includes:
And customer identification information, and a database for storing the first authentication information of the system associated with the customer identification information,
Means for receiving customer identification information transmitted from a customer computer and second authentication information corresponding to the customer identification information to log in to the first authentication device ;
Means for converting the received second authentication information using the first one-way function;
Means for detecting that the converted second authentication information matches the first authentication information;
Means for converting the received second authentication information using the second one-way function when a match is detected;
Means for transmitting the received customer identification information and the converted second authentication information to the second authentication device ;
The second authentication device includes:
An authentication information integration system comprising: means for storing customer identification information transmitted from the first authentication device and the converted second authentication information in its own database . And customer identification information, and a database for storing the first authentication information of the system associated with the customer identification information,
Means for receiving customer identification information transmitted from a customer computer and identification information of second authentication information corresponding to the customer identification information to log in to the authentication information integration system ;
Means for converting the received second authentication information using a first one-way function for converting the authentication information in its own system ;
Means for detecting that the converted second authentication information matches the first authentication information;
Means for converting the received second authentication information using a second one-way function for converting the authentication information in another system when it is detected that they match;
Authentication information comprising: means for transmitting the received customer identification information and the converted second authentication information to the other system so as to be stored in a database of the other system. Integrated system. The authentication information integration system according to claim 1, wherein the first one-way function and the second one-way function are hash functions different from each other. The authentication information integration system according to claim 1, wherein the authentication information is a user password. And customer identification information, the authentication information integration method in the authentication information integration system comprising a database for storing the first authentication information of the system associated with the customer identification information,
In order to log in to the authentication information integration system, the customer identification information transmitted from the customer computer and the identification information of the second authentication information corresponding to the customer identification information are received,
Converting the received second authentication information using a first one-way function for converting the authentication information in its own system ;
Detecting that the converted second authentication information matches the first authentication information;
When it is detected that the two match, the received second authentication information is converted using a second one-way function for converting the authentication information in another system ,
An authentication information integration method, wherein the received customer identification information and the converted second authentication information are transmitted to the other system so as to be stored in a database of the other system. And customer identification information, the authentication information integration program used in the authentication information integration system comprising a database for storing the first authentication information of the system associated with the customer identification information,
In order to log in to the authentication information integration system, the customer identification information transmitted from the customer computer and the identification information of the second authentication information corresponding to the customer identification information are received,
Converting the received second authentication information using a first one-way function for converting the authentication information in its own system ;
Detecting that the converted second authentication information matches the first authentication information;
When it is detected that the two match, the received second authentication information is converted using a second one-way function for converting the authentication information in another system ,
An authentication information integration program for transmitting the received customer identification information and the converted second authentication information to the other system in order to store it in the database of the other system.

Images