JP5727661B2 - Authentication method, authentication system, service providing server, and authentication server - Google Patents

Description

  The present invention relates to a technique for transmitting and receiving messages using an information processing terminal.

  In recent years, with the development of Internet technology, a method in which a user downloads an application such as a game program to a client terminal and performs processing on the client terminal has become widespread. For example, in a smartphone terminal, a game can be downloaded from a server and played. Usually, a user performs member registration with respect to a service operator who provides a game through a terminal, and acquires an ID and a password. After that, when the user inputs an ID and a password to the terminal, a predetermined authentication process is performed by the authentication server, thereby enabling login and enjoying the game.

  Since such a login process is performed each time a different application system is used, the user is prompted to input personal information such as an ID and a password each time, which is complicated for the user. Therefore, a “single sign-on (SSO)” technology that realizes access to a plurality of systems by a single login process has been developed. In SSO, an authentication ticket is issued to guarantee that the authentication server has been authenticated. When the browser of the client terminal performs data communication with the application server, the authentication ticket is transmitted to the application server, and the application server receives the authentication ticket. , It is confirmed that the user has logged in (see, for example, Patent Documents 1 and 2).

JP 2006-236281 A JP 2008-059038 A

  In conventional authentication, a sequence for SSO processing is configured on the assumption that an authentication server and an application server (hereinafter also referred to as a service providing server) are operated by different operators. Here, when the authentication server and the service providing server are operated by the same business operator, the conventional SSO process is not necessarily an efficient and secure process.

  The present invention has been made in view of such a problem, and an object of the present invention is to provide a server device, a method, and a method capable of more efficiently executing a secure SSO process by linking an authentication server and a service providing server. To provide a system.

  One aspect of the present invention provides a client terminal that stores one or more applications, a service providing server that connects to the client terminal via a network and provides a service to the client terminal, the client terminal, and the service provision In an authentication method in a system including an authentication server that connects to a server and executes authentication processing, if a session is established between the authentication server and at least one target application in the client terminal, the service The providing server receives an authentication request from the client terminal and transmits authentication request information for requesting confirmation of authentication to the client terminal, and the client terminal receives the authentication request information from the service providing server. Confirm the authentication. Ticket information indicating that the client terminal is authenticated by the authentication server in response to authentication request information from the client terminal. To the client terminal, the client terminal receives the ticket information from the authentication server, transmits the ticket information to the service providing server, and the service providing server receives the ticket information from the client terminal. In response, the access request for access permission is sent to the authentication server together with the ticket information. The authentication server receives the ticket information and the access request from the service providing server, and the ticket information is received by the authentication server. If it has been issued, access to allow access The token and the ID token for specifying the target application are transmitted to the service providing server, and the service providing server receives the access token and the ID token from the authentication server, and stores the ID token and the application stored in advance. The authentication method is characterized in that the access token is transmitted to the client terminal if the collation with the secret information regarding is valid.

  Another aspect of the present invention provides a client terminal that stores one or more applications, a service providing server that connects to the client terminal via a network and provides a service to the client terminal, the client terminal, and the service provision In an authentication system including an authentication server that connects to a server and executes authentication processing, if a session is established between the authentication server and at least one target application in the client terminal, the service providing server Receives an authentication request from the client terminal and transmits authentication request information for requesting confirmation of authentication to the client terminal, and the client terminal receives the authentication request information from the service providing server, Require authentication confirmation Authentication request information is transmitted to the authentication server, and the authentication server receives authentication request information from the client terminal, and receives ticket information indicating that the client terminal is authenticated by the authentication server. The client terminal receives ticket information from the authentication server and transmits the ticket information to the service providing server, and the service providing server receives the ticket information from the client terminal and An access request for permission of access is sent to the authentication server together with ticket information, and the authentication server receives ticket information and an access request from the service providing server, and the ticket information is issued by the authentication server If so, access token and access An ID token that identifies a target application is transmitted to the service providing server, and the service providing server receives the access token and the ID token from the authentication server, and the secret information regarding the application stored in advance with the ID token If the verification is valid, the access token is transmitted to the client terminal.

  Another aspect of the present invention provides a client terminal that stores one or more applications, a service providing server that connects to the client terminal via a network and provides a service to the client terminal, the client terminal, and the service provision A service providing server in an authentication system including an authentication server that connects to a server and executes authentication processing, wherein a session is established between the authentication server and at least one target application in the client terminal The authentication request information from the client terminal is received, the authentication request information requesting to confirm the authentication is transmitted to the client terminal, and the client in the authentication server receives the authentication request information via the client terminal. The device is authenticated The ticket information indicating that is received from the authentication server via the client terminal, receives the ticket information from the client terminal, and sends an access request for permission of access together with the ticket information to the authentication server. And when the ticket information is issued in the authentication server, the access token that permits access, the ID token that identifies the target application, and the authentication server are received from the authentication server and stored in advance as the ID token. The service providing server transmits the access token to the client terminal if the collation with the secret information related to the application is valid.

  Another aspect of the present invention provides a client terminal that stores one or more applications, a service providing server that connects to the client terminal via a network and provides a service to the client terminal, the client terminal, and the service provision An authentication server in an authentication system including an authentication server that connects to a server and executes authentication processing, and a session is established between the authentication server and at least one target application in the client terminal When the authentication request information transmitted from the service providing server that has received the authentication request from the client terminal is received via the client terminal and the client terminal is authenticated by the authentication server; The ticket information indicating If it is transmitted to the client terminal, receives an access request for access permission together with the ticket information from the client terminal via the service providing server, and the ticket information is issued by the authentication server An authentication server, wherein an access token that permits access and an ID token that specifies the target application are transmitted to the service providing server.

  According to the present invention, the service providing server and the authentication server cooperate with each other to perform the authentication process, thereby realizing a more secure authentication process.

1 is a diagram illustrating a configuration example of an authentication system according to Embodiment 1. FIG. It is a figure which shows the structural example of the service provision server in the authentication system of FIG. FIG. 2 is a diagram illustrating a configuration example of a mobile terminal or a PC terminal in the authentication system of FIG. It is a sequence diagram which shows the 1st example of an authentication process in the authentication system of FIG. It is a sequence diagram which shows the 2nd example of an authentication process in the authentication system of FIG. It is a sequence diagram which shows the 3rd example of an authentication process in the authentication system of FIG. It is a sequence diagram which shows the 4th example of an authentication process in the authentication system of FIG.

  Before describing the embodiments of the present invention, an outline of the present invention will be described first. The present invention is an authentication technique for an installation-type application, and improves security in authentication processing by adopting a configuration in which not only an authentication server but also a service providing server assists authentication processing of a client terminal. is there.

  In the present invention, the authentication processing is executed based on the authentication information of the client terminal application that has been established in the session stored in the service providing server and the user information related to the user stored in the authentication server. Thus, the authentication in one server can be used to guarantee the authentication in the other, and an efficient and secure authentication process can be performed. Hereinafter, an example will be described. In the following, the service providing server may be a platform that provides a service, and the authentication server may be a server that provides an application. Further, these servers may be physically integrated.

  First, Example 1 will be described. FIG. 1 is a diagram illustrating an authentication system 100 according to the first embodiment of the present invention. The authentication system 100 includes a service providing server 10, an authentication server 20, a network 30 that connects the service providing server 10, the authentication server 20, and the base station 40 with a wired line, and a first base station represented by the base station 40. 40a to 3rd base station 40c, 1st mobile terminal 50a represented by mobile terminal 50-3rd mobile terminal 50c, and PC terminal 70 are included.

  For convenience of illustration, only three base stations 40 and mobile terminals 50 are shown, but the number of base stations 40 and mobile terminals 50 may be more than that. The same applies to the PC terminal 70. In addition, the first mobile terminal 50 a to the third mobile terminal 50 c are illustrated as being connected to different base stations 40, but not limited to this, a plurality of mobile terminals 50 are connected to one base station 40. Needless to say, the present invention is applicable.

  The service providing server 10 is a device for providing a net service such as a chat service and for cooperating with the authentication server 20 to improve the log-in process of the client terminal. The service providing server 10 executes communication processing for authentication processing between the authentication server 20 or the mobile terminal 50 and the PC terminal 70 via the network 30 and / or the base station 40. In the following, in order to simplify the description, the network 30 and the base station 40 are simply expressed as “execute communication processing between the service providing server 10 and the mobile terminal 40 or the PC terminal 70”. The description of the points to be interposed is omitted. Hereinafter, the mobile terminal 50 and the PC terminal 70 may be collectively referred to as a client terminal.

  The client terminal transmits a signal related to the authentication request to the service providing server 10 via the browser every time the application is started in accordance with a user instruction. When the service providing server 10 receives the authentication request from the client terminal, the service providing server 10 issues session information (Cookie) related to the client terminal, adds the session information to the authentication request, and returns it.

  The client terminal transmits an authentication request to which the session information is assigned to the authentication server 20. Then, the authentication server 20 receives the authentication request from the client terminal, cooperates with the service providing server 10, and the authentication information of the application of the client terminal already established in the session stored in the service providing server, and the authentication server The authentication process is executed based on the user information related to the user stored in.

  Here, the application authentication information includes an ID unique to the application and secret information of the application itself. This application authentication information is issued to an application for which a session has been established, and is managed by the service providing server 10. As will be described later, the service providing server 10 manages the use of an application by a user, authenticates login of a user having a legitimate authority, and establishes a session of the application if it is legitimate.

  The user information includes a user ID and a password designated by the user. This user information is managed by the authentication server 20. As will be described later, the authentication server 20 obtains user information via a user terminal, compares it with user information stored in advance, and judges and authenticates the login of the user.

  As described above, the user may log in to the authentication server 10 or may log in to the service providing server 20. In the present invention, when it is determined that the login on one side is valid, the validity is also applied to the other server and the login is permitted. Therefore, the authentication result in each is confirmed directly between the authentication server 10 and the service providing server or via the browser of the user terminal.

  That is, since the authentication server 10 and the service providing server 20 are operated by the same company, the above-described authentication cooperation is possible. Needless to say, the present invention can be applied to a case where it is operated by a non-identical business operator and has a considerable degree of trust.

  This will be specifically described. If the authentication server 20 determines that a session with an application running on the client terminal has already been established in response to an authentication request from the client terminal, the authentication server 20 issues a one-time ticket associated with the client terminal. Send to client terminal.

  The session is established means that the user is logged in. The logged-in state means that the user has secret information such as ID and password via a browser of any application or an authentication assist application (hereinafter also referred to as a specific browser) outside the application. By entering the information, it is appropriate information based on the authentication information of the client terminal application stored in the service providing server and the user information related to the user stored in the authentication server. Is confirmed and the authentication process is completed.

  The client terminal redirects (transfers) the one-time ticket acquired from the authentication server 20 to the service providing server 10. In response to this, the service providing server 10 requests the authentication server 20 to issue an access token for establishing a session with the client terminal by transmitting the one-time ticket acquired from the client terminal.

  Here, the access token indicates a user's execution authority for a predetermined application, and the predetermined application can be executed on the client terminal by presenting it to the server. The one-time ticket includes information indicating which client terminal requests and which server is trusted and authenticated. Further, the access token may be encrypted. In that case, stronger security can be realized by passing the decryption key to the client terminal in advance before starting up the browser.

  After confirming that the one-time ticket received from the service providing server 10 is issued, the authentication server 20 issues an access token related to the one-time ticket and sends it back to the service providing server 10. The service providing server 10 transmits the access token received from the authentication server 20 to the client terminal. Thereby, since the client terminal can acquire the access token, the application can be executed.

  The authentication server 20 establishes a session when the authentication confirmation of the ID token of the client terminal that is the authentication request source is successful, or when the login process from the application running on the client terminal is confirmed. It may be determined that

  When a session is established between the application running on the authentication request source client terminal and the service providing server 10, the service providing server 10 includes an ID token for the client terminal. Issue session information. The authentication server 20 may verify whether or not a session is established by verifying an ID token obtained via the client terminal.

  On the other hand, when a session is not established between the authentication server 20 and the application activated in the authentication request source client terminal, the client terminal sends user information to the authentication server 20. Here, after verifying the received user information, the authentication server 20 issues an ID token together with the access token and transmits it to the service providing server 10. The service providing server 10 may verify the acquired ID token, establish a session, and transmit an access token to the client terminal.

  FIG. 2 is a diagram illustrating a configuration example of the service providing server 10 in the authentication system 100 of FIG. The service providing server 10 includes a server communication unit 12, an authentication processing unit 14, and a server memory 16.

  The server communication unit 12 receives a signal from the client terminal or the authentication server 20, performs a predetermined demodulation process, and sends the demodulated signal to the authentication processing unit 14. In addition, a predetermined modulation process is performed on the signal transmitted from the authentication processing unit 14 and transmitted to the user terminal. The modulation / demodulation processing in the server communication unit 12 may use a conventional modulation / demodulation technique, and it will be understood by those skilled in the art that the present invention can be applied even in such a mode. is there.

  The authentication processing unit 14 receives information related to the authentication processing from the client terminal through the server communication unit 12. The authentication processing unit 14 manages secret information such as session information, user ID, or user password in the server memory 16 for each client terminal. The secret information may be notified from the client terminal when the client terminal first performs a registration process with the service providing server 10. As a result, when there is an authentication request from a client terminal for which a session has already been established, an ID token is issued without requiring another login process, and a smooth SSO process is executed.

  In addition, when there is an authentication request from a client terminal for which a session has not been established, the authentication processing unit 14 checks whether or not a session has already been established in the authentication server 20. By acquiring the ID token from the server 20, smooth SSO processing is executed.

  If a session is not established in the authentication server 20, the authentication processing unit 14 also asks the client terminal for secret information such as a user ID and a password, and compares it with the secret information registered in advance. Process and establish a session.

  Next, the configuration on the client terminal side will be described. FIG. 3 is a diagram illustrating a configuration example of the mobile terminal 50 or the PC terminal 70 of FIG. Here, for convenience of explanation, the configuration of the mobile terminal 50 will be described, but the PC terminal 70 has the same configuration.

  The mobile terminal 50 includes a terminal communication unit 52, a browser control unit 54, a terminal control unit 56, a terminal memory 58, and a user interface 60. The terminal communication unit 52 executes transmission / reception processing of information regarding authentication processing with the service providing server 10 or the authentication server 20.

  The browser control unit 54 controls a first browser that operates in the background, a second browser that can accept input of user information from the user, and a specific browser that operates as a browser function outside the application. The first browser is also called a hidden browser (Hidden Embedded Browser). The first browser and the second browser are browsers (embedded browsers) embedded as components in a predetermined application, and session information can be shared with each other. That is, the first browser and the second browser are browsers that exist for each application.

  On the other hand, the specific browser is a browser that can assist authentication. Since this specific browser operates as a function outside the application, session information cannot be shared between the first browser and the second browser embedded in the application. The specific browser may be an OS standard browser, a browser that can be shared through application cooperation, and may be an arbitrary application that can be launched. By realizing the authentication process through this specific browser, the application linkage becomes easy, and the user only needs to perform the login process once. It becomes unnecessary.

  Usually, since Cookie cannot be shared between a specific browser and an embedded browser in the application, such application cooperation is difficult. However, with the service providing server 10 interposed between the authentication server 20 and the client terminal, an authentication process is performed to ensure that the user is the same at the start and end in authentication with a specific external browser. Thus, SSO in application cooperation using an external browser was realized.

  The browser control unit 54 first performs an authentication process with the service providing server 10 using the first browser. The first browser is used when performing a process that does not prompt the user for input. Thereby, processing can be realized at high speed without making the user aware of the operation. And when it comes to the scene which requires a user's input, the browser control part 54 switches operation | movement to a 2nd browser. Thereby, efficient processing becomes possible.

  For example, the browser control unit 54 first performs an authentication process with the service providing server 10 using the first browser. Next, when a session is not established between the activated application and the service providing server 10 and when it is necessary to cause the user to input user information, the user information The second browser is activated to accept the request, and the authentication process is switched between the second browser and the service providing server 10.

  Even if a session is not established between the authentication server 20 and the application running on the authentication request source client terminal, the session is established between the specific browser of the client terminal and the authentication server 20. In such a case, instead of the second browser, the specific browser is activated to switch to the processing between the specific browser and the service providing server 10.

  The terminal control unit 56 receives instructions from the user via the user interface 60 and manages application execution and authentication processing while accessing the terminal memory 58. Application execution and authentication processing is performed for each application. The application includes SDK (Software Development Kit) that is a basic software library for controlling the operation of the application, and a browser embedded in the application. Among these, the terminal control unit 56 controls the SDK. The SDK controls processing such as starting up a browser in response to an instruction from the server.

  The user interface 60 includes a screen interface for displaying a message to the user and a user information screen, an input interface for receiving input from the user such as a keyboard and a touch panel, and an image capturing unit such as a camera.

  The user interface 60 receives an application execution request from the user and transmits it to the terminal control unit 56. In addition, the user interface 60 displays a login screen as necessary, receives confidential information such as a user ID and a password, or an input related to a login processing request using a specific browser, and transmits it to the terminal control unit 56.

  The terminal memory 58 stores applications downloaded from the service providing server 10, image information received from image capturing means and other users, and contact information stored in association with names and contacts. Remember.

  Here, an outline of the basic flow of the authentication system 100 will be described.

  The service providing server 10 issues a cookie for identifying the user agent to the embedded browser in the application at the start of authentication, saves the cookie so that it can be verified, and then starts a specific browser such as an OS standard external browser. .

  The specific browser accesses the service providing server 10 and then transitions to the authentication server 20 by redirection, and performs user authentication processing if necessary. When the user authentication by the authentication server 20 is completed, the return URL of the service providing server 10 is redirected, and the specific browser makes a request to the service providing server 10.

  The service providing server 10 holds client secret information such as a client ID related to the application of the user terminal in advance, and verifies the one-time ticket (code) and ID token received from the authentication server 20 without going through the client terminal. Is valid, a user session for the service providing server 10 is issued, a login session is established between the specific browser and the service providing server 10, and a one-time ticket (code) is passed to the client terminal.

  Upon receiving this one-time ticket, the client terminal again activates the in-application embedded browser and passes the one-time ticket to the service providing server 10. At this time, the service providing server 10 verifies whether or not the user is a valid user agent based on information previously associated with the cookie from the cookie issued at the start of authentication. Using the ticket, the access token for accessing the protected resource from the authentication server 20 and the ID token associated with the one-time ticket are received and verified, and if appropriate, the browser embedded in the application and the service providing server 10 Establish an authentication session between them.

  This will be specifically described. Here, an example of four authentication processes in the authentication system 100 of FIG. 1 will be described using the four sequence diagrams shown in FIGS.

  FIG. 4 is a sequence diagram illustrating a first authentication processing example in the authentication system 100 of FIG. The first authentication processing example is a case where a session has already been established with a client terminal in both the service providing server 10 and the authentication server 20. This sequence may be started when the user executes the application via the user interface 60.

  In the first authentication processing example, the terminal control unit 56 indicates an SDK in an application to be subjected to login processing. In addition, the browser processing unit 54 processes a hidden browser among the three browsers.

  First, the terminal control unit 56 notifies the browser processing unit 54 of a message for starting the browser, and starts the browser (S10).

  The browser processing unit 54 notifies the service providing server 10 of a message for requesting login, and requests login to the SDK service (S12). Here, the service providing server 10 verifies whether a session has already been established with the client terminal (S14).

  Here, in the first authentication processing example, since a session has already been established with the client terminal, the service providing server 10 verifies the authentication request to the browser processing unit 54 as verification OK. The message is notified together with the ID token, and the client terminal is made to perform an authentication request to the authentication server 20 (S16).

  Next, the browser processing unit 54 notifies the authentication server 20 of the ID token received from the service providing server 10 and a message indicating an authentication request (S18).

  The authentication server 20 verifies the notified ID token and determines whether a session has already been established with the client terminal (S20). In the first authentication processing example, since a session has already been established with the client terminal, the authentication server 20 sends a message indicating that login is permitted and a one-time ticket as a response to the previous authentication request. Is sent to the browser processing unit 54 (S22). This one-time ticket is a time-expired ticket, and the client terminal returns this ticket to the authentication server 20 via the service providing server 10 within a predetermined period, thereby obtaining an access token indicating the access authority. It is something that can be done.

  The browser processing unit 54 notifies the service providing server 10 of a message indicating that login is permitted sent from the authentication server 20 together with a code that is a one-time ticket (S24). Here, the service providing server 10 notifies the authentication server 20 of a message for requesting an access token for the client terminal together with the code (S26).

  The authentication server 20 confirms the notified code, verifies that it is issued for the client terminal, issues an access token, and sends it to the service providing server 10 (S28). The service providing server 10 sends the access token to the browser processing unit 54 (S30). Further, the browser processing unit 54 sends an access token to the terminal control unit 56 (S32). As described above, the client terminal can obtain the access token and execute the application.

  FIG. 5 is a sequence diagram illustrating a second authentication processing example in the authentication system 100 of FIG. The second authentication processing example is a case where a session is already established with the client terminal only in the authentication server 20 and not established in the service providing server 10.

  In the second authentication processing example, the terminal control unit 56 indicates an SDK (Software Development Kit) in an application for which a user performs login. In addition, the browser processing unit 54 processes a hidden browser among the three browsers.

  This sequence may be started when the user executes the application via the user interface 60. Note that the processes in S10 and S12 in FIG. 4 are the same as those in the first authentication process example, and thus illustration and description thereof are omitted, and the process from S14 will be described.

  In S14, the service providing server 10 verifies whether a session has already been established with the client terminal. However, in the second authentication processing example, the client terminal has not established a session with the service providing server 10. Therefore, the client terminal ID token is not held. Here, the service providing server 10 notifies the browser processing unit 54 of an authentication confirmation message (S40), and confirms whether a session is established in the authentication server 20.

  Next, the browser processing unit 54 notifies the authentication server 20 of a message as an authentication request (S42). Here, the authentication server 20 determines whether or not a session has already been established with the client terminal (S44). Here, since the session has already been established, the authentication server 20 notifies the browser processing unit 54 of a message that the authentication has been confirmed and a code that is a one-time ticket (S46).

  The browser processing unit 54 notifies the service providing server 10 of a message indicating that the authentication has been confirmed together with a code that is a one-time ticket (S48). Here, the service providing server 10 notifies the authentication server 20 of a message for requesting an access token for the client terminal together with the code (S50).

  The authentication server 20 confirms the notified code, verifies that it is issued for the client terminal, issues an access token, and sends it to the service providing server 10 together with the ID token ( S52). This is because the service providing server 10 does not have the client terminal ID token in the second authentication processing example.

  The service providing server 10 verifies the validity of the ID token by comparing the received ID token with secret information relating to the application stored in advance (S54). If the verification result is valid, the service providing server 10 sends an access token to the browser processing unit 54 (S56). Further, the browser processing unit 54 sends an access token to the terminal control unit 56 (S58). As described above, the session with the service providing server 10 is also established, and the client terminal can execute the application using the access token.

  FIG. 6 is a sequence diagram illustrating a third authentication processing example in the authentication system 100 of FIG. The third authentication processing example is a case where a session is not established with the client terminal in both the authentication server 20 and the service providing server 10. In this case, it is assumed that the application is first launched.

  In the third authentication processing example, it is assumed that the terminal control unit 56 indicates an SDK in an application for which a user performs login. The browser processing unit 54 processes two of the three browsers, the hidden embedded browser and the embedded browser. In FIG. 6, the hidden embedded browser is illustrated as a first browser and the embedded browser is illustrated as a second browser.

  This sequence may be started when the user executes the application via the user interface 60. Note that the processing up to S44 in FIG. 5 is the same as that in the second authentication processing example, and therefore illustration and description thereof are omitted. Here, the processing from S44 will be described.

  In S44, the authentication server 20 determines whether a session has already been established with the client terminal (S44). Here, since the session has not been established, the authentication server 20 notifies the first browser of a message for performing login processing via the service providing server 10 together with an error response (S70).

  The first browser notifies the terminal control unit 56 of a message for starting the login process (S72), and thereafter, the browser process is switched to the second browser capable of screen display. Here, the terminal control unit 56 notifies the second browser of a message for requesting login processing (S74).

  Here, the second browser displays the user interface 60 (S76) and prompts input from the user. When receiving an input such as a user ID or a password from the user via the user interface 60, the terminal control unit 56 notifies the information input from the user to the second browser as credential information (S78). The second browser notifies the authentication server 20 of the information notified from the terminal control unit 56 (S80).

  The authentication server 20 checks the user ID and user password stored in advance and verifies the validity of the notified information (S82). If it is valid, the authentication server 20 notifies the second browser of the message indicating that the authentication has been confirmed, together with the code that is the one-time ticket (S84).

  The second browser notifies the service providing server 10 of a message that the authentication has been confirmed together with the code that is a one-time ticket (S86). Here, the service providing server 10 notifies the authentication server 20 of a message for requesting an access token for the client terminal together with the code (S50).

  Here, the authentication server 20 notifies the service providing server 10 of a code for requesting an access token for the client terminal and the ID token (S52).

  The service providing server 10 verifies the validity of the ID token by comparing the received ID token with the secret information about the application stored in advance (S54). If the verification result is valid, the service providing server 10 sends an access token to the second browser (S88). Further, the second browser sends an access token to the terminal control unit 56 (S90). As described above, a session is established between both the service providing server 10 and the authentication server 20, and the client terminal can execute the application using the access token.

  FIG. 7 is a sequence diagram illustrating a fourth authentication processing example in the authentication system 100 of FIG. The fourth authentication processing example is a case where a session is not established with the client terminal in both the authentication server 20 and the service providing server 10 in the application. In addition, it is assumed that a session is established in an external browser that functions as a browser external to the application. In this case, it is assumed that the application is started after the login process is completed using an external browser.

  In the fourth authentication processing example, it is assumed that the terminal control unit 56 indicates an SDK in an application for which a user performs login. The browser processing unit 54 processes three of the three browsers: a hidden embedded browser, an embedded browser, and an external browser. In FIG. 6, the hidden embedded browser is illustrated as the first browser, the embedded browser is illustrated as the second browser, and the external browser is illustrated as the specific browser. The specific browser is a browser that operates outside the application.

  This sequence may be started when the user executes the application via the user interface 60. Since the processing up to S76 in FIG. 5 is the same as the third authentication processing example, illustration and description thereof will be omitted, and the processing from S76 will be described here.

  Here, the second browser displays the user interface 60 (S76) and prompts input from the user. When a login request using a specific browser is received from the user via the user interface 60, the terminal control unit 56 notifies the specific browser of the information (S110). The specific browser notifies the service providing server 10 of a message for requesting SSO processing using the external browser (S112).

  The service providing server 10 notifies the specific browser of a message related to the authentication request (S114). Next, the specific browser notifies the authentication server 20 of a message related to the authentication request (S116).

  Here, the authentication server 20 verifies the session information with the external browser (S118), and notifies the message that the authentication with the code and the ID token as a one-time ticket has been confirmed (S120).

  The specific browser notifies the service providing server 10 of a message that the authentication has been confirmed together with the ID token (S122). The service providing server 10 verifies the ID token (S124), and notifies the specific browser of a message that the authentication is confirmed (S126).

  Further, the specific browser notifies the terminal control unit 56 of a message for completing the session processing in the application together with the code acquired from the authentication server 20 (S128). In response to this, the terminal control unit 56 notifies the first browser together with the code (S130). Here, since it is not necessary to accept input from the user, the first browser is notified instead of the second browser in consideration of speeding up of processing and user convenience.

  The first browser notifies the service providing server 10 of the message with the code (S132). Here, the service providing server 10 notifies the authentication server 20 of a message for requesting an access token for the client terminal together with the code (S50).

  Here, the authentication server 20 notifies the service providing server 10 of a message for requesting an access token for the client terminal, a code, and an ID token (S52).

  The service providing server 10 verifies the validity of the ID token by comparing the received ID token with the secret information stored in advance regarding the client terminal (S54). If the verification result is valid, the service providing server 10 sends an access token to the first browser (S56). Further, the first browser sends an access token to the terminal control unit 56 (S58). As described above, the session between both the service providing server 10 and the authentication server 20 is also established, and the client terminal can execute the application using the access token.

  In the case where a session is established in any one of them, the session information can be established efficiently by complementing the session information held in any one of them.

  According to the above aspect, the service providing server 10 and the authentication server 20 that have received the authentication request from the client terminal cooperate with each other, and authentication is performed based on the authentication information about the client terminal stored in advance in each server. By executing the process, the service providing server 10 and the authentication server 20 can complete the authentication process, so that a more secure authentication process can be realized.

  Further, the authentication process can be performed securely by executing the authentication process using a one-time ticket issued in association with the client terminal. Further, by passing the one-time ticket to the client terminal and returning it to the authentication server 20 via the service providing server 10, the service providing server 10 and the authentication server 20 do not hold the secret information of the application in the client terminal. Since the authentication process can be completed, a more secure authentication process can be realized.

  Also, when authentication confirmation of the ID token of the client terminal that is the authentication request source is successful, or when login processing from an application running on the client terminal is confirmed, it is determined that a session is established Thus, secure SSO processing can be executed efficiently.

  When a session is established between the application running on the authentication request source client terminal and the service providing server 10, the service providing server 10 includes an ID token for the client terminal. Issuing session information, the authentication server 20 efficiently executes secure SSO processing by verifying whether the session is established by verifying the ID token obtained via the client terminal can do.

  Further, when a session is not established between the authentication server 20 and the application activated in the authentication request source client terminal, the client terminal sends user information to the authentication server 20, and the authentication server 20 After verifying the received user information, an ID token is also issued together with the access token and transmitted to the service providing server 10, and the service providing server 10 verifies the acquired ID token and establishes a session to thereby secure the session. SSO processing can be executed efficiently.

  In addition, when authentication processing is first performed with the service providing server 10 by the first browser, and a session is not established between the application running on the authentication requesting client terminal and the service providing server 10 And when making a user input user information, in order to receive user information, a 2nd browser is started and it switches to the authentication process between a 2nd browser and the service provision server 10. FIG. As a result, the secure SSO process can be executed more smoothly without making the user aware of the fact that the authentication process is being performed.

  In addition, even if a session is not established between the authentication server 20 and the application activated in the authentication request source client terminal, the session is not established between the specific browser of the client terminal and the authentication server 20. If established, the secure SSO process can be efficiently executed by starting the specific browser instead of the second browser and switching to the process between the specific browser and the service providing server 10. it can.

  Further, the service providing server 10 manages the secret information of the client terminal, and performs session management for browser identification when the service providing server 10 and the client terminal storing the application are linked on the service providing server 10. By doing this, stronger security is ensured.

  Specifically, when application cooperation is sandwiched during an authentication transaction, the platform can guarantee cookie management for identifying embedded browsers before and after cooperation. There is no need to store the secret information of the client terminal used in communication with the authentication server 20 in the install type application. Therefore, fraudulent acts such as authentication ticket replacement attacks are not easily established, and enhanced security can be realized.

  In the above, this invention was demonstrated based on the Example. The present invention is not limited to the above-described embodiments and the contents of each embodiment, and various modifications can be made within the scope of the gist of the present invention. Those skilled in the art will understand that the above-described embodiments are exemplifications, and that various modifications can be made to combinations of the respective constituent elements and processing processes, and such modifications are also within the scope of the present invention. .

  10 service providing server, 12 server communication unit, 14 authentication processing unit, 16 server memory, 20 authentication server, 30 network, 40 base station, 40a first base station, 40b second base station, 40c third base station, 50 mobile Terminal 50a first mobile terminal 50b second mobile terminal 50c third mobile terminal 52 terminal communication unit 54 browser processing unit 56 terminal control unit 58 terminal memory 60 user interface 70 PC terminal 100 authentication system .

Claims (4)

A client terminal that stores one or more applications, a service providing server that connects to the client terminal via a network, provides a service to the client terminal, and connects to the client terminal and the service providing server; In an authentication method in a system including an authentication server to be executed,
When a session is established between the authentication server and at least one target application in the client terminal,
The service providing server receives an authentication request from the client terminal, and transmits authentication request information for requesting confirmation of authentication to the client terminal.
The client terminal receives authentication request information from the service providing server, and transmits authentication request information for requesting confirmation of authentication to the authentication server,
The authentication server receives authentication request information from the client terminal and transmits ticket information that is a one-time ticket indicating that the client terminal is authenticated by the authentication server to the client terminal;
The client terminal receives ticket information from the authentication server and transmits the ticket information to the service providing server,
The service providing server receives ticket information from the client terminal and sends an access request for permission of access together with the ticket information to the authentication server,
The authentication server receives ticket information and an access request from the service providing server, and if the ticket information is issued by the authentication server, an access token that permits access and an ID that identifies the target application Token to the service providing server,
The service providing server receives the access token and the ID token from the authentication server, and transmits the access token to the client terminal if the verification of the ID token and the secret information relating to the application stored in advance is appropriate. To
An authentication method characterized by that. A client terminal that stores one or more applications, a service providing server that connects to the client terminal via a network, provides a service to the client terminal, and connects to the client terminal and the service providing server; An authentication system including an authentication server to execute,
When a session is established between the authentication server and at least one target application in the client terminal,
The service providing server receives an authentication request from the client terminal, and transmits authentication request information for requesting confirmation of authentication to the client terminal.
The client terminal receives authentication request information from the service providing server, and transmits authentication request information for requesting confirmation of authentication to the authentication server,
The authentication server receives authentication request information from the client terminal and transmits ticket information that is a one-time ticket indicating that the client terminal is authenticated by the authentication server to the client terminal;
The client terminal receives ticket information from the authentication server and transmits the ticket information to the service providing server,
The service providing server receives ticket information from the client terminal and sends an access request for permission of access together with the ticket information to the authentication server,
The authentication server receives ticket information and an access request from the service providing server, and if the ticket information is issued by the authentication server, an access token that permits access and an ID that identifies the target application Token to the service providing server,
The service providing server receives the access token and the ID token from the authentication server, and transmits the access token to the client terminal if the verification of the ID token and the secret information relating to the application stored in advance is appropriate. To
An authentication system characterized by that. A client terminal that stores one or more applications, a service providing server that connects to the client terminal via a network, provides a service to the client terminal, and connects to the client terminal and the service providing server; A service providing server in an authentication system including an authentication server to be executed,
When a session is established between the authentication server and at least one target application in the client terminal,
In response to an authentication request from the client terminal, sends authentication request information requesting confirmation of authentication to the client terminal,
When a client terminal is authenticated in the authentication server that has received the authentication request information via the client terminal, ticket information that is a one-time ticket indicating the authentication is received from the authentication server via the client terminal. ,
Receiving ticket information from the client terminal, and sending an access request for permission of access together with the ticket information to the authentication server;
When the ticket information is issued in the authentication server, an access token that permits access, an ID token that identifies the target application, and the authentication server are received,
If the verification of the ID token and secret information related to the application stored in advance is valid, the access token is transmitted to the client terminal.
A service providing server characterized by that. A client terminal that stores one or more applications, a service providing server that connects to the client terminal via a network, provides a service to the client terminal, and connects to the client terminal and the service providing server; An authentication server in an authentication system including:
When a session is established between the authentication server and at least one target application in the client terminal,
The authentication request information transmitted from the service providing server that has received the authentication request from the client terminal is received via the client terminal,
When the client terminal is authenticated by the authentication server , the ticket information that is a one-time ticket indicating that is transmitted to the client terminal,
Receiving an access request for access permission together with the ticket information from the client terminal via the service providing server;
If the ticket information is issued by the authentication server, an access token that permits access and an ID token that identifies the target application are transmitted to the service providing server.
An authentication server characterized by that.

Images