JP6153228B2 - Authentication system - Google Patents

Description

  The present invention relates to an authentication system including a service providing apparatus that provides a service to a terminal and a management server having a database unit.

  Conventionally, when using a service providing apparatus that provides a service to a terminal, a user needs to set an ID for each service and receive authentication. A single sign-on technique exists as a technique for eliminating the complexity of ID management and the like.

  As this single sign-on technology, there are an ID unified type, an ID deposit type, an ID linkage type, and the like (see Patent Document 1). In the unified ID type, an ID is set by a central certification authority, and a service is provided by an ID set in each service server. In the ID deposit type, the ID and password set in each service site are registered in the central certification authority, and after the user authentication is performed with the ID set in the central certification authority, the central certification authority acts for each user. In this method, an ID and a password for each service server are transmitted to each service server, and the service server authenticates again. In the ID linkage type, each service server manages the ID, and the ID of the authentication proxy server and the ID between the service sites are associated with each other by a temporary name and operated.

JP 2007-299303 A

  However, even in the conventional single sign-on technology, the user who receives the service needs to set an ID for each service, which is complicated.

  The present invention has been made in consideration of the above problems, and an object of the present invention is to provide an authentication system in which a user can manage IDs flexibly and easily.

  An authentication system according to the present invention includes a terminal, a service providing apparatus that provides a service to the terminal, and a management server having a database unit in which authentication information for receiving the service is recorded. The authentication information acquired from SNS (social networking service) is recorded in the unit, and the service providing apparatus authenticates service provision to the terminal based on the authentication information.

  In the authentication system, the service is set according to a use authority of the service providing apparatus.

  According to the authentication system of the present invention, authentication information acquired from SNS (social networking service) is recorded in a database unit, and based on the authentication information, authentication of service provision to a terminal is performed, so that a user can ID can be managed flexibly and easily, and single sign-on can be easily performed.

It is explanatory drawing of the authentication system which concerns on embodiment of this invention. 2A is an explanatory diagram of the terminal, FIG. 2B is an explanatory diagram of the terminal table, and FIG. 2C is a menu displayed on the display unit of the terminal. FIG. 3A is an explanatory diagram of a service providing apparatus, FIG. 3B is an explanatory diagram of a service table, and FIG. 3C is an explanatory diagram of a level table. FIG. 4A is an explanatory diagram of the management server, and FIG. 4B is an explanatory diagram of the management table. It is explanatory drawing of the authentication item information table of SNS. It is explanatory drawing of the process sequence of the authentication system which concerns on embodiment of this invention.

  Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is an explanatory diagram of an authentication system 10 according to an embodiment of the present invention. 2A is an explanatory diagram of the terminal 20, FIG. 2B is an explanatory diagram of the terminal table 28, and FIG. 2C is a menu 32 displayed on the display unit 30 of the terminal 20. 3A is an explanatory diagram of the service providing apparatus 100, FIG. 3B is an explanatory diagram of the service table 108, and FIG. 3C is an explanatory diagram of the level table 110. FIG. 4A is an explanatory diagram of the management server 200, and FIG. 4B is an explanatory diagram of the management table 208. FIG. 5 is an explanatory diagram of authentication item information tables 210a to 210c of SNS (social networking service).

<Description of Configuration of Authentication System 10>
The authentication system 10 includes a terminal 20, a service providing apparatus 100, and a management server 200. The terminal 20 can be connected to the service providing apparatus 100 and the management server 200 via the public line 12.

  The terminal 20 is a terminal having a communication function. The public line 12 is a public line constituted by the Internet or the like.

  The terminal 20 includes a terminal control unit 22, a communication unit 24, a storage unit 26, and a display unit 30. The terminal control unit 22 is a control unit that mainly controls operations and functions of the terminal 20. The communication unit 24 performs communication processing with the service providing apparatus 100 and the management server 200. The storage unit 26 includes a terminal table 28.

  The terminal table 28 stores authentication items and authentication information for using the service providing apparatus 100. In the terminal table 28, Ia and Ib are stored as authentication information for the authentication items A and B, respectively. In addition, for the authentication items C to F, a DB indicating that authentication information is acquired from the management table 208 of the management server 200 is stored. The display unit 30 is a display unit on which a menu 32 for selecting a service provided to the terminal 20 by the service providing apparatus 100 is displayed.

  The authentication item is not limited as long as the user of the terminal 20 can be specified. For example, the user ID, telephone number, mail address, biometric information, medical data, sensor data, and various histories are included as authentication items. Here, the biological information includes, for example, the height, weight, blood pressure, heart rate, sex, fingerprint, palm shape, retina, iris, face, blood vessel shape, voice, ear shape, and DNA of the user of the terminal 20. It is. As medical data, for example, a medical history is included. The sensor data includes, for example, position information based on GPS, temperature, humidity, and moving speed. The various histories include, for example, a product purchase history and an access history to the service providing apparatus 100.

  The service providing apparatus 100 includes a service control unit 102, a communication unit 104, and a storage unit 106. The service control unit 102 is a control unit that mainly performs operation and function control of services provided to the terminal 20 and authentication of the terminal 20. The communication unit 104 performs communication processing with the terminal 20. The storage unit 106 includes a service table 108 and a level table 110.

  The service table 108 stores authentication items and authentication information for using the service providing apparatus 100 for each user. In the service table 108, Ia to If are stored as authentication information for the authentication items A to F, respectively.

  In the level table 110, authentication items are set for each level for services provided to the terminal 20. In order to receive the provision of server level 1, authentication of authentication items A and B is required. In order to receive provision of the server level 2, authentication of the authentication items A to D is required. In order to receive the provision of the server level 3, authentication of the authentication items A to F is required.

  Services that can be used by the service providing apparatus 100 include a server, a USB memory, a printer, a network device, and an ATM. Examples of services provided by the service providing apparatus 100 include VDI (Virtual Desktop Infrastructure), applications, and cloud services.

  The authentication system 10 includes a plurality of service providing apparatuses 100, and each service providing apparatus 100 implements each service. On the terminal 20, among the services, server level 1, server level 2, server level 3, VDI, USB memory, printer, and application divided according to authority are displayed in a menu 32 so that they can be selected. Note that the authority to use the server level increases as the number increases.

  The management server 200 includes a management control unit 202, a communication unit 204, and a database unit 206. The management control unit 202 is a control unit that mainly performs overall control of the management server 200, update and management of the database unit 206. The communication unit 204 performs communication processing with the terminal 20. The database unit 206 includes a management table 208.

  The management table 208 stores authentication items and authentication information for using the service providing apparatus 100. The authentication items and authentication information of the management table 208 are acquired from the SNS by the management control unit 202 and stored. Generally, each SNS stores authentication items and authentication information in different formats. The management control unit 202 acquires authentication items and authentication information in consideration of the storage format of each SNS, and stores them in the management table 208. Also, the management control unit 202 periodically acquires authentication items and authentication information from each SNS, and updates the management table 208.

  In the management table 208, authentication information Ic to Ie corresponding to the authentication items C to E is acquired from the SNS1. Similarly, authentication information If to Ih corresponding to authentication items F to H is acquired from SNS2, and authentication information Ii to Ik corresponding to authentication items I to K is acquired from SNS3.

  SNS1 includes an authentication item information table 210a, SNS2 includes an authentication item information table 210b, and SNS3 includes an authentication item information table 210c. In the authentication item information table 210a, Ic to Ie are stored as authentication information for the authentication items C to E, respectively. In the authentication item information table 210b, If to Ih are stored as authentication information for the authentication items F to H, respectively. In the authentication item information table 210c, Ii to Ik are stored as authentication information for the authentication items I to K, respectively.

<Description of Operation of Authentication System 10>
Next, the operation of the authentication system 10 will be described with reference to FIG. FIG. 6 is an explanatory diagram of a processing procedure of the authentication system 10 according to the embodiment of the present invention. Hereinafter, a case where the service providing apparatus 100 is a server and the server level 2 is used will be described. Note that, when the server level is the server level 1 or the server level 3, the processing procedure is the same as that of the server level 2, and thus the description thereof is omitted. Further, when the service providing apparatus 100 provides a service other than the server, the processing procedure is the same as that when the service providing apparatus 100 is a server, and thus description thereof is omitted.

  First, the user selects server level 2 as a service to be used in the menu 32 of the terminal 20. The terminal control unit 22 transmits a service target used by the user to the service providing apparatus 100 via the communication unit 24 (step S1).

  The service control unit 102 of the service providing apparatus 100 receives the service target via the communication unit 104 and collates with the level table 110. Since the service target is the use of server level 2, the service control unit 102 refers to the level table 110 to indicate that the authentication items A to D for using the service providing apparatus 100 are requested. It transmits to the terminal 20 via 104 (step S2).

  In the terminal 20, the display unit 30 displays that the authentication information corresponding to the authentication item is to be transmitted to the service providing apparatus 100. When the user selects consent to transmit authentication information to the service providing apparatus 100 on the display unit 30, the terminal control unit 22 compares the obtained authentication item with the terminal table 28 (step S3). As a result of the collation, the terminal control unit 22 acquires Ia and Ib from the terminal table 28 as authentication information for the authentication items A and B. Further, the terminal control unit 22 acquires DB from the terminal table 28 as authentication information for the authentication items C and D. Since the acquired authentication information is a DB, the terminal control unit 22 transmits to the management server 200 via the communication unit 204 that authentication information for the authentication items C and D is requested (step S4).

  The management control unit 202 of the management server 200 receives the request for authentication information via the communication unit 204, and collates with the management table 208 (step S5). As a result of the collation, the management control unit 202 acquires Ic and Id as authentication information for the authentication items C and D from the management table 208 and transmits them to the terminal 20 via the communication unit 204.

  The terminal control unit 22 receives the authentication information Ic and Id, and transmits the authentication information Ia and Ib already acquired to the service providing apparatus 100 via the communication unit 24 (step S6).

  The service control unit 102 receives the authentication information Ia, Ib, Ic, and Id and collates with the service table 108. As a result of the collation, when the service control unit 102 determines that the authentication information matches the service table 108, use of the server level 2 for the terminal 20 is permitted. Thereby, the user can use the service providing apparatus 100 as a server at the server level 2 by the terminal 20 (step S7).

  As described above, the authentication system 10 includes the management server having the terminal 20, the service providing apparatus 100 that provides a service to the terminal 20, and the database unit 206 in which authentication information for receiving the service is recorded. 200, the authentication information acquired from the SNS is recorded in the database unit 206, and the service providing apparatus 100 authenticates service provision to the terminal 20 based on the authentication information. . In the authentication system 10, the service is set according to the usage authority of the service providing apparatus 100.

  According to the authentication system 10, the authentication information acquired from the SNS is recorded in the database unit 206, and the user is authenticated flexibly and simply by authenticating the provision of the service to the terminal 20 based on the authentication information. ID can be managed and single sign-on can be easily performed.

  It should be noted that the present invention is not limited to the above-described embodiment, and various configurations can be adopted without departing from the gist of the present invention.

DESCRIPTION OF SYMBOLS 10 ... Authentication system 12 ... Public line 20 ... Terminal 22 ... Terminal control part 24, 104, 204 ... Communication part 26, 106 ... Storage part 28 ... Terminal table 30 ... Display part 32 ... Menu 100 ... Service provision apparatus 102 ... Service control Unit 108 ... service table 110 ... level table 200 ... management server 202 ... management control unit 206 ... database unit 208 ... management tables 210a to 210c ... authentication item information table

Claims (2)

A terminal,
A service providing device for providing a service to the terminal;
A management server having a database unit in which authentication information for receiving provision of the service is recorded;
With
In the database unit, the authentication information acquired from SNS (social networking service) is recorded,
The service providing apparatus authenticates service provision to the terminal based on the authentication information. The authentication system according to claim 1,
The authentication system according to claim 1, wherein the service is set according to a use right of the service providing apparatus.

Images