KR20050077658A - System and method for combining identities - Google Patents

Abstract

The present invention relates to an ID federation system and method thereof. According to the present invention, the ID provider issues a temporary ID for each user so that individual service providers can use a desired virtual ID for each service provider while maintaining their original ID management scheme. In this way, a user can designate a desired type of ID to various service providers, and by using a mixture of temporary IDs and virtual IDs, ID tracking through the network is impossible, thereby ensuring personal privacy as much as possible.

Description

ID federation system and its method {SYSTEM AND METHOD FOR COMBINING IDENTITIES}

The present invention relates to an ID federation system and a method in a web service environment.

In general, a web service includes a user, a service requester, a service provider, and a web service directory (Universal Description, Discovery, and Integration (UDDI)).

The service requester finds a web service desired by the user through UDDI, prepares an interface for the service, and requests the service from the service provider. At this time, reliable authentication is required between the service requester and the plurality of service providers.

In addition, when passing through a plurality of service providers to process one service requested by a service requester, there is a hassle of having to receive services after individually authenticating each service provider.

This is not a big problem if you can give a single unified management to each user under the entire web service environment. However, since each service provider maintains a unique ID system, it is practically impossible to unify these IDs uniformly.

An object of the present invention is to provide a system and a method for federating and using IDs for a plurality of service providers in a web service environment.

The ID federation system according to the characteristics of the present invention for solving this problem is registered within the predetermined trust area from the user and registered with the virtual ID of the desired form for each service providing system for providing a web service, the service from the service providing system ID providing system for randomly issuing a temporary ID per user used once when receiving the; And a service request system for issuing the temporary ID from the ID provider system in response to the user's request and requesting a service to the service providing system using the temporary ID.

The service providing system,

Request a virtual ID corresponding to the temporary ID for which a service is requested from the service request system to the ID providing system, authenticate the user and perform a service through the virtual ID received from the ID providing system,

The execution result is transmitted to the service request system corresponding to the temporary ID.

In addition, the service providing system,

The temporary ID and the virtual ID information are stored for a predetermined time, and if a service is requested with the same temporary ID within the predetermined time, the service is performed using the stored virtual ID information.

The service request system,

The user is provided with a temporary ID for the user from the ID providing system through authentication using a user ID registered in advance in the ID providing system.

The ID providing system,

Authentication information for proving that the temporary ID is issued to the user is transmitted together with the temporary ID.

In addition, the service request system,

A service is requested to the service providing system included in the trusted area based on the authentication information.

An ID federation method according to an aspect of the present invention is a method for federating and managing a user's ID for the service providing system belonging to a predetermined trusted area in a web service environment including a service request system, a service providing system, and an ID providing system.

a) registering, by the service requesting system, the virtual ID desired by the user for each service providing system in the ID providing system in response to a user request; b) in response to the user's request, the service requesting system requests the ID providing system to issue a temporary ID for the user, receives a temporary ID, and requests a service from the service providing system using the temporary ID. step; c) receiving, by the service providing system, the virtual ID information of the temporary ID from the ID providing system to receive a virtual ID, and performing the requested service using the virtual ID.

In step b),

The ID providing system transmits authentication information together with the temporary ID,

C),

The reliability of the temporary ID is determined based on the temporary ID and authentication information received from the service request system.

Further, in step c),

The service providing system stores the virtual ID and the temporary ID information for a predetermined time, and performs a service using the stored virtual ID when a service is requested with the same temporary ID within the predetermined time.

In step c),

The service providing system provides the service execution result to the service request system corresponding to the temporary ID.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention. Like parts are designated by like reference numerals throughout the specification.

First, an ID federation system according to an embodiment of the present invention will be described in detail with reference to FIG. 1.

1 illustrates an ID federation system according to an embodiment of the present invention.

According to an embodiment of the present invention, a web service environment is divided into a plurality of trust zones, and each trust zone includes an identity provider that can be trusted by all service providers in the trust zone.

That is, as shown in FIG. 1, the ID federation system according to the embodiment of the present invention includes a service requester 100, an ID provider 200, and a service provider 300, which represent web services. The user requests and receives a desired service through the service requester 100.

The ID provider 200 registers the user's ID information and a virtual ID to be used by the service provider 300 in the corresponding trust area from the user. In this case, the virtual ID is an ID required for a specific service provider to recognize a user and includes all IDs of a user's desired form including an anonymous. The ID provider 200 manages a virtual ID registered from a user in the form of a virtual ID table for each user. In addition, the ID provider 200 transmits the user's virtual ID to the service provider 300 according to the request of the service provider 300.

When the service requester 100 receives a service request from the user, the service requester 100 requests user authentication from the ID provider 200 based on the ID and authentication information registered by the user to the ID provider 200, and the ID provider 200 requests the service requester 100. After the verification process for the authentication request of the user is issued a temporary ID for the actual ID. At this time, the ID provider 200 reissues a temporary ID every time a user requests authentication through the service requester 100. In addition, the ID provider 200 transmits authentication information together with the temporary ID to prove that the temporary ID has been issued to the user.

There may be a variety of methods such as the ID provider 200 to generate the authentication information, such as digital signature, and the description thereof is omitted since such a technique is already known.

The service requester 100 may request a reliable service from all the service providers 300 in the trust region through the authentication information. In addition, since the service requester 100 uses the temporary ID and authentication information issued from the ID provider 200 until the end of the user's session, the service requester 100 may make a service request to all service providers 300 included in the same trust zone. There is no need to ask the ID provider 200 for authentication each time.

The service provider 300 verifies the reliability through the temporary ID and authentication information received from the service requester 100, and requests the ID provider 200 for the virtual ID of the user corresponding to the temporary ID. The service provider 300 performs a service through the virtual ID received from the ID provider 200, and transmits the result to the service requester 100 corresponding to the temporary ID. In this case, the service provider 300 stores the temporary ID and the virtual ID information for a predetermined time, and when a service request comes in with the same temporary ID thereafter, the service provider 300 performs the service with the stored virtual ID without requesting the virtual ID from the ID provider 200. can do.

In addition, the service provider 300 transmits a temporary ID, authentication information, and service history of the service requester 100 to another service provider when the service requester 100 needs to receive a service from another service provider in order to perform the service requested by the service requester 100. .

Next, the operation of the ID federation system according to the embodiment of the present invention will be described in detail with reference to FIG. 2.

2 illustrates an operation of an ID federation system according to an embodiment of the present invention.

First, the user registers ID information and a service provider-specific virtual ID to be used in the trusted area to the ID provider 200 in the specific trust area through the service requester 100 (S201).

Thereafter, the user accesses the service requester 100 to receive the service and requests authentication from the ID provider 200 through his real ID (S202).

The ID provider 200 issues a temporary ID for the actual ID after verifying the authentication request of the service requester 100 (S203). At this time, the ID provider 200 adds the authentication information to the temporary ID and transmits it to the service requester 100.

Thereafter, the service requester 100 requests a service with a temporary ID and authentication information to the service provider 300 providing the corresponding service according to the user's request (S204).

The service provider 300 receiving the temporary ID and the authentication information from the service requester 100 confirms that the temporary ID is issued through the reliable ID provider 200 through the verification process (S205).

Thereafter, the service provider 300 requests a virtual ID corresponding to the temporary ID from the ID provider 200 (S206). In this case, an authentication procedure according to a previously promised method is performed between the service provider 300 and the ID provider 200.

The ID provider 200 retrieves the temporary ID corresponding to the temporary ID and the service provider 300 from the virtual ID mapping table according to the request of the service provider 300 and informs the service provider 300. In addition, the service provider 300 may store the temporary ID and the virtual ID information, and if the service is subsequently requested from the same temporary ID, the process of requesting the virtual ID may be omitted (S207).

The service provider 300 performs a service through the virtual ID received from the ID provider 200, and the service performance result is provided to the service requester 100 corresponding to the temporary ID (S208).

In addition, when access to another service provider 300-1 is required to perform a service, the service provider 300 requests the service provider 300-1 for a temporary ID, authentication information, and service details.

Thereafter, the service provider 300-1 performs a service requested from the service provider 300, and the overall procedure is the same as the service performing procedure of the service provider 300, and thus description thereof is omitted.

Although the preferred embodiment of the present invention has been described in detail above, the present invention is not limited thereto, and various other changes and modifications are possible.

As described above, according to the present invention, individual service providers can satisfy a service provider and a user at the same time by allowing a user to use a desired ID for each service provider while maintaining their original ID management scheme.

In addition, individual users can assign various types of IDs to service providers. ID providers manage virtual IDs for each user through a virtual ID mapping table, so there is almost no possibility of duplication and conflict due to integration and single ID.

In addition, by using a mixture of temporary IDs and virtual IDs, it is impossible to track IDs through the network, ensuring maximum personal privacy.

1 is a diagram illustrating an ID federation system according to an embodiment of the present invention.

2 is a diagram illustrating an operation process of an ID federation system according to an embodiment of the present invention.

Claims (11)

It registers a virtual ID of the type desired by a user for each service providing system that exists in a predetermined trust area and provides a web service, and randomly issues a temporary ID per user, which is used once when the service is provided from the service providing system. ID providing system; And A service request system for issuing the temporary ID from the ID provider system in response to a request of the user and requesting a service to the service providing system using the temporary ID; ID federation system comprising a. The method of claim 1, The service providing system, Requesting a virtual ID corresponding to the temporary ID for which a service is requested from the service request system to the ID providing system, and authenticating the user and performing a service through the virtual ID received from the ID providing system; Identity federation system. The method of claim 2, The service providing system, Transmitting the execution result to the service request system corresponding to the temporary ID Identity federation system. The method of claim 2, The service providing system, The temporary ID and the virtual ID information is stored for a predetermined time, and if a service is requested with the same temporary ID within the predetermined time, the service is performed using the stored virtual ID information. Identity federation system. The method of claim 1, The service request system, Receiving a temporary ID for the user from the ID providing system through authentication using a user ID registered in advance in the ID providing system Identity federation system. The method of claim 5, The ID providing system, Transmitting the authentication information with the temporary ID to prove that the temporary ID is issued for the user Identity federation system. The method of claim 6, The service request system, Requesting a service from the service providing system included in the trusted area based on the authentication information Identity federation system. In a web service environment including a service request system, a service providing system, and an ID providing system, a method for concatenating and managing a user's ID for the service providing system belonging to a predetermined trusted area, a) registering, by the service requesting system, the virtual ID desired by the user for each service providing system in the ID providing system in response to a user request; b) in response to the user's request, the service requesting system requests the ID providing system to issue a temporary ID for the user, receives a temporary ID, and requests a service from the service providing system using the temporary ID. step; c) receiving, by the service providing system, the virtual ID information for the temporary ID from the ID providing system to receive a virtual ID, and performing the requested service using the virtual ID; ID federation method comprising a. The method of claim 8, In step b), The ID providing system transmits authentication information together with the temporary ID, C), The reliability of the temporary ID is determined based on the temporary ID and authentication information received from the service request system. ID federation method. The method of claim 8, In step c), The service providing system stores the virtual ID and the temporary ID information for a predetermined time, and performs a service using the stored virtual ID when a service is requested with the same temporary ID within the predetermined time. ID federation method. The method of claim 8 or 10, In step c), The service providing system provides the service execution result to the service request system corresponding to the temporary ID. ID federation method.