WO2011017921A1

WO2011017921A1 - System and method for visiting a visited service provider

Info

Publication number: WO2011017921A1
Application number: PCT/CN2010/071187
Authority: WO
Inventors: 高宏伟; 林兆骥; 陈剑勇; 滕志猛; 李媛
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-08-11
Filing date: 2010-03-22
Publication date: 2011-02-17
Also published as: CN101998398A

Abstract

The present invention provides a system and method for visiting a visited service provider (SP). When a user visits the visited SP, a visited identity provider (IdP) acquires the user information and then, via the interface between the visited IdP and the home IdP of the user, requests the home IdP to authenticate the user; the home IdP returns the authentication result to the visited IdP after completing the authentication; the visited IdP transmits the authentication result to the visited SP; and the visited SP provides services for the user according to the authentication result; therein, the interface between the visited IdP and the home IdP is the same as the interface between the home SP and the home IdP. The technical solution disclosed in the present invention solves the problem of the user visiting an SP across different identity management (IdM) systems in the prior IdM system.

Description

System and method for accessing a visiting service provider

The present invention relates to secure communication technologies in network communication systems, and more particularly to a system and method for accessing a visited service provider. Background technique

IdM (Identity Management) refers to the management of the user's identity life cycle (usage process) and the relationship between user identity and network application services based on the network and related support technologies. For example, authenticate or authorize users accessing and applying resources. At present, IdM systems are still in a vertical structure independent of each other, and most of these IdM systems are established for specific application services. Interconnection between various IdM systems is impossible, and user information (such as user trust) cannot be realized. Sharing of information, authentication information).

The IdM system includes users, IdP (Identity Provider), SP (Service provide, Service Provider). In the authentication process, only when there is a trust relationship between the SP and the IdP, the SP can confirm that the authentication information of the user identity of the IdP is authentic and reliable, and can further provide services for the user. In the IdM system, IdP acts as an independent operator, which realizes the separation of identity services and application services. Through a series of query/response messages, IdP provides users with a series of services such as identity registration, identity management and identity authentication, so as to establish the trust level expected by the service between the SP and the user, and realize the user's access to the service.

As shown in FIG. 1 , a general process for authenticating a user in an IdM system in the prior art: Step 101: A user requests a service from a service provider SP;

Step 102: The service provider SP requires the user to perform identity authentication.

Step 103: The user sends the user ID and the location IdP address to the SP.

Step 104, the SP forwards the received user ID and the location IdP address to the IdP;

Step 105: The IdP sends a message to the user, requesting the user to input the credential information;

Step 106: The user sends its credential information to the IdP. Step 107: The IdP authenticates the identity information provided by the user.

Step 108: The IdP returns the authentication result to the SP.

Step 109: The SP provides a corresponding service to the user according to the obtained authentication result.

In the general IdM system, the SP of the visited place controls the user's access to its resources through the authentication of the IdP of the visited place, and the IdP of the visited place can only authenticate its own user, and when the users of other IdPs access it, , is considered an illegal user, the user must re-register, which is not convenient for the user and limits the development of the SP.

Summary of the invention

The technical problem to be solved by the present invention is to provide a system and method for accessing a visiting service provider, which solves the problem that users in an existing identity management system access SPs across different IdM systems.

In order to solve the above problems, the present invention provides a method for accessing a visited service provider, the method comprising:

When the user accesses the service provider of the visited place, the identity provider IdP of the visited place acquires the information of the user, and requests the user's home IdP through the interface between the identity provider IdP of the visited place and the IdP of the home place. Authenticate the user;

The attribution

The interface between the IdP of the visited place and the IdP of the home place is the same as the interface between the home service provider and the home IdP.

In the above method, the step of requesting the home IdP to perform the authentication by the visited IdP includes: the visited IdP sends an authentication request to the home IdP, where the authentication request carries the user identifier of the user;

After receiving the authentication request, the home IdP requests the user's credential information from the user, then authenticates the user, and returns the authentication result to the visited place IdP.

In the above method, after the visited site IdP receives the authentication result, the authentication result is performed. After the conversion, it is sent to the service provider of the visited place.

In the above method, after the visited IdP obtains the information of the user, the address check is performed according to the user's home address IdP address, and if the IdP address is the visited IdP address, the authentication is directly performed, otherwise the attribution is requested. IdP is certified.

The present invention also provides a system for accessing a visited service provider, including a user attribution

IdP, visiting IdP and the service provider of the visited place;

After the visited IdP is set to receive the information of the user, if the user is not the user of the location of the visited IdP, the authentication request is sent to the user's home IdP through the interface between the visited IdP and the home IdP. And sending the authentication result to the service provider of the visited place after receiving the authentication result; wherein the interface between the IdP of the visited place and the IdP of the home place is the same as the interface between the home service provider and the home IdP ;

The home IdP is configured to authenticate the user after receiving the authentication request, and return the authentication result to the visited place IdP;

The service provider of the visited place is arranged to provide the service to the user based on the authentication result.

In the above system, the visited IdP is further configured to receive the authentication result, perform format conversion on the visited result, and then send the authentication result to the service provider of the visited place.

In the above system, the visited IdP is further configured to perform an address check according to the home address IdP address after receiving the information of the user, and if the home address IdP address is the visited IdP address, directly perform authentication. Otherwise, the home address IdP is requested to perform authentication.

In the above system, the visited IdP is further configured to authenticate the user after receiving the information of the user, and checking that the home IdP address is the visited IdP address according to the home address IdP address, and Return the certification result to the service provider of the visited place.

In the above system, the visited IdP is further configured to receive the information of the user, and according to the home address IdP address, it is checked that the home IdP address is not the visited IdP address, and the information of the user is carried. The user identifier sends an authentication request to the home IdP through the interface between the IdP of the visited place and the IdP of the home. After receiving the authentication request, the home IdP requests the user's credential information from the user. , then authenticate the user and verify the result Return to the visited place IdP.

The present invention provides a system and method for accessing a visiting service provider, and solves the problem that a user accesses an SP across different IdM systems in an existing identity management system; and the method is simple and easy, and does not need to change the original IdM system authentication. The general model and communication mechanism, the IdM system only needs to add the forwarding and conversion authorization mechanism, which can solve the problem of access authentication across the IdM system. The invention of the method satisfies the user's needs and enables the IdM system to be more widely used. . BRIEF abstract

1 is a general flowchart of a prior art IdM system for authenticating a user;

2 is a schematic diagram of each member instance when a user accesses an SP across different IdPs;

FIG. 3 is a flow chart of authenticating a user when a user accesses an SP across different IdPs according to the present invention.

Preferred embodiment of the invention

The embodiment provides a system for accessing a visited service provider. As shown in FIG. 2, the call includes the visited IdP, the home IdP, and the visited SP. When the user visits the visited SP, the visited SP requests the visited IdP. (ie, the IdP at the location of the visited SP) authenticates the user, and the visited IdP assumes the role of the IdP. Since the user does not belong to the user of the visited place, the visited IdP cannot authenticate it, and then requests the home IdP to authenticate the user. At this time, the visited site IdP appears as the role of the SP. specifically:

The SP of the visited place is used to request the user to perform identity authentication after receiving the request for providing the service by the user, and after receiving the user ID and the home IdP address sent by the user, send an authentication request to the IdP of the SP location, and carry the user ID. And the home address IdP address; and is also used to receive the user authentication result returned by the IdP of the local location, and provide the corresponding service to the user according to the authentication result.

After receiving the authentication request, the visited IdP determines whether the user is the local user, and directly authenticates, if not, requests the IdP of the user's home location to authenticate the user ID, and carries the user ID; After the authentication result returned by the home IdP, the result is format converted, converted to a format supported by the system, and then sent to the SP of the location.

After receiving the authentication request, the home IdP obtains the credential information of the user according to the user ID. Then, authentication is performed based on information such as the user ID and its credentials, and the authentication result is returned to the visited place IdP. The interface between the visited IdP and the home IdP is the same as the interface between the home SP and the home IdP.

This embodiment provides a method for accessing a visited service provider. As shown in FIG. 3, the following steps are included:

Step 301: The user terminal provides a service request to the SP of the visited place.

Step 302: The SP server of the visited place requests the user terminal to perform identity authentication.

Step 303: The user provides the user ID and the IdP address of the user location according to the requirement.

Step 304: The SP server in the visited area receives the ID provided by the user and the registered IdP address (that is, the IdP address where the user is located), and forwards it to the IdP of the SP location to request the authenticated user.

Step 305: The visited IdP receives the ID of the user provided by the SP of the visited place and the IdP address of the user location, and first performs an address check. If the IdP address of the user location is itself, the authentication is directly performed, and the authentication result is returned. Otherwise, go to step 306.

Step 306: The visited IdP system acts as an SP, and sends an authentication request to the user's home IdP, where the user ID is carried;

Step 307: The user home IdP receives the authentication request, and sends a message to the user corresponding to the user ID, requesting the user to input the credential information;

Step 308, the user sends its credential information to its home IdP;

Step 309: The user's home location IdP authenticates the user according to information such as the user ID and credentials. Step 310: The user's home IdP returns the authentication result to the visited IdP, and carries the user ID. Step 311: The visited IdP receives the authentication result of the user, and maps the authentication result to the authentication result of the visit. The mapping refers to converting the received authentication result into a format and converting the authentication result into the system format.

Step 312: The visited place IdP returns the converted authentication result to the visited place SP.

Step 313: The visited place SP provides the corresponding service for the user according to the authentication result.

The interface between the visited IdP and the home IdP and the home service provider and the home IdP The interface between them is the same.

INDUSTRIAL APPLICABILITY The technical solution disclosed by the present invention solves the problem that a user accesses an SP across different IdM systems in an existing identity management system, and the method is simple and easy, and does not need to change the general model and communication mechanism of the original IdM system authentication, IdM The system only needs to add the forwarding and conversion authorization mechanism, which can solve the problem of access authentication across the IdM system. The invention of the method satisfies the user's needs and enables the IdM system to be more widely used.

Claims

Claim

1. A method of accessing a visiting service provider, comprising:

When the user accesses the service provider of the visited place, the visited identity provider IdP obtains the information of the user, and requests the home address IdP to authenticate the user through the interface between the visited IdP and the home IdP;

The interface between the visited IdP and the home IdP and the interface between the home service provider and the home IdP are the same.

2. The method of claim 1 wherein

The step of the visited IdP requesting the home IdP to perform authentication includes:

The visited IdP sends an authentication request to the home IdP, where the authentication request carries the user identifier of the user;

After receiving the authentication request, the home IdP requests the user's credential information from the user, and authenticates the user after receiving the credential information of the user.

3. The method of claim 2, further comprising:

After receiving the authentication result, the visited IdP performs format conversion and sends the authentication result to the service provider of the visited place.

4. The method of claim 1 further comprising:

After obtaining the information of the user, the visited IdP performs an address check according to the user's home address IdP address, and if the user's home IdP address is the visited IdP address, the authentication is directly performed, otherwise the attribution is requested. IdP is certified.

5. A system for accessing a visiting service provider, comprising:

a service provider of the user's home address provider IdP, the visited place IdP, and the visited place, wherein the visited place IdP is set to receive the information of the user, and if the user is not the user of the location of the visited place IdP, Defining an interface between the visited IdP and the home IdP to the user The home IdP sends an authentication request; and after receiving the authentication result, the authentication result is sent to the service provider of the visited place; wherein the interface between the visited IdP and the home IdP and the home service provider The same interface as the home address IdP;

6. The system of claim 5, wherein

The visited place IdP is further configured to, after receiving the authentication result, formatally convert the authentication result to the service provider of the visited place.

7. The system of claim 5, wherein

The visited IdP is further configured to perform an address check according to the home address IdP address after receiving the information of the user, and if the home address IdP address is the visited IdP address, directly perform authentication, otherwise request the attribution. The ground IdP is certified.

8. The system of claim 7, wherein

The visited IdP is further configured to: after receiving the information of the user, and checking, according to the home address IdP address, that the home address IdP address is the visited IdP address, authenticating the user, and authenticating the user The result is returned to the service provider of the visited place.

9. The system of claim 7, wherein

The visited IdP is further configured to: after receiving the information of the user, and checking, according to the home address IdP address, that the home IdP address is not the visited IdP address, carrying the user identifier in the information of the user And sending, by the interface between the visited IdP and the home IdP, an authentication request to the home IdP, where the home IdP receives the authentication request, and requests the user from the user The credential information is then authenticated to the user and the authentication result is returned to the visited place IdP.