JP2005227891A - Device, method and program for providing authentication service, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To make setting and alteration of the setting easy and to provide a single sign-on. <P>SOLUTION: An authentication service providing device has an authentication service providing means 60 of providing service regarding authentication corresponding to a service providing means of providing service, and also has an authentication request receiving means (SQ40) of receiving an authentication request from a client 50 using the service provided by the service providing means, an certification information generation means of generating certification information regarding authentication at the authentication request, an authentication response transmitting means (SQ41) of sending the certification information to the client, and an validity confirmation request receiving means (SQ43) of receiving a request to confirm validity of the certification information which includes the certification information sent to the client from another authentication service providing means 70 of providing service regarding authentication. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an authentication service providing apparatus, an authentication service providing method, an authentication service providing program, and a recording medium.

  An example of the relationship between a service providing service that provides a service to a client and an authentication service providing service that provides a service related to authentication (hereinafter simply referred to as an authentication service) will be described with reference to FIG. FIG. 1 is a sequence diagram for explaining an example of a relationship between a service providing service that provides a service to a client and an authentication service.

  First, in order to use the service provided by the service providing service A for the service providing service A that provides the service that the user wants to use, the client service authenticates in which authentication service. A service use inquiry for inquiring whether it is acceptable is transmitted (sequence SQ1).

  When the service providing service A receives the service use inquiry, the service providing service A provides an authentication service (authentication service B in the example of FIG. 1) that provides a service related to authentication necessary for using the service provided by the service providing service A. A service use inquiry response including an identifier or the like is created and transmitted to the requesting client service (sequence SQ2).

  When the client service receives a service use inquiry response from the service providing service A, the client service requests the user to input authentication data such as a user ID and a password, and sends an authentication request including the input user ID and password to the user. It transmits to the identifier of the authentication service included in the service use inquiry response (sequence SQ3).

  When the authentication service B receives the authentication request, the authentication service B performs authentication based on, for example, the user ID and password included in the authentication request, and if it is determined that the combination is a valid user ID and password, the authentication is verified. Create an authentication ticket to be used.

  The authentication service B creates an authentication response including an authentication ticket ID for identifying the authentication ticket, and transmits it to the requesting client service (sequence SQ4).

  When receiving the authentication response, the client service creates a service use request including the authentication ticket ID included in the authentication response and transmits it to the service providing service A (sequence SQ5).

  When the service providing service A receives the service use request from the client service, the service providing service A uses the authentication ticket ID included in the service use request to create a confirmation request for confirming whether the authentication ticket ID is a valid authentication ticket ID. .

  Service providing service A transmits a confirmation request to corresponding authentication service B (sequence SQ6).

  Upon receiving the confirmation request, the authentication service B determines whether there is a corresponding authentication ticket from among the authentication tickets managed in the authentication service B based on the authentication ticket ID included in the confirmation request. Confirmation is performed, and a confirmation response including the confirmation result is generated and transmitted to the service providing service A that is the request source (sequence SQ7).

  When the service providing service A receives the confirmation response from the authentication service B, the service providing service A refers to the confirmation result included in the confirmation response and determines that the confirmation result indicates that the authentication ticket ID is valid. Provide services corresponding to.

  The service providing service A creates a service use response including a service result indicating the result of the provided service, and transmits it to the requesting client service (sequence SQ8).

  As described with reference to FIG. 1, when a client service wants to use a certain service, it is necessary to perform authentication in an authentication service associated with the service providing service that provides the service. Therefore, when the client service intends to use a different service, it is necessary to perform authentication again in a different authentication service.

  Hereinafter, an example of normal sign-on when authentication is performed in different authentication services will be described with reference to FIG. FIG. 2 is a sequence diagram for explaining an example of normal sign-on.

  In the following, for simplification of description, the service providing service as described with reference to FIG. 1 is omitted, and description will be made using a client service and an authentication service.

  First, the client service requests the user to input authentication data such as a user ID and a password, creates an authentication request including the input user ID and password, and transmits the authentication request to the authentication service A. (Sequence SQ10).

  When the authentication service A receives the authentication request, the authentication service A performs authentication based on, for example, the user ID and password included in the authentication request, and if it is determined that the combination is a valid user ID and password, the authentication is proved. Create an authentication ticket to be used.

  The authentication service A creates an authentication response including an authentication ticket ID for identifying the authentication ticket, and transmits it to the requesting client service (sequence SQ11).

  When the client service receives a notification from the user that another service is to be used, the client service again requests the user to input authentication data such as a user ID and password in order to use the service. An authentication request including the received user ID and password is created, and the authentication request is transmitted to the authentication service (authentication service B in the example of FIG. 2) corresponding to the service (sequence SQ12).

  When the authentication service B receives the authentication request, the authentication service B performs authentication based on, for example, the user ID and password included in the authentication request, and if it is determined that the combination is a valid user ID and password, the authentication is verified. Create an authentication ticket to be used.

  The authentication service B creates an authentication response including an authentication ticket ID for identifying the authentication ticket, and transmits it to the requesting client service (sequence SQ13).

  As shown in FIG. 2, each time the client service intends to use a different service, the user is asked to input authentication data such as a user ID and a password, and authentication is performed using a different authentication service. There was a problem that needs to be done.

  In order to solve such a problem, single sign-on has attracted attention in recent years as a system that enables a user to use all permitted services only by receiving authentication once.

  Hereinafter, an example of single sign-on in the prior art will be described with reference to FIG. FIG. 3 is a sequence diagram for explaining an example of single sign-on in the prior art.

  First, the client service requests the user to input authentication data such as a user ID and a password, and stores the input user ID and password.

  The client service creates an authentication request including the stored user ID and password, and transmits the authentication request to authentication service A (sequence SQ20).

  When the authentication service A receives the authentication request, the authentication service A performs authentication based on, for example, the user ID and password included in the authentication request, and if it is determined that the combination is a valid user ID and password, the authentication is proved. Create an authentication ticket to be used.

  The authentication service A creates an authentication response including an authentication ticket ID for identifying the authentication ticket, and transmits it to the requesting client service (sequence SQ21).

  In addition, when the client service receives a notification from the user that another service is to be used, the client service creates an authentication request including the stored user ID and password in order to use the service, It transmits to the authentication service (authentication service B in the example of FIG. 3) corresponding to the service (sequence SQ22).

  When the authentication service B receives the authentication request, the authentication service B performs authentication based on, for example, the user ID and password included in the authentication request, and if it is determined that the combination is a valid user ID and password, the authentication is verified. Create an authentication ticket to be used.

  The authentication service B creates an authentication response including an authentication ticket ID for identifying the authentication ticket and transmits it to the requesting client service (sequence SQ23).

  As described in FIG. 3, by storing the user ID and password input by the user in the client service, the user can input all the permitted user IDs and passwords only once, for example. You can use the service.

  In the example of FIG. 3, for the sake of simplification of description, the same user ID and password are used for authentication service A and authentication service B for the same user. As an explanation.

  Hereinafter, another example of single sign-on in the prior art will be described with reference to FIG. FIG. 4 is a sequence diagram for explaining another example of single sign-on in the prior art.

  First, the client service requests the user to input authentication data such as a user ID and a password, and stores the input user ID and password.

  The client service creates an authentication request including the stored user ID and password, and transmits the authentication request to authentication service A (sequence SQ30).

  Upon receiving the authentication request, authentication service A transmits the authentication request to an external authentication server that performs actual authentication processing (sequence SQ31).

  When the external authentication server receives the authentication request, the external authentication server performs authentication based on, for example, the user ID and password included in the authentication request, and proves the authentication if it determines that the combination is a valid user ID and password. Create an authentication ticket to be used.

  The external authentication server creates an authentication response including an authentication ticket ID for identifying the authentication ticket, and transmits it to the requesting authentication service A (sequence SQ32).

  When receiving the authentication response, the authentication service A transmits the authentication response to the client service (sequence SQ33).

  In addition, when the client service receives a notification from the user that another service is to be used, the client service creates an authentication request including the stored user ID and password in order to use the service, It transmits to the authentication service (authentication service B in the example of FIG. 4) corresponding to the service (sequence SQ34).

  Upon receiving the authentication request, authentication service B transmits the authentication request to an external authentication server that performs the actual authentication processing (sequence SQ35).

  When the external authentication server receives the authentication request, the external authentication server performs authentication based on, for example, the user ID and password included in the authentication request, and proves the authentication if it determines that the combination is a valid user ID and password. Create an authentication ticket to be used.

  The external authentication server creates an authentication response including an authentication ticket ID for identifying the authentication ticket, and transmits it to the requesting authentication service B (sequence SQ36).

  When receiving the authentication response, the authentication service B transmits the authentication response to the client service (sequence SQ37).

  As described with reference to FIG. 4, by using an external authentication server that performs the actual authentication behind each authentication service, the user is permitted to enter the user ID and password once, for example. All services that are available.

  As another example of single sign-on, instead of the method described in FIG. 3 and FIG. 4, for example, a mutual trust relationship is set between services, and once authenticated in a certain service, There is a method of making other services available even in other services for which a mutual trust relationship is set.

  However, in the single sign-on system described with reference to FIGS. 3 and 4 above, it is necessary to implement a function for storing authentication data such as a user ID and a password in the client service, and there is also a problem in terms of security. was there.

  Further, the method of setting the mutual trust relationship between services has a problem that the setting is complicated and the change of the mutual trust relationship setting due to the increase or decrease of the service cannot be flexibly dealt with.

  The present invention has been made in view of the above points, and an object of the present invention is to provide a single sign-on that can be easily set and changed.

  In order to solve the above problem, the present invention provides an authentication service providing apparatus having an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service, provided by the service providing means. An authentication request receiving unit that receives an authentication request from a client that uses the service to be performed; a proof information generating unit that generates proof information related to authentication in response to the authentication request; and the proof information is transmitted to the client. Validity confirmation request receiving means for receiving a confirmation request for validity of the certification information including the certification information transmitted to the client from an authentication response transmission means and another authentication service providing means for providing a service related to authentication It is characterized by having.

  The authentication service providing unit corresponds to, for example, the general authentication service 60 in the first embodiment described later. The client corresponds to, for example, the client service 50 in the first embodiment described later. Other authentication service providing means corresponds to, for example, the remote authentication service 70 in the first embodiment to be described later. The authentication request receiving unit corresponds to, for example, a sequence SQ40 and / or step S10 in the first embodiment described later. Further, the certification information creation means corresponds to, for example, step S12 in the first embodiment described later. The authentication response transmission means corresponds to, for example, a sequence SQ41 and / or step S14 in the first embodiment described later. Further, the validity confirmation request receiving unit corresponds to, for example, a sequence SQ43 and / or step S20 in the first embodiment described later. The certification information corresponds to, for example, a first general authentication ticket or a first general authentication ticket ID described later.

  The present invention also provides an authentication service providing apparatus having an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service, from a client using a service provided by the service providing means. Authentication request receiving means for receiving an authentication request, first proof information creating means for creating first proof information related to authentication in response to the authentication request, and authentication for sending the first proof information to the client A request for creating second proof information related to the first proof information including the first proof information transmitted to the client is received from a response transmitting means and another authentication service providing means for providing a service related to authentication. And second proof information creation request receiving means.

  Note that the authentication service providing means corresponds to, for example, the general authentication service 60 in Example 2 described later. The client corresponds to, for example, a client service 50 according to a second embodiment described later. The other authentication service providing means corresponds to, for example, the remote authentication service 70 in the second embodiment described later. The authentication request receiving unit corresponds to, for example, a sequence SQ50 in the second embodiment described later. The authentication response transmission unit corresponds to, for example, a sequence SQ51 in the second embodiment described later. The second certification information creation request receiving means corresponds to, for example, a sequence SQ53 and / or step S40 in the second embodiment described later. The first certification information corresponds to, for example, a first general authentication ticket or a first general authentication ticket ID described later. The second certification information corresponds to, for example, a second general authentication ticket or a second general authentication ticket ID described later.

  Further, the present invention is an authentication service providing apparatus having an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service, and another authentication service providing means for providing a service related to authentication The authentication request receiving means for receiving the authentication request, the first certification information creating means for creating the first certification information related to the authentication in response to the authentication request, and the first certification information as the other certification service Authentication response transmitting means for transmitting to the providing means; second certification information relating to authentication issued by the other authentication service providing means from the client using the service provided by the service providing means; and providing the other authentication service Identification information for identifying means, and third proof information creation request receiving means for receiving a request to create third proof information related to authentication including And wherein the door.

  The authentication service providing unit corresponds to, for example, the general authentication service 60 in the third embodiment described later. The client corresponds to, for example, a client service 50 according to a third embodiment described later. Other authentication service providing means corresponds to, for example, the remote authentication service 70 in the third embodiment described later. The authentication request receiving unit corresponds to, for example, a sequence SQ61 and / or step S80 in a third embodiment described later. The first proof information creating unit corresponds to, for example, step S82 in Example 3 described later. Further, the authentication response transmission unit corresponds to, for example, a sequence SQ62 and / or step S84 in the third embodiment described later. The third certification information creation request receiving unit corresponds to, for example, a sequence SQ64 and / or step S90 in the third embodiment described later. The first certification information corresponds to, for example, a first general authentication ticket or a first general authentication ticket ID described later. The second certification information corresponds to, for example, a remote authentication ticket and / or a remote authentication ticket ID in the third embodiment described later. The third certification information corresponds to, for example, a second general authentication ticket or a second general authentication ticket ID described later.

  Further, the present invention is an authentication service providing apparatus having an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service, and another authentication service providing means for providing a service related to authentication Accordingly, an authentication request receiving means for receiving an authentication request, a first proof information creating means for creating first proof information related to authentication in response to the authentication request, and an encryption means for encrypting the first proof information Authentication response transmitting means for transmitting the first certification information and the first authentication information encrypted by the encryption means to the other authentication service providing means, and a service provided by the service providing means Second authentication information related to authentication issued by the other authentication service providing means and identification information for identifying the other authentication service providing means. A third certification information creation request receiving means for receiving a request to create a third certification information related to authentication including information, and characterized by having a.

  Note that the authentication service providing means corresponds to, for example, the general authentication service 60 in Example 4 described later. The client corresponds to, for example, a client service 50 according to a fourth embodiment described later. The other authentication service providing means corresponds to, for example, the remote authentication service 70 in the fourth embodiment described later. The authentication request receiving unit corresponds to, for example, a sequence SQ71 and / or step S120 in a fourth embodiment described later. The first proof information creating means corresponds to, for example, step S122 in Example 4 described later. The encryption unit corresponds to, for example, step S123 in the fourth embodiment described later. The authentication response transmission unit corresponds to, for example, a sequence SQ72 and / or step S125 in the fourth embodiment described later. The third proof information creation request receiving means corresponds to, for example, a sequence SQ74 and / or step S130 in a fourth embodiment described later. The first certification information corresponds to, for example, a first general authentication ticket or a first general authentication ticket ID described later. The second certification information corresponds to, for example, a remote authentication ticket and / or a remote authentication ticket ID in a fourth embodiment described later. The third certification information corresponds to, for example, a second general authentication ticket or a second general authentication ticket ID described later.

  The present invention also provides an authentication service providing apparatus having an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service, from a client using a service provided by the service providing means. A second proof information creation request receiving means for receiving a request to create second proof information related to authentication, including the first proof information related to authentication issued by another authentication service providing means that provides a service related to authentication; Validity confirmation request transmitting means for transmitting a confirmation request for validity of the first proof information including the first proof information to the other authentication service providing means, and validity of the first proof information Validity confirmation response receiving means for receiving the confirmation response of the validity of the certification information including the confirmation result from the other authentication service providing means, and the first certification information If the validity is confirmed, in response to the creation request for the second certification information related to the authentication, and having a, a second certification information generation means for generating a second certification information relating to authentication.

  The authentication service providing unit corresponds to, for example, the remote authentication service 70 in the first embodiment described later. The client corresponds to, for example, the client service 50 in the first embodiment described later. The other authentication service providing means corresponds to, for example, the general authentication service 60 in the first embodiment described later. The second certification information creation request receiving means corresponds to, for example, a sequence SQ42 and / or step S30 in the first embodiment described later. Further, the validity confirmation request transmitting unit corresponds to, for example, a sequence SQ43 and / or step S33 in the first embodiment described later. The validity confirmation response receiving unit corresponds to, for example, a sequence SQ44 and / or step S34 in the first embodiment described later. The second certification information creation means corresponds to, for example, step S36 in the first embodiment described later. The first certification information corresponds to, for example, a first general authentication ticket or a first general authentication ticket ID described later. The second certification information corresponds to, for example, a remote authentication ticket or a remote authentication ticket ID in Example 1 described later.

  The present invention also provides an authentication service providing apparatus having an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service, from a client using a service provided by the service providing means. A third proof information creation request receiving means for receiving a request to create third proof information related to authentication, including the first proof information related to authentication issued by other authentication service providing means for providing a service related to authentication; Second certification information creation request transmitting means for transmitting a creation request for second certification information relating to the first certification information, including the first certification information, to the other authentication service providing means; Second proof information creation response receiving means for receiving a creation response including the second proof information from the service providing means, and a request for creating third proof information related to the authentication In response, associated with the second certification information received by the second certification information creation response receiving means, and having a, a third certification information generation means for generating a third certification information relating to authentication.

  The authentication service providing unit corresponds to, for example, the remote authentication service 70 in the second embodiment described later. The client corresponds to, for example, a client service 50 according to a second embodiment described later. The other authentication service providing means corresponds to, for example, the general authentication service 60 in the second embodiment described later. The third certification information creation request receiving means corresponds to, for example, a sequence SQ52 and / or step S50 in the second embodiment described later. Further, the second certification information creation request transmission means corresponds to, for example, a sequence SQ53 and / or step S53 in the second embodiment described later. The second certification information creation response receiving means corresponds to, for example, a sequence SQ54 and / or step S54 in the second embodiment described later. The third proof information creating unit corresponds to, for example, step S56 in Example 2 described later. The first certification information corresponds to, for example, a first general authentication ticket or a first general authentication ticket ID described later. The second certification information corresponds to, for example, a second general authentication ticket or a second general authentication ticket ID described later. The third certification information corresponds to, for example, a remote authentication ticket or a remote authentication ticket ID in the second embodiment described later.

  The present invention also provides an authentication service providing apparatus having an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service, from a client using a service provided by the service providing means. Authentication request receiving means for receiving an authentication request, authentication request transmitting means for transmitting the authentication request to another authentication service providing means for providing a service related to authentication, and authentication created by the other authentication service providing means. The authentication response receiving means that receives the first certification information from the other authentication service providing means, and the authentication response associated with the first certification information received by the authentication response receiving means in response to the authentication request And second proof information creating means for creating second proof information.

  The authentication service providing unit corresponds to, for example, the remote authentication service 70 in the third embodiment described later. The client corresponds to, for example, a client service 50 according to a third embodiment described later. The other authentication service providing means corresponds to, for example, the general authentication service 60 in Example 3 described later. The authentication request receiving unit corresponds to, for example, a sequence SQ60 and / or step S60 in a third embodiment described later. The authentication request transmitting unit corresponds to, for example, a sequence SQ61 and / or step S62 in the third embodiment described later. The authentication response receiving unit corresponds to, for example, a sequence SQ62 and / or step S63 in a third embodiment described later. The second certification information creation means corresponds to, for example, step S64 in the third embodiment described later. The first certification information corresponds to, for example, a first general authentication ticket or a first general authentication ticket ID described later. The second certification information corresponds to, for example, a remote authentication ticket or a remote authentication ticket ID in the third embodiment described later.

  The present invention also provides an authentication service providing apparatus having an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service, from a client using a service provided by the service providing means. Authentication request receiving means for receiving an authentication request, authentication request transmitting means for transmitting the authentication request to another authentication service providing means for providing a service related to authentication, and authentication created by the other authentication service providing means. The first response information and the encrypted first verification information received from the other authentication service providing unit from the authentication response receiving unit, and received in the authentication response receiving unit in response to the authentication request. The second proof information for authentication is created by associating the first proof information with the encrypted first proof information. A certification information creating means, and having a.

  Note that the authentication service providing means corresponds to, for example, the remote authentication service 70 in the fourth embodiment described later. The client corresponds to, for example, a client service 50 according to a fourth embodiment described later. The other authentication service providing means corresponds to, for example, the general authentication service 60 in Example 4 described later. The authentication request receiving unit corresponds to, for example, a sequence SQ70 and / or step S100 in a fourth embodiment described later. The authentication request transmission unit corresponds to, for example, a sequence SQ71 and / or step S102 in a fourth embodiment described later. The authentication response receiving unit corresponds to, for example, a sequence SQ72 and / or step S103 in a fourth embodiment described later. The second certification information creation means corresponds to, for example, step S104 in the fourth embodiment described later. The first certification information corresponds to, for example, a first general authentication ticket or a first general authentication ticket ID described later. Further, the second certification information corresponds to, for example, a remote authentication ticket or a remote authentication ticket ID in Example 4 described later.

  The present invention also provides an authentication service providing apparatus having an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service, from a client using a service provided by the service providing means. Second authentication information related to authentication including first authentication information related to authentication issued by other authentication service providing means for providing a service related to authentication, and identification information identifying the other authentication service providing means Based on identification information for identifying the second certification information creation request receiving means for receiving the creation request and the other authentication service providing means, including the first certification information for the other authentication service providing means, The proof including a validity confirmation request transmitting means for transmitting a validity confirmation request for the first proof information, and a result of confirming the validity of the first proof information. When the validity of the first proof information is confirmed and the validity confirmation response receiving means for receiving the confirmation response of the validity of the information from the other authentication service providing means, the second proof information related to the authentication And second proof information creating means for creating second proof information related to authentication in response to the creation request.

  The authentication service providing means corresponds to, for example, the remote authentication service 70 in the fifth embodiment described later. The client corresponds to, for example, a client service 50 according to a fifth embodiment described later. The other authentication service providing means corresponds to, for example, the general authentication service 60 in Example 5 described later. The second certification information creation request receiving unit corresponds to, for example, a sequence SQ82 in the fifth embodiment described later. Further, the validity confirmation request transmitting unit corresponds to, for example, a sequence SQ83 in a fifth embodiment described later. Also, the validity confirmation response receiving means corresponds to, for example, a sequence SQ84 in the fifth embodiment described later. The first certification information corresponds to, for example, a first general authentication ticket or a first general authentication ticket ID described later. The second certification information corresponds to, for example, a remote authentication ticket or a remote authentication ticket ID in Example 1 described later.

  According to the present invention, setting and change of setting are simple and single sign-on can be provided.

  Further, as means for solving the above problems, an authentication service providing method, an authentication service providing program, and a recording medium may be used.

  According to the present invention, setting and change of setting are simple and single sign-on can be provided.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  Hereinafter, a service that has a directory service function and actually performs an authentication process based on authentication data such as a user ID and a password is referred to as a general authentication service. A service that does not have a directory service function, does not perform authentication processing based on authentication data such as a user ID or password, and has a one-way trust relationship (reference relationship) with respect to a general authentication service is referred to as a remote authentication service. .

  FIG. 5 is a hardware configuration diagram of an example of the general authentication service providing server.

  The hardware configuration of the general authentication service providing server 1 shown in FIG. 5 includes an input device 11, a display device 12, a drive device 13, a recording medium 14, and a ROM (Read Only) connected to each other via a bus. The memory 15 is composed of a RAM (Random Access Memory) 16, a CPU (Central Processing Unit) 17, an interface device 18, and an HDD 19.

  The input device 11 includes a keyboard and a mouse that are operated by a user of the general authentication service providing server 1 and is used to input various operation signals to the general authentication service providing server 1.

  The display device 12 includes a display or the like used by the user of the general authentication service providing server 1 and displays various types of information.

  The interface device 18 is an interface that connects the general authentication service providing server 1 to a network or the like.

  An application program corresponding to a general authentication service 60 to be described later, a main program for controlling the entire processing of the general authentication service providing server 1, and the like are provided to the general authentication service providing server 1 by a recording medium 14 such as a CD-ROM, for example. Or downloaded over the network. The recording medium 14 is set in the drive device 13, and the application program, the main program, and the like are installed from the recording medium 14 to the HDD 19 via the drive device 13.

  The ROM 15 stores data and the like. The RAM 16 reads and stores the application program, the main program, and the like from the HDD 19 when the general authentication service providing server 1 is activated. The CPU 17 executes processing according to the application program, the main program, etc. read and stored in the RAM 16.

  The HDD 19 stores data, files, programs, and the like. For example, the HDD 19 stores a general authentication ticket (to be described later), user information, and the like.

  Hereinafter, an exemplary hardware configuration of the remote authentication service providing server 2 will be described with reference to FIG.

  FIG. 6 is a hardware configuration diagram of an example of a remote authentication service providing server.

  The hardware configuration of the remote authentication service providing server 2 shown in FIG. 6 includes an input device 21, a display device 22, a drive device 23, a recording medium 24, a ROM 25, and a RAM 26 that are mutually connected by a bus. A CPU 27, an interface device 28, and an HDD 29.

  The input device 21 includes a keyboard and a mouse operated by a user of the remote authentication service providing server 2 and is used to input various operation signals to the remote authentication service providing server 2.

  The display device 22 is configured by a display or the like used by the user of the remote authentication service providing server 2 and displays various information.

  The interface device 28 is an interface for connecting the remote authentication service providing server 2 to a network or the like.

  An application program corresponding to the remote authentication service 70 to be described later, a main program for controlling the entire processing of the remote authentication service providing server 2, and the like are provided to the remote authentication service providing server 2 by a recording medium 24 such as a CD-ROM, for example. Or downloaded over the network. The recording medium 24 is set in the drive device 23, and the application program, the main program, and the like are installed from the recording medium 24 to the HDD 29 via the drive device 23.

  The ROM 25 stores data and the like. The RAM 26 reads and stores the application program, the main program, and the like from the HDD 29 when the remote authentication service providing server 2 is activated. The CPU 27 executes processing according to the application program, the main program, etc. read and stored in the RAM 26.

  The HDD 29 stores data, files, programs, and the like. For example, the HDD 29 stores a remote authentication ticket to be described later.

  As described above, in the embodiment of the present invention, the general authentication service 60 described later is mounted on the general authentication service providing server 1, and the remote authentication service 70 described later is mounted on the remote authentication service providing server 2. The explanation will be made assuming that The general authentication service 60 and the remote authentication service 70 may be mounted on the same server or the like.

  Hereinafter, an exemplary hardware configuration of the user terminal device 3 will be described with reference to FIG.

  FIG. 7 is a hardware configuration diagram of an example of a user terminal device.

  The hardware configuration of the user terminal device 3 shown in FIG. 7 includes an input device 31, a display device 32, a drive device 33, a recording medium 34, a ROM 35, a RAM 36, and a mutually connected bus. The CPU 37, the interface device 38, and the HDD 39 are configured.

  The input device 31 includes a keyboard and a mouse operated by a user of the user terminal device 3, and is used to input various operation signals to the user terminal device 3.

  The display device 32 includes a display or the like used by the user of the user terminal device 3 and displays various types of information.

  The interface device 38 is an interface that connects the user terminal device 3 to a network or the like.

  An application program corresponding to the client service 50 to be described later, a main program for controlling the entire processing of the user terminal device 3, or the like is provided to the user terminal device 3 by a recording medium 34 such as a CD-ROM or a network Downloaded through. The recording medium 34 is set in the drive device 33, and the application program, the main program, and the like are installed from the recording medium 34 to the HDD 39 via the drive device 33.

  The ROM 35 stores data and the like. The RAM 36 reads out and stores the application program, the main program, and the like from the HDD 39 when the user terminal device 3 is activated. The CPU 37 executes processing in accordance with the application program, the main program, etc. read and stored in the RAM 36.

  The HDD 39 stores data, files, programs, and the like. For example, the HDD 39 stores a general authentication ticket ID and a remote authentication ticket ID, which will be described later.

  Hereinafter, an example of processing related to single sign-on in the first embodiment will be described with reference to FIG. FIG. 8 is a diagram (No. 1) for explaining processing related to single sign-on according to the present invention.

  First, the client service 50 requests the user to input authentication data such as a user ID and a password, and transmits an authentication request including the input user ID and password to the general authentication service 60. (Sequence SQ40). An example of the authentication request will be described with reference to FIG.

  When receiving the authentication request, the general authentication service 60 performs authentication based on, for example, a user ID and a password included in the authentication request, and determines that the combination is a valid user ID and password. Create a first general authentication ticket to prove. Details of the first general authentication ticket will be described with reference to FIG.

  The general authentication service 60 creates an authentication response including the first general authentication ticket ID for identifying the first general authentication ticket, and transmits it to the requesting client service (sequence SQ41). An example of the authentication response will be described with reference to FIG.

  The client service 50 can use a service corresponding to the general authentication service 60 using the first general authentication ticket ID included in the authentication response.

  When the client service 50 receives a notification from the user that another service is to be used, the authentication ticket including the first general authentication ticket ID acquired and held in sequence SQ41 to use the service is used. An authentication request using the ID is created, and the authentication request is transmitted to the authentication service (remote authentication service 70 in the example of FIG. 8) corresponding to the service (sequence SQ42). An example of an authentication request using the authentication ticket ID will be described with reference to FIG.

  When receiving the authentication request using the authentication ticket ID, the remote authentication service 70 acquires the first general authentication ticket ID included in the authentication request, and the first general authentication ticket including the first general authentication ticket ID An ID validity check request is created.

  For example, when the remote authentication service 70 is installed in the remote authentication service providing server 2, the remote authentication service 70 is a URL (Uniform Resource Locator) of the general authentication service 60 written in an external authentication service management table to be described later. Then, the created validity confirmation request is transmitted to the general authentication service 60 (sequence SQ43). An example of the validity confirmation request will be described with reference to FIG.

  When the general authentication service 60 receives the validity confirmation request, the general authentication service 60 uses the first general authentication ticket ID included in the validity confirmation request to determine whether a corresponding valid first general authentication ticket exists, If it is determined that a corresponding valid first general authentication ticket exists, a validity confirmation response including a determination result (for example, OK) and a user name is created and transmitted to the requesting remote authentication service 70 (sequence SQ44). . An example of the validity confirmation response will be described with reference to FIG.

  When the remote authentication service 70 receives the validity confirmation response, the remote authentication service 70 refers to the determination result (confirmation result) included in the validity confirmation response. If, for example, OK is included, the remote authentication service 70 determines that the validity is confirmed, and performs authentication. Create a remote authentication ticket that proves Details of the remote authentication ticket will be described with reference to FIG.

  The remote authentication service 70 creates an authentication response using an authentication ticket ID including a remote authentication ticket ID for identifying the remote authentication ticket, and transmits it to the requesting client service (sequence SQ45). An example of an authentication response using the authentication ticket ID will be described with reference to FIG.

  The client service 50 can use a service corresponding to the remote authentication service 70 using the remote authentication ticket ID included in the authentication response using the authentication ticket ID.

  By performing the processing as shown in FIG. 8, single sign-on can be realized by a one-way reference relationship from the remote authentication service 70 without performing any special setting on the general authentication service 60 side. .

  Further, actual authentication using authentication data is performed only on the general authentication service 60 side, and management of user information and the like can be performed only on the general authentication service 60 side.

  A directory service that provides user information and the like can be shared by the general authentication service 60 side and the remote authentication service 70 side.

  Hereinafter, an example of the authentication request will be described with reference to FIG. FIG. 9 is a diagram for explaining an example of the authentication request.

  As shown in FIG. 9, the user ID is stored in the <authName> </ authName> tag of the authentication request. In addition, a password is stored in the <password> </ password> tag of the authentication request. In addition, the <duration> </ duration> tag of the authentication request stores the valid time of the first general authentication ticket in units of seconds.

  Hereinafter, an example of the authentication response will be described with reference to FIG. FIG. 10 is a diagram for explaining an example of the authentication response.

  As shown in FIG. 10, the first general authentication ticket ID is stored in the <return> </ return> tag of the authentication response.

  Hereinafter, an example of the authentication request using the authentication ticket ID will be described with reference to FIG. FIG. 11 is a diagram for explaining an example of the authentication request using the authentication ticket ID.

  As shown in FIG. 11, the first general authentication ticket ID is stored in the <masterAuthTicket> </ masterAuthTicket> tag of the authentication request using the authentication ticket ID. The <duration> </ duration> tag of the authentication request using the authentication ticket ID stores the effective time of the remote authentication ticket in units of seconds.

  Hereinafter, an example of the validity confirmation request will be described with reference to FIG. FIG. 12 is a diagram for explaining an example of the validity confirmation request.

  As shown in FIG. 12, the <authTicket> </ authTicket> tag of the validity confirmation request stores the first general authentication ticket ID.

  Hereinafter, an example of the validity confirmation response will be described with reference to FIG. FIG. 13 is a diagram for explaining an example of the validity confirmation response.

  As shown in FIG. 13, the <return> </ return> tag of the validity confirmation response includes a validity determination result (confirmation result). Also, user information (user name in the example of FIG. 13) is stored in the tag <userName> </ userName>.

  Hereinafter, an example of an authentication response using the authentication ticket ID will be described with reference to FIG. FIG. 14 is a diagram for explaining an example of an authentication response using the authentication ticket ID.

  As shown in FIG. 14, the remote authentication ticket ID is stored in the <return> </ return> tag of the authentication response using the authentication ticket ID.

  Hereinafter, an example of a functional configuration of the general authentication service 60 will be described with reference to FIG. FIG. 15 is a diagram for explaining an example of a functional configuration of the general authentication service.

  As shown in FIG. 15, the general authentication service 60 includes a user authentication unit 61, a user management unit 62, a ticket confirmation unit 63, and a ticket management unit 64.

  When the user authentication unit 61 receives a user ID and a password as input, the user authentication unit 61 refers to a user management table, which will be described later, managed by the user management unit 62 and performs authentication.

  If the authentication is successful, the user authentication unit 61 creates a new authentication ticket using the ticket management unit 64 and returns an authentication ticket ID for identifying the authentication ticket.

  The user management unit 62 manages information related to authentication data, for example, a table of combinations of user IDs and passwords (user management table).

  When the user management unit 62 receives the user ID and password as input, the user management unit 62 refers to the managed user management table, returns success (for example, OK) if the correct combination exists, and returns if the correct combination does not exist. Returns failure (eg NG).

  An example of the user management table will be described with reference to FIG.

  Upon receipt of the authentication ticket ID for identifying the authentication ticket as an input, the ticket confirmation unit 63 refers to the authentication ticket (for example, the first general authentication ticket and / or the second general authentication ticket) managed by the ticket management unit 64, Check if a valid authentication ticket exists.

  If the ticket confirmation unit 63 determines that a valid authentication ticket exists, it returns a user name and success (for example, OK), and if it determines that there is no valid authentication ticket, returns a failure (for example, NG).

  The ticket management unit 64 manages an authentication ticket (for example, a first general authentication ticket and / or a second general authentication ticket).

  Hereinafter, an example of the user management table will be described with reference to FIG. FIG. 16 is a diagram for explaining an example of the user management table.

  As shown in FIG. 16, in the user management table, a user ID and a password are managed as a pair.

  Hereinafter, an example of the first general authentication ticket will be described with reference to FIG. FIG. 17 is a diagram for explaining the first general authentication ticket.

  As shown in FIG. 17, the first general authentication ticket includes a first general authentication ticket ID, an expiration date, and user information.

  The first general authentication ticket ID stores an identifier for identifying the first general authentication ticket. The expiration date stores the expiration date of the first general authentication ticket. In the user information, the user information structure (user information structure) of the authenticated user is stored as it is.

  Hereinafter, an example of the user information structure will be described with reference to FIG. FIG. 18 is a diagram for explaining an example of the user information structure.

  As shown in FIG. 18, the user information structure includes a user ID, a domain name, and a name.

  The user ID stores an identifier for identifying the user. The domain name stores a domain name related to the user. The name stores the name of the user.

  Hereinafter, an example of a functional configuration of the remote authentication service 70 will be described with reference to FIG. FIG. 19 is a diagram for explaining an example of a functional configuration of the remote authentication service.

  As shown in FIG. 19, the remote authentication service 70 includes a user authentication unit 71, a ticket confirmation unit 72, a ticket management unit 73, an authentication proxy unit 74, and an authentication proxy management unit 75.

  When the user authentication unit 71 receives the authentication ticket ID (for example, the first general authentication ticket ID and / or the second general authentication ticket ID) as an input, the user authentication unit 71 issues a confirmation request for the authentication ticket ID via the authentication proxy unit 74, for example. When the authentication service ID is confirmed to be valid for the authentication service 60, a remote authentication ticket is created and written in the ticket management unit 73. Further, the user authentication unit 71 returns a remote authentication ticket ID for identifying the created remote authentication ticket.

  Further, as shown in an embodiment described later, when the user authentication unit 71 receives a user ID and a password as input, the user authentication unit 71 sends an authentication request to the general authentication service 60 via the authentication proxy unit 74 and acquires the acquired authentication. A remote authentication ticket including the ticket ID is created and written in the ticket management unit 73. Further, the user authentication unit 71 returns a remote authentication ticket ID for identifying the created remote authentication ticket.

  As shown in an embodiment to be described later, when the ticket confirmation unit 72 receives an authentication ticket ID for identifying an authentication ticket as an input, the ticket confirmation unit 72 refers to the authentication ticket (for example, a remote authentication ticket) managed by the ticket management unit 73 and validates it. Whether there is a valid authentication ticket.

  If the ticket confirmation unit 72 determines that a valid authentication ticket exists, it returns a user name and success (for example, OK), and if it determines that there is no valid authentication ticket, returns a failure (for example, NG).

  The ticket management unit 73 manages authentication tickets (for example, remote authentication tickets).

  The authentication proxy unit 74 receives an authentication request based on the user ID and password, calls an external authentication service (for example, the general authentication service 60), and returns a result returned from the external authentication service.

  When the authentication proxy unit 74 receives an authentication request including the authentication ticket ID (for example, the first general authentication ticket ID and / or the second general authentication ticket ID), the external authentication service (for example, the general authentication service 60) is similarly received. ) And returns the result returned from the external authentication service.

  Note that the authentication proxy unit 74 acquires identification information (URL) of the external authentication service from the authentication proxy management unit 75.

  The authentication proxy management unit 75 manages an external authentication service management table, which will be described later, and returns the URL of the external authentication service included in the external authentication service management table in response to a request.

  Hereinafter, an example of the remote authentication ticket will be described with reference to FIG. FIG. 20 is a diagram (part 1) for explaining the remote authentication ticket.

  As shown in FIG. 20, the remote authentication ticket includes a remote authentication ticket ID and an expiration date.

  The remote authentication ticket ID stores an identifier for identifying the remote authentication ticket. Further, the expiration date stores the expiration date of the remote authentication ticket. Although not shown in FIG. 20, the user name acquired from the general authentication service 60 may be included in the remote authentication ticket.

  Hereinafter, an example of the external authentication service management table will be described with reference to FIG. FIG. 21 is a diagram for explaining an example of the external authentication service management table.

  As shown in FIG. 21, the external authentication service management table stores the URL of the external authentication service.

  Hereinafter, an example of the authentication process in the general authentication service 60 will be described with reference to FIG. FIG. 22 is a flowchart (part 1) for explaining the authentication process in the general authentication service.

  In step S <b> 10, the general authentication service 60 receives the authentication request as shown in FIG. 9 including the user ID and password from the client service 50.

  In step S11 following step S10, the general authentication service 60 refers to the user management table based on the combination of the user ID and the password included in the authentication request received in step S10, and determines the correct user ID and password. It is determined whether or not a combination of exists.

  If the general authentication service 60 determines that the correct combination exists (YES in step S11), it proceeds to step S12 because the authentication is successful, and if it determines that the correct combination does not exist (NO in step S11), it indicates that the authentication has failed. End the process. Note that without completing the process, an authentication response including that the authentication has failed may be generated and transmitted to the requesting client service 50.

  In step S12, the general authentication service 60 creates a first general authentication ticket as shown in FIG.

  Progressing to step S13 following step S12, the general authentication service 60 generates an authentication response as shown in FIG. 10 including the first general authentication ticket ID for identifying the first general authentication ticket generated in step S12.

  Proceeding to step S14 following step S13, the general authentication service 60 transmits the authentication response created in step S13 to the requesting client service 50.

  By performing the processing shown in FIG. 22, the general authentication service 60 creates a first general authentication ticket in response to a request from the client service 50, and requests an authentication response including the first general authentication ticket ID. It can be sent to the original client service 50.

  The client service 50 can use a service corresponding to the general authentication service 60 using the first general authentication ticket ID. Further, the client service 50 creates an authentication request using the authentication ticket ID as shown in FIG. 14 including the first general authentication ticket ID using the first general authentication ticket ID. Authentication can be requested.

  Hereinafter, an example of the validity confirmation process in the general authentication service 60 will be described with reference to FIG. FIG. 23 is a flowchart for explaining the validity confirmation process in the general authentication service.

  In step S <b> 20, the general authentication service 60 receives a validity confirmation request including the first general authentication ticket ID from the remote authentication service 70.

  Progressing to step S21 following step S20, the general authentication service 60 refers to the ticket management unit 64 and the like based on the first general authentication ticket ID included in the validity confirmation request received in step S20. Determine whether one general authentication ticket exists.

  If the general authentication service 60 determines that a valid first general authentication ticket exists (YES in step S21), the process proceeds to step S22. If the general authentication service 60 determines that no valid first general authentication ticket exists (NO in step S21), Proceed to step S23.

  The general authentication service 60 has a valid first general authentication ticket if, for example, the first general authentication ticket corresponding to the first general authentication ticket ID exists and the expiration date of the first general authentication ticket has not expired. Judge that.

  In step S22, the general authentication service 60 creates a validity confirmation response as shown in FIG. 13 including OK as a parameter.

  On the other hand, in step S23, the general authentication service 60 creates a validity confirmation response including NG as a parameter.

  In step S24, the general authentication service 60 transmits the created legitimacy confirmation response to the requesting remote authentication service 70.

  23, the general authentication service 60 confirms the validity of the first general authentication ticket ID (or the first general authentication ticket) in response to a request from the remote authentication service 70. A validity confirmation response including the confirmation result can be transmitted to the requesting remote authentication service 70.

  The remote authentication service 70 can create a remote authentication ticket based on the confirmation result of the validity of the first general authentication ticket ID.

  Hereinafter, an example of authentication processing using the authentication ticket ID in the remote authentication service 70 will be described with reference to FIG. FIG. 24 is a flowchart (part 1) for explaining the authentication process using the authentication ticket ID in the remote authentication service.

  In step S <b> 30, the remote authentication service 70 receives an authentication request using the authentication ticket ID as illustrated in FIG. 11 including the first general authentication ticket ID from the client service 50.

  Proceeding to step S31 following step S30, the remote authentication service 70 verifies the validity as shown in FIG. 12 including the first general authentication ticket ID included in the authentication request using the authentication ticket ID received in step S30. Create a request.

  Progressing to step S32 following step S31, the remote authentication service 70 acquires the URL of the general authentication service 60 from the external authentication service management table or the like.

  Progressing to step S33 following step S32, the remote authentication service 70 transmits the validity confirmation request created in step S31 to the URL acquired in step S32.

  Progressing to step S34 following step S33, the remote authentication service 70 receives a validity confirmation response as shown in FIG. 13 from the general authentication service 60 of the transmission destination that has transmitted the validity confirmation request in step S33.

  Progressing to step S35 following step S34, the remote authentication service 70 refers to the parameter included in the validity confirmation response received in step S34, and determines whether or not the validity of the first general authentication ticket ID has been confirmed. .

  If the remote authentication service 70 determines that the validity of the first general authentication ticket ID has been confirmed (YES in step S35), the remote authentication service 70 proceeds to step S36 and determines that the validity of the first general authentication ticket ID has not been confirmed ( In step S35, NO), the process ends.

  It should be noted that an authentication response using an authentication ticket ID including the fact that the validity of the first general authentication ticket ID has not been confirmed is created without terminating the process, and is transmitted to the requesting client service 50. Also good.

  In step S36, the remote authentication service 70 creates a remote authentication ticket as shown in FIG.

  Progressing to step S37 following step S36, the remote authentication service 70 creates an authentication response using the authentication ticket ID shown in FIG. 14 including the remote authentication ticket ID for identifying the remote authentication ticket created in step S36. To do.

  Proceeding to step S38 following step S37, the remote authentication service 70 transmits an authentication response using the authentication ticket ID created in step S37 to the requesting client service 50.

  By performing the processing as shown in FIG. 24, the remote authentication service 70 responds to the request for confirming the validity of the first general authentication ticket ID included in the request based on the request from the client service 50. When it is transmitted to the authentication service 60 and the validity of the first general authentication ticket ID is confirmed, a remote authentication ticket that proves the authentication in the remote authentication service 70 is created, and the authentication ticket ID including the remote authentication ticket ID is used. The received authentication response can be transmitted to the requesting client service 50.

  The client service 50 can use a service corresponding to the remote authentication service 70 using the remote authentication ticket ID.

  Hereinafter, an example of processing related to single sign-on according to the second embodiment will be described with reference to FIG. FIG. 25 is a diagram (No. 2) for explaining the process related to single sign-on according to the present invention.

  First, the client service 50 requests the user to input authentication data such as a user ID and a password, and sends an authentication request including the input user ID and password as shown in FIG. 9 to the general authentication service. 60 is transmitted (sequence SQ50).

  When receiving the authentication request, the general authentication service 60 performs authentication based on, for example, a user ID and a password included in the authentication request, and determines that the combination is a valid user ID and password. A first general authentication ticket as shown in FIG. 17 is created.

  The general authentication service 60 creates an authentication response as shown in FIG. 10 including the first general authentication ticket ID for identifying the first general authentication ticket, and transmits it to the requesting client service (sequence SQ51).

  The client service 50 can use a service corresponding to the general authentication service 60 using the first general authentication ticket ID included in the authentication response.

  When the client service 50 receives a notification from the user that another service is to be used, the client service 50 includes the first general authentication ticket ID acquired and held in the sequence SQ51 in order to use the service. The authentication request using the authentication ticket ID as shown in FIG. 5 is created, and the authentication request is transmitted to the authentication service corresponding to the service (the remote authentication service 70 in the example of FIG. 25) (sequence SQ52).

  When receiving the authentication request using the authentication ticket ID, the remote authentication service 70 acquires the first general authentication ticket ID included in the authentication request, and the second general authentication ticket including the first general authentication ticket ID. Create a creation request.

  The remote authentication service 70 acquires the URL or the like of the general authentication service 60 written in the external authentication service management table or the like, and transmits the created second general authentication ticket creation request to the general authentication service 60 (sequence SQ53). ).

  Upon receiving the second general authentication ticket creation request, the general authentication service 60 uses the first general authentication ticket ID included in the second general authentication ticket creation request to generate a corresponding valid first general authentication ticket. If it is determined whether or not there is a corresponding valid first general authentication ticket, user information included in the first general authentication ticket is acquired, and a second general authentication ticket including the user information is created. To do. An example of the second general authentication ticket will be described with reference to FIG.

  The general authentication service 60 determines, for example, whether there is a second general authentication ticket ID that identifies the created second general authentication ticket and a valid first general authentication ticket corresponding to the first general authentication ticket ID. A second general authentication ticket creation response including the result (eg, OK) is created and transmitted to the requesting remote authentication service 70 (sequence SQ54).

  When the remote authentication service 70 receives the second general authentication ticket creation response, the remote authentication service 70 refers to the parameters included in the second general authentication ticket creation response, and if the second general authentication ticket ID and, for example, OK are included. Then, it is determined that the validity of the first general authentication ticket ID is confirmed, and a remote authentication ticket that proves the authentication including the second general authentication ticket ID is created. Details of the remote authentication ticket will be described with reference to FIG. 27 described later.

  The remote authentication service 70 can obtain, for example, user information included in the corresponding second general authentication ticket from the general authentication service 60 using the second general authentication ticket ID.

  The remote authentication service 70 creates an authentication response using an authentication ticket ID including a remote authentication ticket ID for identifying the remote authentication ticket, and transmits it to the requesting client service (sequence SQ55).

  The client service 50 can use a service corresponding to the remote authentication service 70 using the remote authentication ticket ID included in the authentication response using the authentication ticket ID.

  By performing the processing shown in FIG. 25, single sign-on can be realized by a one-way reference relationship from the remote authentication service 70 without performing any special setting on the general authentication service 60 side. .

  Further, actual authentication using authentication data is performed only on the general authentication service 60 side, and management of user information and the like can be performed only on the general authentication service 60 side.

  A directory service that provides user information and the like can be shared by the general authentication service 60 side and the remote authentication service 70 side.

  Hereinafter, an example of the second general authentication ticket will be described with reference to FIG. FIG. 26 is a diagram for explaining an example of the second general authentication ticket.

  As shown in FIG. 26, the second general authentication ticket includes a second general authentication ticket ID, an expiration date, and user information.

  In the second general authentication ticket ID, an identifier for identifying the second general authentication ticket is stored. The expiration date stores the expiration date of the second general authentication ticket. The user information includes a structure of user information (user information) included in the first general authentication ticket corresponding to the first general authentication ticket ID included in the second general authentication ticket creation request of sequence SQ53. Structure) is stored as it is.

  Hereinafter, another example of the remote authentication ticket will be described with reference to FIG. FIG. 27 is a diagram (part 2) for explaining the remote authentication ticket.

  As shown in FIG. 27, the remote authentication ticket includes a remote authentication ticket ID, a second general authentication ticket ID, and an expiration date.

  The remote authentication ticket ID stores an identifier for identifying the remote authentication ticket. The second general authentication ticket ID stores an identifier for identifying the second general authentication ticket included in the second general authentication ticket creation response of sequence SQ54. Further, the expiration date stores the expiration date of the remote authentication ticket.

  Hereinafter, an example of the second general authentication ticket creation process in the general authentication service 60 will be described with reference to FIG. FIG. 28 is a flowchart for explaining the second general authentication ticket creation process in the general authentication service. In the second embodiment, the authentication process in the general authentication service 60 is the same as that in the first embodiment, and the description of the flowchart is omitted.

  In step S <b> 40, the general authentication service 60 receives a second general authentication ticket creation request including the first general authentication ticket ID from the remote authentication service 70.

  Progressing to step S41 following step S40, the general authentication service 60 refers to the ticket management unit 64 and the like based on the first general authentication ticket ID included in the second general authentication ticket creation request received in step S40. Determine whether a valid first general authentication ticket exists.

  If the general authentication service 60 determines that a valid first general authentication ticket exists (YES in step S41), the process proceeds to step S42. If the general authentication service 60 determines that no valid first general authentication ticket exists (NO in step S41), Proceed to step S43.

  The general authentication service 60 has a valid first general authentication ticket if, for example, the first general authentication ticket corresponding to the first general authentication ticket ID exists and the expiration date of the first general authentication ticket has not expired. Judge that.

  In step S42, the general authentication service 60 creates a second general authentication ticket as shown in FIG. 26 including the user information included in the first general authentication ticket corresponding to the first general authentication ticket ID.

  On the other hand, in step S43, the general authentication service 60 generates a second general authentication ticket creation response including NG as a parameter.

  Proceeding to step S44 following step S42, the general authentication service 60 creates a second general authentication ticket including OK as parameters and a second general authentication ticket ID for identifying the second general authentication ticket created in step S42. Create a response.

  In step S45, the general authentication service 60 transmits the created second general authentication ticket creation response to the requesting remote authentication service 70.

  28, the general authentication service 60 confirms the validity of the first general authentication ticket ID (or the first general authentication ticket) in response to a request from the remote authentication service 70. If it is determined that it is a valid first general authentication ticket ID, a second general authentication ticket including user information included in the first general authentication ticket is created, and the validity confirmation result, the second general authentication ticket ID, Can be sent to the requesting remote authentication service 70.

  The remote authentication service 70 can create a remote authentication ticket based on the confirmation result of the validity of the first general authentication ticket ID and the second general authentication ticket ID.

  Hereinafter, another example of the authentication process using the authentication ticket ID in the remote authentication service 70 will be described with reference to FIG. FIG. 29 is a flowchart (part 2) for explaining the authentication process using the authentication ticket ID in the remote authentication service.

  In step S50, the remote authentication service 70 receives an authentication request using the authentication ticket ID as shown in FIG. 11 including the first general authentication ticket ID from the client service 50.

  Progressing to step S51 following step S50, the remote authentication service 70 creates a second general authentication ticket creation request including the first general authentication ticket ID included in the authentication request using the authentication ticket ID received in step S50. .

  Progressing to step S52 following step S51, the remote authentication service 70 acquires the URL of the general authentication service 60 from the external authentication service management table or the like.

  Progressing to step S53 following step S52, the remote authentication service 70 transmits the second general authentication ticket creation request created in step S51 to the URL obtained in step S52.

  Proceeding to step S54 following step S53, the remote authentication service 70 receives the second general authentication ticket creation response from the general authentication service 60 of the transmission destination that has transmitted the second general authentication ticket creation request in step S53.

  Progressing to step S55 following step S54, the remote authentication service 70 refers to the parameter included in the second general authentication ticket creation response received in step S54, and whether or not the validity of the first general authentication ticket ID has been confirmed. Determine.

  If the remote authentication service 70 determines that the validity of the first general authentication ticket ID is confirmed (YES in step S55), the remote authentication service 70 proceeds to step S56 and determines that the validity of the first general authentication ticket ID has not been confirmed ( In step S55, NO), the process ends.

  It should be noted that an authentication response using an authentication ticket ID including the fact that the validity of the first general authentication ticket ID has not been confirmed is created without terminating the process, and is transmitted to the requesting client service 50. Also good.

  In step S56, the remote authentication service 70 creates a remote authentication ticket as shown in FIG.

  Progressing to step S57 following step S56, the remote authentication service 70 creates an authentication response using the authentication ticket ID as shown in FIG. 14 including the remote authentication ticket ID for identifying the remote authentication ticket created in step S56. To do.

  Proceeding to step S58 following step S57, the remote authentication service 70 transmits an authentication response using the authentication ticket ID created in step S57 to the requesting client service 50.

  By performing the processing as shown in FIG. 29, the remote authentication service 70 generates a second general authentication ticket creation request including the first general authentication ticket ID included in the request based on the request from the client service 50. Is transmitted to the corresponding general authentication service 60, and when the validity of the first general authentication ticket ID is confirmed and the second general authentication ticket ID is acquired, the authentication in the remote authentication service 70 including the second general authentication ticket ID is performed. Can be created, and an authentication response using the authentication ticket ID including the remote authentication ticket ID can be transmitted to the requesting client service 50.

  Further, the remote authentication service 70 uses the second general authentication ticket ID acquired from the general authentication service 60 to acquire, for example, user information included in the second general authentication ticket corresponding to the second general authentication ticket ID. can do.

  The client service 50 can use a service corresponding to the remote authentication service 70 using the remote authentication ticket ID.

  Hereinafter, an example of processing related to single sign-on according to the third embodiment will be described with reference to FIG. FIG. 30 is a diagram (No. 3) for explaining the process related to single sign-on according to the present invention.

  First, the client service 50 requests the user to input authentication data such as a user ID and a password, and sends an authentication request such as that shown in FIG. 9 including the input user ID and password to the remote authentication service. 70 is transmitted (sequence SQ60).

  When receiving the authentication request, the remote authentication service 70 acquires the URL of the general authentication service 60 written in the external authentication service management table and the like, and transmits the authentication request to the general authentication service 60 (sequence SQ61).

  When receiving the authentication request, the general authentication service 60 performs authentication based on, for example, a user ID and a password included in the authentication request, and determines that the combination is a valid user ID and password. A first general authentication ticket as shown in FIG. 17 is created.

  The general authentication service 60 creates an authentication response as shown in FIG. 10 including the first general authentication ticket ID for identifying the first general authentication ticket, and transmits it to the requesting remote authentication service 70 (sequence SQ62). .

  The remote authentication service 70 can acquire, for example, user information included in the corresponding first general authentication ticket from the general authentication service 60 using the first general authentication ticket ID.

  When receiving the authentication response, the remote authentication service 70 creates a remote authentication ticket including the first general authentication ticket ID included in the authentication response and sends an authentication response including the remote authentication ticket ID for identifying the remote authentication ticket. It is created and transmitted to the requesting client service (sequence SQ63). An example of the remote authentication ticket will be described with reference to FIG.

  The client service 50 can use a service corresponding to the remote authentication service 70 by using the remote authentication ticket ID included in the authentication response.

  When the client service 50 receives notification from the user that another service is to be used, the client service 50 uses the remote authentication ticket ID acquired and held in sequence SQ63 and the remote authentication service 70 in order to use the service. And an authentication request including a URL using the authentication ticket ID, and transmitting the authentication request to an authentication service corresponding to the service (general authentication service 60 in the example of FIG. 30). (Sequence SQ64.)

  When the general authentication service 60 receives the authentication request including the URL using the authentication ticket ID, the general authentication service 60 includes the remote authentication ticket ID included in the authentication request and includes the remote authentication ticket ID corresponding to the remote authentication ticket ID. A request for acquiring the general authentication ticket ID is created and transmitted to the URL included in the authentication request including the URL using the authentication ticket ID (sequence SQ65).

  When receiving the acquisition request for the first general authentication ticket ID, the remote authentication service 70 uses the remote authentication ticket ID included in the acquisition request for the first general authentication ticket ID, and there is a corresponding valid remote authentication ticket. The first general authentication ticket ID included in the remote authentication ticket is obtained, and the first general authentication ticket ID including the first general authentication ticket ID is obtained. A ticket ID acquisition response is transmitted to the requesting general authentication service 60 (sequence SQ66).

  When the general authentication service 60 receives the acquisition response for the first general authentication ticket ID, the first general authentication ticket ID included in the response for acquiring the first general authentication ticket ID is a valid one issued by the general authentication service 60. It is determined whether it is the first general authentication ticket ID.

  If it is determined that the general authentication service 60 is a valid first general authentication ticket ID issued by itself, the general authentication service 60 acquires user information included in the first general authentication ticket corresponding to the first general authentication ticket ID, and A second general authentication ticket including user information is created.

  The general authentication service 60 generates an authentication response including a URL using the authentication ticket ID, including the second general authentication ticket ID for identifying the generated second general authentication ticket, and transmits the authentication response to the requesting client service 50 ( Sequence SQ67.).

  The client service 50 can use a service corresponding to the general authentication service 60 using the second general authentication ticket ID included in the authentication response including the URL using the authentication ticket ID.

  By performing the processing shown in FIG. 30, single sign-on can be realized by a one-way reference relationship from the remote authentication service 70 without performing any special setting on the general authentication service 60 side. .

  Further, actual authentication using authentication data is performed only on the general authentication service 60 side, and management of user information and the like can be performed only on the general authentication service 60 side.

  A directory service that provides user information and the like can be shared by the general authentication service 60 side and the remote authentication service 70 side.

  Hereinafter, another example of the remote authentication ticket will be described with reference to FIG. FIG. 31 is a diagram (No. 3) for explaining the remote authentication ticket.

  As shown in FIG. 31, the remote authentication ticket includes a remote authentication ticket ID, a first general authentication ticket ID, and an expiration date.

  The remote authentication ticket ID stores an identifier for identifying the remote authentication ticket. In the first general authentication ticket ID, an identifier for identifying the first general authentication ticket included in the authentication response of sequence SQ62 is stored. Further, the expiration date stores the expiration date of the remote authentication ticket.

  Hereinafter, an example of authentication processing in the remote authentication service 70 will be described with reference to FIG. FIG. 32 is a flowchart (part 1) for explaining the authentication process in the remote authentication service.

  In step S <b> 60, the remote authentication service 70 receives an authentication request as shown in FIG. 9 including the user ID and password from the client service 50.

  In step S61 following step S60, the remote authentication service 70 acquires the URL of the general authentication service 60 from the external authentication service management table or the like.

  Progressing to step S62 following step S61, the remote authentication service 70 transmits the authentication request received in step S60 to the URL acquired in step S61.

  Progressing to step S63 following step S62, the remote authentication service 70 receives the authentication response as shown in FIG. 10 including the first general authentication ticket ID from the general authentication service 60 of the transmission destination that transmitted the authentication request in step S62. Receive.

  Progressing to step S64 following step S63, the remote authentication service 70 creates a remote authentication ticket as shown in FIG. 31 including the first general authentication ticket ID included in the authentication response received in step S63.

  Proceeding to step S65 following step S64, the remote authentication service 70 creates an authentication response including a remote authentication ticket ID for identifying the remote authentication ticket created in step S64.

  Proceeding to step S66 following step S65, the remote authentication service 70 transmits the authentication response created in step S65 to the requesting client service 50.

  32, the remote authentication service 70 transmits an authentication request from the client service 50 to the corresponding general authentication service 60, and is a result of authentication by the general authentication service 60. A remote authentication ticket including the first general authentication ticket ID can be created using one general authentication ticket ID, and an authentication response including the remote authentication ticket ID can be transmitted to the requesting client service 50.

  The client service 50 can use a service corresponding to the remote authentication service 70 using the remote authentication ticket ID. Further, the client service 50 can create an authentication response including a URL using the authentication ticket ID including the remote authentication ticket ID using the remote authentication ticket ID, and request authentication in the general authentication service 60.

  Hereinafter, an example of the first general authentication ticket ID acquisition process in the remote authentication service 70 will be described with reference to FIG. FIG. 33 is a flowchart for explaining a first general authentication ticket ID acquisition process in the remote authentication service.

  In step S <b> 70, the remote authentication service 70 receives the acquisition request for the first general authentication ticket ID including the remote authentication ticket ID from the general authentication service 60.

  Progressing to step S71 following step S70, the remote authentication service 70 refers to the ticket management unit 73 and the like based on the remote authentication ticket ID included in the acquisition request for the first general authentication ticket ID received in step S70. It is determined whether there is a valid remote authentication ticket corresponding to the remote authentication ticket ID.

  If the remote authentication service 70 determines that a valid remote authentication ticket exists (YES in step S71), the process proceeds to step S72. If the remote authentication service 70 determines that no valid remote authentication ticket exists (NO in step S71), the process proceeds to step S73. .

  For example, when the remote authentication ticket corresponding to the remote authentication ticket ID exists and the validity period of the remote authentication ticket has not expired, the remote authentication service 70 determines that a valid remote authentication ticket exists.

  In step S72, the remote authentication service 70 acquires the first general authentication ticket ID included in the remote authentication ticket from the remote authentication ticket corresponding to the remote authentication ticket ID.

  On the other hand, in step S73, the remote authentication service 70 creates a first general authentication ticket ID acquisition response including NG as a parameter.

  Proceeding to step S74 following step S72, the remote authentication service 70 creates a first general authentication ticket ID acquisition response including OK as parameters and the first general authentication ticket ID acquired in step S72.

  In step S75, the remote authentication service 70 transmits a first general authentication ticket ID acquisition response to the requesting general authentication service 60.

  33, the remote authentication service 70 obtains the first general authentication ticket ID from the remote authentication ticket corresponding to the remote authentication ticket ID in response to a request from the general authentication service 60. Then, it can be transmitted to the requesting general authentication service 60.

  When the general authentication service 60 determines whether the acquired first general authentication ticket ID is the first general authentication ticket ID issued by the general authentication service 60 and determines that it is a valid first general authentication ticket ID issued by itself. The user information included in the first general authentication ticket corresponding to the first general authentication ticket ID can be acquired, and a second general authentication ticket including the user information can be created.

  Hereinafter, another example of the authentication process in the general authentication service 60 will be described with reference to FIG. FIG. 34 is a flowchart (part 2) for explaining the authentication process in the general authentication service.

  In step S80, the general authentication service 60 receives an authentication request including the user ID and password from the remote authentication service 70 as shown in FIG.

  Progressing to step S81 following step S80, the general authentication service 60 refers to the user management table based on the combination of the user ID and password included in the authentication request received in step S80, and corrects the correct user ID and password. It is determined whether or not a combination of exists.

  If it is determined that the correct combination exists (YES in step S81), the general authentication service 60 proceeds to step S82 assuming that the authentication is successful. If it is determined that the correct combination does not exist (NO in step S81), it is assumed that the authentication has failed. The process ends. Note that without completing the process, an authentication response including the fact that the authentication has failed may be created and transmitted to the requesting remote authentication service 70.

  In step S82, the general authentication service 60 creates a first general authentication ticket as shown in FIG.

  Progressing to step S83 following step S82, the general authentication service 60 generates an authentication response as shown in FIG. 10 including the first general authentication ticket ID for identifying the first general authentication ticket generated in step S82.

  Proceeding to step S84 following step S83, the general authentication service 60 transmits the authentication response created in step S83 to the requesting remote authentication service 70.

  By performing the processing as shown in FIG. 34, the general authentication service 60 creates a first general authentication ticket in response to a request from the remote authentication service 70, and sends an authentication response including the first general authentication ticket ID. It can be sent to the requesting remote authentication service 70.

  The remote authentication service 70 can use the first general authentication ticket ID to create a remote authentication ticket as shown in FIG. 31 including the first general authentication ticket ID.

  Hereinafter, an example of the authentication process including the URL using the authentication ticket ID in the general authentication service 60 will be described with reference to FIG. FIG. 35 is a flowchart (part 1) for explaining the authentication process including the URL using the authentication ticket ID in the general authentication service.

  In step S <b> 90, the general authentication service 60 receives an authentication request including a URL using the authentication ticket ID including the remote authentication ticket ID and the URL for identifying the remote authentication service 70 from the client service 50.

  Progressing to step S91 following step S90, the general authentication service 60 corresponds to the remote authentication ticket ID including the remote authentication ticket ID included in the authentication request including the URL using the authentication ticket ID received in step S90. An acquisition request for the first general authentication ticket ID included in the remote authentication ticket is created.

  Progressing to step S92 following step S91, the general authentication service 60 includes the acquisition request for the first general authentication ticket ID created in step S91 in the authentication request including the URL using the authentication ticket ID received in step S90. To be sent to the URL.

  Proceeding to step S93 following step S92, the general authentication service 60 includes the first general authentication ticket ID from the remote authentication service 70 of the transmission destination that transmitted the acquisition request for the first general authentication ticket ID in step S92. One general authentication ticket ID acquisition response is received.

  Proceeding to step S94 following step S93, the general authentication service 60 determines that the first general authentication ticket ID included in the first general authentication ticket ID acquisition response received in step S93 is a valid one issued by the general authentication service 60. It is determined whether it is the first general authentication ticket ID.

  If the general authentication service 60 determines that it is a valid first general authentication ticket ID issued by itself (YES in step S94), it proceeds to step S95 and is not a valid first general authentication ticket ID issued by itself. (NO in step S94), the process ends.

  For example, when the first general authentication ticket corresponding to the first general authentication ticket ID exists and the expiration date of the first general authentication ticket has not expired, the general authentication service 60 uses a valid first general authentication ticket ID. Judge that there is.

  In step S95, the general authentication service 60 acquires user information included in the first general authentication ticket from the first general authentication ticket corresponding to the first general authentication ticket ID, and the second general authentication including the user information is acquired. Create a ticket.

  Proceeding to step S96 following step S95, the general authentication service 60 sends an authentication response including a URL using the authentication ticket ID including the second general authentication ticket ID for identifying the second general authentication ticket created in step S95. create.

  Proceeding to step S97 following step S96, the general authentication service 60 transmits an authentication response including the URL using the authentication ticket ID created in step S95 to the requesting client service 50.

  By performing the processing as shown in FIG. 35, the general authentication service 60 includes the remote authentication ticket ID included in the request based on the request from the client service 50, and the remote corresponding to the remote authentication ticket ID. When the acquisition request for the first general authentication ticket ID included in the authentication ticket is transmitted to the URL included in the request, the validity of the remote authentication ticket ID is confirmed, and the first general authentication ticket ID is acquired, User information included in the first general authentication ticket is acquired from the first general authentication ticket corresponding to the first general authentication ticket ID, a second general authentication ticket including the user information is created, and the second general authentication ticket is obtained. An authentication response including a URL using the authentication ticket ID including the ID is sent to the requesting client service. It can be sent to 50.

  The client service 50 can use a service corresponding to the general authentication service 60 using the second general authentication ticket ID.

  Hereinafter, an example of processing related to single sign-on according to the fourth embodiment will be described with reference to FIG. FIG. 36 is a diagram (No. 4) for describing a process related to single sign-on according to the present invention.

  First, the client service 50 requests the user to input authentication data such as a user ID and a password, and sends an authentication request such as that shown in FIG. 9 including the input user ID and password to the remote authentication service. 70 is transmitted (sequence SQ70).

  When receiving the authentication request, the remote authentication service 70 acquires the URL of the general authentication service 60 written in the external authentication service management table and the like, and transmits the authentication request to the general authentication service 60 (sequence SQ71).

  When receiving the authentication request, the general authentication service 60 performs authentication based on, for example, a user ID and a password included in the authentication request, and determines that the combination is a valid user ID and password. A first general authentication ticket as shown in FIG. 17 is created.

  The general authentication service 60 creates an authentication response including a first general authentication ticket ID for identifying the first general authentication ticket and an encrypted first general authentication ticket ID obtained by encrypting the first general authentication ticket ID. Then, the request is transmitted to the requesting remote authentication service 70 (sequence SQ72).

  The remote authentication service 70 can acquire, for example, user information included in the corresponding first general authentication ticket from the general authentication service 60 using the first general authentication ticket ID.

  When receiving the authentication response, the remote authentication service 70 creates a remote authentication ticket including the first general authentication ticket ID included in the authentication response and the encrypted first general authentication ticket ID, and the remote authentication ticket An authentication response including a remote authentication ticket ID for identifying is generated and transmitted to the requesting client service (sequence SQ73). Another example of the remote authentication ticket will be described with reference to FIG.

  The client service 50 can use a service corresponding to the remote authentication service 70 by using the remote authentication ticket ID included in the authentication response.

  When the client service 50 receives notification from the user that another service is to be used, the client service 50 uses the remote authentication ticket ID acquired and held in sequence SQ73 and the remote authentication service 70 in order to use the service. And an authentication request including a URL using an authentication ticket ID, and transmitting the authentication request to an authentication service corresponding to the service (general authentication service 60 in the example of FIG. 36). (Sequence SQ74.)

  When receiving the authentication request including the URL using the authentication ticket ID, the general authentication service 60 includes the remote authentication ticket ID included in the authentication request and the encryption included in the remote authentication ticket corresponding to the remote authentication ticket ID An acquisition request for the first general authentication ticket ID is created and transmitted to the URL included in the authentication request including the URL using the authentication ticket ID (sequence SQ75).

  When the remote authentication service 70 receives the request for acquiring the encrypted first general authentication ticket ID, the remote authentication service 70 uses the remote authentication ticket ID included in the request for acquiring the encrypted first general authentication ticket ID to correspond to the valid remote authentication. When it is determined whether the ticket exists and it is determined that the corresponding valid remote authentication ticket exists, the encrypted first general authentication ticket ID included in the remote authentication ticket is obtained, and the encrypted first general authentication ticket is obtained. An encrypted first general authentication ticket ID acquisition response including the ID is transmitted to the requesting general authentication service 60 (sequence SQ76).

  When the general authentication service 60 receives the encrypted first general authentication ticket ID acquisition response, the general authentication service 60 decrypts the encrypted first general authentication ticket ID included in the encrypted first general authentication ticket ID acquisition response. It is determined whether the converted first general authentication ticket ID is a valid first general authentication ticket ID issued by the general authentication service 60.

  If it is determined that the general authentication service 60 is a valid first general authentication ticket ID issued by itself, the general authentication service 60 acquires user information included in the first general authentication ticket corresponding to the first general authentication ticket ID, and A second general authentication ticket including user information is created.

  The general authentication service 60 generates an authentication response including a URL using the authentication ticket ID, including the second general authentication ticket ID for identifying the generated second general authentication ticket, and transmits the authentication response to the requesting client service 50 ( Sequence SQ77.).

  The client service 50 can use a service corresponding to the general authentication service 60 using the second general authentication ticket ID included in the authentication response including the URL using the authentication ticket ID.

  By performing the processing as shown in FIG. 36, single sign-on can be realized by a one-way reference relationship from the remote authentication service 70 without performing special settings or the like on the general authentication service 60 side. .

  Further, actual authentication using authentication data is performed only on the general authentication service 60 side, and management of user information and the like can be performed only on the general authentication service 60 side.

  A directory service that provides user information and the like can be shared by the general authentication service 60 side and the remote authentication service 70 side.

  In the fourth embodiment, as shown in the sequence SQ75 and the sequence SQ76, the general authentication service 60 can acquire the encrypted first general authentication ticket ID from the remote authentication service 70. Compared to the above, it has a more secure configuration.

  Hereinafter, another example of the remote authentication ticket will be described with reference to FIG. FIG. 37 is a diagram (part 4) for explaining the remote authentication ticket.

  As shown in FIG. 37, the remote authentication ticket includes a remote authentication ticket ID, a first general authentication ticket ID, an encrypted first general authentication ticket ID, and an expiration date.

  The remote authentication ticket ID stores an identifier for identifying the remote authentication ticket. The first general authentication ticket ID stores an identifier for identifying the first general authentication ticket included in the authentication response of sequence SQ72. The encrypted first general authentication ticket ID stores an identifier for identifying the first general authentication ticket encrypted in the general authentication service 60 included in the authentication response of the sequence SQ72. Further, the expiration date stores the expiration date of the remote authentication ticket.

  Hereinafter, an example of authentication processing in the remote authentication service 70 will be described with reference to FIG. FIG. 38 is a flowchart (part 2) for explaining the authentication process in the remote authentication service.

  In step S <b> 100, the remote authentication service 70 receives an authentication request as shown in FIG. 9 including the user ID and password from the client service 50.

  Progressing to step S101 following step S100, the remote authentication service 70 acquires the URL of the general authentication service 60 from an external authentication service management table or the like.

  Proceeding to step S102 following step S101, the remote authentication service 70 transmits the authentication request received in step S100 to the URL acquired in step S101.

  Progressing to step S103 following step S102, the remote authentication service 70 encrypts the first general authentication ticket ID and the first general authentication ticket ID from the general authentication service 60 of the transmission destination that transmitted the authentication request in step S102. An authentication response including the encrypted first general authentication ticket ID is received.

  Progressing to step S104 following step S103, the remote authentication service 70 includes the first general authentication ticket ID included in the authentication response received in step S103 and the encrypted first general authentication ticket ID in FIG. Create a remote authentication ticket as shown.

  Proceeding to step S105 following step S104, the remote authentication service 70 creates an authentication response including a remote authentication ticket ID for identifying the remote authentication ticket created in step S104.

  In step S106 following step S105, the remote authentication service 70 transmits the authentication response created in step S105 to the requesting client service 50.

  38, the remote authentication service 70 transmits an authentication request from the client service 50 to the corresponding general authentication service 60, and is the result of authentication by the general authentication service 60. A remote authentication ticket including the first general authentication ticket ID and the encrypted first general authentication ticket ID is created using the one general authentication ticket ID and the encrypted first general authentication ticket ID, and the remote authentication is performed. An authentication response including the ticket ID can be transmitted to the requesting client service 50.

  The client service 50 can use a service corresponding to the remote authentication service 70 using the remote authentication ticket ID. Further, the client service 50 can create an authentication response including a URL using the authentication ticket ID including the remote authentication ticket ID using the remote authentication ticket ID, and request authentication in the general authentication service 60.

  Hereinafter, an example of the encrypted first general authentication ticket ID acquisition process in the remote authentication service 70 will be described with reference to FIG. FIG. 39 is a flowchart for explaining the encrypted first general authentication ticket ID acquisition process in the remote authentication service.

  In step S <b> 110, the remote authentication service 70 receives an acquisition request for the encrypted first general authentication ticket ID including the remote authentication ticket ID from the general authentication service 60.

  Progressing to step S111 following step S110, the remote authentication service 70 refers to the ticket management unit 73 and the like based on the remote authentication ticket ID included in the acquisition request for the encrypted first general authentication ticket ID received in step S110. Then, it is determined whether there is a valid remote authentication ticket corresponding to the remote authentication ticket ID.

  If the remote authentication service 70 determines that a valid remote authentication ticket exists (YES in step S111), the process proceeds to step S112. If the remote authentication service 70 determines that no valid remote authentication ticket exists (NO in step S111), the process proceeds to step S113. .

  For example, when the remote authentication ticket corresponding to the remote authentication ticket ID exists and the validity period of the remote authentication ticket has not expired, the remote authentication service 70 determines that a valid remote authentication ticket exists.

  In step S112, the remote authentication service 70 acquires the encrypted first general authentication ticket ID included in the remote authentication ticket from the remote authentication ticket corresponding to the remote authentication ticket ID.

  On the other hand, in step S113, the remote authentication service 70 creates an encrypted first general authentication ticket ID acquisition response including NG as a parameter.

  Progressing to step S114 following step S112, the remote authentication service 70 creates an encrypted first general authentication ticket ID acquisition response including OK as parameters and the encrypted first general authentication ticket ID acquired in step S112. To do.

  In step S115, the remote authentication service 70 transmits an encrypted first general authentication ticket ID acquisition response to the requesting general authentication service 60.

  By performing the processing as shown in FIG. 39, the remote authentication service 70 responds to the request from the general authentication service 60 by using the encrypted first general authentication ticket ID from the remote authentication ticket corresponding to the remote authentication ticket ID. Can be acquired and sent to the requesting general authentication service 60.

  The general authentication service 60 decrypts the acquired encrypted first general authentication ticket ID, determines whether the decrypted first general authentication ticket ID is the first general authentication ticket ID issued by itself, Is determined to be a valid first general authentication ticket ID issued, the user information included in the first general authentication ticket corresponding to the first general authentication ticket ID is acquired, and the second general authentication including the user information is acquired. Tickets can be created.

  Hereinafter, another example of the authentication process in the general authentication service 60 will be described with reference to FIG. FIG. 40 is a flowchart (No. 3) for explaining the authentication process in the general authentication service.

  In step S120, the general authentication service 60 receives the authentication request as shown in FIG. 9 including the user ID and password from the remote authentication service 70.

  In step S121 following step S120, the general authentication service 60 refers to the user management table based on the combination of the user ID and the password included in the authentication request received in step S120, and corrects the user ID and password. It is determined whether or not a combination of exists.

  If the general authentication service 60 determines that the correct combination exists (YES in step S121), it proceeds to step S122 because the authentication has succeeded. The process ends. Note that without completing the process, an authentication response including the fact that the authentication has failed may be created and transmitted to the requesting remote authentication service 70.

  In step S122, the general authentication service 60 creates a first general authentication ticket as shown in FIG.

  Proceeding to step S123 following step S122, the general authentication service 60 encrypts the first general authentication ticket ID for identifying the first general authentication ticket created in step S122.

  Proceeding to step S124 following step S123, the general authentication service 60 creates an authentication response including the first general authentication ticket ID and the encrypted first general authentication ticket ID encrypted in step S123.

  Proceeding to step S125 following step S124, the general authentication service 60 transmits the authentication response created in step S124 to the requesting remote authentication service 70.

  By performing the processing as shown in FIG. 40, the general authentication service 60 creates a first general authentication ticket in response to a request from the remote authentication service 70, the first general authentication ticket ID, and the encrypted first authentication ticket. An authentication response including one general authentication ticket ID can be transmitted to the requesting remote authentication service 70.

  The remote authentication service 70 includes the first general authentication ticket ID and the encrypted first general authentication ticket ID using the first general authentication ticket ID and the encrypted first general authentication ticket ID. You can create a remote authentication ticket as shown in.

  Hereinafter, an example of the authentication process including the URL using the authentication ticket ID in the general authentication service 60 will be described with reference to FIG. FIG. 41 is a flowchart (part 2) for explaining the authentication process including the URL using the authentication ticket ID in the general authentication service.

  In step S <b> 130, the general authentication service 60 receives an authentication request including a URL using the authentication ticket ID including the remote authentication ticket ID and the URL for identifying the remote authentication service 70 from the client service 50.

  Progressing to step S131 following step S130, the general authentication service 60 corresponds to the remote authentication ticket ID including the remote authentication ticket ID included in the authentication request including the URL using the authentication ticket ID received in step S130. An acquisition request for the encrypted first general authentication ticket ID included in the remote authentication ticket is created.

  Proceeding to step S132 following step S131, the general authentication service 60 sends an acquisition request for the encrypted first general authentication ticket ID created in step S131 to the authentication request including the URL using the authentication ticket ID received in step S130. The URL is included in the URL.

  Progressing to step S133 following step S132, the general authentication service 60 transmits the encrypted first general authentication ticket ID from the remote authentication service 70 of the transmission destination that has transmitted the acquisition request for the encrypted first general authentication ticket ID in step S132. Including the encrypted first general authentication ticket ID acquisition response.

  Proceeding to step S134 following step S133, the general authentication service 60 decrypts the encrypted first general authentication ticket ID included in the encrypted first general authentication ticket ID acquisition response received in step S133.

  In step S135 following step S134, the general authentication service 60 determines whether the first general authentication ticket ID decrypted in step S134 is a valid first general authentication ticket ID issued by the general authentication service 60. To do.

  If the general authentication service 60 determines that it is a valid first general authentication ticket ID issued by itself (YES in step S135), it proceeds to step S136 and is not a valid first general authentication ticket ID issued by itself. (NO in step S136), the process ends.

  For example, when the first general authentication ticket corresponding to the first general authentication ticket ID exists and the expiration date of the first general authentication ticket has not expired, the general authentication service 60 uses a valid first general authentication ticket ID. Judge that there is.

  In step S136, the general authentication service 60 acquires user information included in the first general authentication ticket from the first general authentication ticket corresponding to the first general authentication ticket ID, and the second general authentication including the user information is acquired. Create a ticket.

  Proceeding to step S137 following step S136, the general authentication service 60 sends an authentication response including a URL using the authentication ticket ID including the second general authentication ticket ID for identifying the second general authentication ticket created in step S136. create.

  Proceeding to step S138 following step S137, the general authentication service 60 transmits an authentication response including the URL using the authentication ticket ID created in step S137 to the requesting client service 50.

  By performing the processing as shown in FIG. 41, the general authentication service 60 includes the remote authentication ticket ID included in the request based on the request from the client service 50, and the remote corresponding to the remote authentication ticket ID. An acquisition request for the encrypted first general authentication ticket ID included in the authentication ticket is transmitted to the URL included in the request, the validity of the remote authentication ticket ID is confirmed, and the encrypted first general authentication ticket ID is Upon acquisition, the encrypted first general authentication ticket ID is decrypted, and from the first general authentication ticket corresponding to the decrypted first general authentication ticket ID, user information included in the first general authentication ticket is acquired, Creating a second general authentication ticket including the user information and including a second general authentication ticket ID; It can be sent to the requesting client service 50 authentication response including the URL with.

  The client service 50 can use a service corresponding to the general authentication service 60 using the second general authentication ticket ID.

  Hereinafter, an example of processing related to single sign-on according to the fifth embodiment will be described with reference to FIG. FIG. 42 is a diagram (No. 5) for explaining a process related to single sign-on according to the present invention.

  First, the client service 50 requests the user to input authentication data such as a user ID and a password, and sends an authentication request including the input user ID and password as shown in FIG. 9 to the general authentication service. 60 is transmitted (sequence SQ80).

  When receiving the authentication request, the general authentication service 60 performs authentication based on, for example, a user ID and a password included in the authentication request, and determines that the combination is a valid user ID and password. A first general authentication ticket as shown in FIG. 17 is created.

  The general authentication service 60 creates an authentication response as shown in FIG. 10 including the first general authentication ticket ID for identifying the first general authentication ticket, and transmits it to the requesting client service (sequence SQ81).

  The client service 50 can use a service corresponding to the general authentication service 60 using the first general authentication ticket ID included in the authentication response.

  When the client service 50 receives a notification from the user that another service is to be used, the authentication ticket including the first general authentication ticket ID acquired and held in sequence SQ81 to use the service is used. And an authentication request including the URL for identifying the general authentication service 60, and sends the authentication request to the authentication service corresponding to the service (the remote authentication service 70 in the example of FIG. 42) (sequence SQ82). ).

  When receiving the authentication request using the authentication ticket ID, the remote authentication service 70 acquires the first general authentication ticket ID included in the authentication request, and the first general authentication ticket including the first general authentication ticket ID An ID validity check request is created, and the validity check request is transmitted to the URL included in the authentication request using the authentication ticket ID (sequence SQ83).

  When the general authentication service 60 receives the validity confirmation request, the general authentication service 60 uses the first general authentication ticket ID included in the validity confirmation request to determine whether a corresponding valid first general authentication ticket exists, If it is determined that a corresponding valid first general authentication ticket exists, a validity confirmation response including a determination result (for example, OK) and a user name is created and transmitted to the requesting remote authentication service 70 (sequence SQ84). .

  When the remote authentication service 70 receives the validity confirmation response, the remote authentication service 70 refers to the determination result (confirmation result) included in the validity confirmation response. A remote authentication ticket as shown in FIG.

  The remote authentication service 70 creates an authentication response as shown in FIG. 14 using the authentication ticket ID including the remote authentication ticket ID for identifying the remote authentication ticket, and transmits it to the requesting client service (sequence SQ85). .

  The client service 50 can use a service corresponding to the remote authentication service 70 using the remote authentication ticket ID included in the authentication response using the authentication ticket ID.

  In the fifth embodiment, the URL of the general authentication service 60 is not managed by the external authentication service management table or the like of the remote authentication service 70, but the client service 50 manages the remote authentication service 70 as compared with the first embodiment. Is an example of teaching. The same configuration can be adopted in other embodiments.

  In the fifth embodiment, a list of URLs of the general authentication service 60 that can be connected in the remote authentication service 70 is held and managed so that the remote authentication service 70 is not connected to the false general authentication service. It is determined whether the URL of the general authentication service 60 designated by the client service 50 is included in the list of URLs of the general authentication service 60 managed by the client service 50, and only when it is determined that it is included. In accordance with an instruction from the client service 50, a validity confirmation request may be transmitted to a designated URL.

  The preferred embodiments of the present invention have been described in detail above, but the present invention is not limited to such specific embodiments, and various modifications can be made within the scope of the gist of the present invention described in the claims.・ Change is possible.

  For example, in each of the above-described embodiments, the authentication ticket ID for identifying the authentication ticket has been described as being transmitted and received between the services. However, the authentication ticket itself may be transmitted and received between the services.

  In the above-described embodiment, the second general authentication ticket including the user information of the first general authentication ticket is created. However, without creating a new authentication ticket, for example, it is effective. You may make it produce the copy of the 1st general authentication ticket which extended only the time limit.

In the above-described embodiment, the remote authentication ticket has been described using an example including the first general authentication ticket ID, the second general authentication ticket ID, the encrypted first general authentication ticket ID, etc. In the remote authentication service 70, the remote authentication ticket is associated with the first general authentication ticket ID, the second general authentication ticket ID, the encrypted first general authentication ticket ID, etc. You may make it manage using.

It is a sequence diagram for demonstrating an example of the relationship between the service provision service which provides a service to a client, and authentication service. It is a sequence diagram for demonstrating an example of normal sign-on. It is a sequence diagram for demonstrating an example of the single sign-on in a prior art. It is a sequence diagram for demonstrating the other example of the single sign-on in a prior art. It is a hardware block diagram of an example of a general authentication service provision server. It is a hardware block diagram of an example of a remote authentication service provision server. It is a hardware block diagram of an example of a user terminal device. It is FIG. (1) for demonstrating the process which concerns on the single sign-on in this invention. It is a figure for demonstrating an example of an authentication request. It is a figure for demonstrating an example of an authentication response. It is a figure for demonstrating an example of the authentication request using authentication ticket ID. It is a figure for demonstrating an example of a correctness confirmation request. It is a figure for demonstrating an example of a correctness confirmation response. It is a figure for demonstrating an example of the authentication response using authentication ticket ID. It is a figure for demonstrating an example of a function structure of a general authentication service. It is a figure for demonstrating an example of a user management table. It is a figure for demonstrating a 1st general authentication ticket. It is a figure for demonstrating an example of a user information structure. It is a figure for demonstrating an example of a function structure of a remote authentication service. It is FIG. (1) for demonstrating a remote authentication ticket. It is a figure for demonstrating an example of an external authentication service management table. It is a flowchart (the 1) for demonstrating the authentication process in a general authentication service. It is a flowchart for demonstrating the correctness confirmation process in a general authentication service. It is a flowchart (the 1) for demonstrating the authentication process using authentication ticket ID in a remote authentication service. It is FIG. (2) for demonstrating the process which concerns on the single sign-on in this invention. It is a figure for demonstrating an example of a 2nd general authentication ticket. It is FIG. (2) for demonstrating a remote authentication ticket. It is a flowchart for demonstrating the 2nd general authentication ticket creation process in a general authentication service. It is a flowchart (the 2) for demonstrating the authentication process using authentication ticket ID in a remote authentication service. It is FIG. (3) for demonstrating the process which concerns on the single sign-on in this invention. It is FIG. (3) for demonstrating a remote authentication ticket. It is a flowchart (the 1) for demonstrating the authentication process in a remote authentication service. It is a flowchart for demonstrating the 1st general authentication ticket ID acquisition process in a remote authentication service. It is a flowchart (the 2) for demonstrating the authentication process in a general authentication service. It is a flowchart (the 1) for demonstrating the authentication process containing URL using the authentication ticket ID in a general authentication service. It is FIG. (4) for demonstrating the process which concerns on the single sign-on in this invention. It is FIG. (4) for demonstrating a remote authentication ticket. It is a flowchart (the 2) for demonstrating the authentication process in a remote authentication service. It is a flowchart for demonstrating the encryption 1st general authentication ticket ID acquisition process in a remote authentication service. It is a flowchart (the 3) for demonstrating the authentication process in a general authentication service. It is a flowchart (the 2) for demonstrating the authentication process containing URL using the authentication ticket ID in a general authentication service. It is FIG. (5) for demonstrating the process which concerns on the single sign-on in this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 50 Client service 60 General authentication service 61 User authentication part 62 User management part 63 Ticket confirmation part 64 Ticket management part 70 Remote authentication service 71 User authentication part 72 Ticket confirmation part 73 Ticket management part 74 Authentication proxy part 75 Authentication proxy management part 75

Claims (29)

An authentication service providing apparatus having authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
An authentication request receiving means for receiving an authentication request from a client using a service provided by the service providing means;
In response to the authentication request, certification information creating means for creating certification information related to authentication,
Authentication response transmission means for transmitting the certification information to the client;
Validity confirmation request receiving means for receiving a confirmation request for validity of the certification information including the certification information transmitted to the client from other authentication service providing means for providing a service related to authentication;
An authentication service providing apparatus comprising:   2. The apparatus according to claim 1, further comprising: a validity confirmation response transmitting unit that transmits a confirmation response of the validity of the certification information including the result of confirming the validity of the certification information to the other authentication service providing unit. The authentication service providing apparatus according to the description. An authentication service providing apparatus having authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
An authentication request receiving means for receiving an authentication request from a client using a service provided by the service providing means;
In response to the authentication request, first proof information creating means for creating first proof information related to authentication;
Authentication response transmission means for transmitting the first certification information to the client;
Second proof information creation for receiving a request for creating second proof information related to the first proof information including the first proof information transmitted to the client from another authentication service providing means for providing a service related to authentication A request receiving means;
An authentication service providing apparatus comprising:   4. The second proof information creation response transmitting means for transmitting a creation response including the second proof information created in response to the creation request to the other authentication service providing means. Authentication service providing device. An authentication service providing apparatus having authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
An authentication request receiving means for receiving an authentication request from other authentication service providing means for providing a service related to authentication;
In response to the authentication request, first proof information creating means for creating first proof information related to authentication;
Authentication response transmission means for transmitting the first certification information to the other authentication service providing means;
Authentication including second certification information related to authentication issued by the other authentication service providing means and identification information for identifying the other authentication service providing means from a client using a service provided by the service providing means Third proof information creation request receiving means for receiving a request to create third proof information according to
An authentication service providing apparatus comprising:   Acquisition of the first proof information transmitted by the authentication response transmitting means including the second proof information to the other authentication service providing means based on identification information for identifying the other authentication service providing means. 6. The authentication service providing apparatus according to claim 5, further comprising first certification information acquisition request transmission means for transmitting a request. An authentication service providing apparatus having authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
An authentication request receiving means for receiving an authentication request from other authentication service providing means for providing a service related to authentication;
In response to the authentication request, first proof information creating means for creating first proof information related to authentication;
Encryption means for encrypting the first certification information;
Authentication response transmission means for transmitting the first certification information and the first authentication information encrypted by the encryption means to the other authentication service providing means;
Authentication including second certification information related to authentication issued by the other authentication service providing means and identification information for identifying the other authentication service providing means from a client using the service provided by the service providing means Third proof information creation request receiving means for receiving a request to create third proof information according to
An authentication service providing apparatus comprising:   Based on the identification information for identifying the other authentication service providing means, the encrypted authentication information sent to the other authentication service providing means in the authentication response transmission means including the second certification information. 8. The authentication service providing apparatus according to claim 7, further comprising: encryption certification information acquisition request transmission means for transmitting an authentication information acquisition request. An authentication service providing apparatus having authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
Request to create second certification information related to authentication, including first certification information related to authentication issued by another authentication service providing means that provides a service related to authentication, from a client that uses the service provided by the service providing means Second proof information creation request receiving means for receiving
Validity confirmation request transmitting means for transmitting a request for confirming the validity of the first certification information including the first certification information to the other authentication service providing means
Validity confirmation response receiving means for receiving the confirmation response of the validity of the proof information from the other authentication service providing means, including the confirmation result of the validity of the first proof information;
When the validity of the first proof information is confirmed, in response to a request to create second proof information related to the authentication, second proof information creating means for creating second proof information related to the authentication,
An authentication service providing apparatus comprising:   The second proof information creation response transmission means for transmitting a proof information creation response including the second proof information created by the second proof information creation means to the client. Authentication service providing device. An authentication service providing apparatus having an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
Request to create third certification information related to authentication, including first certification information related to authentication issued by another authentication service providing means that provides a service related to authentication, from a client using a service provided by the service providing means A third proof information creation request receiving means for receiving
Second certification information creation request transmission means for transmitting a creation request for second certification information relating to the first certification information, including the first certification information, to the other authentication service providing means;
Second certification information creation response receiving means for receiving a creation response including the second certification information from the other authentication service providing means;
Third certification information for creating third certification information for authentication associated with the second certification information received by the second certification information creation response receiving means in response to a request for creation of third certification information for the authentication Creating means;
An authentication service providing apparatus comprising:   12. The third proof information creation response transmitting means for transmitting a proof information creation response including the third proof information created by the third proof information creating means to the client. Authentication service providing device. An authentication service providing apparatus having authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
An authentication request receiving means for receiving an authentication request from a client using a service provided by the service providing means;
An authentication request transmitting means for transmitting the authentication request to another authentication service providing means for providing a service related to authentication;
Authentication response receiving means for receiving, from the other authentication service providing means, first certification information relating to authentication created by the other authentication service providing means;
In response to the authentication request, second proof information creating means for creating second proof information related to authentication associated with the first proof information received by the authentication response receiving means;
An authentication service providing apparatus comprising:   The authentication service providing apparatus according to claim 13, further comprising an authentication response transmission unit configured to transmit the second certification information created by the second certification information creation unit to the client. An authentication service providing apparatus having authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
An authentication request receiving means for receiving an authentication request from a client using a service provided by the service providing means;
An authentication request transmitting means for transmitting the authentication request to another authentication service providing means for providing a service related to authentication;
Authentication response receiving means for receiving, from the other authentication service providing means, first authentication information relating to authentication created by the other authentication service providing means, and the encrypted first certification information;
In response to the authentication request, a second proof information relating to authentication is created by associating the first proof information received by the authentication response receiving means with the encrypted first proof information. Proof information creation means;
An authentication service providing apparatus comprising:   16. The authentication service providing apparatus according to claim 15, further comprising an authentication response transmission unit that transmits the second certification information created by the second certification information creation unit to the client. An authentication service providing apparatus having authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
Identification for identifying first certification information related to authentication issued by another authentication service providing means for providing a service related to authentication and the other authentication service providing means from a client using a service provided by the service providing means Second certification information creation request receiving means for receiving a request for creating second certification information related to authentication including information;
Based on the identification information for identifying the other authentication service providing means, the right to send a request for confirming the validity of the first certification information including the first certification information to the other authentication service providing means. Sex confirmation request sending means,
Validity confirmation response receiving means for receiving the confirmation response of the validity of the proof information from the other authentication service providing means, including the confirmation result of the validity of the first proof information;
When the validity of the first proof information is confirmed, in response to a request to create second proof information related to the authentication, second proof information creating means for creating second proof information related to the authentication,
An authentication service providing apparatus comprising:   18. A second proof information creation response transmitting means for transmitting a proof information creation response including the second proof information created by the second proof information creating means to the client. Authentication service providing device. An authentication service providing method in an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
An authentication request receiving step of receiving an authentication request from a client using a service provided by the service providing means;
In response to the authentication request, a certification information creation stage for creating certification information related to authentication,
Sending an authentication response to send the certification information to the client;
A validity confirmation request receiving step for receiving a request for confirmation of validity of the certification information including the certification information transmitted to the client from another authentication service providing means for providing a service related to authentication;
An authentication service providing method characterized by comprising: An authentication service providing method in an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
An authentication request receiving step of receiving an authentication request from a client using a service provided by the service providing means;
In response to the authentication request, a first proof information creation stage for creating first proof information related to authentication;
An authentication response transmission step of transmitting the first certification information to the client;
Second proof information creation for receiving a request for creating second proof information related to the first proof information including the first proof information transmitted to the client from another authentication service providing means for providing a service related to authentication A request receiving stage;
An authentication service providing method characterized by comprising: An authentication service providing method in an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
An authentication request receiving stage for receiving an authentication request from other authentication service providing means for providing a service related to authentication;
In response to the authentication request, a first proof information creation stage for creating first proof information related to authentication;
An authentication response transmission step of transmitting the first certification information to the other authentication service providing means;
Authentication including second certification information related to authentication issued by the other authentication service providing means and identification information for identifying the other authentication service providing means from a client using the service provided by the service providing means Receiving a third certification information creation request receiving stage for receiving a third certification information creation request according to
An authentication service providing method characterized by comprising: An authentication service providing method in an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
An authentication request receiving stage for receiving an authentication request from other authentication service providing means for providing a service related to authentication;
In response to the authentication request, a first proof information creation stage for creating first proof information related to authentication;
An encryption step of encrypting the first certification information;
An authentication response transmission step of transmitting the first certification information and the first authentication information encrypted in the encryption step to the other authentication service providing means;
Authentication including second certification information related to authentication issued by the other authentication service providing means and identification information for identifying the other authentication service providing means from a client using a service provided by the service providing means A third proof information creation request receiving stage for receiving a third proof information creation request according to
An authentication service providing method characterized by comprising: An authentication service providing method in an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
Request to create second certification information related to authentication, including first certification information related to authentication issued by another authentication service providing means that provides a service related to authentication, from a client that uses the service provided by the service providing means Receiving a second certification information creation request receiving stage,
A legitimacy confirmation request sending step for sending a legitimacy confirmation request for the first certification information including the first certification information to the other authentication service providing means;
A legitimacy confirmation response receiving step for receiving the legitimacy confirmation response of the proof information from the other authentication service providing means, including the legitimacy confirmation result of the first proof information;
When the validity of the first certification information is confirmed, in response to the creation request of the second certification information related to the authentication, a second certification information creation step of creating the second certification information related to the authentication,
An authentication service providing method characterized by comprising: An authentication service providing method in an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
Request to create third certification information related to authentication, including first certification information related to authentication issued by another authentication service providing means that provides a service related to authentication, from a client using a service provided by the service providing means Receiving a third certification information creation request receiving stage;
A second certification information creation request sending step for sending a creation request for second certification information related to the first certification information, including the first certification information, to the other authentication service providing means;
A second certification information creation response reception step of receiving a creation response including the second certification information from the other authentication service providing means;
Third certification information for creating third certification information for authentication associated with the second certification information received in the second certification information creation response reception stage in response to a creation request for third certification information for the authentication The creation stage,
An authentication service providing method characterized by comprising: An authentication service providing method in an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
An authentication request receiving step of receiving an authentication request from a client using a service provided by the service providing means;
An authentication request transmission step of transmitting the authentication request to another authentication service providing means for providing a service related to authentication;
An authentication response reception step of receiving, from the other authentication service providing means, first certification information relating to authentication created by the other authentication service providing means;
In response to the authentication request, a second proof information creating step for creating second proof information related to authentication associated with the first proof information received in the authentication response receiving step;
An authentication service providing method characterized by comprising: An authentication service providing method in an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
An authentication request receiving step of receiving an authentication request from a client using a service provided by the service providing means;
An authentication request transmission step of transmitting the authentication request to another authentication service providing means for providing a service related to authentication;
An authentication response receiving step of receiving, from the other authentication service providing means, the first certification information relating to the authentication created by the other authentication service providing means and the encrypted first certification information;
In response to the authentication request, a second proof information relating to authentication is created by associating the first proof information received in the authentication response receiving step with the encrypted first proof information. The certification information creation stage;
An authentication service providing method characterized by comprising: An authentication service providing method in an authentication service providing means for providing a service related to authentication corresponding to a service providing means for providing a service,
Identification for identifying first certification information related to authentication issued by another authentication service providing means for providing a service related to authentication and the other authentication service providing means from a client using a service provided by the service providing means A second proof information creation request receiving stage for receiving a request to create second proof information related to authentication including information;
Based on the identification information for identifying the other authentication service providing means, the right to send a request for confirming the validity of the first certification information including the first certification information to the other authentication service providing means. A sex confirmation request sending stage;
A legitimacy confirmation response receiving step for receiving the legitimacy confirmation response of the proof information from the other authentication service providing means, including the legitimacy confirmation result of the first proof information;
When the validity of the first certification information is confirmed, in response to the creation request of the second certification information related to the authentication, a second certification information creation step of creating the second certification information related to the authentication,
An authentication service providing method characterized by comprising:   An authentication service providing program for causing a computer to execute the authentication service providing method according to any one of claims 19 to 27.   A computer-readable recording medium on which the authentication service providing program according to claim 28 is recorded.

Images