JP2010157012A - Authentication system, user terminal connection server apparatus, user terminal apparatus, program for the same - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform authentication processing while preventing phishing scam. <P>SOLUTION: With first and second user terminal apparatuses, a service provider apparatus, an authentication server apparatus, and a user terminal connection server apparatus, authentication processing is performed. The user terminal connection server apparatus associates an authentication server list indicative of a plurality of authentication server apparatuses with individual connection temporary identification information, first session information, and second session information and stores them. Between the user terminal connection server apparatus and the second user terminal apparatus, an authentication server is selected. User authentication is performed with the selected authentication server apparatus and the first user terminal apparatus. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to an authentication system, a user terminal connection server device, a user terminal device, and a program thereof used for authentication performed when a service provider device provides a service to a user terminal device.

  When a service provider device provides a service to a user terminal device, authentication may be performed to determine whether the user terminal device is valid. Instead of directly performing this authentication by the service provider device, a method of requesting proxy authentication from the authentication server device is used. According to this method, even when the user terminal device uses a plurality of service provider devices, as long as the same authentication server device is used, the user terminal device only needs to be authenticated once, and the service provider device and the authentication server There is a single sign-on technique in which an authentication act is completed between devices (for example, see Non-Patent Document 1).

In this method, the service provider device has an authentication server device list in which a plurality of authentication server devices are described. The service provider device presents the authentication server device list to the user terminal device to select which authentication server to use. And a user terminal device performs an authentication process between the selected authentication servers, and if authentication passes, a service provider apparatus will provide a service to a user terminal device.
"Liberty specification tutorial [online]" Liberty Alliance "[searched on December 1, 2008], Internet <URL: http://www.projectliberty.net/jp/resources/LAP_DIDW_Oct_15_2003_en.pdf>

  In the single sign-on technology, conventionally, a malicious service provider device, for example, presents and selects an authentication server device list in which a plurality of fake server devices are described, and guides the user terminal device to a fake authentication server device. There was a problem to do. There is a so-called phishing scam in which a fake authentication server is guided and the user inputs important information such as a user ID and a password to the fake authentication server and steals it. The phishing scam is described in "" Phishing scam "[online], [searched on November 25, 2008] Internet <URL: http://www.eazyfox.homelinux.org/Security/Security21.html> Yes.

  Further, conventionally, it is necessary for the user terminal device to select an authentication server from the authentication server device list held by the service provider device and to inform the service provider device. Then, when the authentication server increases or decreases, it is necessary to change the setting on the service provider device side.

  An authentication system according to the present invention provides a service to a first user terminal device, an authentication server device that performs user authentication for the first user terminal device, and the first user terminal device if the user authentication is passed. An authentication system including a service provider device, a user terminal connection server device, and a second user terminal device. The first user terminal device includes a transmission / reception unit and a display unit. The transmission / reception unit transmits service use request information to the service provider device, transmits processing start information to the user terminal connection server device, receives authentication request information from the service provider device, and receives the user The individual connection temporary identification information α from the terminal connection server device is received. The display unit displays the individual connection temporary identification information α. The second user terminal device includes an input unit and a transmission / reception unit. The individual connection temporary identification information α is input to the input unit. The transmission / reception unit transmits connection request information, individual connection temporary identification information α, and input authentication server information to the user terminal connection server device, and individual connection temporary identification information request information from the user terminal connection server device, selection Receive request information. The user terminal connection server device includes an information generation unit, a storage unit, a search unit, and a transmission / reception unit. The information generation unit includes individual connection temporary identification information α, first session information β between itself and the first user terminal device, second session information γ between itself and the second user terminal device, individual connection temporary identification information request information, Generate authentication server selection request information. The storage unit associates the individual connection temporary identification information α with the first session information β, and associates the individual connection temporary identification information α with the second session information γ corresponding to the first session information β. Is remembered. A search part searches the destination of the 2nd user terminal connection server apparatus about the 2nd session information (gamma) matched with the 1st session information (beta) about the 1st user terminal device of the transmission origin of the received process start information. The transmission / reception unit receives authentication request information from the service provider device, processing start information from the first user terminal device, connection request information from the second user terminal device, authentication server information, and individual connection temporary identification information α, Individual connection temporary identification information α for one user terminal device, individual connection temporary identification information request information for a second user terminal device, and authentication server selection request for a second user terminal connection server device for which the destination has been searched The authentication request information is transmitted to at least one of the first user terminal device and the authentication server device indicated by the authentication server information.

  According to the authentication system of the present invention, an authentication server list is held in a user terminal connection server device not related to the service provider device (independent), and an authentication server is selected between the user terminal connection server device and the user. Therefore, since the user terminal connection server device can introduce only a valid authentication server to the user, a phishing scam does not occur as a result. In addition, the service provider device only needs to always send authentication request information to the user terminal connection server device. Even if the authentication server increases or decreases, the setting on the service provider device side (the authentication server held by the service provider device) No need to change the list).

  The best mode for carrying out the invention will be described below. In addition, the same number is attached | subjected to the process which performs the structure part which has the same function, and the same process, and duplication description is abbreviate | omitted.

  FIG. 1 shows a functional configuration example of the authentication system according to the first embodiment. In addition, the sequence diagram of the authentication method is divided into a first part, a middle part, and a second part, which are shown in FIGS. As illustrated in FIG. 1, the authentication system 1000 according to the first embodiment includes a first user terminal device 100, a service provider device 200, an authentication server device 300, a user terminal connection server device 400, and a second user terminal device 500. ing. The user terminal connection server device 400 is independent of the service provider device 200. Even if the service provider device 200 is malicious, the user terminal connection server device 400 is assumed to be valid. 5 shows a functional configuration example of the user terminal connection server device 400, and FIG. 6 shows a functional configuration example of the first user terminal device 100, the service provider device 200, the authentication server device 300, and the second user terminal device 500. . The first user terminal device 100 and the second user terminal device 500 are both owned by the user, and the combination of the first user terminal device 100 and the second user terminal device 500 is, for example, (PC, mobile communication device) (For example, a mobile phone)) (mobile communication device, PC) (mobile communication device, mobile communication device) (PC, PC). It is preferable that the first user terminal device 100 is a PC and the second user terminal device 500 is a mobile phone.

[Preliminary work]
First, the prior work of the authentication method according to the first embodiment will be described. The user installs the authentication server device selection software from the user terminal connection server device 400 in the second user terminal device 500, for example. The authentication server device selection software may be downloaded from another location. It is assumed that the second user terminal device 500 has acquired the address of the user terminal connection server device 400 when the authentication server device selection software is installed. The user determines the authentication server device to be used, and a plurality of authentication server devices can be set. In addition, it is assumed that the user already has an account in the service provider device 200 and the authentication server device 300.

[Authentication]
Next, the authentication work will be described with reference to FIGS. First, when the user wants to receive the service of the service provider device 200, the user inputs information indicating that he / she wants to receive the service from the input unit 106. Then, the transmission / reception unit 102 of the first user terminal device 100 transmits the service use request information A to the service provider device (step S100). When the transmission / reception unit 202 of the service provider device 200 receives the service use request information A, the authentication request information generation unit 204 is authentication request information that is information for requesting authentication between the user and the authentication server device 300. B is generated. The transmission / reception unit 202 of the service provider device transmits the authentication request information B to the first user terminal device 100 and also to the user terminal connection server device 400 by redirection (step S102). The transmission / reception unit 202 of the service provider device 200 may directly transmit to the user terminal device 100 and the user terminal connection server device 400.

  When the transmission / reception unit 402 of the user terminal connection server device 400 receives the authentication request information B, the information generation unit 404 of the user terminal connection server device 400 generates the individual connection temporary identification information α. Further, the information generation unit 404 generates first session information β that is session information between the user terminal connection server device 400 itself and the first user terminal device 100. Then, the generated individual connection temporary identification information α and the first session information β are associated with each other and stored in the storage unit 406 (step S104). The transmission / reception unit 502 of the user terminal connection server device 400 transmits the individual connection temporary identification information α associated with the first session information β in step S104 to the first terminal device 100 (step S106).

  When the transmitting / receiving unit 102 of the first user terminal device 100 receives the individual connection temporary identification information α transmitted in step S106, the display unit 104 displays the individual connection temporary identification information α (step S108). By this display, the user can know the individual connection temporary identification information α. In accordance with this display, for example, an electronic copy of a user terminal device connection completion button is displayed on the display unit 104. By electronically pressing this user terminal device connection completion button, the user recognizes that the second user terminal device 500 and the user terminal connection server device 400 are interconnected (not yet connected at this stage). Then, the user can notify the user terminal connection server device of the recognition. The second user terminal device connection completion button may be anything as long as it is such information.

  When the user confirms that the individual connection temporary identification information α is displayed on the display unit 104, the user activates the authentication server selection software in the second user terminal device 500 and the user terminal connection server from the second user terminal device 500. A connection request is made to the device 400. For example, the connection request information generation unit 508 generates connection request information C and transmits it to the user terminal connection server device 400 (step S110). As described above, the second user terminal device 500 holds the address of the second user terminal connection server device 400 in the storage unit 512 when the authentication server selection software is downloaded. By requiring connection request processing from the second user terminal device 500 to the user terminal connection server device 400, which is the processing of step S110, the user himself can confirm the user terminal connection server device 400, and the result As a result, phishing scams can be prevented.

  Based on the transmitted connection request information C, the information generation unit 404 of the user terminal connection server device 400 generates second session information γ between the user terminal connection server device 400 itself and the user terminal device 500, and the second The session information γ is stored in the storage unit 406. The user terminal connection server device 400 instructs the second user terminal device 500 to input the individual connection temporary identification information α (step S112). Specifically, the information generation unit 404 of the user terminal connection server device 400 generates the individual connection temporary identification information request information D, and the transmission / reception unit 402 of the user terminal connection server device receives the individual connection temporary identification information request information D. Transmit to the second user terminal device 500. When the transmission / reception unit 502 of the second user terminal device 500 receives the individual connection temporary identification information request information D, a display to the effect that the individual connection temporary identification information α is input from the input unit 504 is displayed on the display unit 510. When viewing the display, the user inputs the individual connection temporary identification information α from the input unit 504. Then, the transmitting / receiving unit 502 of the second user terminal device 500 transmits the input individual connection temporary identification information α to the second user terminal connection server device 400 (step S114).

  When the transmission / reception unit 402 of the user terminal connection server device 400 receives the individual connection temporary identification information α transmitted in step S114, the individual connection temporary identification information α associated in step S114 and the second session generated in step S112. The information γ is associated and stored in the storage unit 406 (step S116). In step S104, the individual connection temporary identification information α and the first session information β are stored in the storage unit 406 in association with each other. Also, “the first session information β for the first user terminal device 100” and “the second session information γ for the second user terminal device 500 held by the same user for the first user terminal device 100” and This relationship is referred to as “first session information β” and “second session information γ” corresponding to each other ”. That is, in step S116, the individual connection temporary identification information α and the first session information β are associated with the storage unit 406, and the individual connection temporary identification information α and “the first session information β corresponding to the first session information β” are associated. 2 session information γ ”is stored in association with each other. In other words, the individual connection temporary identification information α, the first user terminal device 100 owned by the same user, the first session information β for the second user terminal device 500, and the second session information γ are associated with each other. Stored in the storage unit 406.

On the other hand, after the user transmits the individual connection temporary identification information α in step S114,
When the user presses the second user terminal device connection completion button displayed on the display unit 104 of the first user terminal device 100, the second user terminal device 500 and the user terminal connection server device 400 are interconnected. Is notified to the user terminal connection server apparatus 400, and processing start information E, which is information indicating that the user terminal connection server apparatus 400 is instructed, is transmitted to the user terminal connection server apparatus 400. (Step S118).

  When the transmission / reception unit 402 of the user terminal connection server device 400 receives the process start information E, the information generation unit 404 of the user terminal connection server device generates authentication server selection request information F. The authentication server selection request information F is information that prompts the user to select an authentication server. The transmission / reception unit 402 of the user terminal connection server device 400 transmits the authentication server selection request information F to the second user terminal device 500. However, since many people own the second user terminal device 500 and there are many second user terminal devices 500, it will be explained which of the many second user terminal devices 500 is selected for transmission. To do.

  As described above, in step S116, the individual connection temporary identification information α, the first session information β, and the second session information γ are associated with each other and stored in the storage unit 406. The search unit 408 searches the individual session temporary identification information α corresponding to the first session information β for the first session information β of the first user terminal device 100 that is the transmission source of the transmitted process start information E. Then, the search unit 408 searches for the second session information γ corresponding to the individual connection temporary identification information α. The destination of the second user terminal device 500 for the second session information γ searched by the search unit 408 is searched, and the transmission / reception unit 402 transmits authentication server selection request information F to the destination (step S120).

  The determination unit 506 of the second user terminal device 500 determines an authentication server from a predetermined authentication server list using the input authentication server information G (step S122).

  A method for determining the authentication server will be described. As a first technique, there is a technique for allowing a user to select an authentication server device. In the following description, the authentication server information G is information indicating the authentication server device defined by the user, for example, the name of the authentication server device and the address of the authentication server device are associated with each other. . In the first method, when the second user terminal device 500 downloads the authentication server selection software in [pre-processing], the second user terminal device 500 (held by the user terminal connection server device 400) Assume that the second authentication server list is held. The second authentication server list is one in which one or more authentication server devices are associated with the addresses of the authentication server devices. In this case, the second user terminal device 500 includes a list presenting unit 514, presents the authentication server list to the list presenting unit 514, and is provided to the user among the authentication server devices indicated in the second authentication server list. Any one of them is selected and input to the input unit 504 as authentication server information G. Further, as a modification, the user may directly input the address of the authentication server device desired by the user from the input unit 504 without referring to the second authentication server list, and this may be used as the authentication server information G. . In the case of this modification, the list presentation unit 514 is not necessary.

  In the second method, instead of allowing the user to select an authentication server device, the determination unit 506 of the second user terminal device automatically determines the authentication server. When this second method is used, when the transmission / reception unit 202 of the service provider apparatus transmits the authentication request information B to the user terminal connection server apparatus 400 in step S102, the service provider apparatus information H is also transmitted. . And in step S120, when the transmission / reception part 402 of the user terminal connection server apparatus 400 transmits the authentication server selection request information F to the 2nd user terminal apparatus 500, the service provider apparatus information H is also transmitted simultaneously.

  The service provider device information H is, for example, (1) information (for example, URL of the service provider device 200) about the service provider device 200 that requests authentication, or (2) the service provider device 200 requests. Authentication authentication methods (for example, SAML (Security Assertion Markup Language), OpenID, etc.), (3) authentication time (for example, current time), and the like. In addition, the service provider apparatus information H may be anything as long as it is information on the service provider apparatus 200 itself or information on authentication requested by the service provider apparatus 200.

For example, as the service provider device information H, (1) if a URL for the service provider device 200 requesting authentication is used, an authentication server device is allocated for each URL, and the determination unit 506 determines the service provider device information. Referring to H (that is, the URL of the service provider device), the corresponding authentication server device is automatically determined, and authentication server information G for the authentication server device automatically determined is generated. If (2) the authentication method is used as the service provider device information H, an authentication server device is allocated for each authentication method, and the service provider device information H (that is, the authentication requested by the service provider device) is assigned. Referring to the authentication method), the determination unit 506 automatically determines the corresponding authentication server device. Further, as the service provider device information H, the case of using (3) authentication time, for example, if the authentication time morning, using the authentication server 300 _1, when the authentication time afternoon, the authenticating server device 300 ₂ It may be used. The associated information described in (1) to (3) between the service provider apparatus information H and the authentication server apparatus is stored in the storage unit 512 of the second user terminal apparatus.

  Next, as a third technique, as in the second technique, in step S102 and step S120, the service provider apparatus information H is transmitted from the service provider apparatus 200 via the user terminal connection server apparatus 400 to the second user terminal apparatus. 500. The second user terminal device 500 includes a list generation unit 516. The list generation unit 516 generates a second authentication server list (described in the first method) using the service provider device information H. The method for generating the second authentication server list will be described. In the [pre-processing], the second user terminal device 500 holds the second authentication server list (described in the first method). When V authentication server devices in the second authentication server list are indicated, the list generation unit 516 uses the service provider device information to generate V ′ (V> V ′) authentication server devices. Narrow down and generate an authentication server list showing V ′ authentication server devices. The generated authentication server list is presented as a second server list by the list presenting unit 514 to be shown to the user. Then, the user selects the authentication server device from the presented second server list and causes the input unit 504 to input the authentication server information G. Further, the list generation unit 516 may generate an authentication server list directly indicating V ′ authentication server devices without narrowing down the V authentication server devices.

  Hereinafter, the authentication server device determined by the first to third methods is referred to as a post-determination authentication server device 300, and the transmission / reception unit 502 of the second user terminal device 500 uses the authentication server information G of the post-determination authentication server device 300. It transmits with respect to the user terminal connection server apparatus 400 (step S122). In the following description, the authentication server device indicated by the authentication server information G is referred to as an after-determination authentication server device.

  When the transmission / reception unit 502 of the second user terminal device 500 receives the authentication server information G, the transmission / reception unit 502 transmits the determined authentication server device 300 and the first user terminal device 100 indicated by the authentication server information G to the The authentication request information B received in step S102 is transmitted (step S124).

  The transmission / reception unit 502 of the second user terminal device 500 transmits the authentication request information B to at least one of the first user terminal device 100 and the post-determination authentication server device 300. Further, the transmission / reception unit 502 of the second user terminal device 500 transmits the authentication request information B to the first user terminal device 100, and transmits the authentication request information B to the authentication server device 300 after determining the authentication request information B by redirection. Further, the transmission / reception unit 502 of the second user terminal device 500 may transmit the authentication request information B directly to the post-determination authentication server device 300 and the first user terminal device 100.

  Then, the post-determination authentication server apparatus 300 performs user authentication with the first user terminal apparatus 100 that has received the authentication request information B (step S126). As a user authentication method, for example, a known technique such as password authentication may be used. The above is the authentication method of the present embodiment.

[Service delivery]
Then, the authentication unit 304 of the authentication server device 300 generates authentication result information J indicating the result of the authentication processing, and the transmission / reception unit 302 transmits the authentication result information J to the first user terminal device 100 and the service provider device 200. To do. The authentication result information J may be transmitted to the first user terminal device 100 and transmitted to the service provider device 200 by redirection. If the authentication is successful (step S130), the providing unit 206 of the service provider device 200 provides a service to the first user terminal device 100 (step S132). If the authentication fails, the providing unit 206 ends without providing the service.

  Conventionally, since a service provider device has an authentication server list, a malicious service provider device introduces a fake authentication server device to a user and causes the fake authentication server device to input a user ID, a password, and the like. There was a phishing scam. In the present embodiment, a second user terminal device connection server device that is completely unrelated to the service provider device (independent) is newly added, the second user terminal device connection server device has an authentication server list, and the second The user terminal device is made to select an authentication server device. Therefore, even if the service provider device is malicious, the first user terminal device cannot be introduced with a fake authentication server device, and no phishing scam occurs.

  In the configuration of the authentication method according to the first embodiment, the service provider device 200 may always transmit an authentication request to the second terminal connection server device 400. Thereby, for example, even when the number of authentication servers increases or decreases, it is not necessary to change the settings (authentication server list, etc.) on the service provider device side.

  Further, by using the above-described (2) authentication method as the authentication server information G, the determination unit 506 automates the determination of the authentication server device, so that the service provider device 200 can use the authentication method (SAML method, OpenID method, etc.). The authentication request may be transmitted to the second terminal connection server device 400 regardless of the standardization method. As a result, the processing load on the service provider device 200 can be reduced, and the second terminal connection server device 400 can connect to the authentication server device in accordance with each authentication method. As a result, the service provider device desires. Authentication by an authentication method can be performed.

  The authentication method according to the second embodiment is obtained by adding a step in which the service provider device 200 determines whether or not the authentication server device selected by the user is acceptable to the authentication method according to the first embodiment. Thereby, compared with the authentication method of Example 1, accurate authentication can be performed. Compared with the authentication method of the first embodiment, the first part (FIG. 2) and the second part (FIG. 4) of the authentication method are changed, and the second part of the authentication method of the second embodiment is shown in FIG. FIG. 2 is used for the first part. Since the middle part is the same as that of the first embodiment, the description is omitted. Only the differences from the authentication method of the first embodiment will be described.

  In the first embodiment, when the transmission / reception unit 202 of the service provider device 200 receives the service use request information A in step S102, it transmits “authentication request information B” to the first user terminal device and the user terminal connection server device. In Example 2, as step S102 ′, when the transmission / reception unit 202 of the service provider apparatus 200 receives the service use request information A, the “authentication server presentation request information K” is transmitted to the first user terminal apparatus and the user terminal connection server apparatus. Send to. The authentication server presentation request information K is information for requesting the service provider apparatus 200 to present which authentication server apparatus is used for user authentication.

  In step S104, when the transmission / reception unit 402 of the user terminal connection server device 400 receives the “authentication server presentation request information K”, the information generation unit 404 of the user terminal connection server device 400 performs the individual connection temporary identification information α, And first session information β between itself and the first user terminal device is generated.

  In step S124, in the first embodiment, the transmission / reception unit 502 of the second user terminal device 500 transmits the authentication request information B to the authentication server device 300 and the first user terminal device 100 after determination, but in the second embodiment, in step S124 ′. As described above, the transmission / reception unit 402 of the user terminal connection server device 400 transmits the authentication server information G to the user terminal device 100, and also transmits it to the service provider device 200 by redirection. It is not necessary to transmit to the user terminal device 100.

  In the second embodiment, the service provider device 200 has a first authentication server list in the storage unit 210. The first authentication server list indicates one or more authentication server devices for which the service provider device 200 can request authentication processing.

  When the transmission / reception unit 202 of the service provider device 200 receives the authentication server information G, the determination unit 208 refers to the first authentication server list, and the authentication server device indicated by the authentication server information G is indicated in the first authentication server list. Whether or not it is possible to request authentication processing to the authentication server device indicated by the authentication server information G. Based on the confirmation, the determination unit 208 determines whether or not the transmission / reception unit 202 transmits authentication request information to at least one of the authentication server device 300 and the first user terminal device 100 after determination of the received authentication server information. Judging. For example, when the determination unit 208 confirms that “the authentication server device indicated by the authentication server information G is indicated in the first authentication server list”, the determined authentication server device is designated as the determined authentication server device 300, and the service The transmission / reception unit 402 of the provider device 200 transmits the authentication request information to at least one of the authentication server device 300 and the first user terminal device 100 after determining the authentication request information B.

  When the transmission / reception part 402 sends to both, it transmits to the 1st user terminal device 100, and transmits to the authentication server apparatus 300 after determination by redirection. In step S126, authentication processing between the user terminal device 100 and the post-determination authentication server device 300 is performed. When the determination unit 208 confirms that “the authentication server device indicated by the authentication server information G is not shown in the first authentication server list”, the process is ended or the user is made to select the authentication server device again. The authentication request information is not transmitted to the transmission / reception unit 202.

  As in the second embodiment, the service provider device 200 includes the step of determining whether or not the authentication server device selected by the user is acceptable, thereby enabling more accurate authentication than the authentication method of the first embodiment. It can be performed.

  In the third embodiment, the user terminal connection server device 400 includes the confirmation unit 410 and the storage unit 406 holds the third authentication server list. The third authentication server list shows authentication servers that the user terminal connection server device 400 may perform an authentication process.

  In step S122, when user terminal connection server apparatus 400 receives authentication server information G from the second user terminal apparatus, in step S124, determination unit 410 of user terminal connection server apparatus 400 indicates the received authentication server information. The authentication server device checks whether it is shown in the third authentication server list. Then, based on the confirmation, it is determined whether or not the transmission / reception unit 410 of the user terminal connection server device 400 transmits the authentication request information B to at least one of the first user terminal device 100 and the determined authentication server device 300. .

  If the determination unit 410 confirms that “the authentication server device indicated by the received authentication server information is not indicated in the third authentication server list” in the configuration of the first embodiment, the authentication request information B is transmitted to the transmission / reception unit 410. May be transmitted, the processing may be terminated, or the authentication server information G may be input to the second user terminal device 500 again.

  If determination unit 410 confirms that “the authentication server device indicated by the received authentication server information is indicated in the third authentication server list”, it causes transmission unit 410 to transmit authentication request information B.

  In the configuration of the second embodiment, when the determination unit 410 confirms that “the authentication server device indicated by the received authentication server information is not shown in the third authentication server list”, the transmission / reception unit 410 receives the service provider. Instead of transmitting the authentication server information G to the device 200, an error signal indicating that the authentication server device 300 is not appropriate may be transmitted to the service provider device 200.

  If the determination unit 410 confirms that “the authentication server device indicated by the received authentication server information is indicated in the third authentication server list”, the transmission / reception unit 410 notifies the service provider device 200 of the authentication server information G. To send.

  Thus, by providing the user terminal connection server device 400 with the determination unit 410, a more appropriate authentication server device can be selected.

  In the first to third embodiments, the first user terminal device 100 and the second user terminal device 500 may be integrated.

<Hardware configuration>
The present invention is not limited to the above-described embodiment. In addition, the various processes described above are not only executed in time series according to the description, but may be executed in parallel or individually according to the processing capability of the apparatus that executes the processes or as necessary. Needless to say, other modifications are possible without departing from the spirit of the present invention.

  Moreover, it is possible to configure a reverberation program that causes a computer to operate as the user terminal connection server device 400 and the user terminal device (second user terminal device) 500. Also, it configures a computer-readable recording medium that records the program. It is also possible to do. In this way, when realized by a computer, the processing contents of functions that the user terminal connection server device 400 and the user terminal device (second user terminal device) 500 should have are described by a program. The processing function is realized on the computer by executing the program on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. The computer-readable recording medium may be any medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, or a semiconductor memory. Specifically, for example, the magnetic recording device may be a hard disk device or a flexible Discs, magnetic tapes, etc. as optical disks, DVD (Digital Versatile Disc), DVD-RAM (Random Access Memory), CD-ROM (Compact Disc Read Only Memory), CD-R (Recordable) / RW (ReWritable), etc. As the magneto-optical recording medium, MO (Magneto-Optical disc) or the like can be used, and as the semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory) or the like can be used.

  The program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Furthermore, the program may be distributed by storing the program in a storage device of the server computer and transferring the program from the server computer to another computer via a network.

A computer that executes such a program first stores, for example, a program recorded on a portable recording medium or a program transferred from a server computer in its own storage device. When executing the process, the computer reads the program stored in its own recording medium and executes the process according to the read program. As another execution form of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and the program is transferred from the server computer to the computer. Each time, the processing according to the received program may be executed sequentially. Also, the program is not transferred from the server computer to the computer, and the above-described processing is executed by a so-called ASP (Application Service Provider) type service that realizes the processing function only by the execution instruction and result acquisition. It is good. Note that the program in this embodiment includes information that is used for processing by an electronic computer and that conforms to the program (data that is not a direct command to the computer but has a property that defines the processing of the computer).
In this embodiment, the present apparatus is configured by executing a predetermined program on a computer. However, at least a part of these processing contents may be realized by hardware.

  In addition, the user terminal connection server device 400 and the user terminal device (second user terminal device) 500 described in this embodiment include a CPU (Central Processing Unit), an input unit, an output unit, an auxiliary storage device, and a RAM (Random Access Memory). ), A ROM (Read Only Memory) and a bus (none of which are shown).

  The CPU executes various arithmetic processes according to the read various programs. The auxiliary storage device is, for example, a hard disk, an MO (Magneto-Optical disc), a semiconductor memory, or the like, and the RAM is an SRAM (Static Random Access Memory), a DRAM (Dynamic Random Access Memory), or the like. The bus connects the CPU, the input unit, the output unit, the auxiliary storage device, the RAM, and the ROM so that they can communicate with each other.

<Cooperation between hardware and software>
The word adding device of this embodiment is constructed by reading a predetermined program into the hardware as described above and executing it by the CPU. The functional configuration of each device constructed in this way will be described below.

Information generation unit 404, search unit 408, determination unit 410 of user terminal connection server device 400, determination unit 506 of second user terminal device 500, connection request information generation unit 508,
Is a calculation unit constructed by reading a predetermined program into the CPU and executing it. The storage unit 406 and the storage unit 512 function as the auxiliary storage device. Each transmission / reception unit functions as an interface by connecting each device via a bus or the like. The list presentation unit 514 functions as a display.

The figure which showed the function structural example of the authentication system of a present Example. The figure which showed the sequence diagram of the first part of the authentication method of a present Example. The figure which showed the sequence diagram of the middle part of the authentication method of a present Example. The figure which showed the sequence diagram of the latter part of the authentication method of a present Example. The figure which showed the function structural example of the user terminal connection server apparatus of a present Example. The figure which showed the function structural examples, such as the 1st user terminal device of a present Example. The figure which showed the sequence diagram of the second part of the authentication method of the other Example.

Claims (13)

A first user terminal device, an authentication server device that performs user authentication for the first user terminal device, a service provider device that provides a service to the first user terminal device if the user authentication is successful, and a user In an authentication system comprising a terminal connection server device and a second user terminal device,
The first user terminal device
Service usage request information is transmitted to the service provider device, processing start information is transmitted to the user terminal connection server device, authentication request information from the service provider device is received, and the user terminal connection server device A transmission / reception unit for receiving individual connection temporary identification information α from
A display unit for displaying the individual connection temporary identification information α,
The second user terminal device
An input unit to which the individual connection temporary identification information α is input;
Connection request information, individual connection temporary identification information α, and input authentication server information are transmitted to the user terminal connection server device, and individual connection temporary identification information request information and authentication server selection request information from the user terminal connection server device And a transmission / reception unit for receiving
The user terminal connection server device is:
Individual connection temporary identification information α, first session information β between itself and the first user terminal device, second session information γ between itself and the second user terminal device, individual connection temporary identification information request information, authentication server selection request information An information generation unit for generating
The individual connection temporary identification information α and the first session information β are associated with each other, and the individual connection temporary identification information α and the second session information γ corresponding to the first session information β are stored in association with each other. And
A search unit for searching for a destination of the second user terminal connection server device for the second session information γ associated with the first session information β for the first user terminal device that is the transmission source of the received process start information;
The authentication request information from the service provider device, the processing start information from the first user terminal device, the connection request information from the second user terminal device, the authentication server information, and the individual connection temporary identification information α are received, and the first user terminal device The individual connection temporary identification information α for the second user terminal device, the individual connection temporary identification information request information for the second user terminal device, the authentication server selection request information for the second user terminal device searched for the destination, An authentication system comprising: a user terminal device; and a transmission / reception unit that transmits authentication request information to at least one of authentication server devices indicated by authentication server information (hereinafter referred to as “post-determination authentication server device”). The authentication system according to claim 1,
The transmitting / receiving unit of the user terminal connection server device does not transmit authentication request information to at least one of the first user terminal device and the determined authentication server device, but authenticates the service provider device after the determination. It sends authentication server information about the server device,
The service provider device further includes:
Confirm whether or not the authentication server device indicated by the received authentication server information is shown in the first authentication server list, and based on the confirmation, the transmitting and receiving unit An authentication system, comprising: a determination unit configured to determine whether at least one of the first user terminal devices transmits authentication request information. The authentication system according to claim 1,
The user terminal connection server device further includes:
Check whether the authentication server device indicated by the received authentication server information is shown in the third authentication server list, and based on the confirmation, send / receive unit of the user terminal connection server device to the first user terminal device An authentication system comprising: a determination unit that determines whether or not to transmit authentication request information to at least one of the authentication server devices indicated by the authentication server information. The authentication system according to claim 2,
The user terminal connection server device is:
Further, it is confirmed whether or not the authentication server device indicated by the received authentication server information is shown in the third authentication server list, and based on the confirmation, the transmission / reception unit of the user terminal connection server device is notified to the service provider device. An authentication system comprising: a determination unit that determines whether or not to transmit the authentication server information. An authentication system according to any one of claims 1 to 4,
The transmission / reception unit of the second user terminal device receives service provider device information about the service provider device,
The second user terminal device further includes:
An authentication system comprising: a determination unit that generates authentication server information using the service provider apparatus information. An authentication system according to any one of claims 1 to 4,
The authentication system, wherein the authentication server information is input from the input unit. The authentication system according to claim 6,
The second user terminal device has a list presenting unit for presenting a second authentication server list in which an authentication server is shown;
2. The authentication system according to claim 1, wherein the authentication server information indicates any of the authentication server devices indicated in the second authentication server list. The authentication system according to claim 7,
The transmission / reception unit of the second user terminal device receives service provider device information about the service provider device,
The second user terminal device further includes:
An authentication system comprising: a list generation unit configured to generate the second authentication server list using the service provider apparatus information. Individual connection temporary identification information α, first session information β between itself and the first user terminal device, second session information γ between itself and the second user terminal device, individual connection temporary identification information request information, authentication server selection request information An information generation unit for generating
The individual connection temporary identification information α and the first session information β are associated with each other, and the individual connection temporary identification information α and the second session information γ corresponding to the first session information β are stored in association with each other. A storage unit;
A search unit for searching for a destination of the second user terminal connection server device for the second session information γ associated with the first session information β for the first user terminal device that is the transmission source of the received process start information;
The authentication request information from the service provider device, the processing start information from the first user terminal device, the connection request information from the second user terminal device, the authentication server information, and the individual connection temporary identification information α are received, and the first user terminal device The individual connection temporary identification information α for the second user terminal device, the individual connection temporary identification information request information for the second user terminal device, the authentication server selection request information for the second user terminal connection server device searched for the destination, and the first user. A user terminal connection server device comprising: a transmission / reception unit that transmits authentication request information to at least one of the terminal device and the authentication server device indicated by the authentication server information. The user terminal connection server device according to claim 9,
The transceiver unit is
The authentication request information is not transmitted to at least one of the first user terminal device and the authentication server device indicated by the authentication server information, but the authentication request information is transmitted to the service provider device. User terminal connection server device. The user terminal connection server device according to claim 9 or 10,
Furthermore, when the authentication server device indicated by the received authentication server information is not shown in the third authentication server list, the authentication server device has a confirmation unit that does not determine the authentication server device after the determination. A user terminal connection server device. An input unit to which the individual connection temporary identification information α is input;
Connection request information, individual connection temporary identification information α, and inputted authentication server information are transmitted to the user terminal connection server device, and individual connection temporary identification information request information, selection request information, service from the user terminal connection server device A transceiver for receiving service provider device information about the provider device; and
And a determination unit that generates authentication server information using the service provider device information.   The program which operates a computer as a user terminal connection server apparatus in any one of Claims 9-11, or a user terminal apparatus of Claim 12.

Images