JP6468013B2 - Authentication system, service providing apparatus, authentication apparatus, authentication method, and program - Google Patents

Description

  The present invention relates to an authentication system, a service providing apparatus, an authentication apparatus, an authentication method, and a program.

  When the service providing device authorizes the use of the service to the user, the authentication device that manages the user information performs the user authentication and the service use authorization, and the service providing device determines the user according to the result. There is an authentication system that authorizes the use of services.

JP 2008-234606 A

  Here, for example, in a system that performs authentication at the time of using the service providing apparatus in the authentication apparatus, if the authentication apparatus generates authorization information that is information related to authorization for use of the service providing apparatus, the service providing apparatus side There is a possibility that authorization information is generated regardless of the intention. For example, if the authorization information includes the number of authorized users, the content of the authorized service, restrictions on the time to authorize, etc., depending on the content included in the authorization information, The load may increase. Therefore, it is not preferable that the authorization information is generated regardless of the intention of the service providing apparatus providing the service and used in the system.

  One of the objects of the present invention is to make it possible to use authorization information arbitrarily generated on the service providing apparatus side in a system that performs authentication in the authentication apparatus when using the service providing apparatus.

The invention according to claim 1 is an authentication system including a service providing device and an authentication device, wherein the service providing device generates authorization information used for authorization of use of a service provided by the service providing device. Generating means, an authorization information providing means for providing the generated authorization information to the authentication device, and a request that does not include the authorization information from a user of the service providing device. Guidance means for guiding the authentication device to perform authentication, and authorization means for authorizing the use of the service to the user when a request including the authorization information is received from the user, The authentication apparatus includes: a means for storing the authorization information provided by the authorization information providing means in a storage means in association with the user; and a guidance means. Means for authenticating the guided user, and authorization information transmitting means for transmitting the authorization information stored in the storage means in association with the authenticated user to the user. Features.

  The invention according to claim 2 is the authentication system according to claim 1, wherein the service providing device corresponds to the generated authorization information and an authorization condition related to a service provided by the service providing device. And further includes means for storing the information.

  A third aspect of the present invention is the authentication system according to the first aspect, wherein the authorization information includes information relating to an authorization condition relating to a service provided by the service providing apparatus.

  Invention of Claim 4 is an authentication system in any one of Claim 2 or 3, Comprising: The said authorization conditions are the content of the service which the said service provision apparatus authorizes use, and the authority of the user who authorizes , And at least one of the available periods.

  Invention of Claim 5 is an authentication system as described in any one of Claim 1 to 4, Comprising: The said service provision apparatus sets the validity or invalidity of the authorization information which the said authorization information provision means provided Setting means to further include.

  The invention according to claim 6 is the authentication system according to claim 5, wherein the authorization unit includes the authorization information transmitted by the authorization information transmission unit in the request received from the user, In addition, when the authorization information is set to be invalid, the user is not authorized to use the service.

  A seventh aspect of the present invention is the authentication system according to any one of the first to sixth aspects, wherein the service providing device stores an authorization history of use of the service by the authorization means in a storage means. And fraud detection means for detecting unauthorized use of the authorization information in accordance with the authorization history.

The invention according to claim 8 is the authentication system according to any one of claims 1 to 4 , wherein the service providing device stores an authorization history of use of the service by the authorization means in a storage means. Means for detecting unauthorized use of the authorization information according to the authorization history, and setting means for setting validity or invalidity of the authorization information provided by the authorization information providing means, When the fraud detection unit detects the unauthorized use, the setting unit sets the authorization information in which the unauthorized use is detected to be invalid .

The invention according to claim 9 is the authentication system according to claim 8 , wherein the authorization unit includes the authorization information transmitted by the authorization information transmission unit in the request received from the user, In addition, when the authorization information is set to be invalid, the user is not authorized to use the service .
A tenth aspect of the present invention is the authentication system according to any one of the seventh to ninth aspects, wherein the fraud detection means differs in a number of requests including the same authorization information by a predetermined number or more. The unauthorized use is detected when received from the user.

The invention described in claim 1 1, a service providing apparatus connected to the authentication device, and generating means for generating authorization information used for authorization of use of the service provided by the service providing apparatus, said generating Authentication information providing means for providing the authorization information to the authentication device; and when a request not including the authorization information is received from a user of the service providing device, the user is authenticated in the authentication device Guidance means for guiding, and an authorization means for authorizing the user to use the service when a request including the authorization information is received from the user.

The invention according to claim 12 includes a generating unit that generates a service providing device connected to an authentication device, and generates authorization information used to authorize use of a service provided by the service providing device, and the generated Authorization information providing means for providing authorization information to the authentication device, and when a request not including the authorization information is received from a user of the service providing device , guides the user to perform authentication in the authentication device When the request including the authorization information is received from the user, the guidance unit is configured to function as an authorization unit that authorizes the user to use the service.

The invention according to claim 1 3, An authentication apparatus connected to a service providing apparatus, the authorization information used for authorization of use of the service provided by the service providing apparatus, in association with the user memory Means for storing in the means; means for authenticating a user who has been guided to perform authentication in the authentication device by the service providing device that has received a request not including the authorization information from the user; and And authorization information transmitting means for transmitting the authorization information stored in the storage means in association with the user to the user.

Invention according to claim 1 4, a program, means for storing authorization information used for authorization of use of the service provided, the storage means in association with the user by the service providing apparatus, the usage Means for authenticating a user who is guided to execute authentication in the authentication apparatus by the service providing apparatus that has received a request that does not include the authorization information from a user, and the storage means in association with the authenticated user The authorization information stored in the function is made to function as an authorization information transmitting means for transmitting to the user.

The invention according to claim 1 5, An authentication method implemented in an authentication system including a service providing apparatus and the authentication device, by the service providing device, authorization of the use of services provided by the service providing device Generating the authorization information used for the service, providing the generated authorization information to the authentication device by the service providing device, and providing the authorization information provided by the authentication device to the service Storing in association with a user of the apparatus, and when the service providing apparatus receives a request not including the authorization information from the user, the user is authenticated by the authentication apparatus. A step of guiding, a step of authenticating the guided user by the authentication device, and a step of authenticating the authentication device. More, the authorization information stored in association with the authenticated user is transmitted to the user, and the authorization provided from the authentication device to the request received from the user by the service providing device. And if the information is included, authorizing the user to use the service.

Claim 1, 1 1,12,13, according to the invention described in 14 and 1 5, in a system that performs the authentication of the authentication device when using the service providing device, authorization created arbitrarily service providing apparatus Information can be used.

  According to invention of Claim 2 and 3, the authorization information based on authorization conditions can be used.

  According to the fourth aspect of the present invention, the service providing apparatus provides authorization information based on authorization conditions such as the service contents that the service providing apparatus authorizes use, the authority of the authorized user, and the number of authorized users. Can be generated.

  According to the fifth aspect of the present invention, the service providing apparatus can control whether the authorization information provided to the authentication apparatus is valid or invalid.

According to the sixth and ninth aspects of the present invention, the service providing apparatus can avoid providing a service to a user who makes a request based on invalid authorization information.

  According to the seventh aspect of the present invention, unauthorized use of authorization information by a user can be detected.

According to the tenth aspect of the present invention, unauthorized use of authorization information can be detected based on authorization information that has been used multiple times.

According to the invention described in claim 8 , it is possible to avoid providing a service to a user who makes a request based on unauthorized use authorization information.

It is a figure which shows an example of the whole structure of the authentication system which concerns on this embodiment. It is a functional block diagram which shows an example of the function which the terminal device which concerns on this embodiment, a service provision apparatus, and an authentication apparatus implement | achieve. It is a figure which shows an example of the authentication apparatus information table which concerns on this embodiment. It is a figure which shows an example of the authorization information table which concerns on this embodiment. It is a figure which shows an example of the user information table which concerns on this embodiment. It is a figure which shows an example of the matching information table which concerns on this embodiment. It is a flowchart which shows an example of the authentication apparatus registration process which the service provision apparatus which concerns on this embodiment performs. It is a flowchart which shows an example of the authorization information production | generation process which the service provision apparatus which concerns on this embodiment performs, and the authorization information matching process which an authentication apparatus performs. It is a flowchart which shows an example of the service use authorization process which the service provision apparatus which concerns on this embodiment, and an authentication apparatus perform. It is a figure which shows an example of the authorization information table with which the invalid flag which concerns on this embodiment was matched. It is a figure which shows an example of the authorization information utilization log | history table which concerns on this embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram illustrating an example of the overall configuration of an authentication system 1 according to the present embodiment. As shown in FIG. 1, the authentication system 1 according to the present embodiment includes a terminal device 10, a service providing device 20, and an authentication device 30. The terminal device 10, the service providing device 20, and the authentication device 30 are connected to each other via a communication means such as a local network (LAN) or the Internet, and communicate with each other.

  The terminal device 10 is, for example, a computer used by a user such as a personal computer, a tablet, or a portable terminal. A control unit that is a program control device such as a CPU that operates according to a program installed in the terminal device 10, ROM or RAM And a storage unit such as a hard disk drive and an operation unit such as a network board. In the present embodiment, a web application is activated on the terminal device 10 and communicates with the service providing device 20 and the authentication device 30 via the web application.

  The service providing apparatus 20 is a server computer or the like, and is a control unit that is a program control device such as a CPU that operates according to a program installed in the service providing apparatus 20, a storage unit that is a storage element such as a ROM or a RAM, or a hard disk drive. And a communication unit which is a communication interface such as a network board. In the present embodiment, the service providing device 20 is a device that provides a web service to a user who has made a use contract, and for example, provides a service such as web storage.

  The authentication device 30 is a server computer or the like, a control unit that is a program control device such as a CPU that operates according to a program installed in the authentication device 30, a storage unit that is a storage element such as a ROM or RAM, a hard disk drive, or the like, a network It includes a communication unit that is a communication interface such as a board. In the present embodiment, the authentication device 30 is a device that authenticates a user who uses the service of the service providing device 20. The authentication device 30 holds user information of the user of the service providing device 20, and authenticates the user based on the user information. In addition, the authentication device 30 may manage user information for each organization such as a company and a department, and may authenticate a member belonging to the organization.

  In such an authentication system 1, for example, when a new organization makes a contract to use the service providing device 20, an agreement between the new contract organization and the administrator of the service providing device 20 (referred to as a service administrator). Accordingly, the service conditions that the service providing device 20 authorizes use, the authority of the user to authorize, the number of users to authorize, and the authorization conditions such as the time when it can be used are determined. Then, the service administrator registers the authentication device 30 for authenticating the service content to be authorized and the user in the service providing device 20, and the administrator of the new contract organization or the administrator of the authentication device 30 (the authentication administrator). ) Sets authorization conditions such as the authority of the authorized user and the number of authorized users in the authentication device 30. In this way, by allowing the authentication device 30 to authorize the service of the service providing device 20, user authentication and service authorization can be integrated into the authentication device 30, and user management is facilitated. On the other hand, by causing the authentication device 30 to authorize the service of the service providing device 20, there is a possibility that fraud may occur in the authentication device 30 that deviates from the determined authorization condition and grants the service authorization to the user. There is. Therefore, in the present invention, the authorization information including the authorization conditions is generated on the service providing apparatus side, so that the service can be authorized to the user using the authorization information based on the authorization conditions.

  Further, in order to allow the authentication device 30 to authorize the service of the service providing device 20, it is necessary to add an attribute (such as a user authority) corresponding to the authorization condition to the user information held by the authentication device 30. When the authentication device 30 authorizes services of a plurality of service providing devices 20, an attribute corresponding to the authorization condition of each service providing device 20 is added to the user information. As described above, when the number of attributes increases each time the service providing apparatus 20 is added, management of user information becomes complicated. In the present invention, such a problem can be solved. This will be described in detail below.

  FIG. 2 is a functional block diagram showing an example of functions realized by the terminal device 10, the service providing device 20, and the authentication device 30 according to the present embodiment. As illustrated in FIG. 2, the terminal device 10 according to the present embodiment is functionally configured to include, for example, a use request unit 11 and an authentication request unit 12. These functions are realized by the control unit executing a program stored in the storage unit. This program is supplied to the terminal device 10 via a computer-readable information storage medium such as an optical disk, a magneto-optical disk, a magnetic tape, a magneto-optical disk, or a flash memory, or via communication means such as the Internet. .

  The service providing apparatus 20 according to the present embodiment functionally includes, for example, a request receiving unit 21, an authentication apparatus registration unit 22, an authorization information generation unit 23, an authorization information providing unit 24, a verification unit 25, and a usage authorization unit. 26, an authentication guide unit 27, an authentication device information table Tbl210, and an authorization information table Tbl220. Among these functions, the request reception unit, the authentication device registration unit 22, the authorization information generation unit 23, the authorization information provision unit 24, the verification unit 25, the usage authorization unit 26, and the authentication guidance unit 27 are stored in the storage unit 28. This is realized by the control unit executing the program. This program is supplied to the service providing apparatus 20 via a computer-readable information storage medium such as an optical disk, a magneto-optical disk, a magnetic tape, a magneto-optical disk, or a flash memory, or via communication means such as the Internet. The The authentication device information table Tbl210 and the authorization information table Tbl220 are realized by the storage unit 28.

  Also, the authentication device 30 according to the present embodiment functionally includes, for example, a request reception unit 31, an authorization information acquisition unit 32, a user information acquisition unit 33, an authorization information association unit 34, an authentication unit 35, and an authentication result. A transmission unit 36, a user information table Tbl310, and an association information table Tbl320 are included. Among these functions, the request reception unit 31, the authorization information acquisition unit 32, the user information acquisition unit 33, the authorization information association unit 34, the authentication unit 35, and the authentication result transmission unit 36 are programs stored in the storage unit 37. Is implemented by the control unit. This program is supplied to the authentication device 30 via a computer-readable information storage medium such as an optical disc, a magneto-optical disc, a magnetic tape, a magneto-optical disc, or a flash memory, or via communication means such as the Internet. . Also, the user information table Tbl310 and the association information table Tbl320 are realized by the storage unit 37.

  The use request unit 11 of the terminal device 10 transmits a service use request to the service providing device 20. For example, a service use request is transmitted when a user accesses a web service provided by the service providing apparatus 20 via a web application activated on the terminal device 10.

  The authentication request unit 12 of the terminal device 10 transmits a user authentication request to the authentication device 30 in accordance with the authentication guide transmitted from the authentication guide unit 27 of the service providing device 20. For example, when a user inputs authentication information on an authentication page presented by the authentication device 30, an authentication request is transmitted to the authentication device 30.

  The request receiving unit 21 of the service providing apparatus 20 receives a request input from the service manager and a request transmitted from the terminal device 10.

  The authentication device registration unit 22 of the service providing device 20 registers the authentication device 30 for authenticating a user who uses the service providing device 20 in response to a request from the service administrator. The authentication device information indicating the authentication device 30 requested to be registered by the service manager is registered by being stored in the authentication device information table Tbl210. For example, when a new organization makes a contract to use the service providing device 20, authentication device information indicating the authentication device 30 for authenticating an affiliation belonging to the contracted organization is stored in the authentication device information table Tbl210. The

  FIG. 3 is a diagram showing an example of the authentication device information table Tbl210 according to the present embodiment. As illustrated in FIG. 3, the authentication device information table Tbl210 is managed by associating identification information (service ID) for identifying a service provided by the service providing device 20 with authentication device information indicating the authentication device 30. The The authentication device information is, for example, an address for accessing the authentication device (for example, a URL indicating an authentication page that the authentication device 30 presents for the user to input authentication information).

  The authorization information generation unit 23 of the service providing apparatus 20 generates an authorization token (an example of authorization information) that is given to a user who authorizes the use of the service providing apparatus 20 in response to a request from the service administrator. An authorization token is a credential used to access a protected resource, and is a string representing an authorization issued to a client. For example, the service providing apparatus 20 may include information representing authorization conditions such as service contents authorized for use, authority of authorized users, the number of authorized users, and a service usage period. Further, the service providing apparatus 20 may store the authorization condition and the authorization token in association with each other, and control to permit use based on the authorization condition based on the correspondence relationship. The authorization token may be a non-overlapping character string (including a numeric string) generated by the service providing apparatus 20. For example, the service providing apparatus 20 may generate the authorization token as a random character string. The authorization token generated by the authorization information generation unit 23 is stored in the authorization information table Tbl220. For example, when a new organization makes a contract to use the service providing apparatus 20, the authorization information generating unit 23 of the service providing apparatus 20 generates an authorization token for the number of persons determined as the authorization condition. Alternatively, the authorization information generation unit 23 of the service providing apparatus 20 generates an authorization token for the affiliation belonging to the newly contracted organization. The generated authorization token includes information indicating an organization to which the authorization token is given (for example, identification information of the organization), a service ID for identifying a service contracted with the organization, that is, a service authorized to be used by the authorization token, The attribute information of the user to which the authorization token is given (for example, organization information indicating the organization to which the user belongs) is stored in the authorization information table Tbl220 in association with it.

  FIG. 4 is a diagram showing an example of the authorization information table Tbl220 according to the present embodiment. As shown in FIG. 4, the authorization information table Tbl220 includes, for each generated authorization token, organization information indicating the service ID of the service authorized to be used by the authorization token and the organization to which the user to whom the authorization token is assigned belongs. And are managed in association with each other.

  The authorization information providing unit 24 of the service providing apparatus 20 provides the authorization token generated by the authorization information generating unit 23 of the service providing apparatus 20 to the authentication apparatus 30. Here, the authorization information providing unit 24 of the service providing apparatus 20 associates the authorization token with information (service providing apparatus ID) for identifying the service providing apparatus 20 that generated the authorization token, and provides the information to the authentication apparatus 30. To do. This makes it possible to specify the provider of the authorization token.

  The verification unit 25 of the service providing apparatus 20 verifies whether the service use request received by the request receiving unit 21 of the service providing apparatus 20 includes the authorization token generated by the authorization information generating unit 23 of the service providing apparatus 20. .

  The use authorization unit 26 of the service providing apparatus 20 transmits the service use request when the authorization token generated by the service providing apparatus 20 is included in the use request as a result of the verification by the verification unit 25 of the service providing apparatus 20. Authorize users to use the service. Specifically, use of the service indicated by the service ID associated with the authorization token in the authorization information table Tbl220 is authorized.

  The authentication guide unit 27 of the service providing apparatus 20 authenticates the user when the service token is not included in the service use request as a result of the verification by the verification unit 25 of the service providing apparatus 20. The authentication guidance for performing it is transmitted to the terminal device 10. In the present embodiment, the authentication guide unit 27 of the service providing device 20 transmits the authentication device information stored in the authentication device information table Tbl210 to the terminal device 10.

  The request receiving unit 31 of the authentication device 30 receives a request from an authentication manager and an authentication request transmitted from the authentication requesting unit 12 of the terminal device 10.

  The authorization information acquisition unit 32 of the authentication device 30 acquires the authorization token provided by the authorization information provision unit 24 of the service providing device 20.

  The user information acquisition unit 33 of the authentication device 30 is a user user who grants the authorization token acquired by the authorization information acquisition unit 32 from the user information table Tbl310 stored in advance in the storage unit 37 of the authentication device 30. Get information.

  FIG. 5 is a diagram showing an example of the user information table Tbl310 according to the present embodiment. As shown in FIG. 5, the user information table Tbl310 is associated with a user identifier for identifying a user, authentication information for authenticating the user, and user attribute information indicating a user attribute. It is managed. The user identifier and the authentication information are information specific to the user to be authenticated, may be information registered by the user, or may be information issued by the authentication device 30 to the user. . Further, the authentication information may be, for example, a password composed of a character string, or information indicating biometric features such as a face, a fingerprint, and a vein. Since such a user information table Tbl310 is stored, the authentication unit 35 of the authentication device 30 described later has a user identifier (user ID) and authentication information (password) included in the authentication request. By verifying whether the user identifier managed in the information table Tbl310 matches the authentication information, it is possible to authenticate whether the person who made the authentication request is the user identified by the user identifier. . The user attribute information may be information such as the user's name, the organization to which the user attribute belongs, and the user's email address.

  In accordance with the authorization information registration request from the authentication manager, the authorization information associating unit 34 of the authentication device 30 includes the authorization token acquired by the authorization information acquisition unit 32 of the authentication device 30 and the user information acquisition unit 33 of the authentication device 30. The acquired user information (for example, a user identifier for identifying the user) is associated and stored in the association information table Tbl320. For example, the authentication administrator is an administrator of an organization contracted with the service providing apparatus 20, and the authentication administrator appropriately selects a user who authorizes use of the service from a member belonging to the organization and gives an authorization token. can do.

  FIG. 6 is a diagram illustrating an example of the association information table Tbl 320 according to the present embodiment. As shown in FIG. 6, the association information table Tbl 320 includes, for each provided authorization token, a service providing device ID provided in association with the authorization token and a user identifier of the user to whom the authorization token is assigned. Correspondingly managed. In this way, in the association information table Tbl320, only the number of users corresponding to the number of authorization tokens provided from the service providing apparatus 20 is managed, and the authentication apparatus 30 allows the user to authorize the use of the service without limit. You can avoid being given. Also, by managing the authorization token, service providing apparatus ID, and user identifier in association with each other in the association information table Tbl320, user attribute information for authorization of service use is stored in the user information table Tbl310. There is no need to add. Further, even when the authentication device 30 manages the authorization tokens provided from a plurality of different service providing devices 20, since the providing source of the authorization token can be specified by the service providing device ID, the association information table Tbl320 shown in FIG. It becomes possible to manage similarly.

  The authentication unit 35 of the authentication device 30 performs user authentication in response to the authentication request received by the request reception unit of the terminal device 10. The authentication unit 35 of the authentication device 30 verifies whether the user identifier and the authentication information included in the authentication request match the user identifier and authentication information managed in the user information table Tbl310. Authenticate.

  The authentication result information transmission unit of the authentication device 30 transmits the result of authentication by the authentication unit 35 of the authentication device 30. When authentication by the authentication unit 35 of the authentication device 30 is successful, the authentication result information transmission unit of the authentication device 30 displays the association information associated with the user who has been successfully authenticated in the association information table Tbl320. Transmit to device 10. When the authentication by the authentication unit 35 of the authentication device 30 fails, the authentication result information transmission unit of the authentication device 30 transmits authentication error information indicating that the authentication has failed to the terminal device 10. The error information may include the user identifier of the user who has failed authentication.

[Pre-registration process]
Here, a pre-registration process executed by the service providing device 20 and the authentication device 30 when a new user makes a contract to use the service providing device 20 will be described. Here, the new user (new user) is a plurality of members belonging to an organization such as a company or a department, but may be an individual user.

  First, an example of authentication device registration processing executed by the service providing device 20 according to the present embodiment will be described with reference to the flowchart of FIG.

  When a usage contract is made between the new user and the service providing apparatus 20, and the service manager operates the service providing apparatus 20 to make an authentication apparatus registration request, the request receiving unit 21 of the service providing apparatus 20 causes the authentication apparatus to A registration request is accepted (S101). Here, the service administrator makes an authentication device registration request including information on the authentication device 30 that can authenticate a new user and a service ID indicating the contracted service to the service providing device 20. The information of the authentication device 30 is, for example, a URL indicating an authentication page that accepts a user authentication request provided by the authentication device 30.

  When the request receiving unit 21 of the service providing device 20 receives the authentication device registration request, the authentication device registering unit 22 of the service providing device 20 authenticates the information and the service ID of the authentication device 30 included in the authentication device registration request. Registration is performed in the device information table Tbl210 (S201), and the authentication device information registration process is terminated. For example, the authentication device registration unit 22 of the service providing device 20 associates the authentication device identification information (authentication device ID) with the authentication device information included in the request of S101 and the service ID in the authentication device information table Tbl210. sign up.

  Next, an example of the authorization information generation process executed by the service providing apparatus 20 according to the present embodiment and the authorization information association process executed by the authentication apparatus 30 will be described with reference to the flowchart of FIG.

  First, when a usage contract is made between a new user and the service providing apparatus 20, and the service manager operates the service providing apparatus 20 to make an authorization information generation request, the request receiving unit 21 of the service providing apparatus 20 receives the authorization information. A generation request is accepted (S201). Here, the service administrator makes an authorization information generation request including number information indicating the number of authorization tokens to be generated. The number of authorization tokens to be generated is, for example, the number of new users, and is determined by an agreement between the new user and the service manager when a usage contract is made between the new user and the service providing apparatus 20. It may be the number.

  The authorization information generation unit 23 of the service providing device 20 generates the number of authorization tokens indicated by the number information included in the authorization information generation request (S202). Each generated authorization token is associated with a service ID of a service authorized to be used by the authorization token and, for example, organization information indicating an organization to which the user to whom the authorization token is assigned belongs. It is stored in Tbl 220 (S203).

  When all the generated authorization tokens are stored in the authorization information table Tbl220, the authorization information providing unit 24 of the service providing apparatus 20 includes an authorization token and a service providing apparatus ID that identifies the service providing apparatus 20 that has generated the authorization token. The authorization information list, which is a list of associations, is transmitted to the terminal device 30 (S204). The authorization information providing unit 24 of the service providing apparatus 20 transmits the authorization information list to the authentication apparatus 30 indicated by the authentication apparatus information stored in the authentication apparatus information table Tbl210. For example, the authorization information providing unit 24 of the service providing apparatus 20 may transmit the authorization information table Tbl220 and the service providing apparatus ID shown in FIG. 4 to the authentication apparatus 30 as the above authorization information list.

  The authorization information acquisition unit 32 of the authentication device 30 acquires the authorization information list transmitted from the authorization information provision unit 24 of the service providing device 20 (S205).

  Next, the user information acquisition unit 33 of the authentication device 30 acquires the user information of the user to whom the authorization token is given from the user information table Tbl310 (S206). For example, the user information acquisition unit 33 of the authentication device 30 may acquire a user identifier included in the user information table Tbl310. Here, it is assumed that the authentication manager operates the authentication device 30 to search the user information table Tbl310 for the user identifier of the user to whom the authorization token is given. Then, the user information acquisition unit 33 of the authentication device 30 acquires the user identifier searched by the authentication manager. Note that the user information acquisition unit 33 of the authentication device 30 may acquire the user identifier input by the authentication manager.

  Subsequently, when the authentication manager operates the authentication device 30 to make an authorization token registration request, the request accepting unit 31 of the authentication device 30 accepts an authorization information registration request (S207). Here, the authentication manager makes an authorization information registration request including an authorization information list (authorization token and service providing apparatus ID) and a user identifier of the user to whom the authorization token is granted. Here, the authentication manager may identify the user associated with the authorization information based on, for example, an identifier, a user name associated with the identifier, user organization information associated with the identifier, and the like. Conceivable. The authentication administrator may specify authorization tokens included in the authorization information list one by one and make an authorization information registration request, or a user identifier that grants an authorization token to all authorization tokens included in the authorization information list The authorization information registration request may be made in a lump after associating with.

  When the request accepting unit 31 of the authentication device 30 accepts the authorization information registration request, the authorization information associating unit 34 of the authentication device 30 receives the authorization token, the service providing device ID, and the user identifier included in the authorization information registration request. Correlate (S208). Then, the association information in which the authorization token, the service providing device ID, and the user identifier are associated is stored in the association information table Tbl320 (S209). When all the authorization tokens included in the authorization information list are stored in the association information table Tbl320, the authorization information generation process and the authorization information registration process are completed.

[Service authorization process]
Next, an example of service use authorization processing executed by the service providing apparatus 20 and the authentication apparatus 30 according to the present embodiment will be described with reference to the flowchart of FIG. Here, the service use authorization process when the user uses the service providing apparatus 20 after the pre-registration process is executed will be described.

  First, the use request unit 11 of the terminal device 10 makes a service use request to the service providing device 20 in accordance with a user instruction (S301).

  When the request receiving unit 21 of the service providing apparatus 20 receives the service use request, the verifying unit 25 of the service providing apparatus 20 verifies whether the service use request includes the authorization token generated by the service providing apparatus 20. (S302). For example, the verification unit 25 of the service providing apparatus 20 performs the above verification based on whether or not the authorization token included in the service use request is included in the authorization information table Tbl220 illustrated in FIG.

  As a result of verification by the verification unit 25 of the service providing apparatus 20, if the service use request includes the authorization token generated by the service providing apparatus 20 (S303: Y), the use authorization unit 26 of the service providing apparatus 20 performs the service. A response authorizing the use of the service is transmitted to the terminal device 10 that has transmitted the use request (S304). Specifically, the use authorization unit 26 of the service providing apparatus 20 authorizes the use of the service indicated by the service ID associated with the authorization token included in the service use request in the authorization information table Tbl220. A user who is authorized by the use authorization unit 26 of the service providing apparatus 20 can use the service.

  As a result of the verification by the verification unit 25 of the service providing apparatus 20, if the service use request does not include an authorization token (S303: N), the authentication providing unit 27 of the service providing apparatus is for authenticating the user. A response including authentication guidance is transmitted to the terminal device 10 (S305). Specifically, the authentication guide unit 27 of the service providing device 20 transmits a response including the authentication device information stored in the authentication device information table Tbl210 to the terminal device 10.

  When the terminal device 10 receives the response including the authentication device information, the authentication request unit 12 of the terminal device 10 makes an authentication request to the authentication device 30 indicated by the authentication device information (S306). For example, the terminal device 10 accesses the URL of the authentication page indicated by the authentication device information, and causes the user to input a user identifier and authentication information. Then, the authentication request unit 12 of the terminal device 10 transmits an authentication request including the user identifier and authentication information input by the user on the authentication page to the authentication device 30. The authentication request unit 12 of the terminal device 10 may transmit the user identifier and authentication information input by the user to the authentication device 30 as they are, but after converting them using a hash function or the like, the authentication device 30 May be sent to.

  When the request reception unit 31 of the authentication device 30 receives the authentication request, the authentication unit 35 of the authentication device 30 authenticates the user based on the user identifier and the authentication information included in the authentication request (S307). Here, the authentication unit 35 of the authentication device 30 verifies whether the user identifier and the authentication information included in the authentication request match the user identifier and the authentication information managed in the user information table Tbl310. Authenticate users with. If the user identifier and the authentication information included in the authentication request match the user identifier and the authentication information managed in the user information table Tbl310, the authentication is successful, and the user identifier and the authentication included in the authentication request are authenticated. If the information does not match the user identifier managed in the user information table Tbl310 and the authentication information, the authentication is failed.

  When the authentication unit 35 of the authentication device 30 successfully authenticates the user, the authentication result transmission unit 36 of the authentication device 30 is associated with the user identifier of the user who has been successfully authenticated from the association information table Tbl320. The attached information is acquired and transmitted as an authentication result to the terminal device 10 (S308). Here, although the authorization token, the user identifier, and the service providing apparatus ID are included as the authentication result, it is sufficient that at least the authorization token and the service providing apparatus ID are included. If the authentication unit 35 of the authentication device 30 fails to authenticate the user, the authentication result information transmission unit of the authentication device 30 transmits authentication error information indicating that the authentication has failed to the terminal device 10. To do.

  Then, the use request unit 11 of the terminal device 10 transfers the authentication result received from the authentication device 30 to the service providing device 20 indicated by the service providing device ID included in the authentication result, whereby the service providing device 20 uses the service. A request is made (S309). Here, the usage request unit 11 of the terminal device 10 includes the authorization token given to the user by transferring the association information, which is the authentication result when the user authentication is successful, to the service providing device 20. A service use request is made.

  When the request accepting unit 21 of the service providing apparatus 20 accepts the service use request, the process after the process S302 is executed.

[Modification]
The present invention is not limited to the above embodiment.

  First, in the authorization information table Tbl220 in which the authorization token generated by the authorization information generating unit 23 of the service providing apparatus 20 is stored, each authorization token further includes an invalid flag that can set invalidity or validity of the authorization token, and the authorization The contact information of the user who is provided with the token may be associated.

  FIG. 10 is a diagram illustrating an example of the authorization information table Tbl220 associated with the invalid flag according to the present embodiment. As shown in FIG. 10, the authorization information table Tbl220 is managed by associating a service ID, user attribute information, an invalid flag, and a contact address for each generated authorization token. The invalid flag is set with an invalid flag indicating “0” or “1”. For example, “1” is set when the authorization token is invalidated, and “0” is set when the authorization token is validated. It will be done. The contact address is a destination for notifying that the value of the invalid flag associated with the authorization token has been updated, and may be, for example, an email address, a telephone number, an address, or the like.

  In this case, the verification unit 25 of the service providing apparatus 20 refers to the authorization information table Tbl220 to verify whether the authorization token included in the service use request has been invalidated. As a result of verification by the verification unit 25 of the service providing apparatus 20, if the authorization token is invalidated, the use of the service is not authorized. As described above, when the contract between the user and the service providing apparatus 20 is terminated, the use of the service can be stopped only by invalidating the authorization token provided to the user. Then, when the same user makes a contract again, the use of the service can be resumed by enabling the authorization token without generating a new authorization token.

  The invalid flag can also be set for each service ID and each user attribute information. For example, when it is desired to stop using the service for each organization, an invalid flag corresponding to predetermined organization information may be set to invalid. If it is desired to stop the use for each service content, the invalid flag corresponding to the predetermined service ID may be set invalid.

  Further, in the authorization information table Tbl220, by associating the contact information of the user who is provided with the authorization token, when the authorization token is invalidated, it is possible to notify the user that the authorization token has been invalidated. it can. It is possible to associate the contact information for each organization. If the contact information of the organization manager is associated with each organization, when the use of the service is stopped for each organization, only the organization administrator needs to be contacted.

  Next, the usage history of the authorization token may be managed in the service providing apparatus 20. Specifically, every time the verification unit 25 of the service providing apparatus 20 performs verification according to the service usage request, the verification result is stored in the authorization information usage history table.

  FIG. 11 is a diagram showing an example of the authorization information use history table Tbl400 according to the present embodiment. As shown in FIG. 11, the authorization information use history table Tbl400 is managed in association with a history ID, an authorization token, a user identifier, a time, and a verification result. The history ID is an identifier given each time the verification unit 25 of the service providing apparatus 20 performs verification. In the authorization token, the authorization token included in the service use request (or the authentication result transmitted by the authentication result transmission unit 36 of the authentication device 30) is stored. The user identifier stores the user identifier included in the service use request (or the authentication result transmitted by the authentication result transmitting unit 36 of the authentication device 30). The time stores the time when the verification unit 25 of the service providing apparatus 20 performs the verification. In the verification result, the result of verification by the verification unit 25 of the service providing apparatus 20 is stored. Here, information indicating approval or disapproval of use of the service is stored.

  Using the authorization information use history table Tbl400 as shown in FIG. 11, the service providing apparatus 20 can detect unauthorized use of the authorization token. Specifically, the service providing apparatus 20 defines a prescribed number (or upper limit number) of 2 or more for the number of users associated with the authorization token, and the same authorization token is used by more than the prescribed number of different users. If this happens, fraud will be detected. As a result, fraud is detected when the authentication manager assigns the authorization token provided from the service providing apparatus 20 to a predetermined number or more of users. When such fraud is detected, the authorization token cannot be used by invalidating the invalid flag of the authorization token. If fraud is detected when different users use the same authorization token, only one user can use one authorization token.

  Further, the user information table Tbl310 and the authentication unit 35 of the authentication device 30 may be configured as other external authentication devices. Thereby, it is possible to separate user management for each organization contracted with the service providing apparatus 20 and user management for general-purpose user authentication.

  Further, the authorization generation unit and the verification unit 25 of the service providing device 20 may be configured by other external devices. Thereby, the processing burden of the service providing apparatus 20 can be reduced.

  DESCRIPTION OF SYMBOLS 1 Authentication system, 10 Terminal device, 11 Usage request part, 12 Authentication request part, 20 Service provision apparatus, 21,31 Request reception part, 22 Authentication apparatus registration part, 23 Authorization information generation part, 24 Authorization information provision part, 25 Verification Unit, 26 usage authorization unit, 27 authentication guidance unit, 28 storage unit, 30 authentication device, 32 authorization information acquisition unit, 33 user information acquisition unit, 34 authorization information association unit, 35 authentication unit, 36 authentication result transmission unit, 37 storage unit, Tbl210 authentication device information table, Tbl220 authorization information table, Tbl310 user information table, Tbl320 association information table, Tbl400 authorization information use history table.

Claims (15)

An authentication system including a service providing device and an authentication device,
The service providing apparatus includes:
Generating means for generating authorization information used to authorize use of the service provided by the service providing device;
Authorization information providing means for providing the generated authorization information to the authentication device;
When receiving a request not including the authorization information from a user of the service providing apparatus, guiding means for guiding the user to perform authentication in the authentication apparatus;
An authorization unit that authorizes the user to use the service when a request including the authorization information is received from the user, and
The authentication device
Means for storing the authorization information provided by the authorization information providing means in a storage means in association with the user;
Means for authenticating a user guided by the guiding means;
Authorization information transmitting means for transmitting the authorization information stored in the storage means in association with the authenticated user to the user;
An authentication system comprising: The service providing apparatus includes:
A means for storing the generated authorization information in association with an authorization condition related to a service provided by the service providing apparatus;
The authentication system according to claim 1, wherein: The authorization information includes information related to authorization conditions related to services provided by the service providing device,
The authentication system according to claim 1, wherein: The authorization condition includes at least one of the content of the service that the service providing device authorizes use, the authority of the user to authorize, and the available period.
The authentication system according to claim 2, wherein the authentication system is characterized in that The service providing apparatus includes:
Setting means for setting validity or invalidity of the authorization information provided by the authorization information providing means;
The authentication system according to any one of claims 1 to 4, further comprising: When the authorization information transmitted by the authorization information transmission unit is included in the request received from the user and the authorization information is set to invalid, the authorization unit provides the service to the user. Does not authorize the use of
The authentication system according to claim 5. The service providing apparatus includes:
Means for storing an authorization history of use of the service by the authorization means in a storage means;
Fraud detection means for detecting unauthorized use of the authorization information according to the authorization history;
The authentication system according to any one of claims 1 to 6, further comprising: The service providing apparatus includes:
Means for storing an authorization history of use of the service by the authorization means in a storage means;
Fraud detection means for detecting unauthorized use of the authorization information according to the authorization history;
Setting means for setting validity or invalidity of the authorization information provided by the authorization information providing means;
Further including
When the fraud detection unit detects the unauthorized use, the setting unit sets the authorization information in which the unauthorized use is detected to be invalid.
The authentication system according to any one of claims 1 to 4, wherein: When the authorization information transmitted by the authorization information transmission unit is included in the request received from the user and the authorization information is set to invalid, the authorization unit provides the service to the user. Does not authorize the use of
The authentication system according to claim 8. The fraud detection means detects the fraudulent use when a request including the same authorization information is received from a predetermined number of different users or more.
The authentication system according to any one of claims 7 to 9, wherein A service providing device connected to the authentication device,
Generating means for generating authorization information used to authorize use of the service provided by the service providing device;
Authorization information providing means for providing the generated authorization information to the authentication device;
When receiving a request not including the authorization information from a user of the service providing apparatus, guiding means for guiding the user to perform authentication in the authentication apparatus;
An authorization means for authorizing the use of the service to the user when a request including the authorization information is received from the user;
A service providing apparatus comprising: A service providing device connected to the authentication device,
Generating means for generating authorization information used to authorize use of the service provided by the service providing device;
Authorization information providing means for providing the generated authorization information to the authentication device;
Guidance means for guiding the user to perform authentication in the authentication device when a request not including the authorization information is received from a user of the service providing device ;
An authorization means for authorizing the user to use the service when receiving a request including the authorization information from the user;
Program to function as. An authentication device connected to a service providing device,
Means for storing authorization information used for authorization of use of a service provided by the service providing apparatus in a storage means in association with a user;
Means for authenticating a user who has been guided to perform authentication in the authentication device by the service providing device that has received a request not including the authorization information from the user;
Authorization information transmitting means for transmitting the authorization information stored in the storage means in association with the authenticated user to the user;
An authentication device comprising: An authentication device connected to the service providing device
Means for storing authorization information used for authorization of use of a service provided by the service providing apparatus in a storage means in association with a user;
Means for authenticating a user who has been guided to perform authentication in the authentication device by the service providing device that has received a request not including the authorization information from the user;
Authorization information transmitting means for transmitting the authorization information stored in the storage means in association with the authenticated user to the user;
Program to function as. An authentication method implemented in an authentication system including a service providing device and an authentication device,
Generating authorization information used to authorize use of the service provided by the service providing apparatus by the service providing apparatus;
Providing the generated authorization information to the authentication device by the service providing device;
Storing the authorization information provided by the authentication device in association with a user of the service providing device ;
When receiving a request not including the authorization information from the user by the service providing device, guiding the user to perform authentication in the authentication device;
Authenticating the guided user with the authentication device;
Sending authorization information stored in association with the authenticated user to the user by the authentication device;
When the request received from the user by the service providing apparatus includes authorization information provided from the authentication apparatus, authorizing the user to use the service;
An authentication method that includes:

Images