JP4357165B2 - Service provision system based on network connection authentication - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a single sign-on service and system that allow a user to omit authentication for connection to various service servers if authentication for Internet connection, which is essential when connecting to the Internet, is performed.
[0002]
[Prior art]
A service providing system based on the prior art is shown in FIG. The gateway 7 is placed at a connection point for the user terminal 2 to connect to the Internet 1 and performs processing for the network authentication 51 for Internet connection authentication from the user terminal 2. If the authentication is successful, the gateway 7 subsequently forwards packets sent from the user terminal 2 to the Internet 1 and sends packets sent to the user terminal 2 from other terminals or servers connected to the Internet 1 to the user terminal 2. Forward to. The service servers 4, 5 and 6 store various service information, and the user acquires desired service information from each service server through the user terminal 2. With respect to service information provided only to members, the user authenticates at the authentication confirmation server 103, and the service information can be acquired based on the successful authentication. At this time, the user originally needs to authenticate each of the service servers 4, 5, and 6. However, in recent years, once the authentication confirmation server 103 is authenticated by the technique of single sign-on, the service servers 4, 5, and 5 are authenticated. And it became possible to omit authentication every 6th. This eliminates the need for the user to memorize a plurality of authentication passwords for each service server, and allows only one password entry that is required every time service information is acquired.
[0003]
Below, the operation | movement outline | summary of the conventional single sign-on technique is demonstrated. When the above-described network authentication 51 is successful, the user terminal 2 performs authentication 153 with respect to the authentication confirmation server 103. Authentication includes, for example, verification of a user's account name and password. When the authentication confirmation server 103 receives the account name and password from the user terminal 2, the authentication confirmation server 103 compares it with the registered account name and password. If the authentication is successful, the authentication confirmation server 103 returns an authentication response 154 to the user terminal 2. Thereafter, the user terminal 2 sends a service request 155 to the service server 4 when the service information is desired to be received by the service server 4, for example. When the service server 4 receives the service request 155, the service server 4 transmits an authentication confirmation 156 to the authentication confirmation server 103. The authentication confirmation 156 means that the authentication confirmation server 103 centrally manages whether or not the user has been authenticated, and each service server performs authentication confirmation 156 on the authentication confirmation server 103 to determine whether or not the user has been authenticated. It is because it can know. Upon receiving the authentication confirmation 156, the authentication confirmation server 103 returns an authenticated notification 157 to the service server 4 because the user terminal 2 has already been authenticated. When it is confirmed that the service server 4 has been authenticated, the service server 4 sends the requested service information to the user terminal 2. Further, when the user terminal 2 wants to receive service information from the service server 5 thereafter, the exchange of the service request 155 and the service information 158 between the user terminal 2 and the service server 5 as described above is performed by the authentication confirmation server. An authentication confirmation 156 and an authenticated notification 157 are exchanged between the server 103 and the service server 5.
If the user terminal 2 sends a service request 155 to the service server 4 without performing the authentication 153 with respect to the authentication confirmation server 103, the authentication confirmation server 103 responds to the authentication confirmation 156 as an unauthenticated process. The notification 157 is returned to the service server 4. As a result, the service server 4 does not send service information to the user terminal 2.
[0004]
Non-patent document 1, for example, is a document that describes the conventional single sign-on technology.
[0005]
[Non-Patent Document 1]
Liberty Alliance Project, "Liberty Bindings and Profiles Specification, Version 1.0", 11 July 2002, [Search October 3, 2002], Internet <http://www.projectliberty.org/specs/liberty-architecture-bindings- and-profiles-v1.0.pdf>
[0006]
[Problems to be solved by the invention]
All the above operation sequences except for the network authentication 51 are performed using, for example, HTTP in the conventional technique. HTTP is located in an upper layer of IP (Internet Protocol) and TCP (Transmission Control Protocol). That is, the above-described authentication is also a process performed at a higher layer than IP, and is usually distinguished from network authentication 51 such as PPP (Point to Point Protocol) authentication that is required at the start of Internet connection. As a result, the user terminal 2 needs to perform two types of authentication: network authentication and conventional single sign-on authentication.
[0007]
[Means for Solving the Problems]
The purpose of this application is to unify the two types of authentication into one authentication, that is, to realize single sign-on by network authentication at the start of Internet connection. This solving means will be described below with reference to FIG.
[0008]
The gateway 7 is placed at a connection point for the user terminal 2 to connect to the Internet 1, and performs processing for the network authentication 51 for Internet connection authentication from the user terminal 2. If the authentication is successful, the gateway 7 subsequently forwards packets sent from the user terminal 2 to the Internet 1 and sends packets sent to the user terminal 2 from other terminals or servers connected to the Internet 1 to the user terminal 2. Forward to.
[0009]
The gateway 7 transfers the network authentication result 52 which is the authentication result in the network authentication 51 to the authentication confirmation server 3. When the network authentication result 52 is successful, the authentication confirmation server 3 centrally manages that the user who has authenticated through the user terminal 2 has been authenticated.
[0010]
Thereafter, the user terminal 2 sends a service request 55 to the service server 4 when the service information is desired to be received by the service server 4, for example. When the service server 4 receives the service request 55, the service server 4 transmits an authentication confirmation 56 to the authentication confirmation server 3. Upon receiving the authentication confirmation 56, the authentication confirmation server 3 returns an authenticated notification 57 to the service server 4 because the user terminal 2 has already been authenticated. When it is confirmed that the service server 4 has been authenticated, the service server 4 sends the requested service information to the user terminal 2.
[0011]
Further, when the user terminal 2 wants to receive service information from the service server 5 thereafter, the exchange of the service request 55 and the service information 58 between the user terminal 2 and the service server 5 as described above is performed by the authentication confirmation server. 3 and the service server 5 exchange authentication confirmation 56 and authenticated notification 57.
[0012]
That is, this means realizes single sign-on with only one authentication of the network authentication 51 while maintaining the same operation as that of the prior art for the service server.
[0013]
DETAILED DESCRIPTION OF THE INVENTION
A service providing system based on an embodiment of the present invention is shown in FIG.
[0014]
The gateway 7 is placed at a connection point for the user terminal 2 to connect to the Internet 1 and performs processing for the network authentication 51 for Internet connection authentication from the user terminal 2. If the authentication is successful, the gateway 7 subsequently forwards packets sent from the user terminal 2 to the Internet 1 and sends packets sent to the user terminal 2 from other terminals or servers connected to the Internet 1 to the user terminal 2. Forward to.
[0015]
The gateway 7 transfers the network authentication result 52 which is the authentication result in the network authentication 51 to the authentication confirmation server 3. When the network authentication result 52 is successful, the authentication confirmation server 3 centrally manages that the user who has authenticated through the user terminal 2 has been authenticated.
[0016]
Here, the network authentication result 52 is transferred from the gateway 7 to the authentication confirmation server 3 only when the authentication is successful, whereby the authentication confirmation server 3 confirms that the user who has authenticated through the user terminal 2 has been authenticated. A centralized management method may be used.
[0017]
Thereafter, the user terminal 2 sends a service request 55 to the service server 4 when the service information is desired to be received by the service server 4, for example. When the service server 4 receives the service request 55, the service server 4 transmits an authentication confirmation 56 to the authentication confirmation server 3. Upon receiving the authentication confirmation 56, the authentication confirmation server 3 returns an authenticated notification 57 to the service server 4 because the user terminal 2 has already been authenticated. When it is confirmed that the service server 4 has been authenticated, the service server 4 sends the requested service information to the user terminal 2.
[0018]
Further, when the user terminal 2 wants to receive service information from the service server 5 thereafter, the exchange of the service request 55 and the service information 58 between the user terminal 2 and the service server 5 as described above is performed by the authentication confirmation server. An authentication confirmation 56 and an authenticated notification 57 are exchanged between the server 103 and the service server 5.
[0019]
Here, the operation when the user terminal 2 makes a service request from the service server 6 when the user terminal 2 is originally not permitted to connect to the service server 6 will be described. The authentication confirmation server 3 manages service servers 4 and 5 as service servers to which the user terminal 2 may connect. When the authentication confirmation server 3 receives an authentication confirmation sent from the service server 6 in response to a service request from the user terminal 2, the user terminal 2 is not permitted to connect to the service server 6, so the authentication confirmation server 3 The server 6 is notified that the authentication has not been processed. As a result, it is possible to prevent the user terminal 2 outside the contract from obtaining service information from the service server 6 illegally.
[0020]
Next, processing when each service information acquired by the user terminal 2 is charged and this authentication management is performed by the authentication confirmation server 3 will be described with reference to FIG. After the service information 58 is sent from the service server 4 to the user terminal 2, the service server 4 transmits service information acquisition history information 61 to the authentication confirmation server 3. Upon receiving this, the authentication confirmation server 3 manages that the user using the user terminal 2 has acquired the service information 58 in the internal history information management unit 12 shown in FIG. Further, the billing information management unit 13 manages fee information imposed when the user acquires service information. Further, the authentication confirmation server 3 returns a history information reception notification 62 to the service server 4 in order to notify that the service information acquisition history information 61 has been received.
[0021]
Note that the authentication confirmation server 3 may include a charging agent server that collects charges for the user based on the fee information, instead of the service server or the service provider holding the service information.
[0022]
Further, it is added that the present embodiment does not depart from the present embodiment even when the authentication confirmation server 3 and the gateway 7 are integrated, or when the authentication confirmation server 3 and the service servers 4 to 6 are integrated.
[0023]
In the present embodiment, the network authentication 51 is RADIUS authentication, the service request 55, the authentication confirmation 56, the authenticated or unauthenticated notification 57, the service information 58, the service information acquisition history information 61, and the history information reception notification 62. Can also be applied to the case of transferring by HTTP, and can also be applied to a technique that is currently in practical use.
[0024]
In addition to the above-described operation sequence, as shown in FIG. 5, in the conventional technique, a confirmation 53 and a confirmation response 54 may be exchanged between the user terminal 2 and the authentication confirmation server 3. Also in this case, the positioning of the network authentication 52 and the outline of the operation are the same as described above, and the present invention can be applied regardless of the presence or absence of the confirmation 53 and the confirmation response 54.
[0025]
In the above description, the network authentication 51 has been described as authentication for specifying the user who uses the user terminal 2, but the operation outline is basically basic for authentication for specifying the user terminal 2 itself. I added that it does not change to.
[0026]
Furthermore, the present invention provides
(1) The service provider that owns the authentication confirmation server is different from the service provider that owns the service server,
(2) A form in which the service provider that owns the gateway and the service provider that owns the service server are different,
(3) The service provider that owns the authentication confirmation server and gateway is different from the service provider that owns the service server, and
(4) A form in which the service provider that owns the authentication confirmation server, the gateway, and the network constituting the Internet is different from the service provider that owns the service server,
(5) A form in which the service provider that owns the authentication confirmation server is different from the service provider that owns the gateway,
Needless to say, the present invention can also be applied.
[0027]
Although the invention made by the present inventor has been specifically described based on the above-described embodiment, the present invention is not limited to the above-described embodiment, and various modifications can be made without departing from the scope of the invention. Of course.
[0028]
【The invention's effect】
The service providing system of the present invention realizes single sign-on with only one authentication of the network authentication 51. In addition, since the sequence between the service server and the authentication confirmation server and the sequence between the service server and the user terminal according to the present invention are the same as those in the prior art, a change of the service server accompanies the transition from the prior art to the present technology. There are no advantages.
[Brief description of the drawings]
FIG. 1 is a diagram showing a service providing system according to an embodiment of the present invention.
FIG. 2 is a diagram showing a service providing system based on a conventional technique.
FIG. 3 is a diagram showing billing management processing according to the embodiment of the present invention.
FIG. 4 is a diagram showing an internal structure of an authentication confirmation server according to the embodiment of this invention.
FIG. 5 is a diagram showing a service providing system when communication is performed between a user terminal and an authentication confirmation server according to an embodiment of the present invention.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 ... Internet, 2 ... User terminal, 3, 103 ... Authentication confirmation server, 4-6 ... Service server, 7 ... Gateway, 11 ... Authentication status management part, 12 ... History information management part, 13 ... Billing information management part, 52 ... network authentication result, 53 ... confirmation, 54 ... confirmation response, 55, 155 ... service request, 56, 156 ... authentication confirmation, 57, 157 ... authenticated or unauthenticated notification, 58, 158 ... service information, 61 ... Service information acquisition history information, 62 ... History information reception notification, 153 ... Authentication, 154 ... Authentication response.

Claims (10)

The user terminal is placed at the connection point for connecting to the Internet,
It means for performing a network authentication for the user terminal is connected to the Internet,
Means for permitting transfer of a packet transmitted from the user terminal to the Internet when network authentication of the user terminal is successful ;
A gateway comprising:
Receiving said service from a user terminal via the Internet request packet, and one or more service servers comprise means for returning the service information packet which carries the service information via the Internet to the user terminal as a response,
Means for receiving the network authentication result from the gateway via the Internet ;
An authentication confirmation for confirming whether the user terminal has already been network- authenticated is received from the service server via the Internet , and if the network authentication result is successful as a response, the service server is authenticated to the service server notified through the Internet that, if the network authentication result is unsuccessful, means for notifying via the Internet as an authentication untreated to the service server,
An authentication confirmation server comprising :
With
An authentication confirmation for confirming whether or not the user terminal has already been authenticated from the service server, and the response is HTTP (Hypertext Transfer Protocol) .   The service providing system according to claim 1, wherein the network authentication result is transferred from the gateway only when the authentication is successful, and the authentication confirmation server receives the network authentication result. The authentication confirmation server
Manage service servers to which each user or each user terminal can connect, or service information that each user or each user terminal can acquire,
An authentication confirmation for confirming whether the user terminal has already been authenticated is received from the service server, and when the network authentication result is successful, the user terminal may connect to the service server or obtain service information If the user terminal is not permitted to connect to the service server or is not permitted to obtain service information, the service server is notified that the service server has been authenticated. 3. The service providing system according to claim 1, further comprising means for notifying the service server that authentication has not been performed.   When the service server is notified that the authentication is confirmed by the authentication confirmation server, the service server returns a service information packet to the user terminal, and when the authentication confirmation server is notified that the authentication is not processed. 4. The service providing system according to claim 1, wherein the service information packet is refused to be transferred to the user terminal.   5. The service providing system according to claim 1, wherein the network authentication for connecting the user terminal to the network is authentication for specifying a user who uses the user terminal.   5. The service providing system according to claim 1, wherein the network authentication for connecting the user terminal to a network is authentication for specifying the user terminal. The service server comprises means for notifying the authentication confirmation server that the service information has been transferred to the user terminal when the service information packet is returned to the user terminal;
The authentication confirmation server includes means for managing service information acquisition history of the user or the user terminal based on a notification that the service information received from the service server has been transferred to the user terminal. The service providing system according to any one of claims 1 to 6.   The authentication confirmation server includes means for managing fee information imposed when the user or the user terminal acquires service information based on means for managing service information acquisition history of the user or the user terminal. The service providing system according to claim 7.   9. A charging agent server that collects charges for the user or the user terminal owner instead of a service server or a service provider holding service information based on the fee information managed by the authentication confirmation server. The service provision system described. The user terminal is placed at the connection point for connecting to the Internet,
Means for performing network authentication for the user terminal to connect to the Internet;
Means for permitting transfer of a packet transmitted from the user terminal to the Internet when network authentication of the user terminal is successful;
A gateway comprising:
Means for receiving the network authentication result from the gateway via the Internet;
One or more service servers comprising means for receiving a service request packet from the user terminal via the Internet and returning a service information packet carrying service information to the user terminal via the Internet as a response Via the Internet, an authentication confirmation is received to confirm whether the user terminal has already been network-authenticated, and if the network authentication result is successful as a response, the service server is authenticated via the Internet. And if the network authentication result is unsuccessful, means for notifying the service server that authentication has not been processed via the Internet,
An authentication confirmation server comprising:
With
An authentication confirmation for confirming whether or not the user terminal has already been authenticated from the service server, and the response is HTTP (Hypertext Transfer Protocol), a system comprising a gateway and an authentication confirmation server .

Images