JP5555617B2 - Authentication migration system, authentication migration method, and authentication migration device - Google Patents

Description

  The present invention relates to a technique for centrally managing authentication information.

  In recent years, various services have been provided on networks. There are many membership services that require user registration. In the membership system service, in order to use the service, authentication information such as a user name and a password is input to identify and authenticate the user. However, since authentication information such as user names and passwords is individually managed by the service, a user who uses many services must remember many user names and passwords.

  With regard to this problem, centralized management of authentication information such as user names and passwords enables the user to use each service only by remembering one authentication information (for example, patents). Reference 1).

Japanese Patent Laid-Open No. 2000-259566

  However, when performing centralized management of authentication information, there is a problem of how to migrate the authentication information of existing services to a centrally managed database. Conventionally, in order to obtain confirmation and approval of the migration of the authentication means to the user who used the existing service, the user is notified that the authentication means will be migrated, and forcibly separated by the date and time of completion of the migration. There was a need to migrate. In addition, there is a problem that the user who hardly uses the service is bothered when the authentication means is transferred.

  The present invention has been made in view of the above, and an object of the present invention is to smoothly shift the authentication means without bothering the user.

  An authentication migration system according to a first aspect of the present invention is an authentication migration system having a server that provides a service, a database that centrally manages authentication information, and an authentication migration device, wherein the database includes new authentication information after unified management, The old authentication information used in the service and the migration information indicating whether or not the authentication migration confirmation / approval has been obtained are stored, and the server transfers the authentication migration device when the user accesses for authentication. Whether or not the authentication transfer device has already obtained confirmation / approval of authentication transfer from the user with reference to the transfer information when accessed by the user. A determination means for determining whether the new authentication information or the old authentication information is received from the user and performing user authentication, and whether the determination means is the user. If it is determined that confirmation / approval of authentication transition has not been obtained, a list of the services used by the user is obtained from the database and presented to the user after user authentication is performed by the authentication unit. And a migration means for accepting confirmation / approval of authentication migration from the user and updating the migration information.

  In the authentication migration system, the migration means presents the old authentication information used in a service first used by the user after unified management of authentication information to the user as the new authentication information.

The authentication transfer method according to the second aspect of the present invention is an authentication transfer method using a server that provides a service, a database that centrally manages authentication information, and an authentication transfer device, and when the user accesses the server for authentication. Instructing access to the authentication transition device, and a transition indicating whether or not the authentication transition stored in the database has been confirmed and approved by the authentication transition device when accessed by a user A step of determining whether or not authentication transition confirmation / approval has already been obtained from the user with reference to information, and new authentication information after centralized management stored in the database or old authentication used in the service Receiving information from the user and performing user authentication; and If it is determined that not obtained the certification and approval, after the step of performing the user authentication is user authentication has been performed, presented to the user a list of the services that the user has utilized to obtain from the database And a step of accepting confirmation / approval of authentication migration from the user and updating the migration information.

  In the authentication transition method, the presenting step presents the old authentication information used in a service first used by the user after unified management of authentication information to the user as the new authentication information.

  An authentication transfer apparatus according to a third aspect of the present invention is an authentication transfer apparatus for transferring authentication information for using a service, and when there is an access from a user, confirmation / approval of authentication transfer stored in a database. Determining means for determining whether or not confirmation / approval of authentication transfer has already been obtained from the user with reference to the transfer information indicating whether or not the authentication information has been obtained, and new authentication information after centralized management stored in the database or An authentication unit that receives the old authentication information used in the service from the user and performs user authentication; and the determination unit determines that the authentication transfer confirmation / approval has not been obtained from the user. After the user authentication is performed by the means, the service list used by the user is acquired from the database and presented to the user. It accepts the confirmation and approval of the authentication transition from a user, characterized by having a a transition means for updating the migration information.

  In the authentication migration apparatus, the migration means presents the old authentication information used in a service first used by the user after unified management of authentication information to the user as the new authentication information.

  According to the present invention, it is possible to smoothly shift the authentication means without bothering the user.

It is a whole block diagram including the authentication transfer system in this Embodiment. The example of the data accumulate | stored in the database of the authentication transfer system in this Embodiment is shown. It is a sequence diagram which shows the flow of a process of the authentication transfer system in this Embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is an overall configuration diagram including an authentication migration system according to the present embodiment. The authentication migration system according to the present embodiment has an authentication server 1 and a database 2, and centralizes authentication information managed by the servers 3A, 3B, and 3C that provide the services A, B, and C into the database 2, The authentication server 1 performs user authentication when using the services A, B, and C. In particular, when authentication information is unified, user authentication is transferred to a new authentication server 1.

  The authentication server 1 and the servers 3A, 3B, 3C are connected to the network 100. When the services A, B, and C are used from the user terminal 4, each server is accessed via the network 100. When using each service A, B, and C, authentication traffic such as authentication information is directed to the authentication server 1, and service traffic such as service information is directed to each service A, B, and C.

  The authentication server 1 includes a determination unit 11, an authentication unit 12, and a migration unit 13, and a database 2 that centrally manages authentication information for each service A, B, and C is connected. Each unit included in the authentication server 1 may be configured by a computer including an arithmetic processing device, a storage device, and the like, and the processing of each unit may be executed by a program. This program is stored in a storage device included in the authentication server 1 and can be recorded on a recording medium such as a magnetic disk, an optical disk, or a semiconductor memory, or provided through a network. Hereinafter, each part will be described.

  When the user terminal 4 accesses the authentication server 1, the determination unit 11 determines whether confirmation / approval of authentication transition has already been obtained from the accessing user.

  The authentication unit 12 refers to the authentication information transmitted from the user terminal 4 in the database 2 and performs user authentication.

  When the determination unit 11 determines that the authentication transfer confirmation / approval has not been obtained from the accessing user, the transfer unit 13 displays a list of the services A, B, and C in which the authentication information is collected in the user terminal 4. Display, request confirmation / approval of authentication transition from the user, update the data in the database 2 when confirmation / approval of authentication transition is obtained, and record the fact that the authentication transition has been completed for the user .

  Next, data stored in the database 2 will be described.

  The database 2 stores, for each user, data in which authentication information held by each of the servers 3A, 3B, 3C is gathered for each user using information that can identify an individual such as a mail address, line information, and address name as a key. FIG. 2 shows an example of data stored in the database 2. In the example shown in FIG. 2, a new user ID, a new password, a user ID and password used in each service, a migrated flag, and name identification information are stored for each user. The new user ID and the new password are authentication information used for authentication at the time of using the service after migration, that is, after confirmation / approval of authentication migration is obtained from the user. The migrated flag is data indicating whether confirmation / approval of authentication migration has already been obtained from the user. The name identification information is information used for name identification of the authentication information held by each server 3A, 3B, 3C.

  Next, the flow of processing of the authentication migration system in this embodiment will be described.

  FIG. 3 is a sequence diagram showing a flow of processing of the authentication migration system in the present embodiment. This example shows the processing flow of the authentication migration system when a user uses the service A for the first time after the authentication information of each service A, B, C is migrated to the database 2.

  First, the user accesses the server 3A providing the service A from the user terminal 4 (step S11).

  The server 3A redirects access from the user terminal 4 to the authentication server 1 (step S12), and the user terminal 4 accesses the authentication server 1 according to an instruction from the server 3A (step S13).

  Upon receiving access from the user terminal 4, the authentication server 1 requests authentication information such as a user ID and a password from the user terminal 4 (step S14).

  And a user inputs authentication information with the user terminal 4, and transmits to the authentication server 1 (step S15). At this time, since the user has not been transferred to the authentication and has been redirected from the server 3A, the user ID and password of the service A are input and transmitted to the authentication server 1.

  When the authentication server 1 receives the authentication information from the user terminal 4, the authentication server 1 refers to the database 2 and determines whether confirmation / approval of the authentication transition has been obtained from the user (step S16). Whether or not the confirmation / approval of the authentication shift has been obtained is determined by the determination unit 11 referring to the database 2 and checking the transferred flag of the user who has accessed. The user who has accessed can be identified using line information added when the user terminal 4 accesses the authentication server 1. Alternatively, the user can be identified from the user ID of service A.

  Subsequently, the authentication server 1 transmits and displays a screen for prompting confirmation / approval of the authentication transition to the user terminal 4 (step S17). The migration unit 13 refers to the database 2 to obtain a list of services that have been identified and transmits them to the user terminal 4 to prompt the user to confirm and approve the migration of the authentication means. Information to be displayed on the user terminal 4 includes a service name that the user has registered for use and a user ID used for the service. At the same time as confirming the authentication transition, the user is prompted to enter a new user ID and new password. Alternatively, the user ID and password used in the service A that was first accessed after the centralized management of authentication information are used as the new user ID and new password after migration, and the user ID and password of the specific service are used as the new user ID and new password There is a method of presenting the user to select a frequently used one for each user and to use a mail address used for name identification as a new user ID.

  Then, the user confirms the service whose authentication is transferred to the authentication server 1 by looking at the screen displayed on the user terminal 4, sets a new user ID and a new password, and sends a confirmation / approval response to the authentication server 1. Transmit (step S18).

  Upon receiving the confirmation / approval of authentication migration, the authentication server 1 updates the data in the database 2 and turns on the migrated flag (step S19). In addition, since user authentication is performed with the new user ID and new password after the migration, the user ID and password for each service A, B, and C are not required, so the user ID and password for each service A, B, and C are used. It may be deleted from the database 2.

  Then, the authentication server 1 transmits an authentication token for using the service A to the user terminal 4 (step S20), and the user terminal 4 accesses the server 3A using the received authentication token and uses the service A. (Steps S21 and S22).

  Next, user authentication after migration will be described.

  After the migration, when the user terminal 4 accesses the server 3B providing the service B (step S23), the access is redirected to the authentication server 1 (steps S24 and S25), and the user authentication is performed using the new user ID and the new password. (Step S26). The authentication server 1 transmits an authentication token for using the service B to the user terminal 4 (step S27), and the user terminal 4 accesses the server 3B using the received authentication token and uses the service B ( Steps S28 and S29).

  As described above, according to the present embodiment, when a user accesses the authentication server 1, referring to the migrated flag in the database 2, the user can obtain the authorization to migrate the authentication means. A screen for prompting confirmation / approval of the authentication transfer including a list of service names registered by the user is transmitted to the user terminal 4 and displayed. Then, a response of confirmation / approval is received from the user terminal 4, the data in the database 2 is updated, and the migrated flag is turned on. As a result, it is possible not only to notify that the authentication is transferred in advance, but also to transfer the authentication means after obtaining confirmation / approval of the user. In addition, since the user is required to confirm and approve when accessing the service to be used, the user who hardly uses the service is not bothered.

  According to the present embodiment, the user ID and password used by the service accessed first after the unified management of authentication information are used as the new user ID and new password after migration, so that the user is familiar with the user ID and password. Can be used as is.

DESCRIPTION OF SYMBOLS 1 ... Authentication server 11 ... Determination part 12 ... Authentication part 13 ... Migration part 2 ... Database 3A, 3B, 3C ... Server 4 ... User terminal 100 ... Network

Claims (6)

An authentication migration system having a server that provides a service, a database that centrally manages authentication information, and an authentication migration device,
The database is
Stores new authentication information after centralized management, old authentication information used in the service, and migration information indicating whether authentication migration confirmation / approval has been obtained,
The server
Instructing means for instructing access to the authentication transition device when a user accesses for authentication,
The authentication transfer device
A determination means for determining whether or not the authentication migration confirmation / approval has already been obtained from the user with reference to the migration information when accessed by the user;
An authentication means for receiving the new authentication information or the old authentication information from the user and performing user authentication;
When the determination unit determines that confirmation / approval of authentication transfer has not been obtained from the user, a list of the services used by the user is obtained from the database after the user authentication is performed by the authentication unit. Obtaining and presenting to the user, and receiving a confirmation / approval of authentication migration from the user, and a migration means for updating the migration information;
An authentication transition system characterized by comprising:   The authentication transition according to claim 1, wherein the transition means presents the old authentication information used in a service first used by the user after unified management of authentication information as the new authentication information to the user. system. An authentication transfer method using a server that provides a service, a database that centrally manages authentication information, and an authentication transfer device,
By the server,
Directing access to the authentication transition device when a user accesses for authentication;
By the authentication transfer device,
Whether or not the authentication migration confirmation / approval has already been obtained from the user with reference to the migration information indicating whether or not the authentication migration confirmation / approval stored in the database has been obtained when accessed by the user Determining whether or not
Receiving new authentication information after centralized management stored in the database or old authentication information used in the service from the user and performing user authentication;
If it is determined in the determining step that confirmation / approval of authentication transfer has not been obtained from the user, the list of services used by the user after the user authentication is performed in the user authentication step Obtaining from the database and presenting to the user;
Receiving confirmation / approval of authentication migration from the user, and updating the migration information;
An authentication transition method characterized by comprising:
  4. The authentication according to claim 3, wherein the presenting step presents the old authentication information used in a service first used by the user after unified management of authentication information as the new authentication information to the user. 5. Migration method. An authentication transfer device for transferring authentication information for using a service,
Whether or not the authentication migration confirmation / approval has already been obtained from the user by referring to the migration information indicating whether or not the authentication migration confirmation / approval stored in the database has been obtained when accessed by the user Determining means for determining
New authentication information after centralized management stored in a database or old authentication information used in the service from the user and authenticating means for performing user authentication;
When the determination unit determines that confirmation / approval of authentication transfer has not been obtained from the user, a list of the services used by the user is obtained from the database after the user authentication is performed by the authentication unit. Obtaining and presenting to the user, and receiving a confirmation / approval of authentication migration from the user, and a migration means for updating the migration information;
An authentication transition apparatus characterized by comprising:   6. The authentication transition according to claim 5, wherein the transition means presents the old authentication information used in a service first used by the user after unified management of authentication information as the new authentication information to the user. apparatus.

Images