JP6560281B2 - Web service providing system, web service providing method, web server, authentication server, and computer program - Google Patents

Description

  The present invention relates to single sign-on technology.

  Single Scion is known as a technology that integrates multi-site authentication. Single sign-on is a technology that realizes integration of authentication by sharing authentication information among multiple sites. Typical implementation methods for single sign-on include a reverse proxy type and an agent type. For example, Patent Document 1 describes an authentication system that realizes agent-type single sign-on.

JP 2005-293088 A

  However, when attempting to implement single sign-on using the conventional method, an SSO (Single Sign-On) server that integrates and manages authentication at each site is required in both the reverse proxy type and agent type methods. . Therefore, the realization of single sign-on requires a large amount of money, and there is a problem that it may be difficult to realize due to an economic load.

  In view of the above circumstances, an object of the present invention is to provide a technique capable of realizing single sign-on at a lower cost.

  According to an aspect of the present invention, a web service providing unit that provides a web service to an authenticated user and a user authentication process are performed, and different identification information is assigned to each authenticated user. An authentication unit that causes the user terminal used to receive provision of a desired web service to transmit the identification information given to the user to a web service providing unit that provides the web service desired by the user; The web service providing unit identifies an authentication state of the user by using the identification information received from the user terminal, and provides the web service to the user when the user has been authenticated. It is a web service providing system that permits the use of.

  One aspect of the present invention is the web service providing system described above, wherein the web service providing unit transmits the identification information received from the user terminal to the authentication unit, and as a response to the transmitted identification information. The authentication status of the user is identified by acquiring information indicating the authentication status of the user from the authentication unit.

  One aspect of the present invention is the above-described web service providing system, wherein the authentication unit includes a storage unit for storing the identification information given to the user, and is received from the web service providing unit. If the identification information matches the identification information stored in the storage unit, the web service providing unit responds that the user associated with the identification information has been authenticated.

  One aspect of the present invention is the web service providing system described above, wherein the identification information is generated using a hash function that outputs a different hash value for each user.

  One aspect of the present invention is the web service providing system described above, wherein the authentication unit sets an expiration date in the identification information when giving the identification information to a user who has been authenticated, The authentication state of the user to whom the identification information is assigned is identified as authenticated, and the authentication state of the user to which the identification information whose expiration date has expired is assigned is identified as unauthenticated.

  According to one aspect of the present invention, a web service providing step of providing a web service to an authenticated user, a user authentication process, and providing different identification information for each authenticated user, An authentication step for causing a user terminal used for receiving provision of a desired web service to transmit the identification information given to the user to a web service providing unit that provides the web service desired by the user; In the web service providing step, the authentication status of the user is identified using the identification information received from the user terminal, and the web provided to the user when the user has been authenticated. This is a web service provision method that permits the use of a service.

  According to an aspect of the present invention, a user authentication process is performed, and different identification information is given to each user who has been authenticated, and the user terminal used for receiving provision of a desired web service is described above. A communication unit for communicating the identification information given to the user to a web service providing server that provides the web service desired by the user, and a web service that provides the authenticated user with the web service A providing unit, wherein the web service providing unit identifies an authentication state of the user using the identification information received from the user terminal, and the user is authenticated when the user has been authenticated. It is a server that permits the use of the web service that it provides.

  One aspect of the present invention is a web service providing server that provides a web service to an authenticated user, the identification information received from a user terminal used by the user to receive a desired web service. A communication unit that communicates with a web service providing server that identifies the user's authentication state, and performs user authentication processing, assigns different identification information to each user who has been authenticated, and provides the user with a desired web service An authentication unit that causes the user terminal used to receive the provision of the information to transmit the identification information given to the user to a web service providing server that provides the web service desired by the user.

  One embodiment of the present invention is a computer program for causing a computer to function as the above-described server.

  According to the present invention, single sign-on can be realized at a lower cost.

It is a figure which shows the outline of the system configuration | structure of the web service provision system 100 in embodiment. It is a block diagram which shows the specific example of a function structure of the representative server 1 in embodiment. It is a figure which shows the specific example of the authentication information memorize | stored in the memory | storage part 13, the user identifier between servers, and authentication status management information. It is a block diagram which shows the specific example of a function structure of the external server 2 in embodiment. It is a sequence diagram which shows the flow of the user authentication in the web service provision system 100 of embodiment.

  FIG. 1 is a diagram illustrating an outline of a system configuration of a web service providing system 100 according to the embodiment. The web service providing system 100 is a system that provides a web service to the user terminal 3. The web service providing system 100 includes a representative server 1 and one or more external servers 2. The representative server 1 can communicate with the user terminal 3 via the first network 41 and can communicate with each external server 2 via the second network 42. Note that the network configuration of the web service providing system 100 may be different from that of FIG. 1 as long as the representative server 1 can communicate with each external server 2 and the user terminal 3. For example, the first network 41 and the second network 42 may be realized by wired communication or wireless communication. Further, the first network 41 and the second network 42 may be configured as the same network. The second network 42 may be configured as a plurality of different networks for each external server 2.

  The representative server 1 is interposed between the external server 2 and the user terminal 3, and realizes single sign-on by centrally managing authentication of each external server 2 with respect to the user terminal 3.

  The external server 2 accepts a web service provision request (hereinafter referred to as “web service request”) and executes a predetermined process corresponding to the requested web service. Any web service provided by the external server 2 may be used. The external server 2 accepts only authenticated user web service requests.

  The user terminal 3 is a terminal that transmits a web service request to the external server 2. For example, the user terminal 3 is a terminal device such as a PC (Personal Computer), a smartphone, or a tablet in which a web browser is installed. As described above, the web service request of the user terminal 3 is accepted by the external server 2 on the condition that the user is authenticated. The user terminal 3 can receive authentication of the external server 2 that provides the web service by notifying the representative server 1 of the web service desired by the user.

  FIG. 2 is a block diagram illustrating a specific example of a functional configuration of the representative server 1 in the embodiment. The representative server 1 includes a CPU (Central Processing Unit), a memory, an auxiliary storage device, and the like connected by a bus, and executes a program. The representative server 1 functions as an apparatus including the first communication unit 11, the second communication unit 12, the storage unit 13, and the authentication unit 14 by executing the program. All or some of the functions of the representative server 1 may be realized by using hardware such as an application specific integrated circuit (ASIC), a programmable logic device (PLD), and a field programmable gate array (FPGA). The program may be recorded on a computer-readable recording medium. The computer-readable recording medium is, for example, a portable medium such as a flexible disk, a magneto-optical disk, a ROM, a CD-ROM, or a storage device such as a hard disk built in the computer system. The program may be transmitted via a telecommunication line.

  The first communication unit 11 includes a communication interface for connecting the own apparatus to the first network 41. The first communication unit 11 communicates with the user terminal 3 via the first network 41. The second communication unit 12 includes a communication interface for connecting the own device to the second network 42. The second communication unit 12 communicates with each external server 2 via the second network 42.

  The storage unit 13 is configured using a storage device such as a magnetic hard disk device or a semiconductor storage device. The storage unit 13 stores authentication information, an inter-server user identifier, and authentication state management information. The authentication information is information necessary for user authentication, and includes user identification information and qualification information. The inter-server user identifier is user identification information used for the representative server 1 to identify the same user with the external server 2. The inter-server user identifier is set as a unique value for each user identification information included in the authentication information. The authentication status management information is information for the representative server 1 to manage the authentication status (authenticated or unauthenticated) of each user. While the authentication information and the server-to-server user identifier are stored in the storage unit 13 in advance, the authentication status management information is registered or updated according to a change in the authentication status.

  The authentication unit 14 accepts a user authentication request to the web service providing system 100 and returns an authentication result to the requesting user terminal 3. The authentication unit 14 generates authentication state management information related to the user in response to the completion of authentication, and manages the authentication state of the authenticated user based on the generated authentication state management information. On the other hand, the authentication unit 14 further has a function of responding to an authentication state of a predetermined user in response to a request from the external server 2.

  FIG. 3 is a diagram illustrating a specific example of authentication information, an inter-server user identifier, and authentication state management information stored in the storage unit 13. For example, the authentication information, the inter-server user identifier, and the authentication state management information of the embodiment are stored as a table M1 illustrated in FIG. The table M1 has a record for each user ID, and each record has a user ID, a password, an alias ID, a hash value, and an expiration date. The user ID and password are identification information and qualification information of a user who can use the web service providing system 100, and are an example of authentication information of each user. The alias ID is information that is uniquely determined for each user ID and that indicates a value different from the corresponding user ID. In that sense, the alias ID can be called an alias of the user ID. The alias ID is a specific example of the inter-server user identifier, and is transmitted / received to / from the external server 2 instead of the user ID. As described above, the security can be further strengthened by transmitting / receiving the alias ID indirectly indicating the user ID. From the viewpoint of security, the alias ID is desirably set so that the user ID cannot be obtained or estimated from the value.

  The hash value is a value calculated as a value that differs at least for each user based on a predetermined hash function. The hash function has a property of outputting the same hash value for the same data input and outputting different hash values for different data inputs. Also, it is impossible to restore the original data from the hash value. Using such a property, the representative server 1 generates a hash value for the user who has been authenticated, and registers it in the table M1 in association with the expiration date. The combination of the hash value and the expiration date is referred to or updated in the representative server 1 in order to manage the authentication state of the authenticated user. Such a hash value and expiration date are a specific example of authentication state management information in the present embodiment.

  FIG. 4 is a block diagram illustrating a specific example of a functional configuration of the external server 2 in the embodiment. The external server 2 includes a CPU, a memory, an auxiliary storage device, and the like connected by a bus, and executes a program. The external server 2 functions as a device including the communication unit 21, the request processing unit 22, and the authentication state confirmation unit 23 by executing a program. All or some of the functions of the external server 2 may be realized using hardware such as an ASIC, PLD, or FPGA. The program may be recorded on a computer-readable recording medium. The computer-readable recording medium is, for example, a portable medium such as a flexible disk, a magneto-optical disk, a ROM, a CD-ROM, or a storage device such as a hard disk built in the computer system. The program may be transmitted via a telecommunication line.

  The communication unit 21 includes a communication interface for connecting the own device to the second network 42. The communication unit 21 communicates with the representative server 1 via the second network 42.

  The request processing unit 22 receives a web service request for the device itself, and executes processing according to the received request. Specifically, when a web service request is received, the request processing unit 22 confirms the authentication state of the user who transmitted the request with the representative server 1 via the authentication state confirmation unit 23. The request processing unit 22 accepts the request only when a response is received from the representative server 1 that the user has been authenticated.

  The authentication status confirmation unit 23 inquires the representative server 1 about the authentication status of the designated user in response to a request from the request processing unit 22. The authentication status confirmation unit 23 responds to the request processing unit 22 with the inquiry result (authenticated or unauthenticated).

  The external server 2 may include a storage unit that stores the result of the inquiry. For example, when the expiration date of each user can be acquired as a result of the inquiry, the authentication status confirmation unit 23 associates the expiration date of the authenticated user with the identification information (hereinafter referred to as “authenticated user information”). .) May be stored in the storage unit. In this case, the request processing unit 22 is configured to identify the authentication status of the user by referring to the authenticated user information and inquire the representative server 1 about the authentication status of the user not registered in the authenticated user information. Also good.

  FIG. 5 is a sequence diagram illustrating a flow of user authentication in the web service providing system 100 according to the embodiment. First, in the user terminal 3, an operation for accessing a representative URL (Uniform Resource Locater) is input (event E1). In response to this operation, the user terminal 3 executes access to the representative URL. Here, the representative URL is a URL of a website provided by the representative server 1, and user authentication by the representative server 1 is required for access. When accessing the representative URL, the user terminal 3 acquires the user ID and password and transmits them to the representative server 1 (step S101). When the user authentication is completed, a representative screen on which a link for requesting a web service provided by each external server 2 is displayed on the user terminal 3.

  Specifically, when the authentication unit 14 of the representative server 1 receives a request for access to the representative URL from the user terminal 3, first, the authentication processing of the user is performed using the transmitted authentication information (user ID and password). Perform (step S102). The authentication process is performed by comparing the transmitted authentication information with the user authentication information stored in advance in the storage unit 13.

  When the authentication of the user is completed, the authentication unit 14 generates authentication state management information for the user and stores it in the storage unit 13. Specifically, the authentication unit 14 generates a hash value unique to the user (step S103). For example, the hash value may be generated based on the user ID or based on the alias ID. The authentication unit 14 registers the generated hash value together with the expiration date in the table M1. On the other hand, the authentication unit 14 transmits data for displaying a representative screen (hereinafter referred to as “representative screen data”) and the generated hash value to the user terminal 3 as a response to the access request from the user terminal 3. (Step S104).

  The user terminal 3 displays a representative screen based on the representative screen data transmitted from the representative server 1 (step S105). As described above, the link for requesting the web service provided by each external server 2 is described in the representative screen, and the hash value generated by the representative server 1 in response to the access request of the own device is included in this link. Is added as a parameter. For example, when the web service desired by the user is published at the URL “https: // xxxxx” and the generated hash value is “yyyyy”, the link of the web service is “https: // xxxxx? “hash = yyyyy”. When an operation for selecting this link is input (event E2), the user terminal 3 transmits a web service request together with a hash value to the external server 2 that provides the web service (step S106).

  When the external server 2 receives the web service request transmitted from the user terminal 3, the external server 2 checks the authentication state of the user who transmitted the request based on the hash value indicated by the request. Specifically, the request processing unit 22 of the external server 2 receives a web service request from the user terminal 3. The request processing unit 22 outputs the hash value indicated by the received web service request to the authentication state confirmation unit 23. The authentication state confirmation unit 23 transmits the hash value output from the request processing unit 22 to the representative server 1 and inquires the representative server 1 about the authentication state of the user who transmitted the request (step S107). In response to this inquiry, the authentication unit 14 of the representative server 1 refers to the authentication state management information stored in the storage unit 13 and determines whether or not the received hash value has been registered (step S108). . That is, if the received hash value is already registered in the table M1, it is determined that the user is in an authenticated state (step S109). If the received hash value is not registered, it is determined that the user is in an unauthenticated state. (Step S110). The authentication unit 14 returns the determination result to the authentication state confirmation unit 23 (step S111), and the authentication state confirmation unit 23 outputs the user authentication state returned from the authentication unit 14 to the request processing unit 22.

  The request processing unit 22 determines whether the user who transmitted the request has been authenticated based on the determination result returned from the authentication unit 14 (step S112). If the user has been authenticated (step S112—YES), the request processing unit 22 causes the transmission source user terminal 3 to use a web service provided by the server (hereinafter referred to as “service screen”). .) Is displayed (step S113). The user terminal 3 displays a service screen based on the service screen data received from the external server 2 (step S114). The user can request the external server 2 to provide a desired web service by operating the displayed service screen. On the other hand, when the user is unauthenticated, the request processing unit 22 does not accept the received web service request. In this case, the request processing unit 22 may notify the user terminal 3 of an error, or may change the screen of the user terminal 3 to the representative screen (step S115).

  In step S113, the request processing unit 22 may be configured to transmit data corresponding to the user to the authenticated user terminal 3. For example, the request processing unit 22 may transmit service screen data for displaying a different dedicated service screen for each user to the authenticated user terminal 3. In this case, the external server 2 stores in advance authentication information for each user and an inter-server user identifier. In addition, the representative server 1 transmits the inter-server user identifier of the user to the external server 2 together with information indicating the determination result in the previous step S111. The request processing unit 22 identifies an authenticated user based on the inter-server user identifier received from the representative server 1, and acquires or generates service screen data dedicated to the identified user.

  The web service providing system 100 according to the embodiment configured as described above has a representative server 1 that is a starting point when the user terminal 3 accesses each external server 2 and manages user authentication and authentication status. The SSO function can be realized without requiring a server. Therefore, according to the web service providing system 100 of the embodiment, single sign-on can be realized at a lower cost.

  Further, in the web service providing system 100 of the embodiment, user authentication information is not transmitted between the representative server 1 and the external server 2. Between the representative server 1 and the external server 2, an inter-server user identifier that enables the user to be indirectly identified is transmitted and received instead of the user authentication information. By providing such a configuration, the web service providing system 100 according to the embodiment can realize single sign-on with higher security and lower cost.

<Modification>
In the above-described embodiment, the configuration in which the authentication unit 14 generates the authentication state management information in response to user authentication in the representative server 1 (that is, corresponding to login to the representative server 1) has been described. The authentication status management information may be updated or deleted at this timing. For example, the authentication unit 14 may periodically check the table M1 and delete authentication state management information whose expiration date has expired. Further, the authentication unit 14 may delete the authentication status management information of the user in response to the user ending use of the web service (for example, logging out).

  The representative server 1 or the external server 2 in the above-described embodiment may be realized by a computer. In that case, a program for realizing this function may be recorded on a computer-readable recording medium, and the program recorded on this recording medium may be read into a computer system and executed. Here, the “computer system” includes an OS and hardware such as peripheral devices. The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Furthermore, the “computer-readable recording medium” dynamically holds a program for a short time like a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line. In this case, a volatile memory inside a computer system serving as a server or a client in that case may be included and a program held for a certain period of time. Further, the program may be a program for realizing a part of the above-described functions, and may be a program capable of realizing the functions described above in combination with a program already recorded in a computer system. You may implement | achieve using programmable logic devices, such as FPGA (Field Programmable Gate Array).

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes designs and the like that do not depart from the gist of the present invention.

  The present invention is applicable to a system that performs user authentication.

DESCRIPTION OF SYMBOLS 100 ... Web service provision system, 1 ... Representative server, 11 ... 1st communication part, 12 ... 2nd communication part, 13 ... Memory | storage part, 14 ... Authentication part, 2 ... External server, 21 ... Communication part, 22 ... Request processing , 23 ... Authentication status confirmation unit, 3 ... User terminal, 41 ... First network, 42 ... Second network

Claims (10)

A plurality of web service providing units for providing web services;
An authentication unit that performs authentication processing of a user who uses the web service;
With
The authentication unit generates different identification information for each user authenticated in the authentication process , and a URL (Uniform Resource Locator) for transmitting the generated identification information to any of the plurality of web service providing units. Send information indicating the representative screen described to the user terminal of the user,
The web service providing unit acquires the identification information from the user terminal in response to the URL selection operation performed on the representative screen displayed on the user terminal, and based on the acquired identification information The authentication status of the user is determined, and when the user has been authenticated, information indicating a web service usage screen provided by the user terminal is transmitted to the user terminal .
Web service provision system. The web service providing unit transmits the identification information acquired from the user terminal to the authentication unit, and a notification indicating the authentication state of the user determined based on the identification information as a response to the transmission of the identification information Is received from the authentication unit,
The web service providing system according to claim 1. The authentication unit, when the identification information generated by itself is the first identification information and the identification information acquired from the web service providing unit is the second identification information, the first identification information matches the second identification information. If the user is authenticated, it is determined that the user has been authenticated. If the first identification information does not match the second identification information, the user is determined to be unauthenticated. Notify the provider
The web service providing system according to claim 2. The identification information is generated using a hash function that outputs a different hash value for each user.
The web service providing system according to any one of claims 1 to 3. When generating the identification information for the user authenticated in the authentication process, the authentication unit sets an expiration date in the identification information, and identifies the authentication status of the user corresponding to the identification information within the expiration date as authenticated. And identifying the authentication status of the user corresponding to the identification information that has expired as unauthenticated,
The web service providing system according to any one of claims 1 to 4. And roux Ebusabisu providing step a plurality of web service providing unit provides a web service,
An authentication step of performing an authentication process of a user who uses the web service;
Have
In the authentication step , a URL (Uniform Resource Locater) for generating different identification information for each user authenticated in the authentication process and transmitting the generated identification information to any of the plurality of web service providing units is provided. Send information indicating the representative screen described to the user terminal of the user,
In the web service providing step , the identification information is acquired from the user terminal in response to the URL selection operation performed on the representative screen displayed on the user terminal, and based on the acquired identification information The authentication status of the user is determined, and when the user has been authenticated, information indicating a web service usage screen provided by the user terminal is transmitted to the user terminal .
Web service provision method. A communication unit that communicates with an authentication server that performs authentication processing of a user who uses a web service;
A web service provider that provides web services;
A web server comprising:
The authentication server generates different identification information for each user authenticated by the authentication process , and there is a URL (Uniform Resource Locater) for transmitting the generated identification information to either the own device or another web server. Send information indicating the representative screen described to the user terminal of the user,
The web service providing unit acquires the identification information from the user terminal in response to the URL selection operation performed on the representative screen, and determines the authentication state of the user based on the acquired identification information And, when the user is authenticated , transmits information indicating a use screen of a web service provided by the user terminal to the user terminal .
Web server. A communication unit that communicates with a plurality of web servers that provide web services;
An authentication unit that performs authentication processing of a user who uses the web service;
An authentication server comprising:
The authentication unit generates different identification information for each user authenticated in the authentication process , and a URL (Uniform Resource Locater) for transmitting the generated identification information to any of the plurality of web servers is described. Information indicating the representative screen is transmitted to the user terminal of the user,
The plurality of web servers acquire the identification information from the user terminal in response to the URL selection operation performed on the representative screen, and determine the authentication state of the user based on the acquired identification information And, when the user is authenticated , transmits information indicating a use screen of a web service provided by the user terminal to the user terminal .
Authentication server.   A computer program for causing a computer to function as the web server according to claim 7.   A computer program for causing a computer to function as the authentication server according to claim 8.

Images