JP7008595B2 - Service integrated authentication authorization system and service integrated authentication authorization method - Google Patents

Description

The present invention relates to a service integrated authentication / authorization system and a service integrated authentication / authorization method that enable a user to use a plurality of services with one authentication.

In recent years, cloud services have become widespread. Such cloud services are services provided by cloud computing technology, and are often provided in a multi-tenant configuration that can support a plurality of companies.

The multi-tenant configuration allows multiple services to coexist on the cloud, but each service has an authentication and authorization function that individually authenticates and authorizes. Therefore, a user who uses these services needs to input each user ID (Identifier) and password for each service to authenticate.

As a technology for simplifying user input, a technology for linking cloud services with each other is known. For example, in Patent Document 1, when the linking source service cooperates with the linking destination service, the permission token of the linking destination is provided from the access management system according to the authority of the user who is operating the linking source service. The technology for issuing and delegating authority is disclosed.

Japanese Unexamined Patent Publication No. 2013-14505

However, the technique described in Patent Document 1 has a problem that, for example, the authentication / authorization function of an existing service must be modified, resulting in high development cost. This problem is not limited to cloud services, and the same applies to services other than cloud services.

The present invention has been made in view of the above, and obtains a service integrated authentication / authorization system that enables a user to use a plurality of services with one authentication without modifying the authentication / authorization function of an existing service. The purpose is.

In order to solve the above-mentioned problems and achieve the object, the service integrated authentication / authorization system of the present invention includes an integrated authentication device that authenticates the user, and a user terminal device and each based on the result of authentication by the integrated authentication device. It is equipped with an integrated authorization device that cooperates with the service providing device. The integrated authentication device encrypts the integrated authentication unit that authenticates the user based on the authentication information transmitted from the user's terminal device and the service account information that is the user's account information in the service provided by each service providing device. It is provided with an authentication information storage unit for storing encrypted information. The integrated authorization device is authenticated by the integrated authentication unit based on the acquisition unit that acquires the encrypted information from the integrated authentication device, the decryption unit that decrypts the encrypted information into the service account information, and the decrypted service account information. It is provided with an integrated authorization unit that causes each service providing device to authenticate the user of the terminal device. After the authentication is performed by the integrated authentication unit, the integrated authorization unit determines and determines a predetermined number of services in descending order of frequency of use of the integrated authenticated user who is the user authenticated by the integrated authentication unit. The service providing device that provides the provided service is made to authenticate the integrated authenticated user before the integrated authenticated user selects the service.

According to the present invention, there is an effect that a user can use a plurality of services with one authentication without modifying the authentication / authorization function of the existing service.

The figure which shows the structural example of the information processing system which concerns on Embodiment 1 of this invention. The figure which shows the configuration example of the service integrated authentication authorization system and the service providing apparatus which concerns on Embodiment 1. The figure which shows an example of the authentication authorization table which concerns on Embodiment 1. The figure which shows an example of the service authentication authorization table which concerns on Embodiment 1. The figure which shows an example of the service authentication authorization table which concerns on Embodiment 1. A flowchart showing an example of processing of the service integrated authentication authorization system according to the first embodiment. A flowchart showing an example of the integrated authentication process according to the first embodiment. A flowchart showing an example of the service authentication process according to the first embodiment. A flowchart showing an example of the encryption service account processing according to the first embodiment. The figure which shows an example of the hardware configuration of the service integrated authentication authorization system which concerns on Embodiment 1. The figure which shows the configuration example of the service integrated authentication authorization system and the service providing apparatus which concerns on Embodiment 2 of this invention. The figure which shows an example of the integrated authentication table which concerns on Embodiment 2. The figure which shows an example of the service account table which concerns on Embodiment 2. A flowchart showing an example of the integrated authentication process according to the second embodiment. A flowchart showing an example of the service authentication process according to the second embodiment. The figure which shows the configuration example of the service integrated authentication authorization system and the service providing apparatus which concerns on Embodiment 3 of this invention. The figure which shows an example of the authentication authorization table which concerns on Embodiment 3. The figure which shows the configuration example of the service integrated authentication authorization system and the service providing apparatus which concerns on Embodiment 4 of this invention. The figure which shows an example of the authentication authorization table which concerns on Embodiment 4. The figure which shows the configuration example of the service integrated authentication authorization system and the service providing apparatus which concerns on Embodiment 5 of this invention. The figure which shows an example of the authentication authorization table which concerns on Embodiment 5. A flowchart showing an example of processing of the service integrated authentication authorization system according to the first embodiment. A flowchart showing an example of the service authentication process according to the fifth embodiment. A flowchart showing an example of the migration process according to the fifth embodiment. A flowchart showing an example of the integrated authentication information setting process according to the fifth embodiment.

Hereinafter, the service integrated certification / authorization system and the service integrated certification / authorization method according to the embodiment of the present invention will be described in detail with reference to the drawings. The present invention is not limited to this embodiment.

Embodiment 1.
FIG. 1 is a diagram showing a configuration example of an information processing system according to the first embodiment of the present invention. As shown in FIG. 1, the information processing system 100 according to the first embodiment includes a service integrated authentication / authorization system 1, service providing devices 2 ₁ , 2 ₂ , and a plurality of terminal devices 3 ₁ , ₃₂ , ... , 3 _n and so on. A plurality of terminal devices 3 ₁ , 32 ₂ , ..., 3 _n are used by a plurality of users U ₁ , U ₂ , ..., _Un . n is, for example, an integer of 3 or more. The plurality of users U ₁ , U ₂ , ..., _Un are, for example, employees of a company that has a contract for a cloud service described later.

Hereinafter, when each of the service providing devices 2 ₁ and 2 ₂ is shown without distinction, it is described as the service providing device 2. Further, when each of a plurality of terminal devices 3 ₁ , 32, ..., _{3 n} is shown without distinction, it is described as terminal device 3, and a plurality of users U ₁ , U ₂ , ..., _Un . When each of the above is shown without distinction, it is described as user U. In the example shown in FIG. 1, the number of service providing devices 2 is two, but the number of service providing devices 2 may be three or more.

The service integrated authentication / authorization system 1 and each terminal device 3 are connected to each other so as to be able to communicate with each other via the network 4. The network 4 is the Internet, but may be a WAN (Wide Area Network) other than the Internet, for example.

Each of the service integrated authentication authorization system 1 and the service providing devices 2 ₁ and 2 ₂ is composed of one or more virtual devices arranged on the cloud service platform 10 arranged on the Internet. The cloud service platform 10 provides IT (Information Technology) resources such as physical servers and network devices in units called tenants that are logically divided.

Tenants include VMs (Virtual Machines), which are virtual computers that operate on logically divided servers, and virtual networks. The virtual network is, for example, a VLAN (Virtual Local Area Network). The service integrated authentication authorization system 1 and the service providing devices 2 ₁ and 2 ₂ are assigned to different tenants. Hereinafter, for convenience of explanation, the service provided by the service providing device 21 is referred to as a service A, and the service provided by the service providing device _{2 2 is} referred to as a service B. The services A and B are cloud services, and are, for example, services provided by PaaS (Platform as a Service) or IaaS (Infrastructure as a Service).

The service integrated authentication / authorization system 1 includes an integrated authorization device 11 and an integrated authentication device 12, and the user U of the terminal device 3 authorizes the user U to use the services provided by the plurality of service providing devices 2 by one authentication. do. The integrated authentication device 12 performs integrated authentication of the user U. The integrated authorization device 11 includes a plurality of service providing devices 2 that each provide a service and an integrated authorization device 11 that cooperates with the terminal device 3 of the user U based on the result of the integrated authentication. The integrated authorization device 11 and the integrated authentication device 12 are configured by different virtual devices, but may be configured by the same virtual device.

The integrated authentication is an authentication for collectively authorizing the use of the services provided by the plurality of service providing devices 2. Further, the cooperation between the service providing device 2 and the terminal device 3 of the user U means that the service providing device 2 and the terminal device 3 are connected so that the service provided by the service providing device 2 can be used by the user U of the terminal device 3. Means that.

The integrated authentication device 12 performs integrated authentication of the user U based on the integrated authentication information of the user U transmitted from the terminal device 3. The integrated authentication information is authentication information for collectively authenticating and authorizing the services provided by each service providing device 2 in the service integrated authentication / authorization system 1, and is the account information of the user U in the service integrated authentication / authorization system 1. be. The integrated authorization device 11 authorizes the user U to use the service provided by each service providing device 2 based on the result of the integrated authentication by the integrated authentication device 12.

For example, when the integrated authentication by the integrated authentication device 12 is completed, the integrated authorization device 11 obtains the encrypted service account information obtained by encrypting the service account information which is the account information of the services A and B of the user U from the integrated authentication device 12. get. The integrated authorization device 11 decrypts the acquired encrypted service account information into service account information, and transmits the decrypted service account information to the service providing devices _{2 1} and 22. As a result, the services A and B are authenticated in the service providing devices _{2 1} and 22, and the user U does not need to input the service account information of the services A and B into the terminal device 3, and the user U does not need to input the service account information of the services A and B into the terminal device 3. You can use services A and B at. The encryption service account information is an example of encryption information.

Hereinafter, the service integrated authentication / authorization system 1 and the service providing devices 2 ₁ and 2 ₂ will be described in more detail. FIG. 2 is a diagram showing a configuration example of the service integrated authentication / authorization system and the service providing device according to the first embodiment. In the example shown in FIG. 2, only one terminal device 3 is shown, but as shown in FIG. 1, a plurality of terminal devices 3 are provided.

As shown in FIG. 2, the integrated authorization device 11 of the service integrated authentication authorization system 1 includes an integrated authorization unit 111 that links the terminal device 3 and each service providing device 2, and a service A encrypted from the integrated authentication device 12. , B is provided with an acquisition unit 112 for acquiring the encrypted service account information which is the service account information of B. Further, the integrated authorization device 11 includes a decryption unit 113 that decrypts the encrypted service account information acquired by the acquisition unit 112 into the service account information.

Upon receiving the login information from the terminal device 3, the integrated authorization unit 111 requests the integrated authentication device 12 for integrated authentication. When the login information acquired from the integrated authorization unit 111 in the integrated authentication device 12 is stored as the integrated authentication information, the integrated authentication device 12 succeeds in the integrated authentication.

When the integrated authentication is successful in the integrated authentication device 12, the integrated authorization unit 111 acquires the service account information of the services A and B of the user U from the decryption unit 113, and the acquired service account information is used as the service providing devices 2 ₁ and 2. Send to ₂ . As a result, the user U can use the services A and B by using the terminal device 3 without inputting the service account information which is the authentication information of the services A and B.

The integrated authentication device 12 of the service integrated authentication authorization system 1 includes the integrated authentication unit 121 that performs integrated authentication of the user U of the terminal device 3 based on the request from the integrated authorization device 11, and the integrated service account information and service of the user U. It is provided with an authentication information storage unit 122 that stores the service account information of A and B. Further, the integrated authentication device 12 acquires the service account information of the services A and B of the user U from the service providing devices _{2 1} and 22, encrypts the acquired service account information, and stores the acquired service account information in the authentication information storage unit 122. A unit 123 is provided.

The integrated authentication unit 121 acquires the service account information of the services A and B stored in the authentication information storage unit 122 based on the request from the integrated authorization device 11, and integrates the acquired service account information of the services A and B. It is transmitted to the authorization device 11.

FIG. 3 is a diagram showing an example of the authentication / authorization table according to the first embodiment. As shown in FIG. 3, in the authentication authorization table 50 stored in the authentication information storage unit 122, "integrated authentication information", "service URL", "encryption service account information", and "decryption key" are associated with each other. Includes information.

The "integrated authentication information" is information used for integrated authentication by the integrated authentication unit 121, and includes an integrated user ID (Identifier) and an integrated user PW (Password). The integrated user ID is identification information assigned to each user U, and the integrated user PW is a password set for each integrated user PW. The integrated user ID "UID001" is the integrated user ID of the user U ₁ , and the integrated user ID "UID002" is the integrated user ID of the user U ₂ .

The "service URL" is a URL (Uniform Resource Locator) of the service providing device 2 in the cloud service platform 10. In the example shown in FIG. 3, the URL of the service providing device 21 is "http://A.co.jp", and the URL of the service providing device _{2 2 is} "http://B.co.jp". Is. Such a "service URL" is used as a destination URL by the service integrated authentication / authorization system 1 when the service integrated authentication / authorization system 1 accesses the service providing device 2.

The "encrypted service account information" is information obtained by encrypting the account information of the user U for using the service provided by the service providing device 2. In the example shown in FIG. 3, the encrypted service account information "Spojsprog4w04psr" of the service A and the encrypted service account information "aspoj39pdfjp39kff" of the service B are associated with the integrated user ID "UID001". The "decryption key" is the information of the decryption key for decrypting the encryption service account information.

Returning to FIG. 2, the service providing devices _{2 1} and 22 will be described. The service providing device 2 ₁ includes a service authentication and authorization unit 21 ₁ that authorizes the user U to authenticate the user U and uses the service A, and a service providing unit 22 ₁ that provides the service A to the authenticated and authorized user U. It is provided with a service authentication information storage unit 231 that stores the service account information of the service _A for each user U.

Similarly, the service providing device 2 ₂ has a service authentication and authorization unit 21 ₂ that authorizes the user U to authenticate and use the service B, and a service providing unit 22 that provides the service B to the authenticated and authorized user U. ₂ and a service authentication information storage unit 23 ₂ that stores the service account information of the service B for each user U.

4 and 5 are diagrams showing an example of a service account table according to the first embodiment. The service account table 51 shown in FIG. 4 is information stored in the service authentication information storage unit 231 and includes the service account information of the service _A for each user U. The service account table 51 shown in FIG. 4 includes information in which the service user ID, which is the user ID of the service A, and the service user PW, which is the user PW of the service A, are associated with each other. In the example shown in FIG. 4, the service user ID "AID001" is the service user ID of the user U ₁ , and the service user ID "AID002" is the service user ID of the user U ₂ .

Further, the service account table 52 shown in FIG. 5 is information stored in the service authentication information storage unit ₂₃₂ , and includes the service account information of the service B for each user U. The service account table 52 shown in FIG. 5 includes information in which the service user ID, which is the user ID of the service B, and the service user PW, which is the user PW of the service B, are associated with each other. In the example shown in FIG. 5, the service user ID "BID001" is the service user ID of the user U ₁ , and the service user ID "BID002" is the service user ID of the user U ₂ .

Hereinafter, when _each of the service authentication and authorization units 21 ₁ and 211 is shown without distinction, it is described as the service authentication and authorization unit 21, and when each of the service provision units 22 ₁ and 22 ₂ is shown without distinction, the service is provided. It is described as a part 22. Further, when each of the service authentication information storage units 23 ₁ and 23 ₂ is shown without distinction, it is described as the service authentication information storage unit 23.

Next, the operations of the service integrated authentication / authorization system 1 and the service providing devices _{2 1} and 22 will be described in more detail. FIG. 6 is a flowchart showing an example of the processing of the service integrated authentication / authorization system according to the first embodiment, and is repeatedly executed by the service integrated authentication / authorization system 1.

As shown in FIG. 6, the integrated authorization unit 111 of the integrated authorization device 11 in the service integrated authentication authorization system 1 determines whether or not there is access from the terminal device 3 (step S11). When the integrated authorization unit 111 determines that the terminal device 3 has access (step S11: Yes), the service integrated authentication authorization system 1 executes the integrated authentication process (step S12). The process of step S12 is the process of steps S21 to S26 shown in FIG. 7, which will be described in detail later. In the following, the user U of the terminal device 3 that has accessed the service integrated authentication / authorization system 1 may be described as an access user.

When the process of step S12 is completed, the service integrated authentication / authorization system 1 executes the service authentication process (step S13). The process of step S13 is the process of steps S31 to S38 shown in FIG. 8, which will be described in detail later.

When the process of step S13 is completed or when it is determined that there is no access from the terminal device 3 (step S11: No), the service integrated authentication / authorization system 1 ends the process shown in FIG.

FIG. 7 is a flowchart showing an example of the integrated authentication process according to the first embodiment. As shown in FIG. 7, the integrated authorization unit 111 of the integrated authorization device 11 inquires to the integrated authentication unit 121 of the integrated authentication device 12 whether or not the access user has been authenticated (step S21).

When the integrated authentication unit 121 receives an inquiry from the integrated authorization unit 111 as to whether or not the access user has been authenticated, the integrated authentication unit 121 determines whether or not the access user has been authenticated (step S22). The integrated authentication unit 121 has, for example, authentication status information indicating the authentication status of each user U, and can determine whether or not the access user has been authenticated based on the authentication status information.

When the integrated authentication unit 121 determines that the access user has not been authenticated (step S22: No), the integrated authentication unit 121 transmits the information on the integrated login screen to the access user's terminal device 3 via the integrated authorization unit 111 (step S23). As a result, the integrated login screen is displayed on the terminal device 3 of the access user. The integrated login screen is a screen for allowing the access user to input login information including the integrated user ID and the integrated user PW. The access user operates the terminal device 3 to input the integrated login information which is the login information including the user ID and the user PW on the integrated login screen, and transmits the integrated login information from the terminal device 3 to the service integrated authentication / authorization system 1. Let me.

The integrated authentication unit 121 determines whether or not the integrated login information has been acquired from the terminal device 3 of the access user via the integrated authorization unit 111 (step S24). When the integrated authentication unit 121 determines that the integrated login information has not been acquired (step S24: No), the integrated authentication unit 121 repeats the process of step S24.

When the integrated authentication unit 121 determines that the integrated login information has been acquired (step S24: Yes), the integrated authentication unit 121 compares the integrated login information determined to have been acquired in step S24 with the integrated authentication information stored in the authentication information storage unit 122. (Step S25).

The integrated authentication unit 121 determines whether or not the integrated authentication, which is the authentication of the access user, has succeeded based on the result of the comparison in step S25 (step S26). In step S26, if the integrated authentication information matching the integrated login information is stored in the authentication information storage unit 122, the integrated authentication unit 121 determines that the integrated authentication was successful, and the integrated authentication information matching the integrated login information. Is not stored in the authentication information storage unit 122, it is determined that the integrated authentication has failed.

When the integrated authentication unit 121 determines that the integrated authentication is not successful (step S26: No), the service integrated authentication / authorization system 1 shifts the process to step S23. Further, in the service integrated authentication / authorization system 1, when the integrated authentication unit 121 determines that the integrated authentication is successful (step S26: Yes), or the integrated authentication unit 121 determines that the access user has been authenticated. In the case (step S22: Yes), the process shown in FIG. 7 is terminated.

FIG. 8 is a flowchart showing an example of the service authentication process according to the first embodiment. As shown in FIG. 8, the integrated authentication unit 121 transmits the information on the service selection screen to the terminal device 3 of the access user via the integrated authorization unit 111 (step S31). As a result, the service selection screen is displayed on the terminal device 3 of the access user.

On the service selection screen, for example, a selection button for selecting service A and a selection button for selecting service B are displayed. By operating the terminal device 3 and selecting the selection button, the access user transmits selection information indicating the selected service from the terminal device 3 to the service integrated authentication / authorization system 1.

The integrated authentication unit 121 determines whether or not the access user has selected the service (step S32). In step S32, the integrated authentication unit 121 determines that the access user has selected the service when the selection information is acquired from the terminal device 3 of the access user.

When the integrated authentication unit 121 determines that the access user has not selected the service (step S32: No), the integrated authentication unit 121 repeats the process of step S32. When the integrated authentication unit 121 determines that the access user has selected the service (step S32: Yes), the integrated authentication unit 121 determines whether or not the authentication information storage unit 122 has the encrypted service account information of the access user in the selected service. (Step S33).

For example, it is assumed that the authentication / authorization table 50 is in the state shown in FIG. 3 and the integrated user ID of the access user is “UID002”. In this case, the integrated authentication unit 121 determines that there is encryption service account information when the access user selects service A, and when the access user selects service B, there is no encryption service account information. judge.

When the integrated authentication device 12 determines that there is no encryption service account information by the integrated authentication unit 121 (step S33: No), the integrated authentication device 12 executes an encryption service account process for generating and storing the encryption service account (step S33: No). S34). The process of step S34 is the process of steps S41 to S48 shown in FIG. 9, which will be described in detail later.

When the integrated authentication unit 121 determines that the encrypted service account information exists (step S33: Yes), the acquisition unit 112 has the encrypted service account information associated with the integrated user ID of the access user and the selected service. And the decryption key are acquired from the authentication information storage unit 122 (step S35).

The decryption unit 113 decrypts the encrypted service account information acquired by the acquisition unit 112 into the service account information by using the decryption key acquired by the acquisition unit 112 (step S36). For example, it is assumed that the authentication / authorization table 50 is in the state shown in FIG. 3, the integrated user ID of the access user is “UID001”, and the selected service is service A. In this case, the service account information decrypted by the decryption unit 113 includes the service user ID "AID001" and the service user PWM "aesijpf9eupi43topjaef".

The integrated authorization unit 111 stores the service account information decrypted by the decryption unit 113 in the request, and transmits the request to the service providing device 2 that provides the selected service (step S37). For example, it is assumed that the authentication / authorization table 50 is in the state shown in FIG. 3, the integrated user ID of the access user is “UID001”, and the selected service is service A. In this case, the integrated authorization unit 111 transmits a request including the service user ID “AID001” and the service user PW “aesijpf9eupi43topjaef” to the service providing device 21 with “ _{http://A.co.jp} ” as the destination URL.

Whether or not the service authentication / authorization unit 21 of the service providing device 2 that has received the request from the integrated authorization unit 111 stores the combination of the service user ID and the service user PW included in the received request in the service authentication information storage unit 23. Is determined. The service authentication authorization unit 21 determines that the authentication of the access user is successful when the combination of the service user ID and the service user PW included in the received request is stored in the service authentication information storage unit 23.

When the service authentication authorization unit 21 determines that the authentication of the access user is successful, the service authentication authorization unit 21 transmits information on the usage screen for using the service A to the access user terminal device 3 via the integrated authorization unit 111. Further, when the service authentication / authorization unit 21 determines that the authentication of the access user has failed, the service authentication / authorization unit 21 transmits information indicating that the authentication has failed to the integrated authorization unit 111.

The integrated authorization unit 111 determines whether or not the service authentication is successful based on the information transmitted from the service providing device 2 in response to the request transmitted in step S37 (step S38). For example, the integrated authorization unit 111 determines that the service authentication is successful when the information on the usage screen for using the service A is received from the service providing device 2. Further, when the integrated authorization unit 111 receives the information indicating that the service authentication has failed from the service providing device 2, it determines that the service authentication has failed.

When the integrated authorization unit 111 determines that the service authentication has failed (step S38: No), the integrated authorization unit 111 shifts the process to step S31. Further, when it is determined that the service authentication is successful (step S38: Yes), or when the process of step S34 is completed, the integrated authorization unit 111 ends the process shown in FIG. If the integrated authorization unit 111 determines that the service authentication has failed (step S38: No), the integrated authorization unit 111 may shift the process to step S34.

FIG. 9 is a flowchart showing an example of the encryption service account processing according to the first embodiment. The encryption service account process is a process for registering unregistered encryption service account information in the integrated authentication device 12. As shown in FIG. 9, the integrated authorization unit 111 transmits a request to the service providing device 2 that provides the service determined to be selected in step S32 (step S41).

The integrated authorization unit 111 transmits the information on the service login screen transmitted from the service providing device 2 to the terminal device 3 of the access user in response to the request transmitted in step S41 (step S42). As a result, the service login screen is displayed on the terminal device 3 of the access user. The access user operates the terminal device 3 to input the service login information including the user ID and the user PW on the service login screen, and causes the terminal device 3 to transmit the service login information to the service integrated authentication / authorization system 1.

The integrated authorization unit 111 transmits the service login information transmitted from the terminal device 3 of the access user to the selected service providing device 2 (step S43). The service authentication authorization unit 21 of the service providing device 2 that has received the service login information from the integrated authorization unit 111 determines whether or not the service account information that matches the received service login information is stored in the service authentication information storage unit 23. do.

The service authentication authorization unit 21 determines that the authentication of the access user is successful when the service account information matching the service login information is stored in the service authentication information storage unit 23, and the service account matching the service login information. When the information is not stored in the service authentication information storage unit 23, it is determined that the authentication of the access user has failed.

When the service authentication authorization unit 21 determines that the authentication of the access user is successful, the service authentication authorization unit 21 transmits information on the usage screen for using the service A to the access user terminal device 3 via the integrated authorization unit 111. Further, when the service authentication / authorization unit 21 determines that the authentication of the access user has failed, the service authentication / authorization unit 21 transmits information indicating that the authentication has failed to the integrated authorization unit 111.

The integrated authorization unit 111 succeeds in service authentication, which is authentication by the service providing device 2 that provides the selected service based on the information transmitted from the service providing device 2 in response to the service login information transmitted in step S43. It is determined whether or not it has been done (step S44). For example, the integrated authorization unit 111 determines that the service authentication is successful when the information on the usage screen for using the service A is received from the service providing device 2. Further, when the integrated authorization unit 111 receives the information indicating that the authentication has failed from the service providing device 2, it determines that the service authentication has failed.

When the integrated authorization unit 111 determines that the service authentication has failed (step S44: No), the integrated authorization unit 111 shifts the process to step S42. The information indicating that the authentication has failed from the service providing device 2 is, for example, the information on the service login screen for prompting the re-input of the login information, and the information on the service login screen is transmitted to the terminal device 3 in step S42. To log in.

Further, when the integrated authorization unit 111 determines that the service authentication is successful (step S44: Yes), the integrated authorization unit 111 transmits the information on the usage screen from the service providing device 2 to the terminal device 3 (step S45). As a result, the access user can use the selected service in the terminal device 3.

The collection unit 123 of the integrated authentication device 12 acquires the service account information of the access user whose service authentication is successful from the service providing device 2 (step S46). The collecting unit 123 encrypts the service account information acquired from the service providing device 2 to generate the encrypted service account information (step S47).

Specifically, the collecting unit 123 encrypts the character string in which the service user ID and the service user PW are combined by using the encryption key. At this time, the collecting unit 123 encloses the character string combining the service user ID and the service user PW with an identifier so that the service user ID and the service user PW can be recognized at the time of decryption. Put it in a state. For example, when the service user ID is "AID001" and the service user PW is "aesijpf9eupi43topjaef", the character string combining the service user ID or the service user PW is "AID001 $ aesijpf9eupi43topjaef $".

The collecting unit 123 associates the generated encryption service account information with the integrated user ID of the access user and stores it in the authentication information storage unit 122 (step S48). When the process of step S48 is completed, the process shown in FIG. 9 is completed.

The collection unit 123 can collect the service account information of the access user who has succeeded in the service authentication from the service providing device 2 via the integrated authorization device 11. Further, the integrated authorization unit 111 can acquire the service login information transmitted to the service providing device 2 in step S43 as the service account information of the access user, and output the acquired service account information to the collection unit 123.

FIG. 10 is a diagram showing an example of the hardware configuration of the service integrated authentication / authorization system according to the first embodiment. As shown in FIG. 10, the service integrated authentication / authorization system 1 includes a computer including a processor 101, a memory 102, and an interface circuit 103.

The processor 101, the memory 102, and the interface circuit 103 can send and receive data to and from each other by the bus 104. The processor 101 executes the functions of the integrated authorization device 11 and the integrated authentication device 12 by reading and executing the program stored in the memory 102. The processor 101 is an example of a processing circuit, and includes one or more of a CPU (Central Processing Unit), a DSP (Digital Signal Processer), and a system LSI (Large Scale Integration).

The memory 102 includes one or more of a RAM (Random Access Memory), a ROM (Read Only Memory), a flash memory, and an EPROM (Erasable Programmable Read Only Memory). Further, the memory 102 includes a recording medium in which the above-mentioned program readable by a computer is recorded. Such recording media include one or more of non-volatile or volatile semiconductor memories, magnetic disks, flexible memories, optical discs, compact disks, and DVDs. The service integrated certification / authorization system 1 may include integrated circuits such as an ASIC (Application Specific Integrated Circuit) and an FPGA (Field Programmable Gate Array). Further, the integrated authorization device 11 and the integrated authentication device may each have the hardware configuration shown in FIG.

As described above, the service integrated authentication / authorization system 1 according to the first embodiment includes the integrated authentication device 12 that authenticates the user U and the terminal device 3 of the user U based on the result of the authentication by the integrated authentication device 12. It is provided with an integrated authorization device 11 that cooperates with the service providing device 2. The integrated authentication device 12 is the account information of the user U in the service provided by each service providing device 2 and the integrated authentication unit 121 that authenticates the user U based on the integrated authentication information transmitted from the terminal device 3 of the user U. It is provided with an authentication information storage unit 122 for storing encrypted service account information obtained by encrypting certain service account information. The encryption service account information is an example of encryption information. The integrated authorization device 11 is based on the acquisition unit 112 that acquires the encrypted service account information from the integrated authentication device 12, the decryption unit 113 that decrypts the encrypted service account information into the service account information, and the decrypted service account information. It includes a service authentication of the user U authenticated by the integrated authentication device 12 and an integrated authorization unit 111 to be executed by each service providing device 2. As a result, the user U can use a plurality of services with one authentication without modifying the authentication / authorization function of the existing service.

Further, the integrated authentication device 12 includes a collection unit 123 that collects and encrypts service account information from each service providing device 2. As a result, the user U can save the trouble of manually setting the service account information.

Further, the integrated authorization unit 111 causes the service providing device 2 that provides the service selected by the user U to authenticate the user U after the integrated authentication device 12 authenticates the user U. As a result, only the service used by the user U is authenticated, so that the load of the authentication process can be reduced.

Further, the plurality of service providing devices 2 are configured by a multi-tenant in the cloud service. As a result, in the cloud service, the user U can use a plurality of services with one authentication without modifying the authentication / authorization function of the existing service.

Embodiment 2.
The second embodiment is different from the first embodiment in that the integrated authentication information and the encryption service account information are stored separately. In the following, the same components as those of the service integrated authentication / authorization system 1 according to the first embodiment are designated by the same reference numerals and the description thereof will be omitted, and the configurations different from the service integrated authentication / authorization system 1 according to the first embodiment will be mainly described. It shall be explained to.

FIG. 11 is a diagram showing a configuration example of the service integrated authentication / authorization system and the service providing device according to the second embodiment of the present invention. As shown in FIG. 11, the information processing system 100A according to the second embodiment includes a service integrated authentication / authorization system 1A, service providing devices _{2 1} and 22 and a terminal device 3. In the example shown in FIG. 11, only one terminal device 3 is shown, but as in the first embodiment, a plurality of terminal devices 3 are provided.

The service integrated authentication / authorization system 1A includes an integrated authorization device 11 and an integrated authentication device 12A. The integrated authentication device 12A differs from the integrated authentication device 12 shown in FIG. 2 in that it has an integrated information storage unit 124 and an authentication information storage unit 122A in place of the authentication information storage unit 122 shown in FIG.

The integrated information storage unit 124 stores the integrated authentication information of each user U. The integrated authentication unit 121 performs integrated authentication of the user U based on the integrated authentication information stored in the integrated information storage unit 124.

FIG. 12 is a diagram showing an example of the integrated authentication table according to the second embodiment. As shown in FIG. 12, the integrated authentication table 53 stored in the integrated information storage unit 124 includes information in which the “integrated user ID” and the “integrated user PW” are associated with each other. The integrated authentication unit 121 performs integrated authentication of the user U based on the integrated authentication information included in the integrated authentication table 53.

The authentication information storage unit 122A stores the encryption service account information of each user U. When the integrated authentication device 12A succeeds in the integrated authentication, the integrated authorization device 11 acquires the encryption service account information stored in the authentication information storage unit 122A. The integrated authorization device 11 decrypts the acquired encrypted service account information into service account information, and transmits the decrypted service account information to the service providing device 2.

FIG. 13 is a diagram showing an example of a service account table according to the second embodiment. As shown in FIG. 13, in the service account table 54 stored in the authentication information storage unit 122A, the "integrated user ID", the "service URL", the "encrypted service account information", and the "decryption key" are associated with each other. Includes information.

The acquisition unit 112 acquires the encrypted service account information of the access user from the service account table 54, and the decryption unit 113 decrypts the encrypted service account information acquired by the acquisition unit 112 into the service account information. The integrated authorization unit 111 causes the service providing device 2 to execute the service authentication by using the service account information decrypted by the decryption unit 113.

FIG. 14 is a flowchart showing an example of the integrated authentication process according to the second embodiment. Since the processing of steps S21 to S24 shown in FIG. 14 is the same as the processing of steps S21 to S24 shown in FIG. 7, the description thereof will be omitted.

The integrated authentication unit 121 compares the integrated login information determined in step S24 with the integrated authentication information stored in the integrated information storage unit 124 (step S25A). Then, the integrated authentication unit 121 determines whether or not the integrated authentication, which is the authentication of the access user, has succeeded based on the result of the comparison in step S25A (step S26A). In step S26A, if the integrated authentication information matching the integrated login information is stored in the integrated information storage unit 124, the integrated authentication unit 121 determines that the integrated authentication was successful, and the integrated authentication information matching the integrated login information. Is not stored in the integrated information storage unit 124, it is determined that the integrated authentication has failed.

When it is determined that the integrated authentication is successful (step S26A: Yes), the integrated authentication unit 121 holds the integrated user ID of the access user determined to have been acquired in step S24 (step S27). Further, when the integrated authentication unit 121 determines that the access user has been authenticated (step S22), the integrated authentication unit 121 refers to the cookie information of the access user and holds the integrated user ID (step S27).

FIG. 15 is a flowchart showing an example of the service authentication process according to the second embodiment. Since the processes of steps S31 to S34 and S36 to S38 shown in FIG. 15 are the same as the processes of steps S31 to S34 and S36 to S38 shown in FIG. 8, the description thereof will be omitted.

In step S35A, the acquisition unit 112 acquires the encryption service account information and the decryption key associated with the integrated user ID held in step S27 and the selected service from the authentication information storage unit 122A. The encrypted service account information acquired by the acquisition unit 112 is decrypted into the service account information by the decryption unit 113, and is transmitted to the service providing device 2 that provides the selected service.

The hardware configuration example of the service integrated authentication / authorization system 1A according to the second embodiment is the same as the service integrated authentication / authorization system 1 according to the first embodiment. For example, the processor 101 shown in FIG. 10 can execute the functions of the integrated authorization device 11 and the integrated authentication device 12A by reading and executing the program stored in the memory 102.

As described above, the service integrated authentication / authorization system 1A according to the second embodiment includes an integrated information storage unit 124 for storing the integrated authentication information of the user U and an authentication information storage unit 122A for performing integrated authentication. The integrated authentication unit 121 performs integrated authentication based on the integrated authentication information stored in the integrated information storage unit 124. Further, the integrated authorization unit 111 provides each service with the authentication of the user U for which the integrated authentication has been performed, based on the service account information generated by decrypting the encrypted service account information stored in the authentication information storage unit 122A. Let device 2 execute. As a result, the integrated authentication information and the encryption service account information can be managed separately, so that the terminal device 3 and each service providing device 2 can be linked with each other in a state where the security is strengthened.

Embodiment 3.
The third embodiment is different from the first embodiment in that the integrated authentication process is performed using the device in which the security key is stored, and the user manually inputs the user ID and the user PW. In the following, the same components as those of the service integrated authentication / authorization system 1 according to the first embodiment are designated by the same reference numerals and the description thereof will be omitted, and the configurations different from the service integrated authentication / authorization system 1 according to the first embodiment will be mainly described. It shall be explained to.

FIG. 16 is a diagram showing a configuration example of the service integrated authentication / authorization system and the service providing device according to the third embodiment of the present invention. As shown in FIG. 16, the information processing system 100B according to the second embodiment includes a service integrated authentication / authorization system 1B, service providing devices _{2 1} and 22 and a terminal device 3. A device 5 in which a security key is stored is connected to the terminal device 3. The device 5 is, for example, a dongle connected to the terminal device 3 via USB (Universal Serial Bus). In the example shown in FIG. 16, only one terminal device 3 is shown, but a plurality of terminal devices 3 are provided as in the first embodiment.

The service integrated authentication / authorization system 1B includes an integrated authorization device 11 and an integrated authentication device 12B. The integrated authentication device 12B differs from the integrated authentication device 12 shown in FIG. 2 in that it has an authentication information storage unit 122B instead of the authentication information storage unit 122 shown in FIG.

FIG. 17 is a diagram showing an example of the authentication / authorization table according to the third embodiment. As shown in FIG. 17, the authentication authorization table 55 stored in the authentication information storage unit 122B is information in which a "security key", a "service URL", an "encryption service account information", and a "decryption key" are associated with each other. including. The "security key" is a unique security key stored in the device 5, and is used as authentication information when logging in to the service integrated authentication / authorization system 1B. Such a security key is an example of integrated authentication information.

Here, the integrated authentication process by the service integrated authentication authorization system 1B will be described. The integrated authentication process by the service integrated authentication / authorization system 1B is the same process as the integrated authentication process by the service integrated authentication / authorization system 1 shown in FIG. 7, except that the integrated authentication information is a security key.

When the terminal device 3 to which the device 5 is connected receives the information on the integrated login screen from the service integrated authentication / authorization system 1B, the security key stored in the device 5 is read from the device 5, and the read security key is used for the service integrated authentication / authorization. Send to system 1B. The terminal device 3 can also transmit the security key to the service integrated authentication / authorization system 1B without receiving the information on the integrated login screen. The integrated authentication unit 121 determines whether or not the security key has been acquired from the terminal device 3 in step S24 shown in FIG. When the integrated authentication unit 121 determines that the security key has been acquired (step S24: Yes), the integrated authentication unit 121 compares the security key determined to have been acquired in step S24 with the security key stored in the authentication information storage unit 122B (step S24: Yes). S25).

The integrated authentication unit 121 determines whether or not the integrated authentication, which is the authentication of the access user, has succeeded based on the result of the comparison in step S25 (step S26). In step S26, when the integrated security key matching the security key determined to be acquired in step S24 is stored in the authentication information storage unit 122B, the integrated authentication unit 121 succeeds in the integrated authentication which is the authentication of the access user. If the integrated security key that matches the security key determined to be acquired in step S24 is not stored in the authentication information storage unit 122B, it is determined that the integrated authentication has failed.

The hardware configuration example of the service integrated authentication / authorization system 1B according to the third embodiment is the same as the service integrated authentication / authorization system 1 according to the first embodiment. For example, the processor 101 shown in FIG. 10 can execute the functions of the integrated authorization device 11 and the integrated authentication device 12B by reading and executing the program stored in the memory 102.

Further, the integrated authentication device 12B may be configured to separately store the security key, which is an example of the integrated authentication information, and the encryption service account information, as in the integrated authentication device 12A of the second embodiment. That is, the integrated authentication device 12B replaces the authentication information storage unit 122B with an integrated information storage unit that stores a security key and an integrated user ID, and an authentication that stores an integrated user ID, an encryption service account information, and a decryption key. It may be configured to include an information storage unit.

As described above, the integrated authentication unit 121 according to the third embodiment has the integrated authentication stored in the security key and the authentication information storage unit 122B transmitted from the terminal device 3 to which the device 5 in which the security key is stored is connected. Integrated authentication is performed by comparing with the security key, which is an example of information. As a result, for example, an authentication operation by an external USB device such as a dongle becomes possible, and it is not necessary to manage the user ID and password. In addition, security can be enhanced because authentication using a unique security key is possible. In addition, as in the first embodiment, it may be combined with the method of inputting the user ID and the password, which can further enhance the security.

Embodiment 4.
The fourth embodiment is different from the first embodiment in that the user manually inputs the user ID and the user PW in that the integrated authentication process is performed by biometrics. In the following, the same components as those of the service integrated authentication / authorization system 1 according to the first embodiment are designated by the same reference numerals and the description thereof will be omitted, and the configurations different from the service integrated authentication / authorization system 1 according to the first embodiment will be mainly described. It shall be explained to.

FIG. 18 is a diagram showing a configuration example of the service integrated authentication / authorization system and the service providing device according to the fourth embodiment of the present invention. As shown in FIG. 18, the information processing system 100C according to the second embodiment includes a service integrated authentication / authorization system 1C, service providing devices _{2 1} and 22 and a terminal device 3. A biometrics device 6 for detecting the body characteristic information of the user U is connected to the terminal device 3.

The biometrics device 6 is connected to the terminal device 3 by USB, for example, but may be built in the terminal device 3. The biometrics device 6 acquires, for example, physical characteristic information which is at least one information of the fingerprint, face, iris, voiceprint, and palm shape of the user U as the user-specific physical characteristic information of the user U. In the example shown in FIG. 18, only one terminal device 3 is shown, but a plurality of terminal devices 3 are provided as in the first embodiment.

The service integrated authentication / authorization system 1C includes an integrated authorization device 11 and an integrated authentication device 12C. The integrated authentication device 12C is different from the integrated authentication device 12 shown in FIG. 2 in that it has the authentication information storage unit 122C instead of the authentication information storage unit 122 shown in FIG.

FIG. 19 is a diagram showing an example of the authentication / authorization table according to the fourth embodiment. As shown in FIG. 19, in the authentication authorization table 56 stored in the authentication information storage unit 122C, the "user-specific physical feature information", the "service URL", the "encrypted service account information", and the "decryption key" are mutually exclusive. Contains associated information. The "user-specific physical feature information" is, for example, at least one piece of information about the fingerprint, face, iris, voiceprint, and palm shape of the user U, and is used as authentication information when logging in to the service integrated authentication / authorization system 1C. Such user-specific physical characteristic information is an example of integrated authentication information.

Here, the integrated authentication process by the service integrated authentication authorization system 1C will be described. The integrated authentication process by the service integrated authentication / authorization system 1C is the same process as the integrated authentication process by the service integrated authentication / authorization system 1 shown in FIG. 7, except that the integrated authentication information is the user-specific physical characteristic information.

When the terminal device 3 to which the biometrics device 6 is connected receives the information on the integrated login screen from the service integrated authentication / authorization system 1C, the user-specific physical characteristic information output from the biometrics apparatus 6 is sent to the service integrated authentication / authorization system 1C. Send. The terminal device 3 can also transmit the user-specific physical feature information to the service integrated authentication / authorization system 1B without receiving the information on the integrated login screen. The integrated authentication unit 121 determines whether or not the user-specific physical feature information has been acquired from the terminal device 3 in step S24 shown in FIG. When the integrated authentication unit 121 determines that the user-specific body feature information has been acquired (step S24: Yes), the user who has determined that the user-specific body feature information has been acquired in step S24 is stored in the authentication information storage unit 122C. Compare with the intrinsic body characteristic information (step S25).

The integrated authentication unit 121 determines whether or not the integrated authentication, which is the authentication of the access user, has succeeded based on the result of the comparison in step S25 (step S26). In step S26, the integrated authentication unit 121 authenticates the access user when the user-specific body feature information matching the user-specific body feature information determined to be acquired in step S24 is stored in the authentication information storage unit 122C. Judge that the integrated authentication was successful. The integrated authentication unit 121 determines that the integrated authentication has failed when the user-specific body feature information matching the user-specific body feature information determined to be acquired in step S24 is not stored in the authentication information storage unit 122C.

The hardware configuration example of the service integrated authentication / authorization system 1C according to the fourth embodiment is the same as the service integrated authentication / authorization system 1 according to the first embodiment. For example, the processor 101 shown in FIG. 10 can execute the functions of the integrated authorization device 11 and the integrated authentication device 12C by reading and executing the program stored in the memory 102.

Further, the integrated authentication device 12C has a configuration in which the user-specific physical feature information and the encryption service account information, which are examples of the integrated authentication information, are separately stored, as in the integrated authentication device 12A of the second embodiment. May be good. That is, instead of the authentication information storage unit 122C, the integrated authentication device 12C stores the integrated information storage unit that stores the user-specific physical feature information and the integrated user ID, the integrated user ID, the encryption service account information, and the decryption key. It may be configured to include an authentication information storage unit to be stored.

As described above, the integrated authentication unit 121 according to the fourth embodiment is the physical characteristic information of the user U acquired by the biometrics device 6 and transmitted from the terminal device 3, and the integrated authentication information stored in the authentication information storage unit 122C. Integrated authentication is performed by comparing with the user-specific physical characteristic information, which is an example. As a result, the authentication operation by biometrics becomes possible, and it is not necessary to manage the user ID and password. In addition, since authentication based on user-specific physical characteristic information is possible, security can be enhanced. In addition, as in the first embodiment, it may be combined with the method of inputting the user ID and the password, which can further enhance the security.

Embodiment 5.
In the fifth embodiment, before the user selects a service, a plurality of service providing devices are made to authenticate the user of the terminal device, a service user ID and a service user PW are used as integrated authentication information, and a service is used. It differs from the first embodiment in that the process for migrating the service providing device to be provided to the cloud is performed. In the following, the same components as those of the service integrated authentication / authorization system 1 according to the first embodiment are designated by the same reference numerals and the description thereof will be omitted, and the configurations different from the service integrated authentication / authorization system 1 according to the first embodiment will be mainly described. It shall be explained to.

FIG. 20 is a diagram showing a configuration example of the service integrated authentication / authorization system and the service providing device according to the fifth embodiment of the present invention. As shown in FIG. 20, the information processing system 100D according to the fifth embodiment includes a service integrated authentication / authorization system 1D, a service providing device 2 ₁ , 2 ₂ , 7 ₁ , 7 ₂ , and _a plurality of terminal devices 31 ,. 3 ₂ , ..., 3 _n is provided.

The service providing device 7 ₁ provides the service A, and the service providing device 7 ₂ provides the service B. In the information processing system 100D according to the fifth embodiment, the provision of services A and B is in the process of shifting from the service providing devices 7 ₁ and 72 to the service providing devices _{2 1} and ₂₂ . Hereinafter, when each of the service providing devices 7 ₁ and 7 ₂ is shown without distinction, it may be described as the service providing device 7.

When the service providing device 7 is accessed from the terminal device 3, the service providing device 7 transmits the information on the login screen to the terminal device 3. The user U of the terminal device 3 operates the terminal device 3 to input the service account information including the service user ID and the service user PW on the login screen, and causes the terminal device 3 to transmit the service account information to the service providing device 7. When the service authentication is successful with the service account information transmitted from the terminal device 3, the service providing device 7 includes the authenticated service account information and transfers the redirect information to the terminal device 3 with the service integrated authentication / authorization system 1D as the access destination. Send. When the terminal device 3 acquires the redirect information from the service providing device 7, the terminal device 3 transmits a request based on the redirect information to the service integrated authentication / authorization system 1D. Such request includes the service account information contained in the redirect information.

The service integrated authentication / authorization system 1D includes an integrated authorization device 11D and an integrated authentication device 12D. The integrated authorization device 11D includes an integrated authorization unit 111D in place of the integrated authorization unit 111 shown in FIG. The integrated authorization unit 111D performs a process of causing a plurality of service providing devices 2 to authenticate the user U before the user U selects a service, and provides the service from the service providing devices 7 ₁ and 7 ₂ to the service providing device 2 ₁ , 22 is different from the processing of the integrated authorization unit 111 shown in FIG. 2 in that the processing for shifting to ₂ is performed.

The integrated authentication device 12D differs from the integrated authentication device 12 shown in FIG. 2 in that it has an integrated authentication unit 121D and an authentication information storage unit 122D in place of the integrated authentication unit 121 and the authentication information storage unit 122 shown in FIG. The integrated authentication unit 121D differs in that, in addition to the processing of the integrated authentication unit 121, processing for shifting the service provision from the service providing devices 7 ₁ and 72 to the service providing devices _{2 1} and ₂₂ is performed.

The authentication information storage unit 122D differs from the authentication information storage unit 122 shown in FIG. 2 in that the service user ID and the service user PW are stored as integrated authentication information. FIG. 21 is a diagram showing an example of the authentication / authorization table according to the fifth embodiment. As shown in FIG. 21, in the authentication authorization table 57 stored in the authentication information storage unit 122D, the "integrated authentication information", the "service URL", the "encryption service account information", and the "decryption key" are associated with each other. Includes information.

In the authentication / authorization table 57, one service account information selected from the services available to the user U is set as the "integrated authentication information". Specifically, the service user ID selected by the user U is set as the integrated user ID, and the integrated user PW selected by the user U is set as the service user PW.

Next, the operation of the service integrated authentication / authorization system 1D will be described in more detail. FIG. 22 is a flowchart showing an example of the processing of the service integrated authentication / authorization system according to the first embodiment, which is repeatedly executed by the service integrated authentication / authorization system 1D. Since the processes of steps S53 to S55 and S57 to S59 shown in FIG. 22 are the same as the processes of steps S21 to S26 shown in FIG. 7, some description thereof will be omitted.

As shown in FIG. 22, when the integrated authorization unit 111D of the integrated authorization device 11D in the service integrated authentication authorization system 1D determines that there is access from the terminal device 3 in the process of step S51 (step S51: Yes), the terminal It is determined whether or not the access of the device 3 is a request based on the redirect information from the service providing device 7 (step S52).

When the integrated authorization unit 111D determines that the request is not based on the redirect information (step S52: No), the integrated authorization unit 111D proceeds to the process of step S53. Further, when it is determined that the request is based on the redirect information (step S52: Yes), the migration process is performed (step S61). The process of step S61 is the process of steps S81 to S83 shown in FIG. 24, and will be described in detail later.

In the process of step S55, when the integrated authentication unit 121D transmits the information of the integrated login screen to the terminal device 3 via the integrated authorization unit 111D, the integrated login screen is displayed on the terminal device 3. On the login screen, in addition to the input box for inputting the integrated authentication information, a button for setting the integrated authentication information is arranged. When the user U of the terminal device 3 operates the setting button on the integrated login screen, the terminal device 3 sends a request for setting the integrated authentication information to the service integrated authentication authorization system 1D.

The integrated authentication unit 121D determines whether or not there is a request to set the integrated authentication information from the terminal device 3 of the access user via the integrated authentication unit 111D (step S56). When the integrated authentication unit 121D determines that there is a request to set the integrated authentication information (step S56: Yes), the integrated authentication information setting process is performed (step S62). The process of step S62 is the process of steps S91 to S97 shown in FIG. 25, which will be described in detail later.

When the integrated authentication unit 121D determines that there is no request to set the integrated authentication information (step S56: No), the integrated authentication unit 121D shifts the process to step S57. When the integrated authentication unit 121D determines that the integrated login information has not been acquired (step S57: No), the integrated authentication unit 121D proceeds to the process of step S56.

When the integrated authentication unit 121D determines that the integrated authentication has failed (step S59: No), the service integrated authentication authorization system 1D shifts the process to step S55. Further, the service integrated authentication / authorization system 1D determines that the integrated authentication is successful by the integrated authentication unit 121D (step S59: Yes), or determines that the access user has been authenticated (step S54: Yes). ), The service authentication process is performed (step S60). When the service authentication process is completed, the service integrated authentication / authorization system 1D ends the process shown in FIG. 22. The service integrated authentication / authorization system 1D can also perform the process of step S60 after the process of step S61 is completed.

Here, the service authentication process in step S60 will be described. FIG. 23 is a flowchart showing an example of the service authentication process according to the fifth embodiment. The processing of steps S70, S74, S75, S76, S78, S79, and S80 of FIG. 23 is the same processing as the processing of steps S33, S38, S31, S32, S31, S32, and S34 shown in FIG. The explanation is omitted.

The integrated authentication unit 121D determines whether or not the authentication information storage unit 122D has the encryption service account information of the access user (step S70). When the integrated authentication unit 121D determines that the encryption service account information exists (step S70: Yes), the acquisition unit 112 includes all the encryption service account information and the decryption key associated with the integrated user ID of the access user. (Step S71). The decryption unit 113 decrypts the encryption service account information acquired by the acquisition unit 112 into the encryption service account information by using the decryption key acquired by the acquisition unit 112 (step S72).

The integrated authorization unit 111D stores the service account information decrypted by the decryption unit 113 in a request and transmits it to the service providing device 2 corresponding to each service account information (step S73). The integrated authorization unit 111D determines whether or not the service authentication is successful based on the information transmitted from the service providing device 2 in response to the request transmitted in step S73 (step S74).

When the integrated authentication unit 121D determines that the service authentication is successful by the integrated authorization unit 111D (step S74: Yes), the integrated authentication unit 121D transmits the information on the service selection screen to the access user's terminal device 3 via the integrated authorization unit 111D (step S74: Yes). Step S75). Then, the integrated authentication unit 121D determines whether or not the access user has selected the service (step S76). When the integrated authentication unit 121D determines that the access user has selected the service (step S76: Yes), the integrated authentication unit 121D transmits information on the usage screen from the service providing device 2 that provides the service selected by the access user to the terminal device 3. (Step S77).

When the integrated authentication unit 121D determines that there is no encrypted service account information by the integrated authorization unit 111D (step S70: No), the integrated authentication unit 121D transmits the information on the service selection screen to the access user's terminal device 3 via the integrated authorization unit 111D. (Step S78). Then, the integrated authentication unit 121D determines whether or not the access user has selected the service (step S79). When it is determined that the access user has selected the service (step S79: Yes), the integrated authentication unit 121D executes the encryption service account process for generating and storing the encryption service account (step S80).

When the process of step S77 is completed or the process of step S80 is completed, the service integrated authentication / authorization system 1D ends the process shown in FIG. 23. In the above-mentioned example, the integrated authentication unit 121D authenticates all the services available to the access user before the user U is selected, but the present invention is not limited to this example.

For example, the integrated authorization device 11D can authenticate only the services frequently used by the user U before the user U is selected. In this case, the integrated authorization unit 111D has information on the access history of each user U, determines a predetermined number of services in descending order of frequency of use, and only the determined services are before the access user is selected. Can be authenticated. In this case, the acquisition unit 112 acquires the encryption service account information of a predetermined number of services in descending order of frequency of use by the access user. The usage frequency of the user U may be the usage frequency of each user U or the usage frequency of the entire user U.

Further, the integrated authorization unit 111D can change the predetermined number described above according to the processing load of the service integrated authentication authorization system 1D or the integrated authorization device 11D. For example, the integrated authorization unit 111D can reduce the predetermined number as described above as the processing load of the service integrated authentication authorization system 1D or the integrated authorization device 11D increases. This makes it possible to prevent the processing load of the service integrated authentication authorization system 1D or the integrated authorization device 11D from becoming too high.

Further, the integrated authorization unit 111D can change the predetermined number described above based on the service usage frequency, which is the frequency of using the service provided by the service providing device 2 for each user U or for the entire user U. .. For example, the integrated authorization unit 111D can reduce the predetermined number as described above as the service usage frequency becomes lower. This also prevents the processing load of the service integrated authentication authorization system 1D or the integrated authorization device 11D from becoming too high.

Further, the integrated authorization unit 111D performs the service authentication process shown in FIG. 23 for the access user whose service usage frequency is equal to or higher than the threshold value, and performs the service authentication process shown in FIG. 8 for the access user whose service usage frequency is less than the threshold value. You can also do it. This also prevents the processing load of the service integrated authentication authorization system 1D or the integrated authorization device 11D from becoming too high.

The service integrated authentication / authorization system 1D can also execute the processes of steps S71 to S74 shown in FIG. 23 and the processes of steps S75 and S76 in parallel.

Next, the transition process in step S61 will be described. FIG. 24 is a flowchart showing an example of the transition process according to the fifth embodiment. As shown in FIG. 24, the integrated authentication unit 121D acquires the service account information included in the request of the terminal device 3 via the integrated authorization unit 111D (step S81).

The acquisition unit 112 encrypts the service account information acquired by the integrated authentication unit 121D to generate the encrypted service account information (step S82), and stores the generated encrypted service account information in the authentication information storage unit 122D (step S82). Step S83). When the process of step S83 is completed, the service integrated authentication / authorization system 1D ends the process shown in FIG. 24.

Next, the integrated authentication information setting process in step S62 will be described. FIG. 25 is a flowchart showing an example of the integrated authentication information setting process according to the fifth embodiment. As shown in FIG. 25, the integrated authentication unit 121D transmits the information on the input screen for inputting the service account information to the terminal device 3 of the access user via the integrated authorization unit 111D (step S91).

As a result, the input screen is displayed on the terminal device 3 of the access user. The input screen is a screen for causing the access user to input the service account information including the service user ID and the service user PW. The access user operates the terminal device 3 to input the service account information on the input screen, and causes the terminal device 3 to transmit the integrated login information to the service integrated authentication / authorization system 1D.

When the integrated authentication unit 121D acquires the service account information from the terminal device 3, the integrated authentication unit 121D transmits a request including the service account information from the terminal device 3 to the service providing device 2 via the integrated authorization unit 111D (step S92). Based on the information transmitted from the service providing device 2 in response to the request transmitted in step S92, the integrated authorization unit 111D determines whether or not the service authentication has succeeded by the same processing as the processing in step S38 described above. Determination (step S93).

When it is determined that the service authentication is successful (step S93: Yes), the integrated authentication unit 121D sets the service account information acquired from the terminal device 3 in the authentication information storage unit 122D as the integrated authentication information (step S94). Further, the collecting unit 123 encrypts the service account information acquired by the integrated authentication unit 121D to generate the encrypted service account information (step S95), and stores the generated encrypted service account information in the authentication information storage unit 122D. (Step S96).

When the integrated authentication unit 121D determines that the authentication has failed (step S93: No), the integrated authentication unit 121D transmits the error screen information to the access user's terminal device 3 via the integrated authorization unit 111D (step S97). The service integrated authentication / authorization system 1D ends the process shown in FIG. 25 when the process of step S96 is completed or when the process of step S97 is completed.

The hardware configuration example of the service integrated authentication / authorization system 1D according to the fifth embodiment is the same as that of the service integrated authentication / authorization system 1 according to the first embodiment. For example, the processor 101 shown in FIG. 10 can execute the functions of the integrated authorization device 11D and the integrated authentication device 12D by reading and executing the program stored in the memory 102.

Further, the integrated authentication device 12D may be configured to separately store the integrated authentication information and the encryption service account information, as in the integrated authentication device 12A of the second embodiment. That is, the integrated authentication device 12D replaces the authentication information storage unit 122D with an integrated information storage unit that stores the integrated authentication information, and an authentication information storage unit that stores the integrated user ID, the encryption service account information, and the decryption key. It may be a configuration including. Further, the integrated authentication information may be a security key or physical characteristic information of the user U.

As described above, the integrated authorization unit 111D of the service integrated authentication authorization system 1D according to the fifth embodiment has the user of the terminal device 3 on the plurality of service providing devices 2 after the integrated authentication and before the service selection by the user U. Authenticate U. As a result, the user U of the terminal device 3 can quickly use the service provided by the service providing device 2.

Further, in the service integrated authentication / authorization system 1D according to the fifth embodiment, the integrated authentication unit 121D acquires the service account information included in the request of the terminal device 3. Then, the collecting unit 123 encrypts the service account information acquired by the integrated authentication unit 121D to generate the encrypted service account information. The generated encryption service account information is stored in the authentication information storage unit 122D. As a result, the service provided by the service providing device 7 outside the cloud service platform 10 can be easily transferred to the service providing device 2 of the cloud service platform 10.

Further, in the service integrated authentication / authorization system 1D according to the fifth embodiment, the integrated authentication unit 121D sets the service account information of the service selected by the user U as the integrated authentication information. Thereby, the user U can use a plurality of services, for example, by using the service account information of the service mainly used.

Further, in the service integrated authentication / authorization system 1 according to the above-described first embodiment, the integrated authorization device 11 and the integrated authentication device 12 are configured separately, but the integrated authorization device 11 and the integrated authentication device 12 are integrated. It may be configured in. This also applies to the service integrated authentication and authorization systems 1A, 1B, 1C, and 1D.

The configuration shown in the above-described embodiment shows an example of the content of the present invention, can be combined with another known technique, and is one of the configurations as long as it does not deviate from the gist of the present invention. It is also possible to omit or change the part.

1,1A, _1B , _1C , 1D service integrated authentication and authorization system, 2,2 1,2 _2,7,7 1,7 ₂ service providing device, 3,3 _{1,3 2} , ..., _3n terminal device 4 networks, 5 devices, 6 biometrics devices, 10 cloud service platforms, 11, 11D integrated authorization device, 12, 12A, 12B, 12C, 12D integrated authentication device, 21,21 ₁ , 211 ₂ service authentication authorization unit, 22 , 22 ₁ , 22 ₂ Service provider, 23, 23 ₁ , 23 ₂ Service authentication information storage unit, 50, 55, 56, 57 Authentication authorization table, 51, 52, 54 Service account table, 53 Integrated authentication table, 100, 100A, 100B, 100C, 100D Information processing system, 111,111D integrated authorization unit, 112 acquisition unit, 113 decoding unit, 121,121D integrated authentication unit, 122, 122A, 122B, 122C, 122D authentication information storage unit, 123 collection unit , 124 Integrated information storage.

Claims (7)

It is equipped with an integrated authentication device that authenticates the user, and an integrated authorization device that links the terminal device of the user and each service providing device based on the result of authentication by the integrated authentication device.
The integrated authentication device is
An integrated authentication unit that authenticates the user based on the authentication information transmitted from the terminal device of the user, and
It is provided with an authentication information storage unit for storing encrypted information obtained by encrypting service account information which is account information of the user in the service provided by each service providing device.
The integrated authorization device is
An acquisition unit that acquires the encryption information from the integrated authentication device,
A decryption unit that decrypts the encrypted information into the service account information,
It is provided with an integrated authorization unit that causes each service providing device to authenticate the user of the terminal device that has been authenticated by the integrated authentication unit based on the decrypted service account information .
The integrated approval department
After the authentication is performed by the integrated authentication unit, a predetermined number of services are determined in descending order of frequency of use of the integrated authenticated user who is the user authenticated by the integrated authentication unit, and the determined services are determined. The service providing device to be provided is made to authenticate the integrated authenticated user before the integrated authenticated user selects the service.
A service integrated certification authorization system characterized by that. The integrated authentication device is
The service integrated authentication / authorization system according to claim 1, further comprising a collecting unit that collects and encrypts the service account information from each service providing device. It is provided with an integrated information storage unit that stores the user's authentication information.
The integrated certification unit is
The service integrated authentication / authorization system according to claim 1 or 2, wherein the user is authenticated based on the authentication information transmitted from the terminal device and the authentication information stored in the integrated information storage unit. .. The integrated certification unit is
Claims 1 to 3 characterized in that the user is authenticated using the security key transmitted from the terminal device to which the device in which the security key is stored is connected as authentication information transmitted from the terminal device. Service integrated certification authorization system described in any one of. The integrated certification unit is
Any of claims 1 to 3, wherein the user is authenticated by using the physical characteristic information of the user acquired by the biometrics device and transmitted from the terminal device as authentication information transmitted from the terminal device. The service integrated certification and authorization system described in one. The service integrated authentication / authorization system according to any one of claims 1 to 5 , wherein the plurality of service providing devices are configured by a multi-tenant in a cloud service. A method of integrated service authentication and authorization performed by a computer.
An integrated authentication step that authenticates the user based on the authentication information transmitted from the user's terminal device, and
After the authentication of the user, the acquisition step of acquiring the encrypted information from the authentication information storage unit that stores the encrypted information obtained by encrypting the service account information which is the account information of the user in the service provided by each service providing device. ,
A decryption step for decrypting the acquired encrypted information into service account information, and
Including an integrated authorization step of causing each service providing device to authenticate a user authenticated by the authentication information based on the decrypted service account information.
The integrated authorization step is
After the authentication is performed by the integrated authentication step, a predetermined number of services are determined in descending order of frequency of use of the integrated authenticated user who is the user authenticated by the integrated authentication step, and the determined services are determined. The service providing device to be provided is made to authenticate the integrated authenticated user before the integrated authenticated user selects the service.
A service integrated authentication authorization method characterized by that.

Images