COMPUTER READABLE MEDIUM, AUTHENTICATING METHOD, COMPUTER DATA SIGNAL, AUTHENTICATION SERVER, AND SINGLE SIGN-ON AUTHENTICATION SYSTEM

• US 20080148376A1
• Filed: 05/18/2007
• Published: 06/19/2008
• Est. Priority Date: 12/19/2006
• Status: Active Grant

• Current Assignee: Fujifilm Business Innovation Corp. (Fujifilm Holdings Corporation)
• Original Assignee: Fuji Xerox Company Limited (Xerox Holdings Corp.)
• Inventors: WATANABE, Yutaka, ONOZAWA, Hiroshi
• Granted Patent: US 8,522,331 B2
• Time in Patent Office: Days
• US Class Current: 726/8
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A computer readable medium storing a program causing a computer to execute a process for authenticating a user in a site included in an authentication system in which a plurality of sites are linked each other, the process comprising: receiving authentication information; authenticating the user in a first site of the authentication system based on the received authentication information; receiving suspicious behavior information of the user; registering the received suspicious behavior information; determining reliability of the user based on the suspicious behavior information registered in registering of the behavior information registration; in a case where the user accesses a second site of the authentication system, adding the reliability of the user determined, and transmitting the authentication information to which the reliability is added to the second site; and determining a function to be provided to the user in the first site based on the reliability of the user.

Claims

1. A computer readable medium storing a program causing a computer to execute a process for authenticating a user in a site included in an authentication system in which a plurality of sites are linked each other, the process comprising:

receiving authentication information;

authenticating the user in a first site of the authentication system based on the received authentication information;

receiving suspicious behavior information of the user;

registering the received suspicious behavior information;

determining reliability of the user based on the suspicious behavior information registered in registering of the behavior information registration;

in a case where the user accesses a second site of the authentication system, adding the reliability of the user determined in the determining of the reliability to the authentication information received in the authenticating of the user, and transmitting the authentication information to which the reliability is added to the second site; and

determining a function to be provided to the user in the first site based on the reliability of the user.

2. The computer readable medium as claimed in claim 1, wherein the authenticating of the user determines, in a case where the reliability is added to the received authentication information, whether or not the reliability is at a level which permits the user'"'"'s login to the first site, and avoids authenticating in a case where the reliability is determined not to be at the level which permits the user'"'"'s login.

3. The computer readable medium as claimed in claim 1, wherein the determining of the function determines a function to be provided to the user based on the reliability determined in the determining of the reliability, in a case where the reliability is not added to authentication information received in the receiving of the authentication information.

4. The computer readable medium as claimed in claim 1, wherein the determining of the function determines, in a case where the reliability is added to authentication information received in the receiving of the authentication information, a function to be provided to the user based on a lower one of the added reliability and the reliability that is determined in the determining of the reliability.

5. The computer readable medium as claimed in claim 1, wherein the determining of the function determines an alternative function as a function to be provided to the user in a case where the determining of the function determines that a function requested by the user cannot be provided based on the reliability of the user and where the alternative function is available.

6. The computer readable medium as claimed in claim 1, wherein suspicious behavior of the user which is to be included in the suspicious behavior information is defined in advance, and at least one of:

about accessing time;

about accessing terminal;

about user ID and password;

about information to be accessed in a site; and

about delivery address.

7. The computer readable medium as claimed in claim 1, wherein the reliability of the user represents a degree of which the user who has logged in does not perform a suspicious behavior, and is calculated based on suspicion levels which are set in association with suspicious behavior.

8. An authenticating method for authenticating a user in a site included in an authentication system in which a plurality of sites are linked each other, the method comprising:

receiving authentication information;

authenticating the user in a first site of the authentication system based on the received authentication information;

receiving suspicious behavior information of the user;

registering the received suspicious behavior information;

determining reliability of the user based on the suspicious behavior information registered in registering of the behavior information registration;

in a case where the user accesses a second site of the authentication system, adding the reliability of the user determined in the determining of the reliability to the authentication information received in the authenticating of the user, and transmitting the authentication information to which the reliability is added to the second site; and

determining a function to be provided to the user in the first site based on the reliability of the user.

9. A computer data signal embodied in a carrier wave for enabling a computer to perform a process for authenticating a user in a site included in an authentication system in which a plurality of sites are linked each other, the process comprising:

receiving authentication information;

authenticating the user in a first site of the authentication system based on the received authentication information;

receiving suspicious behavior information of the user;

registering the received suspicious behavior information;

determining reliability of the user based on the suspicious behavior information registered in registering of the behavior information registration;

in a case where the user accesses a second site of the authentication system, adding the reliability of the user determined in the determining of the reliability to the authentication information received in the authenticating of the user, and transmitting the authentication information to which the reliability is added to the second site; and

determining a function to be provided to the user in the first site based on the reliability of the user.

10. An authentication server included in an authentication system in which a plurality of sites linked each other, the server comprising:

an authentication unit that receives authentication information, and that authenticates a user in a first site of the authentication system based on the received authentication information;

a behavior information registration unit that receives suspicious behavior information of the user, and that registers the received suspicious behavior information;

a reliability determination unit that determines reliability of the user based on the suspicious behavior information registered in the behavior information registration unit;

an authentication information transmitting unit that, in a case where the user accesses a second site, adds the reliability of the user determined by the reliability determination unit to the authentication information received by the authentication unit, and that transmits the authentication information to which the reliability is added to the second site; and

an available function determination unit that determines a function to be provided to the user in the first site based on the reliability of the user.

11. A single sign-on authentication system in which a plurality of sites linked each other realize a single sign-on by a linked ID control system, which comprises an authentication server,

wherein

the authentication server comprises:

an authentication unit that receives authentication information, and that authenticates a user in a first site of the single sign-on authentication system based on the received authentication information;

a behavior information registration unit that receives suspicious behavior information of the user, and that registers the suspicious behavior information;

a reliability determination unit that determines reliability of the user based on the suspicious behavior information registered in the behavior information registration unit;

an authentication information transmitting unit that, in a case where the user accesses a second site of the single sign-on authentication system, adds the reliability of the user determined by the reliability determination unit to the authentication information received by the authentication unit, and that transmits the authentication information to which the reliability is added to second site; and

an available function determination unit that determines a function to be provided to the user in the first site based on the reliability of the user.