AUTHENTICATION FEDERATION SYSTEM AND ID PROVIDER DEVICE

• US 20130247142A1
• Filed: 05/09/2013
• Published: 09/19/2013
• Est. Priority Date: 11/09/2010
• Status: Active Grant

• Current Assignee: Toshiba Solutions Corporation (Toshiba Corporation)
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation), Toshiba Solutions Corporation (Toshiba Corporation)
• Inventors: NISHIZAWA, Minoru, Tanaka, Seiichiro, Ikeda, Tatsuro
• Granted Patent: US 9,059,982 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

According to one embodiment, the ID provider device stores pieces of policy information for each service provider ID. The ID provider device outputs a policy evaluation request including the user ID used in the log-in processing and the service provider ID in the authentication federation request when the log-in processing is successful. The ID provider device reads the policy information in accordance with the service provider ID in the policy evaluation request. The ID provider device judges whether to permit the transmission of the service data in accordance with whether environmental conditions of the user for the execution of a service conform to the read policy information.

Claims

1. An authentication federation system comprising:

an ID provider device which is configured to perform log-in processing for a user terminal operable by a user and which has a first memory; and

a plurality of service provider devices which are configured to transmit service data to the user terminal when the log-in processing is successful and which have second memories,

the ID provider device comprising

a user attribute information storage unit which stores pieces of user attribute information in which item names of user attributes to identify the user are associated with item values of the user attributes, the item names including at least a user ID to identify the user,

a service usage storage unit which stores the user ID, a service provider ID, and service usage in association with one another, the service provider ID serving to identify each of the service provider devices, the service usage indicating a service in use showing that the transmission of the service data is permitted, or a service unused showing that the transmission of the service data is not permitted,

a policy storage unit which stores pieces of policy information for each service provider ID, the policy information indicating a user to whom the service provider device identified by the service provider ID is permitted to transmit the service data,

an item name storage unit which stores some of the item names of the user attributes in the user attribute information in association with the service provider ID,

a key storage unit which stores a signature generating key for the ID provider device,

a unit which outputs a user authentication request including the address information for the user terminal in an authentication federation request in response to the authentication federation request which is transmitted from one of the service provider devices and which includes the service provider ID for the service provider device and the address information for the user terminal,

a unit which performs log-in processing to transmit a log-in request to the user terminal in accordance with the address information for the user terminal in the output user authentication request, and authenticates a user ID and user authentication information received from the user terminal in accordance with the user ID and the reference information in the user attribute information storage unit,

a unit which outputs a policy evaluation request including the user ID used in the log-in processing and the service provider ID in the authentication federation request when the log-in processing is successful,

a unit which reads the user attribute information from the user attribute information storage unit in accordance with the user ID in the output policy evaluation request,

a unit which reads the policy information from the policy storage unit in accordance with the service provider ID in the output policy evaluation request,

a transmission permission judging unit which judges whether to permit the transmission of the service data in accordance with the read user attribute information, the kind of service to be used by the user, the operation to be performed for a service by the user, and environmental conditions of the user for the execution of a service conform to the read policy information,

a unit which outputs a policy evaluation reply including the judgment result to a transmission source of the policy evaluation request,

a unit which outputs an account federation request including the user ID and the service provider ID in the policy evaluation request when the judgment result in the policy evaluation reply indicates permission,

a unit which reads some of the item names of the user attributes from the item name storage unit in accordance with the service provider ID in the output account federation request,

a unit which acquires user attribute partial information comprising item names corresponding to some of the item names and item values associated with the item names in the user attribute information including the user ID corresponding to the user ID in the user attribute information storage unit in accordance with some of the item names that have been read and the user ID in the account federation request,

a unit which adds an account registration instruction to the acquired user attribute partial information to create an account federation request message,

a unit which transmits the account federation request message to the service provider device which is a transmission source of the account federation request,

a unit which outputs an account federation reply indicating registration completion when the service provider device which is a transmission destination of the account federation request message reports the registration completion including the service provider ID of the service provider device and the user ID in the user attribute partial information,

a unit which updates the service usage in the service usage storage unit from the service unused to the service in use in accordance with the service provider ID and the user ID included in the registration completion in the output account federation reply,

a unit which outputs an authentication federation execution request including the service provider ID and the user ID included in the registration completion in the output account federation reply,

a unit which issues an authentication federation ID shared between the service provider device identified by the service provider ID in an authentication federation execution request and the ID provider device in response to the authentication federation execution request, and writes the authentication federation ID and the user ID in the authentication federation execution request into the first memory in association with each other,

a unit which generates a digital signature based on the signature generating key for an assertion body including the issued authentication federation ID and the name of an authentication method for the log-in processing, and creates an authentication assertion including the assertion body and the digital signature, and

a unit which transmits an authentication federation reply including the created authentication assertion to the service provider device which is a transmission source of the authentication federation request,

the service provider device comprising

a user attribute partial information storage unit which stores the user attribute partial information and an SP-side user ID in association with each other, some of the item names and item values of the user attributes in the user attribute information in the user attribute information storage unit being associated with one another in the user attribute partial information, the SP-side user ID serving to identify the user in the service provider device,

a verification policy storage unit which stores an authentication assertion verification policy including the name of an authentication method for the log-in processing to permit the transmission of the service data when the log-in processing is successful, and a signature verification key corresponding to the signature generating key,

a service data storage unit which stores the service data,

a unit which judges whether a service request includes the authentication token in response to the service request from the user terminal, and transmits the authentication token and the service data in the service data storage unit to the user terminal when the service request includes the authentication token, or transmits an authentication federation request including the service provider ID of the service provider device and the address information for the user terminal to the ID provider device when the service request does not include the authentication token,

a unit which issues a new SP-side user ID when receiving the account federation request message, and registers the issued SP-side user ID and the user attribute partial information in the account federation request message in the user attribute partial information storage unit in association with each other,

a unit which reports, after the registration, registration completion including the user ID in the registered user attribute partial information and the service provider ID in the service provider device to the ID provider device which is a transmission source of the account federation request message,

a unit which extracts an authentication federation ID from the authentication assertion in the authentication federation reply in response to the authentication federation reply from the ID provider device, and writes the extracted authentication federation ID and the user ID in the registered user attribute partial information into the second memory in association with each other,

a verification unit which verifies the authentication method name and the digital signature in the authentication assertion in accordance with the authentication method name and the signature verification key in the authentication assertion verification policy,

a unit which issues an authentication token and writes the authentication token into the second memory in association with the authentication federation ID when all the verification results are proper,

a unit which outputs a service execution request including the written authentication token and the user ID which is associated with the authentication token in the second memory via the authentication federation ID, and

a unit which transmits the authentication token in the service execution request and the service data in the service data storage unit in accordance with the output service execution request.

2. The authentication federation system according to claim 1, wherein

each of the service provider devices further comprises

a use charge storage unit which stores the user ID and a use charge accumulated for the service in use in association with each other, and

a unit which searches the use charge storage unit in accordance with the user ID in a use charge transmission request in response to the use charge transmission request including the user ID from the ID provider device, and transmits, to the ID provider device, a use charge reply including a use charge and the user ID obtained by the search,

one of the pieces of policy information indicates, in association with the service provider ID, the environmental conditions of the user to whom the service provider device identified by the service provider ID is permitted to transmit the service data, and the upper limit value of the use charge to the user,

the ID provider device further comprises

a unit which transmits the use charge transmission request including the user ID to the service provider device identified by the service provider ID in accordance with the user ID and the service provider ID in the output policy evaluation request, and receives the use charge reply including the user ID and the use charge from the service provider device, and

the transmission permission judging unit judges whether to permit the transmission of the service data in accordance with whether the read user attribute information, the kind of service to be used by the user, the operation to be performed for a service by the user, and the environmental conditions of the user for the execution of a service conform to the read policy information and in accordance with whether the use charge in the received use charge reply conforms to the upper limit value of the use charge indicated in the read policy information.

3. The authentication federation system according to claim 1, wherein

one of the pieces of policy information indicates, in association with the service provider ID, the environmental conditions of the user to whom the service provider device identified by the service provider ID is permitted to transmit the service data, the presence of a user who has passed a predetermined or longer period from the last date of use to the present among the users when the number of users has exceeded the upper limit value, and the invalidation of the user attribute partial information for the present user,

each of the service provider devices further comprises

a last use date storage unit which stores last use date information including the user ID and the last use date that indicates the last date of the transmission of the service data, and

a unit which transmits the last use date information in the last use date storage unit to the ID provider device in response to a last use date transmission request from the ID provider device,

the ID provider device further comprises

a service use count storage unit which stores, in association with one another, the service provider ID, a user count which indicates the number of services used shown by the service usage associated with the service provider ID and which is equal to the number of the users, and an upper limit value of the use count,

a unit which reads the use count and the upper limit value from the service usage storage unit in accordance with the service provider ID in the output policy evaluation request, and

a unit which transmits the last use date transmission request to the service provider device identified by the service provider ID in accordance with the service provider ID in the transmitted policy evaluation request, and receiving the last use date information from the service provider device, and

the transmission permission judging unit comprises

a unit which judges whether to permit the transmission of the service data in accordance with whether the read user attribute information, the kind of service to be used by the user, the operation to be performed for a service by the user, and the environmental conditions of the user for the execution of a service conform to the read policy information in the case where the read policy information includes the presence of a user who has passed the predetermined or longer period when the upper limit value of the use count of the user is exceeded, and the invalidation of the user attribute partial information for the present user, and in accordance with whether the last use date in the last use date information received from the service provider device by transmitting the last use date transmission request to the service provider device when the use count read from the service usage storage unit has exceeded the upper limit value read from the service use count storage unit conform to the predetermined period in the read policy information or a longer period, and

a unit which transmits, to the service provider device, an invalidation request including the user ID of the user which is used in the judgment and which has passed the predetermined period or longer when the judgment result indicates permission.

4. An ID provider device which is configured to perform log-in processing for a user terminal operable by a user and which has a first memory, the ID provider device being configured to communicate with a plurality of service provider devices, the service provider devices being configured to transmit service data to the user terminal when the log-in processing is successful in the ID provider device and having second memories, the ID provider device comprising:

a user attribute information storage unit which stores pieces of user attribute information in which item names of user attributes to identify the user are associated with item values of the user attributes, the item names including at least a user ID to identify the user,

a service usage storage unit which stores the user ID, a service provider ID, and service usage in association with one another, the service provider ID serving to identify each of the service provider devices, the service usage indicating a service in use showing that the transmission of the service data is permitted, or a service unused showing that the transmission of the service data is not permitted,

a policy storage unit which stores pieces of policy information for each service provider ID, the policy information indicating environmental conditions of a user to whom the service provider device identified by the service provider ID is permitted to transmit the service data,

an item name storage unit which stores some of the item names of the user attributes in the user attribute information in association with the service provider ID,

a key storage unit which stores a signature generating key for the ID provider device,

a unit which outputs a user authentication request including the address information for the user terminal in an authentication federation request in response to the authentication federation request which is transmitted from one of the service provider devices and which includes the service provider ID for the service provider device and the address information for the user terminal,

a unit which performs log-in processing to transmit a log-in request to the user terminal in accordance with the address information for the user terminal in the output user authentication request, and authenticates a user ID and user authentication information received from the user terminal in accordance with the user ID and the reference information in the user attribute information storage unit,

a unit which outputs a policy evaluation request including the user ID used in the log-in processing and the service provider ID in the authentication federation request when the log-in processing is successful,

a unit which reads the user attribute information from the user attribute information storage unit in accordance with the user ID in the output policy evaluation request,

a unit which reads the policy information from the policy storage unit in accordance with the service provider ID in the output policy evaluation request,

a transmission permission judging unit which judges whether to permit the transmission of the service data in accordance with whether the read user attribute information, the kind of service to be used by the user, the operation to be performed for a service by the user, and environmental conditions of the user for the execution of a service conform to the read policy information,

a unit which outputs a policy evaluation reply including the judgment result to a transmission source of the policy evaluation request,

a unit which outputs an account federation request including the user ID and the service provider ID in the policy evaluation request when the judgment result in the policy evaluation reply indicates permission,

a unit which reads some of the item names of the user attributes from the item name storage unit in accordance with the service provider ID in the output account federation request,

a unit which acquires user attribute partial information comprising item names corresponding to some of the item names and item values associated with the item names in the user attribute information including the user ID corresponding to the user ID in the user attribute information storage unit in accordance with some of the item names that have been read and the user ID in the account federation request,

a unit which adds an account registration instruction to the acquired user attribute partial information to create an account federation request message,

a unit which transmits the account federation request message to the service provider device which is a transmission source of the account federation request,

a unit which outputs an account federation reply indicating registration completion when the service provider device which is a transmission destination of the account federation request message reports the registration completion including the service provider ID of the service provider device and the user ID in the user attribute partial information,

a unit which updates the service usage in the service usage storage unit from the service unused to the service in use in accordance with the service provider ID and the user ID included in the registration completion in the output account federation reply,

a unit which outputs an authentication federation execution request including the service provider ID and the user ID included in the registration completion in the output account federation reply,

a unit which issues an authentication federation ID shared between the service provider device identified by the service provider ID in an authentication federation execution request and the ID provider device in response to the authentication federation execution request, and writes the authentication federation ID and the user ID in the authentication federation execution request into the first memory in association with each other,

a unit which generates a digital signature based on the signature generating key for an assertion body including the issued authentication federation ID and the name of an authentication method for the log-in processing, and creates an authentication assertion including the assertion body and the digital signature, and

a unit which transmits an authentication federation reply including the created authentication assertion to the service provider device which is a transmission source of the authentication federation request,

wherein each of the service provider devices

judges whether a service request includes the authentication token in response to the service request from the user terminal, and transmits the authentication token and the service data in the service data storage unit to the user terminal when the service request includes the authentication token, or transmits an authentication federation request including the service provider ID of the service provider device and the address information for the user terminal to the ID provider device when the service request does not include the authentication token,

issues a new SP-side user ID when receiving the account federation request message, and registers the issued SP-side user ID and the user attribute partial information in the account federation request message in association with each other,

reports, after the registration, registration completion including the user ID in the registered user attribute partial information and the service provider ID in the service provider device to the ID provider device which is a transmission source of the account federation request message,

extracts an authentication federation ID from the authentication assertion in the authentication federation reply in response to the authentication federation reply from the ID provider device, and writes the extracted authentication federation ID and the user ID in the registered user attribute partial information into the second memory in association with each other, and then verifies the authentication method name and the digital signature in the authentication assertion in accordance with the authentication method name and the signature verification key in a previously stored authentication assertion verification policy, and

issues an authentication token and writes the authentication token into the second memory in association with the authentication federation ID when all the verification results are proper, and then outputs a service execution request including the written authentication token and the user ID which is associated with the authentication token in the second memory via the authentication federation ID, and transmits the authentication token in the service execution request and the previously stored service data to the user terminal in accordance with the output service execution request.