GROUP DEFINITION MANAGEMENT SYSTEM

• US 20140189796A1
• Filed: 09/27/2011
• Published: 07/03/2014
• Est. Priority Date: 09/27/2011
• Status: Active Grant

• Current Assignee: Rakuten Group, Inc.
• Original Assignee: Nomura Research Institute Limited
• Inventors: Mashimo, Tatsumi
• Granted Patent: US 9,858,399 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

A group definition management system can easily acquire correspondence between an internal ID and an external ID and easily reflect information of a group definition for the internal ID to an external site. In a typical embodiment of the present invention, this is configured of an internal server 10, an external server 20, and a client. The internal server 10 has an internal user management table 15 and an internal authentication unit 11 that performs authentication by the internal ID. The external server 20 has an external user management table 24 and an external authentication unit 21 that performs authentication by the external ID and replies the information of the external ID in response to an inquiry for whether or not a specific user is an authentic user. The internal server 10 further has an authentication cooperation unit 13 that inquires the external server 20 about whether or not the user is the authentic user of the external server 20 in response to a request from the client used by the user authenticated by the internal authentication unit 11, and registers the replied external ID in the internal user management table 15 so as to correspond to the internal ID.

Claims

1. A group definition management system comprising a first server and a second server connected to a network, and a client connectable to both of the first server and the second server,

wherein the first server has:

a first user management table that stores information of a first ID for each user who can use the first server and information related to a group definition of each user; and

a first authentication unit that authenticates the user by the first ID in response to a request from a user via the client,

the second server has;

a second user management table that stores information of a second ID for each user who can use the second server and information related to a group definition of each user; and

a second authentication unit having an authentication interface that authenticates the user by the second ID in response to a request from the user via the client, and replies information of the second ID for the user acquired from the second user management table, in response to an inquiry for whether or not a specific user is an authentic user of the second server, if the specific user is the authentic user, and

the first server further has

an authentication cooperation unit that inquires the second server about whether or not the user is the authentic user of the second server in response to a request from the client used by the user authenticated by the first authentication unit, and registers the second ID for the user replied from the second server in the first user management table so as to correspond to the first ID for the user.

2. The group definition management system according to claim 1,

wherein, if the user has not been authenticated by the second authentication unit when the second authentication unit of the second server receives the inquiry for whether or not the specific user is the authentic user of the second server, the second authentication unit of the second server requests the user via the client to perform an authentication processing for the second server.

3. The group definition management system according to claim 1,

wherein the first server further has a group management unit that generates update information for updating the group definition for the second ID based on a change content of the group definition for the first ID in the first user management table.

4. The group definition management system according to claim 3,

wherein the second server further has a user management interface for managing the group definition for the second ID in the second user management table, and

the group management unit of the first server updates the group definition for the second ID in the second user management table based on the update information by the user management interface of the second server.

5. The group definition management system according to claim 4,

wherein, after the user who has authority to manage the group definition for the second ID in the second user management table of the second server is authenticated by the first authentication unit of the first server, in response to a request from the client used by the user, the group management unit of the first server acquires information of a current group definition for the second ID in the second user management table by the user management interface of the second server, and generates the update information based on the acquired information of the current group definition and the information of the group definition in the first user management table.

6. The group definition management system according to claim 2,

wherein the first server further has a group management unit that generates update information for updating the group definition for the second ID based on a change content of the group definition for the first ID in the first user management table.