USER INFORMATION MANAGEMENT SYSTEM; USER INFORMATION MANAGEMENT METHOD; PROGRAM, AND RECORDING MEDIUM ON WHICH IT IS RECORDED, FOR MANAGEMENT SERVER; PROGRAM, AND RECORDING MEDIUM ON WHICH IT IS RECORDED, FOR USER TERMINAL; AND PROGRAM, AND RECORDING MEDIUM ON WHICH IT IS RECORDED, FOR SERVICE SERVER

• US 20170201510A1
• Filed: 06/23/2015
• Published: 07/13/2017
• Est. Priority Date: 07/28/2014
• Status: Active Grant

• Current Assignee: Encryptier Co., Ltd.
• Original Assignee: Encryptier Co., Ltd.
• Inventors: TAGUCHI, Haruyoshi
• Granted Patent: US 10,382,430 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04W 12/06 Authentication

Abstract

A management server, a service server, and a plurality of user terminals are connected to each other via a network so as to be capable of transmitting and receiving data. The management server includes a user information storage unit that stores user identification information for identifying users belonging to a group, and an identification information notification processor that, each time a service to be provided to the users of the group is newly added, transmits the user identification information of the plurality of users belonging to the group to the service server by cryptographic communication, corresponding to the newly added service. The service server includes a service information storage unit for storing the user identification information of the plurality of users corresponding to the service, received from the identification information notification processor.

Claims

1. A user information management system comprising:

a management server for managing information on a group containing users;

user terminals respectively corresponding to the users; and

a service server for providing services to the users;

wherein

the management server, the service server, and the user terminals are connected via a network to enable mutual transmission and reception of data;

the management server and the service server are enabled for cryptographic communications with each other;

the management server comprises

user information storage storing user identification information for respectively identifying the users belonging to the group, and

an identification-information notification processor for, whenever a service provided to the users in the group is newly added, transmitting to the service server by means of the cryptographic communications the user identification information for the users belonging to that group that corresponds to the service being added; and

the service server comprises

service information storage storing the identification information, received from the identification-information notification processor, for the users corresponding to the service.

2. The user information management system according to claim 1, wherein whenever a user is newly added belonging to the group, the identification-information notification processor further transmits, by means of the cryptographic communications, user identification information for the added user to the service server providing services to that group.

3. The user information management system according to claim 1, wherein:

the user terminals comprise

a service-key acquisition section for executing a service key acquisition process of accessing the service server providing the services, and acquiring from the service server a service authentication key for receiving provision of a service, and

a service-server access section for using the service authentication key to access the service server; and

the service server comprises

an authentication section for, when there has been an access from a user terminal, acquiring the service authentication key from the user terminal and carrying out authentication using the acquired service authentication key, and

a service providing section for providing, when the authentication has succeeded, the service to the user terminal for which the authentication has succeeded.

4. The user information management system according to claim 3, wherein the authentication section, when there has been an access from a user terminal, further acquires user identification information from the user terminal, and if the acquired user identification information matches any of the users'"'"' identification information stored in the service information storage, the authentication unit carries out authentication using the service authentication key.

6. The user information management system according to claim 3, wherein:

the management server further comprises a decryption section for decrypting user-terminal encrypted encryption information;

the service key acquisition process comprises a first step of encrypting, such as to be decryptable by the decryption section, and transmitting to the service server, a session password for utilization in encryption by the service server;

the service server further comprises a decryption request processor for receiving an encrypted session password from a user terminal and transmitting the encrypted session password to the management server by means of the cryptographic communications; and

the management server further comprises a reply processor for causing the decryption section to decrypt the session password transmitted from the decryption request processor, and transmitting the decrypted session password to the service server by means of the cryptographic communications.

7. The user information management system according to claim 6, wherein:

the service server further comprises a service key transmission section for encrypting, using the decrypted session password, and transmitting to a user terminal a service authentication key; and

the service key acquisition process further comprises a second step of acquiring the service authentication key by decrypting, by means of the session password, the encrypted service authentication key.

8. The user information management system according to claim 6, wherein:

in the first step, the service-key acquisition section further encrypts, such as to be decryptable by the decryption section, and transmits to the service server, a management authentication key for authentication that the management server carries out;

the decryption request processor further receives the encrypted management authentication key from a user terminal, and transmits the encrypted management authentication key to the management server by means of the cryptographic communications;

the reply processor carries out authentication by decrypting, by means of the decryption section, the management authentication key transmitted from the decryption request processor, and if the authentication fails, reports the authentication failure to the service server; and

if failure is reported from the reply processor, the service key transmission section does not carry out transmission of the service authentication key to the user terminal.

9. The user information management system according to claim 6, wherein:

the management server further comprises a service server information storage storing service-server identification information for identifying the service server;

the service server, when carrying out communications with the management server, transmits to the management server service-server identification information identifying the service server itself;

the user terminals further comprise a service-server information acquiring section for receiving the service-server identification information from the management server;

the service-key acquisition section, in the first step, further encrypts, such as to be decryptable by the decryption section, and transmits to the service server, the service-server identification information;

the decryption request processor further receives the encrypted service-server identification information from a user terminal, and transmits the encrypted service-server identification information to the management server by means of the cryptographic communications; and

the reply processor

causes the decryption section to decrypt the service-server identification information transmitted from the decryption request processor,

checks whether or not the decrypted service-server identification information matches the service-server identification information for that service server from which the service-server identification information has been transmitted, and

if the information does not match, does not execute transmission of the decrypted session password to that service server.

10. The user information management system according to claim 1, wherein the service server is respectively provided on a per-service basis.

15. A storage medium storing a management server program for operating the management server in the user information management system according to claim 1, the storage medium storing a management server program that causes the management server to function as:

the user information storage storing user identification information for respectively identifying the users belonging to the group; and

the identification-information notification processor for, whenever a service provided to the users in the group is newly added, transmitting to the service server by means of the cryptographic communications the user identification information for the user belonging to that group that corresponds to the service being added.

16. A storage medium storing a user terminal program for operating the user terminal in the user information management system according to claim 3, the storage medium storing a user terminal program that causes the user terminal to function as:

the service-key acquisition section for executing a service key acquisition process of accessing the service server providing the services, and acquiring from the service server a service authentication key for receiving provision of a service; and

the service-server access section for using the service authentication key to access the service server.

17. A storage medium storing a service server program for operating the service server in the user information management system according to claim 6, the storage medium storing a service server program that causes the service server to function as:

the decryption request processor for receiving an encrypted session password from a user terminal and transmitting the encrypted session password to the management server by means of the cryptographic communications.

5. A user information management system comprising:

a management server for managing information on users;

user terminals respectively corresponding to the users; and

a service server for providing services to the users;

wherein

the management server, the service server, and the user terminals are connected via a network to enable mutual transmission and reception of data;

the management server and the service server are enabled for cryptographic communications with each other; and

the user terminals comprise

a service-key acquisition section for executing a service key acquisition process of accessing the service server providing the services, and acquiring from the service server a service authentication key for receiving provision of a service, and

a service-server access section for using the service authentication key to access the service server.

18. The user information management system according to claim 5, wherein:

the management server further comprises a decryption section for decrypting user-terminal encrypted encryption information;

the service key acquisition process comprises a first step of encrypting, such as to be decryptable by the decryption section, and transmitting to the service server, a session password for utilization in encryption by the service server;

the service server further comprises a decryption request processor for receiving an encrypted session password from a user terminal and transmitting the encrypted session password to the management server by means of the cryptographic communications; and

the management server further comprises a reply processor for causing the decryption section to decrypt the session password transmitted from the decryption request processor, and transmitting the decrypted session password to the service server by means of the cryptographic communications.

11. A user information management method for managing user information in a user information management system comprising a management server for managing information on a group containing users, user terminals respectively corresponding to the users, and a service server for providing services to the users, the method comprising:

a management storing step in which the management server stores user identification information for respectively identifying the users belonging to the group;

an identification information notification process step in which whenever a service provided to the users in the group is newly added, the management server transmits to the service server by means of cryptographic communications the user identification information for the users belonging to that group that corresponds to the service being added; and

a service storing step in which the service server stores the identification information, received from the management server, for the users corresponding to the service.

12-14. -14. (canceled)