Authentication collaboration system and ID provider device

• US 8,793,759 B2
• Filed: 03/05/2013
• Issued: 07/29/2014
• Est. Priority Date: 12/27/2011
• Status: Active Grant

• Current Assignee: Toshiba Solutions Corporation (Toshiba Corporation)
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation), Toshiba Solutions Corporation (Toshiba Corporation)
• Inventors: Nishizawa, Minoru, Ikeda, Tatsuro, Yamada, Masataka, Esaki, Yuuichirou, Tanaka, Seiichiro
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US13/785,746
• Publication Number:
  US 20130198801A1
• Time in Patent Office: 511 Days
• Field of Search: 726/1, 726/8
• US Class Current: 726/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An ID provider device according to an embodiment includes a policy information storage unit that stores policy information representing a user of a target to whom transmission of service data is permitted, an authentication collaboration request preliminary processing unit that performs a policy evaluation process and an account collaboration process at a timing according to a log-in status of a user terminal when an authentication collaboration request is received, and an authentication collaboration request transfer unit that transfers the authentication collaboration request to the authentication collaboration request preliminary processing unit when the authentication collaboration request is received from the service provider device.

Claims

1. An authentication collaboration system, comprising:

an ID provider device that performs a log-in process of a user terminal operated by a user; and

a service provider device that transmits service data to the user terminal when the log-in process is completed,

wherein the user terminal transmits a service use request to the service provider device,

the ID provider device includes

an IDP user attribute information storage unit that stores IDP user attribute information in which an item name of a user attribute including a user identifier identifying the user and specifying the user is associated with an item value of the user attribute,

an IDP authentication session storage unit that stores an ID of the user in association with an authentication token representing that the log-in status of the user is a log-in completion status,

a policy information storage unit that stores policy information representing a user of a target to whom transmission of the service data is permitted,

a key storage unit that stores a signature generation key of the ID provider device,

an IDP authentication collaborating unit that transmits a log-in request to the user terminal when a log-in process of the user terminal is in a non-completion status, receives an SP authentication collaboration request issued from the service provider device that has received the service use request when the log-in process of the user terminal is in a completion status, generates a digital signature on an assertion context including an authentication scheme name of the log-in process based on the signature generation key, generates an authentication assertion including the assertion context and the digital signature, and transmits an authentication collaboration response including the authentication assertion to the service provider device, and

an authentication collaboration control unit includes a log-in status determining unit that performs a log-in status checking process of checking whether or not an authentication token issued to the user remains stored in the authentication session storage unit when the SP authentication collaboration request is received from the user terminal, an authentication collaboration request transfer unit that transfers the SP authentication collaboration request to the IDP authentication collaborating unit when a result of the log-in status checking process is a log-in non-completion status, an authentication identifying unit that receives authentication information of the user transmitted based on the log-in request from the IDP authentication collaborating unit from the user terminal and performs the log-in process based on the received authentication information, a policy evaluating unit that evaluates whether or not a user operating the user terminal based on the IDP user attribute information acquired from the IDP user attribute information storage unit and the policy information is a user of a target to whom transmission of service data is permitted based on a user ID stored in the authentication session storage unit in association with the authentication token issued to the user when a result of the log-in status checking process is the log-in completion status, and evaluates whether or not a user operating the user terminal based on the IDP user attribute information acquired from the IDP user attribute information storage unit and the policy information is a user to whom transmission of service data is permitted based on a user ID included in the authentication information when a result of the log-in status checking process is the log-in non-completion, an account collaborating unit that performs an account collaboration process with the service provider device with reference to the acquired IDP user attribute information when an evaluation result by the policy evaluating unit is permission, and generates an SP side user ID which is an identifier of the user in the service provider device, and an authentication collaboration request transfer unit that transmits the SP authentication collaboration request to the IDP authentication collaborating unit after the account collaboration process, and

the service provider device includes

a verification policy storage unit that stores verification policy including an authentication scheme name of the log-in process of permitting transmission of the service data when the authentication collaboration response is received and a signature verification key corresponding to the signature generation key,

an SP user attribute information storage unit that stores account registration in which the SP side user ID issued in the account collaboration process is associated with user attribute partial information which is at least one item name and one item value among item names and item values of a user attribute included in the user attribute information,

an SP authentication collaborating unit that determines whether or not the service use request includes the authentication token when the service use request is received, transmits the authentication token and the service data to the user terminal when it is determined that the service use request includes the authentication token, issues an SP authentication collaboration request including address information of the user terminal to the ID provider device when it is determined that the service use request does not include the authentication token, verifies the authentication scheme name and the digital signature based on the authentication scheme name and the signature verification key in the verification policy when the authentication collaboration response is received, and issues the authentication token and transmits the authentication token and the service data to the user terminal when the verification result is valid, and

an SP authentication session storage unit that stores the SP side user ID and the authentication token in association with each other.

2. An authentication collaboration system, comprising:

an ID provider device that performs a log-in process of a user terminal operated by a user; and

a service provider device that transmits service data to the user terminal when the log-in process is completed,

wherein the user terminal transmits a service use request to the ID provider device,

the ID provider device includes

an IDP user attribute information storage unit that stores IDP user attribute information in which an item name of a user attribute including a user identifier identifying the user and specifying the user is associated with an item value of the user attribute,

an IDP authentication session storage unit that stores an ID of the user in association with an authentication token representing that a log-in status of the user is a log-in completion status,

a policy information storage unit that stores policy information representing a user of a target to whom transmission of the service data is permitted,

a key storage unit that stores a signature generation key of the ID provider device,

an IDP authentication collaboration requesting unit that issues an IDP authentication collaboration request to the service provider device when a service use request is received from the user terminal,

an IDP authentication collaborating unit that transmits a log-in request to the user terminal when a log-in process of the user terminal is in a non-completion status, receives the IDP authentication collaboration request when the log-in process of the user terminal is in a completion status, generates a digital signature on an assertion context including an authentication scheme name of the log-in process based on the signature generation key, generates an authentication assertion including the assertion context and the digital signature, and transmits an authentication collaboration response including the authentication assertion to the service provider device, and

an authentication collaboration control unit includes a log-in status determining unit that performs a log-in status checking process of checking whether or not an authentication token issued to the user remains stored in the authentication session storage unit when the IDP authentication collaboration request is received, an authentication collaboration request transfer unit that transfers the IDP authentication collaboration request to the IDP authentication collaborating unit when a result of the log-in status checking process is a log-in non-completion status, an authentication identifying unit that receives authentication information of the user transmitted based on the log-in request from the IDP authentication collaborating unit from the user terminal and performs the log-in process based on the received authentication information, a policy evaluating unit that evaluates whether or not a user operating the user terminal based on the IDP user attribute information acquired from the IDP user attribute information storage unit and the policy information is a user of a target to whom transmission of service data is permitted based on a user ID stored in the authentication session storage unit in association with the authentication token issued to the user when a result of the log-in status checking process is the log-in completion status, and evaluates whether or not a user operating the user terminal based on the IDP user attribute information acquired from the IDP user attribute information storage unit and the policy information is a user of a target to whom transmission of service data is permitted based on a user ID included in the authentication information when a result of the log-in status checking process is the log-in non-completion status, an account collaborating unit that performs an account collaboration process with the service provider device with reference to the acquired IDP user attribute information when an evaluation result by the policy evaluating unit is permission, and generates an SP side user ID which is an identifier of the user in the service provider device, and an authentication collaboration request transfer unit that transmits the IDP authentication collaboration request to the IDP authentication collaborating unit after the account collaboration process, and

the service provider device includes

a verification policy storage unit that stores verification policy including an authentication scheme name of the log-in process of permitting transmission of the service data when the authentication collaboration response is received and a signature verification key corresponding to the signature generation key,

an SP user attribute information storage unit that stores account registration in which the SP side user ID issued in the account collaboration process is associated with user attribute partial information which is at least one item name and one item value among item names and item values of a user attribute included in the user attribute information,

an SP authentication collaborating unit that verifies the authentication scheme name and the digital signature based on the authentication scheme name and the signature verification key in the verification policy when the authentication collaboration response is received from the IDP authentication collaborating unit, and issues the authentication token and transmits the authentication token and the service data to the user terminal when the verification result is valid, and

an SP authentication session storage unit that stores the SP side user ID and the authentication token in association with each other.

3. An ID provider device that is connected with a service provider device transmitting service data to a user terminal operated by a user to configure an authentication collaboration system, and performs a log-in process of the user terminal transmitting a service use request to the service provider device, the ID provider device comprising:

an IDP user attribute information storage unit that stores IDP user attribute information in which an item name of a user attribute including a user identifier identifying the user and specifying the user is associated with an item value of the user attribute;

an IDP authentication session storage unit that stores an ID of the user in association with an authentication token representing that a log-in status of the user is a log-in completion status;

a policy information storage unit that stores policy information representing a user of a target to whom transmission of the service data is permitted;

a key storage unit that stores a signature generation key of the ID provider device;

an IDP authentication collaborating unit that transmits a log-in request to the user terminal when a log-in process of the user terminal is in a non-completion status, receives an SP authentication collaboration request issued from the service provider device that has received the service use request when the log-in process of the user terminal is in a completion status, generates a digital signature on an assertion context including an authentication scheme name of the log-in process based on the signature generation key, generates an authentication assertion including the assertion context and the digital signature, and transmits an authentication collaboration response including the authentication assertion to the service provider device;

an authentication collaboration control unit includes a log-in status determining unit that performs a log-in status checking process of checking whether or not an authentication token issued to the user remains stored in the authentication session storage unit when the SP authentication collaboration request is received from the user terminal, an authentication collaboration request transfer unit that transfers the SP authentication collaboration request to the IDP authentication collaborating unit when a result of the log-in status checking process is a log-in non-completion status, an authentication identifying unit that receives authentication information of the user transmitted based on the log-in request from the IDP authentication collaborating unit from the user terminal and performs the log-in process based on the received authentication information, a policy evaluating unit that evaluates whether or not a user operating the user terminal based on the IDP user attribute information acquired from the IDP user attribute information storage unit and the policy information is a user to whom transmission of service data is permitted based on a user ID stored in the authentication session storage unit in association with the authentication token issued to the user when a result of the log-in status checking process is the log-in completion status, and evaluates whether or not a user operating the user terminal based on the IDP user attribute information acquired from the IDP user attribute information storage unit and the policy information is a user of a target to whom transmission of service data is permitted based on a user ID included in the authentication information when a result of the log-in status checking process is the log-in non-completion status, an account collaborating unit that performs an account collaboration process with the service provider device with reference to the acquired IDP user attribute information when an evaluation result by the policy evaluating unit is permission, and generates an SP side user ID which is an identifier of the user in the service provider device, and an authentication collaboration request transfer unit that transmits the SP authentication collaboration request to the IDP authentication collaborating unit after the account collaboration process; and

a transfer device that transfers the authentication collaboration request transmitted from the service provider device to the authentication collaboration control unit.

5. The ID provider device according to claim 3, further comprising,

a service use status storage unit that stores service use status information in which the user ID is associated with a service use status of each service provider device,

wherein an authentication collaboration request preliminary processing unit evaluates whether or not the user operating the user terminal is a user to whom transmission of service data is permitted with reference to the service use status information stored in the service use status storage unit and the policy information stored in the policy information storage unit.

4. An ID provider device that is connected with a service provider device transmitting service data to a user terminal operated by a user to configure an authentication collaboration system, and performs a log-in process of the user terminal, the ID provider device comprising:

an IDP user attribute information storage unit that stores IDP user attribute information in which an item name of a user attribute including a user identifier identifying the user and specifying the user is associated with an item value of the user attribute;

an IDP authentication session storage unit that stores an ID of the user in association with an authentication token representing that a log-in status of the user is a log-in completion status;

a policy information storage unit that stores policy information representing a user of a target to whom transmission of the service data is permitted;

a key storage unit that stores a signature generation key of the ID provider device;

an IDP authentication collaboration requesting unit that issues an IDP authentication collaboration request to the service provider device when a service use request is received from the user terminal;

an IDP authentication collaborating unit that transmits a log-in request to the user terminal when a log-in process of the user terminal is in a non-completion status, receives the IDP authentication collaboration request when the log-in process of the user terminal is in a completion status, generates a digital signature on an assertion context including an authentication scheme name of the log-in process based on the signature generation key, generates an authentication assertion including the assertion context and the digital signature, and transmits an authentication collaboration response including the authentication assertion to the service provider device; and

an authentication collaboration control unit includes a log-in status determining unit that performs a log-in status checking process of checking whether or not an authentication token issued to the user remains stored in the authentication session storage unit when the IDP authentication collaboration request is received, an authentication collaboration request transfer unit that transfers the IDP authentication collaboration request to the IDP authentication collaborating unit when a result of the log-in status checking process is a log-in non-completion status, an authentication identifying unit that receives authentication information of the user transmitted based on the log-in request from the IDP authentication collaborating unit from the user terminal and performs the log-in process based on the received authentication information, a policy evaluating unit that evaluates whether or not a user operating the user terminal based on the IDP user attribute information acquired from the IDP user attribute information storage unit and the policy information is a user of a target to whom transmission of service data is permitted based on a user ID stored in the authentication session storage unit in association with the authentication token issued to the user when a result of the log-in status checking process is the log-in completion status, and evaluates whether or not a user operating the user terminal based on the IDP user attribute information acquired from the IDP user attribute information storage unit and the policy information is a user to whom transmission of service data is permitted based on a user ID included in the authentication information when a result of the log-in status checking process is the log-in non-completion status, an account collaborating unit that performs an account collaboration process with the service provider device with reference to the acquired IDP user attribute information when an evaluation result by the policy evaluating unit is permission, and generates an SP side user ID which is an identifier of the user in the service provider device, and an authentication collaboration request transfer unit that transmits the IDP authentication collaboration request to the IDP authentication collaborating unit after the account collaboration process.