Authentication method, authentication system, and service delivery server

• US 9,548,975 B2
• Filed: 09/19/2013
• Issued: 01/17/2017
• Est. Priority Date: 03/28/2013
• Status: Active Grant

• Current Assignee: DENA Company Limited
• Original Assignee: DENA Company Limited
• Inventors: Ito, Kotaro, Yamaguchi, Toru, Mizushima, Sota
• Primary Examiner(s): Pyzocha, Michael
• Application Number:
  US14/031,707
• Publication Number:
  US 20140298441A1
• Time in Patent Office: 1,216 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A client terminal transmits a signal related to an authentication request to a service delivery server through a browser every time an application is started by an instruction from a user. Upon receiving the authentication request from the client terminal, an authentication server executes authentication processing in cooperation with the service delivery server based on authentication information of an application of the client terminal, a session of which has been established, and stored in the service delivery server, and user information related to the user stored in the authentication server.

Claims

1. An authentication method in a system including a client terminal that stores one or more applications, a service delivery server connected with the client terminal through a network and configured to provide the client terminal with a service, and an authentication server connected with the client terminal and the service delivery server and configured to execute authentication processing, the method comprising:

transmitting, by the client terminal, a signal related to an authentication request to the service delivery server through a browser every time an application is started by an instruction from a user;

for the authentication request indicative of permitting a session, establishing the session by the service delivery server with the application of the client terminal and storing the session in the service delivery server;

issuing, by the service delivery server, session information related to the client terminal when receiving the authentication request from the client terminal, attaching the session information to the authentication request, and returning the authentication request to the client terminal;

transmitting, by the client terminal, the authentication request to which the session information is attached to the authentication server; and

upon receiving the authentication request from the client terminal, executing, by the authentication server, authentication processing in cooperation with the service delivery server based on authentication information of the application of the client terminal, the established session stored in the service delivery server, and user information related to the user stored in the authentication server.

2. The authentication method according to claim 1, wherein

when a session has been established between the authentication server and at least one application in the client terminal regarding the authentication request, the authentication server issues an ID token of the client terminal, and

the service delivery server establishes a session between the service delivery sever and an application newly started by the client terminal regarding the ID token after determining the client terminal has been authenticated by the authentication server by verifying the ID token issued by the authentication server.

3. The authentication method according to claim 1, wherein

when a session has been established between the service delivery server and at least one application in the client terminal regarding the authentication request, the service delivery server issues an ID token of the client terminal, and

the authentication server establishes a session between the authentication server and an application newly started by the client terminal regarding the ID token after determining the client terminal has been authenticated by the service delivery server by verifying the ID token issued by the service delivery server.

4. The authentication method according to claim 2, wherein

when a session has been established between the service delivery server and at least one application in the client terminal regarding the authentication request, the service delivery server issues an ID token of the client terminal, and

the authentication server establishes a session between the authentication server and an application newly started by the client terminal regarding the ID token after determining the client terminal has been authenticated by the service delivery server by verifying the ID token issued by the service delivery server.

5. The authentication method according to claim 1, wherein

the client terminal controls a first browser configured to operate in a background and a second browser capable of receiving an input of the user information from the user,

the first browser and the second browser are operable while sharing the session information each other as a function of the application, and

the client terminal causes the first browser to execute the authentication processing between the first browser and the service delivery server, and when a session has not been established between the application started in the client terminal that is an authentication requestor and the service delivery server, and the user is prompted to input the user information, the client terminal starts the second browser in order to receive the user information, and switching the authentication processing to between the second browser and the service delivery server.

6. The authentication method according to claim 2, wherein

the client terminal controls a first browser configured to operate in a background and a second browser capable of receiving an input of the user information from the user,

the first browser and the second browser are operable while sharing the session information each other as a function of the application, and

the client terminal causes the first browser to execute the authentication processing between the first browser and the service delivery server, and when a session has not been established between the application started in the client terminal that is an authentication requestor and the service delivery server, and the user is prompted to input the user information, the client terminal starts the second browser in order to receive the user information, and switching the authentication processing to between the second browser and the service delivery server.

7. The authentication method according to claim 3, wherein

the client terminal controls a first browser configured to operate in a background and a second browser capable of receiving an input of the user information from the user,

the first browser and the second browser are operable while sharing the session information each other as a function of the application, and

the client terminal causes the first browser to execute the authentication processing between the first browser and the service delivery server, and when a session has not been established between the application started in the client terminal that is an authentication requestor and the service delivery server, and the user is prompted to input the user information, the client terminal starts the second browser in order to receive the user information, and switching the authentication processing to between the second browser and the service delivery server.

8. The authentication method according to any one of claim 4, wherein the client terminal controls a first browser configured to operate in a background and a second browser capable of receiving an input of the user information from the user,

the first browser and the second browser are operable while sharing the session information each other as a function of the application, and

the client terminal causes the first browser to execute the authentication processing between the first browser and the service delivery server, and when a session has not been established between the application started in the client terminal that is an authentication requestor and the service delivery server, and the user is prompted to input the user information, the client terminal starts the second browser in order to receive the user information, and switching the authentication processing to between the second browser and the service delivery server.

9. The authentication method according to claim 5, wherein

the client terminal includes an authentication assist application that operates as an external function of the application, and does not share the session information with the first browser and the second browser, and

even if a session has not been established between the started application and the authentication server, but a session has been established between the authentication assist application and the authentication server, the client terminal starts the authentication assist application in place of the second browser, and switches the authentication processing to between the authentication assist application and the service delivery server.

10. The authentication method according to claim 6, wherein

the client terminal includes an authentication assist application that operates as an external function of the application, and does not share the session information with the first browser and the second browser, and

even if a session has not been established between the started application and the authentication server, but a session has been established between the authentication assist application and the authentication server, the client terminal starts the authentication assist application in place of the second browser, and switches the authentication processing to between the authentication assist application and the service delivery server.

11. The authentication method according to claim 7, wherein

the client terminal includes an authentication assist application that operates as an external function of the application, and does not share the session information with the first browser and the second browser, and

even if a session has not been established between the started application and the authentication server, but a session has been established between the authentication assist application and the authentication server, the client terminal starts the authentication assist application in place of the second browser, and switches the authentication processing to between the authentication assist application and the service delivery server.

12. The authentication method according to claim 8, wherein

the client terminal includes an authentication assist application that operates as an external function of the application, and does not share the session information with the first browser and the second browser, and

even if a session has not been established between the started application and the authentication server, but a session has been established between the authentication assist application and the authentication server, the client terminal starts the authentication assist application in place of the second browser, and switches the authentication processing to between the authentication assist application and the service delivery server.

13. An authentication system comprising:

a client terminal storing one or more applications;

a service delivery server connected with the client terminal through a network, and configured to provide the client terminal with a service; and

an authentication server connected with the client terminal and the service delivery server, and configured to execute authentication processing,

wherein the client terminal transmits a signal related to an authentication request to the service delivery server through a browser every time an application is started by an instruction from a user,

for the authentication request indicative of permitting a session, the service delivery server establishes the session with the application of the client terminal and stores the session in the service delivery server;

the service delivery server issues session information related to the client terminal when receiving the authentication request from the client terminal, attaches the session information to the authentication request, and returns the authentication request to the client terminal,

the client terminal transmits the authentication request to which the session information is attached to the authentication server, and

upon receiving the authentication request from the client terminal, the authentication server executes the authentication processing in cooperation with the service delivery server based on authentication information of the application of the client terminal, the established session stored in the service delivery server, and user information related to the user stored in the authentication server.

14. A service delivery server in a system including a client terminal that stores one or more applications, a service delivery server connected with the client terminal through a network and configured to provide the client terminal with a service, and an authentication server connected with the client terminal and the service delivery server and configured to execute authentication processing, the service delivery server comprising:

a server communication unit configured to, for the authentication request indicative of permitting a session, establish the session with an application of the client terminal and store the session in the service delivery server, issue session information related to the client terminal when receiving an authentication request from the client terminal, to attach the session information to the authentication request and to return the authentication request, and to causes the client terminal to transit the authentication request to which the session information is attached to the authentication server; and

an authentication control unit configured, upon receiving the authentication request from the client terminal, to execute the authentication processing in cooperation with the authentication server based on authentication information of the application of the client terminal, the established session stored in the service delivery server, and user information related to the user stored in the authentication server.

15. An authentication method in a service delivery server in a system including a client terminal that stores one or more applications, a service delivery server connected with the client terminal through a network and configured to provide the client terminal with a service, and an authentication server connected with the client terminal and the service delivery server and configured to execute authentication processing, the authentication method comprising the steps of:

receiving an authentication request from the client terminal;

for the authentication request indicative of permitting a session, establishing the session with an application of the client terminal and storing the session in the service delivery server,

issuing session information related to the client terminal;

attaching the session information to the authentication request and returning the authentication request, and causing the client terminal to transmit the authentication request to which the session information is attached to the authentication server; and

upon receiving the authentication request from the client terminal, executing the authentication processing in cooperation with the authentication server based on authentication information of the application of the client terminal, the established session stored in the service delivery server, and user information related to the user stored in the authentication server.