SINGLE CERTIFICATE SERVICE SYSTEM AND OPERATIONAL METHOD THEREOF

• US 20140282983A1
• Filed: 07/02/2013
• Published: 09/18/2014
• Est. Priority Date: 07/02/2012
• Status: Active Grant

• Current Assignee: SK Planet Co., Ltd. (SK Telecom Co., Ltd.)
• Original Assignee: SK Planet Co., Ltd. (SK Telecom Co., Ltd.)
• Inventors: Ko, Kyungwan, Um, Bongsu, Ju, Jaeyoung
• Granted Patent: US 9,130,927 B2
• Time in Patent Office: Days
• US Class Current: 726/8
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

The present invention discloses a single sign-on service system and its respective elements, and an operating method thereof. The single sign-on service system includes a terminal configured to access at least one of a plurality of application service devices according to a request for activating at least one of a plurality of applications, and receive a service token used to operate the application service from each application service device on the basis of a single sign-on token without separately inputting sign-on information, an application service device configured to provide data for operating the application service by the terminal having the service token and when a single sign-on message is received, provide the single sign-on message to a single sign-on service device.

Claims

1. A single sign-on service system comprising:

a terminal configured to access at least one of a plurality of application service devices according to a request for activating at least one of a plurality of applications, and receive a service token used to operate the application service from each application service device on the basis of a single sign-on token without separately inputting sign-on information;

an application service device configured to provide data for operating the application service by the terminal having the service token, when a single sign-on message is received from the terminal, provide the single sign-on message to a single sign-on service device, when an integration service number is received from the single sign-on service device, create the service token on the basis of the single sign-on token without separately checking sign-on information, and provide the created service token and the data for operating the application service by the terminal to the terminal; and

a single sign-on service device configured to provide the integration service number for operating the single sign-on service by the terminal to the application service device when the single sign-on message is received from the application service device.

2. An application service device capable of supporting a single sign-on service, the application service device comprising:

a first communication unit configured to receive integration ID login information or a single sign-on token-based session inquiry message from a specific application of a terminal;

a first storage unit configured to store data for supporting a specific application function of the terminal and a service token for operating the specific application function of the terminal; and

a first control unit configured to deliver a message for creating a single sign-on token to a single sign-on service device when the integration ID login information is received from the specific application, and when the session inquiry message is received, transmit the session inquiry message to the single sign-on service device, receive an integration service number associated with the session inquiry message from the single sign-on service device, and then provide the service token to the specific application of the terminal without separately checking sign-on information of the application.

3. The application service device of claim 2, wherein the first control unit controls delivery of a message corresponding to the integration ID login information or a message corresponding to the session inquiry message to the single sign-on service device, and

when a single sign-on token and a one-time access key for acquiring single sign-on cookie information by the web browser are received from the single sign-on service device, the first control unit controls delivery of the single sign-on token and the one-time access key to the application of the terminal.

4. The application service device of claim 2, wherein, when the integration ID login information is received, the first control unit controls creation of the service token on the basis of the single sign-on token provided by the single sign-on service device and provision of the single sign-on token, the service token, and the application function support data to the specific application of the terminal.

5. The application service device of claim 2, wherein,

when the integration ID login information is received, the first control unit controls creation of the service token on the basis of the single sign-on token provided by the single sign-on service device and provision of the single sign-on token, a one-time access key, the service token, and the application function support data to the specific application of the terminal, and

when the session inquiry message is received, the first control unit controls creation of the service token on the basis of the integration service token provided by the single sign-on service device and provision of the service token to the specific application of the terminal.

6. The application service device of claim 2, wherein, when a service token termination request message is received from the specific application of the terminal, the first control unit controls provision of a service token termination response message for logging out of the application service to the terminal.

7. The application service device of claim 2, wherein,

when the service token and a single sign-on token termination request message is received from the specific application of the terminal, the first control unit controls provision of the token termination request message to the single sign-on service device, and

when a response message corresponding to the token termination request message is received, the first control unit controls provision of the service token and the single sign-on token termination response message to the terminal.

8. The application service device of claim 2, wherein, when a web browser completion or web browser-based single sign-on cookie termination request message is received, the first control unit controls provision of the web browser completion or web browser-based single sign-on cookie termination request message to the single sign-on service device and provision of a response message corresponding to the request message to the terminal.

9. A single sign-on service device comprising:

a device communication unit configured to establish a communication channel with at least one application service device and receive a single sign-on session request message and a single sign-on session examination message transmitted by a specific application of a terminal through the application service device;

a second storage unit configured to store a single sign-on token provided to the terminal to support a single sign-on allowing access to a specific application service device without separately inputting sign-on information; and

a second control unit configured to control provision of the single sign-on token to the terminal through the application service device when the single sign-on session request message is received and provision of a single sign-on token-based integration service number to the application service device when the single sign-on session examination message is received.

10. The single sign-on service device of claim 9, wherein, when a single sign-on token termination request message is received from the application service device, the second control unit controls provision of a response message corresponding to the single sign-on token termination to the application service device.

11. The single sign-on service device of claim 9, wherein, when a single sign-on session request message is received for creating single sign-on cookie information to be provided to a web browser of the terminal, the second control unit controls provision of a single sign-on token and a one-time access key corresponding to the single sign-on session request message to the terminal through the application service, and provision of the single sign-on cookie information to the web browser performing access through the one-time access key.

12. The single sign-on service device of claim 11, wherein the second control unit controls deletion of the one-time access key after the web browser performs access on the basis of the one-time access key.

13. The single sign-on service device of claim 11, wherein,

when an application single sign-on message composed by using single sign-on cookie information provided by the web browser of the terminal is received, the second control unit controls provision of an integration service number corresponding to the application single sign-on message to the application service device, and

when a single sign-on cookie termination message is received from the web browser of the terminal, the second control unit controls provision of a response message corresponding to the single sign-on cookie termination request message to the web browser and deletion of the single sign-on cookie information stored in the second storage unit.

14. A terminal capable of supporting a single sign-on service, the terminal comprising:

a communication unit configured to establish a communication channel with at least one of a plurality of application service devices to perform a function of at least one of a plurality of applications;

a storage unit configured to store the plurality of applications, service tokens for using services of the plurality of application service devices, and a single sign-on token for supporting access of the plurality of application service devices; and

a control unit configured to control provision of a single sign-on token acquisition request message to a single sign-on service device through the application service device and acquisition of the single sign-on token if there is no single sign-on token, and if there is the single sign-on token, control provision of a single sign-on session inquiry message for providing an integration service number used to access and use a specific application service device on the basis of the single sign-on token, to the single sign-on service device through the application service device.

15. The terminal of claim 14, further comprising a display unit configured to output at least one of:

a region for inputting general sign-on information to access the application service device;

a region for performing an integration ID login to acquire the single sign-on token; and

a region in which the sign-on information used to access a specific application service device is automatically input on the basis of the single sign-on token.

16. The terminal of claim 15, further comprising a display unit configured to output at least one of:

a logout item for requesting termination of the service token;

a pop-up window for requesting termination of the single sign-on token; and

a service region for outputting data received from the application service device.

17. The terminal of claim 15, wherein the control unit supports control of creation of an accounting manager account for operating the single sign-on token or control of activation of a cloud service function.

18. The terminal of claim 15, wherein the control unit controls deletion of the accounting manager account when the single sign-on token is terminated.

19. The terminal of claim 15, wherein, when a specific application is selected to activate, the control unit controls checking of whether the web browser operates single sign-on cookie information and transmission of a message for performing automatic login of the application to the application service device using the single sign-on token provided through the single sign-on cookie information.

20. The terminal of claim 19, wherein,

when the web browser cannot operate the single sign-on cookie, the specific application performs an integration ID login to receive a one-time access key from a single sign-on service device and then provide the one-time access key to the web browser, and

the web browser accesses the single sign-on service device on the basis of the one-time access key to receive the single sign-on cookie information.

21. A single sign-on service operating method comprising:

providing, by a terminal, a session inquiry message for performing an integration ID login or pre-stored single sign-on token-based single sign-on to an application service device during access to an application service device in order to operate a specific application function;

performing, by an application service device, the integration ID login and then transmitting a single sign-on token creation request message to the single sign-on service device or transmitting the session inquiry message to the single sign-on service device;

receiving, by the application service device, an integration service number corresponding to the single sign-on token or the session inquiry message from the single sign-on service device; and

when the single sign-on token is received, providing, by the application service device, the single sign-on token and a service token and data for using the application service device to the terminal, and when the integration service number is received, performing automatic login of the application and providing the service token and data to the terminal.

22. The single sign-on service operating method of claim 21, further comprising:

transmitting, by the terminal, a service token termination request message to the application service device or a service token and single sign-on token termination request message to the application service device;

providing, by the application service device, a service token termination response message to the terminal or transmitting the single sign-on token termination request message to the single sign-on service device and providing a single sign-on token termination response message in addition to the service token termination response message to the terminal; and

performing, by the terminal, at least one of the service logout and the single sign-on logout.

26. A computer readable recording medium storing a program for executing the method of claim 21.

23. A single sign-on service operating method comprising:

when an input signal for activating a specific application is received, calling, by a web browser of a terminal, the specific application and providing a single sign-on cookie information-based single sign-on token to the specific application;

providing, by the application, a session inquiry message for automatic login to a single sign-on service device through an application service device using the single sign-on token;

creating, by the single sign-on service device, an integration service number corresponding to the session inquiry message and providing the created integration service number to the application service device;

creating, by the application service device, a service token for operating the application service on the basis of the integration service number; and

providing, by the application service device, the service token and user data for operating the application service to the application.

24. The single sign-on service operating method of claim 23, further comprising:

when the web browser cannot operate the single sign-on cookie information, providing, by the application, information for an integration ID login to the single sign-on service device through the application service device;

providing, by the single sign-on service device, a one-time access key to the application;

providing, by the application, the one-time access key to the web browser; and

accessing, by the web browser, the single sign-on service device using the one-time access key to receive the single sign-on cookie information.

25. The single sign-on service operating method of claim 23, further comprising:

receiving an input signal for completing the web browser or performing a logout of a web browser-based single sign-on service;

transmitting a request message corresponding to the input signal to the single sign-on service device;

deleting, by the single sign-on service device, stored single sign-on cookie information and providing a response message corresponding to the request message to the terminal; and

performing, by the terminal, the logout of the service.