JP2009282561A - User authentication system, user authentication method and program - Google Patents

Abstract

[PROBLEMS] To secure the identity of a person without destroying the form of an existing authentication system.
A terminal transmits a public key certificate and a private key to an intermediate authentication server, logs in, and transmits a service use request to a service site. When the service site receives a service use request from the terminal, the service site transmits a redirect for authentication mediation to the OpenID authentication server. When receiving the redirect for authentication mediation from the service site, the OpenID authentication server requests the terminal to input the ID and password, notifies the intermediate authentication server of the user's handle, and transmits the authentication request. In response to the authentication request from the OpenID authentication server, the intermediate authentication server performs authentication by confirming the login status of the user. The OpenID authentication server receives the authentication result from the intermediate authentication server and transmits it to the service site. The service site provides a service to the user's portable terminal when receiving an authentication result indicating that the authentication has been made from the OpenID authentication server.
[Selection] Figure 5

Description

  The present invention relates to a user authentication system, a user authentication method, and a program when using a service on the Internet.

  Currently, when using Internet services, it may be necessary to authenticate users according to the services provided. Such authentication is performed by the site providing the service. However, in recent years, an authentication mechanism by a third party has been provided as a service in order to save time and effort for authentication on the site side and management of information necessary for authentication.

  In this case, in a service that uses an authentication mechanism, an identifier (ID) of a user issued by the authentication mechanism can be used. More specifically, the identifier provided to the service is redirected to an authentication mechanism, and the authentication mechanism performs authentication with a necessary password. Then, by notifying the result to the service, the user authentication is completed.

  One of such authentication mechanisms is called OpenID (see Non-Patent Document 1, for example). Here, the OpenID is an ID (account) in a URL format that can be commonly used in various services. Usually, different IDs and passwords are used for acquiring different accounts and logging in for each service. Although it is necessary to input, OpenID can log in with the same ID as a common authentication mechanism for various services. Also, with OpenID, a URL-based ID is generated (the URL itself becomes the ID), so the compatibility with existing Internet technology is high, and the number of sites that use OpenID and the sites that provide it are increasing. is there.

On the other hand, a model has been proposed in which a user ID is requested to be authenticated by an authentication mechanism that can be trusted by a service site (see, for example, Non-Patent Document 2). In this model, strict authentication is performed while ensuring anonymity to the service site by managing the authentication mechanism without presenting detailed user information to the service site. For this reason, the service site can use a strict service only by implementing a simple authentication mechanism. However, there is a problem that does not correspond to OpenID authentication that is being used for blogs and the like.
http://openid.net/ Sawaya, Yamada, Miyake “Mutual Authentication System Using Mobile Phone for Web Access” Information Processing Society of Japan Research Report 2007-CSEC-38 pp.99-105

  However, for example, in the case of the above-described OpenID, the Internet has a high affinity for the mechanism, and thus its use is increasing, but there is an operational problem. That is, in a mechanism such as OpenID, usually only an email address is required to acquire the ID. Currently, an e-mail address can be easily acquired like a free e-mail, and identification is not required for the acquisition. For this reason, the ID of OpenID cannot perform strict identity verification. That is, in the user authentication using OpenID, it is guaranteed that the ID of a certain OpenID is surely present and that the validity is confirmed at present (the correct password corresponding to the ID is confirmed). Become.

  In addition, when providing services such as blog sites that are about writing comments, it is not necessary to confirm such identity, but for adult services and sites where billing occurs, there are separate user attributes. Authentication is required, which may impair user convenience.

  As a technique for solving the problem of identity verification of the ID described above, strict identity verification can be performed when issuing an ID. For example, assume that a telephone company or the like becomes an OpenID provider and issues an OpenID ID to its own users. At present, telephone companies and the like require the presentation of an identification card for the acquisition of a telephone number of a landline phone or a mobile phone, so it can be said that the identity of the number is guaranteed. For this reason, it can be said that the identity of the OpenID provided to such a user is guaranteed.

  However, in this case, the identity confirmation is limited only to the use with the ID, and there is an inconvenience that the ID of the existing OpenID cannot be used similarly. In addition, it is a method to solve the problem that the existing service confirms the identity of the user who has already been provided, but it is not possible to carry out such a procedure for each ID issued simply on the Internet. Not realistic. Furthermore, not only OpenID but the same problem arises when using other authentication services.

  On the other hand, there is a method of using a public key certificate as one of authentications on a mobile phone. In this method, a public key certificate of a reliable issuer is installed in a mobile phone and used for service use or VPN client authentication. In such a service, a public key certificate is issued based on strict identity verification, and is installed and used on a mobile phone that has been rigorously verified. The identity can be confirmed. However, such a service using a public key certificate is a technique different from the technique such as OpenID described above, and there is a problem that it cannot be used as it is on an OpenID compatible site.

  Then, this invention is made | formed in view of the said situation, and it aims at providing the user authentication system, the user authentication method, and program which ensure confirmation of identity, without destroying the form of the existing authentication system. To do.

  The present invention proposes the following items in order to solve the above-described problems.

(1) The present invention provides a user terminal (for example, equivalent to the portable terminal 1 in FIG. 1), a service provider's service site (for example, equivalent to the service site 4 in FIG. 1), and the user's OpenID. An OpenID authentication server (for example, corresponding to the OpenID authentication server 2 in FIG. 1) and an intermediate authentication server (for example, the intermediate authentication in FIG. 1) that performs user authentication between the OpenID authentication server and the user terminal. 2 is a user authentication system comprising: a login unit (for example, the login unit 11 in FIG. 2) in which the user terminal transmits a message for authentication to the intermediate authentication server and logs in. And an authentication screen transmitted from the OpenID authentication server when a service request is made to the service site. And an input means (for example, equivalent to the input unit 12 of FIG. 2) for inputting the password and the password, and when the OpenID authentication server receives a redirect for authentication mediation from the service site, the user terminal An input screen transmitting means (for example, corresponding to the transmitting unit 23 in FIG. 3) for transmitting a screen requesting input of an ID and password to the intermediate authentication server is notified of the user's unique identification information, and an authentication request is transmitted. Authentication request transmission means (for example, equivalent to the transmission unit 23 in FIG. 3), reception means for receiving the authentication result from the intermediate authentication server (for example, equivalent to the reception unit 21 in FIG. 3), and the received intermediate authentication server Authentication result transmission means (for example, corresponding to the transmission unit 23 in FIG. 3) for transmitting the authentication result from the service site, the intermediate authentication server includes the OpenI In response to an authentication request from the authentication server, an authentication unit (for example, equivalent to the authentication unit 32 in FIG. 4) that performs authentication by confirming the login status of the user, and authentication that notifies the OpenID authentication server of the authentication result A result notification means (e.g., corresponding to the transmission unit 33 in FIG. 4), and when the service site receives an authentication result indicating that the authentication has been performed from the OpenID authentication server, A user authentication system characterized by providing a service has been proposed.

  According to the present invention, when the login means of the user terminal transmits a message for authentication to the intermediate authentication server and logs in, and when the input means makes a service request to the service site, the OpenID authentication server Enter the ID and password on the authentication screen sent from. The input screen transmission means of the OpenID authentication server transmits a screen requesting input of an ID and a password to the user terminal when receiving a redirect for authentication mediation from the service site, and the authentication request transmission means is an intermediate authentication server Is notified of the user's unique identification information, and an authentication request is transmitted. The receiving unit receives the authentication result from the intermediate authentication server, and the authentication result transmitting unit transmits the authentication result from the received intermediate authentication server to the service site. The authentication unit of the intermediate authentication server performs authentication by confirming the login status of the user in response to the authentication request from the OpenID authentication server, and the authentication result notification unit notifies the OpenID authentication server of the authentication result. Then, when the service site receives an authentication result indicating that authentication has been performed from the OpenID authentication server, the service site provides a service to the user terminal. Therefore, by arranging an intermediate authentication server and exchanging messages for authentication between user terminals, it is possible to construct a system that ensures the identity while taking advantage of the features of OpenID.

  (2) In the user authentication system according to (1), the user terminal is a portable terminal, and the message for authentication is a message with an electronic certificate using a private key corresponding to a public key certificate. A featured user authentication system is proposed.

  According to the present invention, the user terminal is a mobile terminal, and the message for authentication is a message with an electronic certificate using a private key corresponding to the public key certificate. Therefore, the identity can be confirmed in the intermediate server.

  (3) The present invention proposes a user authentication system according to (1), wherein the user terminal is a personal computer, and the message for authentication is a public key certificate. Yes.

  According to the present invention, the user terminal is a personal computer, and the message for authentication is a public key certificate. Therefore, the identity can be confirmed in the intermediate server.

  (4) The present invention proposes a user authentication system according to (1), wherein the unique identification information of the user is a unique identifier.

  According to this invention, the unique identification information of the user is the unique identifier. Therefore, the intermediate confirmation server can avoid acquiring unnecessary information. Also, anonymity can be enhanced for the user.

  (5) The present invention proposes a user authentication system according to (1), wherein the unique identification information of the user is a handle.

  According to this invention, the user's unique identification information is the handle. Therefore, the intermediate confirmation server can avoid acquiring unnecessary information. Also, anonymity can be enhanced for the user.

  (6) The present invention relates to a user's mobile terminal, a service provider's service site, an OpenID authentication server that authenticates the user's OpenID against the service site, and between the OpenID authentication server and the user terminal. A user authentication method in a user authentication system including an intermediate authentication server that performs user authentication, in which the user's mobile terminal transmits a public key certificate and a private key to the intermediate authentication server and logs in A first step (for example, corresponding to step S101 in FIG. 5) and a second step in which the user's mobile terminal transmits a service use request to the service site (for example, corresponding to step S102 in FIG. 5) When the service site receives a service use request from the user's mobile terminal, the Open A third step of transmitting a redirect for authentication mediation to the D authentication server; and input of an ID and a password to the user terminal when the OpenID authentication server receives a redirect for authentication mediation from the service site A fourth step (for example, corresponding to step S103 in FIG. 5), and a fifth step in which the OpenID authentication server notifies the intermediate authentication server of the unique identifier or handle of the user and transmits an authentication request. And a sixth step (for example, corresponding to step S104 of FIG. 5) in which the intermediate authentication server performs authentication by confirming the login status of the user in response to the authentication request from the OpenID authentication server, The seventh step in which the OpenID authentication server receives the authentication result from the intermediate authentication server. (For example, corresponding to step S105 in FIG. 5) and the eighth step (for example, corresponding to step S106 in FIG. 5) in which the OpenID authentication server transmits the received authentication result from the intermediate authentication server to the service site. ), And when the service site receives an authentication result indicating that the authentication has been performed from the OpenID authentication server, a ninth step of providing a service to the user's mobile terminal (for example, FIG. 5). (Corresponding to step S107).

  According to the present invention, the user's mobile terminal transmits a public key certificate and a private key to the intermediate authentication server, logs in, and transmits a service use request to the service site. When the service site receives a service use request from the user's mobile terminal, the service site transmits a redirect for authentication mediation to the OpenID authentication server. When the OpenID authentication server receives a redirect for authentication mediation from the service site, the OpenID authentication server requests the user terminal to input an ID and a password, notifies the intermediate authentication server of the user's unique identifier or handle, and sends an authentication request. Send. In response to the authentication request from the OpenID authentication server, the intermediate authentication server performs authentication by confirming the login status of the user. The OpenID authentication server receives the authentication result from the intermediate authentication server, and transmits the received authentication result from the intermediate authentication server to the service site. The service site provides a service to the user's portable terminal when receiving an authentication result indicating that the authentication has been made from the OpenID authentication server. Therefore, an intermediate authentication server is arranged and a public key certificate for authentication and a private key are exchanged between the user's mobile terminals, thereby constructing a system that guarantees the identity while taking advantage of the features of OpenID. can do.

  (7) The present invention relates to a user's personal computer, a service provider's service site, an OpenID authentication server that authenticates the user's OpenID to the service site, and between the OpenID authentication server and the user terminal. A user authentication method in a user authentication system comprising an intermediate authentication server for performing user authentication, wherein the user's personal computer transmits a public key certificate to the intermediate authentication server and logs in. (For example, corresponding to step S201 in FIG. 8), a second step in which the user's personal computer transmits a service use request to the service site (for example, corresponding to step S202 in FIG. 8), and the service The site is supported from the user's personal computer. A third step of transmitting a redirect for authentication mediation to the OpenID authentication server when the service use request is received, and when the OpenID authentication server receives a redirect for authentication mediation from the service site And a fourth step for requesting the personal computer to input an ID and password (for example, corresponding to step S203 in FIG. 8), and the OpenID authentication server notifies the intermediate authentication server of the user's unique identifier or handle. A fifth step of transmitting an authentication request, and a sixth step in which the intermediate authentication server performs authentication by confirming a user login status in response to the authentication request from the OpenID authentication server (for example, 8) and the OpenID authentication server. The seventh step of receiving the authentication result from the intermediate authentication server (for example, corresponding to step S205 in FIG. 8), and the OpenID authentication server sends the received authentication result from the intermediate authentication server to the service site. When the service site receives an authentication result indicating that the authentication has been completed from the OpenID authentication server (for example, corresponding to step S206 of FIG. 8) A user authentication method characterized by comprising a ninth step for providing a service (for example, corresponding to step S207 in FIG. 8) is proposed.

  According to this invention, the user's personal computer transmits a public key certificate to the intermediate authentication server, logs in, and transmits a service use request to the service site. When the service site receives a service use request from the user's personal computer, the service site transmits a redirect for authentication mediation to the OpenID authentication server. When the OpenID authentication server receives a redirect for authentication mediation from the service site, it requests the personal computer to enter the ID and password, notifies the intermediate authentication server of the user's unique identifier or handle, and sends the authentication request. To do. In response to the authentication request from the OpenID authentication server, the intermediate authentication server performs authentication by confirming the login status of the user. The OpenID authentication server receives the authentication result from the intermediate authentication server, and transmits the received authentication result from the intermediate authentication server to the service site. Then, when the service site receives the authentication result indicating that the authentication has been made from the OpenID authentication server, the service site provides the service to the user's personal computer. Therefore, by arranging an intermediate authentication server and exchanging public key certificates for authentication between the user's personal computers, it is possible to construct a system that guarantees identity while taking advantage of the features of OpenID. it can.

  (8) The present invention relates to a user's mobile terminal, a service provider's service site, an OpenID authentication server that authenticates the user's OpenID to the service site, and between the OpenID authentication server and the user terminal. A program for causing a computer to execute a user authentication method in a user authentication system including an intermediate authentication server that performs user authentication, wherein the user's mobile terminal makes a public key certificate and a secret to the intermediate authentication server A first step of transmitting a key and logging in (for example, corresponding to step S101 of FIG. 5), and a second step of transmitting a service use request to the service site by the user's mobile terminal (for example, (Corresponding to step S102 in FIG. 5), the service site receives a service from the user's mobile terminal. A third step of transmitting a redirect for authentication mediation to the OpenID authentication server when receiving a use request for the authentication, and when the OpenID authentication server receives a redirect for authentication mediation from the service site A fourth step of requesting the user terminal to input an ID and password (for example, corresponding to step S103 of FIG. 5), and the OpenID authentication server notifies the intermediate authentication server of the unique identifier or handle of the user. A fifth step of transmitting an authentication request, and a sixth step in which the intermediate authentication server authenticates the authentication request from the OpenID authentication server by confirming the login status of the user (for example, FIG. 5), and the OpenID authentication server performs the intermediate authentication. A seventh step of receiving an authentication result from the server (for example, corresponding to step S105 in FIG. 5), and an eighth step in which the OpenID authentication server transmits the received authentication result from the intermediate authentication server to the service site. Step (for example, corresponding to step S106 in FIG. 5) and when the service site receives an authentication result indicating that authentication has been completed from the OpenID authentication server, provides a service to the mobile terminal of the user A program for causing a computer to execute the ninth step (e.g., corresponding to step S107 in FIG. 5) is proposed.

  According to the present invention, according to the present invention, the user's portable terminal transmits a public key certificate and a private key to the intermediate authentication server, logs in, and transmits a service use request to the service site. . When the service site receives a service use request from the user's mobile terminal, the service site transmits a redirect for authentication mediation to the OpenID authentication server. When the OpenID authentication server receives a redirect for authentication mediation from the service site, the OpenID authentication server requests the user terminal to input an ID and a password, notifies the intermediate authentication server of the user's unique identifier or handle, and sends an authentication request. Send. In response to the authentication request from the OpenID authentication server, the intermediate authentication server performs authentication by confirming the login status of the user. The OpenID authentication server receives the authentication result from the intermediate authentication server, and transmits the received authentication result from the intermediate authentication server to the service site. The service site provides a service to the user's portable terminal when receiving an authentication result indicating that the authentication has been made from the OpenID authentication server. Therefore, an intermediate authentication server is arranged and a public key certificate for authentication and a private key are exchanged between the user's mobile terminals, thereby constructing a system that guarantees the identity while taking advantage of the features of OpenID. can do.

  (9) The present invention relates to a user personal computer, a service provider service site, an OpenID authentication server that authenticates the user's OpenID to the service site, and the OpenID authentication server and the user terminal. A program for causing a computer to execute a user authentication method in a user authentication system including an intermediate authentication server that performs user authentication, wherein the personal computer of the user transmits a public key certificate to the intermediate authentication server And a second step (for example, the step of FIG. 8) in which the user's personal computer transmits a service use request to the service site. Equivalent to S202) and the service site A third step of transmitting a redirect for authentication mediation to the OpenID authentication server when a service use request is received from the user's personal computer; and the OpenID authentication server sends an authentication mediation from the service site When receiving the redirect, a fourth step (for example, corresponding to step S203 in FIG. 8) requesting the personal computer to input the ID and password, and the OpenID authentication server sends the user's user ID to the intermediate authentication server. A fifth step of notifying a unique identifier or a handle and transmitting an authentication request; and a step in which the intermediate authentication server authenticates the authentication request from the OpenID authentication server by confirming a login status of the user. 6 steps (for example, step S in FIG. 8) 04), a seventh step (for example, corresponding to step S205 in FIG. 8) in which the OpenID authentication server receives an authentication result from the intermediate authentication server, and the OpenID authentication server receives the received intermediate authentication. The eighth step of transmitting the authentication result from the server to the service site (for example, corresponding to step S206 in FIG. 8), and the service site received the authentication result indicating that the authentication was successful from the OpenID authentication server Sometimes, a program for causing a computer to execute a ninth step (for example, corresponding to step S207 in FIG. 8) for providing a service to the personal computer of the user is proposed.

  According to this invention, the user's personal computer transmits a public key certificate to the intermediate authentication server, logs in, and transmits a service use request to the service site. When the service site receives a service use request from the user's personal computer, the service site transmits a redirect for authentication mediation to the OpenID authentication server. When the OpenID authentication server receives a redirect for authentication mediation from the service site, it requests the personal computer to enter the ID and password, notifies the intermediate authentication server of the user's unique identifier or handle, and sends the authentication request. To do. In response to the authentication request from the OpenID authentication server, the intermediate authentication server performs authentication by confirming the login status of the user. The OpenID authentication server receives the authentication result from the intermediate authentication server, and transmits the received authentication result from the intermediate authentication server to the service site. Then, when the service site receives the authentication result indicating that the authentication has been made from the OpenID authentication server, the service site provides the service to the user's personal computer. Therefore, by arranging an intermediate authentication server and exchanging public key certificates for authentication between the user's personal computers, it is possible to construct a system that guarantees identity while taking advantage of the features of OpenID. it can.

  ADVANTAGE OF THE INVENTION According to this invention, there exists an effect that the authentication method using the user of a portable terminal or a personal computer can be provided, without destroying the utilization form of the existing authentication service seen from the user and the service provider.

  Further, according to the present invention, at the time of user authentication, the identity confirmation part depends on authentication using a portable terminal or a personal computer, but the authentication service can be arbitrarily selected by the user. The degree of freedom is high. For this reason, it is also possible to use a plurality of authentication services properly, and it is possible to increase the anonymity of the user.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
Note that the constituent elements in the present embodiment can be appropriately replaced with existing constituent elements, and various variations including combinations with other existing constituent elements are possible. Therefore, the description of the present embodiment does not limit the contents of the invention described in the claims.

<First Embodiment>

  A first embodiment of the present invention will be described with reference to FIGS.

<System configuration>
As shown in FIG. 1, the user authentication system according to the present embodiment includes a mobile terminal 1, an OpenID authentication server 2, an intermediate authentication server 3, and a service site 4. Connected through.

  Here, the mobile terminal 1 is a terminal possessed by the user, and transmits a service request in order to use the service site 4. The OpenID authentication server 2 provides an ID for OpenID to the user and receives an authentication request from the service site. In response to the authentication request from the OpenID authentication server 2, the intermediate authentication server 3 performs user authentication using a public key certificate authentication service and returns a response. The service site 4 is a site that provides a service to a user, and authentication by OpenID is performed for user authentication.

<Prerequisites>
The following preconditions are shown below before entering the detailed description.
1) It is assumed that the user has already obtained an ID at the OpenID site.
2)
It is assumed that the user uses a public key certificate service (security path) and has installed a public key certificate on his mobile phone.
3)
The OpenID authentication server 2 and the intermediate authentication server 3 are linked in advance. For identification between the OpenID authentication server 2 and the intermediate authentication server 3, both IDs (OpenID ID and public key certificate) are used. This is performed using a common identifier (handle) different from the ID of the book.
4)
When there is an authentication request from the service site 4, the OpenID authentication server 2 determines in advance by the user and the service how to authenticate the ID, and authenticates as usual, and the OpenID authentication server 2 is registered as information.
5)
The OpenID authentication server 2 determines whether or not to request authentication from the intermediate authentication server 3 based on information registered in advance.

<Configuration of mobile terminal>
As shown in FIG. 2, the mobile terminal 1 includes a login unit 11, an input unit 12, and a service request transmission unit 13.

  The login unit 11 performs login by sending a public key certificate and a public key from a transmission unit (not shown) to the intermediate authentication server 3. The input unit 12 inputs an ID and a password on the authentication screen transmitted from the OpenID authentication server 2 when making a service request to the service site 4. The service request transmission unit 13 transmits a service request to a specific service site 4.

<Configuration of OpenID authentication server>
As shown in FIG. 3, the OpenID authentication server 2 includes a reception unit 21, a control unit 22, a transmission unit 23, an authentication result database (DB) 24, a login information database (DB) 25, and a handle database (DB). 26).

  The receiving unit 21 receives an authentication result from the intermediate authentication server 3 and receives login information from the mobile terminal 1 using a public key certificate and a public key. The control unit 22 temporarily stores the authentication result received by the receiving unit 21 in the authentication result database (DB) 24 and transmits it to the service site 4 via the transmission unit 23. Further, the login information received from the portable terminal 1 is checked against the information in the login information database (DB) 25 for confirmation. Further, the handle of the user is searched from the handle database (DB) 26 and transmitted to the intermediate authentication server 3 via the transmitter 23. A unique identifier may be used instead of the handle.

  When receiving a redirect for authentication mediation from the service site 4, the transmission unit 23 transmits a screen for requesting input of an ID and a password to the mobile terminal 1. Also, the user's handle is notified to the intermediate authentication server 3 and an authentication request is transmitted. Further, the authentication result from the intermediate authentication server 3 is transmitted to the service site 4.

  The authentication result database (DB) 24 is a database that temporarily stores the authentication result received from the intermediate authentication server 3. The login information database (DB) 25 is a database that stores user login information. The handle database (DB) 26 is a database that stores handles unique to the user.

<Configuration of intermediate authentication server>
As shown in FIG. 4, the intermediate authentication server 3 includes a reception unit 31, an authentication unit 32, a transmission unit 33, and a handle database (DB) 34.

  The receiving unit 31 receives the user's handle from the OpenID authentication server 2. The authentication unit 32 performs authentication by searching the handle database 34 based on the handle received from the OpenID authentication server 2 to identify the user and confirming the login status of the user. The transmission unit 33 notifies the OpenID authentication server 2 of the authentication result.

<System processing>
The process of the user authentication system according to the present invention will be described with reference to FIG.
First, before using the service site 4, the user uses the public key certificate authentication service to authenticate itself to the intermediate authentication server 3 in advance. As a result, the intermediate authentication server 3 is logged in. Specifically, a signature with a private key paired with the public key certificate is sent as a message for authentication from the portable terminal 1 to the intermediate authentication server 3 (step S101).

  Next, the user transmits a service use request to the service site 4 to be used using the OpenID ID (step S102). The service site 4 that has received the service use request transmits an authentication request by redirection to the corresponding OpenID authentication server 2 (step S103).

  The user inputs an OpenID ID and a password corresponding to the OpenID authentication server 2. The OpenID authentication server 2 checks whether the user performs normal authentication or uses the intermediate authentication server 3. When the intermediate authentication server 3 is used, the OpenID authentication server 2 3, an authentication request is issued (step S104). At this time, the OpenID authentication server 2 notifies the intermediate authentication server 3 of the handle of the user.

  The intermediate authentication server 3 that has received the authentication request from the OpenID authentication server 2 checks whether the user is currently being authenticated using the public key certificate service (step S105). The intermediate authentication server 3 notifies the OpenID authentication server 2 of the authentication result as a message (step S106).

  Based on the notification from the intermediate authentication server 3, the OpenID authentication server 2 sends the user authentication result to the service site 4, and the user authentication for the service use is completed (step S 107). Then, after authentication, the user can use the service (step S108).

  As described above, according to the present embodiment, an intermediate authentication server is arranged, and authentication messages are exchanged between user terminals, thereby ensuring identity verification while taking advantage of the features of OpenID. A system can be constructed.

<Second Embodiment>
A second embodiment of the present invention will be described with reference to FIGS.

<System configuration>
As shown in FIG. 6, the user authentication system according to this embodiment includes an OpenID authentication server 2, an intermediate authentication server 3, a service site 4, and a personal computer 6, which are connected via a network 5. Connected.

  Here, the personal computer 6 is a terminal possessed by the user, and transmits a service request in order to use the service site 4. In response to the authentication request from the OpenID authentication server 2, the intermediate authentication server 3 performs user authentication using a public key certificate and returns a response.

<Configuration of personal computer>
As shown in FIG. 7, the personal computer 6 includes a login unit 41, an input unit 12, and a service request transmission unit 13. The functions of the input unit 12 and the service request transmission unit 13 are the same as those in the first embodiment, and thus detailed description thereof is omitted.

  The login unit 41 performs login by sending a public key certificate from a transmission unit (not shown) to the intermediate authentication server 3.

<System processing>
Processing of the user authentication system according to the present invention will be described with reference to FIG.
First, before using the service site 4, the user uses the public key certificate to authenticate himself / herself to the intermediate authentication server 3 in advance. As a result, the intermediate authentication server 3 is logged in. Specifically, a public key certificate is sent as a message for authentication from the personal computer 6 to the intermediate authentication server 3 (step S201).

  Next, the user transmits a service use request to the service site 4 to be used by using the OpenID ID (step S202). The service site 4 that has received the service use request transmits an authentication request by redirection to the corresponding OpenID authentication server 2 (step S203).

  The user inputs an OpenID ID and a password corresponding to the OpenID authentication server 2. The OpenID authentication server 2 checks whether the user performs normal authentication or uses the intermediate authentication server 3. When the intermediate authentication server 3 is used, the OpenID authentication server 2 3 issues an authentication request (step S204). At this time, the OpenID authentication server 2 notifies the intermediate authentication server 3 of the handle of the user.

  The intermediate authentication server 3 that has received the authentication request from the OpenID authentication server 2 checks whether or not the user is currently being authenticated using the public key certificate (step S205). The intermediate authentication server 3 notifies the OpenID authentication server 2 of the authentication result as a message (step S206).

  Based on the notification from the intermediate authentication server 3, the OpenID authentication server 2 sends the user authentication result to the service site 4, and the user authentication for the service use is completed (step S 207). Then, after authentication, the user can use the service (step S208).

  As described above, according to the present embodiment, an intermediate authentication server is arranged, and authentication messages are exchanged between user terminals, thereby ensuring identity verification while taking advantage of the features of OpenID. A system can be constructed.

  These programs are recorded on a computer-readable recording medium, and the program recorded on the recording medium is stored in each of the portable terminal 1, the OpenID authentication server 2, the intermediate authentication server 3, and the personal computer 6 (all are computer systems). The user authentication system of the present invention can be realized by reading and executing. The computer system here includes an OS and hardware such as peripheral devices.

  Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW (World Wide Web) system is used. The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

  The embodiments of the present invention have been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiments, and includes designs and the like that do not depart from the gist of the present invention. For example, in this embodiment, a case where a mobile terminal or a personal computer is used alone as a user terminal has been described. However, the mobile terminal can be connected to a network and the personal computer can be connected to the mobile terminal. .

It is a block diagram of the user authentication system which concerns on 1st Embodiment. It is a block diagram of the portable terminal which concerns on 1st Embodiment. It is a block diagram of the OpenID authentication server which concerns on 1st Embodiment. It is a block diagram of the intermediate | middle authentication server which concerns on 1st Embodiment. It is a processing sequence of the user authentication system which concerns on 1st Embodiment. It is a block diagram of the user authentication system which concerns on 2nd Embodiment. It is a block diagram of the personal computer which concerns on 2nd Embodiment. It is a processing sequence of the user authentication system which concerns on 2nd Embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Portable terminal 2 ... OpenID authentication server 3 ... Intermediate authentication server 4 ... Service site 5 ... Network 6 ... Personal computer 11, 41 ... Login part 12 ... Input Unit 13: Service request transmission unit 21, 31 ... Reception unit 22 ... Control unit 23, 33 ... Transmission unit 24 ... Authentication result database (DB)
25 ... Login information database (DB)
26, 34 ... handle database (DB)
32 ... Authentication part

Claims (9)

A user terminal, a service provider's service site, an OpenID authentication server that authenticates the user's OpenID to the service site, and an intermediate authentication server that performs user authentication between the OpenID authentication server and the user terminal. A user authentication system,
The user terminal is
Login means for logging in by sending a message for authentication to the intermediate authentication server;
An input means for inputting an ID and a password on an authentication screen transmitted from the OpenID authentication server when a service request is made to the service site;
With
The OpenID authentication server is
An input screen transmitting means for transmitting a screen for requesting input of an ID and a password to the user terminal when receiving a redirect for authentication mediation from the service site;
An authentication request transmitting means for notifying the intermediate authentication server of the user's unique identification information and transmitting an authentication request;
Receiving means for receiving an authentication result from the intermediate authentication server;
Authentication result transmission means for transmitting the received authentication result from the intermediate authentication server to the service site;
With
The intermediate authentication server is
In response to an authentication request from the OpenID authentication server, an authentication unit that performs authentication by confirming a user's login status;
Authentication result notification means for notifying the authentication result to the OpenID authentication server;
With
A user authentication system for providing a service to the user terminal when the service site receives an authentication result indicating that authentication has been performed from the OpenID authentication server.   The user authentication system according to claim 1, wherein the user terminal is a mobile terminal, and the message for authentication is a message with an electronic certificate using a private key corresponding to a public key certificate.   The user authentication system according to claim 1, wherein the user terminal is a personal computer, and the message for authentication is a public key certificate.   The user authentication system according to claim 1, wherein the unique identification information of the user is a unique identifier.   The user authentication system according to claim 1, wherein the unique identification information of the user is a handle. A user's mobile terminal, a service provider's service site, an OpenID authentication server that authenticates the user's OpenID against the service site, and an intermediate authentication server that performs user authentication between the OpenID authentication server and the user terminal A user authentication method in a user authentication system comprising:
A first step in which the mobile terminal of the user transmits and logs in a public key certificate and a private key to the intermediate authentication server;
A second step in which the mobile terminal of the user transmits a service use request to the service site;
A third step of transmitting a redirect for authentication mediation to the OpenID authentication server when the service site receives a service use request from the mobile terminal of the user;
A fourth step of requesting the user terminal to input an ID and a password when the OpenID authentication server receives a redirect for authentication mediation from the service site;
A fifth step in which the OpenID authentication server notifies the intermediate authentication server of the user's unique identifier or handle and sends an authentication request;
A sixth step in which the intermediate authentication server performs authentication by confirming a login status of a user in response to an authentication request from the OpenID authentication server;
A seventh step in which the OpenID authentication server receives an authentication result from the intermediate authentication server;
An eighth step in which the OpenID authentication server transmits the received authentication result from the intermediate authentication server to the service site;
A ninth step of providing a service to the mobile terminal of the user when the service site receives an authentication result indicating that the authentication is successful from the OpenID authentication server;
A user authentication method comprising: User personal computer, service provider service site, OpenID authentication server for authenticating the user's OpenID to the service site, and intermediate authentication server for performing user authentication between the OpenID authentication server and the user terminal A user authentication method in a user authentication system comprising:
A first step in which the user's personal computer sends a public key certificate to the intermediate authentication server and logs in;
A second step in which the user's personal computer transmits a service use request to the service site;
A third step of transmitting a redirect for authentication mediation to the OpenID authentication server when the service site receives a service use request from the personal computer of the user;
A fourth step of requesting the personal computer to input an ID and a password when the OpenID authentication server receives a redirect for authentication mediation from the service site;
A fifth step in which the OpenID authentication server notifies the intermediate authentication server of the user's unique identifier or handle and sends an authentication request;
A sixth step in which the intermediate authentication server performs authentication by confirming a login status of a user in response to an authentication request from the OpenID authentication server;
A seventh step in which the OpenID authentication server receives an authentication result from the intermediate authentication server;
An eighth step in which the OpenID authentication server transmits the received authentication result from the intermediate authentication server to the service site;
A ninth step of providing a service to the personal computer of the user when the service site receives an authentication result indicating that the authentication is successful from the OpenID authentication server;
A user authentication method comprising: A user's mobile terminal, a service provider's service site, an OpenID authentication server that authenticates the user's OpenID against the service site, and an intermediate authentication server that performs user authentication between the OpenID authentication server and the user terminal A program for causing a computer to execute a user authentication method in a user authentication system comprising:
A first step in which the mobile terminal of the user transmits and logs in a public key certificate and a private key to the intermediate authentication server;
A second step in which the mobile terminal of the user transmits a service use request to the service site;
A third step of transmitting a redirect for authentication mediation to the OpenID authentication server when the service site receives a service use request from the mobile terminal of the user;
A fourth step of requesting the user terminal to input an ID and a password when the OpenID authentication server receives a redirect for authentication mediation from the service site;
A fifth step in which the OpenID authentication server notifies the intermediate authentication server of the user's unique identifier or handle and sends an authentication request;
A sixth step in which the intermediate authentication server performs authentication by confirming a login status of a user in response to an authentication request from the OpenID authentication server;
A seventh step in which the OpenID authentication server receives an authentication result from the intermediate authentication server;
An eighth step in which the OpenID authentication server transmits the received authentication result from the intermediate authentication server to the service site;
A ninth step of providing a service to the mobile terminal of the user when the service site receives an authentication result indicating that the authentication is successful from the OpenID authentication server;
A program that causes a computer to execute. User personal computer, service provider service site, OpenID authentication server for authenticating the user's OpenID to the service site, and intermediate authentication server for performing user authentication between the OpenID authentication server and the user terminal A program for causing a computer to execute a user authentication method in a user authentication system comprising:
A first step in which the user's personal computer sends a public key certificate to the intermediate authentication server and logs in;
A second step in which the user's personal computer transmits a service use request to the service site;
A third step of transmitting a redirect for authentication mediation to the OpenID authentication server when the service site receives a service use request from the personal computer of the user;
A fourth step of requesting the personal computer to input an ID and a password when the OpenID authentication server receives a redirect for authentication mediation from the service site;
A fifth step in which the OpenID authentication server notifies the intermediate authentication server of the user's unique identifier or handle and sends an authentication request;
A sixth step in which the intermediate authentication server performs authentication by confirming a login status of a user in response to an authentication request from the OpenID authentication server;
A seventh step in which the OpenID authentication server receives an authentication result from the intermediate authentication server;
An eighth step in which the OpenID authentication server transmits the received authentication result from the intermediate authentication server to the service site;
A ninth step of providing a service to the personal computer of the user when the service site receives an authentication result indicating that the authentication is successful from the OpenID authentication server;
A program that causes a computer to execute.

Images