JP4758575B2 - User authentication method and user authentication system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a method for providing common user authentication among a plurality of Web servers belonging to different domains in a Web site for electronic commerce.
[0002]
[Prior art]
There is a middleware product called single sign-on. A mechanism for enabling a user to access a plurality of different systems by a single logon operation (input of a user ID and a password) is realized. Among these, those having a function called affiliate (partnership) are known. This function makes it possible to access other sites without a logon operation by logging on to the first site when sequentially accessing a plurality of electronic commerce Web sites operated by different companies.
[0003]
Prior to the advent of middleware products with affiliate functions, there were the following problems. For example, assume that a bookstore website is open at a shopping mall site of another company. Since this site needs to protect the user's personal information such as a credit card number, user registration is required. A user who has been registered as a user logs on to this shopping mall site by entering a user ID and password in order to place an order to purchase a book. Suppose you select a book, finish the order, and immediately try to check the delivery status of another book you ordered earlier on the site. However, this shopping mall site does not have a function of confirming the delivery status, and it is necessary to move to the website of the bookstore for the confirmation. Similarly, since the bookstore site is a site that requires user registration, the user must enter a user ID and password registered in the bookstore site and perform a logon operation in order to access. It is troublesome for the user to perform the logon operation every time the site is moved in this way, and the efficiency of the access processing as a whole is also poor for the company.
[0004]
Using a single sign-on product that has an affiliate function, when a user logs on to a shopping mall site and receives user authentication, a bookstore site that has established a trust relationship with a shopping mall company, such as a business alliance, Immediately, information indicating that the user has been authenticated at the shopping mall company side is immediately sent in the background. As a result, when the user accesses the bookstore site, the user has already been authenticated and no logon operation is required. In short, the affiliate function means that when a user sequentially accesses a server in multiple domains, the user only has to log on to one of the servers once, and the user can be in the background to another server. This is a function that gives user authentication in advance.
[0005]
[Problems to be solved by the invention]
However, since the single sign-on product as described above adds dedicated middleware to a system consisting of a Web server and a client, it requires introduction and maintenance costs and labor. If the same function can be realized with only a normal Web server, Web browser, or CGI tool, the installation and maintenance are simple and the cost is low.
[0010]
[Means for Solving the Problems]
In order to solve the above problems, the present invention, when the first server belonging to the first domain, a step of receiving an authentication request from the user, the previous SL first server, completing the authentication, second The user authentication is completed, including link information to a second server belonging to the domain of the user, the user authentication information indicating that the user has been authenticated by the first server, and link information having the attribute information of the user and transmitting the screen configuration data to the user terminal, when the browser before SL user terminal interprets the link information to the second server, the user terminal accesses the second server, the user is the transmitting the attribute information of the user authentication information and the user indicating that the authenticated by the first server to the second server, the previous SL second server, said Yu Toward The terminal, and transmitting the cookie containing the attribute information of the user authentication information and the user,
When prior SL user accesses the second server, the second server adds the user attribute information of receiving the cookie in the cookie in the link information to the first server, wherein the link information and transmitting to the user terminal, when the browser before SL user terminal interprets the link information, wherein the step of transmitting said user attribute information to the first server, the user attributes before Symbol first server receives Collating the information with the user attribute information transmitted to the user terminal, and transmitting the collation result to the second server;
Before Stories second server, by referring to the collation result received a user authentication method characterized by comprising the steps of: performing authentication of the user.
[0011]
According to the present invention, the user attribute information at the time when the first server is first accessed and the user attribute information transmitted from the second server are collated again in the first server, so that the user authentication is performed. It is possible to more reliably prevent unauthorized access such as spoofing, which is forged information only.
[0012]
Further, in the user authentication method of the present invention, the user attribute information, a plurality of user attribute information having different significance, by confirming the user attribute information of the plurality of individually, to authenticate users in multiple levels It is good .
[0013]
In this way, accessible screens can be divided into a plurality of levels according to the user authentication level.
[0014]
In the user authentication method of the present invention, the first and second domain servers may be secure servers, and the user authentication information communicated may be encrypted .
[0015]
In this way , the confidentiality of user authentication information and user attribute information, which are user personal information, can be further improved.
[0018]
The present onset Ming, a first server belonging to the first domain, a user authentication system and a second server belonging to the second domain,) before Symbol first server, an authentication request from a user reception, before Symbol first server, wherein when completing the authentication, the user authentication information and the user indicates that the second a link information to the server the user has already been authenticated by the first server including link information having the attribute information, and transmits an authentication completion screen configuration data of the user to the user terminal, when the browser before SL user terminal interprets the link information to the second server, the user terminal is the accesses the second server, the user transmits the attribute information of the user authentication information and the user indicating that the authenticated by the first server to the second server, before Symbol second server Ba is toward the user terminal, and transmits a cookie containing the attribute information of the user authentication information and the user, when the front SL user accesses the second server, the second server, the cookie when received is added to the link information of the user attribute information to the first server in the cookie, and sends the link information to the user terminal, the browser before SL user terminal interprets the link information, wherein transmitting the user attribute information to the first server, and the user attribute information before Symbol first server receives, and user attribute information transmitted to the user terminal collates, and transmits the collation result to the second server , before Symbol second server, by referring to the collation result received, it performs authentication of the user is a user authentication system characterized by.
[0019]
Further, in this onset Ming user authentication system, the user attribute information, a plurality of user attribute information having different significance, by confirming the user attribute information of the plurality of individually authenticate users in multiple levels It is good as well .
[0020]
Further, in this onset Ming user authentication system, the first and second domain server is a secure server, the user authentication information to be communicated may be that which has been encrypted.
[0021]
DETAILED DESCRIPTION OF THE INVENTION
=== System configuration ===
First, an overview of a system configuration according to an embodiment of the present invention will be described. FIG. 1 is a diagram showing an outline of the system configuration of this embodiment. The user accesses the first server 12 that manages the website of company A and the second server 14 that manages the website of company B through a browser installed in the terminal 10 such as a personal computer. Web shopping and so on. Of course, the first server 12 and the second server 14 have different domains. The terminal 10, the first server 12, and the second server 14 communicate with each other via the Internet. The first server 12 is connected to the database 16.
[0022]
In this embodiment, the website operated by company A is a shopping mall site having various types of stores. Company B is a bookstore and is open at a shopping mall site of Company A, but some information such as the delivery status of the book that has been ordered can only be confirmed on Company B's own website. Company A's site and Company B's site have a function to display a screen for providing individual information to each user, but user registration is required to use this function due to the necessity of protecting personal information. There is a need. The user is given a user ID and password at the time of registration, and thereafter, in order to access these Web sites, they are input and subjected to user authentication (this operation is hereinafter referred to as a logon operation).
[0023]
For example, when accessing the website of Company A many times in succession, a file called a cookie can be used to provide user authentication without performing logon operations one by one. A cookie is a small file such as a text format that contains user ID and user attribute information such as access history, etc., which can be saved on the Web client by the Web server and later retrieved appropriately. . When the user tries to access the server, the server can perform user authentication without taking the user to perform logon operations one by one by taking out the cookie from the client and referring to the contents. As will be described in detail later, the present invention uses this cookie and other mechanisms to receive user authentication on the website of company A, and does not require a logon operation when subsequently accessing the website of company B. In this way, mutual authentication of users is realized.
[0024]
The database 16 stores user IDs and passwords of all member users, and access history information (user attribute information) such as session IDs and browser IDs. In the user authentication by the logon operation, the first server 12 collates the user ID and password input by the user with the record in the database 16. In user authentication using a cookie, access history information such as a session ID included in the cookie taken out from the user terminal 10 is collated with a record in the database 16.
[0025]
=== Flow of processing ===
Next, a processing flow of a user authentication method which is a reference example of the present invention will be described. FIG. 2 is a flowchart showing the flow of processing of this reference example . First, in order to access the website of company A, the user requests user authentication from the first server 12 (s201). Specifically, the user ID and password issued in advance are input, and the first server 12 verifies this with the record in the database 16. If it is determined that it is correct (s203), the first server 12 then transmits a Web image that notifies the user terminal 10 of the completion of authentication (s205).
[0026]
The user confirms this image with a browser. At this time, link information to the second server 14 is included in the Web image configuration data. The browser of the user terminal 10 that has received this link information interprets it without permission and accesses the second server 14 as background processing for the user. There are various mechanisms for realizing this link information. In this reference example , a mechanism called a beacon banner is used.
[0027]
Specifically, the beacon banner is a link tag in a format in which an argument is added to a URL as described below. <Img width = "1" height = "1" src = https: //secureB.Bcompany.co.jp/? F = Acompany & y = YYYYYYYY & b = BBBBBBBB & s = SSSSSSSS &login> where width and height In both cases, 1 indicates that link information having a size of 1 pixel which is invisible to the user is included in the Web screen indicating the authentication notification. When the user's browser finds this 1-pixel beacon banner, it automatically accesses the server of the domain described in the following section https: //. SecureB is the name of the server (second server) of company B. “?” Is an argument as additional information, and describes user authentication information, a user ID, a browser ID, and user attribute information indicating a session ID. In this example, the & login portion at the end is user authentication information, and f = Acompany indicates that user authentication has already been performed on the website of Company A. The y = YYYYYYYY part is the user ID, the b = BBBBBBBB part is the browser ID, and the s = SSSSSSSS part is the session ID. By confirming the browser ID, even the terminal of the same user can be identified. By confirming the session ID, access can be distinguished every time.
[0028]
When the user terminal 10 automatically accesses the second server 14, the user terminal 10 transmits the user authentication information and the user attribute information described in the link tag (s207). Next, the second server 14 creates a cookie describing the received user authentication information and user attribute information, and transmits the cookie to the user terminal 10. This cookie is stored in the user terminal 10 (s209). Since the processes from the reception of the link information from the first server 12 to the reception of the cookie from the second server 14 are performed in the background in the user terminal 10, the user is unaware of these processes.
[0029]
At this point, the user is logged on to the website of Company A and is purchasing the desired book, but will continue to check the delivery status of the book that was ordered on the site before. Then. In this case, the hypertext mechanism moves from the shopping mall site of company A to the website of company B linked. In order to access the website of Company B, a logon operation is usually required. However, in the present invention, user authentication is automatically performed by using the cookie stored in the user terminal 10 earlier. No operation is required, which is very convenient for the user.
[0030]
More specifically, the user first tries to access the second server 14 of company B (s211). Then, the second server 14 instructs the browser of the user terminal 10 to take out the cookie previously transmitted to the user terminal 10 and transmit it to the second server 14. Then, this cookie is received (s213), and the user authentication information portion is confirmed, so that the delivery status confirmation image is immediately transmitted to the user terminal 10 even if the user authentication is successfully performed (s215). If the user authentication information is inaccurate and unauthorized access such as impersonation is suspected, user authentication will be performed by sending a user ID and password input request screen and having a normal logon operation performed. do it.
[0031]
In the above reference example , the user authentication is performed by confirming only the user authentication information described in the cookie transmitted to the second server 14. In other words, in this case, the user is permitted to access only with a record that the user has been authenticated by the first server 12 of the company A. In this case, only the user authentication information may be described as an argument in the link tag, which is as follows. <Img width = "1" height = "1" src = https: //secureB.Bcompany.co.jp/? F = Acompany &login>
=== Embodiment with More Careful Authentication ===
Next, an embodiment of the present invention that performs more careful user authentication using user attribute information will be described. FIG. 3 is a flowchart showing the flow of processing of this embodiment. 3, the processing from s301 to s313, i.e., from the user authentication request to the first server 12, until cookies received from the user terminal 10 according to the second server 14, similar to s201 from s213 process before Symbol Reference Example Therefore, explanation is omitted.
[0032]
In the processing step of s313, the second server 14 that has received the cookie including the user authentication information and the user attribute information, next sends the first beacon banner format similar to that of the first embodiment to the user terminal 10. Link information to the server 12 is transmitted (s315). The specific contents are as follows. <Img width = "1" height = "1" src = https: //secureA.Acompany.co.jp/? F = Acompany & y = YYYYYYYY & b = BBBBBBBB & s = SSSSSSSS &login> where https: / indicates the domain to link to The part of /secureA.Acompany.co.jp is different from the beacon banner in the process of s305.
[0033]
The browser of the user terminal 10 interprets the transmitted link information, accesses the first server 12, and transmits user authentication information and user attribute information described in arguments of the link information (s317). Here, only the user attribute information may be transmitted without transmitting the user authentication information.
[0034]
Next, the first server 12 that has received the user attribute information and the like collates the user attribute information recorded in the database 16 and transmitted to the user terminal 10 in step s305 with the user attribute information received this time. (S319). If all of the user ID, browser ID, and session ID match, a normal status is transmitted to the second server 14 (s321). On the other hand, if any of the three types of attribute information does not match, it is determined that there is a strong suspicion of unauthorized access such as impersonation, and an abnormal status is transmitted to the second server 14 (s321).
[0035]
When receiving the normal status, the second server 14 immediately transmits a delivery status confirmation screen to the browser of the user terminal 10 assuming that user authentication has been performed (s323). When an abnormal status is received, user authentication may be performed by transmitting a user ID and password input request screen and performing a normal logon operation.
[0036]
In this way, by comparing the attribute information when the user first logs on to the first server 12 and the attribute information returned from the second server 14, another person impersonates the user as the user authentication information or Even if it is attempted to forge and access only some user attribute information, this can be prevented.
[0037]
=== Other variations etc. ===
Above you facilities embodiment, three by matching all user attribute information, but all was to provide a user authentication only if they match, the three types of user attribute information matching individually, multiple levels User authentication may be performed. For example, if all of the user ID, browser ID, and session ID match the initial logon time, all Web screens can be accessed, but if the browser ID or session ID is different, important personal information is described. It may be possible to prevent access to the displayed screen.
[0038]
Further, in the above you facilities embodiment, although the three types user attribute information, and other, it may be included, such as time information of the login.
[0039]
Further, in the above you facilities embodiment, the first and second server as a secure server, it may be that all the communication between such two and a user terminal is encrypted. In that case, it is possible to realize more reliable confidentiality for the personal information of the user.
[0040]
In the above embodiment , the personal computer 10, the first server 12, the second server 14 and the like communicate with each other via the Internet. Similarly, the user authentication method of the present invention can be applied.
[0041]
【The invention's effect】
According to the method of the present invention, the single sign-on function that enables access to websites of a plurality of domains with a single logon operation can be realized only with a tool such as a normal web server, web browser, or CGI. Is easy to maintain and costs less.
[Brief description of the drawings]
FIG. 1 is a system configuration diagram in an embodiment of a user authentication method of the present invention.
[Figure 2] definitive user authentication method of the reference example of the present invention, is a flow diagram showing the flow of processing.
In the implementation of a user authentication method of the present invention; FIG is a flow diagram showing the flow of processing.
[Explanation of symbols]
10 terminal 12 first server 14 second server 16 database

Claims (6)

A first server belonging to a first domain accepting an authentication request from a user;
When the first server completes the authentication, user authentication information indicating link information to a second server belonging to a second domain and indicating that the user has been authenticated by the first server; and Transmitting the user authentication completion screen configuration data to the user terminal, including link information having user attribute information;
User authentication indicating that when the browser of the user terminal interprets link information to the second server, the user terminal accesses the second server and the user has been authenticated by the first server. Transmitting information and attribute information of the user to the second server;
The second server transmits a cookie including the user authentication information and the attribute information of the user to the user terminal;
When the user accesses the second server, the second server receives the cookie, adds the user attribute information in the cookie to link information to the first server, and adds the link information to the user. Sending to the device;
Transmitting the user attribute information to the first server when the browser of the user terminal interprets the link information;
Collating the user attribute information received by the first server with user attribute information transmitted to the user terminal, and transmitting a collation result to the second server;
The second server authenticates the user by referring to the received verification result;
A user authentication method comprising: The user authentication method according to claim 1 ,
The user attribute information includes a plurality of user attribute information having different degrees of importance, and a plurality of levels of user authentication are performed by individually checking the plurality of user attribute information. The user authentication method according to claim 1 or 2 ,
The first and second domain servers are secure servers, and the user authentication information to be communicated is encrypted. A user authentication system having a first server belonging to a first domain and a second server belonging to a second domain,
The first server accepts an authentication request from a user;
When the first server completes the authentication, link information to the second server, user authentication information indicating that the user has been authenticated by the first server, and user attribute information Sending the user authentication completion screen configuration data to the user terminal, including link information having
User authentication indicating that when the browser of the user terminal interprets link information to the second server, the user terminal accesses the second server and the user has been authenticated by the first server. Transmitting information and attribute information of the user to the second server;
The second server sends a cookie including the user authentication information and the user attribute information to the user terminal;
When the user accesses the second server, the second server receives the cookie, adds the user attribute information in the cookie to link information to the first server, and adds the link information to the user. Send it to your device,
When the browser of the user terminal interprets the link information, the user attribute information is transmitted to the first server,
The user attribute information received by the first server and the user attribute information transmitted to the user terminal are collated, and the collation result is transmitted to the second server,
The second server authenticates the user by referring to the received verification result;
A user authentication system. The user authentication system according to claim 4 , wherein
The user attribute information includes a plurality of pieces of user attribute information having different importance levels, and a plurality of levels of user authentication are performed by individually checking the plurality of user attribute information. The user authentication system according to claim 4 or 5 ,
The first and second domain servers are secure servers, and the user authentication information to be communicated is encrypted.

Images