JP5920891B2 - Communication service authentication / connection system and method thereof - Google Patents

Description

  The present invention relates to user authentication / connection when using a communication service via a plurality of communication networks, and more particularly to a communication service authentication / connection system and method for performing authentication / connection when connecting to a fixed network or a mobile network. It is.

A UICC (Universal Integrated Circuit Card: SIM (Subscriber Identity Module) card) used for authentication of a mobile terminal is widely used because of its high security function. Furthermore, 3GPP (Third Generation Partnership Project) uses GBA (Generalized Bootstrapping Architecture, Non-Patent Document 1 TS33.220) to realize single sign-on for higher-level services (Web services) based on SIM card authentication results. ) Application-level SIM authentication technology, and a technology for linking with OpenID, which is an authentication technology that can use multiple websites with a single user ID. (Non-patent document 2 3GPP TR33.980, Non-patent document 3, Non-patent document 4)
IEEE 802.1X is an authentication technology used when connecting to a LAN, and is a standard that regulates connection by authentication so that no terminal device other than a predetermined terminal device participates in the computer network. EAP-AKA is a protocol for performing AKA authentication using SIM on EAP (Extensible Authentication Protocol).

  For example, in communication using 802.1X (EAP-AKA), communication is performed as shown in FIG. That is, when an authentication request is sent from the terminal (801) when the terminal (801) is connected to the public WiFi (802) (901), the WiFi AP (802) of the fixed network (804) requests authentication by EAP-SIM. (902). The terminal (801) transmits the ID information stored in the SIM card in the EAP response (903).

  The WiFi AP (802) transmits the ID information to the authentication server ((AAA) server) (803) of the fixed network (804) (904). The AAA server (803) requests the start of EAP-AKA authentication (905).

  The WiFI AP (802) transmits an EAP-AKA authentication start request to the terminal (801) (906).

  The terminal (801) transmits a response to the EAP-AKA authentication start request to the WiFi AP (802) (907). The WiFi AP (802) transmits a response to the EAP-AKA authentication start request to the AAA server (803) (908).

  The AAA server (803) acquires authentication data (authentication vector) from the HSS (807) of the mobile network (809) (909,910).

  The AAA server (803) transmits an AKA authentication challenge to the WiFi AP (802) (911), and the WiFi AP (802) transmits a challenge to the terminal (801) (912).

  The terminal (801) calculates the response value in response to the challenge and transmits it to the AAA server (803) via the WiFi AP (802) (913.914).

  If the relationship between the challenge and the response value is correct, the AAA server (803) completes the authentication and notifies the WiFi AP (802) to permit the connection (915).

  The WiFi AP (802) registers terminal information such as a MAC address in the connection permission list so as to permit communication of the terminal (801), and notifies the terminal (801) of the completion of authentication (916).

  GBA is also a technology that uses SIM authentication for HTTP-based services when connecting to a mobile network. The NAF (Network Application Function) (805) of the mobile network (809) in FIG. 4 is a function that actually provides an application, and the BSF (Bootstrapping function) (808) of the mobile network (809) uses HTTP. This function performs SIM authentication.

  In communication using GBA, first, the terminal (801) requests connection to the NAF (805) (931), and the NAF (805) requests authentication processing from the terminal (932).

  The terminal (801) transmits an authentication request including the user ID to the designated BSF (808) (933).

  The BSF (808) acquires the AKA authentication data (authentication vector) of the user from the HSS (807) (934, 935).

  The BSF (808) transmits a challenge to the terminal (801) based on the authentication data (936).

  The terminal (801) calculates a response to the challenge and transmits it as an authentication response to the BSF (808) (937).

  The BSF (808) verifies whether the response relationship to the challenge is correct, and if it is correct, completes authentication and notifies the terminal (801) of successful authentication (938). At this time, a Bootstrapping Transaction Identifier (B-TID) is assigned.

  The terminal (801) accesses the NAF (805) again with B-TID (939).

  The NAF (805) requests the BSF (808) to verify the B-TID (940) in order to verify whether the transmitted B-TID is actually issued by the BSF.

  The BSF (808) notifies the verification result to the NAF (805) (941), the NAF (805) completes authentication of the terminal (801) (942), and establishes a session (943).

  In addition, 3GPP TR33.980 is considering single sign-on technology in conjunction with application level SIM authentication using GBA and OpenID / SAML. In communication using GBA-OpenID / SAML cooperation, as shown in FIG. 5, the terminal (801) requests a connection using HTTP single sign-on to the Web service (810) (961).

  The Web service (810) redirects the terminal (801) to authenticate with IdP / NAF (811) (962).

  When the terminal (801) requests authentication from the IdP / NAF (811) (963), the IdP / NAF (811) redirects so as to perform SIM authentication with the BSF (808) (964).

  The terminal (801) sends the user ID recorded on the SIM card via HTTP to the BSF (808) and requests authentication (965). Thereafter, the SIM authentication is performed by HTTP using the GBA mechanism, and a B-TID is generated. To the terminal (801). The IdP / NAF (811) verifies the validity of the B-TID to the BSF (808) (972,973), the authentication between the terminal (801) and the IdP / NAF (811) is completed, and the session is established (974).

  When the authentication is completed, the IdP / NAF (811) pays out a token indicating it to the terminal (801) (975).

  The terminal (801) accesses the Web service (810) again with the token (976).

  The web service (810) verifies whether the token is issued by the IdP / NAF (811) (977), and if the validity is confirmed (978), the authentication between the web service (810) and the terminal (801) is completed. Then, the session is established (979). Then, the Web service (810) makes an HTTP response to the terminal (801) (980).

  Next, an outline of 3GPP TR33.980 will be described with reference to FIG.

  In FIG. 6, an IdP (102) in the mobile network (mobile network) (101) is a function for providing user authentication and attribute information. When the user accesses the Web service (103), the Web service (103) Redirect access to the IdP (102). In response to this, the IdP (102) performs terminal authentication using SIM. Also, the IdP (102) confirms the user's cookie, and if it has already been authenticated, the user is not authenticated for the second and subsequent times, and single sign-on is performed. Also, the IdP (102) acquires attribute information requested by the Web service (103) regarding the user from the DB and transmits it to the Web service. At this time, the policy is checked to see if information can be sent to the service.

  The HSS (104) is a subscriber database server, and manages authentication information related to user NW (network) connection and network service subscription attribute information.

ID federation profile server (105), IdP (102) W when to issue ID eb service (103
) Is a server that manages ID issuing conditions, which are information indicating whether or not to provide authentication information and attribute information for each user .

  In the system configured as described above, authentication between the terminal and the Web service is performed as follows.

  The terminal (106) accesses to use the Web service (103).

  The web service (103) requests user authentication and redirects access from the terminal (106) to communicate with the IdP (102).

  Authentication using a SIM card is executed between the terminal (106) and the IdP (102) (authentication (SIM)).

The IdP (102) inquires of the ID association profile server (105) about the ID issuance conditions , and the ID association profile server (105) responds with the ID issuance conditions (profile confirmation).

  The Web service (103) requests the IdP (102) to authenticate the access to the IdP (102) and requests verification of the ID of the user (ID verification request).

  The ID verification result is notified from the IdP (102) to the Web service (103) (ID verification result).

  Authentication of the terminal (106) and the Web service (103) is completed (authentication complete).

3GPP TR33.980 V11.4.0 (2012-09) 3GPP TR33.980 V11.0.0 (2012-09) Andreas Leicher, Andreas U. Schmidt, and Yogendra Shah, “SmartOpenID: A Smart Card Based OpenID Protocol,” SEC 2012, IFIP AICT 376, pp. 75-86, 2012, IFIP International Federation for Information Processing 2012 Charlott Lorentzen, Markus Fiedler, and Peter Lorentzen, “Decisive Factors for Quality of Experience of OpenID Authentication Using EAP,” ADVANCES IN ELECTRONICS AND TELECOMMUNICATIONS, VOL. 2, NO. 3, SEPTEMBER 2011

  However, in the above-described conventional system, the ID providing server (IdP: Identity Provider) (102) is a function that provides an authentication result using a SIM card to a service that the terminal requests authentication. In addition, IdP (102) was originally managed and operated by a single network operator, but provides authentication information based on the same ID to web service providers across different networks (communication networks). In this case, the ID payout conditions cannot be unified.

  The above problem will be described in detail with reference to FIG.

  In FIG. 7, the same components as those of FIG.

  The AAA server (204) is an authentication server for connecting to the network using the SIM card of the mobile operator operating the mobile network (101) in the fixed network (201). The HSS (104) of the network (101) is inquired about authentication information required for SIM authentication.

  Here, the fixed network (201) also has an IdP function, the mobile terminal (106) connects to the fixed network (201) using a mobile operator's SIM card via WiFi, etc., and SIM authentication data is sent to the web service. This will be explained assuming the case to be provided.

  Similar to EAP-AKA described with reference to FIG. 4, the terminal (106) connects to the fixed network (201) after authenticating to the fixed network (201) by SIM authentication.

  The Web service (103A, 103B) is accessed from the terminal (106).

  The Web service (103A, 103B) redirects the terminal to the IdP (202) for authentication and requests ID issuance.

  A SIM authentication procedure is performed between the terminal (106) and the IdP (202).

  The IdP (202) acquires SIM authentication data from the HSS (104) via the AAA server (204) in order to acquire authentication data used for SIM authentication.

  After the authentication is completed, the IdP (202) requests an ID issue condition from the ID association profile server (203).

  At this time, since the ID federation profile server (203) of the fixed network (201) does not have the ID issuing condition corresponding to the user, the Web service (103A, 103B) that requested authorization in the IdP (202) On the other hand, it is impossible to determine whether ID information can be provided.

  In view of the above problems, the present invention is capable of single sign-on using network authentication using SIM or the like regardless of a difference between communication networks such as a fixed network and a mobile network, and a network (communication network) accessed by a terminal It is to provide a communication service authentication / connection system and method for preventing the SIM authentication from being used on the Web service side due to the difference between the two.

  In order to achieve the above object, according to the present invention, when a Web service is accessed from a terminal connected to the first communication network using authentication information corresponding to the second communication network, the Web service is configured to receive the first communication. Requesting the ID provision server of the network to issue an ID to the terminal, the ID provision server requests an ID issuance condition from the ID cooperation profile server of the first communication network, and the ID provision server receives an ID from the ID cooperation profile server. In a communication service authentication / connection system that enables access to the Web service of the terminal when an issuance condition is obtained, a profile cooperation proxy that can be connected to the ID cooperation profile server of a plurality of communication networks is provided, The profile cooperation proxy has a function of distributing ID issuance conditions between ID cooperation profile servers in the plurality of communication networks, and an ID cooperation process of the first communication network. A function of analyzing an inquiry about the ID issuance condition from a file server and analyzing an ID association profile server of the second communication network that is an inquiry target that issued the authentication information; and a second communication network that is the inquiry target A function for inquiring ID issuing conditions from the ID association profile server, and a function for transmitting the ID issuing conditions received from the ID association profile server of the second communication network to be inquired to the ID association profile server that is the inquiry source When the ID providing server of the first communication network receives an ID issuance request for the terminal from the Web service, the ID providing server via the ID cooperation profile server of the first communication network and the profile cooperation proxy By acquiring the terminal ID issuing condition from the ID link profile server of the second communication network, the terminal We propose a communication service authentication and connection system characterized to have a function to establish a single sign-on.

  Further, in order to achieve the above object, according to the present invention, when a Web service is accessed from a terminal connected to the first communication network using authentication information corresponding to the second communication network, Request an ID issuance from an ID providing server of one communication network, the ID providing server requests an ID issuance condition from the ID association profile server of the first communication network, and the ID providing server issues an ID from the ID association profile server. In a communication service authentication / connection method that enables access to the Web service of the terminal when conditions are obtained, a profile cooperation proxy that can be connected to the ID cooperation profile server of a plurality of communication networks is provided, and the profile The cooperative proxy distributes ID issuing conditions between the ID cooperative profile servers in the plurality of communication networks, and from the ID cooperative profile server of the first communication network Analyzing the inquiry of the ID issue condition, analyzing the ID linkage profile server of the second communication network that is the inquiry target that issued the authentication information, and sending it to the ID linkage profile server of the second communication network that is the inquiry target The ID issuance condition is inquired, and the ID issuance condition received from the ID association profile server of the second communication network to be inquired is transmitted to the ID association profile server of the inquiry source, and the ID of the first communication network is transmitted. When the provision server receives an ID issuance request for the terminal from the Web service, the provision server receives the ID cooperation profile server of the second communication network via the ID cooperation profile server of the first communication network and the profile cooperation proxy. By establishing the terminal ID issuance conditions, the terminal establishes single sign-on. To propose a communication service authentication and connection method that.

  According to the communication service authentication / connection system and the method of the present invention, single sign-on using network authentication using authentication information such as SIM is possible regardless of the difference of communication networks such as a fixed network and a mobile network, and a terminal The authentication information cannot be used on the Web service side due to the difference in the communication network to access.

The figure explaining the outline | summary of the communication service authentication and connection system of this invention The block diagram which shows the communication service authentication and the connection system in one Embodiment of this invention The figure explaining the detail of communication of the communication service authentication and the connection system in one Embodiment of this invention Diagram explaining 802.1X (EAP-AKA) communication Diagram explaining communication using GBA-OpenID / SAML integration (3GPP 33.980) Diagram explaining the outline of the conventional 3GPP TR33.980 The figure explaining the subject in the communication service authentication and connection system of a prior art example

  The present invention provides a site information exchange function capable of single sign-on between networks (communication networks), thereby exchanging registered site information authenticated by single sign-on by a user and accessing a different network with a SIM card. This is a technology that enables authentication by means of, etc., and authenticates and connects to services using a common ID under the same conditions.

  Details of the embodiment will be described below.

  In the present embodiment, a case will be described in which a fixed network (201) is connected using a SIM authentication card of a mobile operator operating the mobile network (101).

  First, the outline of the communication service authentication / connection system of the present invention will be described with reference to FIG. In the following description, the fixed communication network is referred to as a fixed network, and the mobile communication network is referred to as a mobile network.

  In FIG. 1, the same components as those of the conventional example described above are denoted by the same reference numerals.

  An IdP (Identity Provider Server: Identity Provider) (102) in a mobile network (mobile network) (101) has a function of providing user authentication and attribute information, and a user (terminal ( When the Web service (103A, 103B) is accessed by 106), the Web service (103A, 103B) redirects the access to the IdP (102). In response to this, the IdP (102) performs terminal authentication using SIM.

  Also, the IdP (102) confirms the user authentication status using a cookie or the like, and if it has already been authenticated, the user is not authenticated for the second and subsequent times, and realizes a single sign-on function. Also, the IdP (102) acquires attribute information requested by the Web service (103A, 103B) regarding the user from the database, and transmits the attribute information to the Web service (103A, 103B). At this time, the policy of whether or not to send information to the service is confirmed.

The HSS (104) is a subscriber database server, and manages authentication information related to the user's connection to the mobile network (network) (101), network service subscription attribute information, and the like.

ID federation profile server (105) is a W eb service (103A, 103B) with respect to it whether the information by providing authentication information and attribute information when IdP to (102) issues an ID ID It is a server that manages issuing conditions for each user .

  The IdP (202) has a function of providing user authentication information and attribute information.When the user accesses the web service (103A, 103B) via the fixed network (201) by the terminal (106), the web service (103A, 103B) 103A, 103B) redirects access to the IdP (202). In response to this, the IdP (202) performs terminal authentication using SIM.

  Also, the IdP (202) confirms the user authentication state using a cookie or the like, and if it has already been authenticated, it does not authenticate the user for the second time or later, and realizes a single sign-on function. Also, the IdP (202) acquires attribute information requested by the Web service (103A, 103B) regarding the user from the database, and transmits the attribute information to the Web service (103A, 103B). At this time, the policy, that is, the ID issuance condition, is checked to determine whether information can be transmitted to the service.

ID federation profile server (203) is a W eb service (103A, 103B) with respect to it whether the information by providing authentication information and attribute information when IdP to (202) issues an ID ID It is a server that manages issuing conditions for each user .

  The AAA server (204) is an authentication server for connecting using a SIM card of a mobile operator operating the mobile network (101) in the fixed network (201). 101) HSS (104) of 101) is inquired about authentication data by SIM.

  The profile linkage proxy (300) is a web service (103A, ID information) managed by a user ID issuer between network service providers, here between the fixed network (201) and the mobile network (101). In order to manage and distribute ID issuing conditions to 103B), it has a function to acquire and reply to ID issuing conditions.

  There are two models for the deployment of the profile cooperation proxy (300). One is a model that is deployed in a fixed network (201) and relays to inquire each mobile network when the fixed network (201) links IDs with mobile network operators of a plurality of mobile networks. The other is not the fixed network (201) or the mobile network (101), but the profile link proxy (300) is connected to the communication network of a third party intermediary that can connect the fixed network (201) and the mobile network (101). ), And a third-party intermediary operator mediates ID linkage between the operators of the fixed network (201) and the mobile network (101). In this case, the profile linkage proxy (300) is deployed in a third network (including the Internet) that is neither the fixed network (201) nor the mobile network (101). Since the profile linkage proxy is a server, it becomes a software function on a computer connected to the network.

  Next, the operation of the communication service authentication / connection system configured as shown in FIG. 1 will be described.

  The terminal (106) connects to the fixed network (201) after authenticating to the fixed network (201) by SIM authentication.

  The Web service (103A, 103B) is accessed from the terminal (106).

  The Web service (103A, 103B) requests the IdP (202) to issue an ID.

  A SIM authentication procedure is performed between the terminal (106) and the IdP (202).

  The IdP (202) acquires SIM authentication data from the AAA server (204) in order to acquire authentication data used for SIM authentication.

  After the authentication is completed, the IdP (202) requests an ID issue condition from the ID association profile server (203).

  The ID linkage profile server (203) makes an inquiry to the profile linkage proxy (300) to inquire the issuer of the ID information using the user ID issued by the operator of the mobile network (101) as a key.

  The profile cooperation proxy (300) identifies the communication network operator that issued the requested user ID, acquires the ID issuance conditions from the ID cooperation profile server (105) of the communication network operator, and acquires the fixed network (201 ) To the ID federated profile server (203).

The ID association profile server (203) returns an ID issuance condition to the IdP (202).

  Through the above processing, it is possible to control the issuance of user IDs even with the IdP (202) of the fixed network (201) in accordance with the issuance conditions of IDs issued by mobile carriers.

  Next, details of the profile cooperation proxy in the present embodiment will be described with reference to FIGS. FIG. 2 is a configuration diagram, and FIG. 3 is a diagram illustrating details of communication.

As shown in FIG. 2, the IdP (202) of the fixed network (201) includes an ID issuing unit (202A), an authentication processing unit (202B), and an ID issuing condition confirmation unit (202C).

  The ID issuing unit (202A) has a function of issuing ID information of a user authenticated by the IdP (202) to the Web service (103A, 103B).

  The authentication processing unit (202B) communicates with the terminal (106), sends a SIM authentication request to the AAA server (204), and when the AAA authentication is completed by the AAA server (204), authorization information is sent to the AAA server (204). Has the required function.

The ID issuance condition confirmation unit (202C) has a function of communicating with the ID association profile server (203) to acquire an ID issuance condition that is attribute information related to user ID association.

The ID link profile server (203) has a function of providing ID issue conditions , which are user ID link attribute information, to the IdP (202). Specifically, for each Web service, information such as whether the user is registered to authenticate using the ID linkage function is transmitted. At this time, when the ID is issued in the own network, the data of the user attribute information DB (203B) in the ID association profile server (203) is referred to. In the case of an ID issued by another business operator, a service registration status is requested to the profile linkage proxy (300) in order to acquire an ID issue condition related to the ID of the other business operator.

  In addition, the ID link profile server (203) of the fixed network (201) includes a service registration status determination unit (203A), an authorized operator identification unit (203C), and another operator authorization condition determination unit (203D), and the service registration status The determination unit (203A) has a user attribute information DB (203B).

The service registration status determination unit (203A) has a user attribute information DB (203B) that manages a list of services registered as ID linkage targets for each user for IDs issued by the company, and registers with the ID linkage service. For registered users, the registered attributes are managed, the service registration status for each user is confirmed in response to an inquiry from the IdP (202) , the ID issuance information that is ID linkage availability information is returned to the IdP, and the IdP ( 202) has a function of responding by retrieving the ID issuing condition of the user from the user attribute information DB (203B) in response to the ID issuing condition request from 202).

The service registration status determination unit (203A) also has a function of confirming the registration status of a specific user with a specific service and responding with the registration status. Therefore, the service registration status determination unit (203A) stores the user ID issuance condition by the user attribute information database (203B).

  In response to the inquiry about the registration status of each user's service inquired from the IdP (202), the authorized carrier identification unit (203C) determines the communication network that is the ID issuer from the domain information of the user ID to be inquired Identify the operator, determine whether it is another network operator, inquire about the service registration status determination unit (203A) for its own users, and other network operators for users of other network operators The authorization condition determination unit (203D) has a function of performing distribution processing so that the profile cooperation proxy (300) is inquired about the service registration status by the other communication network operator ID.

The authorization condition determination unit (203D) of another network operator receives the request distributed by the authorized operator identification unit (203C), and the authorized carrier identification unit (203C) communicates with the user of the other network operator. If it is determined, the ID registration profile server (105) of the other network operator is inquired of the service registration status via the profile cooperation proxy (300), and the ID issuance information which is ID cooperation availability information is set to IdP ( 202).

  The profile linkage proxy (300) includes a service registration status request reception unit (311), a service registration status request transmission unit (312), a service registration status response reception unit (313), a service registration status response transmission unit (314), and a request generation -A management unit (315) is provided.

The service registration status request reception unit (311) and the transmission unit (312) have a function of transmitting and receiving a request for service registration status.

The service registration status response reception unit (313) and the transmission unit (314) have a function of transmitting and receiving a service registration status response.

  The request generation / management unit (315) includes a destination operator determination function (315A), a request ID correspondence generation function (315B), a request generation source operator determination function (315C), a request ID correspondence confirmation / restore function ( 315D).

  The request generation / management unit (315) identifies the ID network operator of the ID issuer, assigns an ID for management, generates a signal necessary for obtaining the authorization conditions, and generates an ID link profile server of the ID issuer It has a function to make an inquiry. For this reason, the request generation / management unit (315) includes a determination function (315A) of the destination network operator, a request ID generation function (315A) for managing the correspondence between the received response and the request, It is equipped with a function to determine the request carrier's network operator (315C) and a request ID correspondence confirmation / restoration function (315D), which is necessary for sending and receiving ID issuance conditions to the request source and request destination network operators. It has signal conversion functions (protocol, header information generation, deletion, etc.).

  As a result, the profile cooperation proxy (300) analyzes the ID issuance condition inquiry from the ID cooperation profile server of the predetermined communication network and the function that enables the distribution of the ID issuance conditions among the operators of the plurality of communication networks. The function of analyzing the ID link profile server of the communication target network operator that issued the authentication information transmitted from the terminal (106), and the ID link profile server of the communication target network provider that is the target of the inquiry And a function for transmitting the ID issuing condition received from the ID federated profile server to be inquired to the ID federated profile server that is the inquiry source.

That is, when exchanging an ID federation profile between communication network operators, the profile linkage proxy (300) specifies the ID issuing network operator from the user ID to be inquired, and the ID of the communication network operator. Resolve the destination of the linkage profile server, format the request signal corresponding to the destination network operator, transfer the request, transform the ID linkage availability information received as a response, and change the request carrier's network operator Return to the ID federation profile server. At this time, by relaying the request / response signal of the ID issuance condition inquiry, the signal content is converted ( deletion / replacement of information, etc. ) according to the policy of the inquiry source network operator and the inquiry destination communication network operator, It is possible to conceal information that should not be distributed among communication network operators.

  For this reason, the profile cooperation proxy (300) holds the destination information (host name, address, connection protocol, signal condition (parameters, etc.), etc.) of the ID cooperation profile server of each communication network operator as the inquiry destination.

  Next, a specific operation when the terminal (106) connects to the Web service 1 (103A) via the fixed network (201) will be described.

  The ID issuing unit (202A) of the IdP (202) of the fixed network (201) receives the authorization request from the Web service 1 (103A) and receives the authentication request to obtain the authentication token # 1 from the authentication processing unit (202B). Authentication token # 1 is transmitted to Web service 1 (103A).

The authentication processing unit (202B) receives an authentication request using the authentication token # 1 from the terminal (106), and performs an authentication process using the SIM card or the like of the terminal (106) using a technique such as GBA. Further, when the authentication is successful, the authentication processing unit (202B) inquires of the ID issuance condition confirmation unit (202C) to confirm whether the user ID can be issued to the Web service 1 (103A).

The ID issuance condition confirmation unit (202C) sends the authenticated user ID and information of the Web service 1 (103A) of the ID request source to the ID association profile server (203), and requests the ID issuance condition .

The authorized carrier identification unit (203C) of the ID linkage profile server (203) calculates the authorization network carrier from the user ID, and if it is a user of the company, it determines the service registration status together with the information of the Web service 1 (103A). to request a confirmation of ID issuance conditions in section (203A). Any user of another network operator, requesting confirmation of the ID issue condition together with information of the Web Service 1 (103A) to the ID issue condition determining unit of the other communication network operator (203D). In the following, the flow of processing when the user is another network operator will be described.

  The ID issue condition determination unit (203D) of another communication network operator transmits an ID issue condition confirmation request with the user ID and information of the requesting Web service operator to the profile cooperation proxy (300).

  After receiving the ID issuance condition confirmation request, the profile linkage proxy (300) identifies the destination network operator from the user ID and applies the relevant information from the user attribute information DB (203B) of the ID linkage profile server (203). The information (host name, address, connection protocol, signal condition (parameters, etc.), etc.) necessary for connection to the ID link profile server (105) of the network operator that issues the user ID is acquired. Based on this information, the ID link profile server (105) of the connection destination is requested to confirm the ID issue condition.

The ID linkage profile server (203) generates a service registration status response including the ID issuance condition and responds to the profile linkage proxy (300).

  The profile cooperation proxy (300) specifies the corresponding request signal from the identification ID included in the response, and transmits the service registration status response included in the received response as a response to the request transmitted from the fixed network (201). .

ID federation profile server fixed network (201) (203) refers to the ID issue condition contained therein upon receiving the response, the ID issuing against IdP (202), of the target to the Web Service 1 (103A) Send a response that includes the condition.

  Next, referring to FIG. 3, in the communication service authentication / connection system of this embodiment, specific communication when the terminal (106) connects to the Web service 1 (103A) via the fixed network (201). Will be described.

  When the user accesses the Web service 1 (103A) from the terminal (106) through the fixed network (201) (401) and authenticates on the Web service (103), the user authenticates with the ID issued by the fixed network (201). If selected, an authentication request is made from the Web service 1 (103A) to the IdP (202) of the fixed network (201) (402).

  The IdP (202) issues an authentication request identification ID # 1 to the Web service 1 (103A) and notifies the Web service 1 (103A) in order to identify which authentication request of which service is to be paid out. (403).

  The Web service 1 (103A) notifies the authentication request identification ID # 1 to the terminal (106) and redirects the terminal (106) to authenticate with the IdP server (202) of the fixed network (201) (404).

  The terminal (106) notifies the IdP (202) of the authentication request identification ID # 1 and starts authentication (405).

  In order to authenticate the terminal (106) by SIM, the IdP (202) makes a SIM authentication request to the AAA server (204) of the fixed network (201) (406).

  The AAA server (204) notifies the IdP (202) of the SIM authentication request identification ID # 2 in order to identify which IdP (202,102) authentication request is issued to the IdP (202) (407). ).

  The IdP (202) notifies the SIM authentication request identification ID # 2 to the terminal (106) and redirects the signal from the terminal (106) to perform SIM authentication with the AAA server (204) (408).

  The terminal (106) makes an authentication request to the AAA server (204) using the SIM authentication request identification ID # 2 (409).

  The AAA server (204) acquires authentication information from an HSS (Home Subscriber Server) (104) of the mobile network (101), and performs authentication using the SIM or the like with the terminal (106) (410, 411). After the authentication is completed (412), the AAA server (204) issues a SIM authentication token # 2 indicating that the terminal (106) has been authenticated (413).

  The terminal (106) transmits the SIM authentication request identification ID and the SIM authentication token received from the AAA server (204) to the IdP (202) and requests authentication processing (414).

  The IdP (202) transmits a SIM authentication request identification ID # 2 to the AAA server (204) in order to inquire the AAA server (204) about the SIM authentication result (415).

  The AAA server (204) transmits SIM authentication token # 2 to the IdP (202) based on the SIM authentication result (416).

The IdP (202) confirms the match of the SIM authentication token sent from the terminal (106) and the AAA server (204), and the IdP (202) is registered that the requesting Web service 1 (103A) performs the authentication agency. In order to check whether or not the ID is issued , an ID issue condition request is transmitted to the ID link profile server (203) of the fixed network (201) (417).

The ID association profile server (203) transmits the received ID issue condition request to the profile association proxy (300) (418).

In response to this, the profile linkage proxy (300) issues the ID from the correspondence between the user and the service to the ID linkage profile server (105) of the appropriate carrier from the communication network of the request source and information such as ID and service. Queries the condition (419).

ID federation profile server (105) checks the ID issue condition information from its user and the service, through the profile linkage proxy (300), the ID federation profile server (203) to the ID issue condition of the fixed network (201) The ID link profile server (203) transmits ID issue conditions to the IdP (202) (422).

The IdP (202) notifies the authentication token # 1 to the Web service 1 (103A) to the terminal (106) based on the ID issuance condition information (423).

  The terminal (106) transmits a set of the authentication request identification ID # 1 and token # 1 to the Web service 1 (103A) and requests authentication processing (424).

  Web service 1 (103A) queries authorization information from IdP (202) using authentication request identification ID # 1 (425), obtains token # 1 (426), and compares it with the token sent by terminal (106) The processing is completed and single sign-on is realized (427).

According to the communication service authentication / connection system of the above embodiment, single sign-on using network authentication using SIM is possible regardless of the difference between communication networks such as the fixed network (201) and the mobile network (101). That is, the problem that the SIM authentication information cannot be used on the Web service side due to the difference in the network (communication network) accessed by the terminal (106) can be solved.

  Single sign-on using network authentication using SIM etc. is possible regardless of the difference in communication networks such as fixed network and mobile network, and authentication on the Web service side due to the difference in network (communication network) accessed by terminal (106) It is possible to provide a communication service authentication / connection system and method in which information cannot be used.

  101 ... Mobile network, 102 ... IdP, 103A, 103B ... Web service, 104 ... HSS, 105 ... ID linkage profile server, 106 ... Terminal, 201 ... Fixed network, 202 ... IdP, 203 ... ID linkage profile server, 204 ... AAA Server (authentication server), 300 ... Profile linkage proxy, 311 ... Service registration status request reception unit, 312 ... Service registration status request transmission unit, 313 ... Service registration status response reception unit, 314 ... Service registration status response transmission unit, 315 ... Request generation / management unit, 315A ... destination operator determination function, 315B ... request ID correspondence generation function, 315C ... request generation source operator determination function, 315D ... request ID correspondence confirmation / restoration function.

Claims (8)

When a Web service is accessed from a terminal connected to the first communication network using authentication information corresponding to the second communication network, the Web service issues an ID to the terminal to the ID providing server of the first communication network. The ID providing server requests an ID issuance condition from the ID association profile server of the first communication network, and the ID providing server obtains the ID issuance condition from the ID association profile server. In a communication service authentication / connection system that enables access to Web services,
Providing a profile linkage proxy that can be connected to the ID linkage profile server of multiple communication networks,
The profile linkage proxy is
A function of distributing ID issuance conditions between ID federated profile servers in the plurality of communication networks;
A function of analyzing an inquiry about the ID issuance condition from an ID association profile server of the first communication network, and analyzing an ID association profile server of the second communication network that is an inquiry target that issued the authentication information;
A function for inquiring ID issuing conditions to the ID link profile server of the second communication network to be inquired;
A function of transmitting the ID issuing condition received from the ID link profile server of the second communication network to be inquired to the ID link profile server of the inquiry source;
The ID providing server of the first communication network is
When receiving an ID issuance request for the terminal from the Web service, the ID of the terminal from the ID federated profile server of the second communication network via the ID federated profile server of the first communication network and the profile linked proxy A communication service authentication / connection system comprising a function for establishing a single sign-on of the terminal by acquiring an issuance condition. The profile linkage proxy is
2. The communication service authentication / connection system according to claim 1, wherein at the time of relaying the request / response signal of the inquiry about the ID issuing condition, the signal content is converted according to a policy of the inquiry source communication network and the inquiry destination communication network. . The communication service authentication / connection system according to claim 1, wherein the profile cooperation proxy has a function of holding destination information of ID cooperation profile servers of a plurality of communication networks that are inquiry destinations. The communication service authentication / connection system according to any one of claims 1 to 3, wherein the profile cooperation proxy is arranged in a fixed communication network connected to a plurality of mobile communication networks. The communication service according to any one of claims 1 to 3, wherein the profile cooperation proxy is provided in a communication network of a third-party brokerage company connected to a fixed communication network and a mobile communication network. Authentication / connection system. When a Web service is accessed from a terminal connected to the first communication network using authentication information corresponding to the second communication network, the Web service requests the ID providing server of the first communication network to issue an ID. The ID provision server requests an ID issuance condition from the ID association profile server of the first communication network, and when the ID provision server obtains the ID issuance condition from the ID association profile server, the ID provision server sends the ID provision condition to the web service of the terminal. In the communication service authentication and connection method that enables access to
Providing a profile linkage proxy that can be connected to the ID linkage profile server of multiple communication networks,
The profile linkage proxy is
Distributing ID issuance conditions between ID federated profile servers in the plurality of communication networks,
Analyzing the ID issuance condition inquiry from the ID association profile server of the first communication network, and analyzing the ID association profile server of the second communication network that is the inquiry target that issued the authentication information;
Inquires about the ID issuance condition to the ID link profile server of the second communication network to be inquired,
Sending the ID issuing condition received from the ID federation profile server of the second communication network to be inquired to the inquiring source ID federated profile server;
When the ID providing server of the first communication network receives an ID issuance request for the terminal from the Web service, the second communication is performed via the ID cooperation profile server of the first communication network and the profile cooperation proxy. A communication service authentication / connection method, characterized in that single sign-on of the terminal is established by acquiring an ID issuing condition of the terminal from an ID link profile server of the network. 7. The profile linkage proxy converts signal contents according to a policy of an inquiry source communication network and an inquiry destination communication network when relaying an inquiry request / response signal of the ID issuance condition. Communication service authentication / connection method. The communication service authentication / connection method according to claim 6 or 7, wherein the profile cooperation proxy holds destination information of ID cooperation profile servers of a plurality of communication networks as inquiry destinations.

Images