JP2008310409A - Information processing system, authentication device, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information processing system capable of outputting authentication information from an authentication device to an information processor even if a user is not authenticated, and to provide the authentication device and a program. <P>SOLUTION: The information processor 12, the authentication device 14, and a user side device 16 communicate one another. The information processor 12 executes prescribed processing according to a user's request, acquire user's authentication information, and determines whether processing is executed based on the authentication information. The authentication device 14 authenticates a user of processing that the information processor 12 executes, outputs the authenticated user's authentication information to the information processor 12, stores information on the user authenticated by the authentication means and output destination information including information on processing to be executed by the information processor 12, and outputs the user's authentication information to the information processor 12, based on the information on the user included in the output destination information and information showing processing to be executed by the information processor 12. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an information processing system, an authentication device, and a program.

  An increasing number of systems utilize ID linkage technology for linking user IDs between information processing devices that provide services and authentication devices that authenticate users of these services. In the Organization for the Advancement of Structured Information Standards (OASIS), Security Assertion Markup Language (SAML) standardizing a mechanism for exchanging information regarding authentication and the like is standardized.

Patent Documents 1 to 3 disclose inventions related to ID linkage technology.
JP 2002-335239 A JP 2003-58503 A JP 2003-85141 A

  In a system that utilizes ID linkage technology, when a user is authenticated, the authentication information of the user is output from the authentication device to the information processing device.

  The present invention has been made in view of the above problems, and an object of the present invention is to provide an information processing system and authentication system that can output authentication information from the authentication device to the information processing device even when the user is not authenticated. To provide an apparatus and a program.

  The invention according to claim 1 is an information processing system including an information processing device and an authentication device, wherein the information processing device executes a predetermined process in response to a user request, and the user Means for acquiring the authentication information, and means for determining whether or not to execute the process based on the authentication information, wherein the authentication apparatus uses the predetermined process executed by the information processing apparatus. A first authentication information output means for authenticating the user and outputting the authenticated user authentication information to the information processing apparatus, the user information authenticated by the authentication means, and the information processing Means for storing output destination information including information on the predetermined process executed by the apparatus; information on the user included in the output destination information; and information indicating the predetermined process executed by the information processing apparatus. Based on the use Authentication information, and is obtained by the fact that a second authentication information output means for outputting to the information processing apparatus.

  The invention according to claim 2 is the information processing system according to claim 1, wherein the information processing apparatus verifies the authentication information output by a second authentication information output means of the authentication apparatus. Is further included.

  The invention according to claim 3 is an authentication apparatus, which executes predetermined processing in response to a user request, acquires authentication information of the user, and executes the processing based on the authentication information. And means for communicating with the information processing apparatus, authenticating a user of the predetermined process executed by the information processing apparatus, and obtaining the authenticated user authentication information as the information processing apparatus First authentication information output means for outputting to, means for storing output destination information including information on the user authenticated by the authentication means, and information on the predetermined processing executed by the information processing apparatus; A second unit for outputting the user authentication information to the information processing device based on the user information included in the output destination information and information indicating the predetermined processing executed by the information processing device; Authentication information output means It is obtained by the.

  The invention according to claim 4 is the authentication apparatus according to claim 3, wherein the authentication information output by the first authentication information output means stores information about the user. 1st authentication information instruct | indicating to an apparatus, The said authentication information which the said 2nd authentication information output means outputs to the said information processing apparatus overwriting the information regarding the said user which the said information processing apparatus memorize | stored This is the second authentication information to be instructed.

  The invention according to claim 5 is the authentication device according to claim 3 or 4, wherein the second authentication information output means outputs the authentication information in response to a predetermined output request. It is.

  The invention according to claim 6 is a program that executes predetermined processing in response to a user request, acquires authentication information of the user, and executes the processing based on the authentication information. Means for determining whether to communicate with the information processing apparatus, authenticating a user of the predetermined processing executed by the information processing apparatus, and outputting the authenticated authentication information of the user to the information processing apparatus First authentication information output means, means for storing output destination information including information on the user authenticated by the authentication means and information on the predetermined process executed by the information processing apparatus, the output destination information Second authentication information output for outputting the user authentication information to the information processing device based on the user information included in the information and information indicating the predetermined processing executed by the information processing device Means, as a compilation In which it was decided to work over data.

  The above program can also be stored in a computer-readable information storage medium.

  According to the first, third, and sixth aspects of the invention, the authentication information can be output from the authentication device to the information processing device even when the user is not authenticated.

  According to the second aspect of the present invention, the authentication information output at a timing not when the user is authenticated is also verified.

  According to the fourth aspect of the present invention, the information about the user stored in the information processing apparatus based on the first authentication information at the time of authentication can be overwritten based on the second authentication information.

  According to the fifth aspect of the present invention, the timing for outputting the authentication information from the authentication device to the information processing device can be adjusted.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram showing an overall configuration of an information processing system according to an embodiment of the present invention. As illustrated in FIG. 1, the information processing system 10 includes an information processing device 12, an authentication device 14, and a user side device (client device) 16.

  The information processing device 12 and the user side device 16 are connected via a network such as the Internet. The user side device 16 and the authentication device 14 are connected to a local area network (LAN).

  The information processing apparatus 12 includes a program control device such as a central processing unit (CPU), and performs predetermined processing (for example, business service or document sharing service) used by the user of the user side device 16. Execute on request. In addition, a storage element such as a random access memory (RAM), a hard disk, and a network interface are also provided.

  The information processing apparatus 12 acquires user authentication information and determines whether or not to execute a predetermined process based on the authentication information. If necessary, the authentication information of the user is verified based on information relating to the authentication device 14 stored in advance. Request authentication for unauthenticated users. Also, it stores or overwrites shared information that is generated based on the authentication information and indicates attributes such as the user's name, e-mail address, department, etc. The information processing apparatus 12 executes a predetermined process using this shared information.

  As illustrated in FIG. 2, the authentication device 14 includes a control unit 20, a storage unit 22, and a communication unit 24. The control unit 20 is a program control device such as a Central Processing Unit (CPU), and operates according to a program stored in the storage unit 22.

  The storage unit 22 stores user information 26 including attribute information such as the user ID, password, name, mail address, and department to which the user is exemplified, as illustrated in FIG. The control unit 20 stores user information 26 in the storage unit 22. The control unit 20 may encrypt the password or the like included in the user information 26 and store it in the storage unit 22. The control unit 20 performs operations (addition, change, deletion, etc.) on the user information 26 stored in the storage unit 22.

  The communication unit 24 communicates with the information processing apparatus 12, the user side apparatus 16, and the like.

  The user side device 16 is constituted by a known personal computer including a control unit such as a CPU, a storage unit such as a hard disk, an output unit such as a display, an input unit such as a keyboard, and a communication unit such as a network board. Yes.

  Next, an outline of the operation of the control unit 20 of the authentication device 14 of the present embodiment will be described. The control unit 20 operates in accordance with a program stored in the storage unit 22, and functionally, as shown in FIG. 4, a user information storage unit 30, an authentication screen generation unit 32, and a first authentication information output unit 34. , Functioning as an output destination information storage unit 36 and a second authentication information output unit 38.

  The user information storage unit 30 stores user information 26 related to the user authenticated by the authentication device 14 in the storage unit 22. The stored user information 26 is also operated (changed or deleted).

  The authentication screen generation unit 32 receives an authentication request from the information processing device 12, generates an authentication screen, and outputs this authentication screen to an output unit such as a display of the user side device 16.

  The first authentication information output unit 34 authenticates the user of the process executed by the information processing apparatus 12 and outputs the first authentication information of the authenticated user. The output first authentication information is transmitted to the information processing apparatus 12 via the user side apparatus 16.

  The output destination information storage unit 36 includes an output including information on the user whose authentication information has been output from the first authentication information output unit 34 and information on processing executed by the information processing apparatus 12 from which the authentication information has been output. The previous information is stored in the storage unit 22. The output destination information is also manipulated (changed or deleted).

  The second authentication information output unit 38 reads the output destination information from the storage unit 22, and based on the user information included in the output destination information and the information of the process executed by the information processing apparatus 12, the user The second authentication information is generated and output. The output second authentication information is transmitted to the information processing apparatus 12 via the user side apparatus 16.

  These elements are realized by executing an authentication program installed in the authentication device 14, which is a computer, by the control unit 20 such as a CPU included in the authentication device 14. The authentication program is supplied to the authentication device 14 via an information transmission medium such as a CD-ROM or DVD-ROM, or via a communication network such as the Internet.

  Next, the detailed processing flow of the information processing system 10 according to the embodiment of the present invention will be described with reference to the flowcharts shown in FIGS.

  The user information storage unit 30 of the authentication device 14 stores the user information 26 illustrated in FIG. 3 in the storage unit 22 (S101).

  A user of a predetermined process executed by the information processing device 12 operates the user side device 16 (for example, inputs information to a Web browser executed on the user side device 16). Then, the user side device 16 transmits a processing request to the information processing device 12 (S102).

  Here, the information processing apparatus 12 determines whether or not the processing request includes user authentication information (first authentication information or second authentication information) (S103). Here, the information processing apparatus 12 may be configured to verify user authentication information based on information related to the authentication apparatus 14 stored in advance. Here, since the first authentication information of the user is not included in the processing request, the information processing device 12 requests the user side device 16 to authenticate with the authentication device 14 (S104). Then, the user side device 16 requests the authentication device 14 to authenticate the user (S105).

  The authentication screen generator 32 of the authentication device 14 generates the authentication screen 40 shown in FIG. 7 (S106), and outputs it to an output device such as a display of the user side device 16 (S107).

  The user inputs a user ID and a password, for example, using an input device such as a keyboard of the user side device 16. Then, the user side device 16 transmits the input information to the authentication device 14 (S108). Here, it is assumed that the user side device 16 transmits information including a user ID “0011” and a password “XXXX” to the authentication device 14.

  The authentication device 14 authenticates the user based on, for example, the user ID and password transmitted from the user side device 16 (S109). Specifically, the authentication device 14 determines whether the user has been successfully authenticated based on the transmitted information and the user information 26 (see FIG. 3) stored in the storage unit 22 of the authentication device 14. Determine if you did. For example, the combination of the user ID and password transmitted to the authentication device 14 is compared with the combination of the user ID and password included in the user information 26, and if the corresponding combination is found, the combination is successful. If it is not found, it is determined to have failed.

  If the authentication fails (S109: N), the authentication device 14 outputs the authentication screen 40 to the display of the user side device 16 again (S107). Here, for example, an error screen may be output to the display of the user device 16 when the authentication has failed a predetermined number of times.

  Here, it is assumed that the authentication for the user with the user ID “0011” has succeeded. If the authentication is successful (S109: Y), the authentication device 14 generates the first authentication information 42 illustrated in FIG. 8 based on the user information 26 (S110). FIG. 8 illustrates the first authentication information 42 generated when the user with the user ID “0011” is authenticated. The first authentication information 42 includes attribute information such as a user ID, name, e-mail address, department to which the user belongs, and a flag indicating that the authentication information is the first authentication information 42. Note that the authentication device 14 may indicate that the authentication information is the first authentication information 42 by a method other than the flag.

  And the authentication apparatus 14 transmits the 1st authentication information 42 to the user side apparatus 16 (S111). The user side device 16 transmits a processing request including the first authentication information 42 to the information processing device 12 (S112).

  Then, as illustrated in FIG. 9, the authentication device 14 includes the information on the user to which the first authentication information 42 has been transmitted and the information related to the process to be authenticated (for example, the Web executing the process). The output destination information 44 including the Uniform Resource Locator (URL) of the site is stored in the storage unit 22 of the authentication device 14 (S113). In the present embodiment, the output destination information 44 includes the date and time when the authentication information was last output to the information processing apparatus 12 (final output date and time). Note that the authentication device 14 may execute the process of S113 before the process of S111.

  Then, the information processing apparatus 12 determines whether or not the first authentication information 42 is included in the processing request (S114). Here, the information processing apparatus 12 may be configured to verify the first authentication information 42 included in the processing request based on information related to the authentication apparatus 14 stored in advance. For example, it may be verified whether the authentication device 14 is authenticated. Here, the authentication information of the user ID “0011” is included in the processing request (S114: Y). Therefore, for example, the information processing apparatus 12 generates an execution screen for the processing of the document sharing service (S115) and outputs it to the display of the user side apparatus 16 (S116). In this way, the information processing apparatus 12 executes a predetermined process in response to a user request.

  Further, at this time, the information processing apparatus 12 extracts and stores the shared information 46 for sharing among the users exemplified in FIG. 10 from the first authentication information 42 (S117). In the example of FIG. 10, the user ID, name, mail address, and department information are stored as shared information 46. In this way, the information processing apparatus 12 can store the shared information 46 related to each user and execute a predetermined process using the shared information 46. The information processing apparatus 12 may execute the process of S117 before the process of S115.

  An administrator of the authentication device 14 operates the authentication device 14. Accordingly, the output destination information storage unit 36 of the authentication device 14 changes the department to which the user information 26 with the user ID “0011” belongs to “accounting unit” as illustrated in FIG. 11 (S201).

  The second authentication information output unit 38 of the authentication device 14 confirms the final output date and time of the output destination information 44 stored in the storage unit 22 at a predetermined time interval (for example, every several hours) (S202). If there is output destination information 44 for which a predetermined time has passed since the last output date and time (S202: Y), the second authentication information is obtained based on the user information 26 corresponding to the output destination information 44. Generate (S203).

  Here, the second authentication information output unit 38 outputs the destination information 44 indicating that the authentication information (first authentication information or second authentication information) of the user ID “0011” has been output to the document sharing service. Suppose that it is confirmed that a predetermined time has passed since the last output date.

  At this time, as illustrated in FIG. 12, the second authentication information 48 generated in S203 includes attribute information such as a user ID, name, e-mail address, department, and the authentication information. A flag indicating information 48 is included. Note that the authentication device 14 may indicate that the authentication information is the second authentication information 48 by a method other than the flag. The department information included in the second authentication information 48 illustrated in FIG. 12 is “accounting department”.

  The second authentication information output unit 38 transmits the second authentication information 48 to the information processing apparatus 12 that executes processing (for example, a document sharing service) indicated by the output destination information 44 (S204).

  At this time, there is no need to transmit via the user side device 16.

  The output destination information storage unit 36 of the authentication device 14 stores information indicating that the second authentication information 48 has been transmitted to the information processing device 12 in the storage unit 22 of the authentication device 14. For example, the information of the last transmission date in the output destination information 44 is updated (S205).

  The information processing apparatus 12 that has received the second authentication information 48 selects the shared information 46 corresponding to the user ID included in the second authentication information 48 from the stored shared information 46 (S206). . Here, the information processing apparatus 12 may be configured to verify the second authentication information 46 included in the processing request based on information related to the authentication apparatus 14 stored in advance. For example, it may be verified whether the authentication device 14 is authenticated.

  The information processing apparatus 12 overwrites the shared information 46 with information included in the second authentication information 48 (S207). As illustrated in FIG. 13, the department to which the user with the user ID “0011” belongs is overwritten with “Accounting Department”. As described above, when the information processing apparatus 12 receives the second authentication information 48, the information processing apparatus 12 does not output an execution screen for a predetermined process on the display of the user side apparatus 16. In this way, the second authentication information 48 can be output from the authentication device 14 to the information processing device 12 even when the user is not authenticated.

  The present invention is not limited to the above embodiment.

  For example, a plurality of information processing devices 12, authentication devices 14, and user devices 16 may be included in the information processing system 10.

  For example, the network between the information processing device 12 and the user device 16 is not limited to the Internet. The network between the authentication device 14 and the user device 16 is not limited to a LAN.

  Further, for example, when the administrator of the authentication device 14 performs a management operation of the authentication device 14 and the user information storage unit 30 of the authentication device 14 changes the user information 26, the user information 26 is based on the user information 26. The second authentication information 48 may be generated and transmitted to the information processing apparatus 12.

  Further, for example, at the timing when the user information storage unit 30 of the authentication device 14 changes the user information 26, change information indicating that a change has been made is stored in the storage unit 22, and based on this change information. Thus, the second authentication information 48 may be generated.

  Further, for example, when the information processing apparatus 12 makes an authentication request to the authentication apparatus 14, the output timing of the second authentication information 48 is specified, and the authentication apparatus 14 responds to the specified timing. The second authentication information 48 may be output to 12.

  Also, for example, the second authentication information output unit 38 includes the second authentication information 48 including information instructing to stop using or discard the shared information 46 stored in the information processing apparatus 12. It may be generated.

  Further, for example, in S104 and S105 (see FIG. 5), only when the information processing apparatus 12 transmits an authentication request including information instructing to store the output destination information 44 to the authentication apparatus 14. However, the output destination information 44 may be stored in the storage unit 22.

  Further, for example, in S104 and S105 (see FIG. 5), the information processing apparatus 12 may directly transmit an authentication request to the authentication apparatus 14 without going through the user side apparatus 16. In S <b> 111 and S <b> 112 (see FIG. 5), the authentication device 14 may directly transmit the first authentication information 42 to the information processing device 12 without going through the user side device 16.

  Further, for example, the first authentication information 42 and the second authentication information 48 may be information based on a standard such as SAML.

  Further, for example, the output destination information storage unit 36 may store the output destination information 44 including the first authentication information 42 and the second authentication information 48 in the storage unit 22.

  In addition, for example, after the first authentication information 42 is issued, when the user side device 16 makes a processing request to the information processing device 12 and the first authentication information 42 is transmitted to the information processing device 12. In addition, the last update date and time of the output destination information 44 may be updated.

  Further, for example, the process of confirming the output destination information 44 shown in S202 (see FIG. 6) may be performed by a dedicated server or application provided separately instead of the authentication device 14.

  Further, for example, when the user operates the Simple Object Access Protocol (SOAP) client instead of operating the Web browser executed by the user side device 16, the user side device 16 causes the information processing device 12 to operate. You may make it transmit a process request to.

It is a figure showing an information processing system concerning one embodiment of the present invention. It is a figure which shows the authentication apparatus which concerns on one Embodiment of this invention. It is a figure which shows an example of user information. It is a functional block diagram of the authentication apparatus which concerns on one Embodiment of this invention. It is a figure which shows the flow of the process performed with an information processing system. It is a figure which shows the flow of the process performed with an information processing system. It is a figure which shows an example of an authentication screen. It is a figure which shows an example of 1st authentication information. It is a figure which shows an example of output destination information. It is a figure which shows an example of shared information. It is a figure which shows an example of user information. It is a figure which shows an example of 2nd authentication information. It is a figure which shows an example of shared information.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 Information processing system, 12 Information processing apparatus, 14 Authentication apparatus, 16 User side apparatus, 20 Control part, 22 Storage part, 24 Communication part, 26 User information, 30 User information storage part, 32 Authentication screen generation part, 34 first authentication information output unit, 36 output destination information storage unit, 38 second authentication information output unit, 40 authentication screen, 42 first authentication information, 44 output destination information, 46 shared information, 48 second authentication information.

Claims (6)

An information processing system including an information processing device and an authentication device,
The information processing apparatus is
Means for executing a predetermined process in response to a user request;
Means for obtaining authentication information of the user;
Means for determining whether to execute the process based on the authentication information;
With
The authentication device is
First authentication information output means for authenticating a user of the predetermined process executed by the information processing apparatus and outputting the authenticated authentication information of the user to the information processing apparatus;
Means for storing output destination information including information on the user authenticated by the authentication means and information on the predetermined processing executed by the information processing apparatus;
A second unit for outputting the user authentication information to the information processing apparatus based on the user information included in the output destination information and information indicating the predetermined processing executed by the information processing apparatus; Authentication information output means,
Having
An information processing system characterized by this. The information processing apparatus is
Means for verifying the authentication information output by the second authentication information output means of the authentication device;
The information processing system according to claim 1. Means for communicating with an information processing device for executing predetermined processing in response to a user request, obtaining authentication information of the user, and determining whether to execute the processing based on the authentication information; ,
First authentication information output means for authenticating a user of the predetermined process executed by the information processing apparatus and outputting the authenticated authentication information of the user to the information processing apparatus;
Means for storing output destination information including information on the user authenticated by the authentication means and information on the predetermined processing executed by the information processing apparatus;
A second unit for outputting the user authentication information to the information processing apparatus based on the user information included in the output destination information and information indicating the predetermined processing executed by the information processing apparatus; Authentication information output means,
An authentication device comprising: The authentication information output by the first authentication information output means is first authentication information that instructs the information processing apparatus to store information about the user,
The authentication information output by the second authentication information output means is second authentication information that instructs the information processing apparatus to overwrite information on the user stored in the information processing apparatus.
The authentication apparatus according to claim 3. The second authentication information output means comprises:
Outputting the authentication information in response to a predetermined output request;
The authentication apparatus according to claim 3 or 4, wherein Means for communicating with an information processing device for executing predetermined processing in response to a user request, obtaining authentication information of the user, and determining whether to execute the processing based on the authentication information;
First authentication information output means for authenticating a user of the predetermined process executed by the information processing apparatus and outputting the authenticated authentication information of the user to the information processing apparatus;
Means for storing output destination information including information on the user authenticated by the authentication means and information on the predetermined processing executed by the information processing apparatus;
A second unit for outputting the user authentication information to the information processing apparatus based on the user information included in the output destination information and information indicating the predetermined processing executed by the information processing apparatus; Authentication information output means,
A program characterized by causing a computer to function.

Images