Authentication system, method and storage medium

Patent metadata

Field	Value
Publication number	US-2016248759-A1
Application number	US-201615148058-A
Country	US
Kind code	A1
Filing date	May 6, 2016
Priority date	Nov 6, 2013
Publication date	Aug 25, 2016
Grant date	—

Abstract

An authentication system according to an embodiment is provided with a service providing apparatus, an IDaaS corporation apparatus, and an authentication providing apparatus. Based on the user ID and SSO request transmitted from the user terminal, the authentication providing apparatus executes authentication processing for the user. If the result of the authentication processing indicates success, the IDaaS corporation apparatus having SSO account information including the SSO account identifier identical to the user ID, permits SSO authentication to be executed for the service identified by the service account identifier included in the service account information associated with the SSO account information. The service providing apparatus transmits information related to the service to the user terminal.

First claim

1 . An authentication system comprising:
a service providing apparatus capable of communicating with a user terminal operated by a user; an IDaaS corporation apparatus, and an authentication providing apparatus, the service providing apparatus comprising a service account information memory that stores service account information including: (i) service account identifiers for identifying accounts of a service provided by the service providing apparatus; and (ii) a first federation ID, the IDaaS corporation apparatus comprising an SSO account information memory that stores single sign-on (SSO) account information including (i) a single sign-on (SSO) account identifier which is identical to a user ID for identifying the user, (ii) a first federation ID, and (iii) a second federation ID different from the first federation ID, the authentication providing apparatus comprising an authentication account information memory that stores authentication account information including: (i) an authentication account identifier for identifying an account of authentication processing corresponding to the user, (ii) a second federation ID which is identical to the second federation ID, and (iii) an authentication class indicative of a method of the authentication processing, wherein, based on the user ID and an SSO request transmitted from the user terminal, the authentication providing apparatus having authentication account information which is associated, by the second federation ID, with the SSO account information including the SSO account identifier identical to the user ID, executes authentication processing for the user who operates the user terminal, if a result of the authentication processing indicates success, the IDaaS corporation apparatus having SSO account information including the SSO account identifier identical to the user ID of the usr subjected to authentication processing, permits SSO authentication to be executed for the service identified by the service account identifier included in the service account information associated with the SSO account information by the first federation ID, and the service providing apparatus which provides the service for which the SSO authentication is permitted, transmits information related to the service to the user terminal which transmitted the user ID and the SSO request.

2 . The authentication system according to claim 1 , wherein the authentication providing apparatus comprises a first table memory storing an authentication class management table, in which an authentication class representing an authentication method and an authentication level representing the level of the authentication processing are described in association with each other,
the SSO account information memory includes the authentication level, if something is wrong with the authentication processing, and the level of that authentication deteriorates, the authentication providing apparatus updates the authentication class management table in such a manner as to lower the authentication level of the authentication processing, and transmits to the IDaaS corporation apparatus the lowered authentication level and the authentication class associated therewith in the authentication account information, and upon receipt of the authentication level and authentication class from the authentication providing apparatus, the IDaaS corporation apparatus searches the SSO account information based on the received authentication class, and updates the SSO account information such that the authentication level searched for is lowered to the received authentication level.

3 . The authentication system according to claim 1 , wherein the authentication providing apparatus comprises a first table memory storing an authentication class management table in which an authentication class representing an authentication method, an authentication level representing the level of the authentication processing and an authentication class index including a name of an authentication provider of the authentication class are described in association with one another,
the SSO account information memory does not include the authentication level but includes the authentication class index, the IDaaS corporation apparatus comprises a second table memory storing an authentication level management table in which an authentication level and an authentication class index are described in association with each other, if something is wrong with the authentication processing, and the level of that authentication deteriorates, the authentication providing apparatus updates the authentication class management table in such a manner as to lower the authentication level of the authentication processing, and transmits to the IDaaS corporation apparatus the authentication level lowered in the authentication class management table and the authentication class index associated therewith, and upon receipt of the authentication level and authentication class index from the authentication providing apparatus, the IDaaS corporation apparatus searches the authentication level management table based on the received authentication class index, and updates the authentication level management table such that the authentication level searched for is lowered to the received authentication level.

4 . An authentication system comprising an IDaaS corporation apparatus and an authentication providing apparatus capable of respectively communicating with a user terminal operated by a user and a service providing apparatus for providing the user with a service,
the service providing apparatus storing service account information including (i) a service account identifier for identifying an accounts of the service provided by the service providing apparatus and (ii) a first federation ID, the IDaaS corporation apparatus comprising a single sign-on (SSO) account information memory that stores single sign-on (SSO) account information including (i) a single sign-on account identifier which is identical to a user ID for identifying the user, (ii) a first federation ID, and (iii) a second federation ID different from the first federation ID, the authentication providing apparatus comprising an authentication account information memory that stores authentication account information including (i) an authentication account identifier for identifying an account of authentication processing corresponding to the user, (ii) a second federation ID which is identical to the second federation ID, and (iii) an authentication class indicative of a method of the authentication processing, wherein, based on the user ID and an SSO request transmitted from the user terminal, the authentication providing apparatus having authentication account information which is associated, by the second federation ID, with the SSO account information including the SSO account identifier identical to the user ID, executes authentication processing for the user who operates the user terminal, if a result of the authentication processing indicates success, the IDaaS corporation apparatus having SSO account information including the SSO account identifier identical to the user ID of the user subjected to authentication processing, permits SSO authentication to be executed for the service identified by the service account identifier included in the service account information associated with the SSO account information by the first federation ID, and the service providing apparatus which provides the service for which the SSO authentication is permitted, transmits information related to the service to the user terminal which transmitted the user ID and the SSO request.

5 . An authentication method executed by an authentication system comprising:
a service providing apparatus comprising a service account information

Assignees

• Toshiba Kk
• Toshiba Solutions Corp

Inventors

• Tsurumi Rieko
• Nishimura Akio
• Ikeda Tatsuro

Classifications

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title

• G06F21/41

  where a single sign-on provides access to a plurality of computers · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/0815 Primary

  providing single-sign-on or federations · CPC title