Information processing apparatus, method, and program

Abstract

To improve the use of credential information.SOLUTION: An information processing apparatus includes: registration means which registers credential information on a credential information management server; and synchronization means which receives, after obtaining authorization from a local device connected to the information processing apparatus over local network, credential information associated with a user who uses the information processing apparatus, from the credential information management server, to synchronize the credential information.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an information processing device, method, and program. [Background technology]

[0002] FIDO (registered trademark) is an authentication system that includes biometric authentication. FIDO is an abbreviation for Fast Identity Online. In addition, multi-device FIDO credentials, an extension of the credentials handled by FIDO (hereinafter referred to as FIDO credentials), have been gaining attention in recent years.

[0003] In FIDO, a registration process is performed in advance between a user's device or other authenticator and an authentication server, whereby credentials such as a private key and user ID are registered in the authenticator, and a public key is registered in the authentication server. Conventional FIDO did not have a specification for sending and storing credentials from the device where they were registered to another device or server. This meant that users could not synchronize their credentials with a device other than the one they used to register them, making account recovery impossible.

[0004] Patent Document 1 discloses account recovery in a state where a credential issuer authenticator and a credential synchronization destination FIDO authenticator are linked. Specifically, an account recovery request is sent from the synchronization destination terminal to an authentication server, and if the authentication conditions are met, account recovery is permitted.

[0005] In contrast, with multi-device FIDO credentials, during credential registration, the FIDO client module on the registration source device sends the credential to the server that manages the client module. This makes it possible to synchronize FIDO credentials with other devices the user uses. Methods for synchronizing credentials include requesting the credential from the FIDO client module on the device to the backup server, or sending the credential using device-to-device communication via BLE. BLE is an abbreviation for Bluetooth Low Energy.

[0006] Here, authenticators must be able to prevent accounts from being hijacked by easily stealing FIDO credentials stored on the user's device, for example by infecting the device with malware. For this reason, FIDO defines authentication security levels (hereafter referred to as authentication levels) based on the hardware and software requirements and the targets of defense. Currently, security levels range from L1, L1+, L2, L2+, L3, and L3+. Higher levels, and levels marked with a plus sign (if the same level is present), provide higher security because they make it more difficult to steal FIDO credentials stored internally. Thus, the higher the authentication level of an authenticator, the lower the risk of credential leakage and account hijacking.

[0007] When using multi-device FIDO credentials for business accounts that require sharing or handover, it is conceivable that FIDO credentials will be synchronized across multiple devices for each of multiple administrators. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] Japanese Patent Publication No. 2023-000715 Summary of the Invention [Problem to be solved by the invention]

[0009] Previously, there was no mechanism to restrict the use of multi-device FIDO credentials or the synchronization of authenticators based on business rules. As a result, if an employee who used an administrator account with a multi-device FIDO credential left the company and took the authenticator with them, it became possible to use or synchronize the multi-device FIDO credential outside the office. This left room for improvement regarding the use of credential information.

[0010] The present invention has been made in consideration of the above problems, and aims to improve the use of credential information. [Means for solving the problem]

[0011] An information processing device according to one embodiment of the present invention is characterized by having a registration means for registering credential information in a credential information management server, and a synchronization means for synchronizing credential information by receiving credential information associated with a user using the information processing device from the credential information management server after receiving permission from a local device connected to the information processing device via a local network. [Effects of the Invention]

[0012] The present invention allows for improved use of credential information. [Brief explanation of the drawings]

[0013] [Figure 1] 1 is a block diagram showing a configuration of a system according to a first embodiment of the present invention. [Figure 2] FIG. 2 is a block diagram showing the hardware configuration of each device according to the first embodiment of the present invention. [Figure 3] FIG. 1 is a diagram illustrating the module configuration of each device according to the first embodiment of the present invention. [Figure 4] 10 is an example of a credential information registration screen according to the first exemplary embodiment of the present invention. [Figure 5] 10 is a sequence for logging in to a service according to the first embodiment of the present invention. [Figure 6] 10 is a sequence of a credential information registration process according to the first embodiment of the present invention. [Figure 7] 10 is a sequence of a credential information registration process according to the first embodiment of the present invention. [Figure 8] 1 is a flowchart of additional authentication processing 1 according to the first embodiment of the present invention. [Figure 9] 10 is a flowchart of a credential creation determination process according to the first embodiment of the present invention. [Figure 10] 10 is a sequence of a credential information synchronization process according to the first exemplary embodiment of the present invention. [Figure 11] 10 is a sequence of a credential information synchronization process according to the first exemplary embodiment of the present invention. [Figure 12] 10 is a flowchart of additional authentication processing 2 according to the first embodiment of the present invention. [Figure 13] 10 is a flowchart of a credential synchronization determination process according to the first exemplary embodiment of the present invention. [Figure 14] 10 is a sequence of a credential information synchronization process according to the second embodiment of the present invention. [Figure 15] 10 is a sequence of a credential information synchronization process according to the second embodiment of the present invention. [Figure 16] 10 is a flowchart of an application server additional authentication process according to the second embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0014] Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[0015] [Embodiment 1] This embodiment discloses a method for restricting the registration and synchronization of credential information when additional authentication is performed by an additional authentication service provided by an additional authentication server. This embodiment relates to a process of requesting the FIDO client module of a terminal to obtain credentials from a backup server.

[0016] <System configuration> Fig. 1 is a block diagram showing the configuration of a system according to a first embodiment of the present invention. In Fig. 1, 101 and 102 are authentication terminals. The authentication terminals 101 and 102 are connected to an application server 103 and an authentication server 104 via a local network 106 and a global network 107.

[0017] The authentication terminals 101 and 102 transmit a request to create credential information to the application server 103. Then, the authentication terminals 101 and 102 transmit the registration result of the credential information to the authentication server 104. The authentication terminals 101 and 102 are examples of information processing devices.

[0018] Furthermore, the authentication terminal 101 and the authentication terminal 102 perform additional authentication by the additional authentication server 108. After the authentication process by the additional authentication server 108, the authentication terminal 101 and the authentication terminal 102 transmit a request to register credential information to the credential information management server 105, and obtain a registration result from the credential information management server 105.

[0019] In addition, the authentication terminal 101 and the authentication terminal 102 transmit a synchronization request for credential information to the credential information management server 105 and acquire the registered credential information. When transmitting a synchronization request, the authentication terminal 101 and the authentication terminal 102 need to make an authentication request to the credential information management server 105 and the authentication needs to be successful.

[0020] Reference numeral 108 denotes an additional authentication server, which is a feature of this embodiment. The additional authentication server 108 is a server that has an authentication function and is difficult to physically take out of the office, such as an MFP in an office. The additional authentication server 108 exists on the same local network 106 as the authentication terminals 101 and 102 and cannot be directly accessed from the global network 107. MFP is an abbreviation for Multifunction Peripheral. The additional authentication server 108 is an example of a local device connected to the authentication terminals 101 and 102 via the local network 106.

[0021] When the additional authentication server 108 receives an additional authentication request from the authentication terminal 101 or 102, it checks the authentication information in the additional authentication server 108 and performs additional authentication processing. If the additional authentication processing is successful, the authentication terminal 101 or 102 transmits a request to register the credential information to the credential information management server 105. Note that in this embodiment, network communication is performed between the authentication terminal 101 or 102 and the additional authentication server 108 via the local network 106, but short-range communication using short-range wireless communication such as Bluetooth or NFC may also be used.

[0022] Reference numeral 103 denotes an application server. The application server 103 receives a request to create credential information from the authentication terminal 101 or 102. The authentication terminal 101 or 102 makes an additional authentication request to the additional authentication server 108, and if successful, transmits the result of creating the credential information to the authentication server 104. Furthermore, when the application server 103 receives the result of creating the credential information from the authentication server 104, it transmits the result of creating the credential information to the authentication terminal 101 or 102.

[0023] Reference numeral 104 denotes an authentication server. When authentication server 104 receives a request to create credential information, it transmits challenge information to authentication terminal 101 or 102. Furthermore, when authentication server 104 receives a result of creating credential information from authentication terminal 101 or 102, it registers the public key in authentication server 104 and transmits the result of creating credential information to application server 103. Note that authentication server 104 may be configured to be managed by the same server as application server 103.

[0024] Reference numeral 105 denotes a credential information management server. The credential information management server 105 manages credential information. The credential information management server 105 receives a request to register credential information from the authentication terminal 101 or 102. The credential information management server 105 registers the credential information in response to the received request to register the credential information, and transmits the credential information registration result to the authentication terminal 101 or 102. Furthermore, when the credential information management server 105 receives a credential information synchronization request from the authentication terminal 101 or 102, it transmits the credential information to the authentication terminal 101 or 102. In addition, when using the synchronization function, the credential information management server 105 requires authentication of the user who uses the authentication terminal 101 or 102, and provides the authentication function to the authentication terminal 101.

[0025] The authentication terminal 101, the authentication terminal 102, and the additional authentication server 108 are connected via a local network 106. The local network 106 is a local network that cannot be directly accessed from the global network 107. The application server 103, the authentication server 104, and the credential information management server 105 are also connected via the global network 107. The local network 106 is a communication network realized by, for example, any one or a combination of a LAN, a WAN, a telephone line, a dedicated digital line, an ATM or frame relay line, a cable television line, a wireless line for data broadcasting, etc. LAN is an abbreviation for Local Area Network. WLAN is an abbreviation for Wireless LAN. ATM is an abbreviation for Asynchronous Transfer Mode. The global network 107 has the same configuration as the local network 106.

[0026] <Hardware configuration of devices and information processing devices> Fig. 2 is a block diagram showing the hardware configuration of each device according to the first embodiment of the present invention. Fig. 2(A) is a block diagram showing an example of the hardware configuration of an authentication terminal constituting each of the authentication terminal 101, the authentication terminal 102, and the additional authentication server 108. Fig. 2(B) is a block diagram showing an example of the hardware configuration of an information processing device constituting each of the application server 103, the authentication server 104, and the credential information management server 105.

[0027] Each of the authentication terminals constituting the authentication terminal 101, authentication terminal 102, and additional authentication server 108 includes a CPU 201 that executes software stored in a storage device, HDD 203. HDD is an abbreviation for Hard Disk Drive. CPU is an abbreviation for Central Processing Unit. The CPU 201 comprehensively controls each piece of hardware connected to a system bus 204.

[0028] The memory 202 functions as the main memory, work area, etc. of the CPU 201. The HDD 203 records data as a large-capacity storage device. The UI control unit 205 controls input from an input device 206 such as a touch panel. UI is an abbreviation for User Interface. The network control unit 207 exchanges data bidirectionally with other nodes via the network.

[0029] The TPM 208 is a tamper-resistant storage device that prevents stored data from being read from an external source for the purpose of processing and holding confidential information. TPM is an abbreviation for Trusted Platform Module. In this embodiment, the TPM 208 manages biometric information used for authentication or credential information such as a private key corresponding to the biometric information.

[0030] The biometric information sensor 209 is a sensor that reads biometric information of a user who uses an authentication terminal. The biometric information sensor 209 converts information such as a user's fingerprint, vein pattern, voiceprint, iris, or facial image into a read signal. The biometric information sensor 209 is realized using a dedicated reader such as a fingerprint sensor, a camera, a microphone, etc.

[0031] The information processing device constituting each of the application server 103, the authentication server 104, and the credential information management server 105 includes a CPU 210 that executes software stored in a storage device, that is, an HDD 212. The CPU 210 comprehensively controls each piece of hardware connected to a system bus 213.

[0032] The memory 211 functions as the main memory, work area, etc. of the CPU 210. The HDD 212 records data as a large-capacity storage device. The input control unit 214 controls input from an input device 215 such as a keyboard. Depending on the role of the information processing device, the configuration may not include the input control unit 214 and the input device 215. The display control unit 216 controls display on a display device 217 such as a liquid crystal display. Depending on the role of the information processing device, the configuration may not include the display control unit 216 and the display device 217. The network control unit 218 exchanges data bidirectionally with other nodes via the network.

[0033] The information processing devices constituting the application server 103, the authentication server 104, and the credential information management server 105 are implemented by information processing devices provided as a cloud computing service. Cloud computing includes serverless computing and virtual machines. In cloud computing, multiple hardware resources shown in FIG. 2(B) are used. Note that the application server 103, the authentication server 104, and the credential information management server 105 may each be implemented by a single physical machine.

[0034] <Functional configuration> 3 is a module configuration diagram of each device according to the first embodiment of the present invention. Fig. 3 is a block diagram showing an example of the functional configuration of the authentication terminals 101 and 102, the additional authentication server 108, the application server 103, the authentication server 104, and the credential information management server 105.

[0035] Each of the authentication terminals 101 and 102 includes a browser 310, an authentication client 320, and an authenticator 330. The browser 310 provides functions for interpreting HTML, displaying web pages, and receiving input from a user and sending requests. HTML is an abbreviation for HyperText Markup Language. Web is an abbreviation for World Wide Web. In this embodiment, the browser 310 provides a web page for displaying a credential information registration screen provided by the application server 103.

[0036] 4 shows an example of a credential information registration screen. The authentication client 320 provides a function for controlling the authentication process and registration of credential information, which are required when a user registers credential information. The credential information will be explained in the functional description of the credential information storage unit 332. The authentication client 320 also provides a function for controlling synchronization of credential information.

[0037] The authentication device 330 includes a biometric authentication processing unit 331, a credential information storage unit 332, and a biometric information management unit 333. The biometric authentication processing unit 331 provides a function to request the user to input biometric information and a function to perform biometric authentication. Biometric authentication is a process to confirm that the biometric information received from the user exists in a biometric information table held by the biometric information management unit 333. The biometric information and the biometric information table will be described in the functional description of the biometric information management unit 333. In addition, the biometric authentication processing unit 331 provides a function to create credential information.

[0038] The credential information storage unit 332 provides a function for storing credential information created when a public key for using a service provided by the application server 103 is registered in the authentication server 104. Table 1 shows an example of a credential information table stored in the credential information storage unit 332 of the authentication terminal 101. Table 2 shows an example of a credential information table stored in the credential information storage unit 332 of the authentication terminal 102. In Tables 1 and 2, each record in the credential information table includes an authentication information ID, a secret key, a user ID, and a service URL. The authentication information ID is an ID that uniquely identifies authentication information. The user ID is an ID that uniquely identifies user information. The service URL is the URL of a service provided by the application server 103. URL is an abbreviation for Uniform Resource Locator. [Table 1] [Table 2]

[0039] The biometric information management unit 333 manages the biometric information stored in the authentication device 330. Table 3 shows an example of a biometric information table managed by the biometric information management unit 333 of the authentication terminal 101. Table 4 shows an example of a biometric information table managed by the biometric information management unit 333 of the authentication terminal 102. In Tables 3 and 4, each record in the biometric information table includes a user ID and a biometric information ID. The biometric information ID is an ID that uniquely identifies the biometric information. [Table 3] [Table 4]

[0040] The additional authentication server 108 includes an additional authentication request management unit 370 and an additional authentication information management unit 371. The additional authentication request management unit 370 receives an additional authentication request equivalent to a request for permission to create credential information sent from the authentication terminal 101 or 102, and provides a function of sending additional authentication success or failure corresponding to whether or not processing at the time of credential registration can be continued. In this embodiment, HTTP authentication (Basic authentication) is used for user authentication (not shown), but other authentication methods such as HTTP authentication (Digest authentication) or OpenID Connect may also be used. HTTP is an abbreviation for Hypertext Transfer Protocol.

[0041] Furthermore, the ID for the additional authentication uses the additional authentication ID included in the credential information sent from the authentication terminal 101. The additional authentication information management unit 371 receives the additional authentication request sent from the additional authentication request management unit 370 and provides an additional authentication processing function. Table 5 is an example of an additional authentication information table managed by the additional authentication information management unit 371. In Table 5, each record in the additional authentication information table includes an additional authentication ID, an additional authentication password, and an additional authentication status. Note that information in the additional authentication information table has been registered in advance, including the users of the authentication terminal 101 and the authentication terminal 102. [Table 5]

[0042] The additional authentication server 108 is a device with authentication functions, such as an office MFP, and office workers are registered in advance for authentication. The information in the additional authentication information table does not necessarily have to be stored in the additional authentication server 108, and may refer to an external server such as an LDAP server. LDAP is an abbreviation for Lightweight Directory Access Protocol.

[0043] The application server 103 includes an authentication processing unit 341 and a credential registration processing unit 342. The authentication processing unit 341 provides a function of requesting the credential information management server 105 to acquire information about users who use services provided by the application server 103. The authentication processing unit 341 acquires the results of user authentication from the credential information management server 105. In this embodiment, OpenID Connect is used for user authentication, but other authentication methods such as HTTP authentication (Basic authentication / Digest authentication) may also be used.

[0044] The credential registration processing unit 342 provides a function to receive a credential information creation request from the authentication terminal 101 or 102, and to transmit the credential information creation request to the authentication server 104. The credential registration processing unit 342 also provides a function to receive a credential information creation result from the authentication server 104, and to transmit the credential information creation result to the authentication terminal 101 or 102.

[0045] The authentication server 104 includes an authentication request management unit 350 and a public key management unit 351. The authentication request management unit 350 receives a request to create credential information sent from the application server 103. In addition, the authentication request management unit 350 provides a function to verify the result of creating the credential information sent from the authentication terminal 101 or 102, and to send the result of creating the credential information to the application server 103. Furthermore, the authentication request management unit 350 provides a function to send a request to the public key management unit 351 to save the public key information included in the result of creating the credential information.

[0046] The public key management unit 351 provides a function of receiving a request to save public key information sent from the authentication request management unit 350 and saving the public key. Table 6 is an example of a public key table managed by the public key management unit 351. Each record in the public key table includes an authentication information ID and a public key. [Table 6]

[0047] The credential information management server 105 includes a credential information management unit 360, a credential synchronization control unit 361, and a user management unit 362. The credential information management unit 360 receives the credential information creation result from the authentication terminal 101 or 102, and stores the credential information. In addition, the credential information management server 105 receives a transmission request for a URL linked to the credential information, which is requested by the authentication terminal 101 or 102. The credential information management server 105 provides a function of transmitting, in a lump, the URLs of the credential information linked to the user who uses the authentication terminal 101 or 102, in response to the received transmission request for the URL linked to the credential information.

[0048] Table 7 is an example of a credential information table held by the credential information management unit 360. In Table 7, each record in the credential information table includes an authentication information ID, a secret key, a user ID, and a service URL. [Table 7]

[0049] The credential synchronization control unit 361 receives a credential information synchronization request from the authentication terminal 101 or the authentication terminal 102. The credential synchronization control unit 361 provides a function of transmitting credential information linked to a user who uses the authentication terminal 101 or the authentication terminal 102 to the authentication terminal 101 or the authentication terminal 102 in response to the received credential information synchronization request.

[0050] The user management unit 362 provides a function for retaining user information of users who use the authentication terminal 101 or the authentication terminal 102. The user management unit 362 also provides a function for receiving a user authentication request (token information acquisition request) from the application server 103, performing user authentication processing, and issuing token information for using the application server 103. Additionally, the user management unit 362 provides a function for authenticating a user who uses the credential information management server 105 when using the credential information synchronization function provided by the credential information management server 105. In this embodiment, authentication is performed using HTTP authentication (Basic authentication / Digest authentication), but other authentication methods such as OpenID Connect may also be used. Table 8 is an example of a user information table retained by the user management unit 362. Each record in the user information table includes a user ID and a password. [Table 8]

[0051] <User authentication process> The user authentication process will be explained using Fig. 5. In order to register credential information linked to a user using the authentication terminal 101 or 102, it is necessary to verify whether the user is registered with the service. This process uses authentication information of the user using the credential information management server 105 to perform authentication of the service provided by the application server 103. Fig. 5 is a sequence diagram showing the processes of the authentication terminal 101, application server 103, and credential information management server 105 in the user authentication process.

[0052] When the user authentication process starts, in step S501, the browser 310 of the authentication terminal 101 sends a login request to the service to the application server 103. Then, in step S502, the authentication processing unit 341 of the application server 103 creates and issues a nonce linked to the session. A nonce is a disposable random character used during encrypted communication. Specific examples of nonce include: 1 999 888 777 666 555 444 Examples include:

[0053] Next, in step S503, the authentication processing unit 341 of the application server 103 transmits an access request to the credential information management server 105 to the authentication terminal 101. Next, in step S504, the browser 310 of the authentication terminal 101 transmits an authentication request request to the credential information management server 105. The authentication request request includes the user ID and password of the user who uses the authentication terminal 101. Here, as an example, it is assumed that the user ID is "user001" and the password is "userpass1".

[0054] Next, in step S505, the user management unit 352 of the credential information management server 105 verifies the authentication information sent from the authentication terminal 101. This authentication information verification is performed by determining whether the combination of the user ID and password included in the received authentication information exists in the user information table held by the user management unit 352. If the combination of the user ID and password included in the received authentication information exists in the user information table held by the user management unit 352, the nonce is stored in the nonce information table. Table 9 is an example of a nonce information table held by the user management unit 352. Each record in the nonce information table includes a session ID, which is an identifier for the session, and a nonce. [Table 9]

[0055] Next, in step S506, the user management unit 352 of the credential information management server 105 transmits the authorization code to the authentication terminal 101. The authorization code is a time-limited token issued from the authorization endpoint. dd1231FBC3123a987= Next, in step S507, the browser 310 of the authentication terminal 101 transmits the authorization code to the application server 103.

[0056] Next, in step S508, the authentication processing unit 341 of the application server 103 sends an ID token and nonce acquisition request along with the authorization code to the credential information management server 105. An ID token is defined in OpenID Connect and is a token that proves that the user who made the issuance request has been authenticated. Specific examples of ID tokens include one that includes the following header and payload:

[0057] (Header) { ”type”: ”assertion”, ”alg”: ”ES256”, “kid”: “aaaaaaaa-bbbb-1111-8888-999999999999” }

[0058] (payload) { ”response_type”: ”id_token”, ”redirect_url”: ”http: / / example_srv.com / customer”, “iss”: “ODBIMWUwasdasd123UUUMXw”, “sub”: “dXIIMM123KKllss”, ”iat”: 1903144999, ”exp”: 1903149999 }

[0059] Next, in step S509, the user management unit 352 of the credential information management server 105 transmits the token and nonce to the application server 103. Next, in step S510, the authentication processing unit 341 of the application server 103 verifies the received token and nonce. Next, in step S511, the authentication processing unit 341 of the application server 103 transmits the authentication result to the authentication terminal 101, and the process ends.

[0060] <Credential information registration process> The credential information registration process will be described with reference to Figs. 6 and 7. This process registers credential information associated with a user who uses the credential information management server 105 in the credential information management server 105, and registers a public key associated with the credential information in the authentication server 104. This process can be executed only when the user authentication process is successful. This process also enables the authentication terminal 101, which is the terminal that registers the credential information, to register the credential information only when the additional authentication process in the additional authentication server 108 is successful. Figs. 6 and 7 are sequence diagrams showing the processes of the authentication terminal 101, the additional authentication server 108, the application server 103, the authentication server 104, and the credential information management server 105 in the credential information registration process. Fig. 7 is a diagram showing the process subsequent to the process in Fig. 6.

[0061] When the credential information registration process starts, the browser 310 of the authentication terminal 101 transmits a credential information creation request for the user who uses the authentication terminal 101 to the application server 103 in step S601.

[0062] Next, in step S602, the credential registration processing unit 342 of the application server 103 transmits a credential information creation request to the authentication server 104. Next, in step S605, the authentication request management unit 350 of the authentication server 104 transmits a credential information registration request to the authentication terminal 101. The request included in the credential information registration request transmitted from the authentication request management unit 350 includes, for example, a challenge and a recommended authentication level. Specific examples of the request included in the credential information registration request include the following:

[0063] (Example of a request included in a credential registration request) { “challenge”: “ASD123tre12312FE”, "certifiedLevel": "L2", "rp": { ”name”: ”AdminPage”, “id”: “https: / / example_srv.com / admin”, ”user”: { ”id”: ”user001”, ”name”: ”user001”, ”displayName”: ”user001” }, ”pubKeyCredParams”: [ { ”alg”: -7, ”type”: ”public-key” }, { ”alg”: -257, ”type”: ”public-key” } ], “authenticatorSelection”: { ``authenticatorAttachment'': ``platform'', “requireResidentKey”: true } } }

[0064] Next, in step S606, the authentication client 320 of the authentication terminal 101 sends an additional authentication request to the additional authentication server 108. For the additional authentication request, the user ID and password, which are the values ​​of the "id" key included in the "user" key included in the credential information registration sent from the authentication request management unit 350, are used. That is, the authentication client 320 uses "user001" as the user ID and "userpass1" as the password. In step S607, the additional authentication server 108 performs additional authentication process 1, which will be described later. If the result of the additional authentication process in step S607 is a failure, the additional authentication server 108 sends a message indicating additional authentication failure to the authentication terminal 101 in step S608 and terminates the process without performing any further processing. If the result of the additional authentication process in step S607 is a success, the additional authentication server 108 sends a message indicating additional authentication success to the authentication terminal 101 in step S609.

[0065] Next, in step S610, the authentication client 320 of the authentication terminal 101 sets a continuation credential registration continuation flag, which is an internal variable that determines whether to continue the registration of credential information, to True, and then performs a credential creation determination process. This credential creation determination process will be described later. Furthermore, if the credential registration continuation flag becomes False as a result of the credential creation determination process, the processes of FIGS. 6 and 7 end.

[0066] Next, in step S611, the authentication terminal 101 acquires biometric information of the user using the authentication terminal 101. The authentication client 320 of the authentication terminal 101 transmits a biometric information acquisition request to the biometric authentication processing unit 331. Upon receiving the biometric information acquisition request, the biometric authentication processing unit 331 waits until it accepts the user's biometric information. The biometric authentication processing unit 331 acquires the feature quantities of the biometric information input by the user. The feature quantities of the biometric information are obtained by converting unique information for each individual, such as a fingerprint pattern, iris pattern, or vein shape, into values ​​that do not impair uniqueness. Biometric authentication identifies an individual using these unique feature quantities. It is desirable that the biometric information transmitted in this process be encrypted using a known encryption technique so that only the authentication device 330 can decrypt it.

[0067] Next, in step S612, the biometric authentication processing unit 331 of the authentication terminal 101 performs authentication processing. The biometric authentication processing unit 331 transmits a request to confirm that the biometric information acquired in step S611 has been registered to the biometric information management unit 333. If the biometric authentication processing unit 331 receives from the biometric information management unit 333 that the biometric information has already been registered, it determines that the authentication has been successful, and if not, it ends the processing in FIGS. 6 and 7.

[0068] Next, in step S613, the biometric authentication processing unit 331 of the authentication terminal 101 creates credential information and transmits a request to store the credential information in the credential information storage unit 332. Upon receiving the request to store the credential information, the credential information storage unit 332 stores the credential information. Table 10 is an example of a credential information table after the credential information has been created. [Table 10]

[0069] Subsequently, in step S614, the authentication client 320 of the authentication terminal 101 transmits the credential information generation result to the authentication server 104. Specific examples of the credential information generation result to be transmitted to the authentication server 104 include the following.

[0070] (Example of credential information creation results) { “id”: “asda13123fdcccc9786546”, ”rawId”: ”10004”, ”response”: { ”clientDataJson”: { ``type'': ``webauthn.create'', “challenge”: “NKX1239887823ASd”, “origin”: “https: / / device101.me”, ”crossOrigin”: false }, ”attestationObject”: { "aaguid": "0000000-0000-0000-0000-000000000000", ``credentialId'': ``10004'', ”credentialPublicKey”: { ”kty”: ”RSA”, “alg”: “ECDSA_alg_sha256”, ”crv”: ”p-256”, “x”: “1aasdaVERSSDfs / werwcsdfsdf”, “y”: “oisdfsdbfsbdhs / easdas,casdasd” } } }, ``authenticatorAttachment'': ``platform'', ”type”: ”public-key” }

[0071] Next, in step S615, the authentication request management unit 350 of the authentication server 104 verifies the signature of the challenge included in the credential information creation result. If the verification is successful, the authentication request management unit 350 obtains the public key included in the credential information creation result, sends a public key save request to the public key management unit 351, and saves the public key. Table 11 is an example of a public key table managed by the public key management unit 351 after the public key has been registered. [Table 11]

[0072] Next, in step S616, the authentication request management unit 350 of the authentication server 104 transmits the credential information creation result to the application server 103. Next, in step S617, the credential registration processing unit 342 of the application server 103 transmits the credential information creation result to the authentication terminal 101.

[0073] Next, in step S618, the authentication client 320 of the authentication terminal 101 transmits a request to acquire the credential information registered in the credential information storage unit 332. Also in step S618, the authentication client 320 transmits the credential information acquired from the credential information storage unit 332 to the credential information management server 105. This communication uses known encrypted communication such as SSL.

[0074] Next, in step S619, the credential information management unit 360 of the credential information management server 105 stores the credential information. Table 12 is an example of a credential information table in the credential information management unit 360 of the credential information management server 105 after registration. [Table 12]

[0075] Also, in step S619, the credential information management unit 360 of the credential information management server 105 transmits the result of the credential information registration to the authentication terminal 101, and this process ends.

[0076] <Additional authentication process 1> Additional authentication processing 1, which is performed by the additional authentication information management unit 371 of the additional authentication server 108, will be described with reference to Fig. 8. This processing is processing for determining whether to create credential information in the credential information registration processing.

[0077] 8 starts in step S701, when the additional authentication request management unit 370 receives an additional authentication request from the authentication terminal 101 and the additional authentication information management unit 371 receives the additional authentication request from the additional authentication request management unit 370. The additional authentication request uses the user ID and password, which are the values ​​of the "id" key included in the "user" key included in the credential information registration sent from the authentication request management unit 350 of the authentication terminal 101. That is, "user001" is used as the user ID and "userpass1" is used as the password.

[0078] Next, in step S702, the additional authentication information management unit 371 searches the additional authentication information table of Table 5 that it manages for a record with an additional authentication ID that matches the user ID. In step S703, the additional authentication information management unit 371 determines whether the password matches the additional authentication password of the record in the search results. If the password matches the additional authentication password of the record in the search results, the additional authentication information management unit 371 determines that the additional authentication has been successful. If the password does not match the additional authentication password of the record in the search results, the additional authentication management unit 371 determines that the additional authentication has been unsuccessful.

[0079] If the additional authentication determination in step S703 is successful, the additional authentication information management unit 371 transmits a message of additional authentication success to the authentication terminal 101 that sent the additional authentication request in step S704. If the additional authentication determination in step S703 is unsuccessful, the additional authentication information management unit 371 transmits a message of additional authentication failure to the authentication terminal 101 that sent the additional authentication request in step S705.

[0080] <Credential creation decision process> The credential creation determination process executed by the authentication client 320 of the authentication terminal 101 will be described with reference to Fig. 9. This process is a process for determining whether to create credential information in the credential information registration process.

[0081] First, when this process starts, in step S801, the authentication client 320 receives the result of the additional authentication process from the additional authentication server 108. Next, in step S802, the authentication client 320 determines whether the additional authentication process was successful or unsuccessful, and if the additional authentication was successful, the process proceeds to step S803, and if the additional authentication was unsuccessful, the process proceeds to step S804.

[0082] In step S803, the authentication client 320 changes the credential registration continuation flag to True, and then ends this process. In step S804, the authentication client 320 changes the credential registration continuation flag to False, and then ends this process.

[0083] <Credential information synchronization processing> The credential information synchronization processing will be explained using Fig. 10 and Fig. 11. This processing synchronizes the credential information registered in the application server 103 with the authentication terminal 102 of the user who uses the credential information management server 105. This processing enables the authentication terminal 102, which is the synchronization destination of the credential information, to synchronize the credential information only when the additional authentication processing of the additional authentication server 108 is successful. Fig. 10 and Fig. 11 are sequence diagrams showing the processing of the authentication terminal 102, the credential information management server 105, and the additional authentication server 108 in the credential information synchronization processing. Fig. 11 is a diagram showing processing subsequent to the processing of Fig. 10.

[0084] When the credential information registration process starts, in step S901, the browser 310 of the authentication terminal 102 sends an authentication request to the credential information management server 105. Subsequently, in step S902, the user management unit 362 of the credential information management server 105 sends a user information acquisition request to the authentication terminal 102.

[0085] Next, in step S903, the browser 310 of the authentication terminal 102 accepts the user ID and password of the user who uses the authentication terminal 102. In step S903, upon acquiring input from the user, the browser 310 of the authentication terminal 102 transmits the user ID and password accepted from the user to the user credential information management server 105. Here, as an example, it is assumed that the user ID is "user002" and the password is "userpass2".

[0086] Next, in step S904, the user management unit 362 of the credential information management server 105 verifies the user information. If the corresponding user ID and password combination exists in the user information table, the user management unit 362 determines the verification result as authentication success, and if not, determines the verification result as authentication failure.

[0087] Next, in step S905, the user management unit 362 of the credential information management server 105 transmits the verification result to the authentication terminal 102. If the verification result indicates successful authentication, the authentication terminal 102 continues this process, and if the verification result indicates unsuccessful authentication, the authentication terminal 102 terminates this process.

[0088] Next, in step S906, the authentication terminal 102 sends to the credential information management server 105 a request to obtain information on services provided by the application server 103 that are linked to the credential information to be synchronized and that is linked to the successfully authenticated user.

[0089] Next, in step S907, the credential synchronization control unit 361 transmits a request to acquire information on the application server associated with the credential information to be synchronized, which is associated with the successfully authenticated user, to the credential information management unit 360. Also in step S907, the credential synchronization control unit 361 transmits, in a lump, the URLs of the services (the above-mentioned service URLs) provided by the application server 103, which have been acquired from the credential information management unit 360, to the authentication terminal 102. Specific examples of responses transmitted from the credential synchronization control unit 361 include the following.

[0090] (Specific example of a response sent from the credential synchronization control unit 361) { "services": [ ”https: / / example_srv.com / customer”, ”https: / / example_srv.com / distributor”, ”https: / / example_srv.com / admin” ] }

[0091] Next, from step S908, the authentication terminal 102 proceeds with processing for each URL acquired from the credential information management server 105.

[0092] Next, in step S909, the authentication client 320 of the authentication terminal 102 sends an additional authentication request to the additional authentication server 108. The additional authentication request uses the user ID and password associated with the successfully authenticated user. That is, the user ID is "user002" and the password is "userpass2".

[0093] In step S910, the additional authentication server 108 performs additional authentication process 2, which will be described later. If the result of the additional authentication process in step S910 is failure, the additional authentication server 108 transmits a message of additional authentication failure to the authentication terminal 102 in step S911 and terminates the process without performing any further processing. On the other hand, if the result of the additional authentication process in step S910 is success, the additional authentication server 108 transmits a message of additional authentication success to the authentication terminal 102 in step S912. The additional authentication server 108 is an example of a local device connected to the authentication terminal 101 and the authentication terminal 102 via the local network 106. After receiving permission, the additional authentication server 108 receives credential information associated with the user who uses the information processing device from the credential information management server, thereby synchronizing the credential information;

[0094] Next, in step S913, the authentication client 320 of the authentication terminal 102 sets a credential synchronization continuation flag, which is an internal variable that determines whether to continue synchronization of credential information, to True, and then performs credential synchronization determination processing. This credential synchronization determination processing will be described later. Furthermore, if the credential synchronization continuation flag becomes False as a result of the credential synchronization determination processing, the process proceeds to processing linked to the next URL.

[0095] Next, in step S914, the authentication client 320 of the authentication terminal 102 transmits a request to acquire credential information of the user associated with the service to the credential information management server 105. Next, in step S915, the credential synchronization control unit 361 of the credential information management server 105 acquires the credential information of the user associated with the service from the credential information management unit 360. Also in step S915, the credential synchronization control unit 361 transmits the credential information of the user associated with the service acquired from the credential information management unit 360 to the authentication terminal 102.

[0096] Next, in step S916, the authentication client 320 of the authentication terminal 102 transmits a request to register the credential information to the credential information storage unit 332, and registers the credential information.

[0097] Next, in step S917, the authentication client 320 of the authentication terminal 102 confirms that all processing of the credential information linked to the acquired application server information has been completed, and then ends this processing. Table 13 is an example of the credential information table in the credential information storage unit 332 of the authentication terminal 102 after this processing. This shows that, as a result of this processing, only the credential information that was successfully additionally authenticated in step S910 has been synchronized with the service provided by the application server 103. [Table 13]

[0098] <Additional authentication process 2> The additional authentication process 2, which is executed by the additional authentication information management unit 371 of the additional authentication server 108, will be described with reference to Fig. 12. This process is a process for determining whether to create credential information in the credential information registration process.

[0099] First, in step S1001, the additional authentication request management unit 370 receives an additional authentication request from the authentication terminal 102, and the additional authentication information management unit 371 receives the additional authentication request from the additional authentication request management unit 370, thereby starting the processing in Fig. 12. The additional authentication request uses the user ID and password associated with the successfully authenticated user. That is, "user002" is used as the user ID, and "userpass2" is used as the password.

[0100] Next, in step S1002, the additional authentication information management unit 371 searches the additional authentication information table of Table 5 that it manages for a record with an additional authentication ID that matches the user ID. In step S1003, the additional authentication information management unit 371 determines whether the password matches the additional authentication password of the record in the search results. If the password matches the additional authentication password of the record in the search results, the additional authentication information management unit 371 determines that the additional authentication has been successful. If the password does not match the additional authentication password of the record in the search results, the additional authentication has been unsuccessful.

[0101] If the additional authentication determination in step S1003 is successful, the additional authentication information management unit 371 transmits a message of additional authentication success to the authentication terminal 102 that sent the additional authentication request in step S1004. If the additional authentication determination in step S1003 is unsuccessful, the additional authentication information management unit 371 transmits a message of additional authentication failure to the authentication terminal 102 that sent the additional authentication request in step S1005.

[0102] <Credential synchronization determination process> The credential synchronization determination process executed by the authentication client 320 of the authentication terminal 102 will be described with reference to Fig. 13. This process is a process for determining whether or not the credential information is synchronized in the credential information synchronization process.

[0103] First, when this process starts, in step S1101, the authentication client 320 receives the result of the additional authentication process from the additional authentication server 108. Next, in step S1102, the authentication client 320 determines whether the additional authentication process was successful or unsuccessful, and if the additional authentication was successful, the process proceeds to step S1103, and if the additional authentication was unsuccessful, the process proceeds to step S1104.

[0104] In step S1103, the authentication client 320 changes the credential registration continuation flag to True, and then ends this process. In step S1104, the authentication client 320 changes the credential registration continuation flag to False, and then ends this process.

[0105] [Embodiment 2] In this embodiment, a method is disclosed for restricting synchronization of credential information executed between authentication terminals by performing additional authentication in a service provided by an application server. In addition, this embodiment is the same as embodiment 1 except for the credential information synchronization process, and therefore a description thereof will be omitted.

[0106] <Credential information synchronization processing> The credential information synchronization processing of this embodiment will be described with reference to Figs. 14 and 15. This processing synchronizes the credential information registered in the application server 103 with the authentication terminal 102 of the user who uses the credential information management server 105. This processing enables the authentication terminal 102, which is the synchronization destination of the credential information, to synchronize the credential information only when the additional authentication processing of the additional authentication server 108 is successful. Figs. 14 and 15 are sequence diagrams showing the processing of the authentication terminal 102, application server 103, credential information management server 105, and additional authentication server 108 in the credential information synchronization processing. Fig. 15 is a diagram showing processing subsequent to the processing of Fig. 14.

[0107] 14 and 15 are the same as steps S901 to S909 in Fig. 10 and 11 of embodiment 1, respectively, and therefore will not be described further. Steps S1210 to S1212 in Fig. 15, which are characteristic of this embodiment, will be described below.

[0108] The additional authentication server 108 of this embodiment receives the additional authentication request in step S1209 from the authentication client 320 of the authentication terminal 102. In step S1210, the additional authentication information management unit 371 of the additional authentication server 108 sends the additional authentication request received in step S1209 to the application server 103 as an application server additional authentication request. The additional authentication request uses the user ID and password associated with the previously successfully authenticated user. That is, the user ID is "user002" and the password is "userpass2".

[0109] Upon receiving the request, the application server 103 performs the application server additional authentication process described below in step S1211. Furthermore, the application server 103 returns an application server additional authentication response to the additional authentication server 108 in step S1212.

[0110] 15 are the same as steps S911 to S917 in Fig. 11 of the first embodiment, and therefore their explanation will be omitted. Also, the credential synchronization determination process is the same as in the first embodiment, and therefore its explanation will be omitted.

[0111] <Application server additional authentication process> The application server additional authentication process executed by the authentication processing unit 341 of the application server 103 will be described with reference to Fig. 16. This process is a process for determining whether to create credential information in the credential information registration process. The authentication processing unit 341 stores a combination of an additional authentication user ID and an additional authentication password.

[0112] First, in step S1301, the authentication processing unit 341 receives an application server additional authentication request from the additional authentication server 108, thereby starting the processing in Fig. 16. The application server additional authentication request uses the user ID and password associated with the successfully authenticated user. That is, "user002" is used as the user ID, and "userpass2" is used as the password.

[0113] Next, in step S1302, the authentication processing unit 341 determines whether the user ID and password associated with the successfully authenticated user match the additionally authenticated user ID and additionally authenticated password. If the user ID and password associated with the successfully authenticated user match the additionally authenticated user ID and additionally authenticated password, the authentication processing unit 341 determines that the additional authentication is successful. If the user ID and password associated with the successfully authenticated user do not match the additionally authenticated user ID and additionally authenticated password, the authentication processing unit 341 determines that the additional authentication is unsuccessful.

[0114] In step S1303, the authentication processing unit 341 determines whether the additional authentication was successful. If the additional authentication was successful, the authentication processing unit 341 executes the process of step S1304. If the additional authentication was unsuccessful, the authentication processing unit 341 executes the process of step S1305.

[0115] In step S1304, the authentication processing unit 341 transmits a notification of application server additional authentication success to the additional authentication server 108 that transmitted the additional authentication request. In step S1305, the authentication processing unit 341 transmits a notification of application server additional authentication failure to the additional authentication server 108 that transmitted the additional authentication request.

[0116] This embodiment discloses a method for restricting synchronization of credential information executed between authentication terminals by performing additional authentication in a service provided by the application server 103. The present invention may also similarly perform additional authentication in a credential information management server.

[0117] (Other embodiments) The present invention can also be realized by supplying a program that realizes one or more functions of the above-described embodiments to a system or device via a network or a storage medium, and having one or more processors in the computer of the system or device read and execute the program. It can also be realized by a circuit (e.g., ASIC) that realizes one or more functions.

[0118] Although the preferred embodiments of the present invention have been described above, the present invention is not limited to these embodiments and various modifications and changes are possible within the scope of the gist of the present invention.

[0119] The disclosure of this embodiment includes the following configuration, method, and program. (Configuration 1) An information processing device, a registration means for registering credential information in a credential information management server; After receiving permission from a local device connected to the information processing device via a local network, a synchronization unit that synchronizes credential information by receiving credential information associated with a user who uses the information processing device from the credential information management server; An information processing device comprising: (Configuration 2) the synchronization means does not perform the synchronization without the permission of the local device; 2. The information processing device according to configuration 1, (Configuration 3) the registration means, after receiving permission from the local device, registers credential information associated with a user who uses the information processing device in the credential information management server; 3. The information processing device according to configuration 1 or 2. (Configuration 4) The permission of the local device is a result of successful additional authentication in additional authentication processing by an additional authentication server connected to the information processing device via the local network. 4. The information processing device according to any one of configurations 1 to 3. (Configuration 5) The permission of the local device is a result of successful additional authentication in additional authentication processing by an application server connected to the information processing device via an additional authentication server connected to the information processing device via the local network. 4. The information processing device according to any one of configurations 1 to 3. (Method 1) A control method for an information processing device, comprising: a registration step of registering credential information in a credential information management server; a synchronization step of receiving credential information associated with a user who uses the information processing device from the credential information management server after receiving permission from a local device connected to the information processing device via a local network, and synchronizing the credential information; A method comprising: (Program 1) A program executed by a computer of an information processing device, The computer A registration means for registering credential information in a credential information management server; and After receiving permission from a local device connected to the information processing device via a local network, a synchronization unit that synchronizes the credential information by receiving the credential information associated with the user who uses the information processing device from the credential information management server; A program characterized by functioning as [Explanation of symbols]

[0120] 101, 102...Authentication terminal 103...Application Server 104...Authentication server 105...Credential information management server 106...Local network 107...Global Network 108...Additional authentication server

Claims

1. An information processing device, a registration means for registering credential information in a credential information management server; a synchronization unit that synchronizes credential information by receiving credential information associated with a user who uses the information processing device from the credential information management server after receiving permission from a local device connected to the information processing device via a local network; An information processing device comprising:

2. the synchronization means does not perform the synchronization without the permission of the local device; 2. The information processing apparatus according to claim 1, wherein:

3. the registration means, after receiving permission from the local device, registers credential information associated with a user who uses the information processing device in the credential information management server; 2. The information processing apparatus according to claim 1, wherein:

4. The permission of the local device is a result of successful additional authentication in additional authentication processing by an additional authentication server connected to the information processing device via the local network.

2. The information processing apparatus according to claim 1, wherein:

5. The permission of the local device is a result of successful additional authentication in additional authentication processing by an application server connected to the information processing device via an additional authentication server connected to the information processing device via the local network.

2. The information processing apparatus according to claim 1, wherein:

6. A control method for an information processing device, comprising: a registration step of registering credential information in a credential information management server; a synchronization step of receiving credential information associated with a user who uses the information processing device from the credential information management server after receiving permission from a local device connected to the information processing device via a local network, and synchronizing the credential information; A method comprising:

7. A program executed by a computer of an information processing device, The computer A registration means for registering credential information in a credential information management server; and a synchronization means for synchronizing credential information by receiving credential information associated with a user who uses the information processing device from the credential information management server after receiving permission from a local device connected to the information processing device via a local network; A program characterized by functioning as

Images