Information processing device and information processing program

Abstract

To provide an information processing device and an information processing program for allowing the information processing device to verify a first communication address even in the case of notifying the information processing device of an authentication cooperation destination of not the first communication address registered in an external authentication device by a user but a second communication address associated with the first communication address.SOLUTION: In an information processing system 10, an authentication server 14 acquires first information showing user's authentication and including a second mail address from an external authentication device 16. The authentication server 14 transmits second information for requesting a verification device 20 to execute communication to the second mail address. The external authentication device 16 transfers the second information to a first mail address. The user sends a mail whose transmission source is the first mail address to the verification device 20 according to the second information. Thus, the verification device 20 acquires the first mail address, verifies whether the first mail address satisfies a restraint shown by restraint information, and sends a verification result to the authentication server 14.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an information processing device and an information processing program. [Background technology]

[0002] Patent Document 1 discloses a system that links a user ID in an on-premises environment with a user ID in a portal site, which is an external site that provides cloud services, etc. When the portal site receives a request to link a user ID from the on-premises environment, it requests unique information from the user identified by the user ID that can prove that they are a user of the on-premises environment, determines the authenticity of the unique information entered by the user, and links the user ID if the unique information is correct, or rejects the linking of the user ID if the unique information is incorrect. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2020-038438 A Summary of the Invention [Problem to be solved by the invention]

[0004] Conventionally, an information processing device that allows a user to use the information processing device after authenticating the user is linked to an external authentication device that authenticates the user. By linking the two devices, the user can use the information processing device without having to perform a separate authentication process on the information processing device by being authenticated by the external authentication device. In particular, in such an authentication linkage system, the external authentication device may perform authentication process using the user's communication address (email address as an example) as a user ID that identifies the user.

[0005] Here, an information processing device that performs authentication cooperation with an external authentication device may want to impose restrictions on the communication addresses that users register to the external authentication device. For example, when an organization allows users belonging to the organization to use an information processing device in authentication cooperation with an external authentication device, the organization may want to limit the user name portion of the email address that the user registers to the external authentication device to a specific format (for example, a user name that starts with an employee number).

[0006] On the other hand, there is a case where the external authentication device generates a substitute communication address in place of the communication address registered by the user in the external authentication device and notifies the information processing device of the substitute communication address. In this case, the information processing device cannot verify whether the communication address registered by the user in the external authentication device satisfies the constraints.

[0007] The present invention aims to enable an information processing device to verify a first communication address even when a user informs an information processing device with which authentication is linked of a second communication address associated with the first communication address registered in an external authentication device, rather than the first communication address. [Means for solving the problem]

[0008] The invention of claim 1 is an information processing device comprising a storage device and a processor, wherein the storage device stores constraints that a first communication address of a user registered in the external authentication device must satisfy in order to be permitted to use the information processing device through authentication collaboration with an external authentication device, and the processor acquires first information indicating successful authentication of the user issued by the external authentication device, the first information including a second communication address generated by the external authentication device in correspondence with the first communication address, transmits second information to the second communication address included in the first information requesting that communication be performed to a specified verification device, acquires from the verification device a verification result indicating whether the first communication address, which is the source of the communication performed in accordance with the second information, satisfies the constraints, and if the verification result indicates that the first communication address does not satisfy the constraints, executes control to not allow authentication collaboration with the external authentication device for the user. The invention of claim 2 is the information processing device described in claim 1, wherein the control further includes receiving from the verification device a judgment result of the validity of the first communication address based on a forwarding path of the communication from the user, and if the judgment result indicates that the first communication address is not valid, not allowing authentication integration with the external authentication device for the user. The invention of claim 3 is an information processing device as described in claim 1 or 2, characterized in that the processor provides constraint information representing the constraint to the verification device, and the verification device determines whether the first communication address, which is the source of the communication, satisfies the constraint indicated by the constraint information provided by the processor, and provides the determination result to the processor. The invention of claim 4 is the information processing device described in claim 3, characterized in that after acquiring the first information, the processor accepts input of identification information of the user in the information processing device from the user, and provides to the verification device the constraint information representing the constraint to be applied to the user, which is identified according to the accepted identification information. The invention of claim 5 is an information processing device as described in claim 1 or 2, characterized in that after acquiring the first information, the processor accepts input of the user's identification information in the information processing device from the user, and in the control, if the verification result indicates that the first communication address satisfies the constraint, allows authentication collaboration with the external authentication device for the user and registers information indicating that the second communication address and the identification information correspond to each other. The invention according to claim 6 is as follows: An information processing program for operating a computer having a storage device, The storage device performs authentication in cooperation with an external authentication device. computer A constraint that must be satisfied by the first communication address of the user registered in the external authentication device in order to be permitted to use the death , The information processing program is configured to: The information processing program includes the steps of: acquiring first information issued by the external authentication device indicating successful authentication of the user, the first information including a second communication address generated by the external authentication device in correspondence with the first communication address; transmitting second information to the second communication address included in the first information requesting communication to a specific verification device; acquiring from the verification device a verification result indicating whether the first communication address, which is the source of the communication performed in accordance with the second information, satisfies the constraint; and, if the verification result indicates that the first communication address does not satisfy the constraint, executing control to not allow authentication collaboration with the external authentication device for the user. Effect of the Invention

[0009] According to the invention of claim 1 or 6, even if a user informs an information processing device with which authentication is linked of a second communication address associated with the first communication address registered in an external authentication device, the information processing device can verify the first communication address. According to the invention of claim 2, it is possible to prohibit authentication collaboration with an external authentication device for the user, further based on the transfer path of communication from the second communication address to the verification device. According to the invention as defined in claim 3, the information processing device and the verification device can be separate entities. According to the invention as set forth in claim 4, the verification device can verify whether or not the first communication address satisfies a constraint according to the user. According to the invention of claim 5, the information processing device can identify the user based on the second communication address. [Brief description of the drawings]

[0010] [Figure 1] 1 is a schematic diagram illustrating a configuration of an information processing system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a schematic diagram of the configuration of a user terminal. [Diagram 3] FIG. 2 is a schematic diagram illustrating the configuration of an authentication server. [Figure 4] FIG. 2 is a schematic diagram illustrating the configuration of a verification device. [Diagram 5] 4 is a first flowchart showing a flow of processing in the information processing system according to the present embodiment. [Figure 6] 10 is a second flowchart showing the flow of processing in the information processing system according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Fig. 1 is a schematic diagram of an information processing system 10 according to the present embodiment. The information processing system 10 includes a user terminal 12 used by a user, an authentication server 14 as an information processing device that authenticates the user, an external authentication device 16 that authenticates the user separately from the authentication server 14, a service providing server 18 that provides services to the user authenticated by the authentication server 14, and a verification device 20. Although only one user terminal 12 is shown in Fig. 1, the information processing system 10 may include multiple user terminals 12 used by multiple users. The user terminal 12, the authentication server 14, the external authentication device 16, the service providing server 18, and the verification device 20 are connected to each other so as to be able to communicate with each other via a communication line 22 including, for example, an Internet line or a LAN (Local Area Network).

[0012] The process flow in the information processing system 10, which is the premise of the present invention, is as follows.

[0013] First, the user accesses the service providing server 18 from the user terminal 12 in order to receive a service provided by the service providing server 18. The service provided by the service providing server 18 to the user is, for example, a document management service, but is of course not limited to this. The service providing server 18 requests the authentication server 14 to authenticate the user who has accessed the service. Note that in this embodiment, the authentication server 14 and the service providing server 18 are separate servers, but the two servers may be integrated. In other words, the authentication server 14 may provide the service.

[0014] The authentication server 14 in this embodiment is a server that provides an authentication service that authenticates a user who wishes to receive one or more services including a service provided by the service providing server 18 on behalf of the service. The authentication server 14 stores user information on a pre-registered user, that is, a user ID and authentication information (e.g., a password). The authentication server 14 can also authenticate a user based on the user information stored in the authentication server 14, but in this embodiment, the authentication server 14 and the external authentication device 16 can perform authentication collaboration, and when a user is authenticated by the external authentication device 16, it can be considered that the authentication server 14 has authenticated the user. The external authentication device 16 is, for example, a server provided by Apple Inc., and an authentication collaboration service provided by the external authentication device 16 is, for example, "Sign in with Apple", but the external authentication device 16 and the authentication collaboration service are not limited thereto.

[0015] The external authentication device 16 also stores the user ID and authentication information of a pre-registered user, and the user is authenticated by the external authentication device 16 by inputting the user ID and authentication information to the external authentication device 16. Then, information indicating successful authentication is transmitted from the external authentication device 16 to the authentication server 14.

[0016] In this embodiment, a communication address is used as the user ID stored in the authentication server 14 and the external authentication device 16. In this embodiment, an email address is used as the communication address. In this specification, the email address as the user ID registered by the user in the authentication server 14 is called "email address 0," and the email address as the user ID registered by the user in the external authentication device 16 is called "email address 1" as a first communication address.

[0017] It is assumed that the email address 0 registered by the user in the authentication server 14 and the email address 1 registered by the user in the external authentication device 16 are different addresses. Cases in which the email address 0 and the email address 1 are different include, but are not limited to, the following cases.

[0018] The user is an employee of a certain company, and is given an email address in the company domain by the company. The user performs user registration in authentication server 14 using the email address in the company domain as a user ID. That is, email address 0 becomes the email address in the company domain. The user is also provided with user terminal 12 as a mobile terminal (e.g., a smartphone) for business use. The email address mainly used in user terminal 12 is an email address in the mobile carrier domain. The user performs user registration in external authentication device 16 using the email address in the mobile carrier domain as a user ID. That is, email address 1 becomes the email address in the mobile carrier domain. In such an assumed case, email address 0 (an email address in the company domain) and email address 1 (an email address in the mobile carrier domain) are different from each other.

[0019] Here, the user can set the external authentication device 16 so that the external authentication device 16 does not inform the authentication server 14 of the email address 1. By setting it in this way, the external authentication device 16 will not send the email address 1 to other devices (the authentication server 14 in this embodiment) that perform authentication linkage without permission, so that the privacy of the email address 1 can be protected. In this case, the external authentication device 16 notifies the authentication server 14 of an email address other than the email address 1 that is generated by the external authentication device 16, by including it in information indicating successful authentication. In this specification, the email address that the external authentication device 16 generates and notifies the authentication server 14 is called "email address 2" as a second communication address. The external authentication device 16 stores the email address 1 and the email address 2 in association with each other. When the authentication server 14 wants to notify the user, the authentication server 14 sends an email (simply referred to as "email" in this specification) to the email address 2, and the external authentication device 16 forwards the email to the email address 1 (i.e., the user).

[0020] When a user attempts to use a service provided by the service providing server 18 using the user terminal 12, the user inputs the email address 1 into the external authentication device 16 to be authenticated. The external authentication device 16 then authenticates the user and transmits the email address 2 to the authentication server 14 as the user ID of the authenticated user. Therefore, the authentication server 14 can consider the user to have been authenticated without knowing the email address 1 of the user.

[0021] Here, there are cases where the authentication server 14 wants to verify the user's email address 1. Verification is a process of determining whether the email address 1 satisfies a predetermined constraint. An example of the constraint may be that the email address 1 is made up of a character string that follows a predetermined rule. For example, the character string may be "employee number@predetermined career domain". Another example of the constraint may be that the email address is an email address in a predetermined domain. Of course, the constraints are not limited to these.

[0022] If the email address 1 does not satisfy the constraints, the authentication server 14 does not permit authentication collaboration with the external authentication device 16 and does not consider the user to have been authenticated. In this manner, the authentication server 14 can consider only those users who have been authenticated by the external authentication device 16 with an email address 1 that satisfies the constraints as having been authenticated.

[0023] If the authentication server 14 deems the user to have been authenticated, the user is permitted to use the authentication server 14. Here, permission to use the authentication server 14 includes the fact that information indicating that the authentication server 14 deems the user to have been authenticated is notified to the service providing server 18, thereby allowing the user to use a service from the service providing server 18. Furthermore, when the authentication server 14 provides a service to the user, permission to use the authentication server 14 includes the fact that the user is permitted to use a service from the authentication server 14.

[0024] However, as described above, when the external authentication device 16 notifies the authentication server 14 of email address 2 instead of email address 1, the authentication server 14 cannot verify the email address 1 because it cannot know the email address 1. Therefore, in this embodiment, the mechanism described below makes it possible for the authentication server 14 to consider only those users who have been authenticated by the external authentication device 16 with an email address 1 that satisfies the constraints as having been authenticated, even when the external authentication device 16 does not notify the authentication server 14 of the email address 1.

[0025] 2 is a schematic diagram of the configuration of the user terminal 12. As described above, the user terminal 12 is assumed to be a mobile terminal such as a smartphone, but the user terminal 12 is not limited to this and may be, for example, a stationary personal computer.

[0026] The communication interface 30 includes, for example, a network adapter, etc. The communication interface 30 performs a function of communicating with other devices via the communication line 22.

[0027] The input interface 32 includes, for example, a touch panel, a button, a mouse, a keyboard, etc. The input interface 32 is used to input user instructions to the user terminal 12.

[0028] The display 34 includes, for example, a liquid crystal panel. Various display screens are displayed on the display 34. In particular, the display 34 displays a login screen provided by the authentication server 14, a login screen provided by the external authentication device 16, or a service screen provided by the service providing server 18. The display 34 also displays execution screens for a browser 38 and a mailer 40, which will be described later.

[0029] The memory 36 includes, for example, a hard disk drive (HDD), a solid state drive (SSD), an embedded multi media card (eMMC), a read only memory (ROM), or a random access memory (RAM). The memory 36 stores programs for operating each unit of the user terminal 12. As shown in FIG. 2, the memory 36 also stores a browser 38, which is an application that communicates with other devices by HTTP (HyperText Transfer Protocol) and displays content obtained from the other devices, and a mailer 40, which is an application that transmits and receives emails. In this embodiment, the user accesses the service providing server 18 using the browser 38 to receive a service from the service providing server 18.

[0030] The processor 42 refers to a processor in a broad sense, and includes at least one of a general-purpose processor (e.g., a CPU (Central Processing Unit)) and a dedicated processing device (e.g., a GPU (Graphics Processing Unit), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array), or a programmable logic device). The processor 42 may not be a single processing device, but may be configured by the cooperation of multiple processing devices located at physically separate locations. The processor 42 controls each part of the user terminal 12 according to a program stored in the memory 36.

[0031] 3 is a schematic diagram of the configuration of the authentication server 14. The authentication server 14 is configured, for example, by a server computer, but may be any computer as long as it can perform the functions described below. The authentication server 14 may be configured by multiple computers. In other words, the functions performed by the authentication server 14 described below may be realized by the cooperation of multiple computers.

[0032] The communication interface 50 includes, for example, a network adapter, etc. The communication interface 50 performs a function of communicating with other devices via the communication line 22.

[0033] The memory 52 as a storage device includes, for example, an HDD, an SSD, an eMMC, a ROM, or a RAM. The memory 52 stores an information processing program for causing each unit of the authentication server 14 to function. In addition, as shown in FIG. 3, the memory 52 stores a user DB 54 and restriction information 56.

[0034] The user DB 54 stores user information on users who have registered with the authentication service provided by the authentication server 14. Specifically, a user ID and authentication information (e.g., a password) are stored in association with each other. As described above, the user ID stored in the user DB 54 is the email address 0 of the user. The user can also directly log in to the authentication server 14 by inputting the email address 0 and the authentication information to the authentication server 14.

[0035] The constraint information 56 is information indicating constraints that must be satisfied by the email address of a user to be authenticated by the authentication server 14 (i.e., the authentication service). The constraints are determined in advance, for example, by an administrator of the authentication server 14. If the email address as the user ID input in the authentication process does not satisfy the constraints indicated by the constraint information 56, the authentication server 14 does not authenticate the user. In this embodiment, as described above, the authentication server 14 considers that the user has been authenticated when the user has logged in to the external authentication device 16 using the email address 1. Therefore, it can be said that the constraint information 56 indicates constraints that must be satisfied by the email address 1 of the user registered in the external authentication device 16 in order to permit use of the authentication server 14 through authentication cooperation with the external authentication device 16.

[0036] The same constraint may be applied to all users, or different constraints may be applied depending on the user. For example, different constraints may be set for each user, or different constraints may be set for each user group (e.g., each company). In this case, the constraint information 56 is information indicating the constraints for each user.

[0037] The processor 58 refers to a processor in a broad sense, and includes at least one of a general-purpose processor (e.g., a CPU, etc.) and a dedicated processing device (e.g., a GPU, an ASIC, an FPGA, or a programmable logic device, etc.). The processor 58 may not be a single processing device, but may be configured by the cooperation of multiple processing devices located at physically separate locations. The processor 58 fulfills the functions of an authentication link processing unit 60, a verification request unit 62, and a verification result confirmation unit 64 according to an information processing program stored in the memory 52.

[0038] When the authentication linkage processing unit 60 receives a request to authenticate a user, it first provides a login screen to the user and displays it on the display 34 (more specifically, the browser 38) of the user terminal 12. As described above, in this embodiment, the request to authenticate a user is received from the service providing server 18. Specifically, when a user accesses the service providing server 18 from the browser 38, the service providing server 18 requests authentication of the user by redirecting the access from the browser 38 to the authentication server 14. Note that in cases where the authentication server 14 and the service providing server 18 are integrated, the authentication server 14 may receive a request to authenticate the user directly from the user (browser 38).

[0039] When the user requests external authentication by the external authentication device 16 on the login screen displayed on the browser 38, the browser 38 accesses the external authentication device 16. The external authentication device 16 causes the browser 38 to display a login screen for the external authentication device 16, requests the user to input an email address 1 and authentication information, and authenticates the user based on the input email address 1 and authentication information. If the external authentication device 16 succeeds in authenticating the user, the external authentication device 16 issues first information indicating the authentication success and transmits it to the authentication server 14. For example, in response to the authentication success in the external authentication device 16, the first information is transmitted to the authentication server 14 via the browser 38 as a parameter when the external authentication device 16 redirects the browser 38 to the authentication server 14. Note that, if the external authentication device 16 fails to authenticate the user, the external authentication device 16 transmits information indicating the authentication failure to the authentication server 14, and the authentication cooperation processing unit 60 does not consider the user to have been authenticated based on the information.

[0040] The first information transmitted from the external authentication device 16 to the authentication server 14 includes the email address 2 generated by the external authentication device 16 in correspondence with the email address 1, and an authentication code which is a token with a short life span (validity period). In this way, the authentication linkage processing unit 60 acquires the first information which indicates successful authentication issued by the external authentication device 16 and includes the email address 2 generated by the external authentication device 16 in correspondence with the email address 1.

[0041] When the authentication cooperation processing unit 60 receives the first information from the external authentication device 16, it transmits a token request including the authentication code included in the first information and the email address 2 as a user ID to the external authentication device 16. The external authentication device 16 verifies the received token request. For example, it verifies whether the authentication code is valid, whether the user indicated by the email address 2 has been authenticated recently, etc. If the token request is valid, it transmits confirmation information indicating that the token request has been confirmed to be valid to the authentication server 14. The authentication cooperation processing unit 60 determines that the user has been authenticated by the external authentication device 16 based on the confirmation information from the external authentication device 16.

[0042] Although the authentication linkage processing unit 60 can know from the first information that the user indicated by the email address 2 has been authenticated by the external authentication device 16, it cannot know which user registered in the user DB 54 the user indicated by the email address 2 is. Therefore, the authentication linkage processing unit 60 requests identification information that can identify the user from the user who was first provided with the login screen. In this embodiment, the authentication linkage processing unit 60 requests the user for email address 0, which is the user ID in the authentication server 14. The authentication linkage processing unit 60 holds the email address 0 as the identification information received from the user and the email address 2 included in the first information in association with each other.

[0043] The verification request unit 62 requests the verification device 20 (described in detail later) to verify whether the email address 1 used by the user for authentication in the external authentication device 16 satisfies the constraints indicated by the constraint information 56. Specifically, the verification request unit 62 transmits second information requesting execution of communication to the verification device 20 to the email address 2 (i.e., the external authentication device 16) included in the first information received from the external authentication device 16. The second information may be an email, the text of which includes the email address of the verification device 20 and a statement requesting that the email address of the verification device 20 be sent with the email address 1 as the sender, to the email address of the verification device 20. The second information may also include a statement notifying that the email address 1 will be known to the verification device 20 when the email is sent to the verification device 20.

[0044] The external authentication device 16 that has received the second information identifies the email address 1 that corresponds to the email address 2, and transfers the second information to the identified email address 1 (i.e., the user terminal 12). The user that has received the second information uses the mailer 40 of the user terminal 12 to check the contents of the email as the second information, and uses the mailer 40 to send an email with the email address 1 as the sender to the verification device 20. As will be described in detail later, the verification device 20 acquires the email address 1 from the sender of the email from the user terminal 12, and verifies whether or not the email address 1 satisfies the constraints indicated by the constraint information 56, based on the constraint information 56 acquired from the authentication server 14. The verification device 20 then transmits information indicating the verification result to the authentication server 14.

[0045] Here, if the email as the second information contains a statement notifying the user that the email address 1 will be known to the verification device 20 when the email is sent to the verification device 20, the user can send the email to the verification device 20 after consenting that the email address 1 will be known to the verification device 20. If the user does not want the verification device 20 to know the email address 1, the user can choose not to send the email to the verification device 20. In this case, since authentication cooperation between the authentication server 14 and the external authentication device 16 is not performed, the user needs to be authenticated by the authentication server 14 in a separate manner in order to receive the service provided by the service providing server 18.

[0046] The verification request unit 62 may generate secret information and include the generated secret information in the second information to be sent to the external authentication device 16. In this case, the verification request unit 62 holds the correspondence between the generated secret information and the corresponding email address 2. The secret information is information used by the verification device 20 to confirm that the email sent from the user terminal 12 is indeed an email based on the verification request from the authentication server 14. When the secret information is included in the second information, the second information includes information requesting that an email including the secret information be sent to the verification device 20.

[0047] The minimum requirement for the secret information is that it is unique information. For example, automatically generated random data can be used as the secret information. The verification device 20 (more specifically, the verification unit 76 (described in detail later)) that receives the second information including the secret information sends the secret information to the authentication server 14, and the verification request unit 62 checks whether the secret information received from the verification device 20 is recently generated, and transmits the confirmation result to the verification device 20. If the second information received by the verification device 20 is not valid, the secret information received by the verification request unit 62 from the verification device 20 should not have been recently generated by the verification request unit 62, so the verification device 20 can determine that the second information is not valid based on the confirmation result transmitted from the verification request unit 62. If the second information is not valid, the verification device 20 can refrain from performing the verification process. Furthermore, the verification request unit 62 can grasp, based on the secret information received from the verification device 20, that the user has sent an email to the verification device 20 for the email address 2 corresponding to the secret information.

[0048] The secret information may also include information indicating a linkage processing date and time indicating the date and time when authentication linkage processing between the authentication server 14 and the external authentication device 16 was performed. The linkage processing date and time may be, for example, the time when the first information was acquired from the external authentication device 16, or the time when the verification request unit 62 transmitted the second information to the external authentication device 16. By including the linkage processing date and time in the secret information, the verification device 20 can check whether the secret information was recently generated without the need to transmit the secret information to the authentication server 14. The verification device 20 can refrain from performing the verification process when the linkage processing date and time indicates a time that is a predetermined time before the current time.

[0049] The private information may also include identification information for identifying the user, such as the user's email address 0. In this case, the verification device 20 transmits the verification result and the email address 0 to the authentication server 14. This allows the verification request unit 62 to know for which user the verification device 20 has verified the email address 1, without the need to store the correspondence between the private information and the corresponding email address 2 (or email address 0).

[0050] The secret information may also include constraint information 56. By including constraint information 56 in the secret information, the verification device 20 can acquire constraint information 56 without needing to request constraint information 56 from the authentication server 14 when verifying the user's email address 1. In addition, when different constraints are applied depending on the user and an email address 0 is accepted from the user, the verification request unit 62 may specify a constraint to be applied to the user based on the accepted email address 0, and include constraint information 56 indicating the specified constraint in the secret information. This allows the verification device 20 to verify whether the user's email address 1 satisfies the constraint corresponding to the user.

[0051] Furthermore, the secret information may include signature information to prevent its tampering.

[0052] The verification result confirmation unit 64 obtains the verification result as to whether or not the user's email address 1 satisfies the constraint information 56 from the verification device 20. If the verification result indicates that the email address 1 satisfies the constraint information 56, the verification result confirmation unit 64 executes control to permit authentication cooperation between the authentication server 14 and the external authentication device 16. In other words, it is considered that the authentication server 14 has authenticated the user, and the verification result confirmation unit 64 notifies the service providing server 18 that the user has been authenticated. As a result, a service is provided to the user from the service providing server 18.

[0053] Furthermore, if the verification result indicates that email address 1 satisfies constraint information 56, verification result confirmation unit 64 registers in memory 52 information indicating that email address 0 of the user corresponds to email address 2 notified from external authentication device 16. This allows authentication server 14 to identify the user based on email address 2 even when the user is authenticated by external authentication, without having to inquire about email address 0 from the user each time. For example, authentication server 14 can grant the user appropriate authority based on email address 2.

[0054] On the other hand, if the verification result indicates that the email address 1 does not satisfy the constraint information 56, the verification result confirmation unit 64 executes control to not permit authentication collaboration between the authentication server 14 and the external authentication device 16. That is, the authentication server 14 does not consider the user as having been authenticated even if the user has been authenticated by the external authentication device 16. In this case, since authentication collaboration between the authentication server 14 and the external authentication device 16 is not performed, the user needs to be authenticated by the authentication server 14 in a separate manner in order to receive the service provided by the service providing server 18.

[0055] FIG. 4 is a schematic diagram of the configuration of the verification device 20. The verification device 20 is, for example, a server computer, but may be any computer as long as it can perform the functions described below. In this embodiment, the verification device 20 is separate from the authentication server 14, but the verification device 20 may be integrated with the authentication server 14. When the verification device 20 and the authentication server 14 are separate, the verification device 20 may be operated by a third party independent of the authentication server 14. As described above, the verification device 20 acquires the email address 1 that the user has prohibited the external authentication device 16 from notifying the authentication server 14, so it is preferable that the third party operating the verification device 20 is an institution that the user can trust. For example, the third party may be a public institution.

[0056] The communication interface 70 includes, for example, a network adapter, etc. The communication interface 70 performs a function of communicating with other devices via the communication line 22.

[0057] The memory 72 includes, for example, an HDD, an SSD, an eMMC, a ROM, a RAM, etc. The memory 72 stores programs for causing each unit of the verification device 20 to function.

[0058] The processor 74 refers to a processor in a broad sense, and includes at least one of a general-purpose processor (e.g., a CPU, etc.) and a dedicated processing device (e.g., a GPU, an ASIC, an FPGA, or a programmable logic device, etc.). The processor 74 may not be a single processing device, but may be configured by the cooperation of multiple processing devices located in physically separate locations. The processor 74 performs the functions of a verification unit 76 and a verification result providing unit 78 according to a program stored in the memory 72.

[0059] The verification unit 76 acquires the email address 1 of the user who received the second information from the sender address of the email sent from the user. The verification unit 76 also receives the constraint information 56 from the authentication server 14. As described above, the verification unit 76 may acquire the constraint information 56 by accessing the authentication server 14, or may acquire the constraint information 56 included in the second information. Then, the verification unit 76 verifies whether the email address 1 satisfies the constraint indicated by the constraint information 56.

[0060] The verification unit 76 also checks confidential information contained in the email received from the user. The process for checking confidential information is as described above, and therefore will not be described here.

[0061] The verification unit 76 may refer to forwarding route information indicating a forwarding route of the email, which is included in attribute information (properties) of the email received from the user, and determine the validity of the email address 1 based on the forwarding route of the email. For example, when an email is sent to the verification device 20 via servers in multiple countries, the verification unit 76 can determine that the email address 1 is not valid.

[0062] The verification result providing unit 78 provides the verification result of the email address 1 by the verification unit 76 to the authentication server 14. Furthermore, if the verification unit 76 determines the validity of the email address 1 based on the email forwarding path, the verification result providing unit 78 also provides the determination result to the authentication server 14. When the verification result confirmation unit 64 of the authentication server 14 receives the determination result from the verification result providing unit 78, if the determination result indicates that the email address 1 is not valid, the verification result confirmation unit 64 does not permit authentication collaboration with the external authentication device 16 for the user, and does not consider the user to have been authenticated.

[0063] The configuration of the information processing system 10 according to the present embodiment has been outlined above. As described above, in the information processing system 10, when the external authentication device 16 authenticates a user, it transmits the first information indicating successful authentication and including the user's email address 2 to the authentication server 14. The verification request unit 62 of the authentication server 14 transmits the second information requesting execution of communication with the verification device 20 to the email address 2 (i.e., the external authentication device 16). The external authentication device 16 transfers the second information to the email address 1 (i.e., the user). In response to the second information, the user sends an email whose sender is the email address 1 to the verification device 20. As a result, the verification device 20 acquires the email address 1. The verification device 20 verifies whether the email address 1 satisfies the constraints indicated by the constraint information 56, and transmits the verification result to the authentication server 14. By performing such processing, even if notification of the email address 1 from the external authentication device 16 to the authentication server 14 is prohibited, the authentication server 14 can confirm whether the email address 1 of the user satisfies the constraints.

[0064] The flow of processing by the information processing system 10 will be described below with reference to the flowcharts shown in FIGS.

[0065] In step S10 of FIG. 5, the user accesses the service providing server 18 from the browser 38 of the user terminal 12 in order to use the service provided by the service providing server 18.

[0066] In step S12, the service providing server 18 redirects the access from the user to the authentication server 14 to request the authentication server 14 to authenticate the user.

[0067] In step S14, the redirected browser 38 accesses the authentication server 14 and makes an authentication request.

[0068] In step S16, the authentication linkage processing unit 60 of the authentication server 14 that has received the authentication request from the browser 38 causes the browser 38 to display a login screen for the authentication server 14. On the login screen, the user can select external authentication.

[0069] In step S18, the user specifies external authentication on the login screen displayed in step S16. This causes the browser 38 to access the external authentication device 16.

[0070] In step S20, the external authentication device 16 causes the browser 38 to display a login screen for the external authentication device 16.

[0071] In step S22, the user logs in to the external authentication device 16 by inputting the user ID, that is, the email address 1 registered in the external authentication device 16, and authentication information on the login screen displayed in step S20.

[0072] In step S24, the external authentication device 16 authenticates the user based on the email address 1 and authentication information input in step S22. Here, it is assumed that the authentication is successful. If the authentication is successful, the external authentication device 16 redirects the browser 38 to the authentication server 14. As parameters at that time, the external authentication device 16 transmits to the authentication server 14 via the browser 38 first information indicating successful authentication, the first information including the email address 2 corresponding to the input email address 1 and an authentication code.

[0073] In step S26, the authentication linkage processing unit 60 of the authentication server 14 transmits to the external authentication device 16 a token request including the authorization code and the email address 2 acquired in step S24.

[0074] In step S28, the external authentication device 16 verifies the token request received in step S26. Here, it is determined that the token request is valid, and the external authentication device 16 transmits confirmation information indicating that the token request is valid to the authentication server 14.

[0075] In step S30, the authentication linkage processing unit 60 of the authentication server 14 confirms that the user has been authenticated by the external authentication device 16.

[0076] In step S32, the authentication linkage processing unit 60 of the authentication server 14 inquires of the user whose authentication request was accepted in step S14 about the email address 0, which is the user ID in the authentication server 14.

[0077] In step S34, the user transmits email address 0 to authentication server 14 in response to the inquiry from authentication server 14 in step S32. Authentication link processing unit 60 associates email address 2 acquired in step S24 with email address 0 acquired in step S34 and retains them.

[0078] In step S36 of FIG. 6, the verification request unit 62 of the authentication server 14 sends second information requesting communication with the verification device 20, the second information including the email address of the verification device 20 and the above-mentioned secret information, to the email address 2 (i.e., the external authentication device 16).

[0079] In step S38, the external authentication device 16 transfers the second information to the email address 1 (that is, the user terminal 12) corresponding to the email address 2 received in step S36.

[0080] In step S40, in response to the second information received in step S38, the user uses the mailer 40 to send an email containing confidential information to the email address of the verification device 20, with email address 1 as the sender's email address.

[0081] In step S42, the verification unit 76 of the verification device 20 acquires the email address 1 from the sender address of the email received in step S40. Furthermore, the verification unit 76 checks the confidential information included in the email, as described above.

[0082] In step S44, the verification unit 76 verifies whether or not the email address 1 acquired in step S40 satisfies the constraints indicated by the constraint information 56. As described above, the verification device 20 may access the authentication server 14 to acquire the constraint information 56, or the constraint information 56 may be included in the private information. Furthermore, the verification unit 76 refers to forwarding route information indicating the forwarding route of the email received in step S40, which is included in the attribute information of the email, and determines the validity of the email address 1 based on the forwarding route of the email.

[0083] In step S46, the verification result providing unit 78 of the verification device 20 transmits to the authentication server 14 the verification result of the email address 1 in step S44 and the determination result of the validity of the email address 1.

[0084] In step S48, the verification result confirmation unit 64 of the authentication server 14 confirms the verification result of the email address 1 received in step S46 and the judgment result of the validity of the email address 1. Here, it is assumed that the verification result of the email address 1 indicates that the email address 1 satisfies the constraints indicated by the constraint information 56, and that the judgment result of the validity of the email address 1 indicates that the email address 1 is valid. Therefore, the verification result confirmation unit 64 permits authentication collaboration between the authentication server 14 and the external authentication device 16, and the authentication server 14 considers that it has authenticated the user.

[0085] In step S50, the verification result confirmation unit 64 associates the email address 0 and the email address 2 held by the authentication link processing unit 60 in step S34 and stores them in the memory 52.

[0086] In step S52, the authentication collaboration processing unit 60 of the authentication server 14 redirects the browser 38 to the service providing server 18. Along with the redirection, the authentication collaboration processing unit 60 transmits information indicating that the user has been authenticated to the service providing server 18, to the service providing server 18. As a result, a service is provided to the user from the service providing server 18.

[0087] In addition, if in step S48 the verification result of email address 1 indicates that email address 1 does not satisfy the constraints indicated by constraint information 56, or the judgment result of the validity of email address 1 indicates that email address 1 is invalid, the verification result confirmation unit 64 does not allow authentication collaboration between the authentication server 14 and the external authentication device 16, the authentication server 14 does not consider the user to have been authenticated, and the processing ends without performing the processing of steps S50 and S52.

[0088] Although the embodiment of the present invention has been described above, the present invention is not limited to the above embodiment, and various modifications are possible without departing from the spirit of the present invention. [Explanation of symbols]

[0089] 10 information processing system, 12 user terminal, 14 authentication server, 16 external authentication device, 18 service providing server, 20 verification device, 22 communication line, 30, 50, 70 communication interface, 32 input interface, 34 display, 36, 52, 72 memory, 38 browser, 40 mailer, 42, 58, 74 processor, 54 user DB, 56 constraint information, 60 authentication linkage processing unit, 62 verification request unit, 64 verification result confirmation unit, 76 verification unit, 78 verification result providing unit.

Claims

1. An information processing device including a storage device and a processor, the storage device stores a constraint that a first communication address of a user registered in an external authentication device must satisfy in order to be permitted to use the information processing device through authentication cooperation with the external authentication device; The processor, acquiring first information issued by the external authentication device, the first information indicating successful authentication of the user, the first information including a second communication address generated by the external authentication device in association with the first communication address; Transmitting second information to the second communication address included in the first information, the second information requesting execution of communication with a predetermined verification device; obtain from the verification device a verification result as to whether or not the first communication address, which is a source of the communication performed in accordance with the second information, satisfies the constraint, and if the verification result indicates that the first communication address does not satisfy the constraint, execute control not to permit authentication collaboration with the external authentication device for the user; 23. An information processing apparatus comprising:

2. The control further includes receiving from the verification device a determination result of the validity of the first communication address based on a forwarding path of the communication from the user, and if the determination result indicates that the first communication address is not valid, not allowing authentication collaboration with the external authentication device for the user. The information processing device according to claim 1 .

3. The processor, providing constraint information representing the constraint to the verification device; The verification device includes: determining whether or not the first communication address, which is a source of the communication, satisfies the constraint indicated by the constraint information provided by the processor, and providing the processor with the determination result; 3. The information processing apparatus according to claim 1, wherein the information processing apparatus is a computer.

4. The processor, after acquiring the first information, accepting an input of identification information of the user in the information processing device from the user; providing the verification device with constraint information that is specified according to the received identification information and indicates the constraint to be applied to the user; 4. The information processing apparatus according to claim 3.

5. The processor, after acquiring the first information, accepting an input of identification information of the user in the information processing device from the user; In the control, when the verification result indicates that the first communication address satisfies the constraint, authentication collaboration with the external authentication device for the user is permitted, and information indicating that the second communication address and the identification information correspond to each other is registered.

3. The information processing apparatus according to claim 1, wherein the information processing apparatus is a computer.

6. An information processing program for operating a computer having a storage device, comprising: the storage device stores a constraint that a first communication address of a user registered in an external authentication device must satisfy in order to be permitted to use the computer through authentication cooperation with the external authentication device; The information processing program is configured to: acquiring first information issued by the external authentication device, the first information indicating successful authentication of the user, the first information including a second communication address generated by the external authentication device in association with the first communication address; transmitting second information, which requests execution of communication with a predetermined verification device, to the second communication address included in the first information; obtain, from the verification device, a verification result as to whether or not the first communication address, which is a source of the communication performed in accordance with the second information, satisfies the constraint, and, if the verification result indicates that the first communication address does not satisfy the constraint, execute control to not permit authentication collaboration with the external authentication device for the user; 2. An information processing program comprising:

Images