Authentication device and authentication method

Abstract

To enable single sign-on for a plurality of authentication processes including an authentication process based on an authentication condition.SOLUTION: An authentication apparatus includes an authentication unit, a history information generation unit, and a communication unit. The authentication unit executes, when a user terminal accesses a service provision system, an authentication process based on an authentication request including descriptions relating to an authentication condition and an authentication method corresponding to the service provision system. The history information generation unit generates history information including information representing whether the authentication condition is satisfied and information representing a result of the authentication process by the authentication method corresponding to the authentication condition. The communication unit transmits the history information to the user terminal.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to an authentication device and an authentication method for single sign-on. [Background technology]

[0002] In recent years, various services have been provided via communication networks. However, security incidents due to unauthorized logins often occur. In many cases, an authentication procedure is performed to authenticate a user when logging in to a service providing system.

[0003] Authentication technologies are becoming more diverse in order to increase security levels. For example, in multi-factor authentication, a user is authenticated based on multiple factors. As an example, a user is authenticated based on an ID, a password, and biometric information. In adaptive authentication, a user is authenticated according to various authentication conditions. For example, a user is permitted to use a service only when the user (or the user's terminal) is located within a specified area.

[0004] Incidentally, a device and a method for appropriately determining a combination of authentication methods according to a service have been proposed (for example, Patent Document 1). Also, an authentication method that utilizes user location information has been proposed (for example, Patent Document 2). [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2017-045328 A [Patent Document 2] US Patent 10027648 (US Publication 2018 / 0083943) Summary of the Invention [Problem to be solved by the invention]

[0006] Single sign-on is a technology that has been put into practical use as one of the technologies to improve user convenience. Single sign-on is a technology that allows users to log in to multiple systems with a single authentication.

[0007] On the other hand, in many cases, the authentication method used when logging in to a service providing system is determined by each service provider. Therefore, as authentication technologies become more diverse and complicated, it becomes difficult to realize single sign-on. In particular, it becomes difficult to realize single sign-on for an authentication system that combines multi-factor authentication, which authenticates a user based on multiple factors, and adaptive authentication, which includes authentication processing according to authentication conditions.

[0008] An object according to one aspect of the present invention is to realize single sign-on for a plurality of authentication processes including authentication processes according to authentication conditions. [Means for solving the problem]

[0009] An authentication method according to one embodiment of the present invention, when a user terminal accesses a service providing system, performs authentication processing based on an authentication request including a description of authentication conditions and an authentication method corresponding to the service providing system, generates history information including information indicating whether the authentication conditions are satisfied and information indicating a result of the authentication processing by the authentication method, and transmits the history information to the user terminal. Effect of the Invention

[0010] According to the above-described aspect, it is possible to realize single sign-on for a plurality of authentication processes including authentication processes according to authentication conditions. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 illustrates an example of a communication system that provides single sign-on. [Diagram 2] FIG. 1 is a diagram illustrating an example of a communication system according to an embodiment of the present invention. [Diagram 3] FIG. 1 is a diagram (part 1) showing an embodiment of an authentication procedure. [Figure 4] FIG. 2 is a diagram (part 2) showing an embodiment of the authentication procedure. [Diagram 5] FIG. 4 is a diagram illustrating an example of a data structure of history information. [Figure 6] FIG. 2 illustrates an example of a data structure of a token. [Figure 7] FIG. 13 is a diagram illustrating an example of a case in which a token that does not include a failed authentication result is sent. [Figure 8] FIG. 11 is a diagram (part 1) showing another embodiment of the authentication procedure. [Figure 9] FIG. 2 is a diagram (part 2) showing another embodiment of the authentication procedure. [Figure 10] FIG. 3 is a diagram (part 3) showing another embodiment of the authentication procedure. [Figure 11] 1A shows an example of a user terminal, and FIG. 1B shows an example of a service providing system. [Figure 12] FIG. 13 is a diagram illustrating an example of a logic database. [Figure 13] FIG. 1 illustrates an example of an authentication system. [Figure 14] FIG. 11 illustrates an example of an authentication processing database. [Figure 15] FIG. 1 illustrates an example of the configuration of an authentication system. [Figure 16] FIG. 1 illustrates an example of an authentication service providing system. [Figure 17] 4 is a flowchart illustrating an example of an authentication method according to an embodiment of the present invention. [Figure 18] 10 is a flowchart illustrating an example of a process in which a user terminal transmits a login request. [Figure 19] 11 is a flowchart illustrating an example of a process in which the service providing system generates an authentication request in response to a login request. [Figure 20] 13 is a flowchart illustrating an example of a process in which a user terminal transfers an authentication request to an authentication system. [Figure 21] 1 is a flowchart showing an example of user authentication by the authentication system. [Figure 22] 11 is a flowchart showing an example of user authentication by the authentication service providing system. [Figure 23] 13 is a flowchart illustrating an example of a process in which the authentication system issues a token. [Figure 24] 13 is a flowchart illustrating an example of token verification by each service providing system. [Diagram 25] FIG. 11 is a diagram (part 1) showing an example of an authentication procedure in a variation of the embodiment of the present invention. [Figure 26] FIG. 2 is a diagram (part 2) showing an example of an authentication procedure in a variation of the embodiment of the present invention. [Figure 27] FIG. 3 is a diagram (part 3) showing an example of an authentication procedure in a variation of the embodiment of the present invention. [Figure 28] FIG. 4 is a diagram showing an example of an authentication procedure in a variation of the embodiment of the present invention. [Figure 29] FIG. 2 illustrates an example of a hardware configuration of an authentication system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] 1 shows an example of a communication system that provides single sign-on. In this example, a communication system 10 includes a plurality of service providing systems 11 (11A to 11B) and an authentication system 12. The service providing systems 11 can provide services to users. The authentication system 12 authenticates users who access the service providing systems 11.

[0013] When a user receives a service provided by the service providing systems 11A to 11B, the user requests login to each of the service providing systems 11A to 11B using the user terminal 13. Here, first, a login request is transmitted from the user terminal 13 to the service providing system 11A.

[0014] When the service providing system 11A receives a login request from the user terminal 13, it requests authentication of the user from the authentication system 12. At this time, the authentication request is transferred to the authentication system, for example, by using a redirect by the user terminal 13. The authentication request includes a list specifying an authentication method (for example, a password, biometric information).

[0015] In response to a user's operation, the user terminal 13 transmits authentication information to the authentication system 12. For example, when a password is requested by the authentication system 12, the user inputs the password using the user terminal 13. The input password is then transmitted from the user terminal 13 to the authentication system 12.

[0016] The authentication system 12 performs user authentication based on authentication information received from the user terminal 13. If the authentication is successful, the authentication system 12 generates a token and transmits it to the user terminal 13. The token includes the signature of the entity that performed the user authentication (in this example, the authentication system 12).

[0017] The user terminal 13 transmits the token generated by the authentication system 12 to the service providing system 11A. If the token is successfully verified, the service providing system 11A permits login. Then, a login request is transmitted from the user terminal 13 to the service providing system 11B. At this time, the token previously generated is also transmitted from the user terminal 13 to the service providing system 11B. If the token is successfully verified, the service providing system 11B also permits login.

[0018] In this way, the user terminal 13 can log in to another system (here, the service providing system 11B) by using the token acquired when logging in to the service providing system 11A. That is, single sign-on is realized.

[0019] However, with this method, if the authentication request specified by each service providing system 11 becomes complicated, it may not be possible to determine whether or not to permit a login request received from a user. For example, it is assumed that the service providing system 11A specifies the following authentication method. (1) If it is in the morning, use your IC card for authentication. (2) If it is not morning, authenticate with your fingerprint In this case, the authentication system 12 needs to select an authentication method according to the authentication conditions. However, when an authentication request is composed of a list that specifies authentication methods, it is difficult to specify an authentication method according to the authentication conditions. Note that, although existing adaptive authentication determines whether or not an authentication condition is satisfied, it does not specify an authentication method according to the authentication conditions.

[0020] <Embodiment> 2 shows an example of a communication system according to an embodiment of the present invention. In this example, a communication system 20 includes a plurality of service providing systems 21 (21A to 21B) and an authentication system 22. The service providing system 21 can provide services to users, similar to the service providing system 11. The authentication system 22 authenticates users who access the service providing system 11, similar to the authentication system 12.

[0021] When a user receives a service provided by the service providing systems 21A to 21B, the user requests login to each of the service providing systems 21A to 21B using the user terminal 13. Here, first, a login request is transmitted from the user terminal 13 to the service providing system 21A.

[0022] When the service providing system 21A receives a login request from the user terminal 13, it requests authentication of the user from the authentication system 22. At this time, the authentication request is transferred to the authentication system 22 by using, for example, a redirect by the user terminal 13.

[0023] In the communication system 10 shown in FIG. 1, the authentication request is composed of a list that specifies an authentication method (e.g., password, biometric information). In contrast, in the communication system 20 according to the embodiment of the present invention, the authentication request includes a description related to the authentication conditions and the authentication method. This description may be, for example, a logical description including a conditional statement. Therefore, in the following description, the description included in the authentication request may be referred to as "logic."

[0024] The user terminal 13 transmits authentication information to the authentication system 22 in response to a user's operation. For example, when a password is requested by the authentication system 22, the user inputs the password using the user terminal 13. The input password is then transmitted from the user terminal 13 to the authentication system 22. Also, when a fingerprint is requested by the authentication system 22, the user inputs his / her fingerprint into the user terminal 13. The user's fingerprint data is then transmitted from the user terminal 13 to the authentication system 22.

[0025] The authentication system 22 performs user authentication based on the authentication information received from the user terminal 13. At this time, the authentication system 22 performs user authentication according to the logic included in the authentication request. Then, the authentication system 22 generates history information indicating the result of the user authentication. Specifically, the authentication history includes information indicating whether the authentication conditions are satisfied, the authentication method selected according to the authentication conditions, the authentication result, and the date and time when the authentication was performed. Here, the authentication result indicates authentication success or failure for each authentication method.

[0026] When the authentication process is completed, the authentication system 22 generates a token. As described above, the token includes the signature of the entity that performed the user authentication (in this example, the authentication system 22). The signature is an example of identification information that identifies the entity that performed the authentication process. The authentication system 22 then transmits the history information and the token to the user terminal 13. At this time, the authentication system 22 may transmit the history information and the token individually to the user terminal 13. Alternatively, the authentication system 22 may generate a token including the history information and transmit it to the user terminal 13. In the following description, it is assumed that a token including the history information (or a token to which the history information is attached) is transmitted from the authentication system 22 to the user terminal 13.

[0027] The user terminal 13 transmits the token generated by the authentication system 22 to the service providing system 21A. The service providing system 21A then determines whether or not to permit the login request received from the user terminal 13 based on the history information attached to the token. Then, the login request is transmitted from the user terminal 13 to the service providing system 21B. At this time, the token generated in response to the login request to the service providing system 21A is also transmitted from the user terminal 13 to the service providing system 21B. The service providing system 21B then determines whether or not to permit the login request received from the user terminal 13 based on the history information attached to this token.

[0028] In this way, the user terminal 13 can log in to another service providing system (here, service providing system 21B) by using the token acquired when making a login request to the service providing system 21A. That is, single sign-on is realized. In addition, in the communication system 20, the authentication request includes logic related to authentication conditions and authentication methods. Then, the authentication system 22 executes user authentication according to that logic. Therefore, single sign-on can be realized even if each service providing system 21 has complex authentication requirements (authentication conditions and authentication methods).

[0029] 2, the service providing systems 21A and 21B may be realized by physically different computers, or may be realized by one computer. A login request to the service providing system 21 (21A, 21B) may mean a login request to a service provided by the service providing system 21. That is, the embodiment of the present invention relates to single sign-on to a service provided by the service providing system 21.

[0030] 3 and 4 show an embodiment of the authentication procedure. In this embodiment, the service providing system 21A and the service providing system 21B have different authentication policies. A different authentication policy is set for each service. The authentication policy of the service providing system 21A is described as "Logic A" in FIG. 3. In Logic A, "InAM" represents the morning. "ICCard" represents authentication by an IC card. "FingerPrint" represents fingerprint authentication. Therefore, Logic A represents "if it is the morning, authentication using an IC card is performed, and if it is not the morning, fingerprint authentication is performed." Also, the authentication policy of the service providing system 21B is described as "Logic B" in FIG. 3. In Logic B, "Face" represents face authentication. Therefore, Logic B represents "if it is not the morning, fingerprint authentication is performed, and if it is the morning, face authentication is performed."

[0031] When the service providing system 21A receives a login request from the user terminal 13, it transmits an authentication request including the logic A to the authentication system 22. At this time, the authentication request may be transmitted directly from the service providing system 21A to the authentication system 22, or may be transferred to the authentication system 22 via the user terminal 13.

[0032] The authentication system 22 performs user authentication according to logic A. First, the authentication system 22 judges whether the current time is in the morning or not according to "if InAM". In this example, it is assumed that the current time is "19:00". In this case, the judgment result for "if InAM" is "false". Also, logic A indicates that "if it is not in the morning, perform fingerprint authentication". Therefore, the authentication system 22 executes fingerprint authentication. In this case, the authentication system 22 transmits a message requesting fingerprint data to the user terminal 13. Then, when the authentication system 22 receives the fingerprint data from the user terminal 13, it authenticates the user of the user terminal 13 by comparing the fingerprint data with fingerprint data registered in advance. In this example, it is assumed that the fingerprint comparison was successful. In this case, the judgment result for "FingerPrint" is "true". Then, the authentication system 22 generates history information indicating the result of the user authentication.

[0033] FIG. 5 shows an example of a data structure of history information. This history information indicates the result of user authentication based on logic A shown in FIG. 3. "seq" indicates a sequence number indicating the order in which the authentication process was executed. "comm" indicates an authentication method or authentication element. "name" indicates the name of the authentication method or authentication element. "result" indicates the execution result of the authentication process. "date" indicates the date and time when the authentication was executed.

[0034] In this example, the execution results represented by the history information are as follows: (1) For sequence 0, determine whether the current time is in the morning, and the result is “false.” (2) In sequence 1, it is determined whether or not the fingerprint data is registered in the server, and the result is "true."

[0035] Once user authentication is complete, authentication system 22 generates a token, which, as described above, includes the signature of the entity that performed the user authentication (in this example, authentication system 22).

[0036] FIG. 6 shows an example of a data structure of a token. In this embodiment, history information is inserted into the token. "iss" represents the token issuer. "sub" represents an ID number for identifying a user. "hist" represents history information. In this embodiment, the history information shown in FIG. 5 is inserted into the token. "sig" represents a signature for data (i.e., payload) including history information, and is generated, for example, using the private key of the token issuer.

[0037] The authentication system 22 transmits the token with the history information attached to the user terminal 13. Then, the user terminal 13 transmits the token issued by the authentication system 22 to the service providing system 21A, as shown in FIG.

[0038] The service providing system 21A judges whether or not to permit the login request received from the user terminal 13 based on the token received from the user terminal 13. First, the service providing system 21A verifies the signature of the token. Here, it is assumed that the signature verification is successful. Next, the service providing system 21A verifies whether or not the history information satisfies logic A. In this example, logic A indicates that "if it is morning, authentication using an IC card is performed, and if it is not morning, fingerprint authentication is performed." Furthermore, the history information indicates "InAM:false" and "FingerPrint:true." Therefore, the service providing system 21A judges that the history information satisfies logic A, and permits the login request received from the user terminal 13.

[0039] Furthermore, a login request is transmitted from the user terminal 13 to the service providing system 21B. At this time, the user terminal 13 transmits, together with the login request, the token issued at the time of the login request to the service providing system 21A to the service providing system 21B.

[0040] The service providing system 21B determines whether or not to permit the login request received from the user terminal 13, based on the token received from the user terminal 13. First, the service providing system 21B verifies the signature of the token. Here, it is assumed that the signature verification is successful. Next, the service providing system 21B checks whether or not the history information satisfies Logic B. In this example, Logic B represents "if it is not morning, perform fingerprint authentication, and if it is morning, perform face authentication." The history information represents "InAM:false" and "FingerPrint:true." Therefore, the service providing system 21B determines that the history information satisfies Logic B, and permits the login request received from the user terminal 13.

[0041] Single sign-on is achieved by the above-mentioned procedure. Here, the history information includes not only successful authentication results but also failed authentication results. In the examples shown in Figs. 3 to 6, the history information includes information indicating that the authentication conditions are not satisfied. Specifically, the history information includes information "InAM: false" indicating that the time of login request is not in the morning. Then, by using this history information when logging in to another service providing system, accurate user authentication is possible.

[0042] For example, as shown in FIG. 7, the history information represents only successful authentication results. That is, in the case shown in FIG. 7, the history information includes "FingerPrint: true" but does not include "InAM: false." In this case, when receiving a token with this history information attached, the service providing system 21B cannot determine whether the fingerprint authentication was performed in the morning or in the afternoon. Therefore, the service providing system 21B cannot authenticate the user based on Logic B.

[0043] 3 to 6, the service providing system 21B can detect that the fingerprint authentication was performed in the afternoon by referring to the history information. Therefore, the service providing system 21B can authenticate the user based on Logic B.

[0044] 8 to 10 show another embodiment of the authentication procedure. In this embodiment, the service providing system 21A and the service providing system 21B have different authentication policies. "OnSite" indicates whether or not the user is located within the premises of the company. "IDandPassword" indicates authentication using an ID number and a password. "PIN" indicates authentication using a personal identification number. Therefore, logic A representing the authentication policy of the service providing system 21A means "when the user is located within the premises of the company, authentication is performed using an ID and a password, and when the user is located outside the premises of the company, authentication is performed using an IC card and a PIN." Moreover, logic B representing the authentication policy of the service providing system 21B means "authentication is performed using an IC card and a PIN."

[0045] In the above communication system 20, when a login request is received from the user terminal 13, the service providing system 21A transmits an authentication request to the user terminal 13. This authentication request includes logic A. This authentication request is also transmitted from the user terminal 13. Authentication System 22 Furthermore, from the user terminal 13, Authentication System 22 Authentication information is sent to.

[0046] The transmission of the authentication information is not particularly limited, but may be realized, for example, by the following procedure. When redirecting the authentication request to the authentication system 22, the user terminal 13 transmits location information indicating the location of the user terminal 13 to the authentication system 22. Authentication System 22, and the authentication system 22 then refers to logic A included in the authentication request to determine whether or not the user is located within the company's premises. Here, it is assumed that the user is located within the company's premises. In this case, the authentication system 22 transmits a message to the user terminal 13 requesting an ID and password based on logic A. Then, when the user inputs an ID and password in response to this message, the user terminal 13 transmits the input ID and password to the authentication system 22.

[0047] The authentication system 22 performs user authentication according to logic A. First, the authentication system 22 judges whether or not the user is located within the premises of the company according to "if OnSite". The user's location is detected by location information received from the user terminal 13. In this example, it is assumed that the user is located within the premises of the company. In this case, the judgment result for "if OnSite" is "true". Also, logic A indicates that "when the user is located within the premises of the company, authentication is performed using the ID and password". Therefore, the authentication system 22 performs user authentication using the ID and password received from the user terminal 13. In this case, it is judged whether or not the pair of the ID and password received from the user terminal 13 is registered in the database. In this example, it is assumed that the authentication is successful. In this case, the judgment result for "IDandPassword" is "true". Then, the authentication system 22 generates history information indicating the result of the user authentication.

[0048] The history information is inserted into the token as shown in Fig. 9. Then, the token with the history information attached is transmitted from the authentication system 22 to the user terminal 13.

[0049] The user terminal 13 transmits the token issued by the authentication system 22 to the service providing system 21A. Then, the service providing system 21A determines whether to permit the login request received from the user terminal 13, based on the token received from the user terminal 13.

[0050] The service providing system 21A checks the signature of the token. Here, it is assumed that the signature verification is successful. Next, the service providing system 21A checks whether the history information satisfies logic A. In this example, logic A indicates that "when the user is located within the company premises, authentication is performed using an ID and password, and when the user is located outside the company premises, authentication is performed using an IC card and PIN." The history information indicates "OnSite: true" and "IDandPAssword: true." Therefore, the service providing system 21A determines that the history information satisfies logic A, and permits the login request received from the user terminal 13.

[0051] Furthermore, a login request is transmitted from the user terminal 13 to the service providing system 21B. At this time, the user terminal 13 transmits, together with the login request, the token issued at the time of the login request to the service providing system 21A to the service providing system 21B.

[0052] The service providing system 21B determines whether to permit the login request received from the user terminal 13, based on the token received from the user terminal 13. That is, the service providing system 21B checks the signature of the token. Here, it is assumed that the signature verification is successful. Next, the service providing system 21B checks whether the history information satisfies logic B. Logic B represents "perform authentication using an IC card and PIN." However, the history information does not include the authentication result using the IC card and PIN. Therefore, the service providing system 21B determines that the history information does not satisfy logic B, and rejects the login request received from the user terminal 13.

[0053] Fig. 11(a) shows an example of a user terminal 13. The user terminal 13 includes an input unit 31 and a communication unit 32. The user terminal 13 may include other functions not shown in Fig. 11(a). For example, the user terminal 13 may include a device that detects the position of the user terminal 13 by using a GPS signal.

[0054] The input unit 31 processes user input. For example, the input unit 31 is realized by a keyboard (including a software keyboard), a mouse, a touch panel, a camera, a microphone, a sensor, etc. The communication unit 32 provides an interface for connecting to a network. That is, the communication unit 32 can communicate with other communication devices (for example, the service providing system 21, the authentication system 22) via the network.

[0055] Fig. 11(b) shows an example of the service providing system 21. The service providing system 21 includes a communication unit 41, a logic database 42, an authentication request unit 43, and a verification unit 44. Note that the service providing system 21 may include other functions not shown in Fig. 11(b).

[0056] The communication unit 41 provides an interface for connecting to a network. That is, the communication unit 41 can communicate with other communication devices (for example, the user terminal 13 and the authentication system 22) via the network. As shown in FIG. 12, the logic database 42 stores a logical description (i.e., logic) describing an authentication policy for each service provided by the service providing system 21. The logic is described, for example, in a text format. When the service providing system 21 receives a login request, the authentication request unit 43 generates an authentication request by referring to the logic database 42. For example, when a login request for using a mail service is received, the authentication request unit 43 extracts logic corresponding to "Mail" from the logic database 42. Then, the authentication request unit 43 generates an authentication request including the extracted logic.

[0057] The verification unit 44 includes a logic verification unit 45 and a signature verification unit 46. When the service providing system 21 receives a token from a user terminal, the logic verification unit 45 verifies whether or not the history information attached to the token satisfies the corresponding logic. The signature verification unit 46 verifies whether or not the token is signed by a predetermined authentication system. When the history information satisfies the logic and a predetermined signature is detected, the service providing system 21 permits the login request. In other words, the service providing system 21 provides a service to the user terminal.

[0058] 13 shows an example of the authentication system 22. The authentication system 22 includes a communication unit 51, an authentication unit 52, and an authentication control unit 55. Note that the authentication system 22 may include other functions not shown in FIG.

[0059] The communication unit 51 provides an interface for connecting to a network. That is, the communication unit 51 can communicate with other communication devices (for example, the user terminal 13 and the service providing system 21) via the network.

[0060] The authentication unit 52 includes an authentication program 53 and an authentication execution unit 54. The authentication program 53 is a program code in which a procedure for user authentication is described. The authentication unit 52 may include a plurality of authentication programs 53. The authentication execution unit 54 executes the authentication program 53 designated by the authentication control unit 55.

[0061] The authentication control unit 55 includes a logic execution unit 56, an authentication processing database 57, a calling unit 58, a history information generating unit 59, and a token issuing unit 60. The logic execution unit 56 identifies authentication elements requested by the service providing system 21 based on logic included in the authentication request. In this embodiment, the authentication elements include authentication conditions and authentication methods. As shown in FIG. 14, the authentication processing database 57 manages the location where the authentication processing is executed and the name of the authentication program for each authentication element. Note that "local" indicates that the corresponding authentication element is executable in the authentication system 22. When the corresponding authentication element is not executable in the authentication system 22, "local" indicates the location where the computer that executes the authentication element is installed. The calling unit 58 identifies the computer that executes the authentication element by referring to the authentication processing database 57, and requests the identified computer to execute user authentication.

[0062] The history information generating unit 59 generates history information representing the result of user authentication. The token issuing unit 60 generates a token by adding a signature to data including the history information. That is, a token with the history information attached is issued. After that, the communication unit 51 transmits the token issued by the authentication control unit 55 to the user terminal 13.

[0063] Fig. 15 shows an example of the configuration of an authentication system. For example, the authentication system is implemented in a service providing system as shown in Fig. 15(a). However, in this configuration, the service provider develops not only the service providing system but also the authentication system. Therefore, if the service provider wants to focus on the development of the service providing system, the development of the authentication system becomes a heavy burden for the service provider.

[0064] In the configuration shown in Fig. 15(b), the authentication system is provided outside the service providing system. This configuration is becoming more and more practical due to the spread of OpenID Connect / SAML and Identity as a Service. However, in recent years, authentication technologies have become more diverse and complex. For this reason, it is not easy for one company to cover all authentication technologies.

[0065] In the configuration shown in FIG. 15(c), the authentication system is provided outside the service providing system, and an authenticator is provided outside the authentication system. The authenticator corresponds to, for example, the authentication unit 52 shown in FIG. 13. In this case, the authentication system is constructed using a third-party authenticator. With this configuration, the service providing system can use a desired authentication policy by combining various authentication conditions and authentication methods. Note that one or more authenticators may be implemented in the authentication system. For example, the authentication system 22 shown in FIG. 13 includes an authentication unit 52 that operates as an authenticator.

[0066] FIG. 16 shows an example of an authentication service providing system. In the example shown in FIG. 15(c), the authentication service providing system 23 shown in FIG. 16 corresponds to an authentication device provided outside the authentication system. The authentication service providing system 23 includes a communication unit 61 and an authentication unit 62. The communication unit 61 provides an interface for connecting to a network. That is, the communication unit 61 can communicate with other communication devices (e.g., the authentication system 22) via the network. The authentication unit 62 includes an authentication program 63 and an authentication execution unit 64. The authentication program 63 and the authentication execution unit 64 are substantially the same as the authentication program 53 and the authentication execution unit 54 implemented in the authentication system 22 shown in FIG. 13, and therefore a description thereof will be omitted.

[0067] Fig. 17 is a flowchart showing an example of an authentication method according to an embodiment of the present invention. The process of this flowchart is executed by, for example, the user terminal 13, the service providing system 21 (21A to 21B), and the authentication system 22 shown in Fig. 3. The process of this flowchart is started when a user logs in to a desired service providing system 21 using the user terminal 13. Each service providing system 21 has logic that represents a policy for user authentication.

[0068] At S1, the user terminal 13 transmits a login request to the service providing system 21 designated by the user. At S2, the service providing system 21 that has received the login request generates an authentication request. This authentication request includes logic that represents the authentication policy of the service providing system 21. The service providing system 21 then transmits this authentication request to the user terminal 13. Note that a transfer request that instructs the authentication request to be transferred to the authentication system 22 is added to this authentication request.

[0069] In S3, in response to the transfer request, the user terminal 13 transfers the authentication request received from the service providing system 21 to the authentication system 22. In addition, the user terminal 13 transmits the authentication information of the user to the authentication system 22. At this time, the user terminal 13 transmits to the authentication system 22 the authentication information (e.g., password, fingerprint, etc.) input by the user depending on the authentication method.

[0070] Note that S2 to S3 can have various variations. For example, the service providing system 21 may transmit an authentication request to the authentication system 22 without going through the user terminal 13. Furthermore, when the user terminal 13 transfers an authentication request received from the service providing system 21 to the authentication system 22, the user terminal 13 may acquire necessary authentication information based on the authentication request. In this case, the user terminal 13 may transmit the authentication information to the authentication system 22 together with the authentication request. Alternatively, when the user terminal 13 is requested for authentication information by the authentication system 22, the user terminal 13 may acquire the requested authentication information from the user and transmit it to the authentication system 22.

[0071] At S4, the authentication system 22 performs authentication processing on the authentication information based on the logic included in the authentication request. At S5, the authentication system 22 generates history information representing the result of the user authentication and issues a token. In this embodiment, the history information is attached to the token. The authentication system 22 then transmits the token with the history information attached to the user terminal 13.

[0072] In S6, the user terminal 13 transmits the token to a desired service providing system 21. At this time, when logging in to a plurality of service providing systems 21, the same token is transmitted to each service providing system 21. In S7, each service providing system 21 that receives the token verifies whether or not the history information attached to the token satisfies its own authentication policy. Then, if the history information satisfies the authentication policy, the service providing system 21 permits the login.

[0073] 18 is a flowchart showing an example of a process for transmitting a login request by the user terminal 13. This process corresponds to S1 shown in FIG.

[0074] In S11, the input unit 31 shown in Fig. 11(a) accepts a login request from a user to the service providing system 21. Then, the input unit 31 passes this login request to the communication unit 32. The login request includes identification information for identifying the service specified by the user (or the service providing system 21 into which the user is attempting to log in). In S12, the communication unit 32 transmits the login request to the service providing system 21 specified by the user. In the example shown in Fig. 3, the login request is transmitted to the service providing system 21A.

[0075] 19 is a flowchart showing an example of a process in which the service providing system 21 generates an authentication request in response to a login request. This process corresponds to S2 shown in FIG.

[0076] 11(b) receives a login request transmitted from the user terminal 13. This login request is passed from the communication unit 41 to the authentication request unit 43. In S22, the authentication request unit 43 acquires logic corresponding to the service designated by the user based on the login request from the logic database 42. Note that it is assumed that logic representing an authentication policy is registered in the logic database 42 for each service provided by the service providing system 21. Each logic is, for example, text data describing an authentication policy.

[0077] In S23, the authentication request unit 43 generates an authentication request including the acquired logic. The authentication request may include, for example, a message or command requesting the authentication system 22 to execute the logic. In S24, the communication unit 41 attaches a transfer request to the authentication request. This transfer request instructs that the authentication request be redirected to the authentication system 22. Then, the communication unit 41 transmits the authentication request with the attached transfer request to the sender of the login request (i.e., the user terminal 13).

[0078] 20 is a flowchart showing an example of a process in which the user terminal 13 transfers an authentication request to the authentication system 22. This process corresponds to S3 shown in FIG.

[0079] In S31, the communication unit 32 shown in FIG. 11(a) receives an authentication request accompanied by a transfer request from the service providing system 21. In S32, the user terminal 13 refers to the logic included in the authentication request and acquires authentication information required for user authentication. The user terminal 13 then requests the authentication information from the user as necessary. For example, when a password is required for user authentication, a screen for inputting the password is displayed on the display device of the user terminal 13. In S33, the communication unit 32 transfers the authentication request to the authentication system 22 in accordance with the transfer request, and transmits the authentication information to the authentication system 22.

[0080] 21 is a flowchart showing an example of user authentication by the authentication system 22. This process corresponds to S4 shown in FIG.

[0081] 13 receives an authentication request and authentication information transmitted from the user terminal 13. The authentication request and authentication information are passed from the communication unit 51 to the logic execution unit 56. At this time, the communication unit 51 requests the logic execution unit 56 to execute the logic included in the authentication request.

[0082] In S42, the logic execution unit 56 executes the logic included in the authentication request. Specifically, the logic execution unit 56 identifies one or more authentication elements requested by the service providing system 21 based on the logic included in the authentication request. In S43 to S44, the calling unit 58 refers to the authentication processing database 57 and identifies a computer capable of executing authentication processing corresponding to each authentication element identified by the logic execution unit 56. Note that, as shown in Fig. 14, the authentication processing database 57 manages, for each authentication element, the location where the authentication processing is executed and the name of the authentication program.

[0083] When the authentication unit 52 implemented in the authentication system 22 can execute the authentication process, in S45 the calling unit 58 requests the authentication unit 52 to execute the authentication process. At this time, the calling unit 58 specifies the authentication program to be executed, and passes the authentication information received from the user terminal 13 to the authentication unit 52. The authentication unit 52 then executes the requested authentication process. Specifically, the authentication execution unit 54 executes the specified authentication program 53 for the authentication information received from the user terminal 13. The authentication unit 52 then outputs the authentication result (true or false). This authentication result is sent to the logic execution unit 56.

[0084] When the authentication unit 52 implemented in the authentication system 22 cannot execute the authentication process, in S46 the calling unit 58 requests the computer specified by the logic execution unit 56 (for example, the authentication service providing system 23 shown in FIG. 16) to execute the authentication process. At this time, the request to execute the authentication process is transmitted by the communication unit 51 to the authentication service providing system 23. Then, the authentication service providing system 23 executes the authentication process. Then, in S47, the communication unit 51 receives the authentication result by the authentication service providing system 23. This authentication result is sent to the logic execution unit 56.

[0085] The processes of S42 to S47 are executed for each authentication element requested by the service providing system 21. That is, in S48, the logic execution unit 56 determines whether or not there are any authentication elements that have not been executed. Then, if there are any authentication elements that have not been executed, the process of the logic execution unit 56 returns to S42. That is, the processes of S42 to S47 are repeatedly executed until the authentication processes corresponding to all authentication elements have been executed. Then, when the authentication processes corresponding to all authentication elements have been executed, in S49, the logic execution unit 56 requests the token issuing unit 60 to issue a token.

[0086] 22 is a flowchart showing an example of user authentication by the authentication-service providing system 23. This process corresponds to a part of S4 shown in FIG.

[0087] In S51, the communication unit 61 shown in FIG. 16 receives a request to execute authentication processing from the authentication system 22. This execution request is transmitted from the authentication system 22 in S46 of FIG. 21. In S52, the authentication unit 62 executes the requested authentication processing. Specifically, the authentication execution unit 64 executes a specified authentication program 63 for the authentication information received from the user terminal 13. Then, the authentication unit 62 outputs an authentication result (true or false). In S53, the communication unit 61 transmits the authentication result to the authentication system 22. This authentication result is received by the authentication system 22 in S47 of FIG. 21.

[0088] 23 is a flowchart showing an example of a process for issuing a token by the authentication system 22. This process corresponds to S5 shown in FIG.

[0089] In S61, the history information generating unit 59 shown in Fig. 13 obtains the logic execution history from the logic execution unit 56. The logic execution history includes the authentication results by the authentication unit 52 and / or the authentication service providing system 23. In S62, the history information generating unit 59 generates history information based on the logic execution history. As shown in Fig. 5, the history information indicates the authentication results for each authentication element and the time when the authentication process was executed. Furthermore, it is preferable that the authentication results for each authentication element are arranged in chronological order.

[0090] In S63, the token issuing unit 60 creates a token by adding a signature for identifying the authentication system 22 to data including the history information. The signature may be generated using a private key for cryptographic communication. In S64, the communication unit 51 transmits the token to the user terminal 13. The user terminal 13 can transmit the token to each of one or more desired service providing systems 21 to which the user wishes to log in.

[0091] 24 is a flowchart showing an example of token verification by each service providing system 21. This process corresponds to S7 shown in FIG.

[0092] In S71, the communication unit 41 shown in FIG. 11(b) receives a token transmitted from the user terminal 13. As described above, the token includes history information indicating the result of user authentication, and also has a signature of the authentication system 22 added to it. This token is passed to the verification unit 44. In S72, the logic verification unit 45 obtains logic corresponding to the service to which the user wishes to log in from the logic database 42. Note that the logic database 42 manages logic describing an authentication policy for each service, as shown in FIG. 12.

[0093] In S73 to S74, the logic verification unit 45 verifies whether or not the history information included in the token satisfies the corresponding logic. When the logic includes an authentication condition and an authentication method, the combination of the authentication condition and the authentication method is verified. When the logic includes multiple authentication elements, each authentication element is verified.

[0094] In S75 to S76, the signature verification unit 46 verifies the signature of the token. For example, the signature verification unit 46 verifies whether or not the token has been issued by a reliable authentication system. Then, when the logic verification and the signature verification are successful, the service providing system 21 permits the login request received from the user terminal 13. On the other hand, when at least one of the logic verification and the signature verification fails, the service providing system 21 rejects the login request received from the user terminal 13. Note that the verification unit 44 may execute S75 to S76 before S73 to S74.

[0095] Next, the procedure of the flowcharts shown in Fig. 21 and Fig. 23 will be described with reference to the embodiments shown in Fig. 8 to Fig. 9. In response to a login request received from the user terminal 13, the service providing system 21A generates an authentication request including the following logic. "if OnSite then ID and Password; else ICCard; PIN This logic indicates that "when the user is located within the company premises, authentication is performed using the ID and password, and when the user is located outside the company premises, authentication is performed using the IC card and PIN." In addition, it is assumed that the location information of the user terminal 13, the user ID, and the password are transmitted from the user terminal 13 to the authentication system 22 as authentication information.

[0096] When the authentication system 22 receives an authentication request including the above logic, it executes S41 to S49 shown in Fig. 21. That is, in S42, the logic execution unit 56 analyzes the received logic to detect the following four authentication elements: Authentication factor A1: Determines whether the user is located on company premises Authentication factor A2: Determine whether the user ID and password pair is correct Authentication factor A3: Determine whether the IC card identification information is registered Authentication factor A4: Determine if PIN is registered The logic execution unit 56 also recognizes that when the determination for the authentication factor A1 is "true", the authentication factor A2 is executed, and when the determination for the authentication factor A1 is "false", the authentication factors A3 to A4 are executed.

[0097] In S43 to S44, the calling unit 58 refers to the authentication process database 57 and identifies a computer capable of executing the authentication process corresponding to the authentication element A1. In this example, it is assumed that the authentication unit 52 implemented in the authentication system 22 is capable of executing the authentication process corresponding to the authentication element A1. In this case, in S45, the authentication unit 52 determines whether or not the user is located within the premises of the company based on the location information received from the user terminal 13. In this example, it is assumed that the user is located within the premises of the company. Then, "OnSite=true" is obtained as the authentication result corresponding to the authentication element A1. Then, this authentication result is sent to the logic execution unit 56. Thereafter, the processing of the authentication system 22 returns to S42.

[0098] In S42, when the logic execution unit 56 recognizes that the authentication result of the authentication element A1 is "true", it extracts the authentication element A2. Next, in S43 to S44, the calling unit 58 refers to the authentication process database 57 and identifies a computer capable of executing the authentication process corresponding to the authentication element A2. In this example, it is assumed that the authentication unit 52 implemented in the authentication system 22 can execute the authentication process corresponding to the authentication element A2. In this case, in S45, the authentication unit 52 judges whether or not the pair of the user ID and password received from the user terminal 13 is correct. In this example, it is assumed that the pair of the user ID and password is correct. Then, "IDandPassword=true" is obtained as the authentication result corresponding to the authentication element A2. Then, this authentication result is sent to the logic execution unit 56.

[0099] According to the logic of this embodiment, when the authentication process corresponding to the authentication factor A2 is executed, the authentication processes corresponding to the authentication factors A3 to A4 are not executed. Therefore, the logic execution unit 56 ends the repeated process of S42 to S47, and requests the token issuing unit 60 to issue a token in S49.

[0100] When the token issuing unit 60 receives a token issuance request from the logic execution unit 56, in S61 the history information generation unit 59 acquires the authentication result by the authentication unit 52 (i.e., the execution history of logic by the logic execution unit 56). In S62, the history information generation unit 59 generates history information indicating the authentication result. In this embodiment, the history information indicates the authentication result and authentication time for each authentication element, as shown in FIG. 9. In S63, the token issuing unit 60 creates a token by adding a signature to data including the history information. In this embodiment, the token is as shown in FIG. 10. Thereafter, the communication unit 51 transmits the token to the user terminal 13 in S64.

[0101] In most cases of current single sign-on authentication, the system that receives the authentication request (i.e., the authentication system) performs the authentication. In this case, the available authentication methods depend on the implementation of the authentication system. Therefore, in cases where various types or strengths of authentication are required, it is difficult for one authentication system to provide all authentication methods. On the other hand, configurations in which part of the functions of a computer system are implemented outside the system (X as a Service, API Mashup) are becoming more common. In addition, there is growing interest in utilizing data owned by individuals or companies. For this reason, it is thought that in the future, there will be a demand to build systems that meet desired requirements by making good use of external services or data.

[0102] Considering the above technical issues and trends, it is preferable that the authentication system can provide various authentication methods by using external services or data. The embodiment of the present invention can solve the issues of how to combine authentication methods and how to verify the execution results in an authentication system that uses a third party.

[0103] In addition, according to the embodiment of the present invention, personal information held by the service provider can be used as authentication information. For example, information on the location and movement of each subscriber held by a communication carrier, and strict personal identification information held by a financial institution can be used as authentication information. For this reason, the embodiment of the present invention is considered to be useful for data utilization businesses.

[0104] <Variations> When the authentication policy of the service providing system 21 includes multiple authentication factors, the operation rate of the logic in the authentication system 22 is likely to decrease. For example, assume that the authentication policy includes authentication factors A1 to A2, and the failure rate of the authentication device B1 corresponding to the authentication factor A1 is 0.1, and the failure rate of the authentication device B2 corresponding to the authentication factor A2 is 0.2. In this case, the operation rates of the authentication devices B1 and B2 are 0.9 and 0.8, respectively, so the operation rate of this logic is 0.72. Note that the failure of the authentication device includes not only an abnormality in the authentication device itself, but also a case where appropriate authentication information is not provided to the authentication device and appropriate authentication processing cannot be performed.

[0105] In a variation of the embodiment of the present invention, in order to alleviate this problem, alternative authentication factors can be set for one or more authentication factors included in the authentication policy. The alternative authentication factors are set by the service providing system 21 and described in an alternative list. Then, for example, the alternative list is notified in advance from the service providing system 21 to the authentication system 22. However, the alternative list may be transmitted to the authentication system 22 together with the authentication request.

[0106] The alternate list represents pairs of authentication factors and alternate authentication factors, for example as follows: Alternative list:OnSite=OnSite2 In this example, "OnSite" uses a Global Positioning System (GPS) to determine whether the user is located within a predetermined area. "OnSite2" uses cellular base station information to determine whether the user is located within a predetermined area. When the computer that performs the authentication process corresponding to the authentication factor is known, the alternative list may include information that identifies the computer.

[0107] When executing authentication processing according to an authentication request, the authentication system 22 refers to the substitution list as necessary. For example, when an authentication processing corresponding to a certain authentication element cannot be executed, the authentication system 22 determines whether or not an alternative authentication element is set for that authentication element by referring to the substitution list. If an alternative authentication element is set, the authentication system 22 realizes user authentication by executing an authentication processing corresponding to the alternative authentication element.

[0108] 25 to 28 show an example of an authentication procedure in a variation of an embodiment of the present invention. In this example, the substitution list indicates that "Onsite2" may be used instead of "OnSite" as shown in Fig. 25. Also, the authentication system 22 is capable of executing authentication processes corresponding to "OnSite" and "Onsite2", respectively.

[0109] The authentication request and authentication information received by the authentication system 22 are substantially the same in Fig. 8 and Fig. 25. However, in this example, the location information representing the location of the user terminal 13 includes GPS information and base station information. The base station information identifies the base station to which the user terminal is connected.

[0110] The authentication system 22 executes user authentication in response to the authentication request. However, in this example, as shown in FIG. 26, the authentication system 22 cannot execute authentication processing corresponding to "OnSite". In this case, the authentication system 22 recognizes that "Onsite2" may be used instead of "OnSite" by referring to the substitution list. In this case, the authentication system 22 executes authentication processing corresponding to "OnSite2" in the procedure of executing the logic included in the authentication request. That is, the authentication system 22 determines whether or not the user is located within a predetermined area based on the base station information of the user terminal 13.

[0111] The authentication system 22 generates history information indicating the authentication result, as shown in FIG. 27. Furthermore, the authentication system 22 generates a token by adding a signature to data including the history information. Here, the history information includes "OnSite2=true" and "IDandPassword=true". Then, the authentication system 22 transmits this token to the user terminal 13.

[0112] The user terminal 13 transmits a token to the service providing system 21 to which the user wishes to log in. In the example shown in FIG. 28, the user terminal 13 transmits the token to the service providing system 21A. The service providing system 21A then verifies the token based on logic A describing the authentication policy of the service providing system 21A. At this time, the service providing system 21A verifies the token taking into account the substitution list. Specifically, the following verification is performed.

[0113] Logic A permits login if "OnSite=true" and "IDandPassword=true". In contrast, the history information attached to the token includes "OnSite2=true" and "IDandPassword=true". In other words, the history information does not satisfy Logic A. However, the substitution list indicates "OnSite=OnSite2". Therefore, taking the substitution list into account, the history information satisfies Logic A. In this case, the service providing system 21A permits login from the user terminal 13.

[0114] In this way, according to the variation of the embodiment of the present invention, it is possible to increase the resistance to failure of the authentication device implemented in the authentication system 22 (or the authentication service providing system 23), and therefore it is possible to provide a stable single sign-on service.

[0115] 29 shows an example of a hardware configuration of the authentication system 22. The authentication system 22 is realized by a computer 100 including a processor 101, a memory 102, a storage device 103, an input / output device 104, a recording medium reader 105, and a communication interface .

[0116] The processor 101 controls the operation of the authentication system 22 by executing a communication program stored in the storage device 103. This communication program includes program code describing the procedures of the flowcharts shown in Figures 21 and 23. This communication program also includes an authentication program 53 shown in Figure 13. Therefore, by the processor 101 executing this communication program, the functions of the authentication execution unit 54, logic execution unit 56, calling unit 58, history information generation unit 59, and token issuing unit 60 shown in Figure 13 are provided.

[0117] The memory 102 is used as a working area for the processor 101. The storage device 103 stores the above-mentioned communication program and other programs. The authentication processing database 57 may be constructed using the storage device 103.

[0118] The input / output device 104 includes input devices such as a keyboard, a mouse, a touch panel, and a microphone. The input / output device 104 also includes output devices such as a display device and a speaker. The recording medium reader 105 can acquire data and information recorded in the recording medium 110. The recording medium 110 is a removable recording medium that can be attached to and detached from the computer 100. The recording medium 110 is realized by, for example, a semiconductor memory, a medium that records signals by optical action, or a medium that records signals by magnetic action. The above-mentioned communication program may be provided to the computer 100 from the recording medium 110. The communication interface 106 corresponds to the communication unit 51 shown in FIG. 13 and can be connected to a network. When the above-mentioned communication program is stored in the program server 120, the computer 100 may acquire the communication program from the program server 120.

[0119] The service providing system 21 is realized with a configuration similar to that of the computer 100 shown in Fig. 29. However, in the service providing system 21, the functions of the authentication request unit 43, the logic verification unit 45, and the signature verification unit 46 are provided by the processor executing a software program. The user terminal 13 and the authentication service providing system 23 are also realized with a configuration similar to that of the computer 100 shown in Fig. 29. [Explanation of symbols]

[0120] 13 User terminal 20. Communication Systems 21 (21A~21B) Service provision system 22 Authentication System 23 Authentication service provider system 51 Communications Department 52 Authentication Section 53 Certification Program 54 Authentication execution unit 55 Authentication control section 56 Logic Execution Unit 57 Authentication Processing Database 58 Call Department 59 History information generation unit 60 Token Issuer 100 Computers 101 Processor

Claims

1. When a user terminal accesses a service providing system, an authentication process is performed based on an authentication request including a description of an authentication condition and an authentication method corresponding to the service providing system; generating history information including information indicating whether the authentication condition is satisfied and information indicating a result of the authentication process by the authentication method; The history information is transmitted to the user terminal. A communications program that causes a processor to execute processing.

2. generating identification information that identifies the entity that performed the authentication process; The identification information is transmitted to the user terminal in addition to the history information.

2. The communication program according to claim 1, further causing the processor to execute a process.

3. creating a token by adding a signature representing the identification information to data representing the history information; Transmitting the token to the user terminal 3. The communication program according to claim 2, further causing the processor to execute a process.

4. a statement included in the authentication request indicates that a first authentication method is to be executed when the authentication condition is satisfied, and that a second authentication method is to be executed when the authentication condition is not satisfied; Upon receiving the authentication request, determining whether the authentication condition is satisfied; When the authentication condition is satisfied, performing user authentication using the first authentication method; When the authentication condition is not satisfied, the user authentication is performed by the second authentication method.

2. The communication program according to claim 1, further causing the processor to execute a process.

5. The history information includes information indicating a time when the authentication process was performed using the authentication method.

5. The communication program according to claim 4.

6. obtaining an alternative list from the service providing system indicating that a second authentication method may be performed instead of a first authentication method; determining whether or not the authentication process by the first authentication method is executable when a description included in the authentication request instructs the authentication process by the first authentication method; When the authentication process using the first authentication method can be executed, the authentication process using the first authentication method is executed; when the authentication process using the first authentication method cannot be executed, the processor is further caused to execute a process of executing an authentication process using the second authentication method based on the alternative list; The history information includes information for identifying an executed authentication method out of the first authentication method and the second authentication method, and information representing a result of the executed authentication process.

2. The communication program according to claim 1 .

7. an authentication unit that executes an authentication process based on an authentication request including a description of an authentication condition and an authentication method corresponding to the service providing system when the user terminal accesses the service providing system; a history information generating unit that generates history information including information indicating whether the authentication condition is satisfied and information indicating a result of the authentication process by the authentication method; a communication unit that transmits the history information to the user terminal; An authentication device comprising:

8. When a user terminal accesses a service providing system, a computer executes an authentication process based on an authentication request including a description of an authentication condition and an authentication method corresponding to the service providing system; the computer generates history information including information indicating whether the authentication condition is satisfied and information indicating a result of the authentication process by the authentication method; The computer transmits the history information to the user terminal.

13. An authentication method comprising:

9. A communication method for processing a login request of a user terminal in a communication system including a first service providing system, a second service providing system, and an authentication system, comprising: The user terminal transmits a login request to the first service providing system; the first service providing system generates an authentication request including a description related to an authentication condition and an authentication method in response to the login request; The user terminal transmits authentication information corresponding to the authentication request to the authentication system; The authentication system includes: performing an authentication process on the authentication information according to a description included in the authentication request; generating history information including information indicating whether the authentication condition is satisfied and information indicating a result of the authentication process by the authentication method; generating a token including the historical information and a signature identifying the authentication system; Transmitting the token to the user terminal; The user terminal transmits the token to the first service providing system and the second service providing system; the first service providing system permits login of the user terminal when the history information and the signature included in the token satisfy an authentication policy of the first service providing system; The second service providing system permits login of the user terminal when the history information and the signature included in the token satisfy an authentication policy of the second service providing system. A communication method comprising:

Images