Information processing system, information processing method, and program

Abstract

The present invention solves the problem of newly adapting a service to support of linkage of authentication information which has not been supported while reducing a load on a user. An information processing system (1) includes: an acquisition unit (11) that acquires, from a first server providing a first service, a first linkage request containing first authentication information that the first server uses to authenticate a user; and a linkage unit (12) that generates, on the basis of the first linkage request, unified authentication information to be linked to the first authentication information, and stores the first authentication information and the unified authentication information in a storage device.

Description

[Technical Field]

[0001] The present invention relates to a technology for linking authentication information. [Background technology]

[0002] There are known techniques for linking authentication information. The authentication information is information including, for example, user identification information (e.g., a user name, a user ID, etc.) and personal verification information (e.g., a password, biometric information, etc.).

[0003] For example, in the technology described in Non-Patent Document 1, an authorization server performs an authentication procedure with a user, and if it successfully proves that the user is the owner of the user ID, it issues a signed ID token. The service server verifies the validity of the user ID by verifying the signature included in the ID token, and provides the service to the user. The user uses the user ID registered with the authorization server to use multiple services.

[0004] Furthermore, for example, in the technology described in Patent Document 1, if a user who logs in with an individual login ID on the individual login screen of the service server is a single sign-on (SSO) user, the user is redirected from the service server to an SSO authentication server. The SSO authentication server performs SSO authentication of the user using the SSO login ID linked to the individual login ID. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] "Dev Overview of OpenIDConnect," OneLogin, Inc., [Retrieved February 17, 2022], Internet<URL:https: / / developers.onelogin.com / openid-connect> [Patent documents]

[0006] [Patent Document 1] Japanese Patent Application Publication No. 2007-293760 Summary of the Invention [Problem to be solved by the invention]

[0007] Let us consider a case where a service that previously did not support federation of authentication information now supports it. In such a case, the techniques described in Patent Documents 1 and 2 impose a burden on existing users of such a service, as they will no longer be able to use the authentication information specific to the service that they have been using up until now. In addition, in order to continue using the service, they will have to burden themselves with registering new authentication information in the approval server (SSO authentication server).

[0008] One aspect of the present invention has been made in consideration of the above-mentioned problems, and one of its objectives is to provide technology that enables services that were previously incompatible with the integration of authentication information to become compatible while reducing the burden on users. [Means for solving the problem]

[0009] An information processing system according to one aspect of the present invention includes an acquisition means for acquiring a first integration request from a first server that provides a first service, the first integration request including first authentication information used by the first server to authenticate a user, and an integration means for generating integrated authentication information to be integrated with the first authentication information based on the first integration request, and storing the first authentication information and the integrated authentication information in a storage device.

[0010] An information processing method according to one aspect of the present invention includes obtaining a first integration request from a first server providing a first service, the first integration request including first authentication information used by the first server to authenticate a user; generating integrated authentication information to be integrated with the first authentication information based on the first integration request; and storing the first authentication information and the integrated authentication information in a storage device.

[0011] A program according to one aspect of the present invention is a program for causing a computer to function as an information processing system, and causes the computer to function as: an acquisition means for acquiring a first linkage request from a first server providing a first service, the first linkage request including first authentication information used by the first server to authenticate a user; and an integration means for generating integrated authentication information to be linked to the first authentication information based on the first linkage request, and storing the first authentication information and the integrated authentication information in a storage device. [Effects of the Invention]

[0012] According to one aspect of the present invention, it is possible to newly enable services that were previously incompatible with authentication information linkage while reducing the burden on users. [Brief explanation of the drawings]

[0013] [Figure 1] 1 is a block diagram showing a configuration of an information processing system according to a first exemplary embodiment of the present invention. [Figure 2] 1 is a flowchart showing the flow of an information processing method according to a first exemplary embodiment of the present invention. [Figure 3] FIG. 10 is a block diagram showing the configuration of an information processing system according to a second exemplary embodiment of the present invention. [Figure 4] FIG. 4 is a diagram showing an example of information stored in a user database shown in FIG. 3. [Figure 5] 4 is a diagram showing an example of information stored in another user database shown in FIG. 3. FIG. [Figure 6] FIG. 4 is a diagram illustrating an example of information stored in an integrated database illustrated in FIG. 3. [Figure 7] FIG. 10 is a schematic diagram showing an overview of a cooperation method according to a second exemplary embodiment of the present invention. [Figure 8] 8 is a flowchart showing the flow of a linking process executed by a linking server in the linking method shown in FIG. 7. [Figure 9] FIG. 8 is a sequence diagram showing an example of the cooperation method shown in FIG. 7. [Figure 10]10 is a diagram showing an example of a screen output to a terminal in the example of the cooperation process shown in FIG. 9. FIG. [Figure 11] FIG. 8 is a sequence diagram showing another example of the cooperation method shown in FIG. 7. [Figure 12] 12 is a diagram showing an example of a screen output to a terminal in another example of the linking method shown in FIG. 11. FIG. [Figure 13] FIG. 10 is a schematic diagram illustrating an overview of an authentication method according to a second exemplary embodiment of the present invention. [Figure 14] 14 is a diagram showing an example of a screen output to a terminal in the authentication method shown in FIG. 13. FIG. [Figure 15] 14 is a flowchart showing the flow of authentication processing executed by the authentication server in the authentication method shown in FIG. [Figure 16] FIG. 15 is a diagram showing a modified example of the screen shown in FIG. [Figure 17] FIG. 11 is a diagram showing a modified example of the screen shown in FIG. [Figure 18] FIG. 2 is a diagram illustrating an example of the hardware configuration of each device that configures the information processing system in each exemplary embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0014] Exemplary Embodiment 1 A first exemplary embodiment of the present invention will be described in detail with reference to the drawings. This exemplary embodiment is a basic form of the exemplary embodiments described below.

[0015] <Configuration of Information Processing System 1> The configuration of an information processing system 1 according to this exemplary embodiment will be described with reference to Fig. 1. Fig. 1 is a block diagram showing the configuration of the information processing system 1.

[0016] As shown in FIG. 1, the information processing system 1 includes an acquisition unit 11 and a linking unit 12. The acquisition unit 11 is an example of a configuration that realizes the acquisition means described in the claims. The linking unit 12 is an example of a configuration that realizes the linking means described in the claims. The acquisition unit 11 acquires a first linking request from a first server that provides a first service, the first linking request including first authentication information used by the first server to authenticate a user. Based on the first linking request, the linking unit 12 generates integrated authentication information to be linked to the first authentication information, and stores the first authentication information and the integrated authentication information in a storage device. Details of each of these units will be described in the "Flow of Information Processing Method S1" section below.

[0017] <Flow of information processing method S1> The information processing system 1 configured as above executes an information processing method S1 according to this exemplary embodiment. The flow of the information processing method S1 will be described with reference to Fig. 2. Fig. 2 is a flow diagram showing the flow of the information processing method S1. As shown in Fig. 2, the information processing method S1 includes steps S11 to S12.

[0018] In step S11, the acquisition unit 11 acquires, from a first server that provides a first service, a first cooperation request that includes first authentication information that the first server uses to authenticate a user.

[0019] The first authentication information is authentication information used by a user to use the first service. The first authentication information is, for example, information registered by the user in the first service. The first authentication information includes, for example, user identification information that identifies the user in the first service and identity verification information for identity verification. The identity verification information is, but is not limited to, a password, biometric information, etc.

[0020] The first linking request is, for example, information requesting linking of the first authentication information with the integrated authentication information. Alternatively, the first linking request may be, for example, information requesting linking of the first authentication information with the integrated authentication information so that the first authentication information can be used for other services.

[0021] In step S12, the linking unit 12 generates integrated authentication information to be linked to the first authentication information based on the first linking request, and stores the first authentication information and the integrated authentication information in the storage device.

[0022] Here, the integrated authentication information includes, for example, user identification information for identifying a user and identity verification information for identity verification in the linked service provided by the information processing system 1. Identity verification information is, but is not limited to, a password, biometric information, or the like.

[0023] Here, the storage device may be, for example, a device referenced by an authentication unit that authenticates a user in a linked service provided by the information processing system 1. For example, the authentication unit may authenticate a user using at least one of first authentication information and integrated authentication information stored in the storage device. Specifically, the authentication unit may determine that the authentication of a user has been successful when, for example, input authentication information authenticated by the user is successfully matched with at least one of the first authentication information and the integrated authentication information. Furthermore, such an authentication unit may be included in the information processing system 1 or in an external device.

[0024] <Example of program implementation> When the information processing system 1 is configured by a computer, the following program is stored in a memory referenced by the computer. The program causes the computer to function as the information processing system 1, and causes the computer to function as: an acquisition unit that acquires, from a first server that provides a first service, a first collaboration request including first authentication information used by the first server to authenticate a user; and a collaboration unit that generates, based on the first collaboration request, integrated authentication information to be collaborated with the first authentication information, and stores the first authentication information and the integrated authentication information in a storage device. In this case, the above-described information processing system 1 and information processing method S1 are realized by a processor included in the computer reading and executing the program.

[0025] <Advantages of this exemplary embodiment> As described above, the information processing system 1, information processing method S1, and program according to this exemplary embodiment are configured to obtain a first linkage request from a first server providing a first service, the first server including first authentication information used by the first server to authenticate a user, generate integrated authentication information to be linked to the first authentication information based on the first linkage request, and store the first authentication information and the integrated authentication information in a storage device.

[0026] Therefore, when the first server does not support authentication information federation and the first server is made to support it, integrated authentication information to be federated to the first authentication information is generated based on a federation request from the first server. As a result, the effort required for existing users of the first service to feed authentication information is reduced. In this way, according to this exemplary embodiment, it is possible to obtain the effect of enabling a service that did not support authentication information federation to be newly made compatible with the authentication information federation while reducing the burden on users.

[0027] Exemplary Embodiment 2 A second exemplary embodiment of the present invention will be described in detail with reference to the drawings. Note that components having the same functions as those described in the first exemplary embodiment are given the same reference numerals, and their description will be omitted as appropriate.

[0028] <Outline of Information Processing System 1A> The information processing system 1A according to this exemplary embodiment is a system that provides an integrated service that integrates authentication information. The integrated service includes a federated service and an authentication service. The federated service integrates individual authentication information that the same user has registered individually in multiple services using integrated authentication information. The authentication service authenticates the user using any of the individual authentication information and integrated authentication information. By using the integrated service, the user can use each service using any of the individual authentication information and integrated authentication information.

[0029] In the following, the service for which the user has registered individual authentication information will also be referred to as an individual service. However, when there is no need to particularly distinguish between individual services, integrated services, linked services, and authentication services, they will also be simply referred to as services.

[0030] The details of individual authentication information and integrated authentication information will be described later, but when there is no need to distinguish between them, they will simply be referred to as authentication information. Furthermore, "authentication information" refers to information including user identification information and personal identification information. User identification information is information that identifies a user in each service, such as, but not limited to, information called a user ID. Personal identification information is information used to verify the identity of a user, such as, but not limited to, a password or biometric information.

[0031] <Configuration of Information Processing System 1A> The configuration of an information processing system 1A according to this exemplary embodiment will be described with reference to Fig. 3. Fig. 3 is a block diagram showing the configuration of the information processing system 1A.

[0032] 3, information processing system 1A includes linked server 10, authentication server 20, service servers 30A, 30B, ..., user databases 40A, 40B, ..., integrated database 50, and terminal 90. Hereinafter, when there is no need to particularly distinguish between service servers 30A, 30B, ..., they will also be referred to simply as service server 30. Furthermore, when there is no need to particularly distinguish between user databases 40A, 40B, ..., they will also be referred to simply as user database 40.

[0033] Although Fig. 3 shows two service servers 30 and two user databases 40, the number of each device may be three or more. Also, although Fig. 3 shows one terminal 90, the number of terminals 90 may be multiple.

[0034] The link server 10 is connected to each service server 30 and terminal 90 via a network N1. The authentication server 20 is connected to each service server 30 and terminal 90 via the network N1. The network N1 is configured by, for example, a wireless local area network (LAN), a wired LAN, a wide area network (WAN), a public line network, a mobile data communication network, other networks, or a combination of some or all of these.

[0035] Furthermore, linked server 10 and authentication server 20 are each communicatively connected to integrated database 50. Furthermore, service server 30A is communicatively connected to user database 40A, and service server 30B is communicatively connected to user database 40B.

[0036] It should be noted that information processing system 1A only needs to include at least linked server 10 and authentication server 20, and some or all of the other devices may be located outside information processing system 1A.

[0037] (Linked Server 10) The configuration of link server 10 will be described with reference to Figure 3. Link server 10 is a server that provides the link service described above. Link server 10 includes a control unit 110, a storage unit 120, and a communication unit 130. Control unit 110 controls each unit of link server 10. Storage unit 120 stores various data used by control unit 110. Communication unit 130 transmits and receives data to and from other devices under the control of control unit 110.

[0038] The control unit 110 includes an acquisition unit 111 and a linking unit 112. The acquisition unit 111 is configured substantially similarly to the acquisition unit 11 in the first embodiment, but differs at least in that it acquires linkage requests from multiple service servers 30. The linking unit 112 is configured substantially similarly to the linking unit 12 in the first embodiment, but differs at least in that it links multiple pieces of individual authentication information to integrated authentication information and stores it in the integrated database 50. Details of the acquisition unit 111 and the linking unit 112 will be described later in "Outline of Linking Method S100" and the like.

[0039] (Authentication Server 20) The configuration of authentication server 20 will be described with reference to Fig. 3. Authentication server 20 is a server that provides the above-mentioned authentication service. Authentication server 20 includes a control unit 210, a storage unit 220, and a communication unit 230. Control unit 210 controls each unit of authentication server 20. Storage unit 220 stores various data used by control unit 210. Communication unit 230 transmits and receives data to and from other devices under the control of control unit 210.

[0040] The control unit 210 includes an authentication unit 211. The authentication unit 211 authenticates the user by referring to the integrated database 50. The authentication unit 211 is an example of a configuration that realizes the authentication means described in the claims. Details of the authentication unit 211 will be explained later in "Outline of authentication method S200" and the like.

[0041] (Service Server 30) The configuration of service server 30 will be described with reference to FIG. 3. Service server 30 is an example of the first server or second server set forth in the claims. Service server 30 is a server that provides individual services to users. Specifically, service server 30 transmits and receives information related to the individual services to and from terminals 90 used by users via network N1. The individual services are services that are different from both the linked services provided by link server 10 and the authentication services provided by authentication server 20. For example, specific examples of individual services include, but are not limited to, services that sell goods, services that distribute information, education-related services, and medical-related services.

[0042] Here, service server 30 is a server that did not support the integrated service for a certain period in the past, but currently supports the integrated service. During the period when service server 30 did not support the integrated service, it provided individual services to users who were individually authenticated using individual authentication information. Furthermore, even after service server 30 supports the integrated service, it continues to provide individual services to both users who were individually authenticated using individual authentication information and users who were authenticated by authentication server 20. When performing authentication using individual authentication information, service server 30 refers to user database 40, which will be described later. Furthermore, service server 30 transmits and receives information related to the integrated service between terminal 90, link server 10, and authentication server 20 via network N1. Furthermore, service server 30 stores information related to the individual services and the integrated service in memory as needed.

[0043] In the following, an example will be described in which the service server 30A provides an individual service A, and the service server 30B provides an individual service B that is different from the individual service A. Note that in this exemplary embodiment, the description will be given assuming that each service server 30 provides one service.

[0044] (User database 40) The user database 40 will be described with reference to Fig. 3. The user database 40 is provided in correspondence with the service server 30. The user database 40 stores individual authentication information of users.

[0045] For example, information stored in user database 40 is registered by the corresponding service server 30 and referenced by that service server 30. Here, "registration" refers to storing information in user database 40. It is desirable that user database 40 is accessible from specific devices, including the corresponding service server 30, and not accessible from other devices. For example, in this exemplary embodiment, user database 40A is not accessible from linked server 10, authentication server 20, and service server 30B. Furthermore, user database 40B is not accessible from linked server 10, authentication server 20, and service server 30A.

[0046] (Individual authentication information) The individual authentication information is authentication information used by the service server 30 for authentication. The individual authentication information is an example of the first authentication information or second authentication information described in the claims. The user database 40A stores the individual authentication information of users who use individual service A provided by the service server 30A. The user database 40B stores the individual authentication information of users who use individual service B provided by the service server 30B. Such individual authentication information is registered, for example, during a period when the service server 30 does not support linked services. Hereinafter, the individual authentication information of a user who uses individual service A may be referred to as individual authentication information A. Furthermore, the individual authentication information of a user who uses individual service B may be referred to as individual authentication information B. Furthermore, when there is no need to particularly distinguish between these, they will simply be referred to as individual authentication information.

[0047] An example of information stored in the user database 40 will be described with reference to Figures 4 and 5. Figure 4 is a diagram showing an example of information stored in the user database 40A. Figure 5 is a diagram showing an example of information stored in the user database 40B.

[0048] As shown in FIG. 4, the user database 40A stores information R1 including a user ID and a password. Here, the user ID and password are examples of information constituting individual authentication information A. The user ID uniquely identifies a user in the user database 40A. In other words, the user ID uniquely identifies a user who uses individual service A. The password is an example of personal identification information used in combination with the user ID. In this example, information R1 includes the user ID "A@mail" and the password "P@ss".

[0049] As shown in FIG. 5, the user database 40B stores information R2 including a user ID and a password. As described above, the user ID and password are examples of information that constitute individual authentication information B. The user ID uniquely identifies a user in the user database 40B. In other words, the user ID uniquely identifies a user who uses individual service B. The password is as described above. In this example, information R2 includes the user ID "officeID" and the password "p@ssword".

[0050] 4 and 5, the passwords are shown in plain text, but the personal identification information stored in the user database 40 is not necessarily limited to being stored in plain text. For example, the user database 40 may store passwords hashed according to a conversion method adopted by the corresponding service server 30.

[0051] 4 and 5 show an example in which user databases 40A and 40B have the same data structure, but the data structures of user databases 40A and 40B do not have to be the same. Also, an example in which individual authentication information A and B contain the same type of personal identification information, but the types of personal identification information contained in individual authentication information A and B do not have to be the same.

[0052] (Integrated Database 50) The configuration of the integrated database 50 will be described with reference to Fig. 3. The integrated database 50 stores individual authentication information and integrated authentication information. The integrated database 50 is an example of a configuration that realizes the storage device recited in the claims.

[0053] For example, the information stored in the integrated database 50 is registered by the linkage server 10 and referenced by the authentication server 20. Here, "registration" refers to storing information in the integrated database 50. It is desirable that the integrated database 50 be accessible from specific devices including the linkage server 10 and the authentication server 20, and not be accessible from other devices. For example, in this exemplary embodiment, the integrated database 50 is not accessible from the service server 30.

[0054] An example of information stored in the integrated database 50 will be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of information stored in the integrated database 50. As shown in Fig. 6, the integrated database 50 is capable of storing information R including a UUID (Universally Unique Identifier), service identification information, a user ID, and a password. Here, the user ID and password are examples of information constituting authentication information.

[0055] The UUID is identification information that uniquely identifies the user targeted by the information processing system 1A. The service identification information is identification information that identifies the service. Here, the services identified by the service identification information include individual services provided by the service server 30 and integrated services provided by the information processing system 1A. The user ID is information that identifies the user for each service. The password is as described above.

[0056] 6, in the integrated database 50, information R3, R4, and R5, which have the same UUID "UUID001," are associated with one another. In other words, the individual authentication information A included in information R3 and the integrated authentication information included in information R4 are associated and registered. Furthermore, the individual authentication information B included in information R5 and the integrated authentication information included in information R4 are associated and registered.

[0057] Hereinafter, registering individual authentication information in the integrated database 50 in association with the UUID associated with the integrated authentication information will also be described as "registering the integrated authentication information and the individual authentication information in association with each other in the integrated database 50." Furthermore, "registering the integrated authentication information and the individual authentication information in association with each other in the integrated database 50" is an example of "linking" as described in the claims.

[0058] (Individual authentication information and integrated authentication information) Information R3 shown in FIG. 6 includes, as service identification information, "A" indicating individual service A. Hereinafter, this service identification information will also be referred to as service identification information A. The authentication information (ID, password) included in such information R3 corresponds to the individual authentication information included in information R1 shown in FIG. 4. Furthermore, information R5 includes, as service identification information, "B" indicating individual service B. Hereinafter, this service identification information will also be referred to as service identification information B. The authentication information (ID, password) included in such information R5 corresponds to the individual authentication information included in information R2 shown in FIG. 5. In other words, information R3 and R5 include individual authentication information.

[0059] Information R4 shown in FIG. 6 includes "U" indicating an integrated service as service identification information. Hereinafter, this service identification information will also be referred to as service identification information U. The authentication information (ID, password) included in such information R4 represents integrated authentication information. In other words, information R4 includes integrated authentication information. Details of the integrated authentication information will be described later.

[0060] 6, the password is shown in plain text, but the personal identification information stored in the integrated database 50 is not necessarily limited to being stored in plain text. For example, the integrated database 50 may store a password hashed according to a conversion method adopted by the authentication server 20. However, for example, the conversion method for passwords stored in the user database 40 and the conversion method for passwords stored in the integrated database 50 may be the same, but they do not have to be the same.

[0061] (Terminal 90) The configuration of the terminal 90 will be described with reference to FIG. 3. The terminal 90 is a computer used by a user. The terminal 90 may be, for example, but is not limited to, a smartphone, a tablet, a personal computer, or a wearable device. The terminal 90 includes or is connected to a display device (not shown). The terminal 90 includes or is connected to an input device (not shown). The terminal 90 is communicatively connected to each of the link server 10, the authentication server 20, and the service server 30 via the network N1. The terminal 90 transmits information input by the user via the input device via the network N1. The terminal 90 displays information received via the network N1 on the display device. The terminal 90 stores information transmitted and received via the network N1 in a memory as needed.

[0062] <Flow of the collaboration method S100 and the authentication method S200 executed by the information processing system 1A> The information processing system 1A configured as described above executes a linking method S100 and an authentication method S200 according to this exemplary embodiment. The linking method S100 and the authentication method S200 are examples of the information processing method described in the claims.

[0063] (Overview of collaboration method S100) An overview of the linking method S100 will be described with reference to FIG. 7. FIG. 7 is a schematic diagram illustrating an overview of the linking method S100. As shown in FIG. 7, the linking method S100 includes steps M1 to M10. It is assumed here that the user of the terminal 90 does not yet possess integrated authentication information before the linking method S100 is executed. It is also assumed that the user uses individual service A using the individual authentication information of individual service A and individual service B using the individual authentication information of individual service B before the linking method S100 is executed. In the following example, the service server 30A is an example of a configuration that realizes the first server recited in the claims, and the service server 30B is an example of a configuration that realizes the second server.

[0064] (Step M1) In step M1, the terminal 90 transmits information agreeing to the linking of the individual authentication information A to the service server 30A in accordance with an operation by a user who uses the individual service A.

[0065] (Step M2) In step M2, service server 30A transmits cooperation request A including individual authentication information A for individual service A of the user to cooperation server 10. In other words, acquisition unit 111 of cooperation server 10 receives cooperation request A (first cooperation request) including individual authentication information A (first authentication information) used by service server 30A to authenticate the user from service server 30A that provides individual service A.

[0066] (Step M3) In step M3, link unit 112 of link server 10 inquires of terminal 90 whether or not it possesses integrated authentication information, and if it does not, transmits a registration screen. Terminal 90 transmits a registration execution request including information input on the registration screen by the user's operation to link server 10.

[0067] (Step M4) In step M4, based on the link request A, the linking unit 112 of the link server 10 generates integrated authentication information to be linked to the individual authentication information A, and registers the individual authentication information A and the integrated authentication information in the integrated database 50. Specifically, the linking unit 112 generates a new UUID. The linking unit 112 also generates the integrated authentication information by referencing the information input by the user. The linking unit 112 also associates the UUID with the integrated authentication information and registers them in the integrated database 50. The linking unit 112 also associates the UUID with the individual authentication information A received in step M2 and registers them in the integrated database 50. As a result, the integrated authentication information and the individual authentication information A are linked.

[0068] (Step M5) In step M5, the linking unit 112 associates the session ID-U (linked information) indicating that the individual authentication information A and the integrated authentication information have been linked with each other, with the integrated authentication information, and stores the associated session ID-U in the storage unit 120. In this example, the linking unit 112 associates the session ID-U with a UUID for identifying the integrated authentication information, and stores the associated session ID-U in the storage unit 120.

[0069] Furthermore, the linking unit 112 transmits the linking result to the terminal 90. The linking result includes the integrated authentication information and the session ID-U. The terminal 90 presents the integrated authentication information to the user and stores the session ID-U in the memory of the terminal 90. The session ID-U is used in step M6 and thereafter.

[0070] Thereafter, the user can use individual service A using either the integrated authentication information or the individual authentication information A through the authentication service described below.

[0071] (Step M6) In step M6, the terminal 90 transmits information agreeing to the linking of the individual authentication information B to the service server 30B in accordance with the operation of the user who uses the individual service B.

[0072] (Step M7) In step M7, service server 30B transmits cooperation request B including individual authentication information B for individual service B of the user to cooperation server 10. In other words, acquisition unit 111 of cooperation server 10 receives cooperation request B (second cooperation request) including individual authentication information B (second authentication information) used by service server 30B to authenticate the user from service server 30B that provides individual service B.

[0073] (Step M8) In step M8, link unit 112 of link server 10 inquires of terminal 90 whether or not it possesses integrated authentication information. If terminal 90 possesses integrated authentication information, it transmits a link execution request including session ID-U to link server 10.

[0074] (Step M9) In step M9, based on the linkage request B, the linkage unit 112 of the linkage server 10 links the individual authentication information B to the integrated authentication information, and registers the individual authentication information B in the integrated database 50. In this case, since the linkage request B includes the session ID-U (linked information), the linkage unit 112 links the integrated authentication information associated with the session ID-U to the individual authentication information B.

[0075] Specifically, the linking unit 112 refers to the storage unit 120 and identifies the UUID associated with the received session ID-U. The linking unit 112 also associates the UUID with the individual authentication information B received in step M7 and registers them in the integrated database 50. As a result, the integrated authentication information and the individual authentication information B are linked.

[0076] (Step M10) In step M10, the linking unit 112 transmits the linking result to the terminal 90. For example, the linking unit 112 may generate a new session ID-U and include it in the linking result. In this case, the new session ID-U can be used when linking individual authentication information used in an individual service other than individual service A and individual service B.

[0077] Thereafter, the user can use individual service A and individual service B using any of the integrated authentication information, individual authentication information A, and individual authentication information B, by using the authentication service described below.

[0078] In the description of steps M1 to M9, individual authentication information A is an example of the first authentication information set forth in the claims, and federation request A is an example of the first federation request set forth in the claims. Individual authentication information B is an example of the second authentication information set forth in the claims, and federation request B is an example of the second federation request set forth in the claims. The first authentication information and the first federation request refer to the individual authentication information of a user who does not yet possess integrated authentication information and information requesting its federation. The second authentication information and the second federation request refer to the individual authentication information of a user who already possesses integrated authentication information and information requesting its federation.

[0079] (Flow of collaboration process S10) Next, the flow of the linking process S10 executed by the linking server 10 in the linking method S100 will be described with reference to Fig. 8. Fig. 8 is a flow diagram showing the flow of the linking process S10. As shown in Fig. 8, the linking process S10 includes steps S101 to S105.

[0080] (Step S101) In step S101, acquisition unit 111 of link server 10 receives a link request from service server 30. The link request includes individual authentication information used by service server 30 to authenticate a user. Step S101 corresponds to step M2 or M7 of link method S100 described with reference to Fig. 7. Details of step S101 are as described in steps M2 and M7.

[0081] (Step S102) In step S102, the linking unit 112 determines whether the user possesses integrated authentication information based on the information acquired from the terminal 90. Step S102 corresponds to step M3 or M8 of the linking method S100 described with reference to Fig. 7. Details of step S102 are as described in steps M3 and M8.

[0082] (Step S103) If the determination in step S102 is No, in step S103, the linking unit 112 generates, based on the linking request received in step S101, integrated authentication information to be linked to the individual authentication information included in the linking request. Step S103 corresponds to part of step M4 of the linking method S100 described with reference to Fig. 7. Details of step S103 are as described in step M4.

[0083] (Step S104) If the determination in step S102 is Yes, in step S104, the linking unit 112 identifies, based on the linking request received in step S101, the integrated authentication information to be linked to the individual authentication information included in the linking request. Step S104 corresponds to a part of step M9 of the linking method S100 described with reference to Fig. 7. Details of step S104 are as described in step M9.

[0084] (Step S105) In step S105, the linking unit 112 associates the integrated authentication information generated in step S103 or the integrated authentication information identified in step S104 with the individual authentication information, and registers them in the integrated database 50. This links the authentication information included in the linking request with the integrated authentication information. Step S105 corresponds to part of step M4 and M5, or part of step M9 and M10, of the linking method S100 described with reference to FIG. 7. Details of step S105 are as described in steps M4, M5, M9, and M10.

[0085] (Specific example of collaboration method S100) Next, a specific example of the linking method S100 will be described with reference to Figs. 9 and 10. Fig. 9 is a sequence diagram showing a specific example of the linking method S100, and shows an example of the flow of linking individual authentication information A and integrated authentication information. Fig. 10 is a diagram showing an example of a screen output to terminal 90 in the example shown in Fig. 9. It is assumed that, before the specific example of the linking method S100 shown in Fig. 9 is executed, none of the information R3 to R5 is registered in integrated database 50, as shown in the upper part of Fig. 6.

[0086] (Step A1) Step A1 in FIG. 9 is a step in which the terminal 90 transmits a login request from a user to the service server 30A. In step A1, the display device of the terminal 90 outputs the screen G1 shown in FIG. 10. The screen G1 includes UI objects G11, G12, and G13. The UI object G11 accepts input of a user ID. The UI object G12 accepts input of a password. The UI object G13 accepts a login operation. The user inputs the user ID and password into the UI objects G11 and G12 and performs an operation (login operation) on the UI object G13. The user ID and password input into the UI objects G11 and G12 are authentication information (here, a set of user ID=A@mail and password=P@ss) that the user recognizes as individual authentication information A. As a result, the terminal 90 transmits a login request including the authentication information to the service server 30A.

[0087] (Step A2) 9, service server 30A compares the authentication information received from terminal 90 with individual authentication information A stored in user database 40A. If the comparison is successful, service server 30A determines that login has been successful.

[0088] After successful login, the service server 30A generates a random session ID-A and temporarily stores it in memory in association with the successfully matched individual authentication information A. Even if the password included in the individual authentication information A is hashed in the user database 40A, it is desirable that the temporarily stored individual authentication information A remain in plain text as received from the terminal 90. The service server 30A deletes the temporarily stored pair of individual authentication information A and session ID-A after a predetermined validity period has elapsed. The predetermined validity period may be, for example, one hour, but is not limited to this.

[0089] (Step A3) In step A3, service server 30A responds to the login request by transmitting to terminal 90 a link inquiry screen, session ID-A, and information for redirecting to link server 10. As a result, terminal 90 is redirected to link server 10.

[0090] In this step, screen G2 shown in Fig. 10 is output to the display device of terminal 90. Screen G2 includes text G21 inquiring about consent to the linkage, a UI object G22 that accepts an operation to consent, and a UI object G23 that accepts an operation to not consent. Here, text G21 includes, as an example, the content, "Do you want to link so that you can use other services using the authentication information for individual service A (individual authentication information A)?"

[0091] (Step A4) In step A4, if the user performs an operation (non-consent operation) on UI object G23, the subsequent steps are not executed. In this case, the user continues to use individual service A using individual authentication information A.

[0092] On the other hand, when the user performs an operation (a consent operation) on UI object G22, terminal 90 transmits a collaboration start request to service server 30A. The collaboration start request includes session ID-A. In this case, the processing from step A5 onwards is executed. In other words, collaboration unit 112 of collaboration server 10 functions when the user inputs information consenting to collaboration. Step A4 corresponds to step M1 of collaboration method S100 described with reference to FIG. 7.

[0093] (Step A5) In step A5, service server 30A transmits cooperation request A to cooperation server 10. Cooperation request A includes individual authentication information A and service identification information A. Individual authentication information A is information that is temporarily stored in association with session ID-A received from terminal 90 in step A4. Service identification information A is information that identifies individual service A. Step A5 corresponds to step M2 of cooperation method S100 described with reference to FIG. 7.

[0094] (Step A6) In step A6, acquisition unit 111 of cooperation server 10 generates a random linked transaction ID (hereinafter also referred to as a linked TID). Acquisition unit 111 also associates the linked TID with service identification information A and individual authentication information A included in cooperation request A, and temporarily stores the associated TID in storage unit 120.

[0095] (Step A7) In step A7, acquisition unit 111 of link server 10 transmits the linked TID to service server 30A.

[0096] (Step A8) In step A8, service server 30A transmits the linked TID and information for redirecting to link server 10 to terminal 90. As a result, terminal 90 redirects to link server 10.

[0097] (Step A9) In step A9, link unit 112 of link server 10 transmits a possession inquiry screen to terminal 90. In step A9, screen G3 shown in FIG. 10 is output to the display device of terminal 90. Screen G3 includes text G31 inquiring about possession of integrated authentication information, a UI object G32 that accepts operations when the user possesses the integrated authentication information, and a UI object G33 that accepts operations when the user does not possess the integrated authentication information. Here, text G31 includes, as an example, the content, "Do you have integrated authentication information?"

[0098] (Step A10) In step A10, it is assumed that the user performs an operation (an operation not possessed) on UI object G33. The case where the user performs an operation (an operation possessed) on UI object G32 will be described later in "Another specific example of linking method S100." In this case, terminal 90 transmits a registration start request to linking server 10. The registration start request includes the linked TID.

[0099] (Step A11) In step A11, linking unit 112 of linking server 10 generates a random registration transaction ID (hereinafter referred to as registration TID), associates the registration TID with the linked TID, and temporarily stores them in storage unit 120.

[0100] (Step A12) In step A12, link unit 112 of link server 10 transmits the registration TID and a registration screen to terminal 90. In step A12, screen G4 shown in Fig. 10 is output to the display device of terminal 90. Screen G4 includes text G41 indicating that new integrated authentication information will be registered, a UI object G42 that accepts input of a user ID, a UI object G43 that accepts input of a password, a UI object G44 that accepts a registration operation, and a UI object G45 that accepts a back operation.

[0101] (Step A13) In step A13, the user inputs a user ID and password into UI objects G42 and G43, and performs an operation (registration operation) on UI object G44. The user ID and password input into UI objects G42 and G43 are the authentication information that the user wants to register as integrated authentication information (here, the set of user ID=A@mail and password=password).

[0102] As a result, terminal 90 transmits a registration execution request to link server 10. The registration execution request includes the authentication information and registration TID entered by the user. Step A13 corresponds to step M3 of link method S100 described with reference to FIG. 7.

[0103] In step A13, if the user performs an operation (back operation) on UI object G45, the subsequent steps are not executed. In this case, the user continues to use individual service A using individual authentication information A.

[0104] (Step A14) In step A14, linking unit 112 of linking server 10 generates a UUID that identifies the user in the integrated service. Linking unit 112 also generates integrated authentication information by referencing the authentication information included in the registration execution request. The authentication information included in the registration execution request is the authentication information that the user wants to register.

[0105] The linking unit 112 also registers the service identification information A and the individual authentication information A in the integrated database 50, associating them with the UUID. As a result, information R3 is stored in the integrated database 50, as shown in the middle part of FIG. 6. The linking unit 112 also registers the service identification information U that identifies the integrated service and the integrated authentication information in the integrated database 50, associating them with the UUID. As a result, information R4 is stored in the integrated database 50, as shown in the middle part of FIG. 6. Step A14 corresponds to step M4 of the linking method S100 described with reference to FIG. 7. Note that the linking unit 112 may, for example, hash the passwords included in the individual authentication information A and the integrated authentication information using a predetermined conversion method and register the hashed passwords in the integrated database 50.

[0106] In step A14, the linking unit 112 identifies the service identification information A and the individual authentication information A to be registered in the integrated database 50 by tracing the registration TID and the linked TID. Specifically, the linking unit 112 references the registration TID included in the registration execution request received in step A13, and acquires the linked TID associated with the registration TID. The linking unit 112 also targets the service identification information A and the individual authentication information A associated with the acquired linked TID for registration. After registering the service identification information A and the individual authentication information A in the integrated database 50, the linking unit 112 may discard the registration TID and the linked TID.

[0107] (Step A15) In step A15, the linking unit 112 generates a random session ID-U, associates it with the UUID generated in step A14, and stores it in the storage unit 120. Note that the linking unit 112 may delete the session ID-U from the storage unit 120 after a predetermined storage period has elapsed. The linking unit 112 also transmits the linking result including the session ID-U to the terminal 90. Step A15 corresponds to step M5 of the linking method S100 described with reference to FIG. 7.

[0108] The terminal 90 stores the session ID-U for a predetermined period of time. Details of the session ID-U will be explained later in "Another specific example of the linking method S100."

[0109] This completes one example of the linking process between individual authentication information A and integrated authentication information. Following step A15, for example, link server 10 may transmit information to terminal 90 for redirection to service server 30A. The redirect destination may be a menu screen of individual service A provided by service server 30A.

[0110] (Other specific examples of collaboration methods) Next, another specific example of the linking method S100 will be described with reference to Figs. 11 and 12. Fig. 11 is a sequence diagram showing another specific example of the linking method S100, and shows an example of the flow of linking individual authentication information B with integrated authentication information. Fig. 12 is a diagram showing an example of a screen output to terminal 90 in the example shown in Fig. 11. It is assumed that before the execution of this other specific example of the linking method S100 shown in Fig. 11, information R3 and R4 are registered in integrated database 50, but information R5 is not registered, as shown in the middle part of Fig. 6.

[0111] (Steps B1 to B9) In FIG. 11, the flow from steps B1 to B9 can be explained in the same manner as in the explanation of the flow from steps A1 to A9 explained with reference to FIG. 9, by replacing A with B in the reference symbols.

[0112] Also, in step B1, screen G5 shown in Fig. 12 is output on the display device of terminal 90. Screen G5 will be described in substantially the same manner as screen G1 shown in Fig. 10. However, here, the user ID and password entered into UI objects G11 and G12 are authentication information that the user recognizes as individual authentication information B (here, a set of user ID=officeID and password=p@ssword).

[0113] 12 is output to the display device of the terminal 90. Screen G6 will be explained in the same manner as screen G2 shown in FIG.

[0114] 12 is output to the display device of the terminal 90. Screen G7 will be explained in the same manner as screen G3 shown in FIG.

[0115] 10 and 12 show examples in which screens G1 and G5, screens G2 and G6, and screens G3 and G7 are configured similarly to one another, but this does not mean that they are necessarily identical.

[0116] (Step B10) In step B10, it is assumed that the user performs an operation (a possessed operation) on UI object G32. In this case, terminal 90 transmits a collaboration execution request to collaboration server 10. The collaboration execution request includes a linked TID and a session ID-U. Session ID-U is information that terminal 90 stored in memory in step A15.

[0117] Note that, when the user performs an operation (an operation that the user does not have) on the UI object G33, the operation is as explained in "Specific example of the linking method S100."

[0118] (Step B11) In step B11, collaboration unit 112 of collaboration server 10 identifies a UUID based on the collaboration execution request. Collaboration unit 112 also registers service identification information B and individual authentication information B in integrated database 50, in association with the UUID. As a result, information R5 is stored in integrated database 50, as shown in the lower part of FIG. 6. Step B11 corresponds to step M9 of collaboration method S100 described with reference to FIG. 7. Note that collaboration unit 112 may, for example, hash the password included in individual authentication information B using a predetermined conversion method and register the hashed password in integrated database 50.

[0119] In step B11, the collaboration unit 112 refers to the session ID-U included in the collaboration execution request and identifies the UUID associated with the session ID-U. The collaboration unit 112 also refers to the linked TID included in the collaboration execution request and sets the service identification information B and individual authentication information B associated with the linked TID as the registration targets. After registering the service identification information B and the individual authentication information B in the integrated database 50, the collaboration unit 112 may discard the linked TID.

[0120] (Step B12) In step B12, the linking unit 112 transmits a linking result to the terminal 90. The linking result may include information indicating that the linking has been completed. The linking result may also include a new session ID-U. In this case, the new session ID-U can be used when linking individual authentication information for a service different from individual service A and individual service B.

[0121] In this case, the linking unit 112 deletes the session ID-U stored in the storage unit 120 and generates a new session ID-U. The linking unit 112 also associates the new session ID-U with the UUID identified in step B11 and stores the new session ID-U in the storage unit 120. Note that the linking unit 112 may delete the new session ID-U from the storage unit 120 after a predetermined storage period has elapsed.

[0122] This completes one example of the process of linking the individual authentication information B and the integrated authentication information. Following step B12, terminal 90 may be redirected to service server 30B, as described in step A15.

[0123] (Overview of authentication method S200) An overview of authentication method S200 will be described with reference to Figs. 13 and 14. Fig. 13 is a schematic diagram illustrating an overview of authentication method S200. Fig. 14 is a diagram showing an example of a screen output to terminal 90 in authentication method S200. As shown in Fig. 13, authentication method S200 includes steps M21 to M27. It is assumed here that linking method S100 has been executed before execution of authentication method S200. In other words, an example will be described in which the user of terminal 90 already possesses integrated authentication information, and linking of individual authentication information A and integrated authentication information, and linking of individual authentication information B and integrated authentication information have been completed.

[0124] (Step M21) In step M21, the terminal 90 transmits a login request to the authentication server 20 in accordance with an operation by the user. The login request includes authentication information entered to use the individual service A or the individual service B. As a result, the authentication unit 211 of the authentication server 20 acquires the authentication information entered by the user to use the individual service A or the individual service B.

[0125] In step M21, the display device of the terminal 90 displays a screen G8 shown in FIG. 14. The screen G8 is generated by the authentication server 20 (integrated service). The screen G8 includes UI objects G81, G82, G83, and G84. The UI object G81 accepts an operation to select an individual service (in this example, either individual service A or individual service B). The UI object G82 accepts input of a user ID. The UI object G83 accepts input of a password. The UI object G84 accepts a login operation. The user operates the UI object G81 to select the individual service they wish to use. The user also inputs a user ID and password into the UI objects G82 and G83, and performs an operation (login operation) on the UI object G84. As a result, the terminal 90 transmits a login request to the authentication server 20, including the input information accepted by the UI objects G81, G82, and G83. The input information includes the service identification information of the selected individual service and the input authentication information.

[0126] Screen G8 may be displayed on terminal 90 by the user operating terminal 90 to directly connect to authentication server 20. Screen G8 may also be displayed on terminal 90 by the user operating terminal 90 to connect to service server 30 and being redirected from service server 30 to authentication server 20.

[0127] (Step M22) In step M22, the authentication unit 211 of the authentication server 20 compares the input authentication information with at least one of the integrated authentication information, individual authentication information A (first authentication information), and individual authentication information B (second authentication information) stored in the integrated database 50. Furthermore, the authentication unit 211 determines that the authentication of the user has been successful if the comparison with at least one of them is successful.

[0128] For example, the authentication unit 211 performs the check by determining whether or not information including the service identification information, user ID, and password included in the login request is stored in the integrated database 50. If the information is stored, the authentication unit 211 determines that the authentication was successful. If the information is not stored, the authentication unit 211 determines that the authentication was not successful.

[0129] 14, assume that the user selects "individual service A" and enters "officeID" and "p@ssword" corresponding to individual authentication information B. In this case, the authentication unit 211 determines that the authentication of the user identified by UUID001 has been successful because information R5 including service identification information A, "officeID," and "p@ssword" included in the input information is stored in the integrated database 50.

[0130] (Step M23) In step M23, if the authentication of the user is successful, the authentication unit 211 of the authentication server 20 generates authentication success information that enables the use of individual service A or individual service B. The authentication unit 211 also transmits the generated authentication success information to the terminal 90. Here, the authentication success information includes the UUID of the user who has been successfully authenticated. The authentication success information also has an expiration date. The authentication success information is information whose validity can be verified by the service server 30. For example, the authentication success information may be a token signed by the authentication server 20. However, the authentication success information is not limited to this and may be generated using any known technology whose validity can be verified.

[0131] (Step M24) In step M24, the terminal 90 connects to the service server 30A based on the user's operation and transmits a service request to the service server 30A. The service request includes the authentication success information received from the authentication server 20. Note that step M24 is executed within the validity period of the authentication success information.

[0132] (Step M25) In step M25, the service server 30A verifies the authentication success information included in the service request, and if it confirms the validity, provides the individual service A to the user via the terminal 90.

[0133] (Step M26) In step S26, the terminal 90 connects to the service server 30B based on the user's operation and transmits a service request to the service server 30B. The service request includes the authentication success information received from the authentication server 20. Note that the time when step M26 is executed is within the validity period of the authentication success information.

[0134] (Step M27) In step M27, the service server 30B verifies the authentication success information included in the service request, and if it confirms the validity, provides the individual service B to the user via the terminal 90.

[0135] In steps M25 and M27, service server 30 identifies the user ID of the individual service corresponding to the UUID included in the authentication success information and provides the individual service using the identified user ID. At this time, service server 30 may obtain the user ID of the individual service corresponding to the UUID included in the authentication success information by inquiring of linkage server 10. Service server 30 may also associate the UUID with the user ID of the individual service for which linkage has been completed and store the UUID in user database 40. In this case, service server 30 can obtain the user ID of the individual service corresponding to the UUID included in the authentication success information by referring to user database 40.

[0136] (Authentication process S20 flow) Next, the flow of the authentication process S20 executed by the authentication server 20 in the authentication method S200 will be described with reference to Fig. 15. Fig. 15 is a flow diagram illustrating the flow of the authentication process S20. As shown in Fig. 15, the authentication process S20 includes steps S201 to S203.

[0137] (Step S201) In step S201, the authentication unit 211 of the authentication server 20 acquires authentication information input by the user to use individual service A or individual service B. Step S201 corresponds to step M21 of the authentication method S200 described with reference to Fig. 13. Details of step S201 are as described in step M21.

[0138] (Step S202) In step S202, the authentication unit 211 determines whether the input authentication information is successfully matched with at least one of the integrated authentication information, individual authentication information A (first authentication information), and individual authentication information B (second authentication information) stored in the integrated database 50. Step S202 corresponds to step M22 of the authentication method S200 described with reference to FIG. 13. Details of step S202 are as described in step M22. If the determination in step S202 is No, the authentication process S20 ends.

[0139] (Step S203) If the determination in step S202 is Yes, step S203 is executed. In step S203, if the authentication unit 211 has successfully authenticated the user, it generates authentication success information that allows the use of individual service A or individual service B. Furthermore, the authentication unit 211 transmits the generated authentication success information to the terminal 90. Step S203 corresponds to step M23 of the authentication method S200 described with reference to Fig. 13. Details of step S203 are as described in step M23.

[0140] This enables the terminal 90 to send a service request to the service server 30 using the authentication success information received from the authentication server 20.

[0141] <Advantages of this exemplary embodiment> As described above, this exemplary embodiment acquires, from service server 30A providing individual service A, federation request A including individual authentication information A used by service server 30A to authenticate a user, and further acquires, from service server 30B providing individual service B different from individual service A, federation request B including individual authentication information B used by service server 30B to authenticate a user. Furthermore, this exemplary embodiment generates integrated authentication information to be linked with the individual authentication information A based on the federation request A, and stores the individual authentication information A and the integrated authentication information in the integrated database 50, and, based on the federation request B, associates the individual authentication information B with the integrated authentication information and stores the individual authentication information B in the integrated database 50.

[0142] Therefore, based on a linkage request from service server 30 providing each individual service to link server 10, information in which the individual authentication information is linked with the integrated authentication information is registered in integrated database 50. As a result, existing users who have used multiple individual services can reduce the effort required to link the individual authentication information registered with each individual service. In this way, according to this exemplary embodiment, it is possible to reduce the burden on existing users who have used multiple individual services that do not support authentication information linkage, while making each individual service compatible with the new linked service.

[0143] In addition, in this exemplary embodiment, linked information (session ID-U) indicating that the individual authentication information and the integrated authentication information have been linked is stored in association with the integrated authentication information, and when the linked information is included in the linking request B, the integrated authentication information associated with the linked information is linked to the individual authentication information B.

[0144] Therefore, it is possible to identify the integrated authentication information of a user who already has integrated authentication information by using the federated information without performing a new authentication process. As a result, when a user wants to federate individual authentication information with integrated authentication information that the user already has, the user can do so without going through a new authentication process.

[0145] Furthermore, this exemplary embodiment determines that user authentication has been successful when authentication information entered by the user to use individual service A or individual service B is successfully matched with at least one of integrated authentication information, individual authentication information A, and individual authentication information B stored in integrated database 50. Furthermore, this exemplary embodiment generates authentication success information that allows the user to use individual service A or individual service B when user authentication is successful.

[0146] Therefore, when using individual service A or individual service B, the user may use the individual authentication information A and individual authentication information B that they are familiar with, or may use the integrated authentication information. As a result, the user does not need to remember different individual authentication information for each individual service, and can continue to use the individual authentication information A or individual authentication information B that they are familiar with. As a result, the burden on the user is significantly reduced.

[0147] Furthermore, the linking unit 112 in this exemplary embodiment functions when the user inputs information agreeing to the linking.

[0148] Therefore, if the user does not consent to the linkage, the user can continue to use the service using the individual authentication information registered for the individual service.

[0149] Furthermore, this exemplary embodiment generates integrated authentication information by referring to information input by the user.

[0150] Therefore, the user can register the information he or she has input as the integrated authentication information to be used for linkage.

[0151] [Variation 1] This exemplary embodiment can be modified so that authentication processing can be performed in the authentication server 20 even if an individual service is not selected. In this case, an example of a screen displayed on the display device of the terminal 90 will be described with reference to FIG. 16. FIG. 16 is a diagram showing an example of a screen displayed on the terminal 90 in this modification. In this modification, in step M21, a screen G9 shown in FIG. 16 is displayed instead of the screen G8 shown in FIG. 14. Like the screen G8, the screen G9 includes UI objects G82 and G83 that accept input of a user ID and password. However, the screen G9 does not include a UI object G81 that accepts selection of an individual service. Furthermore, the screen G9 includes a UI object G91 that accepts an authentication operation instead of the UI object G83 that accepts a login operation. In this case, an authentication request including the input authentication information is transmitted from the terminal 90 instead of a login request.

[0152] For example, it is assumed that each piece of information can be identified by a combination of a user ID and a password in the integrated database 50. In this case, the authentication unit 211 performs matching by determining whether or not information including the authentication information (a combination of a user ID and a password) included in the authentication request is stored in the integrated database 50. If the information is stored, the authentication unit 211 determines that the authentication was successful. If the information is not stored, the authentication unit 211 determines that the authentication was not successful.

[0153] In this case, this modified example makes it possible to authenticate a user in a situation where the user does not use an individual service.

[0154] Furthermore, for example, the authentication unit 211 may perform a matching process using authentication information included in the authentication request and predetermined service identification information. The predetermined service identification information may be set in advance, or may be dynamically determined depending on the user's usage status of individual services, for example. In this case, if information including the predetermined service identification information and the authentication information included in the authentication request is stored in the integrated database 50, the authentication unit 211 determines that the authentication has been successful. If the information is not stored, the authentication unit 211 determines that the authentication has not been successful.

[0155] In this case, this modification makes it possible to authenticate the user while reducing the effort required for the user to select an individual service.

[0156] [Variation 2] This exemplary embodiment can be modified so that the linking unit 112 of the linking server 10 registers the user's attribute information in the integrated database 50 in association with the integrated authentication information.

[0157] For example, the linking unit 112 may acquire attribute information input by the user in addition to the input authentication information that the user wishes to register as integrated authentication information. In this case, an example of a screen displayed on the terminal 90 will be described with reference to FIG. 17. FIG. 17 is a diagram showing an example of a screen displayed on the terminal 90 in this modification. As shown in FIG. 17, in this modification, the display device of the terminal 90 displays a screen G10 shown in FIG. 17 instead of the screen G4 shown in FIG. 10. The screen G10 includes UI objects G41 to G45 similar to those on the screen G4, as well as a UI object group G101. The UI object group G101 accepts input of user attributes such as name, postal code, address, telephone number, etc.

[0158] The linking unit 112 generates a UUID and integrated authentication information based on the authentication information entered on screen G10. The linking unit 112 also associates the integrated authentication information and attribute information with the UUID and registers them in the integrated database 50. This makes it possible for this modification to store attribute information of users who use multiple individual services, which can be provided to operators of each individual service.

[0159] [Variation 3] This exemplary embodiment can be modified so that the UUID functions as the integrated authentication information. In this case, the integrated database 50 shown in FIG. 6 does not need to store information R4 including service identification information U indicating the integrated service. In this case, the terminal 90 does not need to display screen G4 for new registration in FIG. 10. In this case, the authentication unit 211 of the authentication server 20 determines that the authentication of the user has been successful when the authentication information entered by the user is successfully matched with at least one of individual authentication information A and individual authentication information B stored in the integrated database 50.

[0160] Furthermore, in this modification, steps A12 and A13 shown in Fig. 9 are omitted. For example, in step A14, the linking unit 112 generates a UUID (integrated authentication information) and registers the individual authentication information in the integrated database 50 in association with the UUID.

[0161] In this modified example, it is possible to reduce the effort required of the user to register new integrated authentication information.

[0162] [Variation 4] This exemplary embodiment can be modified so that the same information as the individual authentication information is generated as the integrated authentication information. In this case, for example, the individual authentication information may be pre-entered in UI objects G42 and G43 on screen G4 for new registration in Fig. 10. Alternatively, as in Modification 2, steps A12 and A13 shown in Fig. 9 may be omitted, and in step A15, the linking unit 112 may generate the same information as the individual authentication information as the integrated authentication information.

[0163] In this modified example, it is possible to reduce the effort required of the user to register new integrated authentication information.

[0164] [Variation 5] This exemplary embodiment can be modified so as not to display screens G3 and G7 for confirming possession of integrated authentication information in Figures 10 and 12. In this case, in step A9 or B9, the linking unit 112 may inquire of the terminal 90 whether or not it possesses session ID-U, and if it does not possess it, execute the processing from step A10, or if it possesses it, execute step B10 and subsequent steps.

[0165] [Variation 6] This exemplary embodiment can be modified so that, if the user possesses integrated authentication information, the authentication server 20 authenticates the user before executing step B10 of FIG. 11 . In this case, it is possible to identify the integrated authentication information (or its corresponding UUID) to be linked without using the session ID-U. For example, this modification functions when the linking execution request received in step B10 does not include the session ID-U or when the session ID-U has expired. In this case, the linking unit 112 may transmit the authentication screen G4 ( FIG. 10 ) or screen G9 ( FIG. 16 ) to the terminal 90. Furthermore, if the linking unit 112 successfully authenticates the user based on the information entered on screen G4 or screen G9, it executes the processes from step B11 onward. In this case, the linking unit 112 may generate a new session ID-U and transmit it to the terminal 90.

[0166] [Variation 7] In this exemplary embodiment, the number of services provided by one service server 30 is not limited to one, and may be multiple. In this case, a user database 40 is provided corresponding to each service. A service server 30 that provides multiple services is connected to multiple user databases 40 corresponding to each service.

[0167] [Software implementation example] Some or all of the functions of each device constituting the information processing systems 1 and 1A may be realized by hardware such as an integrated circuit (IC chip), or may be realized by software.

[0168] In the latter case, each device constituting the information processing system 1, 1A is realized, for example, by a computer that executes instructions of a program, which is software that realizes each function. An example of such a computer (hereinafter referred to as computer C) is shown in FIG. 18. The computer C includes at least one processor C1 and at least one memory C2. The memory C2 stores a program P for causing the computer C to operate as each device constituting the information processing system 1, 1A. In the computer C, the processor C1 reads and executes the program P from the memory C2, thereby realizing each function of each device constituting the information processing system 1, 1A.

[0169] The processor C1 may be, for example, a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), a micro processing unit (MPU), a floating point number processing unit (FPU), a physics processing unit (PPU), a microcontroller, or a combination thereof. The memory C2 may be, for example, a flash memory, a hard disk drive (HDD), a solid state drive (SSD), or a combination thereof.

[0170] The computer C may further include a RAM (Random Access Memory) for expanding the program P during execution and for temporarily storing various data. The computer C may also include a communication interface for transmitting and receiving data to and from other devices. The computer C may also include an input / output interface for connecting input / output devices such as a keyboard, mouse, display, and printer.

[0171] Furthermore, the program P can be recorded on a non-transitory tangible recording medium M that can be read by the computer C. Such a recording medium M can be, for example, a tape, a disk, a card, a semiconductor memory, or a programmable logic circuit. The computer C can acquire the program P via such a recording medium M. The program P can also be transmitted via a transmission medium. Such a transmission medium can be, for example, a communication network or broadcast waves. The computer C can also acquire the program P via such a transmission medium.

[0172] [Appendix 1] The present invention is not limited to the above-described embodiments, and various modifications are possible within the scope of the claims. For example, embodiments obtained by appropriately combining the technical means disclosed in the above-described embodiments are also included in the technical scope of the present invention.

[0173] [Appendix 2] Some or all of the above-described embodiments can also be described as follows: However, the present invention is not limited to the following described aspects.

[0174] (Appendix 1) an acquisition means for acquiring, from a first server providing a first service, a first collaboration request including first authentication information used by the first server to authenticate a user; a linking means for generating integrated authentication information to be linked to the first authentication information based on the first linking request, and storing the first authentication information and the integrated authentication information in a storage device; An information processing system comprising:

[0175] (Appendix 2) the acquiring means further acquires, from a second server providing a second service different from the first service, a second collaboration request including second authentication information used by the second server to authenticate the user; the linking means links the second authentication information with the integrated authentication information based on the second linking request, and stores the second authentication information in the storage device. 10. The information processing system of claim 1.

[0176] (Appendix 3) The linking means is storing, in association with the integrated authentication information, federation information indicating that the first authentication information and the integrated authentication information have been federated; When the second federation request includes the federated information, the integrated authentication information associated with the federated information is federated with the second authentication information. 10. The information processing system of claim 2.

[0177] (Appendix 4) an authentication means for determining that authentication of the user has been successful when authentication information input by the user to use the first service or the second service is successfully matched with at least one of the integrated authentication information, the first authentication information, and the second authentication information stored in the storage device; 4. The information processing system of claim 2 or 3, further comprising:

[0178] (Appendix 5) the authentication means generates authentication success information that enables the user to use the first service or the second service if the authentication of the user is successful. 5. The information processing system of claim 4.

[0179] (Appendix 6) The linking means functions when the user inputs information agreeing to the linking. 6. An information processing system according to any one of appendices 1 to 5.

[0180] (Appendix 7) the linking means generates the integrated authentication information by referring to the information input by the user. 7. An information processing system according to any one of appendices 1 to 6.

[0181] (Appendix 8) the linking means stores the attribute information of the user in association with the integrated authentication information in the storage device; 8. An information processing system according to any one of appendices 1 to 7.

[0182] (Appendix 9) acquiring, from a first server providing a first service, a first collaboration request including first authentication information used by the first server to authenticate a user; generating integrated authentication information to be linked to the first authentication information based on the first linkage request, and storing the first authentication information and the integrated authentication information in a storage device; An information processing method, including:

[0183] (Appendix 10) A program for causing a computer to function as an information processing system, the program comprising: an acquisition means for acquiring, from a first server providing a first service, a first collaboration request including first authentication information used by the first server to authenticate a user; a linking means for generating integrated authentication information to be linked to the first authentication information based on the first linking request, and storing the first authentication information and the integrated authentication information in a storage device; A program that functions as a

[0184] [Appendix 3] Some or all of the above-described embodiments can also be expressed as follows.

[0185] An information processing system comprising at least one processor, the processor executing an acquisition process of acquiring a first integration request from a first server that provides a first service, the first integration request including first authentication information that the first server uses to authenticate a user, and an integration process of generating integrated authentication information to be integrated with the first authentication information based on the first integration request, and storing the first authentication information and the integrated authentication information in a storage device.

[0186] The information processing system may further include a memory that stores a program for causing the processor to execute the acquisition process and the linking process. The program may be recorded on a computer-readable, non-transitory, tangible recording medium. [Explanation of symbols]

[0187] 1. 1A Information Processing System 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 Notes 10 Collaboration Server 11, 111 Acquisition Department 12, 112 Collaboration Department 20 Authentication Server 211 Authentication Department 30, 30A, 30B Service Server 40, 40A, 40B User Database 50 Integrated Database 90 terminals 110, 210 control unit 120, 220 storage section 130, 230 Communications Department C1 processor C2 Memory N1 Network

Claims

1. an acquisition means for acquiring, from a first server that provides a first service, a first cooperation request including first authentication information used by the first server to authenticate a user; a linking unit that generates linked transaction information based on the first linking request, and associates the first authentication information with the linked transaction information and stores the associated transaction information in a storage device; an output means for outputting the linked transaction information to the first server, the linking means, when the acquiring means acquires from the terminal a registration start request including the linked transaction information, generates transaction information for registration, associates the transaction information for registration with the linked transaction information, and stores the transaction information in the storage device; the output means outputs the transaction information for registration to the terminal; When the acquisition means acquires a registration execution request including information used for authentication and the transaction information for registration, the linking means generates integrated authentication information using the information used for authentication, identifies the first authentication information by using the linked transaction information and the transaction information for registration, and stores the first authentication information in the storage device in association with the integrated authentication information. Information processing system.

2. the acquiring means further acquires, from a second server providing a second service different from the first service, a second cooperation request including second authentication information used by the second server to authenticate the user; the linking means links the second authentication information with the integrated authentication information based on the second linking request, and stores the second authentication information in the storage device. The information processing system according to claim 1 .

3. The linking means is storing, in association with the integrated authentication information, federation information indicating that the first authentication information and the integrated authentication information have been federated; When the second federation request includes the federated information, the integrated authentication information associated with the federated information is federated with the second authentication information. The information processing system according to claim 2 .

4. an authentication means for determining that authentication of the user has been successful when authentication information input by the user to use the first service or the second service is successfully matched with at least one of the integrated authentication information, the first authentication information, and the second authentication information stored in the storage device; The information processing system according to claim 2 or 3, further comprising:

5. the authentication means generates authentication success information that enables the user to use the first service or the second service if the authentication of the user is successful. The information processing system according to claim 4 .

6. The linking means functions when the user inputs information agreeing to the linking. The information processing system according to any one of claims 1 to 5.

7. the linking means stores the attribute information of the user in association with the integrated authentication information in the storage device; The information processing system according to any one of claims 1 to 6.

8. acquiring, from a first server that provides a first service, a first cooperation request including first authentication information used by the first server to authenticate a user; generating linked transaction information based on the first linkage request, and storing the first authentication information and the linked transaction information in a storage device in association with each other; outputting the linked transaction information to the first server; When a registration start request including the linked transaction information is received from the terminal, transaction information for registration is generated, and the transaction information for registration and the linked transaction information are associated with each other and stored in the storage device; outputting the registration transaction information to the terminal; When a registration execution request including information used for authentication and transaction information for the registration is obtained, generating integrated authentication information using the information used for authentication, identifying the first authentication information by using the linked transaction information and the transaction information for the registration, and storing the first authentication information in association with the integrated authentication information in the storage device; An information processing method, including:

9. A program for causing a computer to function as an information processing system, the program comprising: acquiring, from a first server that provides a first service, a first cooperation request including first authentication information used by the first server to authenticate a user; generating linked transaction information based on the first linkage request, and storing the first authentication information and the linked transaction information in a storage device in association with each other; outputting the linked transaction information to the first server; When a registration start request including the linked transaction information is received from the terminal, transaction information for registration is generated, and the transaction information for registration and the linked transaction information are associated with each other and stored in the storage device; outputting the registration transaction information to the terminal; When a registration execution request including information used for authentication and transaction information for the registration is obtained, generating integrated authentication information using the information used for authentication, identifying the first authentication information by using the linked transaction information and the transaction information for the registration, and storing the first authentication information in association with the integrated authentication information in the storage device; A program that executes.

Images