Patent Application
20150280920
This application is based upon and claims the benefit of priority of the prior Japanese Patent Application No. 2014-072146, filed on Mar. 31, 2014, the entire contents of which are incorporated herein by reference.
The embodiment discussed herein is related to a system for authorization, a method for authorization, and a providing device.
When a request for a service is made from a terminal used by the user to a service provider (SP) that provides services of information, applications, and so forth through the Internet, for example, it is checked whether the user has authorization to use the service.
One of schemes used for such an authorization check is, for example, a scheme using a security assertion markup language (SAML) protocol. SAML is a standard protocol that realizes single sign-on to services scattered over the Internet. SAML is a scheme in which authentication and authorization are performed for an SP, a terminal, and an identity provider (IdP) that carries out authentication verification for a request from the SP and returns attribute information of the user. The IdP issues a ticket indicating an authentication result that guarantees the identity of the terminal. The terminal is allowed to use the service provided by the SP by giving the issued ticket to the SP. Examples of documents that disclose such a technique include Japanese Laid-open Patent Publication No. 2012-168795, Japanese Laid-open Patent Publication No. 2003-330896, Japanese Laid-open Patent Publication No. 2005-123996, and Japanese Laid-open Patent Publication No. 2013-137588.
In accordance with an aspect of the embodiments, a system for authorization including a terminal that uses a service, a providing device that provides the service to the terminal, and a distribution device that distributes, to the terminal, authentication information to be used when the terminal receives the service from the providing device, the system includes: a processor; and a memory which stores a plurality of instructions, which when executed by the processor, cause the processor to execute: causing the distribution device to perform a process including receiving status information indicating a status of the terminal and a public key of the terminal transmitted from the terminal, generating a first signed document signed with a private key of the distribution device, the first signed document including authentication information in accordance with a status of the terminal indicated by the status information received and the public key of the terminal, and transmitting the first signed document to the terminal; causing the terminal to perform a process including issuing a service request to the providing device, and making a request to the distribution device for the authentication information by transmitting the status information indicating the status of the terminal, and generating a second signed document signed with a private key of the terminal, the second signed document including provision identification information received from the providing device, and transmitting the first signed document and the second signed document to the providing device; and causing the providing device to perform a process including, in response to the service request, transmitting the provision identification information capable of uniquely identifying the second signed document to the terminal, and verifying the service request from the terminal, in accordance with a combination of a public key of the distribution device distributed in advance from the distribution device and the private key of the distribution device indicated by the first signed document received from the terminal, a combination of the public key of the terminal included in the first signed document and the private key of the terminal indicated by a signature of the second signed document, whether the provision identification information included in the second signed document is received for a first time, and the authentication information included in the first signed document.
The object and advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the claims. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the invention, as claimed.
These and/or other aspects and advantages will become apparent and more readily appreciated from the following description of the embodiments, taken in conjunction with the accompanying drawing of which:
Hereinafter, an example of an embodiment according to the disclosed techniques will be described with reference to the accompanying drawings.
As illustrated in
The distribution device 20 includes a distribution-side generation unit 21 and a distribution-side key storage unit 25. The public key and the private key of the distribution device 20 are stored in the distribution-side key storage unit 25.
The distribution-side generation unit 21 receives a ticket distribution request that includes status information indicating a status of the terminal 30 and a public key of the terminal 30, the ticket distribution request being transmitted from the terminal 30. The status of the terminal 30 includes various states of the terminal 30, a user who uses the terminal 30, and the peripheries of the terminal 30 and the user, such as attributes of the user of the terminal 30, the location of the terminal 30, and facilities for communication that are available to the terminal 30. For example, the latitude and longitude information obtained by a position sensor of the global positioning system (GPS) or the like provided in the terminal 30, an identifier (ID) of a near field communication (NFC) device arranged at a predetermined location obtained by communication with the NFC device, or the like may be status information. Also, for example, a user ID associated with user attributes, such as the department in a company to which the user belongs, and a password managed in combination with the user ID may be used as status information.
The distribution-side generation unit 21 issues a ticket that comprehensively expresses the status of the terminal 30, as authentication information indicating an authentication result for the state of the terminal 30, in order that the terminal 30 receives a service in accordance with the status of the terminal 30. Specifically, referring to a table in which the correspondence relationship between the statuses of the terminal 30 and tickets to be issued is determined in advance, for example, as depicted in
More specifically, the distribution-side generation unit 21 issues, for example, a ticket “event site A” indicated by a ticket ID=P1 in cases where the latitude and longitude information received as status information satisfies conditions determined in the table of
Additionally, for example, if the status information included in the ticket distribution request is a user ID and a password, the distribution-side generation unit 21 checks the authenticity of the user ID by using a separately managed table of correspondence between user IDs and passwords. The distribution-side generation unit 21 then refers to the correspondence table separately managed and including the user ID and a department code indicating the department to which a user indicated by the user ID belongs, and acquires the department code corresponding to the user ID. Further, the distribution-side generation unit 21 issues a ticket “business department” indicated by the ticket ID=A1 if the department code corresponding to the user ID satisfies conditions (#001 to #002) defined in the table of
The distribution-side generation unit 21 also generates a first signed document that includes the ticket ID of an issued ticket, the public key of the terminal 30 included in the ticket distribution request, and a first random value, the first signed document being signed with the private key of the distribution device 20. Note that the first random value is an example of distribution identification information of the disclosed techniques. Although a random value is used as distribution identification information here, the distribution identification information may be a value with which the first signed document is uniquely identified. The distribution-side generation unit 21 also returns the generated first signed document to the terminal 30.
The terminal 30 includes a request unit 31, a terminal-side generation unit 32, a service usage unit 33, and a terminal-side key storage unit 35. The public key and the private key of the terminal 30 are stored in the terminal-side key storage unit 35. The terminal 30 is, for example, a personal computer (PC), a notebook PC, a tablet, a mobile phone, or the like, and is a device on which various applications are executed. The terminal 30 is equipped with the request unit 31, the terminal-side generation unit 32, and the service usage unit 33 as proxy functions that act when an application is executed on the terminal 30.
Upon receipt of a service request for provision of a service from an application that is being executed on the terminal 30, the request unit 31 generates a ticket distribution request for requesting the distribution device 20 to distribute a ticket to be used for receiving the service. As described above, the ticket distribution request includes status information indicating the status of the terminal 30 and the public key of the terminal 30 stored in the terminal-side storage unit 35. The request unit 31 causes, among status information that is acquirable, at least status information to be used for issuance of a ticket to be included in the ticket distribution request. Note that if status information to be used for issuance of a ticket, with which a service request is authorized, is unknown, all the acquirable status information may be included in a ticket distribution request. The request unit 31 transmits the generated ticket distribution request to the distribution device 20.
The request unit 31 requests the providing device 40 to provide a service by relaying a service request received from an application to the providing device 40.
The terminal-side generation unit 32 receives a first signed document returned from the distribution device 20 and a second random value (described in detail below) returned from the providing device 40 in response to a service request transmitted by the request unit 31. The terminal-side generation unit 32 generates a second signed document that includes the first random value included in the first signed document and the second random value returned from the providing device 40 and that is signed with the private key of the terminal 30. The terminal-side generation unit 32 also transmits the first signed document and the second signed document to the providing device 40.
Upon receipt of a notification of the fact that authorization to use a service is granted by the providing device 40, the service usage unit 33 notifies the application of the fact, and relays transmission and reception of data between the application and the providing device 40 so that the authorized service may be used by the application.
The providing device 40 includes a verification unit 41, a providing unit 42, and a provision-side key storage unit 45. The public key of the distribution device 20 distributed from the distribution device 20 in advance is stored in the provision-side storage unit 45.
Upon receipt of a service request transmitted from the terminal 30, the verification unit 41 returns a second random value to the terminal 30 that has transmitted that service request. Note that a second random value is an example of provision identification information of the disclosed techniques. Although a random value is used as provision identification information here, the provision identification information may be a value with which a second signed document is uniquely identified.
The verification unit 41 also receives the first signed document and the second signed document from the terminal 30, and verifies the validity of authorization to use the service requested by the terminal 30 for a ticket indicated by a ticket ID included in the first signed document.
Specifically, the verification unit 41 verifies whether the public key of the distribution device 20 stored in the provision-side key storage unit 45 and the private key of the distribution device 20 indicated by the signature of the first signed document form a valid pair. Through this verification, the verification unit 41 may confirm that the first signed document is generated by the valid distribution device 20 and, in turn, may confirm the validity of a ticket issued by the distribution device 20.
The verification unit 41 also verifies whether the public key of the terminal 30 included in the first signed document generated by the distribution device 20 and the private key of the terminal 30 indicated by the signature of the second signed document form a valid pair. Through this verification, the verification unit 41 may confirm that the terminal 30 and the distribution device 20 has an exchange to issue a ticket and that the ticket is issued to the terminal 30 requesting the service.
Using the second random value included in the second signed document, the verification unit 41 also verifies whether the second signed document is received for the first time. If the second signed document including the second random value that has already been received is received again, the verification unit 41 may determine that the second signed document received for the second time or later is one intercepted by a third party over a network. That is, through this verification, the verification unit 41 may check the validity of the terminal 30.
The verification unit 41 also verifies whether a first random value included in the first signed document matches a first random value included in the second signed document. Through this verification, the verification unit 41 may confirm that the first signed document and the second signed document are a set of signed documents generated for the same service request. Note that, by verifying whether the public key of the terminal 30 included in the first signed document and the private key of the terminal 30 indicated by the signature of the second signed document form a valid pair, it is possible to check whether the first signed document and the second signed document make a set. Here, by checking whether the first random values are included in both the documents, it may be more reliably and simply checked whether both the documents make a set.
As described above, if the validity of the ticket and the terminal 30 is checked, the verification unit 41 further verifies whether the ticket is a ticket serving as authorization to use the requested service. Specifically, the verification unit 41 refers to, for example, a table in which the relationship between the types of tickets and providable services is determined in advance as depicted in
More specifically, for example, it is assumed that the verification unit 41 receives a first signed document including a ticket ID=P1 from the terminal 30 for a service request that makes a request for a service “Guidance for event site A”. The verification unit 41 compares a ticket ID (P1) indicating a ticket to be used for the service “Guidance for event site A” defined, for example, in the table of
On the other hand, if the ticket ID included in the first signed document does not match the ticket ID (P1) indicating a ticket to be used for the service “Guidance for event site A”, the verification unit 41 does not allow the use of the service “Guidance for event site A” by the terminal 30. In this case, it is indicated that the terminal 30 does not exist at a location (event side A, latitude and longitude information (X1, Y1) to (X2, Y2), refer to
Additionally, the verification unit 41 may determine a plurality of tickets used for provision of a service, for example, such as a service “Business department meeting data” of the table depicted in
The verification unit 41 notifies the providing unit 42 of a verification result of whether to refuse or give authorization to use of the service.
When authorization to use a service with the terminal 30 is given, the providing unit 42 notifies the terminal 30 of that fact and begins to provide the service to the terminal 30. On the other hand, when authorization to use a service with the terminal 30 is refused, the providing unit 42 notifies the terminal 30 of that fact.
The distribution device 20 may be implemented, for example, by a computer 50 illustrated in
The storage unit 56 may be implemented by a hard disk drive (HDD), a solid state drive (SSD), a flash memory, or the like. A ticket distribution program 60 for causing the computer 50 to function as the distribution device 20 is stored in the storage unit 56 as a storage medium. The storage unit 56 has a distribution-side key storage area 65.
The CPU 52 reads the ticket distribution program 60 from the storage unit 56 and expands it in the memory 54 so as to sequentially execute processes included in the ticket distribution program 60. The ticket distribution program 60 includes a distribution-side generation process 61. The CPU 52 executes the distribution-side generation process 61 to operate as the distribution-side generation unit 21 illustrated in
The terminal 30 may be implemented, for example, by a computer 70 illustrated in
The storage unit 76 may be implemented by an HDD, an SSD, a flash memory, or the like. A service usage program 80 for causing the computer 70 to function as the terminal 30 is stored in the storage unit 76 as a storage medium. The storage unit 76 also has a terminal-side key storage area 85.
The CPU 72 reads the ticket distribution program 80 from the storage unit 76 and expands it in the memory 74 so as to sequentially execute processes included in the service usage program 80. The service usage program 80 includes a request process 81, a terminal-side generation process 82, and a service usage process 83. The CPU 72 executes the request process 81 to operate as the request unit 31 illustrated in
The providing device 40 may be implemented, for example, by a computer 90 illustrated in
The storage unit 96 may be implemented by an HDD, an SSD, a flash memory, or the like. A service provision program 100 for causing the computer 90 to function as the providing device 40 is stored in the storage unit 96 as a storage medium. The storage unit 96 also has a provision-side key storage area 105.
The CPU 92 reads the service provision program 100 from the storage unit 96 and expands it in the memory 94 so as to sequentially execute processes included in the service provision program 100. The service provision program 100 includes a verification process 101 and a provision process 102. The CPU 92 executes the verification process 101 to operate as the verification unit 41 illustrated in
Note that the distribution device 20, the terminal 30, and the providing device 40 each may be implemented, for example, by a semiconductor integrated circuit, more particularly an application specific integrated circuit (ASIC) or the like.
Next, operations of the authorization system 10 according to this embodiment will be described. When a service request occurs in an application being executed in the terminal 30, a service usage process illustrated in
First, at step S11 of the service usage process (
Next, at step S12, it is determined whether the terminal-side generation unit 32 has received the first signed document returned from the distribution device 20. Determination of this step is repeated until the first signed document is received.
Here, at step S21 of the ticket distribution process (
At step S22, referring to a table in which the correspondence relationship between the statuses of the terminal 30 and tickets to be issued are determined in advance, for example, as illustrated in
Next, at step S23, the distribution-side generation unit 21 returns the generated first signed document to the terminal 30 (202 in
As a result, the determination at step S12 of the service usage process illustrated in
Next, at step S14, it is determined whether the terminal-side generation unit 32 has received the second random value returned from the providing device 40. The determination of this step is repeated until the second random value is received.
Here, at step S31 of the service providing process (
At step S32, the verification unit 41 returns the second random value to the terminal 30 that has transmitted the service request (204 in
As a result, the determination at step S14 of the service usage process illustrated in
At step S15 of the service usage process illustrated in
Next, at step S16, the terminal-side generation unit 32 transmits the first signed document received at step S12 mentioned above and the second signed document generated at step S15 mentioned above to the providing device 40 (206 in
As a result, the determination at step S33 of the service providing process illustrated in
At step S34 of the service providing process illustrated in
At step S35, the verification unit 41 notifies the providing unit 42 of a verification result that authorization to use the service is given. The providing unit 42 notifies the terminal 30, which has transmitted a service request, that the use of the service will be started, and starts providing the service to the terminal 30 (208 in
On the other hand, at step S36, the verification unit 41 notifies the providing unit 42 of a verification result that the use of the service is not allowed. The providing unit 42 notifies the terminal 30, which has transmitted the service request, that the use of the service is not allowed (208 in
As a result, the determination at step S17 of the service usage process illustrated in
At step S19, the service usage unit 33 notifies the application that the use of the service will be started and relays transmission and reception of data between the application and the providing device 40 so that the authorized service is used by the application.
On the other hand, at step S20, the service usage unit 33 makes a report to the user, for example, by displaying, on the display device 110, a message indicating that the use of the service is not allowed, and then the service usage process ends.
Note that processing of a service request made from the terminal 30 to the providing device 40 at step S13 of the service usage process illustrated in
As described above, with the authorization system 10 according to this embodiment, the distribution device 20 issues a ticket in accordance with the status information received from the terminal 30. The distribution device 20 then distributes, to the terminal 30, the first signed document that includes the ticket ID indicating the issued ticket and the public key of the terminal 30 and that is signed with the private key of the distribution device 20. The terminal 30 generates the second signed document that includes the second random value transmitted from the providing device 40 and that is signed with the private key of the terminal 30, and transmits the second signed document, together with the first signed document distributed from the distribution device 20, to the providing device 40. In the providing device 40, a combination of the public key of the distribution device 20 distributed in advance from the distribution device 20 and the private key of the distribution device 20 indicated by the signature of the first signed document is verified. A combination of the public key of the terminal 30 included in the first signed document and the private key of the terminal 30 indicated by the signature of the second signed document is also verified. Further, it is verified whether the second random value included in the second signed document is received for the first time. As a result, it is possible to inhibit unauthorized use of a ticket that is distributed among unspecified users under a specific situation and that serves as authorization to use a service request.
More specifically, description will be given of cases where unauthorized use of a ticket is inhibited in each of situations in which the ticket is likely to be intercepted.
In a situation where the first signed document is transmitted from the distribution device 20 to the terminal 30 (202 in
Additionally, in a situation where the first signed document and the second signed document are transmitted from the terminal 30 to the providing device 40 (206 in
Moreover, it is assumed that the private key of the terminal 30 is flown to the third party and the first signed document is intercepted. In this case, the third party is able to generate a valid second signed document by acquiring the second random value from the providing device 40. In this case, the first random value included in the first signed document may be specified, and the providing device 40 may be notified to invalidate the first signed document. As a result, the providing device 40 may refuse receipt of the invalidated first signed document. Additionally, the first random value is information with which the first signed document is uniquely identifiable. Therefore, when a ticket distribution request is made again from the valid terminal 30, a first signed document including a first random value that is different from that included in the intercepted document is distributed. Thus, no service request from the valid terminal 30 is inhibited.
As described above, with the system for authorization according to this embodiment, a measure is taken against ticket interception. Even in the case where a secure network path is not built among the distribution device 20, the terminal 30, and the providing device 40, it is possible to distribute a ticket. Even in the case where a storage for keeping a ticket is not a secure storage, it is possible to inhibit the flown ticket from unauthorized use. This enables a ticket to be stored for a long time. If the public key of the distribution device 20 is distributed in advance from the distribution device 20 to the providing device 40, it is unnecessary to take an exchange between the distribution device 20 and the providing device 40 during authorization for use of a service. Thus, the distribution device 20 and the providing device 40 may be built as a system in which they are separated in terms of networking.
The system for authorization according to this embodiment is applied, for example, to the case of a user who is present at a specific location such as an event site to perform management, such as user registration. Without authentication of the origin of the terminal 30, a service suitable for a specific location where the user is present may be provided.
Additionally, as the situation of the terminal 30 demands, that is, as a ticket issued with the distribution device 30 demands, the network connected to the terminal 30 may be changed, or the terminal 30 may be separated from the network. For example, a service request is made using a ticket indicating that the user is present in the company to serve as authorization to use a service. This enables a “company secret” file stored in the providing device 40 to be accessed. In contrast, a ticket indicating that the user is present in the company is not issued to the user outside the company. The user outside the company is separated from the network and thus is unable to access the “company secret” file. In such a manner, as the situation of the terminal 30 demands, the network configuration may be dynamically built.
It is to be noted that although description has been given of the case where the first random value is included in the first signed document, the validity of the ticket and the terminal 30 is verifiable without the first random value. Thus, the first random value may be omitted. However, using the first random value enables the first signed document to be invalidated on a document basis, as described above. This may restrict the range to which the influence of refusal of service usage extends to a demanded range. Additionally, using the first random value, it may be more reliably and simply checked whether the first singed document and the second signed document make a set, as described above.
In the foregoing embodiment, the form in which the ticket distribution program 60, the service usage program 80, and the service provision program 100 are stored in advance in the storage unit 56, the storage unit 76, and the storage unit 96, respectively, has been described, but these programs are not particularly limited. These programs may be provided in the form in which they are recorded in a storage medium such as a compact disc (CD)-read-only memory (ROM), a digital video disc (DVD)-ROM, or a universal serial bus (USB) memory.
All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the invention and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although the embodiment of the present invention has been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2014-072146 | Mar 2014 | JP | national |
