JP2001344205A - Service providing system, its method and recording medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable a certification provider to certify a service user by solving difficulty due to the certification of the service user by a service provider, to enable the service user's privacy to be protected, and to perform a certification satisfying a service user's request by receiving the request of the service user. SOLUTION: The certification provider 3 to be a third person certifies the service user 2 through a network, receives the service user's request while protecting the user's privacy and informs the service provider 2 of the certified result of the user 2.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention is used in a system for providing a service in accordance with a service use request from a service user. In particular, the present invention relates to a technology for authenticating a service user or a service provider.

[0002]

2. Description of the Related Art In a service form that requires a service provider to authenticate a service user or to collect information on a service user, these authentication and information collection are performed by a service provider. The service is performed between the provider and the service user, and the service provider authenticates the service user by obtaining information of the service user from the service user.

[0003] Therefore, information for a service provider to authenticate a service user differs for each service provider, and the service user needs to have a lot of information for authentication in advance.

[0004] However, having a user have information for authentication is difficult because of the difficulty in safely distributing the information and the difficult management of this information by service providers and service users. Requires the effort of
It is an obstacle in providing services.

[0005] Further, in the conventional technology, the authentication of the service user is performed merely for the purpose of identifying the service user by the service provider, and does not consider the convenience of the service user. For example, in order for a certain family to be identified as the same service user, it is necessary to share authentication information among a plurality of family members, which is not preferable from the viewpoint of security.

[0006]

In a conventional service user authentication or a service that requires the service provider to acquire the service user information, the service provider must directly authenticate the service user. In addition, information for authentication must be distributed, and labor is required not in the service itself but in authentication of a service user, which is one of the functions required for the service.

In order to solve this problem, when a third-party authentication provider performs authentication, identification information used when the authentication provider authenticates a service user, that is, the authentication provider is used. Notifying all service providers of an authentication ID or the like distributed in advance to the user causes a problem of privacy of the service user.

For example, when an authentication provider notifies all service providers of authentication IDs as user identification information, a plurality of service providers use the service users of other service providers. If the ID notified from the authentication provider of the service user and the ID notified from the authentication provider of the service user match, it is known that the person with this ID is the same person. This causes a problem that the behavior of the service user can be grasped when a plurality of service providers collude.

[0009] Further, with the development of networks represented by the Internet, the dialogue area of each individual has become very wide. Individuals use the network to participate in many services and communities, compared to the real world before the network developed.

[0010] Therefore, each individual is required to have a plurality of self on a network. For example, oneself as a member of society, oneself as a private individual, oneself in a hobby world, oneself in another hobby world.

Each user has information for identification and personal information relating to each user. The former is an example of a real name, anonymity, or an ID number. The latter is an example of a handle name, an e-mail address, a hobby, and an action history (for example, a history of a website surfing the Internet).

However, in the case of personal authentication and provision of personal information by a simple authentication provider, the authentication provider merely substitutes for authenticating what is to be authenticated. For example, what is authenticated is a service provider, and what is authenticated is a service user. In other words, with a simple authentication service, the authenticator simply authenticates the service user instead of the position of the service provider that wants to authenticate. It cannot meet the above individual demands.

That is, when a third party performs authentication, a plurality of service users can use the service of the service provider as if they were the same user, or conversely, one service user can use the service provider's service. It is difficult to use a service as if it were a plurality of different service users.
In the latter case, specifically, it is necessary for one service user to acquire and manage a plurality of authentication information from a third-party authentication provider, which causes a difficulty in managing a plurality of security information.

SUMMARY OF THE INVENTION The present invention has been made in such a background, and solves the difficulties involved in authenticating a service user by a service provider and enabling the authentication provider to authenticate the service user. To provide a service providing system and a service providing method capable of protecting privacy of a service user, and further performing authentication satisfying the request of the service user by accepting the request of the service user. With the goal.

That is, the present invention provides a service provider comprising:
Since the authentication provider intervenes between the service users, the authentication information that the service provider and the service user need to manage can be reduced, and the authentication information of the service provider and the service user can be managed. It is an object of the present invention to provide a service providing system and a service providing method which can facilitate the above. An object of the present invention is to provide a service providing system and a service providing method that enable an authentication provider to transmit authentication information of a service user to the service provider while protecting privacy from the standpoint of a service user. Aim. According to the present invention, a service capable of improving the convenience of a service user such as notifying a plurality of service users to the service provider as an identical service user according to an instruction of the service user. It is an object to provide a providing system and a service providing method. According to the present invention, the authentication provider specifies the service user by the service user's instruction.
For example, it is an object of the present invention to provide a service providing system and a service providing method capable of improving the convenience and privacy protection of a service user, such as transmitting a different ID depending on the service provider.

[0016]

According to the present invention, a computer of an authentication provider as a third party authenticates a service user through a network, protects the privacy of the service user to the service provider, and The most significant feature is that an authentication result notification is received in response to the above request. Alternatively, the service user can authenticate the service provider via the authentication provider. This is different from the conventional technology in that many service providers do not need to directly authenticate the service user, and that they accept user requests.

According to the present invention, authentication that satisfies a service user's request, that is, an authentication provider accepts a request of a person to be authenticated (a service user), and authenticates an authentication result that satisfies the request ( Service provider). Thereby, the service user can notify the service provider of the authentication result reflecting his or her intention.

According to the present invention, for example, when a user wants to browse a homepage in a certain hobby world, he can request to be authenticated as oneself in the hobby world. If you want to join a chat room that involves your work, you can request that you authenticate yourself as a working adult. A server that provides information on the area where the user lives can be requested to authenticate as a resident of the area where the user lives.

The details are as follows. According to the present invention, when a service provider receives an intention to use a service from a service user, the service provider determines whether authentication of the service user is necessary, and if necessary, authenticates the service user to the authentication provider. Then, it sends an authentication request requesting notification of the result.

The authentication provider authenticates whether the service user is himself or not. As the authentication means, an ID and a password which are previously distributed to the service user by the authentication provider are represented. It is also possible to use the public key private key pair possessed by the service user. Alternatively, the service user can use the outgoing telephone number of the access network connected to the network.

The authentication provider creates user identification information to be notified to the service provider based on the result of authenticating the service user, and sends it to the service provider. The service provider uses the authentication result notification to identify the service user and perform the service.

Also, the service provider can send information to the authentication provider for the authentication provider to authenticate the service provider. The authentication provider can also change the authentication result notification mode for notifying the service provider according to the service provider. The service user can also send a notification content designator, which is information for changing the authentication result notification form sent by the authentication provider to the service provider, to the authentication provider. The authentication provider can also change the authentication result notification mode for notifying the service provider using the notification content specifier.

The authentication provider can also send information for the service user to identify the service provider to the service user. The authentication provider can change the authentication result notification form of the service user who notifies the service provider using both the service provider information and the notification content designator. Authentication providers can also share authentication information with service users. The authentication provider uses a database in which the information of the service user, the information of the service provider, and part or all of the notification content designator are associated with each other as a means for changing the notification form of the authentication result notified to the service provider. You can also. Information for creating or changing this database can be sent to the authentication provider. The authentication provider can record and save the input from the service provider, and the authentication provider can record and save the input from the service user.

The authentication provider can charge the service provider by inputting an authentication request from the service provider. Specifically, for example, in one example, the authentication provider charges the service provider according to the number of authentication requests received from the service provider.

The authentication provider can perform a charging process for the service user based on the input from the service user. Specifically, for example, the authentication provider charges the service user according to the number of times the authentication provider has performed the authentication of the service user.

That is, a first aspect of the present invention is a service providing system.
Service use means of a service user, service provision means of a service provider providing a service in accordance with a service provision request from the service use means, and authentication of the service use means or an authentication provider for authenticating the service provision means Providing means for performing authentication of the service providing means and / or the service using means according to an authentication request from the service using means and / or the service providing means; and And a means for notifying the service providing means and / or the service providing means, wherein the service using means and / or the service providing means comprises:
The authentication providing means includes means for designating an authentication result notification mode for notifying the service providing means and / or the service using means, wherein the notifying means is designated in advance by the service using means and / or the service providing means. There is a means for giving a notification in an authentication result notification form.

[0027] Thus, it is possible to solve the difficulty associated with the service providing means authenticating the service using means, enabling the authentication using means to authenticate the service using means, and further protecting the privacy of the service using means. Accepts a request from a service using unit, thereby enabling authentication to satisfy the request from the service using unit.

The service providing means includes means for requesting the authentication providing means to authenticate the service using means in accordance with a service providing request from the service using means. Means for authenticating the service using means and notifying the service providing means of the result, wherein the service providing means sends a service to the service using means when the service using means is properly authenticated in accordance with the authentication notification. Means for providing can be provided.

Preferably, the authentication providing means includes a database in which a correspondence between the information on the service using means and the information on the service providing means and an authentication result notification form are recorded. This correspondence can be set to one or more. Further, it is desirable to have means for adding or changing the recorded contents of the database.

Thus, for example, one service using means can be registered so as to correspond to a plurality of service providing means, or a plurality of service using means can correspond to one service providing means. You can also register to do so. Further, an authentication result notification mode for performing these authentications can be registered together.

A means for recording the execution status of the authentication notification and a means for creating accounting information in accordance with the recording can be provided.

[0032] A second aspect of the present invention is a computer-readable recording medium that is further installed in a computer device having predetermined hardware and predetermined basic software installed on the hardware. This is a recording medium on which software for recording the device as a device corresponding to the service providing system of the present invention is recorded.

[0033] A third aspect of the present invention is a service providing method, which is characterized in that the service providing means notifies the service providing means of identification information for identifying the service using means. A step in which the authentication providing unit receives a request for the request, and a step in which the authentication providing unit that receives the request authenticates the service using unit.
Notifying the service providing means of the identification information of the service using means authenticated by the authentication providing means.

Prior to the notification procedure, the authentication providing unit receives a notification content specifier, which is information for the service using unit to specify the identification information notified by the authentication providing unit, Changing the identification information to be notified to the service providing unit by the designating means.

[0035] Prior to the notification procedure, the authentication providing means may include a procedure for authenticating the service providing means.

Prior to the step of receiving the notification content designator by the authentication providing means, the authentication providing means sends the service using means identification information for the service using means to identify the service providing means. A sending procedure can be included.

Before the authentication providing means notifies the service providing means of the identification information of the service using means, the result of authenticating the service providing means or the result of authenticating the service providing means and the notification The authentication providing unit may include a procedure for changing the notification content of the identification information of the service using unit to notify the service providing unit by using both the content designator.

Before the authentication providing means authenticates the service using means or the service providing means, the authentication providing means may authenticate the service using means or the service providing means. A procedure in which the authentication providing unit receives a request for transmitting the service using unit or the authentication providing unit and the identification information used by the service providing unit to the service using unit or the service providing unit, and receiving the request. The authentication providing means may include a step of notifying the service using means or the service providing means of identification information used by the authentication providing means to authenticate the service using means or the service providing means.

At this time, prior to the accepting procedure, a step of requesting the service providing means to notify the identification information of the service using means may be included.

The procedure for changing the notification content of the identification information of the service using means to be notified to the service providing means includes the identification information of the service using means, the identification information of the service providing means, the notification content designator, And a procedure using a database that associates all or some of the three.

Prior to the procedure for changing the notification content of the result of authentication of the service using means for notifying the service providing means, the identification information of the service using means, the identification information of the service providing means, and the notification content designator And a procedure for receiving information for adding or changing new data to a database that associates all or a part of the three with the above, and a procedure for adding, updating, or deleting this database using this information.

At this time, prior to the accepting procedure, a procedure for requesting notification of a result of authentication of the service using unit to the service providing unit can be performed in advance.

A procedure for creating or updating billing information for the service providing means, a procedure for creating or updating billing information for the service using means, or a procedure for notifying the service providing means of the identification information of the service using means; Both procedures can be included.

The method may include a step of replacing the identification information with the identification information and the personal information of the service using means.

[0045]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The configuration of a service providing system according to an embodiment of the present invention will be described with reference to FIG. FIG. 1 is an overall configuration diagram of a service providing system according to an embodiment of the present invention. In the following description, the service user 1 indicates the service using means of the service user, the service provider 2 indicates the service providing means of the service provider, and the authentication provider 3 indicates the authentication providing means of the authentication provider. I do.

The present invention relates to a service providing system. The feature of the present invention is that a service user 1
A service provider 2 that provides a service in accordance with a service provision request from the service user 1, and an authentication provider 3 that authenticates the service user 1 or the service provider 2. The authentication provider 3 Authenticates the service provider 2 or the service user 1 in accordance with the authentication request from the service user 1 or the service provider 2 and notifies the service user 1 or the service provider 2 of the authentication result; Reference numeral 1 denotes an authentication provider 3 that specifies an authentication result notification mode to be notified to the service provider 2, and the authentication provider 3 performs notification in an authentication result notification mode specified in advance by the service user 1.

The service provider 2 requests the authentication provider 3 to authenticate the service user 1 according to the service provision request from the service user 1, and the authentication provider 3 uses the service according to the authentication request. The service provider 2 is authenticated and the result is notified to the service provider 2, and the service provider 2
Provides the service to the service user 1 when the service user 1 is properly authenticated according to the authentication notification.

The authentication provider 3 includes a database in which the correspondence between the information of the service user 1 and the information of the service provider 2 and the authentication result notification form are recorded. This correspondence can be set to one or more. Further, the service user 1 and the service provider 2 can add or change the recorded contents of the database.

Further, the number of authentication notifications can be counted, and billing information can be created according to the counted result. This may be provided in the authentication provider 3 or in a charging device (not shown). Further, in addition to the number of times of the authentication notification, a billing mode may be adopted in which different billing information is created depending on the attribute of a service provided by the certification.

The service providing system according to the embodiment of the present invention
Software is recorded on a computer device having predetermined hardware and predetermined basic software installed on the hardware, so that the computer device is further installed to make the computer device correspond to the service providing system of the present invention. The present invention can be realized by installing this software in a computer device using a recording medium.

Hereinafter, embodiments of the present invention will be described in more detail.

FIGS. 2 and 3 show that a service user is a computer at home and is a member HP (Ho) on the Internet.
This is an embodiment showing a flow when a service for browsing (mePage: HP) is received.

In this embodiment, the authentication provider 3 authenticates the service user 1 by the authentication ID + password issued by the authentication provider 3 to the service user 1 and changes the result for each service provider 2. This is a usage form of a network system for notifying the result of authentication of the service user 1 by using the network system.

Here, in this embodiment, the authentication ID is an ID used by the authentication provider 2 to authenticate the service user 1.
D is defined. First, as a preliminary preparation, the computer of the service user 1 inputs a request to distribute the authentication information to the computer of the authentication provider 3 to the service user 1 (10). This is possible, for example, by using a WWW server of the computer of the authentication provider 3.

Next, the computer of the authentication provider 3 sends the authentication ID and the password to the computer of the service user 1 by using the existing encryption technology such as SSL, and the computer of the service user 1 transmits the authentication ID and the password. (20).

Next, the computer of the service user 1 stores information on the service user 1, which is a database for changing the authentication result notification form of the result of authentication of the service user 1 sent to the service provider 2. Information for creating a database that associates the information of the service provider 2 with the authentication result notification form is input to the computer of the authentication provider 3 (30). This is possible, for example, by using a WWW server of the computer of the authentication provider 3.

Next, the computer of the authentication provider 3 creates this database (this database is called a default database for convenience of explanation) (40). FIG. 4 shows an example of the default database. When the service user 1 tries to browse the member HP created by the service provider 2, the service user 1 browses the HP of the service provider 2's computer and transmits the data of the member HP to the service user 1. Is input to the computer of the service provider 2 (50). The computer of the service provider 2 determines whether the authentication of the service user 1 is necessary to make this request (60).

If it is determined that authentication is required, the computer of the service provider 2 creates a request for the computer of the authentication provider 3 to authenticate the service user 1 (70). The service provider 2 adds a signature to the request (80). The effect is that the computer of the authentication provider 3 can identify the service provider 2 by adding an electronic signature using information that only the service provider 2 can know. The computer of the service provider 2 inputs the signed request into the computer of the authentication provider 3 (90).

The computer of the authentication provider 3 verifies the electronic signature of the request, identifies the service provider 2, and obtains the correct name of the service provider 2 (100). The computer of the authentication provider 3 records and stores the request (1).
10). The computer of the authentication provider 3 sends the service provider name, which is the information of the service provider 2 obtained as a result of authenticating the service provider 2, to the computer of the service user 1 (120).

The computer of the service user 1 creates a notification content designator in consideration of the service provider name (130). This consideration can be automated by preparing an automation table of a combination of the service provider name and the notification content designator in the computer of the service user 1 in advance. FIG. 5 shows an example of this automation table. The computer of the service user 1 inputs the notification content designator into the computer of the authentication provider 3 (140).

The computer of the authentication provider 3 requests the service user 1 for an authentication ID and a password (15).
0). Service user 1 uses SSL, an existing encryption technology
Enter the authentication ID and password into the computer of the authentication provider 3 on a secure network using
0). Authentication provider 3's computer is service user 1
To identify the authentication ID of the service user 1 (1
70). The computer of the authentication provider 3 records and stores that the service user 1 has been authenticated using the authentication ID and the password (175).

The computer of the authentication provider 3 uses the notification ID and the authentication ID change table to use the authentication ID of the service user 1 so that the service provider 2 can identify the service user 1. It is changed to a user intellectual ID (180). The authentication ID change table is a table in which how to execute the change is created by the service user 1 and the authentication provider 3. FIG. 6 shows an example of the authentication ID change table. Authentication I in FIG.
The D change table refers to the default table in FIG. The computer of the authentication provider 3 sends the user identification ID to the computer of the service provider 2 (190).

Next, the computer of the authentication provider 3 updates the accounting information for the service provider 2 (195). FIG. 7 shows an example of this billing information. It is stated that this fee is 10 yen per provision of authentication.

Next, the computer of the authentication provider 3 updates the billing information for the service user 1 (196). FIG. 8 shows an example of this billing information. It is stated that this fee is 10 yen per provision of authentication. In this billing, 1 yen is charged for one provision of authentication.

The computer of the service provider 2 identifies the service user 1 using the user identification ID,
A process for enabling the service user 1 to view the accessible HP is performed (200). Through the above processing, the service user 1 can browse the membership-based HP (210).

FIG. 9 shows a modification of the procedure after the service user 1 described with reference to FIG. 3 tries to browse the member HP created by the service provider 2 and will be described below.

When the service user 1 tries to browse the member HP created by the service provider 2, the service user 1 browses the HP of the service provider 2's computer and transmits the member HP data to the service HP. The request to be sent to the user 1 is input to the computer of the service provider 2 (50). The computer of the service provider 2 determines whether the authentication of the service user 1 is necessary to make this request (60).

If it is determined that authentication is necessary, the computer of the service provider 2 creates a request for the computer of the authentication provider 3 to authenticate the service user 1 (70). The service provider 2 signs the request (80). The effect is that the computer of the authentication provider 3 can identify the service provider 2 by adding an electronic signature using information that only the service provider 2 can know. The computer of the service provider 2 inputs the signed request into the computer of the authentication provider 3 (90).

The computer of the authentication provider 3 verifies the electronic signature of the request, identifies the service provider 2, and obtains the correct name of the service provider 2 (100). The computer of the authentication provider 3 records and stores the request (1).
10).

The computer of the authentication provider 3 creates and records session random numbers A and B for determining in the future that the session is in response to the authentication request (11).
1). The session random number uses, for example, a combination of a time and a sufficiently long random number so as to satisfy that the session random number does not match other session random numbers and cannot be forged by anyone other than the authentication provider. Specifically, “20000329121314
8dfbuganoi 439obna; zothqa
sfasffdfffadfsdfadgasogu09
5524 "and the like.

The computer of the authentication provider 3 sends the session random numbers A and B to the computer of the service provider 2 (112). The computer of the service provider 2 records the session random numbers A and B (113). The computer of the service provider 2 uses the session random number A
To the service user 1's computer (11
4). The computer of the service user 1 records the session random number A (115).

The computer of the service user 1 inputs an authentication request for authenticating the service user 1 and a session random number A to the computer of the authentication provider 3. (116) The computer of the authentication provider 3 checks whether the session random number A is indeed the random number created by the authentication provider 3, and determines from the random number the authentication request (step 90) input by the service provider 2. Correspond (11
7).

The computer of the authentication provider 3 sends the service provider name, which is the information of the service provider 2 obtained as a result of authenticating the service provider 2, to the computer of the service user 1 (120). The computer of the service user 1 creates a notification content designator in consideration of the service provider name (130). This consideration can be automated by preparing in advance the service user's computer an automation table of the combination of the service provider name and the notification content designator. FIG. 5 shows an example of this automation table.

The computer of the service user 1 inputs the notification content designator to the computer of the authentication provider 3 (140). The computer of the authentication provider 3 requests the service user 1 for the authentication ID and the password (15).
0). Service user 1 uses SSL, an existing encryption technology
Enter the authentication ID and password into the computer of the authentication provider 3 on a secure network using
0). Authentication provider 3's computer is service user 1
To identify the authentication ID of the service user 1 (1
70). The computer of the authentication provider 3 records and stores that the service user 1 has been authenticated using the authentication ID and the password (175).

The computer of the authentication provider 3 uses the notification ID and the authentication ID change table to use the authentication ID of the service user 1 so that the service provider 2 can identify the service user 1. The ID is changed to the user identification ID and the signature of the authentication provider 3 is attached (180).

The authentication ID change table indicates how this change is performed by the service user 1 and the authentication provider 3
It is a table created by the intention of FIG. 6 shows an example of this authentication ID table. The authentication ID table in FIG. 6 refers to the default table in FIG. The computer of the authentication provider 3 sends the session random number B and the user identification ID to the computer of the service user 1 (1
90).

Next, the computer of the authentication provider 3 updates the accounting information for the service provider 2 (195). FIG. 7 shows an example of this billing information. It is stated that this fee is 10 yen per provision of authentication. Next, the computer of the authentication provider 3 updates the accounting information for the service user 1 (196). FIG. 8 shows an example of this billing information.
It is stated that this fee is 10 yen per provision of authentication. In this billing, 1 yen is charged for one provision of authentication.

The computer of the service user 1 records the session random number B (197). The computer of the service user 1 sends the session random number B and the user identification ID to the computer of the service provider 2 (198).

The computer of the service provider 2 confirms the signature of the session random number 3 and the signature of the user identification ID, and confirms that it is the user identification ID issued by the computer of the authentication provider 3 (199).

The computer of the service provider 2 identifies the service user 1 using the user identification ID,
A process for enabling the service user 1 to view the accessible HP is performed (200). Through the above processing, the service user 1 can browse the membership-based HP (210).

According to the flowcharts of FIGS. 2 and 3, the service provider 2 obtains the authentication result of the service user 1 without directly authenticating the service user via the computer of the authentication provider 3. Can be. As an effect, the service provider 2 does not need to distribute and manage passwords, which are information for authenticating many service users 1, to the service users 1.

According to this flow, when a service user 1 uses a plurality of service providers 2, the service user 1 receives individual authentication for each of the plurality of service providers 2. Not one authentication provider 3
Authentication from the computer. The effect is
The service user 1 does not need to store the passwords received from the many service providers 2, but only needs to store the authentication ID and the password, which are the authentication information received from the authentication provider 3, and stores the authentication information. Is easy to manage.

According to this flow, the computer of the authentication provider 3 changes the authentication ID and sends it to the service provider 2. As a result, even when the service users 1 are the same, different user identification IDs can be transmitted to the respective service providers 2.

As an effect, it is possible to prevent a plurality of service providers 2 from colluding and grasping the behavior of the service user 1. That is, service user 1
Is transmitted to a plurality of service providers 2 without changing the ID, the same ID is used by the plurality of service providers.
If the information of the service user 1 is exchanged, the action history of the service user 1 can be grasped, and there is a risk of privacy infringement. Also, for example, one service user 1 can request the authentication provider 3 to notify the service provider 2 as if they were two service users.

Further, according to this flow, the notification contents of the service user 1 provided to the service provider 2 are:
You can specify it yourself. Thus, for example, under the agreement between two service users having different authentication IDs, the two users send the same user identification ID to a service provided by a certain service provider 2. Can be requested to the authentication provider 3. In this embodiment, the service user 1 has the authentication IDs 10 and 2
0, and the default table in the case where the service provider 2 is S4 Corporation corresponds to this, and the user identification ID notified to S4 Corporation at this time is 100
Becomes Further, in this case, there is no need to share the respective authentication IDs and passwords between the two service users, and the other service providers 2 do not interfere with each other and maintain security. It is. This means, for example, that the service user 1 in the family has the same user identification I.
It can be assumed that the service is used when the user wants to receive a service at D. The above two parties agree, for example, to input a request for one to access the computer of the authentication provider 3, change the default table, and notify a certain service provider 2 of the same user ID as the other. Then, the authentication provider 3 sends the fact to the other, and the other is obtained by inputting the approval to the computer of the authentication provider 3 or the like. In this case, if necessary, the authentication provider 3 sends a message to the service provider 2 to acknowledge this identification, and the service provider 2 confirms that the authentication provider understands the identification. It is also possible to input data to the third computer and the like.

In the above embodiment, the service provider 2 performs a procedure for inputting an authentication request for requesting the authentication provider 3 to authenticate the service user 1 to the computer of the authentication provider 3. However, this can be modified so that the service user 1 performs this.

In the above embodiment, the procedure of inputting the authentication request or the notification content designator into the computer of the authentication provider 3 is performed immediately before the authentication provider 3 authenticates the service user 1. This can be modified as follows.

First, the authentication provider 3 performs a procedure for authenticating the service user 1. Next, each time the service user 1 receives the service of one or a plurality of service providers 2, the service provider 2 or the service user 1 inputs an authentication request to the computer of the authentication provider 3, and then the service The user 1 performs a procedure of inputting a notification content designator to the computer of the authentication provider 3. That is, the authentication provider 3
Can be modified so as to perform the procedure of authenticating the service user 1 before the authentication request, and then to perform the procedure of inputting the authentication request and the notification content designator to the computer of the authentication provider 3 as necessary. it can.

As a modification of the above embodiment, the service user 1 and the service provider 2 are different. In the above embodiment, the computer of the authentication provider 3 is
Has been described, and the service user 1 inputs the notification content specifier to the computer of the authentication provider 3. However, as a modification of the present embodiment, the service user 1 Instead of sending the child to the computer of the authentication provider 3, the computer of the authentication provider 3 can change the authentication ID using the default table of FIG.

Similarly, in the above embodiment, the computer of the authentication provider 3 authenticates the service provider 2, and the service user 1 inputs the notification content designator to the computer of the authentication provider 3. Although an example has been described, as a modified example of the present embodiment, the computer of the authentication provider 3 does not authenticate the service provider 2 and the notification content specifier is determined by the computer of the authentication provider 3 at the discretion of the service user 1. Can also be entered.

FIG. 10 shows an example of the authentication ID change table used by the computer of the authentication provider 3 in this case.
In the present embodiment, the authentication provider 3 is the service provider 2
Is performed at the same time as receiving the authentication request from the service provider 2 by using the electronic signature,
As a modified example of the present embodiment, the method in which the authentication provider 3 authenticates the service provider 2 is not an electronic signature, but the authentication provider 3 distributes the service provider 2 in advance to the service provider 2. Using the ID and the password, the authentication provider 3 can authenticate the service provider 2 by making the service provider 2 input the information to the computer of the authentication provider 3.

Further, as a modification of the present embodiment, the computer of the service user 1 and the computer of the service provider 2 may include the service user itself, a portable home electric terminal,
An IC card or a terminal that can use the IC card is also possible.

As a modification of the present embodiment, the service provider 1 authenticates the service provider 2 and authenticates the service provider 2, as opposed to the service provider 2 obtaining the information of the service user 1. It is obvious that the present invention can be used in a method of obtaining the authentication result of the service provider 2 by requesting the service provider 2.

[0094]

As described above, according to the present invention,
Since the authentication provider intervenes between the service provider and the service user, the service provider and the authentication information that the service user needs to manage can be reduced, and the service provider and the service user can be reduced. Can easily manage the authentication information.

Further, from the standpoint of the service user, the authentication provider can transmit the authentication information of the service user to the service provider while protecting privacy.

Further, the authentication provider can notify the service provider of the plurality of service users as the same service user according to the instruction of the service user.
The convenience of service users is improved.

[Brief description of the drawings]

FIG. 1 is an overall configuration diagram of a service providing system according to an embodiment of the present invention.

FIG. 2 is a diagram showing a preparatory flow for providing authentication.

FIG. 3 is a diagram showing a flow of providing authentication.

FIG. 4 is a diagram showing an example of a default table possessed by an authentication provider.

FIG. 5 is a diagram showing an example of an automation table of a service user.

FIG. 6 is a diagram showing an example of an authentication ID change table of an authentication provider.

FIG. 7 is a diagram showing an example of a billing table for a service provider.

FIG. 8 is a diagram showing an example of a billing table for a service user.

FIG. 9 is a diagram showing an authentication providing flow which is a modification of the part described in FIG. 3;

FIG. 10 is a diagram showing an authentication ID change table of the authentication provider when the authentication provider does not authenticate the service provider.

[Explanation of symbols]

 1 service user 2 service provider 3 authentication provider

Claims (19)

[Claims] A service providing means for providing a service in accordance with a service providing request from the service using means; and an authentication providing means for authenticating the service using means or the service providing means. An authentication providing unit configured to authenticate the service providing unit and / or the service using unit in accordance with an authentication request from the service using unit and / or the service providing unit; and transmitting the authentication result to the service using unit and / or the service Means for notifying to a providing means, wherein the service using means and / or the service providing means comprises means for designating an authentication result notification form in which the authentication providing means notifies the service providing means and / or the service using means. The notifying means includes the server A service providing system, comprising: a service using unit and / or a unit for giving a notification in an authentication result notification form designated in advance by the service providing unit. 2. The service providing means comprises means for requesting the authentication providing means to authenticate the service using means in accordance with a service providing request from the service using means, wherein the authentication providing means comprises: And a means for notifying the service providing means of a result of the authentication, and notifying the service providing means that the service using means is authenticated in accordance with the authentication notification. 2. The service providing system according to claim 1, further comprising means for providing a service. 3. The service providing apparatus according to claim 1, wherein said authentication providing means includes a database in which a correspondence relationship between information of said service using means and information of said service providing means and an authentication result notification form are recorded. system. 4. The service providing system according to claim 3, wherein the correspondence relation can be set to one to a plurality. 5. The service providing system according to claim 3, further comprising means for adding or changing the recorded contents of said database. 6. The service providing system according to claim 1, further comprising: means for recording an execution status of the authentication notification; and means for creating billing information in accordance with the recording. 7. The computer device according to claim 1, wherein said computer device is further installed on a computer device having predetermined hardware and predetermined basic software installed on said hardware. A recording medium on which software is recorded as an apparatus corresponding to the service providing system. 8. A procedure in which the authentication providing unit receives a request for the service providing unit to notify the service providing unit of identification information for identifying the service using unit. A service providing method, comprising: a step of authenticating a service using unit; and a step of notifying the service providing unit of identification information of the service using unit authenticated by the authentication providing unit. 9. A procedure in which, prior to the notifying procedure, the authentication providing unit receives a notification content designator, which is information for specifying the identification information notified by the authentication providing unit by the service using unit, 9. The service providing method according to claim 8, further comprising: a step of changing the identification information to be notified to the service providing unit by the notification content designator. 10. The service providing method according to claim 8, wherein the authentication providing unit includes a step of authenticating the service providing unit, prior to the notification procedure. 11. Prior to a procedure in which the authentication providing unit receives the notification content designator, the authentication providing unit may identify the service using unit by the service using unit for identifying the service providing unit. The service providing method according to claim 9, further comprising a step of transmitting information. 12. The service providing means according to the result of authenticating the service providing means or the result of authenticating the service providing means and the notification content designator prior to the notifying procedure. 9. The service providing method according to claim 8, further comprising the step of changing the notification content of the identification information of the service using means to be notified to the user. 13. The authentication providing unit, wherein the authentication providing unit authenticates the service using unit or the service providing unit before the authentication providing unit authenticates the service using unit or the service providing unit. And a step in which the authentication providing unit receives a request to send the service using unit or the authentication providing unit and identification information used by the service providing unit to the service using unit or the service providing unit. Receiving the authentication providing means, and notifying the service using means or the service providing means of identification information used by the authentication providing means to authenticate the service using means or the service providing means. 8. The service providing method according to 8. 14. The service providing method according to claim 13, further comprising a step of, prior to the accepting step, requesting the service providing unit to notify the identification information of the service using unit. 15. A procedure for changing the notification content of the identification information of the service using means to be notified to the service providing means, the identification information of the service using means, the identification information of the service providing means, and the notification content designation. 10. The service providing method according to claim 9, further comprising a step of using a database that associates all or some of the three with the child. 16. A database associating all or a part of three of the identification information of the service using unit, the identification information of the service providing unit, and the notification content specifier, prior to the procedure of changing the notification content. 16. The service providing method according to claim 15, further comprising: a step of receiving information for adding or changing data; and a step of using the information to add, update, or delete the database. 17. The service providing method according to claim 16, further comprising a step of requesting the service providing unit to notify the service providing unit of a result of authentication of the service using unit, prior to the accepting step. 18. A procedure for creating or updating billing information for the service providing means or creating or updating billing information for the service using means according to a notification status of the identification information of the service using means to the service providing means. 9. The service providing method according to claim 8, comprising a procedure or both procedures. 19. The service providing method according to claim 8, further comprising a step of replacing said identification information with identification information and personal information of said service using means.