Patent ID: 8352743
Filing Date: 2013-01-08
Classification: G06F,G06Q,H04L

Abstract:
1. A client device connected through a network to a service providing apparatus, the client device comprising: a micro-processor or CPU; a client authentication information management unit in the micro-processor or CPU that holds a service information database storing a user ID, a public key, a private key, and a server certificate in association with each service; a control unit in the micro-processor or CPU; a client authentication unit in the micro-processor or CPU; and a key generation unit in the micro-processor or CPU; wherein the control unit has a request function to send a user registration request and a service request to the service providing apparatus; the client authentication unit has a server authentication function to verify server authentication information and an authentication request sent from the service providing apparatus; the client authentication unit has a user information transmission function to obtain a signature for a user ID, a password, a user attribute, and a public key generated by the key generation unit, by using a private key generated corresponding to the public key in the key generation unit, and to send to the service providing apparatus user information that includes the user ID, the password, the user attribute, the public key, and the signature; the client authentication information management unit has a service information registration function to register service information that includes the user ID, the public key, the private key, and a server certificate, in the service information database; and the client authentication unit has an authentication response function to calculate, if an authentication method identified from an authentication policy included in the authentication request sent from the service providing apparatus is password authentication, password authentication information with which the possession of the password can be confirmed, from the password, and to send an authentication response that includes the password authentication information, the authentication method, and the user ID to the service providing apparatus; to calculate, if the authentication method identified from the authentication policy is public key authentication, a signature 1 for the authentication method, the user ID, and a challenge included in the authentication request, and to send an authentication response that includes the signature 1, the authentication method, and the user ID to the service providing apparatus; and to calculate, if the authentication method identified from the authentication policy is public-key-and-password combination authentication, a signature 2 for the authentication method, the user ID, the challenge included in the authentication request, and the password, and to send an authentication response that includes the signature 2, the authentication method, and the user ID to the service providing apparatus.