Authentication device and authentication method for single sign-on

An authentication device comprising:

• a processor configured to:
• execute, when a user terminal accesses a service provider system, an authentication process based on an authentication request that comprises a description pertaining to an authentication condition and an authentication method that correspond to the service provider system, the description comprised in the authentication request indicates that a first authentication method is to be implemented when the authentication condition is satisfied, and that a second authentication method is to be implemented when the authentication condition is not satisfied;
• generate history information, the history information including comprising information indicating whether the authentication condition is satisfied and information indicating a result of executing the authentication process by using the authentication method;
• decide whether the authentication condition is satisfied when the authentication device receives the authentication request;
• execute user authentication by using the first authentication method and generating the history information that comprises the information indicating the authentication condition is satisfied when the authentication condition is satisfied, and
• execute user authentication by using the second authentication method and generating the history information that comprises the information indicating the authentication condition is not satisfied when the authentication condition is not satisfied;
• and
• a communication unit configured to transmit the history information to the user terminal.

An authentication method comprising:

• executing, when a user terminal accesses a service provider system, an authentication process based on an authentication request that comprises a description pertaining to an authentication condition and an authentication method that correspond to the service provider system, the description comprised in the authentication request indicates that a first authentication method is to be implemented when the authentication condition is satisfied, and that a second authentication method is to be implemented when the authentication condition is not satisfied;
• generating history information, the history information comprising information indicating whether the authentication condition is satisfied and information indicating a result of executing the authentication process by using the authentication method;
• deciding whether the authentication condition is satisfied when the authentication request is received;
• executing user authentication by using the first authentication method and generating the history information that comprises the information indicating the authentication condition is satisfied when the authentication condition is satisfied;
• and
• executing user authentication by using the second authentication method and generating the history information that comprises the information indicating the authentication condition is not satisfied when the authentication condition is not satisfied;
• and
• transmitting the history information to the user terminal.

A communication method for processing a login request from a user terminal in a communication system that comprises a first service provider system, a second service provider system, and an authentication system, the method comprising:

• transmitting, by the user terminal, the login request to the first service provider system;
• generating, by the first service provider system, in response to the login request, an authentication request that comprises a description pertaining to an authentication condition and an authentication method, the description comprised in the authentication request indicates that a first authentication method is to be implemented when the authentication condition is satisfied, and that a second authentication method is to be implemented when the authentication condition is not satisfied;
• transmitting, by the user terminal, authentication information corresponding to the authentication request to the authentication system;
• executing, by the authentication system, an authentication process for the authentication information in accordance with the description comprised in the authentication request;
• generating, by the authentication system, history information, the history information comprising information indicating whether the authentication condition is satisfied and information indicating a result of executing the authentication process by using the authentication method;
• generating, by the authentication system, a token comprising the history information and a signature identifying the authentication system;
• transmitting, by the authentication system, the token to the user terminal;
• transmitting, by the user terminal, the token to the first service provider system and the second service provider system;
• accepting, by the first service provider system, login of the user terminal when the history information and the signature comprised in the token satisfy an authentication policy of the first service provider system;
• accepting, by the second service provider system, login of the user terminal when the history information and the signature comprised in the token satisfy an authentication policy of the second service provider system;
• deciding, by the authentication system, whether the authentication condition is satisfied when the authentication system receives the authentication request;
• executing, by the authentication system, user authentication by using the first authentication method and generating the history information that comprises the information indicating the authentication condition is satisfied when the authentication condition is satisfied;
• and
• executing, by the authentication system, user authentication by using the second authentication method and generating the history information that comprises the information indicating the authentication condition is not satisfied when the authentication condition is not satisfied.