JP2003044434A - Method and device for authentication information generation - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide easy-to-input authentication information which is used to receive services from a service provider, etc., and corresponds to equipment. SOLUTION: Profile information on the equipment which receives the services is sent to the service provider side and according to the profile information (terminal type, key array, etc.), authentication information is generated which consists of characters and symbols easily inputted through the equipment to facilitate the operation for inputting authentication information.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to user authentication information created by a service provider when a service is provided to a user through a communication line, and more specifically, a personal computer or a mobile phone used by the user. The present invention relates to a generation device that generates authentication information according to a function of an information device or a mobile phone, and a method of generating the authentication information.

[0002]

2. Description of the Related Art Personal computers (hereinafter referred to as personal computers), PDAs (personal digital assistants: Persona)
l Digital Assistant), mobile phones, etc. have become able to connect to the Internet. Therefore, various services can be used from these terminals.

In each of these terminals, the amount of information that can be displayed on the display screen, the method of inputting characters, the initial value of the input mode for inputting characters, and the like differ depending on the manufacturer and model.

Therefore, the service provider side acquires the functions of the hardware and software installed in the terminal, and controls the size of the content to be provided, the presence / absence of image display, etc. according to the acquired function of the terminal. Is being done. Further, a method has been introduced in which an identifier for designating the character input mode of the terminal is embedded in the data transmitted from the service provider side to the terminal side, and the initial input mode is designated when the character is input to the terminal.

Among the above-mentioned terminals, the portable device is designed to be lightweight and small. Therefore, for example, taking the input means of a mobile phone as an example, assigning a plurality of characters to each key of the numeric keypad, and pressing the same key a plurality of
It is designed so that a desired character can be selected by pressing it, and input is performed with a small number of keys. In addition, which character or symbol is assigned to each key often differs depending on the manufacturer or model.

However, conventionally, the user ID and password given to each user by the service provider side are often randomly generated by the service provider side regardless of the terminal or model used by the user. Therefore, even if the user's character input mode is specified as alphanumeric, if the user is given a user ID and password in which multiple alphabets, uppercase letters, and lowercase letters are mixed, the user will receive these services when receiving the service. It was necessary to perform a complicated operation to input the ID and password.
In addition, in order to prevent others from knowing your password, you will usually see the password with an asterisk "*" when you enter it, but with a portable information device that requires complicated input operations as described above. , The password was displayed as it is to prevent incorrect input.

[0007]

As described above, in the conventional authentication information generating method, the authentication information is arbitrarily generated on the service provider side, and therefore a complicated operation is required when the user inputs the authentication information. However, there is a problem that the user is forced to display the information that he or she does not want others to see such as the password in order to input the authentication information accurately.

In order to solve the above problems, the present invention provides an authentication information generating method and an authentication information generating apparatus for generating authentication information that is easy to input from the device according to the device used by the user. And

[0009]

In order to solve the above problems, in the authentication information generating method according to claim 1, a step of receiving an authentication information addition request from a terminal device via a network, and the terminal device. Of the profile information, the step of analyzing the profile information, the step of generating authentication information to be given to the terminal device according to the result of analyzing the profile information, and the generated authentication information to the terminal device. It has been summarized as having a step of sending.

Here, the profile information of the terminal device is
This section gives information for specifying this terminal device and information about operations / functions such as installed software and hardware. The information for identifying the terminal device includes the identification information given to the terminal device, the product model number and version number information, and the identification information given to the user.The software information includes the software name and version. The number and hardware include the type of input device and the initial input mode.
Further, the profile information may include identification information for identifying the terminal device and identification information for the user of the terminal device.

Since the authentication information generating method is configured to generate the authentication information for authenticating the terminal device based on the profile information as described above, the authentication information which can be easily input from the terminal device is input to the terminal device. Can be sent out. Therefore, for example, if the initial input mode can be acquired as the profile information, the authentication information including only the characters and symbols set in the initial input mode can be given to the terminal device.

Further, when unique and highly reliable information such as terminal device identification information and user identification information can be acquired, even if the number of characters of the authentication information to be given is set to be short, that authentication information and the terminal By checking the correspondence with the identification information, the authenticity of the authentication information can be determined, and the user can use the authentication information that is easier to input.

Further, the invention of claim 2 is characterized in that the characters and / or symbols forming the authentication information and the number of the characters are set according to the type of the acquired profile information, and the authentication information is generated. The gist is the authentication information generation method according to claim 1.

Further, in the invention of claim 3, when the acquired profile information includes the identification information of the terminal device or the user identification information, the number of characters of the authentication information given to the terminal device is determined as the identification information of the terminal device or the user identification. The authentication information generation method according to claim 1 or 2, characterized in that the authentication information set to be shorter than the case where no information is included is generated.

Further, in the invention of claim 4, there is provided an authentication information generating device connectable to a terminal device, wherein the authentication information generating device comprises an authentication information request accepting unit for accepting an authentication information addition request from the terminal device. A profile acquisition unit that acquires profile information of the terminal device, a profile information analysis unit that analyzes the acquired profile information, and a character, a symbol, or a character used for the authentication information given to the terminal device according to the analysis result of the profile information. It has an authentication information generation unit that determines the information length that constitutes the authentication information and that generates authentication information based on the determined characters and symbols and information length, and a transmission unit that transmits this authentication information to the terminal device. The characteristic is the authentication information generation device.

Further, in the invention of claim 5, the essence is an authentication information generating apparatus characterized in that the profile information includes unique information possessed by the terminal device and information regarding software or hardware.

[0017]

BEST MODE FOR CARRYING OUT THE INVENTION In the embodiments of the present invention described below, a user accesses a service provider side,
The case where the authentication information is generated on the service provider side will be described as an example, but the present invention is not limited to this example.
This is applicable when generating authentication information according to the function of the terminal device for which authentication information is requested.

The outline of the present invention will be described with reference to the diagram showing the principle configuration of the present invention shown in FIG. In FIG. 1, the terminal device 1 is a terminal device that requests the service provider side device 10 to generate authentication information. This terminal device 1 accesses the service provider side device 10 via a wired or wireless communication line 5 and performs an input procedure such as predetermined user registration, and the authentication information generating device 20 in the service provider side device 10 It is connected to the input / output unit 22.

The authentication information generating device 20 communicates with the terminal device 1 from the terminal device 1 to the product type and the input device function of the terminal device 1, the installed software and the initial mode of the input device, and the terminal device 1. Of the profile information such as the identification information of the user and the identification information of the user of the terminal device 1, the terminal device analysis unit 24 analyzes the acquired profile information, and assigns it to the terminal device 1 based on the result. Authentication information to be generated is generated by the authentication information generation unit 26 and transmitted to the terminal device 1 via the input / output unit 22.

As an example of analysis by the terminal device analysis section 24,
For example, when the information on the model number of the terminal device 1 can be acquired, the authentication information is generated using these characters and symbol strings based on the characters and symbols that can be used by the device of this model number. Further, when the identification information of the terminal device 1 or the user of the terminal device 1 can be acquired, the identification information having a small number of digits is used in the terminal device 1 by using the identification information as part of the authentication information. To generate.

Next, the first embodiment will be described with reference to FIG. In addition to the configuration of the principle diagram of FIG. 1, Example 1 of FIG.
A profile database 28 holding profile information of various terminal devices 1 such as an initial input mode and a keyboard layout is provided, and the authentication information generation unit 26 extracts the profile of the terminal device 1 analyzed by the terminal device analysis unit 24 from the profile database 28. Search for the length of the authentication information,
Authentication information is generated in consideration of the difficulty or complexity of the input operation on the terminal device 1, and is transmitted to the terminal device 1 via the input / output unit 22.

Note that FIG. 2 shows each functional block, and a control unit for controlling each functional block, a storage unit for storing a program for performing a predetermined operation, and the like are omitted.

The user uses the communication line 5 to connect the terminal device 1
Is connected to the authentication information generating device 20, the input / output unit 22
Receives information from the terminal device 1. Input / output unit 2
2 outputs the received information to the terminal device analysis unit 24, and in the terminal device analysis unit 24, profile information such as the model number of the terminal device 1 is further added to the terminal device 1 from the received information. When the identification information and further the identification information of the terminal user of the terminal device 1 can be acquired, the identification information is transmitted to the authentication information generation unit 26. This authentication information generation unit 2
6, the length of the authentication information is increased or decreased to generate the authentication information depending on the presence or absence of the profile information of the terminal device 1 from the terminal device analysis unit 24 or the identification information such as the terminal device 1 or the terminal user, and the generated authentication information. Is transmitted to the input / output unit 22 and is transmitted to the terminal device 1 via the communication line 5.

If more detailed hardware information of the terminal device 1 can be retrieved from the profile database 28 in the profile information from the terminal device 1 or based on the profile information, the terminal device 1
Depending on the more detailed hardware characteristics of the authentication information, the authentication information is generated by increasing or decreasing the difficulty level and / or the length of the operation at the time of inputting the authentication information,
This authentication information is transmitted to the terminal device 1.

Next, a second embodiment of the present invention will be described with reference to FIG. In this embodiment, a case where a user performs user registration and receives a service from a service provider will be described as an example. The service provider device 200 includes a CGI (Common Gateway Interface).
rface) program 210, a service database 220 including information to be provided to the user, and an authentication information generating device 20.

The service provider apparatus 200 is connected with a portable terminal apparatus 250, a personal computer 260, etc. which are connected to the network 240 by a wireless line 251 and a wired line 252.

Similar to FIG. 2, each functional block is shown in FIG. 3, and a control unit for controlling each functional block and a program for performing a predetermined operation (for example, the CGI program 210 described above). The storage unit and the like for storing is omitted from the drawing.

The service provider device 200 of this embodiment
The authentication information generating device 20, the service database 220, and the user information database 230 storing and accumulating the authentication information issued to the user are provided and configured. The database 220, the user information database 230, etc. may be installed outside the service provider apparatus 200. The terminal device that receives the service may be any device that can be connected to a mobile phone, a personal computer, a mobile information device, or any other network.

In this embodiment, when the user receives the service, the user registration is required as an example. FIG. 4 shows an example of a user registration screen for the user to register as a user in order to use the service provided by the service provider. This screen shows an example using a WWW browser.

The user is the service provider device 200.
(See FIG. 3), this screen is displayed on a browser of a mobile phone or a personal computer, predetermined information is input to the user's name input field 310 and mail address input field 320, and the send button 330 is pressed. If the entered information is incorrect, clear button 340
The screen is configured so that you can re-enter by pressing. The registration information input on this registration screen is delivered to the CGI program 210 (see FIG. 3) of the service provider apparatus 200 via the network.

The CGI program 210 can acquire information such as the type and version of the terminal device and the type and version of the browser, in addition to the information input by the user on the user registration screen. When the service provider apparatus 200 is accessed via the wireless network, the CGI program 210 may be able to obtain identification information called a subscriber ID (subscriber ID) that can identify the terminal apparatus or the user of the terminal apparatus. So CG
The I program 210 first tries to acquire the subscriber ID and the identification information that can identify the user. When the subscriber ID or the identification information that can identify the user can be acquired, the user who is trying to register the user can be easily identified, and the identification information that can identify the subscriber ID or the user can be regarded as a kind of password. User ID, which is the authentication information sent to the user
And password length can be set short.

For example, the initial value of the normal password length is 8
In the case of characters, if the subscriber ID or the identification information that can identify the user can be acquired, the password length can be set to 4 characters to facilitate the user's input operation.

FIG. 5 shows another example of the user registration screen shown in FIG. This user registration screen 350 is an example configured to directly input the profile of the terminal device in addition to the user name input field 310 and the mail address input field 320. In the example of FIG. 5, the model name input field of the terminal device is input. Three
25 is directly input to the user. As described above, with the configuration in which the user inputs various profile information of the terminal device, the service provider side can surely acquire the profile information of the terminal device.

Next, the profile database will be described. FIG. 6 shows an outline of an example of the file format of the profile database 400.

The CGI program obtains the profile name 410 of the terminal device from the registration information sent from the user. This profile name 410 is
Indicates the model name of the terminal device. In the profile database 400, in association with the profile name 410, the manufacturer name 420 of the terminal device, and a type 430 indicating whether the terminal device is a mobile phone, a personal computer, a portable information device, or the like. In addition, an initial input mode 440, a key layout 450, etc. for inputting characters on the terminal device are stored as a database.

In this embodiment, type 430 "c-ph" is used.
"one" indicates a mobile phone, "PC" indicates a personal computer, "PDA" indicates a portable information device, and "number" of the initial input mode 440 indicates that the initial input mode of the terminal device indicated by this profile name is a number. The mode, "alpha-c", indicates that it is a capital letter mode of the alphabet, and "kana" indicates that it is a kana mode.

The key layout indicates the type of key assignment of the terminal of each profile. Besides this information,
It may be configured to store the terminal version, browser type, version, and the like. These pieces of information may be stored in the profile database in advance, or may be configured to use the external database when the database is provided externally.

Next, the procedure for generating the authentication information of the present invention will be described with reference to FIG. 7 showing an example of the authentication information generation processing flow.

When the service provider device receives the registration request from the user (step 50 in FIG. 7).
0), first, the CGI program tries to acquire the subscriber ID (step 505).
If D cannot be acquired (NO in step 510), the CGI program proceeds to the hardware profile acquisition process to try to acquire the profile of the terminal device (step 520).

On the other hand, if the subscriber ID can be obtained (YES in stream 510), the length of the authentication information such as the password is shortened (the number of digits is shortened), and step 5
20 hardware profile acquisition process (step 5
Proceed to 20).

In the case of this embodiment, the hardware profile acquisition processing of step 520 is, for example, "U".
SER It can be obtained by accessing the variable "AGENT". Further, there is a possibility that another detailed profile can be obtained by accessing other variables, and the profile information directly input at the time of user registration shown in FIG. 5 may be used.

When the terminal device profile cannot be acquired (NO in step 525), normal authentication information such as user ID and password is generated without considering the characteristics of hardware (step 545).

On the other hand, if the terminal device profile can be acquired in step 525 (YES in step 525), the file 400 shown in FIG. 6 is searched (step 530), and if the profile information is successfully acquired (step 530). If YES in step 535), an authentication information generation process using this profile is performed (step 540).
In step 535, if the profile acquisition fails due to the case where the profile information is not registered in the file 400 of the profile database 28 (NO in step 535), in step 545,
Normal authentication information generation processing such as user ID and password is performed without considering the characteristics of hardware (step 5).
45).

The upper limit of the number of characters of the information generated in the authentication information generation processing in steps 545 and 540 is set to the value set when the subscriber ID is acquired. Since the user can be easily identified if the subscriber ID can be acquired, the upper limit of the authentication information is the number of characters when the acquisition of the subscriber ID is successful, regardless of whether the profile information can be acquired.

Further, the password length can be lengthened or complicated depending on the type of the terminal device. At the time of generating these authentication information, the generated authentication information is stored in the user information database 230 (see FIG. 3) in step 550 so that the user ID is generated so as not to overlap with the existing user ID. It then sends it to the user by email or displays the generated information in the user's browser.

Next, the authentication information generation processing 540 using the profile in step 540 when the profile can be acquired will be described in detail. It is assumed that the acquired profile is “B501 / i-Browse” (in the case of profile name 410 column 2 line in FIG. 6). The CGI program uses the acquired profile "B501 / i-Bro".
wse ”from the profile database, and the initial input mode“ number ”and key layout“ A type ”
e ”is acquired. Utilizing the characteristics of this hardware,
The authentication information given to the user is generated so that the input operation on the terminal device becomes easy. For example, since it can be seen that the initial input mode at the time of input of this terminal device is the number mode, authentication information consisting of only numbers is given to this terminal device, and the authentication when the user accesses this service provider device is performed. The input mode does not have to be changed when inputting information. As described above, the authentication information generating method and device of the present invention can generate authentication information that is easy to input.

Authentication information that facilitates the input operation may be generated by a method other than the above. When the terminal device is a mobile phone, the authentication information may be generated so as to shorten the length of the authentication information, that is, the number of digits of the authentication information without considering the ease of input.

If the acquired profile name does not completely match the information in the profile database, the authentication information may be generated by using the hardware characteristics that match the manufacturer name.

Further, by utilizing the characteristics of the "Kana-Kanji conversion" software installed in the terminal device, it may be constructed so as to generate authentication information such as a user ID and password in Kanji, and a profile can be acquired. As in the case where the user ID does not exist, the user ID is notified to the user after checking and checking with the issued authentication information recorded in the user information database so as not to overlap with the existing user.

As described above, it becomes possible to generate the authentication information in consideration of the characteristics of the hardware and software of the terminal device, and further the identification information given to the terminal device and its user, and input it to the user. Authentication information that is easy to operate can be added.

In connection with the above description, the following items will be disclosed. (Supplementary Note 1) A step of receiving an authentication information addition request from a terminal device via a network, a step of acquiring profile information of the terminal device, a step of analyzing the profile information, and a step of depending on the analyzed result. A method for generating authentication information, comprising: generating authentication information to be given to the terminal device; and sending the generated authentication information to the terminal device.

(Supplementary Note 2) Depending on the type of the acquired profile information, the characters and /
Alternatively, the authentication information generating method according to appendix 1, wherein the symbol and the number of characters thereof are set and the authentication information is generated.

(Supplementary Note 3) The profile information includes information for identifying the terminal device, information for identifying software installed in the terminal device, information for identifying a device installed in the terminal device, and 3. The authentication information generation method according to any one of appendices 1 and 2, which includes either an initial input mode of the terminal device or information for identifying a user of the terminal device.

(Supplementary Note 4) When the acquired profile information includes the identification information of the terminal device or the user identification information, the number of characters of the authentication information given to the terminal device is determined by the identification information of the terminal device or the user identification information. The authentication information generating method according to appendix 1 or 2, wherein the authentication information set to be shorter than that not included is generated.

(Supplementary Note 5) The profile information is CGI.
Note 1 characterized by being acquired by a program
To the authentication information generating method according to any one of appendix 4.

(Supplementary Note 6) An authentication information generating device connectable to a terminal device, wherein the authentication information generating device is an authentication information request accepting unit for accepting an authentication information addition request from the terminal device, and a profile of the terminal device. A profile acquisition unit that acquires information, a profile information analysis unit that analyzes the acquired profile information, and characters, symbols, or authentication information used for the authentication information given to the terminal device according to the analysis result of the profile information. And an authentication information generation unit that generates authentication information based on the determined characters and symbols and the information length, and a transmission unit that transmits the authentication information to the terminal device. An authentication information generating device.

(Supplementary Note 7) The authentication information generating apparatus according to Supplementary Note 6, wherein the profile information includes unique information of the terminal device and information about software or hardware.

[0058]

Since the authentication information generating method and the authentication information generating device are configured to generate the authentication information according to the function of the terminal device for inputting the authentication information, the input operation of the authentication information can be easily performed. Can be done. Furthermore, by simplifying the input operation, it becomes possible to blind the authentication information.

[Brief description of drawings]

FIG. 1 is a diagram showing a principle configuration of the present invention.

FIG. 2 is a diagram showing a first embodiment of the present invention.

FIG. 3 is a diagram showing a second embodiment of the present invention.

FIG. 4 is a diagram showing an example of a user registration screen.

FIG. 5 is a diagram showing another example of a user registration screen.

FIG. 6 is a diagram showing an example of a file format of a profile database.

FIG. 7 is a diagram showing an example of an authentication information generation processing flow.

[Explanation of symbols]

1 terminal device 10 Service provider side device 20 Authentication information generation device 28 Profile database 210 CGI Program 250 Mobile terminal device 260 personal computer

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Masahiko Murakami             4-1, Kamiodanaka, Nakahara-ku, Kawasaki-shi, Kanagawa             No. 1 within Fujitsu Limited (72) Inventor Junyo Okada             4-1, Kamiodanaka, Nakahara-ku, Kawasaki-shi, Kanagawa             No. 1 within Fujitsu Limited (72) Inventor Yasuhide Matsumoto             4-1, Kamiodanaka, Nakahara-ku, Kawasaki-shi, Kanagawa             No. 1 within Fujitsu Limited (72) Inventor Masahide Noda             4-1, Kamiodanaka, Nakahara-ku, Kawasaki-shi, Kanagawa             No. 1 within Fujitsu Limited (72) Inventor Hideto Kihara             4-1, Kamiodanaka, Nakahara-ku, Kawasaki-shi, Kanagawa             No. 1 within Fujitsu Limited F-term (reference) 5B085 AE01 AE23                 5J104 AA07 KA01 KA02 KA06 NA05

Claims (5)

[Claims] 1. A step of receiving an authentication information addition request from a terminal device via a network, a step of acquiring profile information of the terminal device, a step of analyzing the profile information, and a step of responding to the analyzed result. And a step of generating authentication information to be given to the terminal device, and a step of sending the generated authentication information to the terminal device. 2. The authentication information is generated by setting characters and / or symbols forming the authentication information and the number of the characters according to the type of the acquired profile information, and generating the authentication information. Authentication information generation method. 3. The number of characters of authentication information given to the terminal device when the acquired profile information includes the identification information of the terminal device or the user identification information includes the identification information of the terminal device or the user identification information. The authentication information generation method according to claim 1 or 2, wherein the authentication information set to be shorter than that when there is no authentication information is generated. 4. An authentication information generation device connectable to a terminal device, wherein the authentication information generation device includes an authentication information request reception unit that receives an authentication information addition request from the terminal device, and profile information of the terminal device. A profile acquisition unit that acquires the profile information, a profile information analysis unit that analyzes the acquired profile information, and configures characters, symbols, or authentication information to be used for the authentication information given to the terminal device according to the analysis result of the profile information. The information length to be set, and the specified characters and symbols,
An authentication information generation device comprising: an authentication information generation unit that generates authentication information based on an information length; and a transmission unit that transmits the authentication information to the terminal device. 5. The authentication information generating apparatus according to claim 4, wherein the profile information includes unique information of the terminal device, and information about software or hardware.