JP2003091504A - Method of authenticating identification information in bi-directional communication network, communication system and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To increase the number of accessible users and enhance services to the users by speeding up the authentication of identification information (user ID and password) for an access from a user. SOLUTION: A communication terminal (10a, 14a) transmits to a communication network (10, 14) identification information containing a user identification code (ID) and a password and URL of a web server 27-1,..., 27-n to which the communication terminal (10a, 14a) requests to connect. A session communication system Scs receives the identification information from the user communication terminal (10a, 14a) and carries out the authentication processing of comparing the identification information thus received with authentication information stored in advance. When the authentication is normally carried out, the communication terminal is connected to the web server 27-1,..., 27-n to which the communication terminal requests to connect. Thereafter, information (home page contents) is bi-directionally communicated between the communication terminal (10a, 14a) and the web server 27-1,..., 27-n through the line connection by the session communication system Scs.

Description

Detailed Description of the Invention

[0001]

TECHNICAL FIELD The present invention relates to TCP / IP (Tr
An identification information authentication method in a two-way communication network for authenticating a user (client) identification code (ID) and a password in an ansmission Control Protocol / Internet Protocol (intranet, Internet, extranet, etc., described below only in the Internet) And its communication system and program.

[0002]

2. Description of the Related Art Conventionally, in connection with the Internet, for example, dial-up connection, a communication terminal sends a connection point (telephone number) to an Internet Service Provider (ISP) and its URL (Uniform Resource Locators). To access the website by transmitting the user ID and password previously given by the administrator on the website side, and open the homepage by the authentication to browse the content.

FIG. 5 is a block diagram for explaining authentication in a conventional web server. In FIG. 5, in this example, a web server 2 is housed in a communication line network (digital fixed / mobile communication network) 1, and this web server 2
The authentication module 2a is mounted on.

In this example, the authentication of the user ID and password is executed by the authentication module 1a installed in the web server 1. In this authentication module 1a, a database engine searches for a large number of user identification code IDs and passwords stored in advance in a database (D / B) device and a user ID and password for this access. The processing load (load) is large.

Due to this increase in processing load, access is delayed. Due to this access delay, the user ID and password are further transferred from the user communication terminal side, the transmission system traffic volume of the communication network increases, and the communication network load (for example, an interworking function for executing gateway processing is increased. (IWF) processing load on the device may increase and the web server may become congested. In particular, mobile terminals and electronic commerce (EC: Electronic C
ommerce), system down due to excessive traffic volume due to large amount of access to large-scale entertainment websites, and deterioration of access response have become problems for web servers and website administrators.
For this reason, various proposals have been made for a speed-up process for improving the access response on the web server side.

As an example of this, Japanese Patent Laid-Open No. 11-282
No. 804 sends direct request information to the client so that the service server directly accesses the authentication server when the service server does not complete the authentication, and when the authentication server receives the access from the client. Discloses a user authentication method for executing the authentication.

[0007]

As described above, in the conventional example, system down due to excessive traffic volume due to a large amount of access to websites such as mobile terminals, electronic commerce, large-scale entertainment systems, and deterioration of access response. There's a problem.

Further, in the example of the publication of the proposal for improving this,
Since the user ID and password of the client are authenticated after the direct request information is transmitted to the client, there is room for improvement from the viewpoint of speeding up the authentication. In addition, since there is only one authentication server, there is a drawback that due to the limit of the authentication processing capacity, if the number of accesses is large, rapid authentication of the user ID and password cannot be performed.

The present invention solves the problems in the prior art as described above, and the identification in the two-way communication network can speed up the authentication response of the identification information (user identification code (ID) and password) to the access. An object is to provide an information authentication method, a communication system therefor, and a program.

[0010]

In order to achieve the above object, an identification information authentication method in a two-way communication network of the present invention replaces the identification information from a communication terminal in the two-way communication network with an information providing communication device. The proxy communication device authenticates and performs line connection, and the communication terminal transmits the identification information unique to the communication terminal side together with the connection information of the information providing communication device requesting the line connection, and the connection information and The step of performing an authentication in which the proxy communication device receives the identification information and compares the identification information with the authentication information stored in advance, and the proxy communication device is connected when the proxy communication device is successfully authenticated. A step of transmitting information and connecting to the information providing communication device requested to be connected by the communication terminal, and a step of connecting the information communication device with the user communication terminal It is characterized by a step of performing two-way communication for providing and obtaining information through a line connection with the communication device.

According to the present invention, the traffic amount does not increase, the communication network load is reduced, and the congestion state on the information providing communication device side does not occur. That is, the authentication response of the identification information (user ID and password) to the line connection (access) request from the communication terminal can be speeded up. Therefore, for example, system down due to excessive traffic volume due to mass access to mobile terminals, electronic commerce, and large-scale entertainment websites and access response deterioration do not occur. As a result, the number of users that can be accommodated can be expanded, and user service is improved.

Further, the present invention is characterized in that the identification information is a user identification code (ID) and a password. Further, the present invention enables so-called conventional user identification on the Internet or the like.

The identification information authentication communication system of the present invention performs the connection of the line by performing the authentication of the user identification information in the two-way communication network, and the identification code (ID) and the password given to the own device are used. A communication terminal that transmits identification information and connection information of an information providing communication device that requests line connection, an information providing communication device that provides information to the communication terminal through a line connection, and receive identification information and connection information from the communication terminal On the other hand, an agent that performs authentication by comparing the identification information with previously stored authentication information, and when this authentication is normally performed, performs a line connection to the information providing communication device requested to connect from the communication terminal. And a communication device,
The communication terminal and the information providing communication device are characterized by providing and acquiring information by bidirectional communication by line connection through the proxy communication device.

The present invention further includes control execution means for controlling the communication terminal and the information providing communication device to provide / acquire information by bidirectional communication by line connection, and control execution means for acquiring a record of communication, and from the communication terminal. And an authentication processing means for performing authentication for receiving the identification information of the above and comparing it with the authentication information stored in advance.

Here, similarly to the identification information authentication method in the above-described two-way communication network, the authentication response of the user ID and password to the access from the user can be speeded up. Further, the communication system of the present invention is characterized in that the communication terminal is a terminal including a mobile communication terminal in which an application program for executing bidirectional communication is mounted.

The present invention can be applied to a so-called fixed communication terminal (for example, a small general-purpose computer) that executes Internet communication, as well as a mobile communication terminal (in particular, a mobile phone having a dedicated application program (browser)). become.

Further, in the communication system of the present invention, the control execution means is provided with an information storage section which indicates whether or not to identify the identification information with respect to the information providing communication device which requests the line connection from the communication terminal. Is characterized by. Further, the control execution means is provided with a record storage unit for storing a record of communication between the communication terminal and the information providing communication device that is required to connect to the line.

In the communication system of the present invention, the information storage unit includes
The information providing communication device that requests line connection from the communication terminal
When the information indicating that the identification information is not identified is stored, the identification information is not identified, and the communication terminal and the information providing communication device directly perform the information through the two-way communication by the line connection through the proxy communication device. It is characterized by providing and acquiring.

According to the present invention, the setting when the user identification information is identified or not is facilitated. Furthermore, the communication system of the present invention includes a solid-state storage device in the authentication processing unit, stores authentication information in advance in the solid-state storage device, and
The solid-state storage device is characterized by performing authentication by comparing the received identification information with authentication information stored in advance.

In the present invention, the solid-state storage device (memory) is used, and since the authentication by the authentication module (tracking by the D / B engine) is not executed unlike the conventional web server, it is encrypted. The processing load of the authentication search of the stored large number of authentication information (user ID and password) and the authentication information by this access is reduced,
No line connection request (access) delay occurs.

Further, in the communication system of the present invention, the bidirectional communication network is a TCP / IP environment communication network, but various applications can be made to the Internet, intranet, extranet and the like.

According to the program of the present invention, in the identification information authentication communication system in which the proxy communication device authenticates the identification information from the communication terminal in the two-way communication network to establish a line connection, the proxy communication device identifies the communication terminal. The step of receiving the information, the step of performing the authentication for comparing the received authentication information with the authentication information stored in advance, and the line connection is requested from the user communication terminal when the authentication is normally performed. A substantial computer executes control of the step of connecting a line to the information providing communication device and the step of performing a process of providing and acquiring information by bidirectional communication between the communication terminal and the information providing communication device. Is characterized by.

According to the present invention, the proxy communication device executes the program so that the identification code (user I) for the line connection request (access) from the user is executed.
It becomes possible to speed up the authentication response of (D and password).

[0024]

BEST MODE FOR CARRYING OUT THE INVENTION Next, embodiments of an identification information authentication method in a two-way communication network, a communication system therefor, and a program of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a communication network diagram to which the embodiment of the present invention is applied. In FIG. 1, in this example, a digital mobile communication network 10 accommodates a plurality of mobile terminals (a mobile phone in this example, which corresponds to a communication terminal in the claims) 10a that execute Internet access in a wireless section (air interface). In addition, the digital mobile communication network 10 is connected to the router 13.

A plurality of communication terminals (small general-purpose computers in this example) 14a for accessing the Internet are connected to the digital fixed communication network 14, and the digital fixed communication network 14 responds to an IP address of TCP / IP. It is connected to the router 13 that executes relay route control. A plurality of load balancers 16 for load balancing are connected to the router 13, and the load balancer 1
A plurality of gateway (GW) servers 18 (corresponding to control execution means in claims) are connected to the server 6.

An internal local area network (LAN) is connected to the GW server 18, and the accounting server 23 and the authentication server 24-1 ... Are connected to the internal LAN through a router 22 that controls relay of the network layer.
24-n (corresponding to the authentication processing means in the claims) is provided. In addition, NTP (Network
Time Protocol (Server) 25, NFS (Network File Sy)
stem) server 26 and mobile terminal 10a or communication terminal 1
Web server 27-1 to be accessed from 4a ...
27-n (corresponding to the information providing communication device in the claims) is provided.

The GW server 18 is an application program interface (API) that can be called from an application under an operating system (OS) environment as needed.
ace) 18a.

Authentication of the user ID and password (PW) is executed by the API 18a, and the web server 27-1 ... 27-n.
Table 18b (corresponding to the information storage unit in the claims) indicating whether or not to perform each URL.

Hereinafter, the load balancer 16 and the GW server 1
8. The configuration from the billing server 23 to the NFS server 26 is referred to as a session communication system Scs (corresponding to the proxy communication device in the claims) and described. The session communication system Scs uses two system-to-system communication logical connection relationships (session management) between the mobile terminal 10a or communication terminal 14a side and the web server 27-1 ... 27-n side.
Performs user ID and password authentication centrally.

Next, the operation of the embodiment of the present invention will be described. First, the operation of the main part in the configuration of FIG. 1 will be described. TCP / IP is used for the communication terminal 14a, the GW server 18, the web servers 27-1, ...
An application program (for example, web browser software / web server software) that executes bidirectional communication is installed. Further, the mobile terminal 10a is equipped with an application program (for example, a browser described in a dedicated HTML tag) that executes bidirectional communication different from that of the above device.

The GW server 18 uses the user identification code (I) for the access from the mobile terminal 10a or the communication terminal 14a.
D) and the authentication such as the password, the authentication server 24-1
... Executed in conjunction with 24-n. This GW server 18
Is a web server (web server 27-1 ... 2) through two-way communication by a line connection (link) between the mobile terminal 10a or the communication terminal 14a side and the web server 27-1 ... 27-n.
7-n) Information provision / acquisition is processed. That is, GW
The server 18 executes session management and reverse proxy (proxy) for performing proxy access to the back-end web servers 27-1 ... 27-n for the mobile terminal 10a or the communication terminal 14a.

The billing server 23 collects the session log from the GW server 18 and creates billing information by a list of data items. For example, CSV (Comma Separated Va
lue) format.

The authentication servers 24-1 ... 24-n manage and authenticate user IDs and passwords. Users (mobile terminal 10a and communication terminal 1
4a) has an expandability by a redundant configuration so that it can cope with an increase in 4a).

The authentication servers 24-1 ... 24-n are provided with memories 24-1a ... 24-na (corresponding to the "solid-state storage device" in the claims).
a ... 24-na is used to authenticate the user ID and password. Therefore, unlike the conventional case, since the tracking by the D / B engine is not executed, the authentication of the user ID and the password is accelerated without delay.

The NTP server 25 is for time synchronization inside the session communication system Scs, and is used among servers, for example, the GW server 18, the authentication servers 24-1 ... 24-n,
The time synchronization between the billing server 23 and the NFS server 26 is established.

The NFS server 26 realizes a distributed file system and processes a setting file for data sharing in the GW server 18.

Next, the operation of the embodiment of the present invention will be described. FIG. 2 is a sequence diagram according to the embodiment of the present invention, and FIG. 3 is a diagram for explaining a main part operation in the embodiment of the present invention. Further, FIG. 4 is a flowchart showing a processing procedure of an operation of the session communication system Scs.

In FIG. 2 and FIG. 4, the session communication system S is performed through the transmission from the mobile terminal 10a or the communication terminal 14a to the access point of the communication network (the digital mobile communication network 10 or the digital fixed communication network 14).
In cs, along with the user ID and password (PW, corresponding to the identification information of the claim), the website address of the website 27-1 ... 27-n (URL, corresponding to the connection information of the claim) desired to be browsed by the line connection ) Information is received (step S1 in FIG. 4). The session communication system Scs stores records of these communications in the record storage unit.

3 and 4, in the session communication system Scs, the user ID, password (appropriately described as user information), and user-specified URL are the router 1
3. It is taken in by the GW server 18 through the load balancer 16 (step S2 in FIG. 4). GW server 18
27-n in the API 18a is provided with a table 18b indicating whether or not each of the websites 27-1 to 27-n authenticates the user ID and the password (PW). The table 18b includes the website 27-1. … User ID and password (PW) for each 27-n URL
The necessity / unnecessity of authentication of is stored.

As a result of referring to this table 18b, if the URL of the website 27-1 ... 27-n requiring authentication (step S3: Yes), the API 18a sends the user information and the user-specified URL to the authentication server 24-1. … 24
-Transfer to n. In the authentication server 24-1 ... 24-n,
User registration for each URL (user ID,
The memory 24-1a ... 24-na provided with (PW) is provided, and here, the user ID and password that have been encrypted and stored in advance by tracking, and the current GW
The user ID and password transferred from the server 18 are collated.

In step S3, if the URL of the website 27-1 ... 27-n that does not require authentication (No),
In the subsequent step S5, the mobile terminal 10a or the communication terminal 14a and the websites 27-1 to 27-n execute the provision and acquisition of the homepage content through the two-way communication through the line connection (link).

Authentication server 24-1 from API 18a ...
Transfer of user information (user ID, PW) and user-specified URL to 24-n is performed as follows.

When a result indicating that authentication of the user information in the table of the GW server 18 is required is obtained,
A plurality of authentication servers are accessed by a round robin method, user information is transferred, and authentication is performed. Since multiple authentication servers have a redundant configuration and the same data is stored, even if some authentication servers go down, the remaining authentication servers can be used to continue operation.

After the transfer, the session communication system Scs (table 18b or authentication server 24-1)
Add session identification code (ID) to user information,
The subsequent processing is executed (step S5). Next, the session communication system Scs accesses any one of the web servers 27-1 ... 27-n having the authenticated user-specified URL.

In FIG. 3, the accessed web server 27-1 ... 27-n (one of them) returns the result information of the accessed access to the session communication system Scs (step S6). , This result information G
The data is stored in the W server 18 (step S7).

Then, the URL storing the user information is returned to the mobile terminal 10a or the communication terminal 14a through the communication network (step S8). After that, the mobile terminal 10a or the communication terminal 14a and the accessed web server 27-1 ... 27-n (one of them) are confirmed by the session ID through the link. Home page (HP) content is provided and browsed by two-way communication (step S9). After this,
The GW server 18 recognizes the transfer of the end character symbol (descriptor) in the two-way communication for browsing the home page, and stores the communication record in the record storage unit (step S10). Then the link is disconnected.

Session communication system Scs from the same mobile terminal 10a or communication terminal 14a thereafter
Web server 27-1 which is the same as the above-mentioned processing through
For access to 27-n, the following processes (1) and (2) are performed.
Execute (3). (1) Session ID, user information (user ID, password) in this access, and user designation U
The RL is stored and the session I for the next access is stored.
If D, the user information, and the user-specified URL are the same as the last time, authentication and session ID are not performed. (2) The user information (user ID, PW) and the user-specified URL are stored in a database device or a memory (not shown in FIG. 1) connected to the GW server 18 for a fixed period or irregular period. The database device or the memory is selected by the storage capacity of the session communication system Scs, the same user information (user ID, PW), and the user-specified URL.
It may be determined from the access history by considering the number of accesses. (3) The session ID and the user information (user ID, PW) in this access and the user-specified URL are not stored for a fixed period of time or irregularly, and authentication and a session ID are given for each access.

Further, the GW server 18 records logs required for managing these sessions in the recording storage section.
In the log, a user ID, a password, a session start time, a session end time, a transfer byte count, an authentication result, a URL address for which access is requested, and the like are recorded.

Using this log, for example, the billing server 2
3 can create billing data. As a feature of such a billing system, billing can be made for each accessed URL address, so that applications such as billing separately for personal use and company business use are possible.

This session communication system Scs
In the session authentication by the NTP server 25, the NTP server 25 uses a server such as G
Time synchronization is established among the W server 18, the authentication servers 24-1 ... 24-n, the billing server 23, and the NFS server 26.
Also, the NFS server 26 processes a setting file for data sharing in the GW server 18 in the distributed file system.

[0052]

As described above in detail, in the present invention, the customer side communication terminal transmits the identification information including the user ID and the password and the URL of the web server requesting the line connection to the communication line network. In this case, the session communication system Scs receives the identification information from the user communication terminal and executes the authentication to compare with the authentication information stored in advance. When the authentication is normally performed, the communication terminal Connect the line to the web server for which the line connection was requested by. After that, the communication terminal and the web server provide / acquire information by two-way communication by line connection through the session communication system, so that identification information (user ID) for the line connection (access) request from the customer side communication terminal is provided. (And password) authentication response processing has been speeded up.

As a result, in the present invention, the traffic amount does not increase, the communication network load is reduced, and the congestion state on the information providing communication device (web server) side does not occur. Thereby, the authentication of the identification information (user ID and password) for the access from the user is accelerated, and as a result, the number of users accommodated is expanded,
At the same time, it is possible to improve user service.

[Brief description of drawings]

FIG. 1 is a communication network diagram to which an embodiment of the present invention is applied.

FIG. 2 is a sequence diagram according to the embodiment of the present invention.

FIG. 3 is a diagram for explaining an operation of a main part in the embodiment of the present invention.

FIG. 4 is a flowchart showing a processing procedure of an operation of the session communication system implementing the present invention.

FIG. 5 is a block diagram for explaining authentication in a conventional web server.

[Explanation of symbols]

Scs session communication system 10 digital mobile communication network 10a mobile terminal 14 digital fixed communication network 14 14a communication terminal 18 gateway (GW) server 18a application program interface (API) 18b table 24-1 ... 24-n authentication server 24-1a ... 24-na memory 25 NTP server 26 NFS server 27-1 ... 27-n web server

Claims (10)

[Claims] 1. A user identification information authentication method in a two-way communication network, in which a proxy communication device authenticates identification information from a communication terminal in a two-way communication network and a proxy communication device authenticates the line connection, A step in which a communication terminal transmits identification information unique to the communication terminal side together with connection information of the information providing communication device requesting line connection; and the proxy communication device receives the connection information and identification information, and the identification information Authenticate by comparing with the authentication information stored in advance, and when the authentication is normally performed by the proxy communication device, the proxy communication device transmits connection information and is requested to connect from the communication terminal. A line connecting to the information providing communication device, and the user communication terminal and the information providing after the line connecting at the proxy communication device Identity authentication method in a bidirectional communication network, characterized in that it consists of steps and, the steps of executing the two-way communication for providing and obtaining information through a line connection with the communication apparatus. 2. The identification information is user identification code (I
The identification information authentication method in a two-way communication network according to claim 1, characterized in that it is D) and a password. 3. An identification information authentication communication system for performing line connection by performing authentication on behalf of identification information in a two-way communication network, wherein an identification information and a line including a user identification code (ID) and password assigned to its own device. A communication terminal that transmits connection information of an information providing communication device that requests connection, an information providing communication device that provides information to the communication terminal through a line connection, and receives the identification information and the connection information from the communication terminal. In addition, authentication is performed by comparing the identification information with previously stored authentication information, and when this authentication is normally performed, a line connection is made to the information providing communication device requested to be connected by the communication terminal. A proxy communication device for performing information, the communication terminal and the information providing communication device providing information by two-way communication by line connection through the proxy communication device.
An identification information authentication communication system characterized by acquiring. 4. The identification information authentication communication system according to claim 3, wherein the communication terminal is a terminal including a mobile communication terminal in which an application program for executing bidirectional communication is mounted. 5. As the proxy communication device, a control execution unit for performing control for providing / acquiring information by bidirectional communication between the communication terminal and the information providing communication device and for acquiring a record of communication. The identification information authentication communication system according to claim 3, further comprising: an authentication processing unit that receives the identification information from the communication terminal and performs authentication to compare with the authentication information stored in advance. 6. The control execution means is provided with an information storage section that indicates whether or not to identify the identification information with respect to the information providing communication device that requests line connection from the communication terminal. The identification information authentication communication system according to claim 5. 7. The control execution means is provided with a record storage section for storing a record of communication between the communication terminal and the information providing communication device that is requested to connect to a line. Identification information communication system. 8. The solid-state storage device is provided in the authentication processing unit, authentication information is stored in advance in the solid-state storage device, and the received identification information and the authentication information stored in advance in the solid-state storage device are stored. The identification information authentication communication system according to claim 5, wherein authentication is performed by comparison. 9. The identification information is identified when the information storage unit stores information indicating that the information providing communication apparatus requesting a line connection from the communication terminal does not identify the identification information. 7. The identification information authentication communication system according to claim 6, wherein the communication terminal and the information providing communication device directly provide and acquire information by two-way communication by line connection through the proxy communication device. . 10. An identification information authentication communication system in which a proxy communication device authenticates identification information from a communication terminal in a two-way communication network to establish a line connection, wherein the proxy communication device receives the identification information from the communication terminal. The step of receiving, the step of authenticating the received authentication information and the authentication information stored in advance, and the step of requesting a line connection from the user communication terminal when the authentication is normally performed. A step of performing line connection to the information providing communication device; a step of performing a process of providing and acquiring information by bidirectional communication through the line connection between the communication terminal and the information providing communication device. A program characterized in that a computer executes control.