JP2005311904A - Authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system in which correctness of a user can be easily confirmed. <P>SOLUTION: In an authentication system 1 of the present invention, a service providing device 40 receives an encrypted electronic ticket from a mobile terminal 10 and decrypts it. Terminal specification information contained in the electronic ticket is then collated with previously owned invalid terminal specification information to determine validity of the mobile terminal 10. Thus, in the service providing device 40, correctness of a user can be confirmed on a stage that the electronic ticket is read from the mobile terminal 10, without inquiring to another server or the like. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an authentication system.

In recent years, services provided using networks have been diversified. In one aspect of this service diversification, an encryption technique is used when exchanging information such as content (see, for example, Patent Document 1).
JP 2000-188616 A

  By the way, it is also assumed that the service provider sends information such as an electronic ticket to the user's terminal, and the user receives a service from the service provider using the electronic ticket stored in the terminal. In this case, the encryption technique as described above can improve tamper resistance of exchanged information (such as an electronic ticket), but does not contribute to proving the legitimacy of the user in the first place.

  Here, in order to evaluate the legitimacy of the user, for example, when the user receives a service, the service providing device (such as a ticket gate device in the case of a transportation service) installed by the service provider reads the electronic ticket. It is conceivable to confirm the legitimacy of the user. However, in order to confirm the legitimacy of the user, a complicated procedure is required, and the problem of communication resources occupied to execute the procedure cannot be overlooked.

  Therefore, an object of the present invention is to provide an authentication system that can easily confirm the legitimacy of a user.

  The authentication system of the present invention is a request receiving means for receiving an issuance request for an electronic ticket transmitted from a communication terminal and used for the user of the communication terminal to enjoy the service, and in response to receiving the issuance request, Ticket issuing means for issuing an electronic ticket including terminal specifying information for specifying a communication terminal, ticket transmitting means for transmitting the issued electronic ticket to a communication network to which the communication terminal belongs, and the transmitted An encryption unit that receives the electronic ticket and encrypts it with the secret key information; and an intra-network transmission unit that exists under the communication network and transmits the electronic ticket encrypted by the encryption unit to the communication terminal. A revocation information storage means for storing revocation terminal specifying information for specifying a communication terminal whose use has been stopped in a communication network, and a communication terminal The ticket receiving means for receiving and decrypting the encrypted electronic ticket, the terminal specifying information included in the decrypted electronic ticket, and the revoked terminal specifying information stored in the revocation information storing means, And a service providing device having validity determining means for determining the effectiveness of the communication terminal.

  In the authentication system of the present invention, the service providing device receives and decrypts the encrypted electronic ticket from the communication terminal, and collates the terminal specifying information included in the electronic ticket with the revoked terminal specifying information possessed in advance. The effectiveness of the communication terminal is determined. Thereby, the service providing apparatus can confirm the legitimacy of the user at the stage of reading the electronic ticket from the communication terminal without making an inquiry to another server or the like.

  Further, the authentication system of the present invention is used when a user of a communication terminal uses credit sales, and issuance of credit sales information for specifying the user is issued from an issuing device managed by a credit sales company that performs credit sales. A request receiving means for receiving, a credit sales information issuing means for issuing credit sales information including terminal specifying information for specifying a communication terminal in response to reception of the issue request, and encrypting the issued credit sales information A credit card information transmitting means for transmitting to a communication terminal, a payment terminal having a receiving means for receiving and decrypting encrypted credit sales information output from the communication terminal, and a payment terminal Receiving means for receiving decrypted credit sales information to be transmitted, and specifying a revoked terminal for identifying a communication terminal whose use has been stopped in the communication network to which the communication terminal belongs The validity of the communication terminal is determined by comparing the revocation information storage means for storing the information, the terminal specifying information contained in the credit sales information received by the receiving means and the revoked terminal specifying information stored in the revocation information storage means And a settlement server having a validity determination means.

  In the authentication system of the present invention, the payment terminal decrypts the encrypted credit sales information received from the communication terminal and transmits the decrypted credit sales information to the payment server. The validity of the communication terminal is determined by collating with the revoked terminal specifying information. As a result, the payment terminal can confirm the legitimacy of the user without making an inquiry to the issuing device managed by the credit merchant, so that communication resources can be saved.

  In the authentication system of the present invention, encryption is performed based on secret key information set by a provider operating the communication network, and decryption is performed based on public key information set by the provider operating the communication network. It is also preferable. By encrypting the information in this way, the security of the exchanged information can be enhanced. In addition, since the private key information is owned only by the operator operating the communication network, it is easy for the device that performs decryption to determine whether or not the information encrypted with this private key information is truly delivered from this supplier. Can be confirmed.

  As described above, in the authentication system according to the present invention, the validity of the user can be easily confirmed.

  The knowledge of the present invention can be easily understood by considering the following detailed description with reference to the accompanying drawings shown for illustration only. Subsequently, embodiments of the present invention will be described with reference to the accompanying drawings. Where possible, the same parts are denoted by the same reference numerals, and redundant description is omitted.

(First embodiment)
First, a system configuration of an authentication system 1 that realizes terminal authentication will be described with reference to FIG. FIG. 1 is a configuration diagram showing the overall configuration of the authentication system 1.

  The authentication system 1 according to the present embodiment includes an electronic ticket issuing device 20, an electronic ticket distribution management device 30, and a service providing device 40, and is mutually connected with a mobile terminal (communication terminal) 10 owned by a user. Information communication is possible. The portable terminal 10 and the electronic ticket issuing device 20 are connected by a network 50, and the electronic ticket issuing device 20 and the electronic ticket distribution management device 30 are connected by a dedicated communication line 51. The portable terminal 10 and the electronic ticket distribution management device 30 are connected by a communication network 52 managed by a business operator (communication carrier) that operates the electronic ticket distribution management device 30.

  The mobile terminal 10 is a mobile phone used by a user who uses the authentication system 1, and physically includes a storage device such as a CPU (Central Processing Unit) and a memory, an input device such as a push button, a display device such as a display, and the like. Have. The mobile terminal 10 has a UIM (User Identity Module) mounted therein (not shown). The UIM stores certificate information for identifying the user of the mobile terminal 10. The certificate information includes terminal specifying information for specifying the mobile terminal 10. This terminal identification information is a so-called “CN” (common name) composed of, for example, a 15-digit character string. In this embodiment, this CN is used. When the mobile terminal 10 requests the electronic ticket issuing device 20 to obtain an electronic ticket, the portable terminal 10 transmits certificate information including the CN to the electronic ticket issuing device 20.

  Furthermore, the portable terminal 10 has a short-range data communication function. For this, for example, infrared data communication by IrDA (Infrared Data Association), and various wireless and wired communication methods such as Bluetooth (registered trademark) and USB (Universal Serial Bus) can be applied. The portable terminal 10 can cause the service providing apparatus 40 to read the certificate information and the electronic ticket by this short-range data communication function.

  The electronic ticket issuing device 20 is a device that issues an electronic ticket used for the user of the mobile terminal 10 to enjoy the service. The electronic ticket issuing device 20 is physically a computer system including a CPU, a memory, a communication interface, a storage unit such as a hard disk, a display unit such as a display, and the like. The electronic ticket issuing device 20 includes, as functional components, an electronic ticket issuing request receiving unit (request receiving unit) 201, a certificate information receiving unit 202, an electronic ticket issuing unit (ticket issuing unit) 203, and an electronic ticket transmission. Section (ticket transmission means) 204.

  The electronic ticket issue request receiving unit 201 is a part that receives ticket issue request information for requesting issue of an electronic ticket from the mobile terminal 10. When receiving the ticket issuance request information, the electronic ticket issuance request receiving unit 201 transmits certificate request information for requesting the portable terminal 10 to transmit the certificate information.

  The certificate information receiving unit 202 is a part that receives certificate information transmitted from the mobile terminal 10. The certificate information receiving unit 202 outputs the received certificate information to the electronic ticket issuing unit 203.

  The electronic ticket issuing unit 203 is a part that issues an electronic ticket including terminal specifying information for specifying a communication terminal in response to an electronic ticket issuing request from the mobile terminal 10. Specifically, when the electronic ticket issuing unit 203 receives the certificate information output from the certificate information receiving unit 202, the electronic ticket issuing unit 203 generates a CN-added electronic ticket by adding the CN included in the information to the requested electronic ticket. To do. Then, the electronic ticket issuing unit 203 outputs the generated electronic ticket with CN to the electronic ticket transmitting unit 204.

  The electronic ticket transmission unit 204 is a part that transmits the electronic ticket with CN received from the electronic ticket issuing unit 203 toward the communication network 52 to which the mobile terminal 10 belongs. Specifically, the electronic ticket transmission unit 204 transmits the electronic ticket with CN to the electronic ticket reception unit 301 of the electronic ticket distribution management device 30 via the communication network 52.

  The electronic ticket distribution management device 30 is a device managed by a business operator who operates the communication network 52 to which the mobile terminal 10 belongs. The electronic ticket distribution management device 30 exists under the communication network 52 and manages distribution of electronic tickets distributed to the mobile terminal 10. It is a device that performs. The electronic ticket distribution management device 30 is physically a computer system including a CPU, a memory, a communication interface, a storage unit such as a hard disk, a display unit such as a display, and the like. The electronic ticket distribution management device 30 includes, as functional components, an electronic ticket receiving unit (encrypting unit) 301, an electronic ticket encrypting unit (encrypting unit) 302, and an electronic ticket transmitting unit 303 (intra-network transmitting unit). ).

  The electronic ticket receiving unit 301 is a part that receives the CN-added electronic ticket transmitted from the electronic ticket transmitting unit 204. The electronic ticket reception unit 301 outputs the received electronic ticket with CN to the electronic ticket encryption unit 302.

  The electronic ticket encryption unit 302 is a part that encrypts the received electronic ticket with CN using secret key information possessed by the electronic ticket distribution management device 30. The electronic ticket encryption unit 302 outputs the encrypted electronic ticket with CN to the electronic ticket transmission unit 303.

  The electronic ticket transmission unit 303 is a part that receives the encrypted electronic ticket with CN from the electronic ticket encryption unit 302 and transmits this information to the mobile terminal 10. The electronic ticket transmission unit 303 may have a function of managing the number of transmissions for each CN. In this way, the electronic ticket distribution management device 30 can restrict the electronic ticket issue destination and issue frequency.

  The service providing device 40 is a local terminal managed by the electronic ticket issuing device 20 and assumes, for example, a register provided at a store, a card reader such as a credit card, or an automatic ticket gate installed at a railway station. Device. The service providing device 40 is physically a computer system including a CPU, a memory, a communication interface, a storage unit such as a hard disk, a display unit such as a display, and the like. In addition, the service providing apparatus 40 includes, as functional components, an electronic ticket receiving unit (ticket receiving unit) 401, an electronic ticket decrypting unit (ticket receiving unit) 402, a terminal authenticating unit (validity determining unit) 403, an invalidation A list storage unit (revocation information storage unit) 404 and a processing unit 405 are provided.

  The electronic ticket receiving unit 401 is a part that receives the certificate information and the encrypted electronic ticket with CN from the portable terminal 10 by short-range data communication. The electronic ticket receiving unit 401 outputs each received information to the electronic ticket decrypting unit 402.

  The electronic ticket decryption unit 402 receives the certificate information and the encrypted electronic ticket with CN from the electronic ticket receiving unit 401, and the encrypted electronic ticket with CN is distributed in advance from the electronic ticket distribution management device 30. This is the part that is decrypted with the public key information. The decrypted electronic ticket with CN is output to the terminal authentication unit 403 together with the certificate information.

  The terminal authentication unit 403 is a part that authenticates the mobile terminal 10 based on the certificate information received from the electronic ticket decryption unit 402 and the electronic ticket with CN. More specifically, first, the terminal authentication unit 403 includes the CN included in the decrypted electronic ticket with CN and the CN (revocation terminal specifying information) included in the revocation list stored in the revocation list storage unit 404. To determine the effectiveness of the mobile terminal 10. FIG. 2 shows an example of the revocation list stored in the revocation list storage unit 404. In the example of FIG. 2, the CN of the mobile terminal whose use has been stopped (expired) in the communication network 52 and the serial number of the mobile terminal are stored in association with each other. This revocation list is a so-called “black list”, and CNs acquired by unauthorized means, CNs whose expiration dates have passed, and the like are listed. If the CN included in the decrypted electronic ticket with CN is not included in the revocation list, the terminal authentication unit 403 approves the validity of the mobile terminal 10. Further, the terminal authentication unit 403 compares the CN included in the certificate information with the CN included in the decrypted electronic ticket with CN to determine the validity of the certificate information, and the CNs match. Approve the validity of the certificate information. The terminal authentication unit 403 authenticates the mobile terminal 10 when both the validity of the mobile terminal 10 and the validity of the certificate information are approved, and based on the contents of the electronic ticket with respect to the processing unit 405. Processing instruction information for instructing execution of a predetermined process is output.

  The processing unit 405 is a part that performs predetermined processing based on the processing instruction information received from the terminal authentication unit 403. That is, using the example of the service providing apparatus 40 described above, a settlement process, a process for opening the gate of the automatic ticket gate, and the like are performed.

  Next, the operation of the authentication system 1 will be described with reference to the flowchart shown in FIG.

  First, the electronic ticket issue request reception unit 201 of the electronic ticket issue device 20 receives ticket issue request information from the mobile terminal 10 (step S01). When receiving the ticket issuance request information, the electronic ticket issuance request receiving unit 201 transmits certificate request information for requesting the portable terminal 10 to transmit the certificate information (step S02). When the portable terminal 10 receives the certificate request information, the portable terminal 10 reads out the certificate information including the CN from the built-in UIM and transmits this information to the certificate information receiving unit 202 (step S03). The certificate information receiving unit 202 outputs the received certificate information to the electronic ticket issuing unit 203.

  Upon receiving the certificate information output from the certificate information receiving unit 202, the electronic ticket issuing unit 203 generates a CN-added electronic ticket by adding the CN included in this information to the requested electronic ticket (step S04). . The generated electronic ticket with CN is output to the electronic ticket transmission unit 204, and is transmitted to the electronic ticket reception unit 301 of the electronic ticket distribution management device 30 by the electronic ticket transmission unit 204 (step S05).

  The electronic ticket reception unit 301 outputs the received electronic ticket with CN to the electronic ticket encryption unit 302. The electronic ticket encryption unit 302 encrypts the received electronic ticket with CN using the private key information owned by the electronic ticket distribution management device 30 (step S06). The encrypted electronic ticket with CN is output to the electronic ticket transmission unit 303, and is transmitted to the portable terminal 10 by the electronic ticket transmission unit 303 (step S07).

  Next, when the user actually wants to receive service from the service providing apparatus 40, communication is performed between the mobile terminal 10 and the service providing apparatus 40 using the above IrDA or the like. At this time, the certificate information read from the UIM and the encrypted electronic ticket with CN received from the electronic ticket transmitting unit 303 are transmitted from the mobile terminal 10 to the electronic ticket receiving unit 401 of the service providing apparatus 40. (Step S08). The electronic ticket receiving unit 401 outputs the received certificate information and the encrypted electronic ticket with CN to the electronic ticket decrypting unit 402. The electronic ticket decryption unit 402 decrypts the encrypted electronic ticket with CN using public key information distributed in advance from the electronic ticket distribution management device 30 (step S09). The decrypted electronic ticket with CN is output to the terminal authentication unit 403 together with the certificate information.

  The terminal authentication unit 403 determines whether or not the mobile terminal 10 can be authenticated based on the received certificate information and the CN-added electronic ticket (step S10). The terminal authentication unit 403 authenticates the portable terminal 10 when the validity of the portable terminal 10 and the validity of the certificate information are confirmed, and performs predetermined processing based on the contents of the electronic ticket with respect to the processing unit 405. Processing instruction information for instructing the execution of. When the processing unit 405 receives the processing instruction information from the terminal authentication unit 403, the processing unit 405 performs a predetermined process based on the information (step S11).

  As described above, in the authentication system 1 according to the present embodiment, the service providing apparatus 40 reads and decrypts the encrypted electronic ticket from the mobile terminal 10, and stores the CN included in the electronic ticket and the revocation list in advance. The validity of the mobile terminal 10 in the communication network 52 is determined by collating with the CN included in the revocation list stored in the unit 404. Thereby, the service providing apparatus 40 can authenticate the mobile terminal 10 at the stage of reading the electronic ticket from the mobile terminal 10 without making an inquiry to another server or the like.

  In the present embodiment, the electronic ticket is encrypted and decrypted based on the secret key information and the public key information set by the operator operating the communication network 52 of the mobile terminal 10. By using such encryption / decryption, the security of electronic tickets exchanged via the network can be enhanced. Also, since the private key information is owned only by the business operator who operates the communication network 52, the service providing apparatus 40 can easily determine whether the electronic ticket encrypted with this private key information has been distributed from this business operator. It becomes possible to confirm.

(Second Embodiment)
Next, the system configuration of the authentication system 2 according to the second embodiment of the present invention will be described with reference to FIG. FIG. 4 is a configuration diagram showing the overall configuration of the authentication system 2.

  The authentication system 2 of the present embodiment is a system for realizing a credit settlement (credit sales) service with a settlement local terminal provided in a store or the like using the mobile terminal 10 used by the user. The authentication system 2 includes a payment server 70 and a payment terminal 80, and is configured to enable mutual information communication between the mobile terminal 10 owned by the user and the credit information issuing device (issuing device) 60. Has been. The mobile terminal 10 and the credit information issuing device 60 are connected by a network 53, and the credit issuing device 60, the payment server 70, and the payment terminal 80 are connected by a dedicated communication line 54. Further, the mobile terminal 10 and the settlement server 70 are connected by a communication network 55 managed by a business operator that operates the settlement server 70.

  The mobile terminal 10 is a mobile phone used by a user who uses the authentication system 2 and has the same configuration as that of the first embodiment. The mobile terminal 10 transmits credit settlement AP request information for requesting acquisition of an application necessary for credit settlement (hereinafter referred to as “credit settlement AP”) to the credit information issuing device 60. In addition, when certificate request information requesting transmission of certificate information is received from the settlement server 70 as a response to this request, the certificate information including CN is read from the built-in UIM, and this information is stored in the settlement server 70. It is transmitted to the certificate information receiving unit 702. Further, after receiving the credit settlement AP from the settlement server 70, the mobile terminal 10 can cause the settlement terminal 80 to read the certificate information and credit information described later by the short-range data communication function.

  The credit information issuing device 60 is a device managed by a credit merchant that provides a credit settlement service. The credit information issuing device 60 is used when a user of the mobile terminal 10 uses credit settlement, and credit information (credit) for identifying the user is used. This is a device for making a request for issuing (sales information). The credit information issuing device 60 is physically a computer system including a CPU, a memory, a communication interface, a storage unit such as a hard disk, a display unit such as a display, and the like. When the credit information issuing device 60 receives the credit payment AP request information from the mobile terminal 10, the credit information issuing device 60 transmits issuance request information and credit information requesting the payment server 70 to issue the credit information. When the credit information is received from the payment server 70 that has authenticated the mobile terminal 10, the payment approval information for notifying the payment approval of the payment is transmitted to the payment terminal 80.

  The settlement server 70 is a device installed as a download center for managing credit information distribution and the like, and physically includes a CPU, a memory, a communication interface, a storage unit such as a hard disk, a display unit such as a display, and the like. Computer system. The settlement server 70 includes, as functional components, a credit information receiving unit (request receiving unit) 701, a certificate information receiving unit 702, a credit information issuing unit (credit sales information issuing unit) 703, a credit information encryption unit ( A credit information transmission unit) 704, a credit information transmission unit (credit sales information transmission unit) 705, a terminal authentication unit (reception unit, validity determination unit) 706, and a revocation list storage unit (revocation information storage unit) 707.

  The credit information receiving unit 701 is a part that receives issue request information and credit information transmitted from the credit information issuing device 60. The credit information receiving unit 701 transmits certificate request information for requesting the mobile terminal 10 to transmit certificate information in response to receiving the issuance request information. The received credit information is output to the credit information issuing unit 703.

  The certificate information receiving unit 702 is a part that receives certificate information transmitted from the mobile terminal 10. The certificate information receiving unit 702 outputs the received certificate information to the credit information issuing unit 703.

  The credit information issuing unit 703 is a part that issues credit information including CN. Specifically, upon receiving the credit information output from the credit information receiving unit 701 and the certificate information output from the certificate information receiving unit 702, the credit information issuing unit 703 receives the CN included in the certificate information. Is added to the credit information. Then, the credit information issuing unit 703 outputs the generated credit information with CN to the credit information encryption unit 704.

  The credit information encryption unit 704 is a part that encrypts the received credit information with CN using secret key information possessed by the settlement server 70. The credit information encryption unit 704 outputs the encrypted credit information with CN to the credit information transmission unit 705.

  The credit information transmission unit 705 is a part that receives the encrypted credit information with CN from the credit information encryption unit 704 and transmits this information to the mobile terminal 10 as a credit settlement AP.

  The terminal authentication unit 706 is a part that receives the certificate information transmitted from the information transmission unit 803 of the payment terminal 80 and the decrypted credit information with CN, and based on each received information, the mobile terminal 10 This is the part that performs authentication. More specifically, first, the terminal authenticating unit 706 collates the CN included in the decrypted credit information with CN and the CN included in the revocation list stored in the revocation list storage unit 707 to check the mobile terminal. Judge 10 effectiveness. This revocation list includes the same information as the revocation list shown in FIG. The terminal authentication unit 706 approves the validity of the mobile terminal 10 when the CN included in the decrypted credit information with CN is not included in the revocation list. Furthermore, the terminal authentication unit 706 determines the validity of the certificate information by comparing the CN included in the certificate information with the CN included in the decrypted credit information with CN, and the CNs match. Approve the validity of the certificate information. Then, the terminal authentication unit 706 authenticates the mobile terminal 10 when both the validity of the mobile terminal 10 and the validity of the certificate information are approved. When the authentication is performed, the terminal authentication unit 706 transmits the credit information to the credit information issuing device 60.

  The payment terminal 80 is a local terminal managed by the credit information issuing device 60 and provided in a store or the like. The payment terminal 80 is physically a computer system including a CPU, a memory, a communication interface, a storage unit such as a hard disk, a display unit such as a display, and the like. The payment terminal 80 includes, as functional components, a credit information receiving unit (receiving unit) 801, a credit information decrypting unit (receiving unit) 802, an information transmitting unit 803, a payment approval information receiving unit 804, and a payment processing unit. 805.

  The credit information receiving unit 801 is a part that receives certificate information and encrypted credit information with CN from the mobile terminal 10 by short-range data communication. The credit information receiving unit 801 outputs each received information to the credit information decrypting unit 802.

  The credit information decrypting unit 802 receives the certificate information and the encrypted credit information from the credit information receiving unit 801, and uses the public key information distributed from the settlement server 70 in advance to store the encrypted credit information with CN. This is the part to be decrypted. The decrypted credit information with CN is output to the information transmission unit 803 together with the certificate information.

  The credit information transmission unit 803 is a part that transmits the certificate information received from the credit information decryption unit 802 and the decrypted information with CN to the terminal authentication unit 706 of the settlement server 70.

  The payment approval information receiving unit 804 is a part that receives payment approval information from the credit information issuing device 60. The received payment approval information is output to the payment processing unit 805.

  The payment processing unit 805 is a part that receives payment approval information from the payment approval information receiving unit 804 and performs predetermined processing. Specifically, when the payment processing unit 805 receives the payment approval information, the payment processing unit 805 transmits information related to the payment (receipt data, etc.) to the mobile terminal 10 and sales information indicating the sales amount and the like to the credit information issuing device 60. Send.

  Next, the operation of the authentication system 2 will be described with reference to the flowchart shown in FIG.

  First, the credit information issuing device 60 receives credit settlement AP request information from the mobile terminal 10 (step S21). The credit information issuing device 60 that has received the credit settlement AP request information, together with the issuance request information that requests the credit information receiving unit 701 of the settlement server 70 to issue credit information, the credit information necessary for executing the credit settlement AP. Is transmitted (step S22). The credit information receiving unit 701 transmits the certificate request information to the mobile terminal 10 in response to the reception of the issue request information (Step S23). The received credit information is output to the credit information issuing unit 703. When the portable terminal 10 receives the certificate request information, the portable terminal 10 reads the certificate information including the CN from the built-in UIM, and transmits this information to the certificate information receiving unit 702 (step S24). The certificate information receiving unit 702 outputs the received certificate information to the credit information issuing unit 703.

  Next, upon receiving the credit information output from the credit information receiving unit 701 and the certificate information output from the certificate information receiving unit 702, the credit information issuing unit 703 credits the CN included in the certificate information. The credit information with CN added to the information is generated (step S25). Then, the credit information issuing unit 703 outputs the generated credit information with CN to the credit information encryption unit 704. The credit information encryption unit 704 encrypts the received credit information with CN using the secret key information owned by the settlement server 70 (step S26). The encrypted credit information with CN is output to the credit information transmission unit 705. Then, the encrypted credit information with CN and certificate information are transmitted to the mobile terminal 10 as a credit settlement AP (step S27).

  Next, when the user performs a credit settlement using the settlement terminal 80, the user performs communication based on the above-described IrDA or the like between the mobile terminal 10 and the settlement terminal 80 using the received credit settlement AP. At this time, the certificate information read from the UIM and the encrypted electronic ticket with CN are transmitted from the mobile terminal 10 to the credit information receiving unit 801 of the settlement terminal 80 (step S28). The credit information receiving unit 801 outputs each received information to the credit information decrypting unit 802.

  Upon receipt of the certificate information and the encrypted credit information, the credit information decryption unit 802 decrypts the encrypted credit information with CN using the public key information distributed from the payment server 70 in advance (Step S1). S29). The decrypted credit information with CN is output to the information transmission unit 803 together with the certificate information, and is transmitted to the terminal authentication unit 706 of the settlement server 70 by the information transmission unit 803 (step S30).

  The terminal authentication unit 706 determines whether or not the mobile terminal 10 can be authenticated based on each received information (step S31). Then, the terminal authentication unit 706 authenticates the mobile terminal 10 when the validity of the mobile terminal 10 and the validity of the certificate information are approved. If the mobile terminal 10 is authenticated, the terminal authentication unit 706 transmits credit information to the credit information issuing device 60 (step S32). The credit information issuing device that has received the credit information from the terminal authenticating unit 706 transmits the payment approval information to the payment approval information receiving unit 804 of the payment terminal 80 (step S33). The payment approval information receiving unit 804 outputs the received payment approval information to the payment processing unit 805, and upon receiving this information, the payment processing unit 805 transmits information related to payment (receipt data and the like) to the mobile terminal 10. Sales information is transmitted to the credit information issuing device 60 (step S34).

  As described above, in the authentication system 2 according to the present embodiment, the payment terminal 80 decrypts the encrypted credit information received from the mobile terminal 10 and transmits it to the payment server 70. The payment server 70 The validity of the mobile terminal 10 is determined by comparing the CN included in the converted credit information with the CN included in the revocation list stored in the revocation list storage unit 707 in advance. Thereby, the payment terminal 80 can confirm the legitimacy of the user of the portable terminal 10 without making an inquiry to the credit information issuing device 60 managed by the credit dealer. Therefore, communication resources can be saved as compared with the case where an inquiry is made directly to the credit information issuing device 60.

  In the present embodiment, encryption and decryption of credit information are performed based on secret key information and public key information set by a company operating the communication network 55 of the mobile terminal 10. By using such encryption / decryption, security of credit information exchanged via the network can be enhanced. Further, since the private key information is owned only by the business operator who operates the communication network 55, it is easily confirmed at the settlement terminal 80 whether or not the credit information encrypted with this private key information has been distributed from this business operator. It becomes possible to do.

It is a block diagram which shows the authentication system which is 1st Embodiment of this invention. It is the figure which showed an example of the information stored in a revocation list storage part. FIG. 3 is a sequence diagram showing an operation procedure of the authentication system according to the first embodiment of the present invention. It is a block diagram which shows the authentication system which is 2nd Embodiment of this invention. It is a sequence diagram which shows the operation | movement procedure of the authentication system which is 2nd Embodiment of this invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1, ... Authentication system, 10 ... Portable terminal, 20 ... Service provision apparatus, 52, 55 ... Communication network, 60 ... Credit information issuing apparatus, 70 ... Payment server, 80 ... Payment terminal, 201 ... Electronic ticket issue request receiving part , 203 ... Electronic ticket issuing unit, 204 ... Electronic ticket transmitting unit, 301 ... Electronic ticket receiving unit, 302 ... Electronic ticket encryption unit, 303 ... In-network transmission means, 401 ... Electronic ticket receiving unit, 402 ... Electronic ticket decryption unit 403... Terminal authentication unit 701 credit information receiving unit 703 credit information issuing unit 704 credit information encryption unit 705 credit information transmission unit 706 terminal authentication unit 707 revocation list storage unit 801: Credit information receiving unit, 802: Credit information decoding unit.

Claims (3)

Request receiving means for receiving an electronic ticket issuance request transmitted from a communication terminal and used by the user of the communication terminal to enjoy the service;
Ticket issuing means for issuing an electronic ticket including terminal specifying information for specifying the communication terminal in response to receiving the issuing request;
Ticket transmitting means for transmitting the issued electronic ticket to a communication network to which the communication terminal belongs;
An encryption means for receiving the transmitted electronic ticket and encrypting it with the private key information;
In-network transmission means for transmitting the electronic ticket that is under the communication network and encrypted by the encryption means to the communication terminal;
An authentication system comprising:
Revocation information storage means for storing revocation terminal specifying information for specifying a communication terminal whose use has been stopped in the communication network;
Ticket receiving means for receiving and decrypting the encrypted electronic ticket from the communication terminal;
Validity determination means for comparing the terminal identification information contained in the decrypted electronic ticket with the revocation terminal identification information stored in the revocation information storage means, and determining the validity of the communication terminal;
An authentication system further comprising a service providing apparatus having: A request receiving means that is used when a user of a communication terminal uses credit sales, and receives a request for issuing credit sales information for specifying the user from an issuing device managed by a credit dealer who performs the credit sales;
Credit sales information issuing means for issuing credit sales information including terminal specifying information for specifying the communication terminal in response to reception of the issue request;
Credit sales information transmitting means for encrypting the issued credit sales information and transmitting it to the communication terminal;
An authentication system comprising:
A payment terminal having receiving means for receiving and decrypting the encrypted credit sales information output from the communication terminal;
A receiving means for receiving the decrypted credit sales information transmitted from the payment terminal, and revoked terminal specifying information for specifying a communication terminal whose use has been stopped in the communication network to which the communication terminal belongs is stored. The validity of the communication terminal is determined by comparing the revocation information storage means, the terminal identification information included in the credit sales information received by the reception means, and the revocation terminal identification information stored in the revocation information storage means. A settlement server having validity determination means;
An authentication system further comprising:   The encryption is performed based on secret key information set by a vendor operating the communication network, and the decryption is performed based on public key information set by a vendor operating the communication network. 2. The authentication system according to 2.

Images