JP2008108084A - Logon authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a means for leaving evidences showing who, where and when, has logged on a computer. <P>SOLUTION: When a user logs on the computer, the user requests issue of a password to a server from a mobile phone provided with a GPS function, the server generates a one-time password by using location information and the present date which are received at the request, and notifies the mobile phone about the one-time password. When the user uses this password to try to log on the computer, the computer uses the GPS function provided in itself to acquire location information and confirms validity of the password and allows the user to log on the computer only at the date when and in a place where the user has requested issue of a password. The computer notifies the server about the fact that the computer has been logged on when the computer is connected to a network after log-on, whereby the server side performs unitary management of evidences showing which computer has been logged on and by whom, where and when the computer has been logged on. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a logon authentication system, and more particularly to a logon authentication system for a computer that uses position information by GPS function and date / time information.

  Conventionally, a method of using a one-time password for logon authentication to a personal computer (hereinafter referred to as a PC) is known.

According to the above-described logon authentication, a one-time password issuance record remains, but there is a problem that it is impossible to manage a trail of who used and when the password was actually logged on to the PC.
The present invention has been made to solve the above-described problems of the prior art, and an object of the present invention is to centrally manage a trail of who logs on to a computer at a server in a logon authentication system. It is to provide a technology that makes it possible.
The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings.

Of the inventions disclosed in this application, the outline of typical ones will be briefly described as follows.
In order to achieve the above object, in the present invention, in a logon authentication system in which a general unspecified mobile phone, a general unspecified computer, and a server are connected via a network (for example, the Internet), Using the GPS function for each of the cellular phone and the computer, the location information (date / time information / location information) of the cellular phone and the location information (date / time information / location information) of the PC are acquired. And a password issuing unit for issuing a password when a password issuance request is received from the mobile phone.
Prior to logging on to the computer, the mobile phone transmits a password issuance request message with the location information added to the server, and the server that has received the password issuance request message uses the location information. The password issued by the password issuing means is transmitted to the mobile phone.
When the user logs on to the computer, the computer generates a verification password using the location information acquired by the computer itself, and compares the password obtained and input via the mobile phone, and compares the passwords. If they match, the computer is permitted to log on to the computer, and when the computer is connected to the network, the server is notified of the password, location information, and logon time. Notify that it has been implemented. The server stores the password received from the computer, location information, and logon time.

The effects obtained by the representative ones of the inventions disclosed in the present application will be briefly described as follows.
According to the logon authentication system of the present invention, it is possible to centrally manage a trail of who has logged on to a computer, where and when using a server.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
In all the drawings for explaining the embodiments, parts having the same functions are given the same reference numerals, and repeated explanation thereof is omitted.
FIG. 1 is a block diagram showing a schematic configuration of a logon authentication system according to an embodiment of the present invention.
In FIG. 1, 101 is an artificial satellite for GPS, 104 is a mobile phone having a GPS receiving function, 106 is a personal computer (hereinafter referred to as a PC), 102 is a radio wave communication between the mobile phone 104 for positioning and the artificial satellite 101. 103 indicates radio communication between the PC 106 and the artificial satellite 101 for positioning, 105 indicates Internet communication of the mobile phone 104, 107 indicates Internet communication of the PC 106, 108 indicates the entire Internet, 110 indicates the server, and 109 indicates Internet communication of the server 110. .

FIG. 2 is a block diagram showing a schematic configuration of the mobile phone shown in FIG.
In FIG. 2, reference numeral 104 denotes a mobile phone, 201 denotes a GPS function, 202 denotes a communication function, and 203 denotes a one-time password issue request application.
FIG. 3 is a block diagram showing a schematic configuration of the PC shown in FIG.
In FIG. 3, 106 is a PC, 301 is a GPS device, 302 is a GPS driver, 303 is an OS standard logon authentication process, 304 is a logon notification application, 305 is an authentication application, 306 is a one-time password management database, and 307 is user management. Database 308 indicates a logon trail management database.
4 is a block diagram showing a schematic configuration of the server shown in FIG.
In FIG. 4, 110 is a server, 401 is a one-time password issuing application, 402 is a logon notification receiving application, 403 is a user management database, 404 is a one-time password management database, and 405 is a logon trail management database.

Hereinafter, an authentication method at the time of PC logon according to the present embodiment will be described.
First, a part for obtaining a one-time password for logging on to the PC 106 using the mobile phone 104 will be described.
FIG. 5 is a flowchart showing a processing procedure of the application 203 that requests issuance of a one-time password on the mobile phone 104.
FIG. 6 is a flowchart showing a processing procedure of the application 401 that issues a one-time password on the server 110 and sends it back to the mobile phone 104.
When the one-time password issue request application 203 is activated on the mobile phone 104, an ID and mobile password input screen is displayed on the screen (step 501).
When the ID and the mobile password are input, position information is acquired from the artificial satellite 101 (step 502), and the input ID, the mobile password, and the position information acquired in step 502 are transmitted to the Internet using the communication function 202. It is transmitted to the server 110 via 108 (step 503).

When the one-time password issuing application 401 on the server 110 receives the ID, the mobile password, and the location information from the mobile phone 104 (step 601), it determines whether the mobile password is correct (step 602).
In this step 602, the mobile password transmitted from the mobile phone 104 is checked against the mobile password stored in the user management database 403 to prevent unauthorized use of this function. In step 602, if the mobile password transmitted from the mobile phone 104 is incorrect, the process returns to step 601.
If the mobile password transmitted from the mobile phone 104 is correct in step 602, a random number Seed for generating a unique password for each user is acquired from the user management database 403 (step 603), and then the server 110 The current date and time provided is acquired (step 604), and a one-time password is generated based on the location information received from the mobile phone 104, the random number Seed acquired in step 603, and the current date and time acquired in step 604. (Step 605).
Next, after the generated one-time password is returned to the mobile phone 104 (step 606), the ID, issued one-time password, date and time, received location information, and issue are issued in the one-time password management database 404. The fact that the one-time password thus used is unused is stored (step 607).
The mobile phone 104 receives the one-time password transmitted from the server 110 (step 504), and displays the received one-time password on the screen of the mobile phone 104 (step 505).

Next, an authentication part when the user logs on to the PC 106 using the one-time password displayed on the screen of the mobile phone 104 will be described.
FIG. 7 is a flowchart showing a processing procedure during logon authentication processing to the PC 106.
The authentication application 305 is always activated on the PC 106, and an ID / password input screen for logging on to the OS is displayed (step 701).
When the user inputs the ID and the one-time password acquired by the mobile phone 104 and attempts to log on, the user refers to the one-time password management database 306 to determine whether or not the one-time password is unused (step 702). .
If it has been used in step 702, the process returns to step 701 to display an ID / password input screen.
If it is not used in step 702, a random number Seed for generating a unique password is acquired from the user management database 307 (step 703), and then the date and time of the PC is acquired (step 704). The position information is acquired using the GPS device 301 included in the PC (step 705).

Next, based on the random number Seed acquired in Step 703, the date and time acquired in Step 704, and the position information acquired in Step 705, a one-time password for verification is generated (Step 706).
Next, the one-time password input in step 701 is collated with the one-time password for collation generated in step 706 (step 707).
In step 707, if the one-time passwords do not match, the process returns to step 701 to display the ID / password input screen.
If the one-time passwords match in step 707, the password for OS logon is acquired from the user management database 307 (step 708), the password is passed to the OS, and the OS executes the logon process (step 709). ).
When the logon to the OS is completed, the fact that the one-time password used in this logon is a used one-time password is stored in the one-time password management database 306 (step 710). In 308, the ID, the one-time password, the position information, the logon time, and the fact that the one-time password has been used are stored (step 711).

Next, the logon notification part after logging on to the PC 106 will be described.
FIG. 8 is a flowchart showing a processing procedure when the PC 106 executes a logon notification to the server 110.
FIG. 9 is a flowchart showing a processing procedure when the server receives a logon notification.
When the logon to the PC 106 is completed, the logon notification application 304 is activated in the background, and it is confirmed whether the PC 106 is capable of network communication (step 801).
In step 801, when the network connection is impossible, after a predetermined time has elapsed (step 803), the process of step 801 is performed again.
If the network connection is possible in step 801, the server 110 is notified of the logon, ID, one-time password, location information, and logon time (step 802).

On the server 110, the receiving application 402 is always activated, and when a logon notification is received from the PC 106 (step 901), the one-time password in the one-time password management database 404 is updated to used (step 902). The received ID, one-time password, location information, and logon date and time are recorded in the logon trail management database 405 (step 903).
As described above, according to the present embodiment, it is possible to centrally manage the trail of who logs on to the PC 106 by the server 110. Further, it is possible to make it possible for the user of the PC 106 to log on only at the place of use at the date and time of use.
As mentioned above, the invention made by the present inventor has been specifically described based on the above embodiments. However, the present invention is not limited to the above embodiments, and various modifications can be made without departing from the scope of the invention. Of course.

It is a block diagram which shows schematic structure of the logon authentication system of the Example of this invention. It is a block diagram which shows schematic structure of the mobile telephone shown in FIG. It is a block diagram which shows schematic structure of the personal computer shown in FIG. It is a block diagram which shows schematic structure of the server shown in FIG. It is a flowchart which shows the process sequence of the application which requests the one-time password issue on a mobile telephone. It is a flowchart which shows the process sequence of the application which issues a one-time password on a server, and returns to a mobile telephone. It is a flowchart which shows the process sequence at the time of the log-on authentication process to a personal computer. It is a flowchart which shows the process sequence when a personal computer performs the log-on notification to a server. It is a flowchart which shows the process sequence when a server receives logon notification.

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 Artificial satellite for GPS 102 Radio communication between mobile phone and artificial satellite for positioning 103 Radio communication between PC and artificial satellite for positioning 104 Mobile phone with GPS reception function 105 Internet communication of mobile phone 106 Personal computer 107 Internet communication of personal computer 108 Internet whole 109 Internet communication of server 110 Server 201 GPS function provided in mobile phone 202 Communication function provided in mobile phone 203 One-time password issue request application 301 GPS device 302 GPS driver
303 OS standard logon authentication processing 304 Logon notification application 305 Authentication application 306, 404 One-time password management database 307, 403 User management database 308, 405 Logon trail management database 401 One-time password issuing application 402 Logon notification receiving application

Claims (1)

A logon authentication system in which a mobile phone, a computer, and a server are connected via a network,
The mobile phone uses a GPS function to acquire location information of the mobile phone, and location information acquisition means;
Means for adding the location information to the server and sending a password issuance request message;
Means for receiving a password issued from the server,
The computer includes position information acquisition means for acquiring position information of the computer using a GPS function;
Password generating means for generating a verification password using the position information acquired by the position information acquiring means;
Means for requesting the input of a password issued from the server when there is a logon request from a user;
A means for comparing the input password with the verification password and permitting the logon request if they match,
Means for notifying the server of the password, location information, and logon time when connected to the network;
The server includes means for receiving a password issuance request message from the mobile phone;
Means for generating a password using location information received from the mobile phone;
Means for transmitting the generated password to the mobile phone;
A logon authentication system comprising: the password received from the computer; location information; and means for storing a logon time.

Images