JP2012014434A - Information processor, authentication system and authentication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information processor capable of authenticating a client without storing a password in client equipment.SOLUTION: According to an embodiment, the information processor can provide a plurality of pieces of client equipment with service, and comprises transmission means, receiving means, and service means. The transmission means generates a one-time password for first client equipment in the plurality of pieces of client equipment, and transmits a start message including the generated one-time password and a start instruction to the first client equipment via a first network. The receiving means receives an authentication request including the one-time password via a second network from the first client equipment started by the start message. The service means executes service to the first client equipment via the second network when the generated one-time password matches to the one-time password in the received authentication request.

Description

  Embodiments described herein relate generally to an information processing apparatus and an authentication system for authenticating a client device, and an authentication method applied to the apparatus.

  In general, when a service is executed by connecting a server computer and a client device via a network, whether or not the client device is permitted to connect to the server computer before starting the service. Is authenticated. For example, the server determines whether or not the client device is a device permitted to be connected, using a password transmitted from the client device via the network. The server establishes a connection with the client device that has transmitted the correct password, and starts executing the service.

Japanese Patent No. 4302732

  As the above-mentioned password, a password or an electronic certificate stored in a flash memory or the like in the client device may be used. For example, the server computer manages a password associated with each client terminal. The server computer authenticates the client terminal by comparing the password transmitted from the client terminal via the network with the password associated with the client terminal in the server computer. Usually, in order to ensure security, the password of each client terminal needs to be updated periodically.

  However, even if the password of each client terminal is updated regularly, it is difficult to ensure sufficient security. This is because an attacker may identify a storage area in which a password (or electronic certificate) is stored by comparing images of flash memories provided in a plurality of client devices. For example, an attacker may detect an area where the image of the flash memory differs between client devices, and specify the detected area as an area where a password (or electronic certificate) is stored. The identified area becomes a security hole.

  An object of the present invention is to provide an information processing apparatus, an authentication system, and an authentication method that can authenticate a client without storing a password in the client device.

  According to the embodiment, the information processing apparatus is an information processing apparatus capable of providing services to a plurality of client devices, and includes a transmission unit, a reception unit, and a service unit. The transmission means generates a one-time password for a first client device in the plurality of client devices, and sends an activation message including the generated one-time password and an activation command via the first network. Transmit to the first client device. The receiving means receives an authentication request including a one-time password from the first client device activated by the activation message via the second network. The service means executes the service for the first client device via the second network when the generated one-time password matches the one-time password in the received authentication request.

The conceptual diagram which shows the structure of the authentication system which concerns on one Embodiment. The another conceptual diagram which shows the structure of the authentication system of the embodiment. The block diagram which shows the structure of the authentication system of the embodiment. The figure which shows one structural example of the client information used by the authentication server provided in the authentication system of the embodiment. The figure which shows the communication sequence of the service start process performed by the authentication system of the embodiment. 6 is an exemplary flowchart illustrating an example of a procedure of service start processing which is executed by the authentication system of the embodiment.

Hereinafter, embodiments will be described with reference to the drawings.
First, a conceptual configuration example of an authentication system according to an embodiment will be described with reference to FIG. The authentication system includes an authentication server 1, a terminal activation server 2, and a plurality of terminals 3 (clients). The authentication server 1 and the terminal activation server 2 are connected by a secure communication path 4. The terminal activation server 2 and the terminal 3 are connected by a secure communication path 5. Further, the terminal 3 and the authentication server 1 are connected by an insecure communication path 6.

  The authentication server 1 provides services to a plurality of terminals (clients) 3. For example, this service starts one terminal 3 of a plurality of terminals 3 and uses the GPS receiver provided in the terminal 3 to transmit the location information of the terminal 3 from the terminal 3 to the authentication server 1. It is a service. In addition, this service is a service for activating the terminal 3 of the plurality of terminals 3 and deleting the data stored in the storage device provided in the terminal 3, for example. The authentication server 1 transmits an activation command and a one-time password to the terminal activation server 2 via the secure communication path 4, and requests the terminal activation server 2 to transmit a message to the terminal 3 (terminal activation server 2). To send a message to the terminal 3).

  The terminal activation server 2 receives the activation command and the one-time password transmitted by the authentication server 1. The terminal activation server 2 generates a message including these activation instructions and a one-time password. Then, the terminal activation server 2 transmits the message generated via the secure communication path 5 to the terminal 3.

  The terminal 3 receives the message transmitted by the terminal activation server 2. Then, the terminal 3 is activated in response to the activation command included in the message. Then, the terminal 3 requests the authentication server 1 for authentication using the one-time password included in the message. When the authentication is successful, the terminal 3 executes a predetermined process according to the execution of the service by the authentication server 1 via the insecure communication path 6. In response to a request (service) from the authentication server 1, the terminal 3 encrypts the position information of the terminal 3 detected by a GPS receiver provided in the terminal 3, for example, and authenticates the authentication server 1 via the insecure communication path 6. Send to. Further, the terminal 3 deletes data stored in a storage device provided in the terminal 3, for example, in response to a request from the authentication server 1.

  As described above, the authentication server 1 authenticates the terminal 3 using the one-time password before starting the service. That is, the authentication server 1 executes the service for the terminal 3 that has been successfully authenticated using the one-time password. The one-time password is a password used only for one authentication. That is, in the first authentication, the authentication succeeds using the one-time password, and in the second and subsequent authentications, the authentication fails using the same one-time password. The one-time password can be defined with an effective period (for example, several minutes) that can be used for authentication. Therefore, for example, after the validity period has elapsed after the one-time password is generated, authentication using the one-time password fails. As described above, in the authentication using the one-time password, for example, security can be improved even when the password is known to a third party.

In this authentication system, authentication using a one-time password is performed according to the following procedure.
First, the one-time password generator 12 provided in the authentication server 1 generates a one-time password for the terminal 3. Then, the authentication server 1 requests the terminal activation server 2 to transmit an activation message using the communication function 101. At that time, the authentication server 1 transmits the generated one-time password and the activation command to the terminal activation server 2 via the secure communication path 4.

  The terminal activation server 2 receives the one-time password and activation command transmitted by the authentication server 1. The terminal activation server 2 generates an activation message including these one-time password and activation command. Then, the terminal activation server 2 transmits the generated activation message to the terminal 3 via the secure communication path 5.

  The terminal 3 receives the activation message transmitted by the terminal activation server 2. The terminal 3 is activated in response to the activation command included in the activation message. In addition, in the terminal 3 before starting, a communication function (communication module) 301 for executing communication via the secure communication path 5 operates, and other modules, BIOS, OS, etc. in the terminal 3 operate. Absent. Therefore, the terminal 3 activates a module other than the communication module 301 in the terminal 3, such as a BIOS and an OS, in response to the activation command. The activated terminal 3 transmits an authentication request (login request) including the one-time password to the authentication server 1 via the insecure communication path 6.

The authentication server 1 receives the authentication request transmitted by the terminal 3. Then, when the generated one-time password matches the one-time password included in the received authentication request, the service unit 11 provided in the authentication server 1 encrypts the message so as to pass through the insecure communication path 6. Then, execution of the service for the terminal 3 is started.
With the above configuration, the authentication server 1 can execute a service for the authenticated terminal 3. The one-time password used for authentication is transmitted to the terminal 3 via the secure communication paths 4 and 5. Therefore, the terminal 3 connected via the insecure communication path 6 can be authenticated using the one-time password obtained via the secure communication paths 4 and 5.

  FIG. 2 shows another example of the conceptual configuration of the authentication system of the present embodiment. The authentication system includes an authentication server 1, an SMS (short message service) server 2, and a plurality of terminals (clients) 3. The authentication server 1, the SMS server 2, and the terminal 3 operate in the same manner as the authentication server 1, the terminal activation server 2, and the terminal 3 described with reference to FIG. The authentication server 1 and the SMS server 2 are connected by an intranet 4. The SMS server 2 and the terminal 3 are connected by a cellular network (mobile communication network) 5. The terminal 3 and the authentication server 1 are connected by the Internet (Internet protocol network) 6.

  The authentication server 1 shown in FIG. 2 transmits the telephone number, activation command, and one-time password corresponding to the service target terminal 3 to the SMS server 2 via the intranet 4 to the SMS server 2. 2 is requested to send a message to the terminal 3 (the SMS server 2 is caused to send a message to the terminal 3).

  The SMS server 2 receives the telephone number, activation command, and one-time password of the terminal 3 transmitted by the authentication server 1. The SMS server 2 generates a short message including an activation command and a one-time password. Then, the SMS server 2 transmits the generated short message to the terminal 3 via the cellular network 5 using the telephone number of the terminal 3. A short message is a message including data within a predetermined size, for example.

  The authentication server 1 shown in FIG. 2 can execute a service for the authenticated terminal 3 as in the example shown in FIG. The one-time password used for authentication is transmitted to the terminal 3 via the secure intranet 4 and the cellular network 5. Therefore, the terminal 3 connected via the insecure Internet 6 can be authenticated using the one-time password obtained via the secure intranet 4 and the cellular network 5.

  Next, a configuration example of the authentication system according to the present embodiment will be described with reference to FIG. The authentication system includes an authentication server 1, a message transmission server 2, and a plurality of client devices 3. The authentication server 1 and the message transmission server 2 are connected by the first network 4. The first network 4 is, for example, an intranet, a local area network, or a virtual private network. The message transmission server 2 and the client device 3 are connected by the second network 5. The second network 5 is, for example, a mobile communication network (cellular network). The client device 3 and the authentication server 1 are connected by a third network 6. The third network 6 is, for example, an Internet protocol network.

  The authentication server 1 provides services to a plurality of client devices 3. This service is, for example, a service for remotely starting the client device 3 and specifying the location where the client device 3 is located. In specifying the location of the client device 3, for example, the position information of the client device 3 is transmitted from the client device 3 to the authentication server 1 using a GPS receiver provided in the client device 3. In addition, this service is a service for starting the client device 3 from a remote location and deleting data stored in a storage device provided in the client device 3, for example.

  For example, the message transmission server 2 is requested to transmit a message by the authentication server 1 connected via the first network 4, and the client device 3 connected via the second network 5 with the message generated in response to the request. Send to. The message transmission server 2 can be realized as, for example, an SMS (short message service) server.

  In addition, the client device 3 executes a predetermined process in accordance with the execution of the service by the authentication server 1 via the third network 6. In response to a request (service) from the authentication server 1, the client device 3 uses, for example, the location information of the client device 3 detected by a GPS receiver provided in the client device 3 via the third network 6. Send to. In response to a request from the authentication server 1, the client device 3 deletes data stored in a storage device provided in the client device 3, for example. Note that the client device 3 is switched between an operating state and a dormant state. In the operating state, modules, BIOS, OS, etc. in the client device 3 operate. In the dormant state, a communication module (for example, a communication device for performing communication via the cellular network) that performs communication via the second network 5 operates, and other modules, BIOS, OS, and the like in the client device 3 are Not working. For example, the client device 3 is activated in response to an activation command input via the second network 5, that is, switches from a sleep state to an operating state (other modules in the client device 3, BIOS, OS, etc. Operation starts). In addition, for example, after the execution of the service by the authentication server 1 is completed, the client device 3 switches from the operating state to the dormant state.

  The authentication server 1, the message transmission server 2, and the client device 3 can be realized as an information processing apparatus such as a computer. The authentication server 1 (first information processing apparatus) includes a service unit 11, a password generation unit 12, a first communication unit 13, a second communication unit 14, and an authentication unit 15. The message transmission server 2 (second information processing apparatus) includes a communication unit 21, a message generation unit 22, and a message transmission unit 23. The client device 3 includes a message reception unit 31, an activation unit 32, an authentication unit 33, a communication unit 34, and a service unit 35.

  The service unit 11 of the authentication server 1 executes a service for the client device 3. Specifically, first, the service unit 11 reads client information 1A corresponding to the client device 3 to be serviced. The client information 1A is stored in a storage device provided in the authentication server 1, for example.

  FIG. 4 shows a configuration example of the client information 1A. The client information 1A includes a plurality of entries respectively corresponding to the plurality of client devices 3. Each entry includes, for example, a client ID and a telephone number. In an entry corresponding to a certain client device, the client ID indicates identification information unique to the client device. The client ID may be, for example, an ID assigned to a communication device or HDD built in the client device. The telephone number indicates a telephone number corresponding to the client device.

  The service unit 11 requests the password generation unit 12 to generate a one-time password for the client device 3 to be serviced.

  The password generation unit 12 generates a one-time password for the client device 3 in response to the request from the service unit 11. For example, the password generation unit 12 calculates a value obtained by converting the time of generation using a hash function, and sets it as a one-time password. Then, the password generation unit 12 outputs the generated one-time password to the service unit 11.

  The service unit 11 outputs the telephone number of the client device 3, the generated one-time password, and an activation command to the first communication unit 13. The first communication unit 13 sends the telephone number of the client device 3, the generated one-time password, and the activation command to the message transmission server 2 via the first network 4 in order to request (request) transmission of the activation message. To the communication unit 21 of the message transmission server 2. The first communication unit 13 is, for example, a communication module capable of communication on an intranet.

  The communication unit 21 receives the transmission request for the activation message transmitted by the first communication unit 13. Further, the communication unit 21 receives the one-time password, the activation command, and the telephone number transmitted by the first communication unit 13. The communication unit 21 outputs the received one-time password and activation command to the message generation unit 22. Note that the communication unit 21 is a communication module capable of communication on an intranet, for example.

  The message generator 22 generates an activation message including the one-time password output by the communication unit 13 and an activation command. Then, the message transmission unit 22 outputs the generated activation message to the message transmission unit 23.

  The message transmission unit 23 transmits the activation message generated by the message generation unit 22 to the client device 3 (message reception unit 31) specified by the telephone number via the second network 5. The message transmission unit 23 is a communication module that can communicate with a mobile communication network (cellular network), for example.

  The message receiving unit 31 of the client device 3 receives the activation message transmitted by the message transmitting unit 23. The message receiving unit 31 outputs the received activation message to the activation unit 32. The message receiving unit 31 is a communication module that can communicate with a mobile communication network (cellular network), for example.

  The activation unit 32 activates the client device 3 in response to the activation instruction included in the activation message. That is, the activation unit 32 switches the client device 3 from the hibernation state to the operation state. As described above, in the client device 3 before activation (hibernation), the message receiving unit 31 for executing communication via the second network 5 operates, and other modules, BIOS, OS in the client device 3 operate. Etc are not working. In the client device 3, the operation of other modules, BIOS, OS, etc. in the client device 3 is started by shifting from the hibernation state to the operation state. The activation unit 32 outputs the one-time password included in the activation message to the authentication unit 33.

  The authentication unit 33 requests authentication from the authentication server 1 using the one-time password output by the activation unit 32. Specifically, the authentication unit 33 first outputs an authentication request including the client ID 3A and the one-time password to the communication unit 34. The communication unit 34 transmits a connection request to the second communication unit 14 of the authentication server 1 via the third network 6. At this time, the communication unit 34 may establish an HTTPS session with the second communication unit 14. Further, the communication unit 34 may receive an electronic certificate transmitted by the authentication server 1 at the time of session establishment, and determine whether or not the authentication server 1 is a reliable server (server authentication). Thereby, the authentication request including the one-time password can be transmitted more safely. The communication unit 34 is a communication module capable of communication over the Internet, for example.

  The second communication unit 14 receives the authentication request transmitted by the communication unit 34. Then, the second communication unit 14 outputs the received authentication request to the authentication unit 15. The second communication unit 14 is, for example, a communication module that can perform communication over the Internet.

  The authentication unit 15 determines whether the one-time password for the client device 3 generated by the password generation unit 12 matches the one-time password included in the received authentication request (client authentication).

  If the generated one-time password matches the one-time password included in the authentication request, the authentication unit 15 determines that the client device 3 is a client to be serviced. That is, mutual authentication between the authentication server 1 and the client device 3 is completed. The authentication unit 15 outputs a message indicating that the authentication is successful to the second communication unit 14. Then, the second communication unit 14 transmits a message indicating successful authentication to the communication unit 34 of the client device 3. In addition, the authentication unit 15 notifies the service unit 11 that the authentication of the client device 3 has been successful. The service unit 11 starts executing a service for the client device 3 via the third network 6. The service unit 35 of the client device 3 executes a predetermined process in response to a request from the service unit 11.

  Specifically, the service unit 11 of the authentication server 1 requests the client device 3 to transmit the location information (current location) of the client device 3. In response to this request, the service unit 35 of the client device 3 transmits, for example, the location information of the client device 3 detected by the GPS receiver provided in the client device 3 to the authentication server 1 via the third network 6. To do.

  The service unit 11 of the authentication server 1 requests the client device 3 to delete data stored in a storage device (for example, HDD) provided in the client device 3.

In response to this request, the service unit 35 of the client device 3 deletes the data stored in the storage device provided in the client device 3.

  When the generated one-time password does not match the one-time password included in the authentication request, the authentication unit 15 outputs a message indicating that the authentication has failed to the second communication unit 14. The second communication unit 14 transmits a message indicating authentication failure to the communication unit 34 of the client device 3. And the 2nd communication part 14 cancels | releases the connection between the client apparatuses 3 (communication part 34).

  With the configuration described above, the authentication server 1 sends the client device 3 a startup message including a startup command and a one-time password, thereby starting the client device 3 and requesting the client device 3 to request authentication from the authentication server 1. Can be sent. That is, the authentication server 1 can start authentication for executing a service for the client device 3 at the same time as starting the client device 3. In addition, the one-time password can be securely transmitted to the client device 3 by transmitting the activation message including the one-time password via the first network 4 and the second network 5 which are secure networks. Furthermore, since the client device 3 receives the one-time password from the authentication server 1 every time execution of the service is requested, it is not necessary to store the password in the client device 3. For this reason, for example, by comparing the images of the flash memories provided in the client devices 3, it is possible to avoid specifying the storage area in which the password (or electronic certificate) is stored (security hole). Note that the first communication unit 13 and the second communication unit 14 of the authentication server 1 may be provided in one communication module (device).

FIG. 5 shows a communication sequence among the authentication server 1, the message transmission server 2, and the client device 3.
First, the authentication server 1 generates a one-time password for the client device 3. Then, the authentication server 1 requests the message transmission server 2 to transmit a message to the client device 3 (S1). At that time, the authentication server 1 transmits the generated one-time password to the message transmission server 2.

  Next, the message transmission server 2 generates a message including the one-time password in response to the request from the authentication server 1. Then, the message transmission server 2 transmits the generated message to the client device 3 (S2).

  The client device 3 that has received the message establishes an HTTPS session with the authentication server 1 (S3). The client device 3 authenticates the authentication server 1 (server authentication) when establishing a session. For example, the client device 3 determines whether or not the authentication server 1 is a reliable server by using an electronic certificate transmitted by the authentication server 1. When it is determined that the authentication server 1 is a reliable server, the client device 3 establishes a session with the authentication server 1.

  The client device 3 that has established a session with the authentication server 1 transmits an authentication request including the client ID and the one-time password to the authentication server 1 (S4). The authentication server 1 authenticates the client device 3 (client authentication) in response to the authentication request transmitted by the client device 3. The authentication server 1 determines that the client device 3 is a client permitted to connect to the authentication server 1 when the generated one-time password matches the one-time password included in the authentication request. When it is determined that the client device 3 is a client permitted to connect, the authentication server 1 notifies the client device 3 that the authentication is completed (S5). Then, the authentication server 1 starts executing a service for the client device 3 (S6).

  Through the communication sequence described above, the authentication server 1 authenticates the client device 3 and starts executing a service for the client device 3.

Next, an example of the procedure of service start processing executed by the authentication system will be described with reference to the flowchart of FIG.
First, the service unit 11 determines whether to start a service (block B101). For example, the service unit 11 starts a service when a predetermined period has elapsed since the previous service was executed. Also, the service starts the service when, for example, a request to start the service is detected. When the service is not started (NO in block B101), the service unit 11 returns to block B101 and determines whether to start the service again.

  When starting the service (YES in block B101), the service unit 11 determines the client device 3 to be serviced (block B102). The service unit 11 reads the client information 1A corresponding to the determined client device 3 to be serviced. The client information 1A includes the client ID of the client device 3 and a telephone number.

  Next, the password generation unit 12 generates a one-time password for the client device 3 (block B103). For example, the password generating unit 12 generates a value obtained by converting the time of generation using a hash function as a one-time password. Then, the service unit 11 requests the message transmission server 2 to transmit an activation message to the client device 3 (block B104). Specifically, the first communication unit 13 responds to the request for transmitting the activation message by the service unit 11 and the generated one-time password and the activation command for activating the client device 3 via the first network 4. And the telephone number corresponding to the client device 3 are transmitted to the message transmission server 2 (communication unit 21).

  The communication unit 21 of the message transmission server 2 receives the activation message transmission request transmitted by the authentication server 1 (block B105). In addition, the communication unit 21 receives the one-time password, the activation command, and the telephone number transmitted by the authentication server 1. Then, the message generator 22 generates an activation message including a one-time password and an activation command (block B106). Next, the message transmission unit 23 transmits the generated activation message to the client device 3 via the second network 5 using the received telephone number (block B107).

  The message receiving unit 31 of the client device 3 receives the activation message transmitted by the message transmitting unit 23 (block B108). The activation unit 32 is activated in response to the activation instruction included in the activation message (block B109). Then, the communication unit 34 establishes a connection with the second communication unit 14 of the authentication server 1 via the third network 6 (block B110).

  Next, the authentication unit 33 transmits an authentication request including the client ID and the one-time password to the authentication server 1 (block B111). Specifically, the authentication unit 34 outputs an authentication request including a client ID and a one-time password to the communication unit 34. The communication unit 34 transmits an authentication request to the second communication unit 14 of the authentication server 1 via the third network 6.

  The second communication unit receives the authentication request transmitted by the communication unit 34 (client device 3) (block B112). The second communication unit 14 outputs the received authentication request to the authentication unit 15. Then, the authentication unit 15 determines whether or not the one-time password for the client device 3 generated by the password generation unit 12 matches the one-time password included in the received authentication request (block B113). ).

  When the generated one-time password matches the one-time password included in the authentication request (YES in block B113), the authentication unit 15 notifies the client device 3 that the authentication has been successful (block B114). Specifically, the authentication unit 15 outputs a message indicating successful authentication to the second communication unit 14. The second communication unit 14 transmits a message indicating successful authentication to the communication unit 34 of the client device 3. In addition, the authentication unit 15 notifies the service unit 11 that the authentication of the client device 3 has been successful. Then, the service unit 11 starts executing a service for the client device 3 via the third network 6 (block B115). The service unit 35 of the client device 3 executes a predetermined process in response to a request from the service unit 11.

  If the generated one-time password does not match the one-time password included in the authentication request (NO in block B113), the authentication unit 15 notifies the client device 3 that the authentication has failed (block B116). Specifically, the authentication unit 15 outputs a message indicating authentication failure to the second communication unit 14. The second communication unit 14 transmits a message indicating authentication failure to the communication unit 34 of the client device 3. Then, the second communication unit 14 releases the connection with the client device 3 (communication unit 34) (block B117).

  Through the above processing, the authentication server 1 sends the client device 3 a startup message including a startup command and a one-time password, thereby starting the client device 3 and requesting the client device 3 to authenticate the authentication server 1. Can be sent. That is, the authentication server 1 can start authentication for executing a service for the client device 3 at the same time as starting the client device 3.

  The authentication server 1 may transmit an activation message including a one-time password and an activation command directly to the client device 3 without using the message transmission server 2. In other words, the authentication server 1 may have a function of transmitting an activation message corresponding to the function of the message transmission server 2. As a result, the one-time password is transmitted to the client device 3 via a secure network (for example, an intranet or a mobile communication network) connecting the authentication server 1 and the client device 3, and the authentication server 1 and the client device 3 are connected. A service for the client device 3 can be executed via an insecure network to be connected (for example, the Internet).

  In addition, a message requesting a one-time password can be transmitted from the client device 3 to the authentication server 1. Also at that time, the authentication server 1 can transmit the one-time password to the client device 3 via the first network 4 and the second network 5 which are secure networks.

  As described above, according to this embodiment, the client can be authenticated without storing a password in the client device. Since the authentication server 1 transmits the activation message including the one-time password via the first network 4 and the second network 5 which are secure networks, the one-time password can be transmitted to the client device 3 safely. Further, the client device 3 receives a one-time password from the authentication server 1 every time a service execution is requested (that is, the authentication server 1 generates a one-time password every time a service execution is requested). The password need not be stored in the client device 3. For this reason, for example, by comparing the images of the flash memories provided in the client devices 3, it is possible to avoid specifying the storage area in which the password (or electronic certificate) is stored (security hole). In addition, since it is not necessary to store a password (or client certificate) in the client device 3, it is not necessary to update the password periodically, and the operation time is reduced.

  Note that all procedures of the service start processing of the present embodiment can be executed by software. For this reason, it is possible to easily realize the same effect as that of the present embodiment only by installing and executing this program on a normal computer through a computer-readable storage medium storing a program for executing the service start processing procedure. Can do.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

  DESCRIPTION OF SYMBOLS 1 ... Authentication server, 11 ... Service part, 12 ... Password production | generation part, 13 ... 1st communication part, 14 ... 2nd communication part, 15 ... Authentication part, 1A ... Client information, 2 ... Message transmission server, 21 ... Communication part , 22 ... message generation unit, 23 ... message transmission unit, 3 ... client device, 31 ... message reception unit, 32 ... activation unit, 33 ... authentication unit, 34 ... communication unit, 35 ... service unit, 3A ... client ID, 4 ... 1st network, 5 ... 2nd network, 6 ... 3rd network.

Claims (10)

An information processing apparatus capable of providing services to a plurality of client devices,
A one-time password for a first client device in the plurality of client devices is generated, and an activation message including the generated one-time password and an activation command is transmitted via the first network to the first client A transmission means for transmitting to the device;
Receiving means for receiving an authentication request including a one-time password from the first client device activated by the activation message via a second network;
Service means for executing a service for the first client device via the second network when the generated one-time password matches the one-time password in the received authentication request. Information processing device. Each of the plurality of client devices includes a wireless module connectable to a mobile communication network,
The transmission means transmits the one-time password, the activation command, and the telephone number corresponding to the first client device to the short message server via the intranet, and uses the telephone number for the short message server. Via the mobile communication network, causing the first client device to transmit an activation message including the one-time password and the activation command,
The receiving means receives the authentication request from the first client device via an Internet protocol network,
The information processing apparatus according to claim 1, wherein the service unit executes the service via the Internet protocol network. Each of the plurality of client devices includes a wireless module connectable to a mobile communication network,
The transmission means transmits the activation message to the first client device via the mobile communication network,
The receiving means receives the authentication request from the first client device via an Internet protocol network,
The information processing apparatus according to claim 1, wherein the service unit executes the service via the Internet protocol network. The first network is a secure network;
The information processing apparatus according to claim 1, wherein the second network is an insecure network.   The information processing apparatus according to claim 1, wherein the transmission unit generates the one-time password using a hash function. A one-time password for a first client device in a plurality of client devices is generated, and the generated one-time password and an activation command are transmitted to the second information processing apparatus via the first network. 1 with an information processing device,
The second information processing device receives the one-time password and the activation command via the first network, generates an activation message including the one-time password and the activation command, and transmits a second network to the second information processing device. The activation message is transmitted to the first client device via
The first client device receives the activation message via the second network, activates in response to the activation command included in the activation message, and sends an authentication request including a one-time password to the third network. To the first information processing device via
The first information processing apparatus receives the authentication request via the third network, and when the generated one-time password matches the one-time password in the received authentication request, the third information processing apparatus An authentication system for executing a service for the first client device via a network. The first information processing device transmits the one-time password, the activation command, and a telephone number corresponding to the first client device to the second information processing device via an intranet,
The second information processing apparatus receives the one-time password, the activation command, and the telephone number of the first client device via the intranet, and receives the generated one-time password and the activation command. Generating an activation message including, and transmitting the activation message to the first client device via the mobile communication network using the telephone number;
The first client device includes a wireless module connectable to the mobile communication network, receives the activation message via the mobile communication network, and activates in response to the activation command included in the activation message. Sending an authentication request including a one-time password to the first information processing apparatus via the Internet protocol network;
The first information processing apparatus receives the authentication request via the Internet protocol network, and when the generated one-time password matches the one-time password in the received authentication request, the Internet protocol The authentication system according to claim 6, wherein the service is executed via a network. The first network and the second network are secure networks;
The authentication system according to claim 6, wherein the third network is an insecure network. An authentication method for authenticating a plurality of client devices providing a service,
A one-time password for a first client device in the plurality of client devices is generated, and an activation message including the generated one-time password and an activation command is transmitted via the first network to the first client To the device,
Receiving an authentication request including a one-time password from the first client device activated by the activation message via a second network;
An authentication method for executing a service for the first client device via the second network when the generated one-time password matches the one-time password in the received authentication request. Each of the plurality of client devices includes a wireless module connectable to a mobile communication network,
The transmitting includes transmitting the one-time password, the activation command, and a telephone number corresponding to the first client device to a short message server via an intranet, and transmitting the telephone number to the short message server. Using the mobile communication network to cause the first client device to transmit an activation message including the one-time password and the activation command;
Receiving the authentication request from the first client device via an Internet protocol network;
The authentication method according to claim 9, wherein executing the service executes the service via the Internet protocol network.

Images