JP2016197767A - Authentication data verification system, device and method using command from communication apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a system which allows for implementation of user authentication while ensuring convenience of a user, in a form where an application is arranged on the server side.SOLUTION: A user terminal 1 receives a command from a communication apparatus 3 and transmits to an authentication/AP server 2, receives a response generated in the application processing unit 214 of the authentication/AP server 2 for the command and transmits to the communication apparatus 3. The authentication/AP server 2 has an authentication data verification unit 212 for verifying the transmission source of the command. The user terminal 1 generates authentication data based on the N-th command without waiting the response, and transmits the authentication data generated based on the N-th command and the (N+1)th command to the authentication data verification unit 212. The authentication data verification unit 212 generates collation data based on the already received N-th command, and verifies the transmission source of the (N+1)th command, by collating the authentication data received together with the (N+1)th command and the data for collation.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an authentication technique for verifying the legitimacy of a user when using a remotely located program or data.

  Conventionally, wireless tag reading / writing devices, so-called reader / writers, and mobile terminals owned by the user communicate with each other in close proximity to enable technology to enable the user to enjoy various services. It is actively used. At this time, examples of the services provided include use of transportation by an IC boarding card, settlement by electronic money, and electronic identification.

  Recently, a technique has been proposed in which an application program and data for providing such a service are provided on the server side instead of on the terminal side.

  For example, Patent Document 1 has an execution unit that holds and executes an application, generates a response using a command received by relaying the portable terminal from the reader / writer, and transmits the response to the reader / writer via the portable terminal. An SA (Secure Application) server is disclosed. Here, the SA server specifies user data using the secure ID when the authentication process is performed between the mobile terminal and the authentication server, and then receives the received command based on the specified user data. An application related to is running.

JP 2012-123591 A

  However, the conventional technique such as the technique described in Patent Document 1 does not present any authentication mechanism such as verification of the legitimacy of a user when using an application held in a server.

  For example, as a generally adoptable authentication method, there is a method in which a user inputs a user identifier (ID) and a password when using a service. However, in a form in which the portable terminal is held over the reader / writer, inputting the user ID or password before or after the holding over greatly reduces the convenience for the user.

  As another authentication method, it is conceivable to perform an authentication process using a key stored in a secure device such as an IC chip mounted on a terminal. However, since an IC chip generally has a lower processing capability than software installed in a terminal, it takes time to generate data for authentication, and the entire processing time becomes longer. In this way, authentication using an IC chip can also cause inconvenience to users who use the service.

  Accordingly, an object of the present invention is to provide a system, an apparatus, and a method capable of performing appropriate authentication while ensuring user convenience in a form in which an application is arranged on the server side.

According to the present invention, a command can be received from a communication device and transmitted to the outside, and the response generated by an application processing unit capable of processing the command and generating a response can be received and transmitted to the communication device. An authentication data verification system having a user terminal,
The authentication data verification system verifies the transmission source of the received Nth command for the processing of the Nth command (N is a natural number equal to or greater than 2) received and transmitted after the first command by the user terminal. It further has an authentication data verification means,
User terminal
When the Nth command is received from the communication device, the authentication is based on the Nth command or the data related to the Nth command and / or the data generated for the processing of the command received prior to the Nth command. Authentication data generation means for generating data without waiting for a response to the Nth command and using the data;
When the (N + 1) th command is received after the Nth command, the authentication data generated for the processing of the Nth command and the (N + 1) th command are transmitted so as to reach the authentication data verification means Terminal side communication control means for
The authentication data verification means is the verification data based on the Nth command already received or the data related to the Nth command and / or the data generated for the processing of the command received prior to the Nth command. An authentication data verification system characterized by verifying the transmission source of the (N + 1) th command by verifying the authentication data received together with the (N + 1) th command and the verification data. Provided.

As a preferred embodiment of the authentication data verification system according to the present invention, when the authentication data generating means receives the (N + 1) th command from the communication device, the processing of the (N + 1) th command and the Nth command Generate authentication data based on the authentication data generated for
The authentication data verification means, for the processing of the (N + 2) th command, generates verification data based on the previously received (N + 1) th command and the verification data generated for the processing of the Nth command. The transmission source of the (N + 2) command may be verified by verifying the authentication data generated and received together with the (N + 2) command and the generated verification data.

Further, the authentication data verification means of the authentication data verification system according to the present invention generates a random number for the processing of the first command, generates verification data based on the random number,
The authentication data verification system further includes server side communication control means for transmitting the random number to the user terminal,
The authentication data generation means generates authentication data based on the received random number,
When the terminal side communication control means receives the second command after the first command, the terminal side communication control means transmits the authentication data based on the random number and the second command so as to reach the authentication data verification means,
It is also preferable that the authentication data verifying unit verifies the transmission source of the second command by comparing the authentication data received together with the second command and the verification data generated based on the random number.

Furthermore, as another embodiment of the authentication data verification system according to the present invention, the command received from the communication device includes a service identifier for identifying the service to be provided,
The authentication data verification system includes application processing means,
The application processing means has a plurality of applications for processing the service specified by the service identifier, and processes the received command with respect to the command based on information related to the service identifier extracted from the command. It is also preferable to determine the application used to generate the response.

As still another embodiment of the authentication data verification system according to the present invention, when the authentication data verification system receives a command processing start notification or a first command, it specifies a subsequent command processing session. Further comprising a process control means for generating a session identifier of
The authentication data verification means stores the session identifier and the generated verification data in association with each other,
The authentication data verification system further includes server-side communication control means for transmitting the session identifier to the user terminal,
The user terminal further includes data processing means for storing the session identifier in association with the generated authentication data,
The terminal side communication control means transmits the session identifier together with the authentication data and the command so as to reach the authentication data verification means,
It is also preferable that the authentication data verifying unit verify the transmission source of the command by comparing the verification data associated with the received session identifier with the received authentication data.

  Further, the user terminal of the authentication data verification system according to the present invention may receive the command from the communication device and transmit the response to the communication device using the short-range wireless communication method defined by the ISO / IEC standard. preferable.

According to the present invention, there is also provided a user terminal capable of receiving a response generated by an application processing unit capable of receiving a command from a communication device and transmitting the command to the outside and processing the command to generate a response. , An authentication data verification device for verifying authentication data related to communication transmitted from a user terminal capable of transmitting the response to the communication device,
Authentication data verification means for verifying the source of the received Nth command for processing of the Nth (N is a natural number of 2 or more) command received and transmitted after the first command by the user terminal;
When the user terminal receives the (N + 1) th command after the Nth command from the communication device, the Nth command or the data related to the Nth command and / or the Nth command received earlier. The authentication data generated based on the data generated for the processing of the command received first, and the authentication data generated without waiting for the response to the Nth command is used as the (N + 1) th command. And a device-side communication control means capable of receiving together,
The authentication data verification means is the verification data based on the Nth command already received or the data related to the Nth command and / or the data generated for the processing of the command received prior to the Nth command. An authentication data verification device characterized by verifying the transmission source of the (N + 1) th command by verifying the authentication data received together with the (N + 1) th command and the verification data. Provided.

Further, according to the present invention, a command is received from the communication device and transmitted to the outside, and the response generated by the application processing means capable of processing the command and generating a response is received to the communication device. A method for verifying authentication data in an authentication data verification system having a user terminal capable of transmitting,
The authentication data verification system verifies the source of the received Nth command for processing of the Nth command (N is a natural number of 2 or more) received and transmitted after the first command by the user terminal. A data verification means;
This method
When the user terminal receives the Nth command from the communication device, the Nth command or the data related to the Nth command and / or the data generated for the processing of the command received before the Nth command Generating authentication data based on the above without waiting for a response to the Nth command,
When the user terminal receives the (N + 1) th command after the Nth command, the authentication data generated for the processing of the Nth command and the (N + 1) th command reach the authentication data verification means. And the step of sending
The verification data verifying means is the verification data based on the Nth command already received or the data related to the Nth command and / or the data generated for the processing of the command received prior to the Nth command. The authentication data verification method includes the step of verifying the authentication data received together with the (N + 1) th command and the verification data and verifying the transmission source of the (N + 1) th command Is done.

  According to the authentication data verification system, apparatus, and method of the present invention, it is possible to perform appropriate authentication while ensuring user convenience in a form in which an application is arranged on the server side.

It is a schematic diagram which shows one Embodiment of the authentication data verification system by this invention. It is a functional block diagram which shows the function structure in one Embodiment of the user terminal and authentication data verification apparatus which concern on this invention. It is a schematic diagram which shows other embodiment of the authentication data verification system by this invention. It is a schematic diagram which shows further another embodiment of the authentication data verification system by this invention. It is the sequence diagram which showed the process with respect to the 1st command in one Embodiment of the authentication data verification method by this invention. FIG. 6 is a sequence diagram showing processing for an Nth (N ≧ 2) command in the embodiment shown in FIG. 5. It is the sequence diagram which showed the process with respect to the 1st command in other embodiment of the authentication data verification method by this invention. FIG. 8 is a sequence diagram showing processing for an Nth (N ≧ 2) command in the embodiment shown in FIG. 7.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

[Authentication data verification system]
FIG. 1 is a schematic diagram showing an embodiment of an authentication data verification system according to the present invention.

According to FIG. 1, the authentication data verification system of this embodiment is
(A) Generated by an application processing unit (installed in the server 2 in FIG. 1) that receives a command from the reader / writer 3 that is a communication device, transmits it to the outside, and processes the command to generate a response. At least one (usually many) user terminals 1 capable of receiving a response and transmitting the response to the reader / writer 3;
(B) An authentication / application (AP) server 2 is provided.

  Among these, the authentication / AP server 2 is an authentication data verification device that verifies the transmission source of the received command. In this embodiment, an application that can execute service processing in response to a request from the user terminal 1. -It is also a server with programs and data.

  The user terminal 1 is a communication information terminal such as a smart phone, a tablet computer, or a mobile phone with a built-in wireless IC tag. The user terminal 1 (wireless IC tag) is brought close to, held over, or placed on the reader / writer 3 by the user, so that the user terminal 1 (wireless IC tag) is in contact with the reader / writer 3 by ISO represented by NFC (Near Field Communication). / Short-range wireless communication defined by the IEC standard can be performed.

  Specifically, a command as a command is transmitted from the reader / writer 3 to the user terminal 1, and a response as a response is returned from the user terminal 1 to the reader / writer 3. Data such as commands and responses exchanged between the two is called an APDU (Application Protocol Data Unit).

  The user terminal 1 can further communicate with the authentication / AP server 2 via an access network that is a carrier communication network or via the access network and the Internet. Therefore, the user terminal 1 transmits a command transmitted from the reader / writer 3 to the authentication / AP server 2, receives a response generated based on this command in the authentication / AP server 2, and transmits it to the reader / writer 3. It also functions as a relay device.

  Here, the access network may be a wireless carrier communication network such as LTE (Long Term Evolution), WiMAX (Worldwide Interoperability for Microwave Access), or 3G (3rd Generation). Communication between the user terminal 1 and the authentication / AP server 2 may be performed via a wireless local area network (Wi-Fi) such as Wi-Fi (registered trademark). In addition, communication via a private network can be performed.

In this authentication data verification system, the authentication / AP server 2 (authentication data verification device)
(C) Regarding the processing of the Nth command (N is a natural number of 2 or more) received and transmitted after the first command by the user terminal 1, the transmission source of the received Nth command is verified.
That is, for each process of the second command, the third command,... That is received after receiving the first command, the authentication / AP server 2 is a user whose transmission source of the received command is valid. It is verified whether or not it is the terminal 1.

On the other hand, the user terminal 1
(D) When the Nth (N ≧ 2) command is received from the reader / writer 3, “the Nth command or the data related to the Nth command and / or the command received before the Nth command. Authentication data based on the “data generated for the process of” without generating a response to the Nth command and using it,
(E) When the (N + 1) th command is received after the Nth command, the authentication data generated for the processing of the Nth command and the (N + 1) th command are sent to the authentication / AP server 2 ( In other words, it is transmitted so as to reach the authentication data verification device.

Next, the authentication / AP server 2
(F) For verification based on “(Nearly received) Nth command or data relating to Nth command and / or data generated for processing of command received prior to Nth command” Data is generated, and the authentication data received together with the (N + 1) th command is compared with the verification data to verify the transmission source of the (N + 1) th command.

Here, to give one specific example of processing in this system, the user terminal 1
(A) When the first (first) command is received from the reader / writer 3, the authentication / AP server 2 is notified of the command reception, and then the random number generated by the server 2 is acquired from the server 2 together with the response. And return the acquired response to the reader / writer 3,
(B) When the second (second time) command is received, this command and the authentication data generated based on the acquired random number are transmitted to the server 2, and this authentication data is verified by the server 2. Then, the response is acquired from the server 2 and the acquired response is returned to the reader / writer 3.
(C) When a third or later command (after the third) is received, this command and authentication data generated based on the previous command are transmitted to the server 2, and this authentication is performed by the server 2. After receiving the data verification, a response is acquired from the server 2 and the acquired response is returned to the reader / writer 3.

  As described above, when the user terminal 1 transmits the command received from the reader / writer 3 to the authentication / AP server 2, based on the command or the data related to the command received before that, or the processing of the command in advance Send the generated authentication data together. Here, the generation of the authentication data in advance can be executed in a waiting time for a response from the server 2 to the transmitted command or in a waiting time until the next command is received from the reader / writer 3. That is, before the user terminal 1 sends the next command notification to the server 2, authentication data to be transmitted can be generated. On the other hand, when the authentication / AP server 2 receives the command, the authentication / AP server 2 has already generated the authentication data based on the previously received command or the data related to the command.

  In this way, by preparing authentication data in parallel with command processing, in this authentication data verification system, even if the processing capacity of the authentication data generation unit 113 is low, it depends on the time for generating data used for authentication. It is possible to avoid a situation in which the original command processing is delayed. That is, it is possible to suppress an increase in the overall processing time due to generation of data used for authentication. As a result, even in the form in which the application is arranged on the server 2 side, appropriate authentication can be performed while ensuring the convenience for the user.

Note that the authentication data can be, for example, an (electronic) signature. Further, in the configurations (D) and (F), “the Nth command or the data related to the Nth command and / or the data generated for the processing of the command received before the Nth command” For example,
(A) The Nth command itself may be used.
(B) Information such as a service identifier (ID) included in the Nth command may be used. Or
(C) Both the Nth command and the authentication data generated for the processing of the (N-1) th command (during the processing of the (N-1) th command) may be used.

  In any case, the command is data that is specified and meaningful only between the reader / writer 3 and the application, and is a signal that cannot be generated from the outside without permission and cannot be processed if tampered. It is data. By authenticating and guaranteeing the legitimacy of communication, in particular the legitimacy of the command source, by generating authentication data and verification data based on signal data exchanged by communication in such normal command processing Is possible. For example, as shown in (c) above, by generating authentication data and verification data based on both the Nth command and the authentication data generated for the processing of the (N-1) command. Authenticate and guarantee that not only individual commands but also a series of commands are transmitted in the correct order without omission and that they are transmitted from the same terminal to the server 2, that is, a series of command processing and the validity of the transmission source terminal. You can also.

[User terminal, authentication data verification device]
FIG. 2 is a functional block diagram showing a functional configuration in an embodiment of the user terminal and the authentication data verification device according to the present invention.

  According to FIG. 2, the user terminal 1 includes a non-contact communication interface 101, a terminal communication interface 102, a touch panel display (TP / DP) 103, and a processor memory. Here, the processor memory implements a part of the authentication data verification function by executing a program that causes the computer of the user terminal 1 to function.

  Further, the processor memory includes a non-contact communication control unit 111, a terminal communication control unit 112 that is a terminal-side communication control unit including a data processing unit 112a, and an authentication data generation unit 113 as functional components. . Here, the flow of processing shown by connecting the functional components of the user terminal 1 in FIG. 2 with arrows can be understood as part of one embodiment of the authentication data verification method according to the present invention.

  Similarly, according to FIG. 2, the authentication / AP server 2 serving as an authentication data verification apparatus includes a server communication interface 201 and a processor / memory. Here, the processor memory realizes a part of the authentication data verification function by executing a program for causing the computer of the authentication / AP server 2 to function.

  Further, the processor memory includes a server communication control unit 211 that is a server-side communication unit including the processing control unit 211a, an authentication data verification unit 212 including a random number generator 212a, and a service ID management unit. 213 and an application processing unit 214 including an application 214a. Here, the flow of processing shown by connecting the functional components of the authentication / AP server 2 in FIG. 2 with arrows is also understood as part of an embodiment of the authentication data verification method according to the present invention.

  In FIG. 2, the reader / writer 3 is a communication device that performs short-range wireless communication defined by the ISO / IEC standard such as NFC with the non-contact communication interface 101 of the user terminal 1. Moreover, it is a means for providing a service toward the user terminal 1 (user) by performing this communication. Here, the non-contact communication interface 101 includes a wireless IC tag, and can receive a tag search signal (electromagnetic wave) from the reader / writer 3 via the antenna part of the wireless IC tag. Next, the wireless IC tag may be operated by the electromagnetic field energy of the search signal, a response may be returned to the reader / writer 3, and communication including transmission / reception of commands and responses may be started with the reader / writer.

  The non-contact communication interface 101 sequentially receives commands from the reader / writer 3 that are processed by an application or the like installed in the server 2 to generate a response and that generate a service for the user. Hereinafter, among these commands, the first command received will be referred to as the first command, and will be named as the second command, the third command,. The received command includes a service identifier (ID) that identifies a service to be provided, that is, which service is being processed. The service ID is used later to specify an application to be used in the server 2. As such a command, for example, in the case of NFC, a SELECT command defined by ISO / IEC7816-4 can be adopted.

  The non-contact communication control unit 111 controls signals transmitted and received in communication with the reader / writer 3 via the non-contact communication interface 101.

  The terminal communication interface 102 communicates with the server communication interface 201 of the authentication / AP server 2 via an access network (and the Internet) such as a mobile phone communication network.

The terminal communication control unit 112 controls signals transmitted and received in communication with the authentication / AP server 2 via the terminal communication interface 102. Here, the terminal communication control unit 112
(A) When the second command is received from the reader / writer 3 after the first command, the authentication data generated based on the random number previously received from the server 2 and the second command, as will be described later, , Control to transmit to the authentication / AP server 2 (so as to reach the authentication data verification unit 212),
(B) When the (N + 1) th command is received after the Nth (N ≧ 2) command, the authentication data generated for the processing of the Nth command and the (N + 1) th command are Control is performed to transmit to the AP server 2 (so as to reach the authentication data verification unit 212).

  The terminal communication control unit 112 includes a data processing unit 112a. The data processing unit 112 a holds a unique terminal identifier (ID) for identifying the user terminal 1. The terminal ID is later transmitted to the server 2 together with the command, and is used to specify the data in the user data holding unit of the application to be used and to execute the corresponding application process.

  The data processing unit 112 a further generates data to be transmitted to the server 2 in accordance with the command received from the reader / writer 3. For example, in the case of (a), a set of authentication data generated based on a random number, a second command, a terminal ID, and a command notification is generated as transmission data. In the case of (b), a set of authentication data generated for the processing of the Nth command, (N + 1) th command, terminal ID, and command notification is generated as transmission data. The data processing unit 112 a also generates data to be transmitted to the reader / writer 3 according to the response received from the server 2.

  Furthermore, as will be described later, the data processing unit 112a receives the session identifier (ID) generated when the server 2 (processing control unit 211a) receives the first command, together with the response received first, It is also preferable to store the session ID in association with the authentication data generated for the processing of the command when received. In the embodiment for generating the session ID, the data processing unit 112a, as in the case of (b), the authentication data generated for the processing of the Nth command, the (N + 1) th command, and the terminal ID It is also preferable that a pair of the session ID and the command notification is generated as transmission data and transmitted to the authentication / AP server 2 (so as to reach the authentication data verification unit 212).

The authentication data generation unit 113
(A) generating authentication data based on a random number received when a response to the first command is received from the server 2;
(B) When an Nth (N ≧ 2) command is received from the reader / writer 3, “processing of command or data related to Nth command and / or command received prior to Nth command. The authentication data based on the “generated data” is generated without waiting for a response to the Nth command.

Among these, as a preferred embodiment of the above (b), when the authentication data generation unit 113 receives the (N + 1) th command from the reader / writer 3,
(B1) “(N + 1) th command” or (b2) “(N + 1) th command and authentication data generated for processing of Nth command”
It is also preferable to generate authentication data based on the above. In this case, as will be described later, the authentication data verification unit 212 of the server 2 also has a corresponding “first received (N + 1) command”, or “first received (N + 1) command”, and The verification data is generated on the basis of “the verification data generated for the processing of the Nth command”.

  Here, it is also preferable that the authentication data generation unit 113 holds an encryption key set differently for each terminal ID, and generates authentication data using this encryption key. For example, when an authentication data generation request and operation target data such as a command or previously generated authentication data are received from the data processing unit 112a, this encryption key is used to input the received operation target data as authentication data. Generate a signature.

  Further, as a change mode, the authentication data generated by the authentication data generation unit 113 may be a pair of a signature obtained by encrypting “random number or command or data related to command” with a secret key and a corresponding public key. Good. In this case, the authentication data verification unit 212 of the server 2 described later holds data corresponding to “random number or data related to command or command” used for generating the signature as verification data. The verification data can be verified by comparing the verification data with the data obtained by decrypting the received authentication data (signature and public key) with this public key.

  As a further modification, the authentication data generated by the authentication data generation unit 113 may be a signature generated based on the random number acquired from the server 2 immediately before each time a command is received. Is possible. In this case, the authentication data verification unit 212 of the server 2 described later generates and holds verification data in advance based on a random number generated by itself every time a command is received and passed to the user terminal 1. The verification data can be verified by comparing the verification data with the received authentication data. Furthermore, as the authentication data and verification data, various information data that can be used for authentication can be applied in addition to those described above.

  The TP / DP 103 displays, for example, a web browser or the like for applying for a service to the user of the user terminal 1 or selecting a service and receiving provision of the service. It is a user interface for receiving the input operation etc. concerning this.

  Similarly, in FIG. 2, the server communication control unit 211 of the authentication / AP server 2 controls signals transmitted and received in communication with the user terminal 1 via the server communication interface 201.

  In addition, the server communication control unit 211 includes a processing control unit 211a. When receiving the first command (or command processing start notification), the processing control unit 211a generates a session ID for specifying a session for subsequent command processing. Next, for example, when a response to the first command is transmitted to the user terminal 1, the session ID and the random number generated by the authentication data verification unit 212 are transmitted together.

The authentication data verification unit 212 verifies whether the authentication data transmitted for each command to be processed is valid and whether the transmission source terminal is valid. In addition, the authentication data verification unit 212
(A) having a random number generator 212a for generating a random number to be transmitted to the user terminal 1, and generating a random number when a random number generation request is input from the processing control unit 211a for the processing of the received first command; Generate verification data based on this random number,
(B) Regarding the processing of the received second command, the verification data generated based on the previously generated random number is compared with the authentication data received together with the second command, and the second command Verify the source, and
(C) Collation data based on “Nth (N ≧ 2) command or data relating to Nth command and / or data generated for processing of command received prior to Nth command” And the verification data and the authentication data received together with the (N + 1) th command are verified to verify the transmission source of the (N + 1) th command.

  Here, the authentication data verification unit 212 holds the encryption key that is common to the encryption key held by the authentication data generation unit 113 and is set to be different for each terminal ID, and uses this encryption key to store the authentication data. It is also preferable to produce.

  Here, “the Nth (N ≧ 2) command or the data related to the Nth command and / or the data generated for the processing of the command received before the Nth command” in (c) is The authentication data generating unit 113 of the user terminal 1 is set in a form corresponding to the calculation target data when generating the authentication data. For example, when the authentication data generation unit 113 generates authentication data based on “(N + 1) command” or “authentication data generated for the processing of the (N + 1) command and the Nth command”. The authentication data verification unit 212 generates the (N + 1) -th command and the (N + 1) -th command and the N-th command for the received (N + 2) -th command. Data for verification is generated based on the “verified verification data”, the verification data is compared with the authentication data received together with the (N + 2) th command, and the transmission source of the (N + 2) th command is determined. It is verified.

  The authentication data verification unit 212 also preferably stores the session ID generated by the processing control unit 211a and the generated verification data in association with each other. In this case, when the session ID is transmitted together with the authentication data and the command from the user terminal 1, the authentication data verification unit 212, the verification data associated with the received session ID, the received authentication data, Can be verified to verify the source of the received command.

  The service ID management unit 213 stores and manages the service ID and the application in association with each other. Specifically, when the service ID received from the user terminal 1 (or the service ID extracted from the received command) is input from the processing control unit 211a, the application associated with the service ID is specified, and this application Is output to the processing control unit 211a.

  The application processing unit 214 includes a plurality of applications 214a that process the service specified by the service ID, and the command processing process for the received command is based on information related to the service ID extracted from the command. The application 214a to be used for generating a response to is determined, and the application 214a is activated to generate a response.

  Here, the application 214a includes a program and a user data holding unit. Among these, the program interprets the command, refers to the user data, executes the process, and generates a response. The user data holding unit stores data for each user in association with the terminal ID. Specifically, when the processing start notification and the terminal ID are input from the processing control unit 211a, the application processing unit 214 extracts the user data associated with the terminal ID from the user data holding unit, and uses the corresponding program. The process is executed and the generated response is output to the process control unit 211a.

[Other Embodiments of Authentication Data Verification System]
FIG. 3 is a schematic diagram showing another embodiment of the authentication data verification system according to the present invention.

The authentication data verification system of the embodiment shown in FIG.
(A) a user terminal 1 capable of communicating with the reader / writer 3;
(B) It has the authentication server 25 as an authentication data verification apparatus which can communicate with the application (AP) server 4. Here, the user terminal 1 is the user terminal 1 shown in FIG. 2, and the same communication as that performed with the authentication / AP server 2 of FIG. 2 can be performed with the authentication server 25.

  The authentication server 25 has a functional configuration in which the application processing unit 214 is separated from the authentication / AP server 2 of FIG. That is, the authentication server 25 generates verification data, and verifies the verification data by verifying the verification data with the authentication data received from the user terminal 1. Further, the AP server 4 has a functional configuration corresponding to the separated application processing unit 214.

  In the present embodiment, a terminal ID, a command, and the like are transmitted from the authentication server 25 to the AP server 4 together with a request for application processing, and a response to this command is transmitted from the AP server 4 to the authentication server 25. As a result, when viewed from the user terminal 1, the authentication server 25 and the AP server 4 perform the same function as the authentication / AP server 2 of FIG. Will be provided. Note that a plurality of AP servers 4 may be installed for each service provider, for example, and each may be able to communicate with the authentication server 25.

  FIG. 4 is a schematic diagram showing still another embodiment of the authentication data verification system according to the present invention.

The authentication data verification system of the embodiment shown in FIG.
(A) a user terminal 1 capable of communicating with the reader / writer 3;
(B) having an authentication server 26 as an authentication data verification device capable of communicating with the AP server 5; Here, the user terminal 1 is the user terminal 1 shown in FIG. 2, and performs the same communication with the AP server 5 as that performed with the authentication / AP server 2 of FIG. Can be transmitted to reach the authentication server 26.

  The AP server 5 has a functional configuration in which the authentication data verification unit 212 is separated from the authentication / AP server 2 of FIG. In other words, the AP server 5 has a functional configuration corresponding to the service ID management unit 213 and the application processing unit 214, activates a corresponding application based on the received command, generates a response, and transmits the response to the user terminal 1. To do. Further, the authentication server 26 has a functional configuration corresponding to the separated authentication data verification unit 212. That is, verification data is generated, and the verification data is verified by comparing the verification data with the authentication data received from the user terminal 1.

  In the present embodiment, authentication data, a command, a session ID, and the like are transmitted from the AP server 5 to the authentication server 26 together with the verification request, and an authentication data verification result is transmitted from the authentication server 26 to the AP server 5. As a result, when viewed from the user terminal 1, the AP server 5 and the authentication server 26 also perform the same function as the authentication / AP server 2 in FIG. 2 together, perform similar authentication processing, and perform similar services. Will be provided. Also, a plurality of AP servers 5 may be installed for each service provider, for example, and each may be able to communicate with the user terminal 1 and the authentication server 26.

[Authentication data verification method]
FIG. 5 is a sequence diagram showing processing for the first command in the embodiment of the authentication data verification method according to the present invention.

  In the embodiment described below with reference to FIGS. 5 to 8, the authentication data verification means is included in the authentication / AP server 2. However, also in the embodiment of FIG. 3 in which the authentication data verification means is included in the authentication server 25 and the embodiment in FIG. 4 in which the authentication data verification means is included in the authentication server 26, the processing between the functional components is also performed. The sequence can be similar to that described below. Similarly, in the following embodiment, the authentication data generated by the authentication data generation unit 113 of the user terminal 1 is a signature generated using a command as operation target data and using an encryption key. It is also possible to use data in a format other than the signature.

(S501) The reader / writer 3 to which the user terminal 1 is brought close transmits a first command to the non-contact communication interface 101 of the user terminal 1.
Here, the reader / writer 3 may immediately transmit the first command at the timing when the user terminal 1 is detected, or an input corresponding to a processing start request by the user via the TP / DP 103 of the user terminal 1, for example. If there is, the first command may be transmitted upon receiving a notification to that effect.
(S502) The non-contact interface 101 outputs the received first command to the data processing unit 112a.
(S503) The data processing unit 112a extracts a service ID from the input first command.

(S504) The data processing unit 112a outputs the terminal ID held by itself and the extracted service ID to the terminal communication interface 102 together with the process start notification.
(S505, S506) The terminal communication interface 102 transmits the processing start notification, the terminal ID, and the service ID to the server communication interface 201 of the authentication / AP server 2, and the server communication interface 201 receives the received information. Is output to the processing control unit 211a.
(S507) When the process control unit 211a receives a process start notification, the process control unit 211a generates a session ID for identifying the session of this process.

(S508) The processing control unit 211a outputs the acquired service ID to the service ID management unit 213, and requests information on the application to be used.
(S509) The service ID management unit 213 outputs application (AP) identification information corresponding to the input service ID to the processing control unit 211a as a response.
Here, the AP identification information is information that uniquely specifies which application is used to process the service specified by the service ID, and is output in the form of a URL (Uniform Resource Locator) or a function name. May be.

(S510) The process control unit 211a stores the input AP identification information and the acquired terminal ID in association with the generated session ID.
(S511) The process control unit 211a identifies the application 214a that performs the process based on the acquired AP identification information, and outputs the terminal ID to the application processing unit 214 together with the process start notification.
(S512) The application processing unit 214 performs processing by the identified application 214a using the data associated with the input terminal ID among the data stored in the user data storage unit, and generates the generated response. The response is output to the processing control unit 211a.

(S513) The process control unit 211a outputs the generated session ID to the authentication data verification unit 212 together with the random number request.
(S514) In response to the random number request, the authentication data verification unit 212 generates a random number using the random number generator 212 held therein. Further, a calculation is performed on the generated random number using an encryption key to generate verification data.
(S515) The authentication data verification unit 212 stores the generated verification data and the acquired session ID in association with each other.
(S516) The authentication data verification unit 212 outputs the generated random number to the processing control unit 211a.

(S517) The process control unit 211a outputs the input random number, the acquired response, and the generated session ID to the server communication interface 201.
(S518, S519) The server communication interface 201 transmits a random number, a response, and a session ID to the terminal communication interface 102 of the user terminal 1, and the terminal communication interface 102 transmits the received information to the data processing unit 112a. Output to.
(S520, S521) The data processing unit 112a outputs the input response to the non-contact communication interface 101, and the non-contact communication interface 101 sends this response to the reader / writer 3 in response to the command (received in S501). Send as.

(S522) On the other hand, the data processing unit 112a outputs a signature request together with the input random number to the authentication data generation unit 113.
(S523, S524) The authentication data generation unit 113 performs an operation using the encryption key on the acquired random number, generates a signature (authentication data), and outputs the signature to the data processing unit 112a.
(S525) The data processing unit 112a stores the acquired signature and the input session ID.

  With the above processing sequence, a series of processing for the first command is completed until a response to the first command is generated and returned to the reader / writer 3. Here, the data processing unit 112a of the user terminal 1 stores a signature together with the session ID, while the authentication / AP server 2 stores collation data associated with the same session ID. These signature and verification data are used in the processing for the subsequent second command.

  In the embodiment shown in FIG. 5, the user terminal 1 passes the service ID to the authentication / AP server 2 as information accompanying the process start notification. As a change mode to this, the user terminal 1 transmits the first command including the service ID to the server 2, and the processing control unit 211 a of the server 2 extracts the service ID from the received first command. May be used.

  In FIG. 5, a random number request (S513) is made to the authentication data verification unit 212 after the processing start notification (S511) by the processing control unit 211a of the authentication / AP server 2, but the timing of the random number request is also the same. It is not limited. For example, a random number request may be made immediately after the generation of the session ID by the processing control unit 211a (S507) and immediately before the processing start notification by the processing control unit 211a (S511).

  Further, in the embodiment shown in FIG. 5, a response to the command is generated in the authentication / AP server 2 storing the application 214a. However, when the response data is known in advance, when the data processing unit 112a receives the first command, the data processing unit 112a does not wait for a response from the server 2 and generates a response itself or is prepared in advance. The response can be taken out and transmitted to the reader / writer 3.

  FIG. 6 is a sequence diagram showing processing for the Nth (N ≧ 2) command in the embodiment shown in FIG.

(S601) The reader / writer 3 transmits an Nth (N ≧ 2) command to the non-contact communication interface 101 of the user terminal 1 that is in close proximity.
The Nth command is a command that the reader / writer 3 continues to transmit for processing in this session after receiving a response to the (N-1) th command.
(S602) The non-contact interface 101 outputs the received Nth command to the data processing unit 112a.

(S603) The data processing unit 112a extracts the stored session ID and signature.
Here, for example, when a logical channel specified by ISO / IEC7816-4 is supported, specifically, a target service ID is determined according to a channel number specified by a command, and this service ID is supported. Session ID and signature to be extracted. In this step, when the received command is the second command, the extracted signature is the authentication data generated based on the random number, and the received command is the command after the third command. As will be described later, the extracted signature is authentication data generated during the processing of the previously received command. That is, when the Nth command is received, the data processing unit 112a takes out the signature generated during the processing of the (N-1) th command.

(S604) The data processing unit 112a outputs the extracted session ID and signature and the received Nth command together with the command notification to the terminal communication interface 102.
(S605) The terminal communication interface 102 transmits the input information to the server communication interface 201 of the authentication / AP server 2.

(S606) While outputting the command notification, the data processing unit 112a outputs the Nth command together with the signature request to the authentication data generating unit 113.
(S607, S608) The authentication data generation unit 113 performs an operation on the acquired Nth command using an encryption key, generates a signature (authentication data), and outputs the signature (authentication data) to the data processing unit 112a.
(S609) The data processing unit 112a stores the input signature together with the session ID.

  As described above, the authentication data generation unit 113 generates a signature without using it after waiting for a response to the Nth command. For example, the generation of the signature is completed before the data processing unit 112a performs the process of extracting the signature (S603) in the process of the (N + 1) th command received next. It is also preferable that the generated signature is stored in the data processing unit 112a.

(S611) The server communication interface 201 outputs the received command notification, session ID, signature, and Nth command to the processing control unit 211a.
(S612) The process control unit 211a outputs the input session ID, signature, and Nth command to the authentication data verification unit 212 together with the verification request.
(S613) In response to the verification request, the authentication data verification unit 212 extracts verification data associated with the input session ID, and verifies whether the verification data matches the input signature. I do.
(S614) The authentication data verification unit 212 outputs a signature verification result, that is, a result of whether or not the signature matches the verification data to the processing control unit 211a.

(S615, S616) The authentication data verification unit 212 further performs an operation with the encryption key on the input Nth command, generates new verification data, and generates verification data associated with the session ID. The data is updated to the new verification data.

(S617, S618) If the received signature verification result is a match, the process control unit 211a extracts the AP identification information stored in association with the session ID and the terminal ID, sends a command notification, The terminal ID and the Nth command are output to the application processing unit 214.
(S619) The application processing unit 214 performs processing by the application 214a using the data in the user data holding unit associated with the terminal ID, and outputs the generated response as a response to the processing control unit 211a.

(S620, S621) The process control unit 211a outputs the input response to the server communication interface 201, and the server communication interface 201 transmits the response to the terminal communication interface 102 of the user terminal 1.
(S622, S623, S624) The response received by the terminal communication interface 102 is sent to the reader / writer 3 via the data processing unit 112a and the non-contact communication interface 101 as a response to the Nth command (received in S601). Sent.

  With the above processing sequence, a series of processing for the Nth command is completed until a response to the Nth command is generated and returned to the reader / writer 3. Here, the data processing unit 112a of the user terminal 1 stores a signature together with the session ID, while the authentication / AP server 2 stores collation data associated with the same session ID. These signature and verification data are used in processing for the subsequent (N + 1) th command.

  In the embodiment shown in FIG. 6, for the processing of the Nth command, the data processing unit 112a outputs the Nth command together with the signature request to the authentication data generation unit 113, and the authentication data generation unit 113 A signature is generated based on the Nth command. As a preferred modification to this, the data processing unit 112a outputs a “signature for the Nth command and the (N−1) th command” to the authentication data generation unit 113 together with the signature request. May generate a signature based on these pieces of information. In this case, when receiving the verification request, the authentication data verification unit 212 performs “verification for the Nth command and the (N−1) th command instead of performing an operation with the encryption key for the Nth command. By performing an operation on the “data” with the encryption key, new verification data is generated.

  FIG. 7 is a sequence diagram showing a process for a first command in another embodiment of the authentication data verification method according to the present invention. FIG. 8 is a sequence diagram showing processing for the Nth (N ≧ 2) command in the embodiment shown in FIG.

  In the embodiment shown in FIGS. 7 and 8, the session ID generated and used by the processing control unit 211a in the embodiment of FIGS. 5 and 6 is not used. In the embodiment of FIG. 5, this session ID serves as an identification label when the processing control unit 211a stores the terminal ID and the AP identification information, and when the authentication data verification unit 212 stores the verification data. Plays. In the embodiment of FIG. 6, the user terminal 1 (terminal communication interface 102) transmits a session ID together with a command notification to the authentication / AP server 2 (server communication interface 201), and the authentication data verification unit 212 uses it for signature verification. The session ID is used to specify the verification data.

  On the other hand, in the embodiment shown in FIG. 7, the terminal ID is used instead of the session ID. That is, when storing the acquired AP specifying information, the process control unit 211a stores the AP specifying information in association with the terminal ID (S709). Further, when storing the generated verification data, the authentication data verification unit 212 stores the verification data in association with the terminal ID (S714). Here, the verification data may be stored in association with the terminal ID and the service ID. Thereby, for example, it corresponds to the logical channel specified in ISO / IEC7816-4, and the matching data is also associated with the service corresponding to the channel number specified by the command, so that more accurate matching processing can be performed. It becomes possible.

  Further, in response to the processing shown in FIG. 7, as shown in FIG. 8, the user terminal 1 (terminal communication interface 102) authenticates the terminal ID and the service ID instead of the session ID every time a command notification is transmitted. Transmit to the AP server 2 (server communication interface 201) (S805). Further, the processing control unit 211a outputs the terminal ID instead of the session ID to the authentication data verification unit 212 at the time of the verification request (S812), and the verification result using the verification data linked to the terminal ID Is acquired from the authentication data verification unit 212 (S813, S814). Here, as described above, when the verification data is also stored in association with the service ID, the processing control unit 211a outputs the service ID together with the terminal ID to the authentication data verification unit 212 when the verification request is made. (S812) The result of verification using the verification data linked to the terminal ID and service ID is acquired from the authentication data verification unit 212 (S813, S814).

  As described above, the embodiment shown in FIGS. 7 and 8 does not generate and use a session ID, and suppresses adverse effects such as a delay due to signature verification processing, as in the embodiments of FIGS. 5 and 6. A series of command processing can be appropriately executed. It should be noted that by using the session ID for command processing as in the embodiment of FIGS. 5 and 6, it is possible to more reliably prevent fraudulent attempts to impersonate a legitimate terminal and intervene during the processing. It becomes possible to prevent.

  As described above in detail, according to the present invention, by preparing authentication data in advance in parallel with command processing, the occurrence of a situation in which the entire processing time is increased due to generation of data used for authentication. Can be suppressed. Thereby, even in the form in which the application is arranged on the server 2 side, it is possible to perform appropriate authentication while ensuring user convenience.

  Further, since authentication data and verification data are generated based on signals exchanged by communication in normal command processing, it is possible to authenticate and guarantee the validity of communication, particularly the validity of the command transmission source. In addition, for example, by generating authentication data and verification data based on the received command and the data generated for the processing of the command received earlier, not only individual commands but also a series of commands are correct without omission. It is also possible to authenticate and guarantee that data is transmitted to the server 2 in order and from the same terminal.

  Furthermore, in the authentication data verification system, apparatus, and method according to the present invention, it is not necessary to install a service providing application on the user terminal. As a result, for example, a large number of application programs and large-capacity data having a high processing capacity are prepared on the server side, and various authentications are performed while performing appropriate authentication for a user holding a user terminal over a reader / writer or the like. It is also possible to provide advanced services.

  For the various embodiments of the present invention described above, various changes, modifications, and omissions in the technical idea and scope of the present invention can be easily made by those skilled in the art. The above description is merely an example, and is not intended to be restrictive. The invention is limited only as defined in the following claims and the equivalents thereto.

1 User terminal 101 Non-contact communication interface 102 Terminal communication interface 103 TP / DP (touch panel display)
111 Non-contact communication control unit 112 Terminal communication control unit 112a Data processing unit 113 Authentication data generation unit 2 Authentication / AP server (authentication data verification device)
DESCRIPTION OF SYMBOLS 201 Server communication interface 211 Server communication control part 211a Processing control part 212 Authentication data verification part 212a Random number generator 213 Service ID management part 214 Application processing part 214a Application 25, 26 Authentication server (authentication data verification apparatus)
3 Reader / Writer (communication equipment)
4, 5 AP server

Claims (9)

Authentication having a user terminal capable of receiving a command from a communication device, transmitting the command to the outside, receiving the response generated by an application processing unit capable of processing the command and generating a response, and transmitting the response to the communication device A data verification system,
The authentication data verification system verifies the transmission source of the received Nth command for processing of the Nth command (N is a natural number of 2 or more) received and transmitted after the first command by the user terminal. An authentication data verification means for
The user terminal is
When the Nth command is received from the communication device, based on the Nth command or the data related to the Nth command and / or the data generated for the processing of the command received before the Nth command Authentication data generating means for generating authentication data without waiting for a response to the Nth command and using the authentication data;
When the (N + 1) th command is received after the Nth command, the authentication data generated for the processing of the Nth command and the (N + 1) th command are sent to the authentication data verification means. A terminal side communication control means for transmitting,
The authentication data verification means is for verifying based on the Nth command already received or the data related to the Nth command and / or the data generated for the processing of the command received prior to the Nth command. An authentication data verification system for generating data, verifying the authentication data received together with the (N + 1) th command and the verification data, and verifying the transmission source of the (N + 1) th command . The authentication data generation means generates authentication data based on the (N + 1) th command and the authentication data generated for the processing of the Nth command when the (N + 1) th command is received from the communication device. And
For the processing of the (N + 2) -th command, the authentication data verification means performs verification data based on the (N + 1) -th received command and the verification data generated for the processing of the N-th command. The verification data received together with the (N + 2) command and the generated verification data are verified to verify the transmission source of the (N + 2) command. Authentication data verification system described in 1. The authentication data verification means generates a random number for the processing of the first command, generates verification data based on the random number,
The authentication data verification system further includes server side communication control means for transmitting the random number to the user terminal,
The authentication data generation means generates authentication data based on the received random number,
When the terminal-side communication control means receives the second command after the first command, the terminal-side communication control means transmits authentication data based on a random number and the second command so as to reach the authentication data verification means,
The authentication data verification unit verifies the transmission source of the second command by comparing authentication data received together with the second command and verification data generated based on a random number. Item 3. An authentication data verification system according to item 1 or 2. The command received from the communication device includes a service identifier that identifies the service to be provided;
The authentication data verification system includes the application processing means,
The application processing means has a plurality of applications for processing a service specified by the service identifier, and the command processing process is performed based on information related to the service identifier extracted from the command. The authentication data verification system according to any one of claims 1 to 3, wherein an application used to generate a response to is determined. The authentication data verification system further includes processing control means for generating a session identifier for specifying a session for subsequent command processing when a command processing start notification or first command is received,
The authentication data verification means stores the session identifier and the generated verification data in association with each other,
The authentication data verification system further includes server-side communication control means for transmitting the session identifier to the user terminal,
The user terminal further includes data processing means for storing the session identifier and the generated authentication data in association with each other,
The terminal side communication control means transmits the session identifier together with the authentication data and the command so as to reach the authentication data verification means,
2. The authentication data verifying unit verifies the transmission source of the command by comparing the verification data associated with the received session identifier with the received authentication data. 5. The authentication data verification system according to any one of 4 above.   2. The user terminal receives the command from the communication device and transmits the response to the communication device using a short-range wireless communication method defined in the ISO / IEC standard. 6. The authentication data verification system according to any one of 5 above. A user terminal that can receive a response generated by an application processing unit that can receive a command from a communication device, transmit the command to the outside, process the command, and generate a response, and send the response to the communication device. An authentication data verification device for verifying authentication data related to communication transmitted from a user terminal capable of transmission,
Authentication data verification means for verifying the transmission source of the received Nth command for processing of the Nth command (N is a natural number of 2 or more) received and transmitted after the first command by the user terminal;
When the user terminal receives the (N + 1) th command from the communication device after the Nth command, the Nth command or the data related to the Nth command and / or the Nth command received earlier Authentication data generated based on data generated for processing of a command received earlier than the authentication data generated without waiting for a response to the Nth command is used as the (N + 1) th authentication data. Device side communication control means capable of receiving together with the command of
The authentication data verification means is for verifying based on the Nth command already received or the data related to the Nth command and / or the data generated for the processing of the command received prior to the Nth command. An authentication data verification device for generating data and verifying the authentication data received together with the (N + 1) th command and the verification data to verify the transmission source of the (N + 1) th command . A user terminal capable of receiving a command from a communication device, transmitting the command to the outside, receiving the response generated by an application processing unit capable of processing the command and generating a response, and transmitting the response to the communication device. ,
The Nth (N is a natural number of 2 or more) command received after the first command from the communication device reaches an authentication data verification means provided outside that can verify the transmission source of the Nth command. Terminal-side communication control means for transmitting
When the Nth command is received, the authentication data based on the Nth command or the data related to the Nth command and / or the data generated for the processing of the command received prior to the Nth command, Authentication data generating means for generating without waiting for a response to the Nth command,
When the (N + 1) th command is received after the Nth command, the terminal side communication control means uses the authentication data generated for the processing of the Nth command and the (N + 1) th command as the authentication data. The authentication data verification unit that has already received the Nth command by transmitting to reach the verification unit, the Nth command or data relating to the Nth command and / or the Nth command. The authentication data verification means that has generated verification data based on the data generated for the processing of the previously received command is used to verify the authentication data received together with the (N + 1) th command and the verification data. A user terminal that verifies the transmission source of the (N + 1) th command. Authentication having a user terminal capable of receiving a command from a communication device, transmitting the command to the outside, receiving the response generated by an application processing unit capable of processing the command and generating a response, and transmitting the response to the communication device A method for verifying authentication data in a data verification system, comprising:
The authentication data verification system verifies the transmission source of the received Nth command for processing of the Nth command (N is a natural number of 2 or more) received and transmitted after the first command by the user terminal. An authentication data verification means for
The method
When the user terminal receives the N-th command from the communication device, the N-th command or the data related to the N-th command and / or the processing of the command received before the N-th command is generated. Generating authentication data based on the received data without waiting for a response to the Nth command,
When the user terminal receives the (N + 1) th command after the Nth command, the authentication data generated for the processing of the Nth command and the (N + 1) th command are sent to the authentication data verification means. Sending to reach, and
The authentication data verification means is for verifying based on the Nth command already received or the data related to the Nth command and / or the data generated for the processing of the command received prior to the Nth command. Generating authentication data, verifying the authentication data received together with the (N + 1) th command and the verification data, and verifying the transmission source of the (N + 1) th command. Authentication data verification method.

Images