JP4785992B2 - Authentication method and relay device - Google Patents

Description

  The present invention relates to an authentication method for performing user authentication processing for a user of a terminal device, and a relay device used in the method.

  Conventionally, an EAP-TTL system is known as an authentication method for performing user authentication processing while hiding a user ID in a WLAN.

  In the EAP-TTLS scheme, a secure tunnel is constructed between a terminal device and an authentication server, and the terminal device is configured to transmit a user ID to the authentication server via the constructed secure tunnel. .

  However, the EAP-TTLS method has a problem that a step for constructing a secure tunnel is redundant.

  In order to solve this problem, the EAP-AKA system has been considered as a system for performing user authentication processing without constructing a secure tunnel. With reference to FIG. 15, the EAP-AKA system will be briefly described.

  As shown in FIG. 15, in the first user authentication process, in step S1001, the terminal device 100 transmits authentication information including a user ID to the authentication device (relay device) 200A. In step S1002, the authentication device 200A The authentication information is transferred to the authentication server 300A.

  In step S1003, the authentication server 300A performs a user authentication process for the user of the terminal device 100 based on the received authentication information, and then obtains a temporary ID (temporary user ID) for the user of the terminal device 100. Generate.

  In step S1004, the authentication server 300A notifies the temporary ID to the authentication device 200A, and in step S1005, the authentication device 200A notifies the terminal device 100 of the temporary ID.

  The second and subsequent user authentication processes are performed based on the authentication information including the temporary ID transmitted by the terminal device 100 in the authentication server 300A.

  However, when user authentication processing using the conventional EAP-AKA method is realized by a plurality of authentication servers, each authentication server grasps the correspondence between user IDs issued by all authentication servers and temporary IDs. Not working properly.

  This problem will be specifically described with reference to FIG.

  In step S1006, the terminal device 100 transmits authentication information including the temporary ID issued by the authentication server 300A to the authentication device 200A. In step S1007, the authentication device 200A transfers the authentication information to the authentication server 300B. And

  In such a case, in step S1008, the authentication server 300B does not manage the association between the temporary ID and the user ID included in the received authentication information, so the user of the terminal device 100 is determined based on the authentication information. The user authentication process cannot be performed.

  Accordingly, in step S1009, the authentication server 300B notifies the authentication result (NG) indicating that to the authentication device 200A, and in step S1010, the authentication device 200A notifies the authentication result (NG) to the terminal device 100. It will be.

  As a result, in steps S1011 to S1015, the terminal device 100 must obtain the temporary ID issued by the authentication server 300B by performing the initial user authentication process again.

  If there are a plurality of other authentication servers 300, the terminal device 100 needs to obtain temporary IDs issued by all the authentication servers 300 and use different temporary IDs for each authentication server that performs user authentication processing. is there.

  Therefore, the present invention has been made in view of the above points, and in a network in which user authentication processing is performed by a plurality of authentication servers, even if a terminal device does not acquire and use a plurality of temporary IDs, a safe user can be obtained. It is an object of the present invention to provide an authentication method capable of realizing authentication processing and a relay device used in the method.

  A first feature of the present invention is an authentication method for performing user authentication processing for a user of a terminal device, wherein the terminal device transmits first authentication information including a user ID to a relay device; A relay device forwarding the first authentication information to an authentication server corresponding to the user ID; and the authentication server authenticating a user of the terminal device based on the first authentication information. A step of performing processing; and a step of issuing a temporary ID for a user of the terminal device, and transmitting an authentication server ID for identifying the authentication server and the temporary ID to the relay device, the authentication server; The relay device notifying the terminal device of the temporary ID and the authentication server ID; and the terminal device receiving the temporary ID and the authentication server ID. Transmitting the second authentication information to the relay device, and the relay device includes third authentication information including the temporary ID based on the authentication server ID included in the second authentication information. The gist of the invention is that it includes a step of transmitting to the authentication server and a step of performing a user authentication process for the user of the terminal device based on the third authentication information.

  A second feature of the present invention is a terminal device used by a user for which user authentication processing is performed by an authentication server, wherein first authentication information including a user ID is transmitted to a relay device. An authentication information transmission unit, a temporary ID storage unit that stores a temporary ID issued by the authentication server that has received the first authentication information via the relay device, and the temporary ID and the relay device The gist of the present invention is to include a second authentication information transmitting unit that transmits second authentication information including an authentication server ID for identifying the authentication server.

  A third feature of the present invention is a relay device that transfers authentication information transmitted from a terminal device to an authentication server. When the first authentication information including a user ID is received from the terminal device, the user ID When receiving the first authentication information transmitting unit for transferring the first authentication information to the authentication server corresponding to the second authentication information including the temporary ID and the authentication server ID, the authentication server The gist of the present invention is to include a third authentication information transmission unit that transmits third authentication information including the temporary ID to the authentication server identified by the ID.

  According to a fourth aspect of the present invention, there is provided an authentication server that performs a user authentication process for a user of a terminal device, and receives the first authentication information including a user ID transmitted from the terminal device. A first authentication information processing unit for performing user authentication processing for the user of the terminal device based on the authentication information of the terminal device, and temporary ID generation for generating a temporary ID for the user of the terminal device and notifying the terminal device And the third authentication information including the temporary ID transmitted from the terminal device, a user authentication process for the user of the terminal device is performed based on the third authentication information. The gist is to include an authentication information processing unit.

  As described above, according to the present invention, in a network in which user authentication processing is performed by a plurality of authentication servers, secure user authentication processing is realized even if a terminal device does not acquire and use a plurality of temporary IDs. It is possible to provide an authentication method that can be used, and a relay device used in such a method.

  According to the present invention, for example, user authentication processing is performed in a distributed manner such as a network in which a plurality of authentication servers are installed in consideration of load distribution or the like, or a network configured across a plurality of communication carriers. In the network, the user authentication process can be performed safely without exposing the user ID, and the location privacy violation of the user can be prevented.

1 is an overall configuration diagram of an authentication system according to a first embodiment of the present invention. It is a functional block diagram of the terminal device in the authentication system which concerns on the 1st Embodiment of this invention. It is a functional block diagram of the authentication apparatus in the authentication system which concerns on the 1st Embodiment of this invention. It is a functional block diagram of the authentication server in the authentication system which concerns on the 1st Embodiment of this invention. It is a sequence diagram which shows the user authentication process in the authentication system which concerns on the 1st Embodiment of this invention. It is a whole block diagram of the authentication system which concerns on the 2nd Embodiment of this invention. It is a sequence diagram which shows the user authentication process in the authentication system which concerns on the 2nd Embodiment of this invention. It is a whole block diagram of the authentication system which concerns on the 3rd Embodiment of this invention. It is a functional block diagram of the authentication proxy server in the authentication system which concerns on the 3rd Embodiment of this invention. It is a sequence diagram which shows the user authentication process in the authentication system which concerns on the 3rd Embodiment of this invention. It is a whole block diagram of the authentication system which concerns on the 4th Embodiment of this invention. It is a sequence diagram which shows the user authentication process in the authentication system which concerns on the 4th Embodiment of this invention. It is a whole block diagram of the authentication system which concerns on the 5th Embodiment of this invention. It is a sequence diagram which shows the user authentication process in the authentication system which concerns on the 5th Embodiment of this invention. It is a sequence diagram which shows the user authentication process in the authentication system which concerns on a prior art.

(Authentication system according to the first embodiment of the present invention)
With reference to FIG. 1 thru | or FIG. 5, the authentication system which concerns on 1st Embodiment which concerns on this embodiment is demonstrated.

  As shown in FIG. 1, the authentication system according to the present embodiment includes a terminal device 100, an authentication device 200A, and a network 3 of a communication carrier configured by a plurality of authentication servers 300A to 300C. .

  In the authentication system according to the present embodiment, any one of the plurality of authentication servers 300A to 300C configuring the network 3 of the communication carrier is configured to perform user authentication processing for the user of the terminal device 100.

  Further, in the authentication system according to the present embodiment, the terminal device 100 is configured to connect to the authentication device 200A via the wireless LAN, and the authentication device 200A performs all authentication in the network 3 of the communication carrier. It is connected to the servers 300A to 300C.

  As illustrated in FIG. 2, the terminal device 100 includes a user ID storage unit 101, a temporary ID table storage unit 102, an authentication information transmission unit 103, and an authentication result reception unit 104. In the present embodiment, a mobile communication terminal is used as the terminal device 100.

  The user ID storage unit 101 stores a user ID for identifying the user of the terminal device 100. For example, a mobile phone number or the like can be used as the user ID.

  The temporary ID table storage unit 102 stores a temporary ID issued by the authentication server 300 that has received first authentication information (described later) via the authentication device 200A.

  Specifically, the temporary ID table storage unit 102 is configured to store a temporary ID table that associates a “temporary ID” with an “authentication server ID”.

  Here, the “temporary ID” is a temporary user ID issued by the authentication server that has performed the initial user authentication process for the user of the terminal device 100 in order to conceal the user ID.

  The “authentication server ID” is identification information for identifying the authentication server that issued the temporary ID. For example, the URL of the authentication server can be used as the authentication server ID.

  The authentication information transmission unit 103 transmits first authentication information including a user ID to the authentication device 200A during the first user authentication process.

  The authentication information transmission unit 103 refers to the temporary ID table storage unit 102 for the authentication device 200A during the second and subsequent user authentication processes, and performs the second authentication including the corresponding temporary ID and authentication server ID. Information is transmitted.

  Here, the second and subsequent user authentication processes include, for example, periodic user authentication processes such as key update and location registration, and irregular user authentication processes during service connection and transmission. .

  The authentication result receiving unit 104 receives the authentication result received from the authentication server 300 via the authentication device 200A. The authentication result receiving unit 104 may be configured to update the temporary ID table in the temporary ID table storage unit 102 based on the temporary ID included in the received authentication result.

  As shown in FIG. 3, the authentication device 200A includes an authentication information receiving unit 201, a user ID table storage unit 202, an authentication server ID table storage unit 203, an authentication information transfer unit 204, an authentication result receiving unit 205, And an authentication result transfer unit 206. In the present embodiment, the authentication device 200A is configured to serve as a relay device that transfers the authentication information transmitted from the terminal device 100 to any of the authentication servers 300A to 300C.

  The authentication information receiving unit 201 receives, from the terminal device 100, first authentication information including a user ID or second authentication information including a temporary ID and an authentication server ID.

  The user ID table storage unit 202 stores a user ID table that associates “user ID” with “authentication server ID”. That is, the user ID table storage unit 202 manages the authentication servers 300A to 300C that perform the initial user authentication process for each user using the user ID table.

  As shown in FIG. 1, the authentication server ID table storage unit 203 stores an authentication server ID table 2 that associates an “authentication server ID” with an “address”. “Address” indicates the address of the authentication server, for example, the IP address of the authentication server.

  The address of the authentication server 300 identified by the authentication server ID that is not stored in the authentication server ID table 2 is the address of the “default” gateway (“aaa.aaa.aaa.aaa” in the example of FIG. 1). Is set as

  When the first authentication information including the user ID is received from the terminal device 100, the authentication information transfer unit 204 transfers the first authentication information to the authentication server 300 corresponding to the user ID.

  Specifically, when the authentication information transfer unit 204 receives the first authentication information including the user ID, the authentication information transfer unit 204 refers to the user ID table and the authentication server ID table 2 and refers to the authentication server 300 corresponding to the user ID. The first authentication information is transferred to the address.

  When the authentication information transfer unit 204 receives the second authentication information including the temporary ID and the authentication server ID, the authentication information transfer unit 204 refers to the authentication server ID table 2 to the authentication server 300 identified by the authentication server ID. Thus, the third authentication information including the temporary ID is transmitted.

  Specifically, when the authentication information transfer unit 204 receives the second authentication information including the temporary ID and the authentication server ID, the authentication information transfer unit 204 refers to the authentication server ID table 2 and addresses the address corresponding to the authentication server ID. The received second authentication information may be configured to be transferred as it is as the third authentication information, or new third authentication information including at least the temporary ID is generated and transferred. May be.

  Further, the authentication information transfer unit 204 obtains the address of the authentication server 300 corresponding to the user ID included in the received first authentication information or the address corresponding to the authentication server ID included in the received second authentication information. If not found, the first authentication information or the third authentication information may be configured to be transmitted to the default gateway.

  The authentication result receiving unit 205 receives the authentication result indicating the result of the user authentication process for the user of the terminal device 100 and the newly generated temporary ID from the authentication server 300.

  The authentication result transfer unit 206 notifies the terminal device 100 of the authentication result and temporary ID received from the authentication server 300.

  As shown in FIG. 4, the authentication server 300 includes an authentication information receiving unit 301, an authentication processing unit 302, a temporary ID generation unit 303, and an authentication result transmission unit 304.

  The authentication information receiving unit 301 receives the first authentication information and the third authentication information transmitted from the terminal device via the authentication device 200A.

  The authentication processing unit 302 performs user authentication processing for the user of the terminal device 100 based on the first authentication information or the third authentication information received by the authentication information receiving unit 301.

  Specifically, the authentication processing unit 302 authenticates whether or not the user identified by the user ID included in the first authentication information is a legitimate user, and the temporary processing included in the third authentication information. It is configured to authenticate whether or not the user identified by the ID is a regular user.

  The temporary ID generation unit 303 generates a temporary ID for the user of the terminal device 100. Specifically, the temporary ID generation unit 303 is configured to randomly generate a temporary ID for the user of the terminal device 100 when the initial user authentication process is completed. The temporary ID generation unit 303 is configured to randomly generate a new temporary ID for the user of the terminal device 100 when the second and subsequent user authentication processes are completed.

  The authentication result transmission unit 304 authenticates the temporary ID generated by the temporary ID generation unit 303 and the authentication server ID for identifying the authentication server 300 together with the authentication result indicating the result of the user authentication processing by the authentication processing unit 302. The terminal device 100 is notified via the device 200A.

  Next, user authentication processing in the authentication system according to the present embodiment will be described with reference to FIG.

  As shown in FIG. 5, in step S101, the terminal device 100 that desires the first user authentication process has not yet been assigned a temporary ID, and therefore transmits first authentication information including the user ID to the authentication device 200A. .

  In step S102, the authentication device 200A refers to the user ID table and the authentication server ID table 2, and performs the first authentication for the authentication server 300A corresponding to the user ID included in the received first authentication information. Transfer information.

  In step S <b> 103, the authentication server 300 </ b> A performs user authentication processing for the user of the terminal device 100 based on the received first authentication information. Then, the authentication server 300A randomly generates a temporary ID for the user of the terminal device 100.

  In step S104, the authentication server 300A displays the generated temporary ID and the authentication server ID for identifying the authentication server 300A together with the authentication result indicating that the user authentication process for the user of the terminal device 100 is successful. Send to 200A.

  In step S105, the authentication device 200A notifies the terminal device 100 of the received authentication result, temporary ID, and authentication server ID.

  In step S106, the terminal device 100 that desires the second and subsequent user authentication processes transmits second authentication information including the temporary ID and the authentication server ID to the authentication device 200A.

  In step S107, the authentication device 200A refers to the authentication server ID table 2 and based on the authentication server ID included in the received second authentication information, the authentication device 200A transmits the third authentication information including the temporary ID to the authentication server 300A. Send to.

  In step S <b> 108, the authentication server 300 </ b> A performs user authentication processing for the user of the terminal device 100 based on the received third authentication information. Then, the authentication server 300A randomly generates a new temporary ID for the user of the terminal device 100.

  In step S109, the authentication server 300A displays the generated temporary ID and the authentication server ID for identifying the authentication server 300A together with the authentication result indicating that the user authentication process for the user of the terminal device 100 is successful. Send to 200A.

  In step S110, the authentication device 200A notifies the terminal device 100 of the received authentication result, temporary ID, and authentication server ID.

  According to the authentication system according to the present embodiment, even in a network in which user authentication processing for a user of the terminal device 100 is performed by a plurality of authentication servers 300A to 300C in consideration of load distribution and the like, a user who uses a temporary ID is used. The ID can be concealed.

(Authentication system according to the second embodiment of the present invention)
With reference to FIG.6 and FIG.7, the authentication system which concerns on 2nd Embodiment which concerns on this embodiment is demonstrated paying attention to difference with the authentication system which concerns on the above-mentioned 1st Embodiment.

  As shown in FIG. 6, in the present embodiment, an example in which the terminal device 100 shifts from a state in which the terminal device 100 is in communication with the authentication device 200 </ b> A to a state in which the terminal device 100 is in communication with the authentication device 200 </ b> B. explain.

  In the present embodiment, it is assumed that both the authentication devices 200A and 200B are connected to all the authentication servers 300A to 300C in the network 3 of the communication carrier.

  In the present embodiment, it is assumed that the authentication devices 200 </ b> A and 200 </ b> B regularly exchange the updated contents of the authentication server ID table 2 with each other.

  Next, user authentication processing in the authentication system according to the present embodiment will be described with reference to FIG.

  As shown in FIG. 7, in step S201, the terminal device 100 in communication with the authentication device 200A moves in step S202, thereby establishing communication with the authentication device 200B in step S203. To do.

  It is assumed that the terminal device 100 performs initial user authentication processing via the authentication device 200A, and a temporary ID for the user of the terminal device 100 has already been issued by the authentication server 300A.

  In step S204, the terminal device 100 in communication with the authentication device 200B transmits second authentication information including the temporary ID and the authentication server ID to the authentication device 200B.

  In step S205, the authentication device 200B refers to the authentication server ID table 2 and determines the third authentication information including the temporary ID based on the authentication server ID included in the received second authentication information as the authentication server 300A. Send to.

  In step S206, the authentication server 300A performs user authentication processing for the user of the terminal device 100 based on the received third authentication information. Then, the authentication server 300A randomly generates a new temporary ID for the user of the terminal device 100.

  In step S207, the authentication server 300A displays the generated temporary ID and the authentication server ID for identifying the authentication server 300A together with the authentication result indicating that the user authentication process for the user of the terminal device 100 has been successful. Send to 200B.

  In step S208, the authentication device 200B notifies the terminal device 100 of the received authentication result, temporary ID, and authentication server ID.

  According to the authentication system according to the present embodiment, even when a new connection is made to a different authentication device 200B, user authentication processing can be performed by notifying the temporary ID without notifying the user ID.

(Authentication system according to the third embodiment of the present invention)
With reference to FIGS. 8 to 10, an authentication system according to the third embodiment according to the present embodiment will be described by focusing on differences from the authentication system according to the first embodiment described above.

  As shown in FIG. 8, an authentication proxy server 400A is provided in the network 3 of the communication carrier in addition to the plurality of authentication servers 300A to 300C.

  The authentication proxy server 400A is a proxy server that serves as a representative of the plurality of authentication servers 300A to 300C with respect to the authentication device 200A. The authentication proxy server 400A is connected to the authentication device 200A and a plurality of authentication servers 300A to 300C.

  Specifically, as illustrated in FIG. 9, the authentication proxy server 400A includes an authentication information receiving unit 401, a user ID table storage unit 402, an authentication server ID table storage unit 403, an authentication information transfer unit 404, an authentication A result receiving unit 405 and an authentication result transfer unit 406 are provided. In this embodiment, the authentication proxy server 400A is configured to serve as a relay device that transfers authentication information transmitted from the terminal device 100 to any of the authentication servers 300A to 300C.

  Here, the functions 401 to 406 of the authentication proxy server 400A are the same as the functions 201 to 206 of the authentication device 200A shown in FIG.

  Next, a user authentication process in the authentication system according to the present embodiment will be described with reference to FIG.

  As shown in FIG. 10, in step S301, the terminal device 100 that desires the first user authentication process has not yet been assigned a temporary ID, and therefore transmits first authentication information including the user ID to the authentication device 200A. .

  In step S302, the authentication device 200A transfers the received first authentication information to the authentication proxy server 400A to which the authentication device 200A is connected. The authentication device 200A is configured to transfer the received first authentication information to the authentication proxy server 400 selected by a predetermined method when connected to a plurality of authentication proxy servers 400. Also good.

  In step S303, the authentication proxy server 400A refers to the user ID table and the authentication server ID table 2, and performs the first authentication server 300A corresponding to the user ID included in the received first authentication information. Transfer authentication information.

  In step S304, the authentication server 300A performs user authentication processing for the user of the terminal device 100 based on the received first authentication information. Then, the authentication server 300A randomly generates a temporary ID for the user of the terminal device 100.

  In step S305, the authentication server 300A displays the generated temporary ID and an authentication server ID for identifying the authentication server 300A together with the authentication result indicating that the user authentication process for the user of the terminal device 100 is successful. Transmit to server 400A.

  In step S306, the authentication proxy server 400A notifies the received authentication result, temporary ID, and authentication server ID to the authentication device 200A. In step S307, the authentication device 200A receives the received authentication result, temporary ID, and authentication server ID. To the terminal device 100.

  In step S308, the terminal device 100 that desires the second and subsequent user authentication processes transmits second authentication information including the temporary ID and the authentication server ID to the authentication device 200A.

  In step S309, the authentication device 200A transfers the received second authentication information to the authentication proxy server 400A to which the authentication device 200A is connected.

  In step S310, the authentication proxy server 400A refers to the authentication server ID table 2 and determines the third authentication information including the temporary ID based on the authentication server ID included in the received second authentication information as the authentication server. Send to 300A.

  In step S311, the authentication server 300A performs user authentication processing for the user of the terminal device 100 based on the received third authentication information. Then, the authentication server 300A randomly generates a new temporary ID for the user of the terminal device 100.

  In step S312, the authentication server 300A displays the generated temporary ID and an authentication server ID for identifying the authentication server 300A together with the authentication result indicating that the user authentication process for the user of the terminal device 100 has been successful. Transmit to server 400A.

  In step S313, the authentication proxy server 400A notifies the received authentication result, temporary ID, and authentication server ID to the authentication device 200A. In step S314, the authentication device 200A receives the received authentication result, temporary ID, and authentication server ID. To the terminal device 100.

(Authentication system according to the fourth embodiment of the present invention)
With reference to FIGS. 11 and 12, an authentication system according to the fourth embodiment of the present embodiment will be described by focusing on the differences from the authentication system according to the third embodiment described above.

  As shown in FIG. 11, in the present embodiment, an example of a case where the terminal device 100 shifts from a state in communication with the authentication device 200 </ b> A to a state in communication with the authentication device 200 </ b> B due to the movement of the terminal device 100. explain.

  In the present embodiment, an authentication proxy server 400B connected to the authentication device 200B is provided in the network 3 of the communication carrier in addition to the authentication proxy server 400A connected to the authentication device 200A. Both authentication proxy servers 400A and 400B are connected to all authentication servers 300A to 300C in the network 3 of the communication carrier.

  Further, in the present embodiment, it is assumed that both of the authentication proxy servers 400A and 400B regularly exchange the updated contents of the authentication server ID table 2 with each other.

  Next, a user authentication process in the authentication system according to the present embodiment will be described with reference to FIG.

  As shown in FIG. 12, the terminal device 100 in communication with the authentication device 200A in step S401 moves in step S402, thereby establishing communication with the authentication device 200B in step S403. To do.

  It is assumed that the terminal device 100 performs initial user authentication processing via the authentication device 200A, and a temporary ID for the user of the terminal device 100 has already been issued by the authentication server 300A.

  In step S404, the terminal device 100 in communication with the authentication device 200B transmits second authentication information including the temporary ID and the authentication server ID to the authentication device 200B.

  In step S405, the authentication device 200B transfers the received second authentication information to the authentication proxy server 400B to which it is connected. The authentication device 200B is configured to transfer the received second authentication information to the authentication proxy server 400 selected by a predetermined method when connected to the plurality of authentication proxy servers 400. Also good.

  In step S406, the authentication proxy server 400B refers to the authentication server ID table 2 and uses the authentication server ID included in the received second authentication information to determine the third authentication information including the temporary ID as the authentication server. Send to 300A.

  In step S407, the authentication server 300A performs a user authentication process for the user of the terminal device 100 based on the received third authentication information. Then, the authentication server 300A randomly generates a new temporary ID for the user of the terminal device 100.

  In step S408, the authentication server 300A displays the generated temporary ID and the authentication server ID for identifying the authentication server 300A together with the authentication result indicating that the user authentication process for the user of the terminal device 100 is successful. Transmit to server 400B.

  In step S409, the authentication proxy server 400B notifies the received authentication result, temporary ID, and authentication server ID to the authentication device 200B. In step S410, the authentication device 200B receives the received authentication result, temporary ID, and authentication server ID. To the terminal device 100.

(Authentication system according to the fifth embodiment of the present invention)
With reference to FIG. 13 and FIG. 14, an authentication system according to the fifth embodiment according to the present embodiment will be described focusing on differences from the authentication system according to the fourth embodiment described above.

  As illustrated in FIG. 13, in the present embodiment, an example in which the terminal device 100 shifts from a state in communication with the authentication device 200 </ b> A to a state in communication with the authentication device 200 </ b> C due to the movement of the terminal device 100. explain. Note that the authentication system according to the present embodiment is realized by a plurality of communication carriers A and B.

  Specifically, the network 3A of the communication carrier A includes a plurality of authentication servers 300A to 300C and an authentication proxy server 400A, and the network 3B of the communication carrier B authenticates with the plurality of authentication servers 300D and the like. The proxy server 400C is configured.

  Here, the network 3A of the telecommunications carrier A and the network 3B of the telecommunications carrier B are connected via each other's gateway, and can provide a loaning service to each other.

  In the present embodiment, it is assumed that the authentication proxy servers 400A and 400C regularly exchange the updated contents of the authentication server ID table 2 with each other.

  Next, a user authentication process in the authentication system according to the present embodiment will be described with reference to FIG.

  As shown in FIG. 14, in step S501, the terminal device 100 in communication with the authentication device 200A connected to the authentication proxy server 400A in the network 3A of the communication carrier A moves in step S502. Thus, in step S503, communication is established with the authentication device 200C connected to the authentication proxy server 400C in the network 3B of the communication carrier B.

  It is assumed that the terminal device 100 performs initial user authentication processing via the authentication device 200A, and a temporary ID for the user of the terminal device 100 has already been issued by the authentication server 300A.

  In step S504, the terminal device 100 in communication with the authentication device 200C transmits the second authentication information including the temporary ID and the authentication server ID to the authentication device 200C.

  In step S505, the authentication device 200C transfers the received second authentication information to the authentication proxy server 400C to which the authentication device 200C is connected. When the authentication device 200C is connected to a plurality of authentication proxy servers 400 in the network 3B of the carrier B, the authentication device 200C receives the second authentication information received from the authentication proxy server 400 selected by a predetermined method. May be configured to forward.

  In step S506, the authentication proxy server 400C refers to the authentication server ID table 2 and uses the authentication server ID included in the received second authentication information to obtain the third authentication information including the temporary ID as the authentication server. Send to 300A.

  Specifically, the authentication proxy server 400C transfers the third authentication information addressed to the authentication server 300A to the gateway in the network 3A of the communication carrier A, that is, by using the roaming service, 3 is transferred to the authentication server 300A.

  In step S507, the authentication server 300A performs a user authentication process for the user of the terminal device 100 based on the received third authentication information. Then, the authentication server 300A randomly generates a new temporary ID for the user of the terminal device 100.

  In step S508, the authentication server 300A displays the generated temporary ID and the authentication server ID for identifying the authentication server 300A together with the authentication result indicating that the user authentication process for the user of the terminal device 100 is successful. Transmit to server 400C.

  Specifically, the authentication server 300A transfers information (authentication result, temporary ID and authentication server ID) addressed to the authentication proxy server 400C to the gateway in the network 3B of the communication carrier B, that is, a roaming service Is used to transfer information (authentication result, temporary ID and authentication server ID) to the authentication proxy server 400C.

  In step S509, the authentication proxy server 400C notifies the received authentication result, temporary ID, and authentication server ID to the authentication device 200C. In step S510, the authentication device 200C receives the received authentication result, temporary ID, and authentication server ID. To the terminal device 100.

DESCRIPTION OF SYMBOLS 100 ... Terminal device 101 ... User ID memory | storage part 102 ... Temporary ID table memory | storage part 103 ... Authentication information transmission part 104,205,405 ... Authentication result receiving part 200A, 200B, 200C ... Authentication apparatus 201,301,401 ... Authentication information reception Units 202, 402 ... user ID table storage unit 203, 403 ... authentication server ID table storage unit 204, 404 ... authentication information transfer unit 206, 406 ... authentication result transfer unit 300A, 300B, 300C ... authentication server 302 ... authentication processing unit 303 ... Temporary ID generator 304 ... Authentication result transmitters 400A, 400B, 400C ... Authentication proxy server

Claims (1)

An authentication method for performing user authentication processing for a user of a terminal device in a network in which user authentication processing is performed by a plurality of authentication servers,
The terminal device transmits first authentication information including a user ID to the relay device;
The relay device transferring the first authentication information to an authentication server corresponding to the user ID;
The authentication server performing a user authentication process for the user of the terminal device based on the first authentication information;
The authentication server issuing a temporary ID for the user of the terminal device, and transmitting the authentication server ID for identifying the authentication server and the temporary ID to the relay device;
The relay device notifying the terminal device of the temporary ID and the authentication server ID;
The terminal device transmitting second authentication information including the temporary ID and the authentication server ID to the relay device;
The relay device transmitting third authentication information including the temporary ID to the authentication server based on the authentication server ID included in the second authentication information;
The authentication server has a step of performing user authentication processing for a user of the terminal device based on the third authentication information;
In the transferring step, the authentication server corresponding to the user ID using the user ID table stored in the relay device in advance before the relay device receives the first authentication information from the terminal device. Determine
The user ID table associates the user ID with the authentication server ID,
The terminal device transmits the second authentication information to the relay device during the second and subsequent user authentication processes,
The authentication server performs a user authentication process for a user of the terminal device based on the third authentication information during the second and subsequent user authentication processes.

Images