JP5199745B2 - Remote operation target device and remote terminal authentication method - Google Patents

Description

  The present invention relates to a remote operation target apparatus that mainly accepts operation support from a remote terminal in a remote location and an authentication method for authenticating a connection of remote operation from a remote terminal.

  In recent years, electrical appliances such as personal computers and audio-video devices have various functions, and often require skill for initial setting and use. In particular, users who do not have sufficient technical expertise often encounter configuration problems and usage questions.

  It is often difficult for support specialists, friends, and family members to diagnose and repair these problems and questions over the phone. In that case, a remote operation function is used which can solve the trouble by directly operating the computer in which the problem has occurred from a remote computer.

Conventionally, an attempt has been made to enable remote operation mainly for the purpose of supporting a user who is difficult to operate a terminal, such as a business operator who mainly performs support by remote operation. For example, in the terminal remote maintenance execution method described in Patent Document 1, a remote computer is maintained via the Internet while ensuring a sufficient security level.
Japanese Patent Laid-Open No. 2001-197058

  However, according to the remote control described in Patent Document 1, a user who receives support and a remote operator must share authentication information in advance.

  However, it is often difficult for third-party service providers to support actions directly related to transactions such as user purchases and operations related to privacy.

  In addition, for users with low information literacy (information utilization ability) such as low security awareness of users receiving support or lack of technology to ensure security, authentication from remote terminals is authenticated. It is not easy to properly set the authentication authority and password for the computer.

  In view of this, the present invention has as its solution a problem to securely and reliably realize settings necessary for remote operation of a user with low information literacy.

  The present invention is a technical idea created to solve the above-mentioned problem, and registers contact information such as a remote operator's mail address and telephone number in a remote operation target device that receives support for operation, Only remote terminals that match the contact information are allowed to set passwords necessary for remote operation, and operation support is outsourced.

Specifically, the invention according to claim 1 is a remote operation target device that accepts a remote operation from a remote terminal via a network, and contact information of the remote terminal is connected via the network. Initial authentication confirmation that allows storage means to be registered in advance through input by authentication information input means, and access to set a password for remote operation from the remote terminal by checking against contact information registered in the storage means A terminal state for determining at the time of startup whether or not the password is set , and a management authority authenticating means for authenticating access for remote operation from the remote terminal using a password set after the permission this has a judging means, a processing means and the password in the terminal state determination means for limiting the start if it is determined that the initial state of the unset, the It is characterized in.

The invention described in claim 2 is characterized in that the completion of registration of the contact information is notified to the remote terminal via a network.

The invention according to claim 3 is a remote terminal authentication method in which the remote operation target device authenticates the connection of the remote terminal via the network, and the contact information of the remote terminal is connected via the network. The step of registering in advance in the storage means through the input by the authentication information input means, and the contact address registered in the storage means for accessing the remote operation target device to set a password for remote operation from the remote terminal A step of authorizing by collating with information, a step of authenticating access for remote operation from the remote terminal using a password set after the authorization, and the remote operation target device Determines whether or not the password is set at startup, and starts if the password is determined to be in the initial state It is characterized by having a step of limiting, the.

The invention described in claim 4 further includes the step of notifying the remote terminal of completion of registration of the contact information via a network.

According to the first to fourth aspects of the present invention, more secure authentication can be achieved by authenticating (permitting) password setting access using contact information such as a telephone number notification function and mail address header information. It becomes possible. In addition, the user can register contact information familiar to him / her and designate a remote operator. Furthermore, setting for remote operation is possible without using a temporary password that is difficult for the remote operator to store.

In addition, contact information can be input from a remote location via the network.

Furthermore , according to the invention of claim 2.4 , it is possible to make the remote operator easily recognize the completion of registration of the contact information.

  The present invention envisages use in which a user who wants to receive support mainly by remote operation requests the remote operator to perform initial settings that need to be performed on a terminal to be operated.

  For example, it is necessary to set a password for authenticating a connection from a terminal that performs remote operation (hereinafter referred to as a remote terminal) to a remote operation target terminal (hereinafter referred to as a main terminal) that receives the operation. However, it may be difficult for a user with low information literacy to appropriately set an authentication authority, a password, and the like in the main terminal.

  Therefore, the present invention registers the contact information of the remote operator who requests remote operation in the main terminal as initial authentication information, and authenticates the remote operation only to the remote terminal of the access source that matches the initial authentication information. Password (hereinafter referred to as the administrator password) is permitted. Hereinafter, embodiments of the present invention will be described with reference to the drawings.

(1) First Embodiment FIG. 1 shows a main terminal 1 according to a first embodiment of the present invention. The main terminal 1 is communicably connected to a remote terminal 3 that performs remote operation via a network 2.

  Here, as an example of the main terminal 1, a personal computer (PC) that is generally assumed to have many opportunities for receiving support by remote control will be described as an example. However, the main terminal 1 is not limited to this, and may be any terminal that can be connected to the network 2 such as an audio video device or a TV game machine and has a function of accepting a remote operation. Further, the remote terminal 3 may be a personal computer like the main terminal 1 or may be a mobile terminal such as a mobile phone.

  As shown in FIG. 1, the main terminal 1 includes an input interface 4 such as a remote controller and a keyboard, an input unit 5 that receives a remote operation from the remote terminal 3 and an input through the input interface 4, and A processing unit (for example, a CPU) 6 that executes an operation input from the remote terminal 3 or the input interface 4 and an output that outputs the processing content of the processing unit 6 to the output interface 7 such as the remote terminal 3 or a display. Unit 8, a communication device used for network connection, a memory (RAM) capable of temporarily storing processing data and the like, and a storage unit such as a hard disk drive device.

  Specifically, as shown in FIG. 2, the input unit 5 includes an input receiving unit 9 that receives a connection (access) from the remote terminal 3, and the administrator password is set after the connection of the remote terminal 3 is received. Terminal state determination unit 10 for confirming whether or not the terminal state is determined, terminal state storage unit 11 for storing the determination result of the terminal state determination unit 10, and initial authentication for registering contact information of the remote terminal 3 as initial authentication information An information storage unit 13, an initial authentication confirmation unit 12 that reads the initial authentication information and confirms whether or not it matches the remote terminal 3, a management authority storage unit 15 that stores and registers the administrator password, And a management authority authenticating unit 14 that reads the administrator password and authenticates connection (access) of remote operation from the remote terminal 3.

  Each of the functional blocks 9 to 15 is realized by the processing unit 6 executing a remote operation application installed in the hard disk drive. Of these, the input receiving unit 9 is realized by the communication device, and each of the storage units 11.13.15 is realized by using a memory (RAM) or a hard disk drive device.

  As the initial authentication information, contact information that specifies a remote operation request destination that is difficult to falsify, for example, an e-mail address or a telephone number is registered. Here, as an example, contact information is presented to a store or the like when the main terminal 1 is purchased, and the contact information is input at the store or the like using the input interface 4, and the input contact information is initially authenticated. It is assumed that the information is stored and registered in the storage unit 13 as information. The contact information is not limited to an e-mail address or a telephone number, and if it is difficult to tamper with, other information that can identify the remote operator can be selected and used as appropriate.

  This contact information registration work is a minimum preparation for the main terminal 1 to accept an operation from a remote terminal, and it is necessary to appropriately perform it by eliminating fraud by a store clerk or the like.

  The user of the main terminal 1 with low information literacy by permitting the password setting to authenticate the remote operation with the contact information such as the e-mail address or the telephone number as compared with the case of setting the password by a random character string or the like. However, the remote terminal 3 can be easily confirmed. In addition, when the password is simply entered, it has been technically easy for a store clerk to impersonate another terminal, but information such as an e-mail address or telephone number that is difficult to tamper with is automatically displayed. Thus, since the remote terminal 3 notifies the main terminal 1, such impersonation is prevented.

  After the registration, the remote operation request destination, that is, the remote terminal 3 is notified of the registration completion via the network. For example, it may be notified that registration of contact information as initial authentication information is completed by e-mail or telephone to an e-mail address or a telephone number of the contact information. This notification may be performed when the initial authentication information is registered in the initial authentication information storage unit 13 and the processing unit 6 automatically creates and transmits an e-mail and sends a telephone number. A store clerk may notify by e-mail or telephone. In this case, it can also be notified that the user has been designated as a remote operation manager.

  After this initial setting, the remote terminal 3 can remotely operate the main terminal 1. Hereinafter, an operation example of the main terminal 1 will be described.

<Basic example for initial authentication request>
FIG. 3 shows an example of a basic operation at the time of the initial authentication request of the main terminal 1, that is, at the initial setting. Here, the operation for setting the administrator password is mainly shown. This setting operation will be described below.

  S01: First, the main terminal 1 accepts an operation right request from the remote terminal 3 via the network 2. Specifically, the input accepting unit 9 accepts a session start request and the processing unit 6 confirms this.

  S02: When the session start request is confirmed in S01, the main terminal 1 confirms the terminal state, that is, confirms whether or not an administrator password is set in the main terminal 1. At this time, the processing unit 6 requests the terminal state determination unit 10 to confirm the terminal state. Upon receiving this request, the terminal state determination unit 10 refers to the terminal state storage unit 11 and checks whether an administrator password has already been set.

  S03: As a result of checking in S02, if the administrator password is not set, the main terminal 1 determines that it is the first activation. In this case, the terminal state determination unit 10 returns a determination result indicating the first activation to the processing unit 6.

  S04: When it is determined in S03 that it is the first activation, the main terminal 1 confirms the operation authority of the remote terminal 3. That is, the processing authority 6 makes an operation authority confirmation request to the initial authentication confirmation part 12. The initial authentication confirmation unit 12 that has received this confirmation request reads the initial authentication information stored in the initial authentication information storage unit 13 and confirms whether or not the remote terminal 3 matches the initial authentication information.

  At this time, the type of the remote terminal 3 is limited according to the initial authentication information in the initial authentication information storage unit 13. For example, when a telephone number is registered as the initial authentication information, it is necessary to use a telephone for the remote terminal 3. In this case, the initial authentication confirmation unit 12 confirms the remote terminal 3 by acquiring the telephone number transmitted by the caller number notification function.

  In addition, when a mail address is registered as initial authentication information, it is necessary to use a terminal (such as a personal computer or a mobile phone) capable of sending and receiving mail as the remote terminal 3. In this case, the initial authentication confirmation unit 12 confirms the remote terminal 3 using the sender information of the mail received from the remote terminal 3.

  S05: If there is no problem in the confirmation result in S04, the initial authentication confirmation unit 12 returns a determination result indicating “OK (no problem)” to the processing unit 6, and the process proceeds to S06. In other cases, the processing unit 6 may end the processing.

  S06: If there is no problem in the confirmation result in S05, the main terminal 1 requests the remote terminal 3 to set an administrator password via the network 2. It is desirable that this setting request be made in a manner that matches the mode of the remote terminal 3.

  For example, when the remote terminal 3 is a telephone, the main terminal 1 may request input of an administrator password by a voice message or the like. When the remote terminal 3 is a terminal capable of sending and receiving mail (such as a personal computer or a mobile phone), the main terminal 1 may request input of an administrator password using e-mail or the like.

  S07: The main terminal 1 receives the administrator password input from the remote terminal 3. Specifically, an administrator password is received via the network 2 by the input receiving unit 9 and is confirmed by the processing unit 6.

  S08 to S09: After accepting the administrator password in S07, the main terminal 1 (processing unit 6) requests re-input for confirmation and accepts re-input of the administrator password. This re-input request / re-input may be omitted depending on the setting, or may be performed a plurality of times.

  S10: An administrator password for which input / re-input in S07 to S09 is confirmed is set in the main terminal 1. The administrator password is stored in the management authority storage unit 15 by the processing unit 6.

  S11: When the administrator password is set in S10, it is stored as the terminal state that the administrator password has been set. Specifically, in the main terminal 1 (processing unit 6), data indicating that the administrator password has been set is stored in the terminal state storage unit 11. In this way, the main terminal 1 confirms the operation authority of the remote terminal 3 using the initial authentication information registered in advance, receives the administrator password from the remote terminal 3 having the operation authority, and sets it. ing.

<Other examples at the time of initial authentication request>
FIG. 4 shows another example when the main terminal 1 requests the initial authentication. Here, it is assumed that the main terminal 1 receives an operation right request from the remote terminal 3 and simultaneously receives an administrator password. Hereinafter, a detailed description will be given based on FIG.

  S21: As in S01, the main terminal 1 receives a request for an operation right from the remote terminal 3 via the network 2. Here, it is assumed that the main terminal 1 receives an electronic mail (command mail) in which a newly set administrator password and a processing command for setting the administrator password are described in the text. In this case, the input reception unit 9 receives a command mail in which a session start request and an administrator password are described, and the processing unit 6 confirms this.

  S22 to S25: When the session start request is confirmed in S21, the terminal state and the operation authority are confirmed as in S02 to S05.

  S26: As soon as the operation authority of the remote terminal 3 is confirmed in S25, the administrator password is set. That is, the main terminal 1 executes the command described in the command mail received in S21 in the processing unit 6, and stores the administrator password in the management authority storage unit 15.

  S27: When the administrator password is set in S26, “administrator password set” is stored as the terminal state as in S11.

  S28: When the terminal state is stored in S27, the main terminal 1 notifies the remote terminal 3 of the completion of the administrator password setting. Specifically, the processing unit 6 creates a reply mail of the command mail received in S 21 and sends it back to the remote terminal 3 via the network 2.

  Also in this case, the main terminal 1 can confirm the operation authority of the remote terminal 3 using the initial authentication information, accept the administrator password from the remote terminal 3 having the operation authority, and set it.

<Restrictions on first launch>
FIG. 5 shows an operation example when the activation restriction is set on the main terminal 1. Here, when the administrator password is not set, activation of the main terminal 1 is restricted from the viewpoint of improving security. That is, when the administrator password is not set, the main terminal 1 is permitted to be activated only from the remote terminal 3. Hereinafter, an operation when the main terminal 1 is activated in the initial state will be described.

  S31. S32: When the user turns on the main terminal 1 (S31), the processing unit 6 requests the terminal state determination unit 10 to confirm the terminal state (S32). At this time, the terminal state determination unit 10 refers to the terminal state storage unit 11 and confirms whether an administrator password has already been set.

  S33: When the confirmation result in S32 is not set, the terminal state determination unit 10 returns a determination result that the administrator password is not set to the processing unit 6.

  S34: When an unset determination result is returned in S33, the main terminal 1 notifies the end of activation to the user. At this time, the processing unit 6 outputs a screen, sound, or the like indicating completion of activation to the output interface 7. Thereby, it is possible to prevent the main terminal 1 from being connected to the network 2 in a state where the administrator password is not set, and security is improved. It should be noted that this initial activation restriction is not necessarily set, but is appropriately selected and set according to the necessity of security.

<Basic example of remote control>
FIG. 6 is a sequence diagram showing a remote operation after setting the administrator password. A basic operation example of remote control will be described based on this sequence diagram.

  S41 to S42: The main terminal 1 receives a request for an operation right from the remote terminal 3 via the network 2 in the same manner as S01 to S02, and confirms the terminal state.

  S43: The confirmation result of S42, that is, the determination result that the administrator password has been set is returned from the terminal state determination unit 10 to the processing unit 6.

  S44: When the determination result of S43 is returned, the main terminal 1 requests the remote terminal 3 to input an administrator password. Specifically, the processing unit 6 requests the remote terminal 3 to input an administrator password via the network 2.

  S45: The main terminal 1 receives an administrator password for the input request in S44 from the remote terminal 3. Specifically, an administrator password is received via the network 2 by the input receiving unit 9 and is confirmed by the processing unit 6.

  S46: The main terminal 1 confirms the administrator password received in S45. That is, a confirmation request for the administrator password received from the remote terminal 3 is issued from the processing unit 6 to the management authority authentication unit 14. Upon receiving this confirmation request, the management authority authentication unit 14 reads the administrator password stored from the management authority storage unit 15, and does this match the administrator password input from the remote terminal 3? Confirm whether or not.

  S47: If the administrator password matches as a result of the confirmation in S46, the management authority authentication unit 14 returns a determination result indicating “OK (no problem)” to the processing unit 6, and the process proceeds to S48. If they do not match, the process may return to S44 and accept the input of the administrator password again, or the process may be terminated as it is.

  S48: If there is no problem in the confirmation result in S47, the processing unit 6 returns authentication of the remote terminal 3, that is, connection permission via the network 2.

  S49: The main terminal 1 accepts a remote operation from the remote terminal 3 authenticated in S48. The received remote operation content data is sent from the input unit 5 to the processing unit 6, and the operation is executed by the processing unit 6.

<Other examples of remote control>
FIG. 6 is a sequence diagram illustrating another example of remote operation. Here, the remote operation when the user who owns the main terminal 1 needs to be authenticated is shown. For example, purchase of goods on the Internet requires authentication of the user of the main terminal 1 even if it is a reliable remote operator. Therefore, the main terminal 1 temporarily stores the contents of the remote operation by the remote terminal 3 before execution, and executes the operation after accepting the user's approval for this operation.

  S41 to S49: The remote terminal 3 receives the authentication from the main terminal 1 and performs the remote operation of the main terminal 1 in the same manner as S31 to S39. At this time, the main terminal 1 converts the content of the remote operation into data in the processing unit 6 and temporarily stores it in storage means such as the terminal state storage unit 11.

  S50: The main terminal 1 requests the user to approve the remote operation of the remote terminal 3. Specifically, the processing unit 6 outputs an approval request screen, sound, or the like to the output interface 7.

  S51: In response to the approval request in S50, the user inputs approval / disapproval from the input interface 4 or the like. When the approval is input from the user, the processing unit 6 reads out and executes the remote operation content data stored in the terminal state storage unit 11. On the other hand, if it is denied by the user, the processing unit 6 deletes the data, notifies the remote terminal 3 of the denial, and ends the process.

  As described above, according to the main terminal 1 according to the present embodiment, a user who wants to receive support by remote operation can designate a remote operator simply by presenting contact information such as an email address familiar to him / her. become. In particular, for users with low information literacy, operations such as setting an administrator password, which are difficult to operate, can be supported by remote operation, reducing the work load. Further, the remote operator can connect to the main terminal 1 without using a temporary password that is difficult to memorize, and can support password setting for remote operation.

  Furthermore, if the user specifies a relative who can be trusted even more as a remote operator and requests the administrator password to be set, it is possible to manage the authentication authority more safely while maintaining the convenience of remote operation. become.

(2) Second Embodiment FIG. 8 shows a main terminal 1 according to a second embodiment of the present invention. The main terminal 1 is configured in substantially the same manner as in the first embodiment, and is different in that an initial authentication information input device 16 is connected to the input unit 5 via the network 2.

  The initial authentication information input device 16 is used for registering initial authentication information in the main terminal 1. Specifically, as shown in FIG. 9, the initial authentication information input device 16 receives input of initial authentication information to be set in the main terminal 1 and notification destination information for notifying completion of setting of the initial authentication information. The initial authentication information is set in the input unit 17, the authentication information setting unit 18 that sets the initial authentication information input from the information input unit 17 in the main terminal 1, and the notification destination input from the information input unit 17. The communication function part 19 which notifies that is provided.

  In FIG. 8, the initial authentication information input device 16 is connected to the input unit 5 via the network 2, but the connection mode is not limited to this, for example, the initial authentication information input device 16 may be externally connected directly to the input unit 5. Hereinafter, registration processing of initial authentication information by the initial authentication information input device 16 will be described based on the sequence diagram of FIG.

  S71: The initial authentication information input device 16 makes a connection to the main terminal 1 for registration of initial authentication information.

  S72: A connection permission is returned from the processing unit 6 of the main terminal 1 to the initial authentication information input device 16 in response to the connection of S71.

  S73: Initial authentication information is registered from the initial authentication information input device 16 to the main terminal 1. Specifically, the initial authentication information input device 16 transmits the contact information input from the information input unit 17 by the operator to the main terminal 1 using the authentication information setting unit 18. The main terminal 1 (processing unit 6) stores this contact information in the initial authentication information storage unit 13 as initial authentication information.

  S74: The main terminal 1 (processing unit 6) responds to the initial authentication information input device 16 that the registration in S73 has been completed normally.

  S75: When the normal end is answered in S74, the initial authentication information input device 16 notifies the remote terminal 3 that the registration is completed via the network.

  As the notification method, one type of method may be set in the initial authentication information input device 16 in advance, or a plurality of methods may be set. When there are a plurality of types of notification methods, it is preferable that the initial authentication information input device 16 automatically selects the notification method according to the notification destination information.

  For example, when the “@” mark is included in the notification destination information, the notification destination is automatically recognized as a mail address, and notification is made by electronic mail. On the other hand, when the notification destination information is a 10-digit to 11-digit number starting with 0, it automatically recognizes that the notification destination is a telephone and performs a telephone notification.

  When the notification destination is a mail address, the notification text recorded in advance in the initial authentication information input device 16 may be transmitted by electronic mail. The notification text may include inquiry information such as the telephone number and mail address of the user of the main terminal 1.

  In this case, the person who has received the notification can confirm to which main terminal 1 the initial authentication information is set. When the inquiry information is included in the notification text, the information input unit 17 of the initial authentication information input device 16 has a function of accepting input of inquiry information.

  The notification timing may be performed every time the initial authentication information is registered, or the notification destination information is recorded in the initial authentication information input device 16 and a notification text is transmitted from the operator to the notification destination. The notification text may be transmitted at the timing of receiving the operation.

  Here, since the initial authentication information input device 16 is connected to the input unit 5 via the network 2, contact information can be registered as initial authentication information in the main terminal 1 via the network 2. . Therefore, in a store or the like, initial authentication information can be registered in the main terminal 1 via the network 2 even from a remote place, and registration completion notification to the remote terminal 3 can be easily performed.

  In addition, this invention is not limited to the said embodiment, For example, it can provide also as a remote operation program which makes a computer function as the said input part 5. FIG. In this case, each step of FIGS. 3 to 7 and FIG. 10 of the main terminal 1 is executed by installing the remote operation program in the computer. Therefore, a user who wants to receive remote operation support may request a store to install the remote operation program when purchasing a product.

The block diagram of the remote operation target apparatus which concerns on 1st Embodiment of this invention. The functional block diagram of the input part. The sequence diagram which shows the basic example at the time of the first authentication request | requirement. The sequence diagram which shows another example. The sequence diagram of the restriction processing example of the same first start. The sequence diagram which shows the basic example of the same remote operation. The sequence diagram which shows another example. The block diagram of the remote operation target apparatus which concerns on 2nd Embodiment of this invention. The functional block diagram of the initial authentication information input device. The sequence diagram of the registration process of the same initial authentication information.

Explanation of symbols

1 ... Main terminal (remote operation target device)
DESCRIPTION OF SYMBOLS 2 ... Network 3 ... Remote terminal 4 ... Input interface 5 ... Input part 6 ... Processing part 7 ... Output interface 8 ... Output part 9 ... Input reception part 10 ... Terminal state determination part 11 ... Terminal state memory | storage part 12 ... Initial authentication confirmation part DESCRIPTION OF SYMBOLS 13 ... Initial authentication information memory | storage part 14 ... Management authority authentication part 15 ... Management authority memory | storage part 16 ... Initial authentication information input device 17 ... Information input part 18 ... Authentication information setting part 19 ... Communication function part

Claims (4)

A remote operation target device that accepts remote operation from a remote terminal via a network,
Storage means for previously registering the contact information of the remote terminal through input by an authentication information input means connected via a network ;
Initial authentication confirming means for permitting access to set a password for remote operation from the remote terminal in comparison with contact information registered in the storage means;
Management authority authentication means for authenticating access for remote operation from the remote terminal using a password set after the permission;
Terminal state determination means for determining at startup whether or not the password is set;
Processing means for restricting activation if the terminal state determination means determines that the password is in an initial state that has not been set;
A remote operation target device characterized by comprising: The registration completion of the contact information, the remote operation target apparatus according to claim 1, wherein the notifying the remote terminal via a network. A remote terminal authentication method in which a remote operation target device authenticates connection of a remote terminal via a network,
Pre-registering the contact information of the remote terminal in the storage means through input by an authentication information input means connected via a network;
The remote operation target device permitting access to set a password for remote operation from the remote terminal in comparison with the contact information registered in the storage means;
The remote operation target device authenticates access for remote operation from the remote terminal using a password set after the permission;
Determining whether or not the password is set at the time of startup of the remote operation target device, and limiting the startup if it is determined that the password is not set in an initial state;
A remote terminal authentication method comprising: The remote terminal authentication method according to claim 3 , further comprising a step of notifying the remote terminal of completion of registration of the contact information via a network.

Images