JP2000040064A - Certifying system of network access - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent illegal access in the case of accessing from a mobile terminal to a cable network. SOLUTION: Corresponding to remote access from a mobile terminal 11 to the network, a communication processing part 23 receives an originating ID transmitted from the mobile terminal 11 and dispatches it to an originating ID processing part 27. While using this originating ID, the originating ID processing part 27 requests the acquisition of the past access history of the mobile terminal 11 to a certified information preserving part 25 and when the past access history is received, the originating ID processing part 27 calculates the moving velocity (v) of the mobile terminal 11 from the past access history, the current positional information and the access time or the like of the mobile terminal 11 supplied from the mobile terminal 11. When the moving velocity (v) does not exceed the upper limit value of the moving velocity, the originating ID processing part 27 judges it as legal access and a remote access processing part 29 permits the access. When the moving velocity (v) exceeds the upper limit value of the moving velocity, the access at this time is judged as an illegal one and the remote access processing part 29 inhibits the access.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a network access authentication method applied to an environment in which a mobile client (terminal) acquires desired information from a server on a network.

[0002]

2. Description of the Related Art An information communication process between a mobile terminal and a network server usually uses a dedicated protocol set between the mobile terminal and a remote access server (access server) on the network side. This is performed in a state where network access from the mobile terminal via the mobile communication network is enabled by the connection permission from the mobile terminal.
The connection permission is given to the mobile terminal by authenticating the access server that the login name and the password name input by the terminal carrier are those of a valid user. The dedicated protocol includes PPP (Point-to-Point Protocol), SLIP (Serial Line Internet Protocol) and the like.

[0003]

Conventionally, the determination as to whether or not the mobile terminal carrier is a legitimate user is based on the legitimate user stored in advance in the access server as a criterion. The login name data and the password name data are compared with the login name and the password name given from the mobile terminal, and the determination is made based on whether or not they match. Therefore, even if the login name and the password name from the mobile terminal are those of a legitimate user, the access server cannot confirm whether or not the name is transmitted from the legitimate user. . For example, if the stored data is leaked to a third party for some reason, even if the third party pretends to be a legitimate user and sends the data to the access server, the access server will There is no way to check this, which results in the acceptance of unauthorized network access by third parties.

[0004] Even if the stored data is not leaked to a third party, a login name and a password which can be accessed by a third party who intends to perform wrongdoing by repeatedly inputting various login names and password names. Even if a combination of names is acquired and unauthorized network access is performed using it, it is difficult to prevent it.

[0005] Further, the mobile terminal is stolen on the go, etc.,
When the stolen person accesses the network using the mobile terminal, or when the mobile terminal is duplicated even if it is not stolen and the duplicater illegally accesses the network using the mobile terminal However, it was difficult to prevent such unauthorized access.

SUMMARY OF THE INVENTION It is therefore an object of the present invention to prevent unauthorized access when a mobile terminal accesses a wired network.

[0007]

A network access authentication method according to a first aspect of the present invention is applied to an environment in which a mobile client obtains desired information from a server on a network. Means for judging the validity of the access based on the positional information from the mobile client when accessing the server, and permitting the access when the access is deemed valid.

According to the above configuration, when the mobile client accesses the server, the validity of the access is determined based on the positional information from the mobile client, and the access is permitted when the access is recognized as valid. In accessing the wired network from the terminal, unauthorized access can be prevented.

The network access authentication method according to the second aspect of the present invention is applied to an environment in which a mobile client obtains desired information from a server on a network.
It has means for calculating the moving speed based on the position information from the moving client, and means for judging the validity of the access based on the calculated moving speed, and permitting the access when it is deemed valid.

In a preferred embodiment according to the second aspect of the present invention, the mobile client detects its current position using a GPS or PHS roaming mechanism. The above-mentioned position information includes the position information of the mobile client at the time of the current access and the position information of the mobile client at the time of the previous access, and the access permitting means is obtained from the position information by the moving speed calculating means. When the moving speed exceeds the predetermined moving speed upper limit, the current access is determined to be an unauthorized access.
Further, in the above embodiment, there is further provided a means for determining whether or not the login name and the password name from the mobile client match the previously stored login name data and password name data. When the result of the determination is obtained, the processing operations of the moving speed calculating means and the access permitting means are executed.

A network access authentication method according to a third aspect of the present invention is applied to an environment in which a mobile client obtains desired information from a server on a network.
Means for determining whether or not the mobile client is within a predetermined area based on location information from the mobile client; means for determining the validity of the access based on the determined result; and permitting access when it is determined to be valid. And

[0012] In a preferred embodiment according to the third aspect of the present invention, the mobile client detects its current location using a roaming mechanism of GPS or PHS. The position information described above includes first position information indicating the position of the mobile client at the time of the current access, and second position information set to determine the moving range of the mobile client. Determines that the access is an unauthorized access when it is determined from the first position information that the mobile client is not within the movement range by the determination unit. Further, in the above embodiment, the apparatus further comprises means for confirming whether or not the login name and the password name from the mobile client match the previously stored login name data and password name data,
When a confirmation result indicating that they match is obtained from the confirmation means, processing operations of the determination means and the access permission means are executed.

According to a fourth aspect of the present invention, there is provided a program medium, in an environment where a mobile client acquires desired information from a server on a network, when the mobile client accesses the server, the access is performed based on the positional information of the mobile client. A computer program for operating a computer as a mobile client, a server and a means in a network access authentication method, characterized in that it comprises means for judging the validity of the network, and permitting access when it is justified. Carry.

[0014]

Embodiments of the present invention will be described below in detail with reference to the drawings.

FIG. 1 is a block diagram showing the overall configuration of a mobile client-server system to which an authentication method for network access according to an embodiment of the present invention is applied.

As shown in FIG. 1, the above system comprises a plurality of mobile computers (mobile terminals) 11-1n as mobile clients and a plurality (in principle, at least three or more) of GPS (global positioning systems). ) Satellites (four GPS satellites are shown in this embodiment) 3
1 to 34 and a base station 5 installed on the ground. The system further includes a wired network (network) 7, a remote access server (access server) 9, an authentication server 11, a network server (file server) 13, and a file 15 in addition to the above configuration. Since the mobile terminals 11 to 1n have the same internal configuration, only the mobile terminal 11 will be described below, and the description of the remaining mobile terminals 12 to 1n will be omitted.

The mobile terminal 11 is connected to a file server 13 on a network 7 through a mobile communication network having a base station 5 and the like.
By accessing the file server 13 (remote access) and communicating with the file server 13.
The information (file) desired by the carrier is acquired from the file 15 under the management of. The mobile terminal 11
It includes a transmitting / receiving unit 171, a GPS 191, and an information processing unit 211.

The transmitting / receiving unit 171 is provided for each of the GPS satellites 31 to 34.
GPS information transmitted wirelessly from
191 and the information from the file server 13 transmitted wirelessly through the base station 5 to the information processing section 211.
Give to. The transmitting / receiving unit 171 also transmits the current position information of the mobile terminal 11 given from the GPS 191 to the information processing unit 2.
The information is wirelessly transmitted to the base station 5 together with the caller ID information (that is, the telephone number information of the mobile terminal 11) provided from 11;

The GPS 191 reads the above GPS information through the transmission / reception unit 171 and performs predetermined arithmetic processing to obtain the longitude, latitude and height of the current position of the mobile terminal 11, and obtains the obtained result of the mobile terminal 11. The current position information is output to the transmitting / receiving unit 171.

The information processing section 211 receives a command to provide information (remote access) to the server 13 or a pre-assigned login name, password name, or the like, and inputs the information to the mobile terminal 11 by a carrier. It outputs ID information (telephone number information of the mobile terminal 11), a login name, a password name, and the like to the transmission / reception unit 171 together with an information provision request.
When the information desired by the carrier in response to the information provision request is provided through the transmission / reception unit 171, the information processing unit 211 reads the information and performs a predetermined process.

The base station 5 functions as an interface between the network 7 and the mobile communication network, and includes calling ID information, login name, password name, current position information of the mobile terminal 11, Upon receiving the information provision request, the server (9-1 to 1)
3) Send to the side. The base station 5 also receives the information desired by the carrier transmitted from the server 13 and
Transmit to 71 wirelessly.

The access server 9 stores, in advance, login name data and password name data of a valid user as criteria. The access server 9 transmits the PPP or SL set between the stored login name data and password name data and the mobile terminal 11.
A login name and a password name given from the mobile terminal 11 at the time of remote access are compared using a dedicated protocol such as IP. Then, as a result of the comparison, when the two match, the user of the mobile terminal 11 is determined to be a valid user, and when the two do not match, it is determined to be an unauthorized third party. The result of the determination by the access server 9 is notified from the access server 9 to the authentication server 11 together with the calling ID information and the current position information.

In this embodiment, the remote access (network access) from the mobile terminal 11 is finally authenticated, and it is finally determined whether or not the mobile terminal 11 is to be permitted to connect to the file server 13. Authority is given to the authentication server 11.

That is, the authentication server 11 performs the predetermined arithmetic processing based on the current position information of the mobile terminal 11 at the time of this access only when the result of determination that the user is a valid user is notified from the access server 9. By doing
A final determination is made as to whether the access is a legitimate access (whether the access is an unauthorized access). If it is determined that the access is a legitimate access, the mobile terminal 11 is given permission to connect to the file server 13, but otherwise, the connection permission is not given. When the access server 9 notifies the result of the determination that the user is an unauthorized third party, the connection to the file server 13 is not given without executing the final determination.

Only when the above-mentioned connection permission is given from the authentication server 11, the file server 13
The communication between the mobile terminal 11 and the mobile terminal 11 is read out from the file 15 and transmitted to the mobile terminal 11 through the network 7 and the base station 5.

FIG. 2 is a block diagram showing a functional configuration of the authentication server 11 shown in FIG.

As shown in FIG. 2, the authentication server 11 includes a communication information processing unit 23, an authentication information dependence unit 25, a calling ID processing unit 27, and a remote access processing unit 29.

The communication information processing section 23 receives the calling ID from the mobile terminal 11 through the base station 5 and the network 7 and transfers the calling ID to the calling ID processing section 27 in response to the remote access of the mobile terminal 11.

The authentication information storage unit 25 stores the access history of each of the mobile terminals 11-1n to the file server 13 in the past, that is, the time data ti at the time of access and the position data (xi, yi) at the time of access. Is stored for each of the calling ID information of each of the mobile terminals 11 to 1n. The authentication information storage unit 25 also issues an access history of the mobile terminal (one of 11 to 1n) corresponding to the above-mentioned origin ID in response to an access history acquisition request presenting the origin ID from the origin ID processing unit 27. This is given to the ID processing unit 27.

For example, 200 km / h is set in advance in the calling ID processing unit 27 as the moving speed upper limit value of the mobile terminal 11. The calling ID processing unit 27 is a communication information processing unit 23
, The past access history of the mobile terminal (in this case, the mobile terminal 11) corresponding to the calling ID given by the mobile terminal 11, that is, the time data t1 when the mobile terminal 11 last accessed and the position data (x1 , Y1) from the authentication information storage unit 25. These data, the current access time data t2, and the current position data (x2, y
Based on 2), the moving speed v of the mobile terminal 11 is obtained by the following equation (1).

[0031]

(Equation 1) The calling ID processing unit 27 calculates the moving speed v obtained by the equation (1).
Is compared with the upper limit of the moving speed (200 km / h). As a result, if v ≦ the upper limit of the moving speed, it is determined that the access is legitimate. It is determined that the access speed is not the unauthorized access.
Then, these determination results are given to the remote access processing unit 29.

The remote access processing unit 29 allows the mobile terminal 11 to access the file server 13 when the determination result that the access is legitimate is given from the calling ID processing unit 27, and determines that the access is unauthorized. When the judgment result is given, the access is prohibited. Note that the departure ID
The processing unit 27 stores the authentication information storage unit 25 based on the calling ID.
In the present embodiment, if there is no past access history related to the mobile terminal 11 as a result of making an access history acquisition request, the remote access processing unit 29 treats the access history as a legitimate access.

Next, the processing operation of each unit shown in FIG. 2 will be described.

First, when the mobile terminal 11 remotely accesses the network 7, the communication processing unit 23 transmits a call request transmitted from the mobile terminal 11 through the network 7.
D is received and passed to the calling ID processing unit 27. This departure ID
Is received, the calling ID processing unit 27 makes a request to the authentication information storage unit 25 to obtain a past access history of the mobile terminal 11. On the other hand, when the past access history is given from the authentication information storage unit 25, the calling ID processing unit 2
In step 7, the moving speed v of the mobile terminal 11 is obtained from the past access history, the current position information of the mobile terminal 11 given from the mobile terminal 11, the access time, and the like, based on equation (1).

Next, the originating ID processing section 27 checks whether or not the moving speed v exceeds the upper limit of the moving speed of 200 km / h. The processing unit 29 permits the access. On the other hand, when the moving speed v is a speed that is impossible with the transportation available in daily life, for example, 400 km / h,
It is determined that the current access is an unauthorized access, and the remote access processing unit 29 prohibits the access.

As described above, according to the embodiment of the present invention, even if the access server 9 determines that the access is legitimate, the authentication server 11 determines that the access is legitimate. If not, access is not granted. Therefore, it is possible to prevent unauthorized access by a third party using the login name and the password name obtained by the leak, the theft of the mobile terminal, the repetition of the unauthorized operation, and the like as in the related art.

Next, a modification of the above-described embodiment of the present invention will be described.

In the above-described embodiment, the authentication information storage unit 25 shown in FIG.
Only the access history to the 1n file server 13 is stored for each caller ID information of each of the mobile terminals 11 to 1n.

However, in this modified example, together with the login name and the password name, information on the area (area) where each carrier uses the mobile terminals 11-1n, that is, use area information ｛(xi, yi)-( xj, yj)} is stored in the authentication information storage unit 25 for each of the calling ID information of each of the mobile terminals 11 to 1n. When the communication processing unit 23 receives the calling ID from the mobile terminal 11 and passes it to the calling ID processing unit 27 by remote access of the mobile terminal 11, the calling ID processing unit 27
Is used area information {(x1, y1)-(x2, y2)} of the mobile terminal 11 from the authentication information storage unit 25 according to the calling ID.
To get. Next, by comparing and comparing the current position information (x3, y3) of the mobile terminal 11 given from the mobile terminal 11 with the use area information, it is determined whether or not the current position is included in the use area. To check. As a result of this check, if it is determined that the access is included, it is determined that the access is valid, and the remote access processing unit 29
The above access is permitted. On the other hand, when it is determined that the current position is not included, the current access is determined to be an unauthorized access, and the remote access processing unit 29 prohibits the access.

FIG. 3 is a block diagram showing a functional configuration of an authentication server according to another embodiment of the present invention.

In the above embodiment, each mobile terminal 11
1n to 19n detect their own current positions based on the GPS information individually given from each of the GPS satellites 31 to 34, and use them as the current position information.
Through the server (9-13). However, in the present embodiment, P
Since the HS (Personal Handy Horn System) is adopted, the current position of each of the mobile terminals 11 to 1n can be detected by, for example, each of the mobile terminals 11 to 1n provided from the position information center provided in the base station 5. It will be performed using the location information service regarding. Therefore, in the present embodiment, the authentication server 12 is newly provided with the position information processing unit 31. Other configurations of each unit are the same as those in the above-described embodiment.

The position information processing section 31 includes a calling ID processing section 27
, The mobile terminal (mobile terminal 11 in this case) corresponding to the source ID is requested to provide the current position information at the time of the current access to the position information center. When the current position information ((x2, y2) or (x3, y3) described above) of the mobile terminal 11 is provided from the position information center in response to this request, the information is sent to the calling ID processing unit 2.
7 will be given. Subsequent processing is the same as described above.

It should be noted that the above-mentioned contents relate to each embodiment of the present invention, and do not mean that the present invention is limited to only the above-mentioned contents. For example, the configuration according to the one embodiment and the configuration according to the modification of the one embodiment can be used in combination. In addition to the network access authentication, the present invention can be applied to a service that changes an access level or a service level according to a region to be accessed.

[0044]

As described above, according to the present invention,
In accessing a wired network from a mobile terminal,
It becomes possible to prevent unauthorized access.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an overall configuration of a mobile client-server system to which a network access authentication method according to an embodiment of the present invention is applied.

FIG. 2 is a block diagram showing a functional configuration of the authentication server shown in FIG. 1;

FIG. 3 is a block diagram showing a functional configuration of an authentication server according to another embodiment of the present invention.

[Explanation of symbols]

11 to 1n Mobile computer (mobile terminal) 31 to 33 Artificial satellite 5 Base station 7 Wired network 9 Remote access server (access server) 11 Authentication server 13 Network server (file server) 15 File 171 to 17n Transmission / reception unit 191 to 19n GPS ( Global positioning
System) 211 to 21n Information processing unit 23 Communication information processing unit 25 Authentication information dependence unit 27 Caller ID processing unit 29 Remote access processing unit 31 Position information processing unit

 ──────────────────────────────────────────────────続 き Continued on the front page F term (reference) 5B085 AC03 AE01 AE06 AE23 BG07 5K013 AA07 GA00 GA02 5K067 AA32 BB04 BB21 DD17 DD19 DD23 EE02 EE10 GG11 HH22 HH24 JJ52 JJ56

Claims (10)

[Claims] In an environment where a mobile client obtains desired information from a server on a network, when the mobile client accesses the server,
A network access authentication method comprising means for judging the validity of access based on position information from a mobile client and permitting access when the access is recognized. 2. In an environment in which a mobile client obtains desired information from a server on a network, when the mobile client accesses the server,
Means for calculating the moving speed based on the position information from the moving client; and means for judging the validity of the access based on the calculated moving speed, and permitting the access when the access is deemed valid. Characteristic network access authentication method. 3. The network access authentication method according to claim 2, wherein said mobile client detects its current position using a roaming mechanism of GPS or PHS. 4. The authentication method for network access according to claim 2, wherein the location information includes location information of the mobile client at the time of the current access and location information of the mobile client at the time of the previous access. Network access authentication, wherein the permission means determines that the current access is an unauthorized access when the moving speed calculated by the moving speed calculating means from the position information exceeds a predetermined moving speed upper limit value. method. 5. The network access authentication method according to claim 2, wherein a determination is made as to whether the login name and password name from the mobile client match the previously stored login name data and password name data. The authentication method of network access, further comprising: means for executing processing operations of the moving speed calculating means and the access permitting means when a result of the matching is obtained from the determining means. 6. In an environment in which a mobile client obtains desired information from a server on a network, when the mobile client accesses the server,
Means for determining whether or not the mobile client is within a predetermined area based on position information from the mobile client; and determining the validity of the access based on the determined result. Means for performing network authentication. 7. The network access authentication method according to claim 6, wherein said mobile client detects its current position using a roaming mechanism of GPS or PHS. 8. The authentication method for network access according to claim 6, wherein the position information is set to determine first position information indicating a position of the mobile client at the time of the current access, and to determine a moving range of the mobile client. And the access permission unit determines that the mobile client is not within the movement range from the first position information, and determines that the access is unauthorized access. A network access authentication method characterized by making a judgment. 9. The authentication method for network access according to claim 6, wherein it is determined whether or not the login name and password name from the mobile client match the previously stored login name data and password name data. Means for authentication of network access, wherein the processing operation of the determining means and the access permitting means is executed when a confirmation result indicating a match is obtained from the confirming means. 10. In an environment in which a mobile client obtains desired information from a server on a network, when the mobile client accesses the server,
The mobile client, the server, and the means in the network access authentication method, comprising: a means for judging the legitimacy of the access based on the position information from the mobile client, and comprising means for permitting access when the access is recognized. A computer-readable program medium carrying a computer program for operating a computer.