JP2003032362A - Access authentication controller, communication terminal, access authentication system, access authentication method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an access authentication system that eliminates the need for input operations of a user ID and a password, when a communication terminal is connected to a network so as to simply and securely authenticate a user. SOLUTION: The communication terminal 30 makes a dialing of a particular dial number for access to an ISP management device 18 via a telephone line (S11). The ISP management device 18 gives a user code and a password to the call, when the caller number is a registered caller number and transmits the resulting call to the communication terminal 30 via a telephone line (S3). The communication terminal 30 registers the received user code and password to a user code/password storage section 41 (S14) and transmits the received user code and password to an ISP server 19 via an XDSL line 6 or the like, when making ISP access via the XDSL line (S31). The ISP server 19 starts network access to the communication terminal 30, when the received user code and password are a regular.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a device and a procedure for performing connection authentication when a communication terminal device starts data communication through a communication line such as an XDSL line, and a connection authentication control device and communication used for this connection authentication. The present invention relates to a terminal device, a connection authentication system, a connection authentication method, and a program.

[0002]

2. Description of the Related Art In recent years, it has been widely practiced to connect to a network such as the Internet by a communication terminal device such as a personal computer (PC) to send and receive e-mail and receive various contents by data communication. There is. Conventionally, as a connection authentication method for making a connection with an Internet service provider (hereinafter, referred to as ISP connection), a method described in Japanese Patent Application Laid-Open No. 2000-174893 is known. In this method, the connection authentication control device receives the caller ID of the mobile phone terminal and stores it in a memory, and the received caller ID and the mobile phone of the Internet phone user registered in the memory in advance. The user is authenticated by comparing the ID of the telephone terminal and confirming that the IDs match. As described above, conventionally, a method of performing user authentication by comparing caller IDs has been proposed in order to easily and safely connect to the Internet.

[0003]

However, ADSL (Asymmetric Digital Subscriber), which is becoming popular recently,
In an ISP connection using an XDSL line such as r Line), there is no authentication means for identifying the user such as a caller ID (notification of caller number) like a normal telephone line. When making an ISP connection, it is necessary to set a user ID and a password as an authentication code, which requires the user to perform an input operation for this purpose.
In particular, for users who are unfamiliar with terminals such as PCs, the ISP connection may be difficult because the input operation of the authentication code is troublesome or the operation method is not well understood. In addition, there is a possibility that a password or the like may be leaked due to such an input operation of the authentication code, and a problem may occur in terms of security.

The present invention has been made in view of the above circumstances, and when connecting a communication terminal device to a network for data communication, an input operation of an authentication code such as a user ID and a password is not required, and it is simple and safe. An object is to provide a connection authentication control device, a communication terminal device, a connection authentication system, a connection authentication method, and a program that can perform authentication.

[0005]

A connection authentication control device of the present invention is a connection authentication control device for performing data communication with a communication terminal device connected via a first line, Calling party number receiving means for receiving a calling party number by calling through the second line, and calling party number comparing means for comparing the received calling party number with a previously registered calling party number. And based on the comparison result, when the calling number matches the registered one, an authentication code assigning means for assigning an authentication code corresponding to the communication terminal device through the second line; An authentication means for receiving the authentication code transmitted from the communication terminal device through the line and authenticating the received authentication code, and a connection control means for starting a connection with the communication terminal device when the authentication is confirmed. And having And it features.

A communication terminal device of the present invention is a communication terminal device for performing data communication with a connection authentication control device connected through a first line, and the connection authentication control is performed by circuit switching through a second line. Dial number storage means for storing a specific dial number for making a dial-up connection with the device; specific dial number calling means for transmitting the stored specific dial number through a second line to make a call; Authentication code receiving means for receiving the authentication code given from the connection authentication control device through a second line, authentication code storage means for storing the received authentication code, and the stored authentication code for the first authentication code. Authentication code transmitting means for transmitting to the connection authentication control device via a line, and if the connection authentication control device confirms the authentication of the transmitted authentication code, the connection A connection control unit to initiate a connection with testimony controller, characterized by comprising a.

The connection authentication system of the present invention is an authentication for connecting the connection authentication control device and the communication terminal device when starting data communication between the communication terminal device and the connection authentication control device through the first line. And a dial number storage means for storing a specific dial number for dial-up connecting the communication terminal device to the connection authentication control device by circuit switching through a second line. A specific dial number calling means for sending the specified dial number from the communication terminal device through the second line to call the connection authentication control device; and a second line from the communication terminal device. And a calling party number receiving means for receiving a calling party number by calling through the calling party, and a calling party number for comparing the received calling party number with a previously registered calling party number. If the calling party number matches the registered one based on the comparison result with the person number comparing means, an authentication code corresponding to the communication terminal device is given from the connection authentication control device through the second line. Authentication code giving means for receiving the authentication code given from the connection authentication control device through the second line, and storing the authentication code, and the communication terminal for storing the stored authentication code. Authentication code transmitting means for transmitting from the device to the connection authentication control device through the first line, and authentication for receiving the authentication code transmitted from the communication terminal device through the first line and authenticating the authentication code Means and connection control means for starting the connection between the connection authentication control device and the communication terminal device when the authentication of the authentication code is confirmed. .

The connection authentication method of the present invention is a connection authentication method for authenticating a connection with the communication terminal device when data communication is started between the communication terminal device and the connection authentication control device through the first line. A caller number receiving step of receiving a caller number by the call from the communication terminal device through the second line, and the received caller number and a caller number registered in advance. Based on the comparison result of the calling party number and the comparison result, when the calling party number matches the registered one, an authentication for giving a corresponding authentication code to the communication terminal device through the second line. A code assigning step; an authentication step of receiving an authentication code transmitted from the communication terminal device through the first line and authenticating the received authentication code; and, if the authentication is confirmed, the communication A connection control step of starting the connection to the end device, and having a.

The present invention also provides a program having a program code for causing a computer to execute any one of the connection authentication methods described above.

According to the present invention, when a connection authentication control device makes a network connection for data communication through a first line using a communication terminal device, a dial-up connection is made to the connection authentication control device by a second line. Then, the user authentication is performed using the calling party number, and the connection authentication control device assigns an authentication code such as a user code or password to the communication terminal device on the user side, and data communication is performed through the first line using the authentication code. Authenticate the connection. As a result, it is possible to eliminate the need for inputting an authentication code such as a user code or password for authentication, and it is possible to perform authentication easily and safely.

[0011]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing the configuration of a connection authentication system according to an embodiment of the present invention. In this embodiment, a personal computer (PC) or the like is used as a communication terminal device, and ADSL (Asymmetric Digital) is used.
A configuration example in the case of connecting to an Internet service provider (ISP) that provides a connection service to the Internet network via an XDSL line such as a Subscriber Line) will be shown.

In this connection authentication system, the communication terminal device on the user side is an Internet service provider (IS
P) is for authenticating a registered user when starting a connection with the connection authentication control device 10 on the ISP side and a personal computer on the user side, which are mainly connected via the subscriber line 2 of the telephone network. The communication terminal device 30 includes a (PC) and the like. The communication terminal device 30 can also be configured by providing a dedicated XDSL connection authentication device separately from the communication terminal device.

On the user side of the subscriber line 2, there is provided a splitter 31 for separating a voice signal for a call and a DSL signal. On the other hand, a switching center 16 is provided on the ISP side. The switching center 16 is provided with a splitter 11 for separating a voice signal and a DSL signal, a circuit switch 12 for switching a line of a telephone network, and conversion and switching of a DSL signal. Do DSL
An XDSL modem 13 such as an AM (DSL Access Multiplexor) is provided. An ISP management device 18, which is a specific dial destination, is connected to the telephone line 3 separated by the splitter 11 via a line exchange 12. The XDSL line 4 separated by the splitter 11 is X
IP (Internet Protocol) via DSL modem 13
It is connected to a communication line 15 such as a network or a dedicated line, and is connected to a server device (ISP server) 19 that provides various network services via the communication line 15. The ISP server 19 is connected to the Internet network 17 via a gateway device (not shown), a router, etc., and can access various server devices 20 that deliver electronic mail, various contents, and the like.

The ISP management device 18 includes a calling number receiving unit 21, a calling number comparing unit 22, a calling number list storage unit 23, a user code / password assigning unit 24, and a user code / password managing unit 25. Configured to have. The calling party number receiving unit 21 receives the calling party number of the telephone line 5 called by the user's communication terminal device 30 at the time of dial-up performed at the start of connection authentication. This calling number can be obtained by using the calling number notification service provided in the subscriber line 2. The calling party number comparing section 22 compares the calling party number received by the calling party number receiving section 21 with the telephone number of the registered user registered in the calling party number list storage section 23 in advance, and compares them. The result is notified to the user code / password assigning unit 24.

The user code / password assigning unit 24
If the calling number comparison unit 22 compares the calling numbers, the registered user is automatically given a unique user code and password, and the telephone line 3,
5 to the communication terminal device side. user code·
The password management unit 25 manages the user code / password assigned by the user code / password assignment unit 24 for each registered user.

On the other hand, the communication terminal device 30 on the user side has a dial connection section 34, a communication processing section 35, and a data processing section 3.
It is configured to have 6. The dial connection unit 34 of the communication terminal device 30 is connected to the telephone line 5 separated by the splitter 31. The dial connection unit 34 includes a dial transmission unit 37, a dial-up control unit 38, a specific dial number storage unit 39, a user code / password reception unit 4.
0 and a user code / password storage unit 41.

The specific dial number storage unit 39 stores a specific dial number for connecting a telephone line to the ISP management device 18 via the line switch 12. The dial-up control unit 38 performs control during dial-up, such as transferring the dial number of the ISP management device 18 stored in the specific dial number storage unit 39 to the dial sending unit 37. The dial sending unit 37 sends the dial number of the ISP management device 18 to the subscriber line 2 through the telephone line 5 at the time of dial-up performed at the start of connection authentication, and makes a call.
At this time, the switching station 16 of the subscriber line 2 knows the calling number of the telephone line 5 called from the communication terminal device 30, and the calling number is transmitted to the ISP management device 18. The user code / password receiver 40 is an IS
The user code and password sent from the P side are received. The user code / password storage unit 41 stores the received user code / password.

The XDS separated by the splitter 31
An XDSL modem 33 that converts a DSL signal is connected to the L line 6, and the XDSL modem 33 is connected to the communication processing unit 35 of the communication terminal device 30. The communication processing unit 35 includes an Ethernet (registered trademark) controller 42 that is connected to the XDSL modem 33 and controls communication on the XDSL line, and a protocol processing unit 43 that is connected to the user code / password storage unit 41 and performs communication protocol processing. Have.

A data processing unit 36 is connected to the Ethernet controller 42, and a bus in the data processing unit 36 has various well-known CPUs, ROMs, RAMs, and various input devices, display devices, and the like. Peripheral device (not shown)
Are connected.

Next, the operation of the connection authentication system having the above configuration will be described. When the user purchases the communication terminal device (PC) 30 in advance, the user makes a data communication connection contract with a specific Internet service provider (ISP), and obtains the home telephone number of the connection source from the ISP management device 1
Register in the calling party number list storage unit 23 in 8. Also, at this time, the telephone number of the ISP management device 18 is also registered together with the specific dial number storage unit 39 in the communication terminal device 30. Then, after the communication terminal device 30 is installed at the location (home or the like) of the registered telephone number, the user code and password registration processing as a preparatory step for starting the ISP connection according to the following procedure. I do.

FIG. 2 is a flow chart showing the procedure for registering the user code and password. In FIG.
(A) shows a process on the ISP side, and (B) shows a process on the user side.

In the communication terminal unit 30 on the user side, the dial number of the ISP management unit 18 stored in the specific dial number storage unit 39 is sent to the dial-up control unit 38, and the dial sending unit 37 sends it through the subscriber line 2. IS
Dial-up connection is made to the P management device 18 and the calling party number is notified (step S11). When the line exchange is performed by the line exchange 12 using the dial number, the communication terminal device 30 is connected to the ISP management device 18.

On the other hand, in the ISP management device 18, when receiving an incoming call from the user side, the calling party number receiving section 21 receives the calling party number (step S1). Then, the calling party number stored in the calling party number list storage unit 23,
It is determined whether or not the received calling number matches (step S2). When the calling party numbers match, the user code and password issued by the user code / password management unit 25 are sent to the user code / password assignment unit 24, and the user code / password assignment unit 24 is sent.
Is the communication terminal device 30 on the user side through the telephone lines 3 and 5.
Send the user code and password to (step S
3). At this time, the user code / password management unit 25
Then, the issued user code and password are managed for each registered user. As the user code and password transmitted in step S3, a PB (Push Button) signal representing various characters or numbers or a modem signal in which character information is modulated in a voice band is used.

On the user side, the user code / password receiving unit 40 waits for a predetermined time from the start of dial-up connection until receiving the user code and password (steps S12 and S13). When the user code and password are received within the predetermined time, the received user code and password are stored in the user code / password storage unit 41 (step S14), and the telephone line is disconnected (step S15). Then, this process ends. Depending on the line disconnection process from this communication terminal device side,
The ISP management device 18 also performs a telephone line disconnection process (step S5), and ends this process.

If the calling number does not match in step S2, the ISP management device 18 cancels the registration without adding the user code and password (step S4). In this case, on the user side, in step S13, the user code and password have not been received even after a predetermined time has passed from the ISP management device 18, so that the telephone line is disconnected in step S15. In response to the line disconnection process, as described above, the ISP management device 18 disconnects the telephone line in step S5.

In the above embodiment, if the calling party numbers do not match, the ISP sends nothing and the communication terminal device waits for a predetermined time before disconnecting the line. However, not limited to this method, if the calling party numbers do not match, the ISP management apparatus transmits to the communication terminal apparatus side that the calling party numbers do not match, and the communication terminal apparatus informs that effect. The line may be disconnected when is received.

FIG. 3 is a flowchart showing a connection authentication processing procedure. In FIG. 3, (A) shows processing on the ISP side, and (B) shows processing on the user side. Here, IS
The connection between the server device on the P side and the communication terminal device on the user side is carried out via the XDSL line through the communication protocol PPPoE.
Communication processing is performed by (PPP over Ethernet (registered trademark)).

First, the communication terminal device 30 on the user side reads the user code and password acquired by the processing of FIG. 2 from the user code / password storage unit 41,
XDSL modem 33, XDSL line 6, subscriber line 2,
The user code and password are transmitted to the ISP server 19 through the exchange 16 and the communication line 15, and the ISP server 1
An attempt is made to connect to 9 (step S31). In addition, ISP
The user code and password acquired from the management device 18 may be stored in the user code / password storage unit 41 and used in the subsequent connection authentication processing, or may be deleted once after the connection authentication processing. You may make it receive from the ISP management apparatus 18 every time ISP connection is made.

When the ISP server 19 receives the user code and the password via the XDSL line 4 and the communication line 15 (step S21), the user code registered in the user code / password management unit 25 in the ISP management device 19 is received. And the password are referred to and these are compared (step S22). Based on the result of this comparison, it is determined whether the authentication that the user code and the password match each other and is authentic is confirmed (step S).
23).

When the user code and the password match and the authentication is confirmed, it is recognized that the communication is from a registered user, and the connection with the communication terminal device 30 on the user side is started (step S24). At this time, the ISP server 19 transmits a signal indicating the authentication confirmation and the connection start to the communication terminal device 30 on the user side. After that, the communication terminal device 30 on the user side is connected to the internet network 17 through the ISP server 19 and can perform data communication with various server devices 20 on the internet network 17 using TCP / IP protocol or the like.

If at least one of the user code and the password does not match in step S23, I
The SP server 19 rejects the connection from the communication terminal device 30 (connection cancellation) (step S25). At this time, the ISP server 19 transmits a signal indicating connection refusal to the communication terminal device 30 on the user side. Then, this process ends.

On the other hand, in the communication terminal device 30 on the user side,
After transmitting the user code / password in step S31, it is determined whether or not the ISP server 19 confirms the authentication, that is, whether or not the signal indicating the connection start is received (step S32). When the authentication is successful and the signal indicating the connection start is received, the connection with the ISP server 19 is started (step S33). If a signal indicating connection refusal is received without receiving a signal indicating connection start, XDS
The L line 6 is disconnected to cancel the ISP connection (step S
34). Then, this process ends.

As described above, in this embodiment, the XDSL lines 4 and 6 are used to communicate with the communication terminal device 30 on the user side and the IS.
When starting the connection with the P server 19, I
The SP server 19 is dialed up to perform user authentication based on the calling party number, the ISP server 19 gives a user code and password to the communication terminal device 30 on the user side, and the XDS is used by using this user code and password.
Connection authentication for data communication is performed via the L line. As a result, the input operation of the user code and password from the communication terminal device 30 can be eliminated, and a connection authentication system suitable for a user who is relatively unfamiliar with the operation of devices such as a PC can be constructed. In addition, it is possible to prevent leakage of the user code and password associated with the input operation, and even in the procedure related to the acquisition of the user code and password and the connection authentication, the confidential information such as the password is not inadvertently known to others. Can be secured.

The above is a description of the embodiments of the present invention, but the present invention is not limited to the configurations of these embodiments, and the functions shown in the claims or the embodiments Any structure can be applied as long as the function of the structure can be achieved.

For example, in the above-described embodiment, the user code / password assigning section 24 automatically assigns an arbitrary user code / password to the user whose calling number matches as a result of the comparison. The user code / password desired by the user may be received in advance, registered, and given. In this case, the ISP management device 1
When the dial-up connection is made to the communication terminal 8, the user may key-in the desired one from the communication terminal device 30, may be notified when the communication terminal device 30 is purchased, or may be separately provided. You may request registration by mail.

The ISP management device 18 may be built in the ISP server 19 or provided separately. When provided separately, it may be located at the same location as the ISP server device or at a remote location. When it is installed in a remote place, it is connected to the server device by a telephone line, a network line or the like.

Further, the processing relating to the identification of the communication terminal device on the user side and the addition of the registered user code and password by the notification of the calling number is performed by ISDN instead of the telephone line.
You may use a line.

Although the communication terminal device is shown as connected to the XDSL modem via Ethernet (registered trademark), it may be connected using an interface such as a USB (Universal Serial Bus).

In the above embodiment, ADSL, SD
SL (Symmetric Digital Subscriber Line), HDS
The case where it is applied to the connection of the XDSL line including the L (High-Bit-Rate Digital Subscriber Line) is shown, but not limited to this, the connection of the ISDN line, the connection of the wireless line, or the dial-up connection of the telephone line. The present invention is similarly applicable to the above.

Further, according to the present invention, the program code of the software (the program code shown in the flow charts of FIGS. 2 and 3) for realizing the functions of the above-described embodiment is supplied to an apparatus equipped with a computer and executed. It goes without saying that it is also applicable when it is achieved. In this case, the program code itself read from the storage medium or supplied via the communication path realizes the novel function of the present invention, and the program and the storage medium storing the program constitute the configuration of the present invention. Are included in.

[0041]

As described above, according to the present invention, when the communication terminal device is connected to the network for data communication, the input operation of the authentication code such as the user ID and the password is not required, and the authentication is simple and safe. The effect that it becomes possible to obtain is obtained.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of a connection authentication system according to an embodiment of the present invention.

FIG. 2 is a flowchart showing a registration processing procedure of a user code and a password according to this embodiment.

FIG. 3 is a flowchart showing a connection authentication processing procedure in the present embodiment.

[Explanation of symbols]

3,5 telephone lines 4,6 XDSL line 10 Connection authentication control device 12 circuit switch 13 XDSL modem 15 communication lines 16 exchanges 17 Internet network 18 ISP management device 19 ISP server 21 Caller ID receiver 22 Caller ID comparison unit 23 Calling party number list storage section 24 User code / password provision section 25 User Code / Password Management 30 communication terminal 33 XDSL modem 34 Dial connection 35 Communication processing unit 36 Data processing unit 37 Dial sending unit 38 Dial-up control section 39 Specific dial number storage 40 User code / password receiver 41 User code / password storage 42 Ethernet controller 43 Protocol processing unit

Continued front page    F-term (reference) 5J104 AA07 KA02 KA06 NA05 PA07                 5K024 AA71 BB04 CC01 CC09 CC14                       DD02 EE01 GG01 GG05 GG06                       GG08                 5K027 AA08 BB04 EE11 HH24 HH26                       KK02                 5K101 KK02 LL01 MM01 MM05 NN01                       NN14 NN21 PP03 QQ02 QQ09                       RR27 UU16

Claims (5)

[Claims] 1. A connection authentication control device for performing data communication with a communication terminal device connected via a first line, wherein a caller number by a call from the communication terminal device via a second line. A calling party number receiving means for receiving the calling party number, and a calling party number comparing means for comparing the received calling party number with a previously registered calling party number, and based on the comparison result, the calling party number And an authentication code transmitted from the communication terminal device through the first line, the authentication code giving means for giving an authentication code corresponding to the communication terminal device through the second line, Connection authentication control for authenticating the received authentication code, and connection control means for starting a connection with the communication terminal device when the authentication is confirmed. apparatus. 2. A communication terminal device for performing data communication with a connection authentication control device connected via a first line, wherein dial-up connection is made with the connection authentication control device by circuit switching via a second line. Dial number storing means for storing a specific dial number for transmitting, a specific dial number calling means for sending out the stored specific dial number through a second line to make a call, and through the second line Authentication code receiving means for receiving the authentication code given from the connection authentication control device, authentication code storage means for storing the received authentication code, and connection authentication control for the stored authentication code through the first line. Authentication code transmitting means for transmitting to the device, and connection with the connection authentication control device when the authentication of the transmitted authentication code is confirmed by the connection authentication control device A communication terminal device, comprising: a connection control means for starting. 3. A connection authentication system for performing authentication for connecting the connection authentication control device and the communication terminal device when starting data communication between the communication terminal device and the connection authentication control device through the first line. A dial number storage means for storing a specific dial number for dialing up the communication terminal device to the connection authentication control device by circuit switching through a second line; and the stored specific dial number. A specific dial number calling means for sending a message from the communication terminal device through the second line to call the connection authentication control device, and a call originating from the communication terminal device through the second line. A calling party number receiving means for receiving a calling party number; a calling party number comparing means for comparing the received calling party number with a previously registered calling party number; Based on the compare result, when the caller number matches the one registered, the second from the connection authentication controller
Authentication code assigning means for assigning an authentication code corresponding to the communication terminal device through the line, and an authentication code for receiving the authentication code assigned by the connection authentication control device through the second line and storing the authentication code. Storage means; authentication code transmission means for transmitting the stored authentication code from the communication terminal device to the connection authentication control device through the first line; and transmission from the communication terminal device through the first line. An authentication means for receiving the authentication code and authenticating the authentication code; and a connection control means for starting the connection between the connection authentication control device and the communication terminal device when the authentication of the authentication code is confirmed, A connection authentication system characterized by being provided. 4. A connection authentication method for authenticating a connection with the communication terminal device when data communication is started between the communication terminal device and the connection authentication control device through a first line. And a calling party number receiving step for receiving a calling party number by calling from the second line through the second line, and a calling party number for comparing the received calling party number with a previously registered calling party number. A comparing step; and an authenticating code assigning step of assigning an authenticating code corresponding to the communication terminal device through the second line when the calling number matches the registered one based on the comparison result, An authentication step of receiving the authentication code transmitted from the communication terminal device through the first line and authenticating the received authentication code; and, if the authentication is confirmed, a connection with the communication terminal device is opened. Connection authentication method characterized by comprising a connection control step of, a. 5. A program having a program code for executing the connection authentication method according to claim 4 by a computer.