JP2003099402A - Authentication agent server, method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication agent server, a method and a program capable of improving convenience by the single sign of a user. SOLUTION: Telecommunication carrier servers connect user terminals to a network by authenticating the user, and the authentication agent server performs the authentication procedure of the user on behalf of the user by connecting the service provider servers through the network. Receiving an authentication request from the service provider servers, the authentication agent server requests authentication processing to telecommunication carrier servers which have authenticated the user in the case of network connection based on authentication request contents, and an authentication result concerning the authentication request from the communication carrier servers are transferred to the service provider servers, which authenticate the user having accessed based on the received authentication result.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an authentication proxy server, a method and a program that enable a user to authenticate all services on a network only by the authentication received at the entrance to the network.

[0002]

2. Description of the Related Art Conventionally, authentication of users on the Internet has been performed for each telecommunications carrier and each service provider, and the user makes a contract with each entrepreneur and performs different authentication. I was receiving it.

[0003]

Various so-called single sign-on systems have been proposed in order to avoid a plurality of user authentication procedures as described above, but all of them realize authentication on a business unit basis. However, the single sign-on mechanism for the entire Internet has not been realized yet.

A first object of the present invention is to provide an authentication proxy server, a method and a program in which a plurality of vendors can cooperate with each other to improve the convenience of a single sign of a user in authentication and billing using the Internet. Is to provide.

A second object of the present invention is to provide an authentication proxy server, a method and a program that facilitate the realization of a single sign-on mechanism on the entire Internet.

[0006]

According to a first aspect of the present invention, a communication carrier connecting a user terminal used by the user to the network by authenticating the user when connecting to the network is While connecting to the communication carrier server to be used via the network, and connecting to the service provider server to be used by the service provider providing the service to the user via the network, the user authentication procedure is performed. An authentication proxy server acting as a proxy, wherein the client information including the addresses of the user terminal and the communication carrier server from the user terminal received by the service provider server is received from the service provider server. According to the client information, the telecommunications carrier server used by the user terminal And communication business user identification means for identifying,
By transmitting the client information to the specified telecommunications carrier server, the telecommunications carrier server can access the service provider server based on the authentication of the user performed at the time of network connection. Authentication request means for requesting authentication processing of the user and transmitting the authentication result to the service provider server that has accessed.
The service provider server authenticates the user based on the received authentication result.

In a second aspect of the present invention, a communication carrier server used by a communication carrier connecting a user terminal used by the user to the network by authenticating the user when connecting to the network. An authentication proxy server that connects to a service provider server used by a service provider that provides a service to the user via a network and that proxy the user's authentication procedure. The authentication proxy server receives the client information including the addresses of the user terminal and the communication carrier server received from the service provider server from the user terminal from the service provider server. The telecommunications carrier used by the user terminal based on the client information by A communication carrier specifying means for specifying a server, and transmitting the client information to the specified communication carrier server, thereby authenticating the user at the time of network connection to the communication carrier server. Authentication request means for requesting authentication of the user who has accessed the service provider server based on the authentication request, and receiving the authentication result of the user relating to the authentication request transmitted from the communication provider server. According to the above, the authentication result transmitting means for transmitting the authentication result to the service provider server that has accessed is provided, and the service provider server authenticates the user based on the received authentication result. It is characterized by

[0008] Further, in the authentication proxy server, the billing information relating to the service of the corresponding user, which is transmitted from the service provider server that has provided the service to the user terminal, is transmitted to the communication provider server. On behalf of the telecommunications carrier server, a billing information transmitting device for requesting the telecommunications carrier server to collect the bill for the billing information; , Based on the billing information accumulated for a certain period of time, request the fee to the server of the online credit company to which the telecommunications carrier, who has already collected the fee related to the fee information from the user, and pay the fee. It is preferable to include a price collection proxy means for proxying the collection.

In a third aspect of the present invention, a communication carrier server used by a communication carrier connecting a user terminal used by the user to the network by authenticating the user when connecting to the network. And a server that is connected through a network with a service provider server used by a service provider that provides a service to the user, and is a proxy for the authentication procedure of the user. A proxy method, wherein by receiving from the service provider server client information including addresses of the user terminal and the telecommunications carrier server from the user terminal received by the service provider server, The carrier server used by the user terminal is specified based on the client information. And the service provider based on the authentication of the user performed at the time of network connection to the carrier server by transmitting the client information to the specified carrier server. Requesting an authentication process for the user who has accessed the server and requesting that the authentication result be transmitted to the service provider server, which has accessed the server. It is characterized in that the user is authenticated based on the authentication result.

In a fourth aspect of the present invention, a communication carrier server used by a communication carrier connecting a user terminal used by the user to the network by authenticating the user when connecting to the network. And a server that is connected through a network with a service provider server used by a service provider that provides a service to the user, and is a proxy for the authentication procedure of the user. A proxy method, wherein by receiving from the service provider server client information including addresses of the user terminal and the telecommunications carrier server from the user terminal received by the service provider server, The carrier server used by the user terminal is specified based on the client information. And the service provider server based on the authentication of the user performed at the time of network connection to the carrier server by transmitting the client information to the specified carrier server. The step of requesting authentication of the user who has accessed the user, and the method of accessing the authentication result by receiving the authentication result of the user related to the authentication request transmitted from the communication carrier server. And a step of transmitting to the service provider server,
The service provider server authenticates the user based on the received authentication result.

In the authentication proxy method, the billing information relating to the service of the corresponding user, which is transmitted from the service provider server that provided the service to the user terminal, is transmitted to the communication provider server. Then, a step of requesting the telecommunications carrier server to collect the price related to the charging information, a step of storing the charging information, and a step of storing the charging information of the service provider, on behalf of the service provider, A step of requesting the fee to the server of the online credit company to which the telecommunications carrier, who has already collected the fee related to the fee information from the user, based on the fee information, and representing the fee It is preferable to include

In a fifth aspect of the present invention, a communication carrier server used by a communication carrier connecting a user terminal used by the user to the network by authenticating the user when connecting to the network. And a service provider server used by a service provider that provides a service to the user, and a server connected through the network to represent the authentication procedure of the user. An authentication proxy program for receiving the client information including the addresses of the user terminal and the communication carrier server from the user terminal received by the service provider server, from the service provider server , The communication event used by the user terminal based on the client information Identifying a merchant server, by sending the client information to the specified the communication company server, to the communication company server,
Request the authentication processing of the user who has accessed the service provider server based on the authentication of the user performed at the time of network connection and send the authentication result to the service provider server that has accessed And a step of requesting that the service provider server perform the authentication, and the service provider server authenticates the user based on the received authentication result.

In a sixth aspect of the present invention, a communication carrier server used by a communication carrier connecting a user terminal used by the user to the network by authenticating the user when connecting to the network. Is connected via a network with the service provider server used by a service provider that provides a service to the user, and performs a proxy for the authentication procedure of the user using a server connected via the network. An authentication proxy program for receiving the client information including the addresses of the user terminal and the communication carrier server from the user terminal received by the service provider server, from the service provider server , The communication event used by the user terminal based on the client information A service provider server, and transmitting the client information to the specified carrier server, thereby providing the service based on the authentication of the user performed at the time of network connection to the carrier server. The step of requesting the authentication of the user who has accessed the provider server, and the authentication result of the user relating to the authentication request transmitted from the communication provider server And a step of transmitting to the accessed service provider server, and the service provider server authenticates the user based on the received authentication result.

Further, in the authentication proxy program,
The charging information related to the service of the corresponding user, which is transmitted from the service provider server that has provided the service to the user terminal, is transmitted to the communication carrier server, and the charging information is transmitted to the communication carrier server. Requesting the collection of the fee relating to the above, storing the billing information, and representing the fee collected by the service provider on the basis of the billing information accumulated for a certain period of time from the user. It is preferable that the server of an online credit company to which the telecommunications carrier who collects the payment related to the billing information collects the payment and represents the collection of the payment.

[0015]

BEST MODE FOR CARRYING OUT THE INVENTION When a network is connected, a telecommunications carrier who connects a user terminal (10 in FIG. 1) used by the user to a network (50 in FIG. 1) by authenticating the user Communication carrier server to be used (2 in FIG. 1)
0) through a network, and also through a network with a service provider server (30 in FIG. 1) used by a service provider that provides a service to the user, and authenticates the user. An authentication proxy server (40 in FIG. 1) acting as a proxy, wherein the authentication proxy server (40 in FIG. 1) is the user terminal from the user terminal received by the service provider server and the A telecommunications carrier identifying means for identifying the telecommunications carrier server used by the user terminal based on the client information by receiving client information including the address of the telecommunications carrier server from the service provider server (41 in FIG. 1) and the communication business by transmitting the client information to the specified communication carrier server. The service providing business that requests the server to perform an authentication process of the user who has accessed the service provider server based on the authentication of the user performed at the time of network connection and has accessed the authentication result. Authentication request means (42 in FIG. 1) for requesting transmission to the user server, the service provider server (30 in FIG. 1) authenticates the user based on the received authentication result. By performing the above, the user does not need to input a new authentication factor during the connection by inputting the authentication factor at the time of network connection.

In this case, the program is read from the recording medium (magnetic disk, magnetic tape, optical disk, memory card, semiconductor memory, etc.) in which the program is recorded to the computer through the reading device and the interface. The present invention can be implemented by loading the main memory and executing it. The program is transmitted from a storage device of another computer to a computer forming a server via a wired or wireless network medium and a communication interface, the program is installed in the computer, and the program is loaded into a main memory and executed. You may do it.

[0017]

Embodiment 1 Embodiment 1 of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram schematically showing the configuration of a system including an authentication proxy server according to the first embodiment of the present invention.

This system includes a user terminal 10 (10
A, 10B, 10C) and the carrier server 20 (20
A, 20B, 20C) and the service provider server 3
0 (30A, 30B, 30C) and the authentication proxy server 40
And an information network 50.

The user terminal 10 is a terminal such as a personal computer or a mobile phone used by a person who uses the service provided by the service provider, and is connected to the information network 50.

The telecommunications carrier server 20 is a server used by a telecommunications carrier such as an Internet service provider, and comprises a user information storage means 21, a user information registration means 22, and a user authentication means 23. , Connect to the information network 50.

The user information storage means 21 stores the user's name, credit card number, user authentication ID, password, address, payment method, etc. necessary for uniquely identifying, authenticating and paying the user. Store user information including.

The user information registration means 22 is the user terminal 1
The user terminal 10 is provided with an input form that prompts the user information to be input by accessing 0, and the user information input and transmitted at the user terminal 10 is registered in the user information storage means 21. For example, it is realized by an input form of a WWW server.

The user authentication means 23 is an authentication factor (user authentication ID, password) input and transmitted in the user terminal 10 so that the user terminal 10 can access the network provided by the communication carrier. Etc.), the received authentication factor and the authentication factor (user authentication I) stored in the user information storage means 21 are received.
(D, password, etc.), and the user is authenticated. Here, as the authentication factor, an electronic certificate may be used in addition to the user authentication ID and password. Further, the user authenticating means 23 receives the client information (such as the user's IP address) from the service provider server 30 via the authentication proxy server 40,
The address of the user terminal 10 included in the user information of the corresponding user stored in the user information storage unit 21 is compared with the address of the user terminal 10 included in the client information, and network connection is performed. Authenticate a new user based on the user authentication at the time.

The service provider server 30 is a server terminal used by a service provider such as electronic commerce, and includes a service providing unit 31, a user identifying unit 32, and an authentication requesting unit 33. Connect to the network 50.

The service providing means 31 includes the user terminal 10
Provide various services on the Internet by accessing from. The service is, for example, an information providing service,
An electronic mail service, a file transfer service, an electronic commerce service, an EDI service, an electronic document exchange service between companies, and the like, which are realized by a server on the Internet. This service is realized by, for example, a WWW server.

The user identifying means 32 identifies the user terminal 10 based on the client information transmitted from the user terminal 10 when the user tries to use the service provided by the service providing means 31. Identify.
As the client information, for example, I of the user terminal 10
There is a P address and cookie information registered in the Internet browser of the user terminal 10.

The authentication request means 33 is an authentication proxy server 40.
Sends client information to the authentication proxy server 40 to request the user to authenticate.

The authentication proxy server 40 is a server that carries out an authentication procedure for the user on behalf of a user who is requested to authenticate by the service provider, and receives an authentication request from the service provider server 30 and performs authentication. At the time of network connection based on the content of the request, authentication processing is requested to the communication carrier server 20 that has authenticated the user, and the authentication result related to the authentication request from the communication carrier server 20 is provided as a service. Send to the business entity server 30. As a means for that, the authentication proxy server 40 uses the communication carrier specifying means 4
1, an authentication request means 42, an authentication result transfer means 43,
And is connected to the information network 50.

The telecommunications carrier identifying means 41 is the user terminal 1
The user terminal transmitted from the service provider server 30 in order to specify which communication provider server 20 0 is trying to use the service provided by the service provider server 30 By receiving the client information of 10, the telecommunications carrier server 20 is specified based on the correspondence table of the telecommunications carrier server and the information assigned to the telecommunications carrier contained in the client information accumulated in advance. The client information includes, for example, the IP address of the user. Since an address for identifying a communication carrier server is assigned to the client information for each communication carrier server, it is possible to specify the communication carrier server that has authenticated the user.

The authentication requesting means 42 sends the client information of the user terminal 10 to the telecommunications carrier server 20 specified by the telecommunications carrier specifying means 41, so that the corresponding user is sent to the telecommunications carrier server 20. Request authentication. Here, the service provider server 30 that has received the authentication result provides the service if the authentication result is appropriate. Note that the user authenticating means 23 of the communication carrier server 20 actually authenticates the user.

The authentication result transfer means 43 transfers the authentication result of the user transmitted from the communication carrier server 20 which has performed the authentication processing in response to the authentication request, to the corresponding service provider server 30. When the authentication result is directly transmitted from the communication carrier server 20 to the service provider server 30, the authentication result transfer means 43 may be omitted. In that case, the authentication requesting unit 42 may request the user's authentication process and send the authentication result to the accessing service provider server.

The information network 50 is an information communication network such as the Internet, a telephone line and a wireless base station.

Next, the operation of the first embodiment will be described with reference to the drawings. FIG. 2 is a flowchart for explaining the operation of the authentication proxy server according to the first embodiment of the present invention.

In brief, the Internet user first uses his or her own user terminal 10 to access the communication carrier server 20 and is authenticated, and then the service of the service provider 30 is passed through the network. To get
Here, the user terminal 10 can be provided with the service without being authenticated by the service provider server 30 after being authenticated by the communication provider server 20. Note that this mechanism provided by the telecommunications carrier is WWW
Since a mechanism using a server input form is implemented by many communication carriers, detailed description will be omitted. The details will be described below. As a premise, it is assumed that the user has registered his or her own user information in the communication carrier server 20 in advance.

Referring to FIG. 2, first, the user uses the user terminal 10 to authenticate the user such as a user ID and a password registered in advance to the user terminal 10 in order to authenticate the user. Input and send the authentication factor to the communication carrier server 20 (step A1).

Next, the communication carrier server 20 receives the authentication factor transmitted from the user terminal 10,
The received authentication factor and the authentication factor stored in the user information storage means 21 are compared and collated (step A
2) If they match, the user terminal 10 is permitted to access the network (step A3). on the other hand,
If they do not match, you cannot access the network.

Next, after the user is permitted to access the network, the user accesses the service provider server 30 using the user terminal 10 in order to receive the service provided by the service provider. When accessing
The user terminal 10 transmits client information such as an IP address to the service provider server 30 (step A4).

Next, the service provider server 30
Client information transmitted from the user terminal 10 (IP
By receiving the address, the user identifying means 32 identifies the user terminal 10 which is the sender based on the client information (step A5).

Next, the service provider server 30
In order to authenticate the user who has accessed to provide the service, the authentication proxy server 40 is requested to perform the authentication procedure of the user. At this time, the service provider server 30 transmits the client information (IP address) to the authentication proxy server 40 (step A6).

Next, the authentication proxy server 40 receives the client information (IP address) transmitted from the service provider server 30, and thereby the user terminal 1
In order to identify which telecommunications carrier server 20 0 is authenticated, the telecommunications carrier server 20 is specified using the telecommunications carrier specifying means 41 based on the client information (IP address) (step A7).

Next, the authentication proxy server 40 requests the communication carrier server 20 specified by the authentication requesting means 42 to authenticate the user. At this time, the authentication proxy server 40 transmits the client information (IP address) used for specifying the communication carrier server 20 to the specified carrier server 20 (step A8).

Next, the telecommunications carrier server 20 receives the client information (IP address) transmitted from the authentication proxy server 40, and thereby the user information storage means 21.
The address of the user terminal 10 included in the user information of the corresponding user stored in the above is compared with the address of the user terminal 10 included in the client information, and the address of the user at the time of network connection is compared. The user is authenticated based on the authentication (step A9).

Next, the communication carrier server 20 returns the authentication result of the corresponding user based on the authentication request from the authentication proxy server 40 to the authentication proxy server 40 (step A1).
0).

Next, the authentication proxy server 40 transfers the authentication result of the corresponding user returned from the communication carrier server 20 to the service provider server 30 which has requested the authentication procedure (step A11). .

Finally, the service provider server 30
Receives the authentication result of the corresponding user transferred from the authentication proxy server 40 to confirm the authentication result (step A12). If the authentication result is proper, the service providing means 31 The service will be provided to the user terminal 10 (step A1).
3). On the other hand, if the authentication result is incorrect, the service is not provided to the user terminal 10.

In this way, in the processing from the time the user accesses the service provider server 30 to the time when the user authenticates and the service is provided, the user inputs his authentication factor again. Authentication can be performed without any effort, and user input work can be simplified.

Next, a second embodiment of the present invention will be described with reference to the drawings. FIG. 3 is a block diagram schematically showing the configuration of a system including an authentication proxy server according to the second embodiment of the present invention.

This system has a credit company server 60 in the configuration of the first embodiment shown in FIG. 1, and a new means is added to each of the communication carrier server 20, the service provider server 30, and the authentication proxy server 40. Is different from the first embodiment in that.

The telecommunications carrier server 20, in addition to the user information storage means 21, the user information registration means 22 and the user authentication means 23 shown in the first embodiment, a billing information storage means 24.
And a price calculation means 25 and a price collection means 26.

The billing information storage means 24 is a monthly user's network usage fee associated with the use of a network provided by a telecommunications carrier, and a user's service utilization associated with the use of a service provided by a monthly service provider. Stores billing information including price, etc., for each user, each service,
The billing information is stored in units of time.

The price calculation means 25 calculates the network usage fee of the user due to the use of the network provided by the communication carrier, and registers this usage fee in the charging information in the charging information storage means 24. The network usage fee is generally calculated by a charging method based on connection time or information amount, or a fixed charging method.

The price collection means 26 is the charge information storage means 2
4, based on the charging information of the corresponding user stored in No. 4 and the payment method of the corresponding user stored in the user information storage means 21, the network usage fee is paid to the corresponding user. And bill the service usage fee and collect the cost. For example, when the payment method of the corresponding user is payment by an online credit card, the price collection means 26 tells the server 60 of the online credit card company to which the corresponding user belongs to the network usage fee and service of the user. The usage fee is charged, and the payment is settled from the user to the telecommunications carrier through the online credit card company.

The service provider server 30 has the service providing means 31 and the user identifying means 32 shown in the first embodiment.
In addition to the authentication requesting means 33, the charging information storing means 34
And a billing information transmitting means 35.

The billing information storage means 34 stores the billing information including the service usage fee of the user provided by the service providing means 31 for each user, each telecommunications carrier, and each hour.

When the service providing unit 31 provides the service to the user terminal 10, the billing information sending unit 35 sends the billing information of the user to the authentication proxy server 40.

The authentication proxy server 40, in addition to the communication carrier specifying means 41, the authentication requesting means 42 and the authentication result transferring means 43 shown in the first embodiment, the charging information transmitting means 44, the charging information storing means 45, and the payment collection. And a proxy unit 46.

The billing information transmitting means 44 sends the billing information of the corresponding user transmitted from the service provider server 30 which has provided the service to the user, to the communication carrier server 20.
Send to. The billing information received by the telecommunications carrier server 20 is stored in the billing information storage means 24.

The billing information storage means 45 stores the billing information (service usage fee) for each month of the corresponding user, which is transmitted from the service provider server 30.

The payment collection agent means 46 represents the collection of the service provider's payment, and pays the service usage fee of the user, which should be collected by the service provider, for a fixed period of time. Invoice the telecommunications carrier you are collecting from to collect the cost. The price collection proxy means 46 is, for example, a service of the user that the service provider should collect for the server 60 of the online credit card company to which the telecommunications carrier who has already collected the service usage fee from the corresponding user belongs. The usage fee is charged, and the price is paid from the telecommunications carrier to the service provider through the online credit card company.

Next, the operation of the second embodiment will be described with reference to the drawings. 4 and 5 are flowcharts for explaining the operation of the authentication proxy server according to the second embodiment of the present invention. The newly added steps are steps B4 and B15.
To B25, steps B1 to B3 and B5 of other processes
To B14 are the same as steps A1 to A13 of the first embodiment, respectively.

Referring to FIG. 4, first, the user inputs the authentication factor registered in advance by using the user terminal 10 into the user terminal 10 and transmits the authentication factor to the communication carrier server 20 (step). B1). Next, the telecommunications carrier server 20 receives the authentication factor and the user information storage means 21.
In step B2, a comparison is performed with the authentication factor stored in step S2, and if they match, the user terminal 1
Access to network 0 (step B)
3).

By permitting access, the telecommunications carrier server 20 calculates the network usage charge (or counts time / information amount) associated with the use of the network by the price calculation means 25, and charges the calculated network usage charge as billing information. It is recorded in the storage means 24 (step B4).

Next, after the user is permitted to access the network, the user uses the user terminal 10 to transmit the client information (IP address etc.) to the service provider server 30 (step B5). Next, the service provider server 30 receives the received client information (I
Based on the P address, the user identification means 32 identifies the source user terminal 10 (step B).
6). Next, the service provider server 30 transmits the client information (IP address) used to identify the user terminal 10 to the authentication proxy server 40 (step B7).

Next, the authentication proxy server 40 specifies the communication carrier server 20 using the communication carrier specifying means 41 based on the received client information (step B).
8). Next, the authentication proxy server 40 requests the specified communication carrier server 20 to authenticate the user and specifies the client information (IP address) used to specify the communication carrier server 20. It is transmitted to the server 20 (step B9).

Next, the telecommunications carrier server 20 stores the address of the user terminal 10 included in the received client information and the address of the user terminal 10 included in the stored user information of the corresponding user. , Are compared, and the user is authenticated based on the authentication of the user when connecting to the network (step B10). Next, the communication carrier server 20 transmits the authentication result of the corresponding user based on the authentication request from the authentication proxy server 40 to the authentication proxy server 40 (step B11).

Next, the authentication proxy server 40 transmits the authentication result of the corresponding user transmitted from the communication carrier server 20 to the service provider server 30 which has requested the authentication proxy (step B12). . Next, the service provider server 30 receives the authentication result of the corresponding user transferred from the authentication proxy server 40, and if the authentication result is proper, the service providing means 31 uses it. The service is provided to the person terminal 10 (step B14).

Next, referring to FIG. 5, the service provider server 30 records the service usage fee generated each time a service is provided to the user in the billing information in the billing information storage means 34 (step B15). .

Next, the service provider server 30
The billing information transmitting unit 35 transmits the billing information including the service usage fee that is generated each time the service is provided to the user to the authentication proxy server 40 (step B16).

Next, the authentication proxy server 40 receives the billing information transmitted from the service provider server 30, records this billing information in the billing information storage means 45 (step B17), and stores the billing information. The billing information is transmitted to the communication carrier server 20 each time it is received (step B
18).

Next, the telecommunications carrier server 20 receives the billing information transmitted from the authentication proxy server 40, and records the received billing information in the corresponding user in the billing information storage means 24 ( Step B1
9).

Next, the telecommunications carrier server 20 stores the charge information of the corresponding user stored in the charge information storage means 24 by the charge collection means 26 and the user information storage means 21 after a certain period of time. Based on the payment method of the applicable user and the payment request information for collectively charging the network usage fee and the service usage fee of the user to the credit card company server 60 to which the applicable user belongs. It is transmitted (step B20).

Next, the credit card company server 60
By receiving the billing information transmitted from the telecommunications carrier server 20, the payment processing from the user to the telecommunications carrier is performed based on the received billing information (step B21). The settlement completion notification is transmitted to the person server 20 (step B22).

Next, the authentication proxy server 40 collects the service usage fee of the user from the corresponding user based on the billing information stored in the billing information storage means 45 after a certain period of time. The billing information for billing the service usage fee of the user is transmitted to the credit card company server 60 to which the business operator belongs (step B2).
3).

Next, the credit card company server 60
By receiving the billing information transmitted from the authentication proxy server 40, the settlement processing of the bill from the telecommunications carrier to the service provider is performed based on the received billing information (step B24), and the service is provided. Provider 3
The settlement completion notification is transmitted to 0 (step B25).

As described above, according to the second embodiment, the user can use other services on the network by only being authenticated once at the entrance of the network. The price and service usage fee can be collectively paid to the telecommunications carrier.

Further, since the service provider can request the telecommunications carrier to manage the users and recover the costs from the individual users, it is possible to easily start the service provision.

A third embodiment of the present invention will be described. The basic configuration of the system is as shown in the first and second embodiments, but the user information storage means 21 and the billing information storage means 24 shown in FIG. 1 or 3 may be realized by one database. .

[0078]

According to the present invention, the following effects can be obtained.

The first effect is that the user can access all other services on the network by performing the user authentication procedure only once at the entrance of the network. It is possible to reduce the burden associated with receiving the service.

The second effect is that the user pays the cost for enjoying the service only to the telecommunications carrier at the entrance, so that the labor for the cost payment can be saved.

The third effect is to indirectly provide a service authentication company that newly provides a service on the network with a user authentication mechanism and a fee collection mechanism provided by the communication carrier. Therefore, it is possible to easily realize the single sign-on mechanism on the entire Internet, and the service provider can concentrate on providing the service.

[Brief description of drawings]

FIG. 1 is a block diagram schematically showing a configuration of a system including an authentication proxy server according to a first embodiment of the present invention.

FIG. 2 is a flowchart for explaining the operation of the authentication proxy server according to the first embodiment of the present invention.

FIG. 3 is a block diagram schematically showing a configuration of a system including an authentication proxy server according to a second embodiment of the present invention.

FIG. 4 is a flowchart for explaining the operation of the authentication proxy server according to the second embodiment of the present invention (first half).

FIG. 5 is a flowchart for explaining the operation of the authentication proxy server according to the second embodiment of the present invention (second half).

[Explanation of symbols]

10 user terminals 20 Telecommunications carrier server 21 user information storage means 22 User information registration means 23 User authentication method 24 Billing Information Storage Means 25 Price calculation method 26 means for collecting money 30 Service provider server 31 Service providing means 32 User identification means 33 Authentication Request Means 34 Billing information storage means 35 Billing Information Transmission Means 40 Authentication proxy server 41 Telecommunications carrier identification means 42 Authentication Request Means 43 Authentication result transfer means 44 Billing information transmission means 45 Billing information storage means 46 Payment Collection Agent 50 Information Network 60 Credit company server

Claims (9)

[Claims] 1. When connecting to a network, by authenticating the user, a user terminal used by the user is connected to a network with a carrier server used by a carrier that connects to the network. An authentication proxy server that connects via a network to a service provider server used by a service provider that provides a service to the user, and represents the authentication procedure of the user, wherein the authentication proxy server is Based on the client information by receiving client information including addresses of the user terminal and the communication carrier server from the user terminal received by the service provider server, from the service provider server A telecommunications carrier feature that identifies the telecommunications carrier server used by the user terminal Means for transmitting the client information to the specified carrier server, the service provider server based on the authentication of the user performed at the time of network connection to the carrier server. Authentication requesting means for requesting authentication processing of the user who has accessed the server and requesting that the authentication result be transmitted to the service provider server that has accessed.
An authentication proxy server, wherein the service provider server authenticates the user based on the received authentication result. 2. When connecting to a network, by authenticating the user, the user terminal used by the user is connected via a network to a communication carrier server used by a communication carrier connecting to the network. An authentication proxy server that connects via a network to a service provider server used by a service provider that provides a service to the user, and represents the authentication procedure of the user, wherein the authentication proxy server is Based on the client information by receiving client information including addresses of the user terminal and the communication carrier server from the user terminal received by the service provider server, from the service provider server A telecommunications carrier feature that identifies the telecommunications carrier server used by the user terminal And means for transmitting the client information to the specified carrier server, to the service provider server based on the authentication of the user performed at the time of network connection to the carrier server. Authentication request means for requesting authentication of the user who has accessed, and access to the authentication result by receiving the authentication result of the user relating to the authentication request transmitted from the communication carrier server An authentication result transmitting unit for transmitting the authentication result to the service provider server, wherein the service provider server authenticates the user based on the received authentication result. 3. The authentication proxy server transmits, to the telecommunications carrier server, billing information related to the service of the corresponding user, which is transmitted from the service provider server that provided the service to the user terminal. Then, a billing information transmitting means for requesting the telecommunications carrier server to collect the bill for the billing information, a billing information storage means for storing the billing information, and a proxy for collecting the bill for the service provider. , Based on the billing information accumulated for a certain period of time, request the fee to the server of the online credit company to which the telecommunications carrier, who has already collected the fee related to the fee information from the user, and pay the fee. The authentication proxy server according to claim 1 or 2, further comprising: a payment collection proxy means that proxys the collection. 4. When connecting to a network, by authenticating the user, the user terminal used by the user is connected to the network with a communication carrier server used by a communication carrier connecting to the network. An authentication proxy method for proxying the authentication procedure of the user by using a server connected to a service provider server used by a service provider that provides a service to the user via a network, By receiving from the service provider server client information including the addresses of the user terminal and the communication provider server received from the user terminal by the provider server, the user based on the client information. A step of identifying the carrier server used by the terminal, The user who has accessed the service provider server based on the authentication of the user performed at the time of network connection to the communication provider server by transmitting the client information to the trust provider server. Requesting the authentication process of and transmitting the authentication result to the service provider server that has accessed, the service provider server, the service provider server based on the received authentication result. An authentication proxy method characterized by performing user authentication. 5. When connecting to a network, by authenticating the user, the user terminal used by the user is connected via a network to a communication carrier server used by a communication carrier connecting to the network. An authentication proxy method for proxying the authentication procedure of the user by using a server connected to a service provider server used by a service provider that provides a service to the user via a network, By receiving from the service provider server client information including the addresses of the user terminal and the communication provider server received from the user terminal by the provider server, the user based on the client information. A step of identifying the carrier server used by the terminal, By transmitting the client information to the carrier server, the user of the user who has accessed the service provider server based on the authentication of the user performed at the time of network connection to the carrier server And a step of requesting authentication, and by transmitting the authentication result of the user relating to the authentication request transmitted from the communication provider server, transmitting the authentication result to the service provider server which has accessed. An authentication proxy method, characterized in that the service provider server authenticates the user based on the received authentication result. 6. Billing information relating to the service of the corresponding user, which is transmitted from the service provider server that has provided the service to the user terminal, is transmitted to the communication provider server, Requesting the server to collect the charge related to the charge information, storing the charge information, based on the charge information accumulated for a certain period on behalf of the charge collection of the service provider Requesting the fee to the server of the online credit company to which the telecommunications carrier who has already collected the fee related to the billing information from the user and acting as a proxy for the collection of the fee. The authentication proxy method according to claim 4 or 5. 7. When connecting to a network, by authenticating the user, the user terminal used by the user is connected via a network to a communication carrier server used by a communication carrier connecting to the network. An authentication proxy program for proxying the authentication procedure of the user using a server connected to a service provider server used by a service provider that provides a service to the user via a network, By receiving client information including the addresses of the user terminal and the communication carrier server from the user terminal received by the service provider server from the service provider server, the client information based on the client information is received. A step of specifying the carrier server used by the user terminal; Accessing the service provider server based on the authentication of the user performed at the time of network connection to the communication provider server by transmitting the client information to the specified communication provider server Requesting the user to perform authentication processing and requesting that the authentication result be transmitted to the accessing service provider server, the service provider server receives the received result. An authentication proxy program, which authenticates the user based on an authentication result. 8. When connecting to a network, by authenticating the user, the user terminal used by the user is connected via the network to a communication carrier server used by the communication carrier connecting to the network. An authentication proxy program for executing a proxy of the authentication procedure of the user by using a server connected to a service provider server used by a service provider providing a service to the user via a network, By receiving client information including the addresses of the user terminal and the communication carrier server from the user terminal received by the service provider server from the service provider server, the client information based on the client information is received. A step of specifying the carrier server used by the user terminal; By transmitting the client information to the specified carrier server, the service provider server is accessed based on the authentication of the user performed at the time of network connection to the carrier server. Requesting the authentication of the user, and the service providing business that has accessed the authentication result by receiving the authentication result of the user according to the authentication request transmitted from the communication carrier server. An authentication proxy program, wherein the service provider server authenticates the user based on the received authentication result. 9. Billing information relating to the service of the corresponding user transmitted from the service provider server that has provided the service to the user terminal is transmitted to the communication provider server, Requesting the server to collect the charge related to the charge information, storing the charge information, based on the charge information accumulated for a certain period on behalf of the charge collection of the service provider Requesting the fee to the server of the online credit company to which the telecommunications carrier, who has already collected the fee related to the billing information from the user, and performing the step of proxying the collection of the fee. The authentication proxy program according to claim 7, which is characterized in that.