JP2003122723A - Method and system for relaying user authentication - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce the burden needed for the input of authentication information in the case of accessing the contents requiring user authentication from a client terminal such as a cellular telephone. SOLUTION: This system is provided with a storage means for storing pieces of the authentication information and identification information for the authentication information by every content for authentication the user authentication of which is successfully performed and a user authentication relay processing means for receiving an acquisition request of the contents for user authentication from a client terminal, for judging whether or not the identification information for authentication to the requested contents for user authentication is already stored in the storage means, for transmitting the authentication information corresponding to the stored authentication information to a contents distributing device at an acquisition requesting destination and for executing the user authentication in proxy when it is stored, for relaying a user authentication processing between the client terminal and the contents distributing device and for storing addresses of the contents for authentication, the authentication information and the identification information according to authentication results when it is not stored.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention, when referring to WWW content from a mobile terminal such as a mobile phone using the Internet, requires user authentication to confirm the reference authority, the first time Authenticate with the user name and password of, and if the authentication is successful, let the user enter the identification information to identify the authentication information consisting of this user name and password, and register it, so that the next time and after. The present invention relates to a user authentication relay method and system for performing user authentication on behalf of users by inputting identification information when accessing the same WWW content.

[0002]

2. Description of the Related Art A function of obtaining and browsing WWW contents via the Internet using a mobile phone has been realized. However, since the user interface of the mobile phone has only about 12 buttons, it is inconvenient to input various information. In order to deal with this problem, Japanese Patent Laid-Open No. 11-120238 discloses a method of storing personal information in advance and providing the personal information by proxy when the service provider requests the personal information. .

[0003]

However, the above-mentioned Japanese Unexamined Patent Application Publication No.
Utilizing the technology disclosed in No. 1-120238, WW
If you try to authenticate when accessing W content, you must register the authentication information for each content that requires authentication in advance, and the authentication information required to refer to each content is different, so enter the information. There is a problem that the burden on the user is heavy. In particular, there is a problem that it is troublesome to input the authentication information in proportion to the increase in the number of browsed contents.

It is an object of the present invention to provide a user authentication relay method and system that reduces the burden on the user of inputting authentication information and enables easy browsing of many contents.

[0005]

In order to achieve the above object, a user authentication relay system according to the present invention stores authentication information and identification information for the authentication information for each authentication content for which user authentication has been successful. A storage unit and a request to obtain the content for user authentication are received from the client terminal, and it is determined whether or not the identification information for authentication of the requested content for user authentication is already stored in the storage unit and stored. If so, the authentication information corresponding to the stored identification information is transmitted to the content distribution device of the content acquisition request destination to perform the user authentication on behalf. If not stored, the client terminal and the content distribution device The user authentication process is relayed between the two, and the address of the authentication content and the authentication information and Characterized in that it comprises a user authentication relay processing means for storing identification information.

[0006] Further, it is characterized in that it comprises means for changing the authentication information stored in the storage means. The content distribution device further comprises means for requesting the client terminal to input the authentication information again when the authentication information is changed and the authentication processing using the authentication information stored in the storage means fails. Is characterized by. Further, when the authentication information stored in the storage means has passed a time designated for each content for user authentication, a means for requesting input of the authentication information again is provided. Also,
It is characterized by comprising means for returning the authentication information stored in the storage means in response to a reference request from the client terminal. In addition, if the identification information sent from the client terminal is incorrect for a specified number of times in a row,
It is characterized by further comprising means for erasing a set of the authentication information and the identification information stored in the storage means. Also,
It is characterized by further comprising means for charging the user of the client terminal according to the number of authentication information stored in the storage means. Further, it is characterized in that it is provided with a means for charging according to the number of times of authentication processing substitution.

Further, the user authentication relay method according to the present invention comprises a storage means for storing the authentication information and the identification information for the authentication information for each authentication content for which the user authentication is successful, and obtains the user authentication content. A request is received from the client terminal, it is determined whether or not the identification information for authentication for the requested user authentication content is already stored in the storage means, and if stored, the stored identification information is added. A step of transmitting corresponding authentication information to the content distribution device of the content acquisition request destination to perform the user authentication on behalf, and if not stored, relay the user authentication process between the client terminal and the content distribution device. A storage unit for storing the address of the authentication content, the authentication information and the identification information according to the authentication result. Tsu, characterized in that it comprises a flop.

[0008]

BEST MODE FOR CARRYING OUT THE INVENTION An embodiment of a user authentication relay system according to the present invention will be described below with reference to the drawings. FIG. 1 is a system configuration diagram showing an embodiment of the present invention. In the system shown in this embodiment, a content distribution server computer 1 that stores WWW contents and runs a WWW server program, and a user authentication relay server computer 2 that runs a user authentication relay program are connected via a network 3. You are connected to the Internet 4. The intra-communication carrier network 6 is connected to the Internet 4 via the gateway 5, and the mobile phone 8 is connected to the intra-communication carrier network 6 via the wireless communication base station 7.

FIG. 2 is a block diagram showing the detailed structures of the content distribution server computer 1 and the user authentication relay server computer 2. The content distribution server computer 1 includes a terminal device 11 including a CPU 11A and a memory 11B, a WWW server program 12A and a WW.
External storage device 12 in which W content 12B is stored
And a communication port 13. The user authentication relay server computer 2 includes a terminal device 21 including a CPU 21A and a memory 21B, and a user authentication relay program 22.
A, a URL of content that requires user authentication, and a user authentication content table 22B that stores a success code when user authentication is successful, and authentication information and identification information when user authentication is successful. An external storage device 22 storing an authentication information table 22C to be stored and a communication port 23 are connected to each other via a network 3 for communicating data.
The WWW server program 12A and the user authentication relay server program 22A may run on the same computer.

FIG. 3 is a diagram showing an example of the WWW contents 12B stored in the external storage device on the contents distribution server computer 1 in HTML format, and it is described that an input of a user name and a password is instructed. ing.

FIG. 4 is a functional block diagram showing the configuration of the user authentication relay program 22A which runs on the user authentication relay server computer 2. The user authentication relay program 22A is a content request receiving program 401 that receives a content request from the mobile phone 8, a proxy authentication program that, on behalf of the mobile phone 8, transmits authentication information to the WWW server program 12A and performs proxy authentication. 402, authentication information table management program 403 for managing the authentication information table 22C, initial screen content 40
4 and identification information input contents 405.

FIG. 5 shows an example of the user authentication content table 22B stored in the external storage device 22 on the user authentication relay server computer 2. In the user authentication content table 22B, the URL 501 of the content requesting the input of the authentication information and the success code 502 returned when the authentication is successful are stored as a pair.

FIG. 6 is an example of the authentication information table 22C stored in the external storage device 22 on the user authentication relay server computer 2. In the authentication information table 22C, the URL 601 of the content for inputting the authentication information such as the user name and password, the authentication information 602 input by the user, the identification information 603 input by the user, and the time 604 when the information is registered are paired. It is stored.

FIG. 7A is an example of a screen of the mobile phone 8 which uses the user authentication relay service. In this embodiment,
Mobile phone 8 to user authentication relay server computer 2
The initial screen content 404 acquired as the initial screen when connecting to the
It is displayed as a text area 701 for inputting RL, a text area 702 for inputting identification information, and a button 703 for instructing a connection for obtaining contents. FIG. 7B is another screen example of the mobile phone 8 which uses the user authentication relay service. In this embodiment, when the authentication information is transmitted from the mobile phone 8 to the user authentication relay server computer 2 and the content delivery server computer 1 fails in the authentication, the identification information input content 405 is displayed on the screen 704. Existing U
RL 705, text area 70 for inputting identification information
6. Button 7 for instructing connection to obtain contents
It is displayed as 07.

In the above configuration, when the URL of the content desired to be browsed is specified from the mobile phone 8 and the user authentication relay server computer 2 is connected, the user authentication relay server program 22A determines that the specified URL is registered. It is determined whether they match, and if they do not match, the contents are relayed to the WWW server computer 1 as they are, and the obtained contents are returned. If they match,
It is confirmed whether the authentication information 602 is already registered in the authentication information table 22C, and if it is registered, the content for inputting the identification information 603 is returned to the mobile phone 8 and the user is made to input the identification information. . If the input identification information matches the registered identification information 603, the registered authentication information 602 is used as a proxy for the WW.
Send to W server computer 1 to perform authentication processing on behalf of
The result is returned to the mobile phone 8. If the identification information 603 does not match, the content for inputting the identification information 603 a specified number of times is returned to the mobile phone 8.

If the authentication information 602 is not registered, first, the content of the WWW server computer 1 for inputting the authentication information is returned. When the authentication information is obtained from the mobile phone 8, the content for inputting the identification information 603 is sent to the mobile phone 8 to obtain the identification information. After that, the acquired authentication information is transmitted to the WWW server computer 1 for authentication, and if successful, the set of authentication information and identification information is registered in the authentication information table 22C to prepare for subsequent access.

By adopting the above method, it becomes necessary to input only the identification information 603 after the second time when accessing the content requiring user authentication from the mobile phone 8, and the input load of the authentication information is reduced. be able to.

A detailed description will be given below with reference to the drawings. FIG. 8 is a diagram showing a data flow when the WWW content is accessed for the first time among the mobile phone 8, the user authentication relay server computer 2, and the content distribution server computer 1 when using the user authentication relay service. First, when connecting to the user authentication relay server computer 2 from the mobile phone 8 (step 801), an initial screen for using the user authentication relay service is returned (step 802). This initial screen is as shown in FIG. 7 (a).

When the URL and the identification information are input to the initial screen and a user authentication content acquisition request is issued to the user authentication relay server computer 1 (step 803),
The user authentication relay server computer 2 issues a user authentication content request to the content distribution server computer 1 (step 804), receives the user authentication content (step 805), and returns it to the mobile phone 8 as it is (step 806).

Next, the authentication information is obtained from the mobile phone 8 (step 807), and the authentication information is transmitted to the content distribution server computer 1 (step 808). Then, the authentication result and the content are received from the content distribution server computer 1 (step 809), and if the authentication is successful, the set of the content URL, the authentication information, and the identification information is stored in the authentication information management table 22C (step 810). ), The content is returned to the mobile phone 8 (step 811). If the authentication fails, the content for inputting the authentication information is retransmitted (step 812).
After that, the process is repeated from step 807.

FIG. 9 shows a case where the mobile phone 8, the user authentication relay server computer 2, and the content distribution server computer 1 are used when the user authentication relay service is used.
It is the figure which showed the flow of the data at the time of accessing the same user authentication content after the 1st time. When connecting to the user authentication relay server computer 2 from the mobile phone 8 (step 901), an initial screen for using the user authentication relay service is returned (step 902). On the initial screen, the URL and identification information are input and a content acquisition request is issued to the user authentication relay server computer 1 (step 903).

The user authentication relay server computer 2 is
It connects to the content distribution server computer 1 and sends a request to acquire the content of the specified URL (step 904). Obtain content (step 90)
5) The authentication information 602 corresponding to the identification information 603 is transmitted to the content distribution server computer 1 (step 906). The code and content of the authentication result are received (step 907), the content obtained in step 907 is returned to the mobile phone 8 if the authentication is successful (step 908), and the identification information input content 405 is returned in the case of failure. It is returned to the mobile phone 8 (step 909) and the process is repeated from step 904.

FIG. 10 is a flowchart showing the operation of the WWW server program 12A running on the content distribution server computer 1. When the WWW server program 12A starts, first, the connection from the user authentication relay server computer 2 is accepted (step 100).
1). After connecting, the URL of the content is received (step 1002). It is determined whether the received URL is a user authentication program (step 1003), and if it is a user authentication program, authentication information is received (step 1).
004), a user authentication program (not shown) is started (step 1005), the authentication result is received (step 1006), the code of the authentication result and the content corresponding to the authentication result are returned (step 1007), and the user The connection with the authentication relay server computer 2 is disconnected (step 1
008) and repeat from step 1001. If the URL is not a user authentication program, the content corresponding to the URL is returned (step 1009), and step 1
Continue from 008.

FIG. 11 shows the user authentication relay program 22.
6 is a flowchart showing the operation of a content request reception program 401 which constitutes A. When the content request reception program 401 starts, the connection is accepted from the mobile phone 8 (step 1101) and the initial screen is returned (step 1102). Next, the URL and the identification information of the content to be acquired are received (step 1103). It is confirmed whether the received URL is registered in the user authentication content table 22B (step 1104), and if it is not registered, the content distribution server computer 1 corresponding to the URL is connected (step 1105) and the content is obtained ( Step 1106), mobile phone 8
(Step 1107) and repeats from step 1101.

URL is user authentication content table 2
If registered in 2B, the URL, NULL, identification information and search command are sent to the authentication information table management program 403 to obtain the authentication information 602 (step 110).
8). It is confirmed whether the authentication information 602 has been registered (step 1109), and if it is not registered, the content distribution server computer 1 for the obtained URL is connected (step 1110) and the content for user authentication is obtained (step 1111). , And returns it to the mobile phone 8 (step 1112).

After that, the authentication information is received from the mobile phone 8 (step 1113), and the URL, the authentication information and the identification information are passed to the proxy authentication program 402 (step 111).
4) and receive the content (step 1115). Return to mobile phone 8 (step 1116), step 1
Repeat from 101. If the authentication information has been registered, the process continues from step 1114.

FIG. 12 shows the user authentication relay program 22.
6 is a flowchart showing an operation of a proxy authentication program 402 which constitutes A. When the proxy authentication program 402 starts, the content request reception program 401 sends U
The RL and the authentication information are obtained (step 1201). Then, the user authentication content corresponding to the URL is received from the content distribution server computer 1 (step 1202). Next, the authentication information is transmitted to the content distribution server computer 1 (step 1203), and the authentication result and the content are obtained (step 1204).

The result code of the authentication result is the URL 50 registered in the user authentication content table 22B.
It is checked whether it is equal to the success code 502 corresponding to 1 (step 1205), and if they are equal, the error count is set to 0 (step 1206), and the URL, the authentication information, the identification information, and the registration command are registered in the authentication information table management program
03 to register (step 1207), step 1
The content obtained in 204 is returned to the content request receiving program 401 (step 1208), and the processing is repeated from step 1201.

If it is not equal to the success code, it is confirmed whether the number of errors exceeds the limit number of errors of the system (step 1209). If it exceeds, the URL, the authentication information, the identification information, and the deletion command are passed to the authentication information table management program 403 (step 1210), the error count is set to 0 (step 1211), and the user authentication content is returned ( Step 1212), Step 12
Repeat from 01. If the number of errors does not exceed the limit, 1 is added to the number of errors (step 1213), the URL in the identification information input content is replaced with the obtained URL (step 1214), and the replaced content is returned (step 1213). 1215) and repeat from step 1201.

FIG. 13 shows the user authentication relay program 22.
Authentication information table management program 403 that constitutes A
3 is a flowchart showing the operation of FIG. When the authentication information table management program 403 starts, the URL, the authentication information, the identification information and the command are received (step 1301).
It is checked whether or not the command is a search (step 1302), and in the case of a search, the URL specified in the authentication information table 22C
And whether there is a pair of identification information (step 1
303), if there is an equal set, the authentication information of the set is returned (step 1304) and the process is repeated from step 1301. If there is no equal value, NULL is returned (step 1305) and the process is repeated from step 1301. If the command is not a search, it is determined whether the command is registration (step 1306). If the command is registration, it is checked whether there is a pair of the URL and the identification information in the authentication information table 22C (step 1307). , If there is an equal set, replace that set (step 130).
8), repeat from step 1301.

If there is no equal pair, the UR obtained
A set of L, authentication information, identification information, and current time is newly registered in the authentication information table 22C (step 1309), and the processing is repeated from step 1301.

If the command is neither a search nor a registration, it is checked whether the command is a reference (step 1310). If the command is a reference, all the sets having the same identification information in the authentication information table 22C are returned (step 1311). , Step 13
Repeat from 01. If the command is neither search, registration, nor reference, a set having the same URL, authentication information, and identification information is deleted from the authentication information table 22C (step 131).
2), repeat from step 1301.

Although not shown in the flow chart, the authentication information table management program 403 checks the authentication information table 22C at any time to check the registration time 604.
After the time specified by the system has passed, the set is deleted.

In addition, a charging processing program is installed in the user authentication relay server computer 2, and the user of the mobile phone 8 as a client terminal is provided to the user according to the number of sets of the authentication information and the identification information stored in the authentication information table 22C. It can be configured to charge. It is also possible to monitor the number of times the user authentication process is performed on behalf of the user, and to charge according to the number of times of substitution or the number of sets of authentication information and identification information.

Also, in response to a reference request from a client terminal such as a mobile phone, the URL, the authentication information, and the identification information stored in the authentication information table 22C are provided in the form of a list to reply to the user so that the registration is already completed. The URL, the authentication information, and the identification information that are displayed can be checked, and it can be useful for changing the authentication information and deleting unnecessary information.

The function of each program has been described assuming that the user authentication relay program 22A is running on the user authentication relay server computer 2, but the user authentication relay program 22A itself runs on the content distribution server computer 1. I don't mind. Although it is assumed that information is input from the mobile phone 8, it may be used for user authentication from a normal desktop computer or PDA.

[0037]

As described above, according to the present invention, if the authentication information is input only once when using the content for which the reference authority needs to be confirmed from the client terminal such as the mobile phone, the identification information will be provided thereafter. Authentication can be performed only by inputting, the burden on the user for inputting information can be reduced, and an extremely useful effect can be obtained when browsing many contents. In particular, a remarkable effect can be obtained when browsing content that requires user authentication using a client terminal such as a mobile phone having a small number of input keys.

[Brief description of drawings]

FIG. 1 is a system configuration diagram showing an embodiment of a user authentication relay system according to the present invention.

FIG. 2 is a block configuration diagram of a content distribution server computer and a user authentication relay server computer according to the present invention.

FIG. 3 is a diagram showing an example of content stored in an external storage device on a content distribution server computer according to the present invention.

FIG. 4 is a functional block diagram of a user authentication relay program running on a user authentication relay server computer according to the present invention.

FIG. 5 is a diagram showing an example of a user authentication content table stored in an external storage device on the user authentication relay server computer according to the present invention.

FIG. 6 is a diagram showing an example of an authentication information table stored in an external storage device on a user authentication relay server computer according to the present invention.

FIG. 7 is an example of a screen of a mobile terminal that uses the user authentication relay service according to the present invention.

FIG. 8 is a portable terminal, user authentication relay program, WWW when using the user authentication relay service according to the present invention.
It is the figure which showed the flow of the data at the time of accessing the content for user authentication for the first time among server programs.

FIG. 9 is a portable terminal, a user authentication relay program, WWW when using the user authentication relay service according to the present invention.
It is the figure which showed the data flow at the time of accessing the content for user authentication after the 2nd time between server programs.

FIG. 10 is a flowchart showing the operation of a WWW server program running on the content distribution server computer according to the present invention.

FIG. 11 is a flowchart showing the operation of the content request reception program that constitutes the user authentication relay program according to the present invention.

FIG. 12 is a flowchart showing the operation of a proxy authentication program that constitutes a user authentication relay program according to the present invention.

FIG. 13 is a flowchart showing the operation of an authentication information table management program used by the user authentication relay program according to the present invention.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Content distribution server computer, 2 ... User authentication relay server computer, 3 ... Network, 4 ... Internet, 5 ... Gateway, 6 ... Carrier network, 7 ... Wireless base station, 8 ... Mobile phone 11,
1 ... Terminal device, 12,22 ... External storage device, 13,23
... communication port, 12A ... WWW server program, 12
B ... WWW content, 22A ... User authentication relay program, 22B ... User authentication content table, 22C
… Authentication information table.

Claims (9)

[Claims] 1. A user authentication relay system acting on behalf of user authentication processing for content for user authentication, wherein storage means stores authentication information and identification information for the authentication information for each authentication content for which user authentication has succeeded. And a request for obtaining the content for user authentication is received from the client terminal, it is determined whether or not the identification information for authentication of the requested content for user authentication is already stored in the storage means, and it is stored. For example, the authentication information corresponding to the stored identification information is transmitted to the content distribution device of the content acquisition request destination to perform user authentication on behalf of the user. If not stored, between the client terminal and the content distribution device. Relay the user authentication process with
A user authentication relay system comprising a user authentication relay processing means for storing the address of the authentication content, the authentication information and the identification information in the storage means according to the authentication result. 2. The user authentication relay system according to claim 1, further comprising means for changing the authentication information stored in said storage means. 3. A means for requesting the client terminal to input the authentication information again when the authentication information is changed on the content distribution device side and the authentication process using the authentication information stored in the storage means fails. The user authentication relay system according to claim 1, further comprising: 4. When the authentication information stored in the storage means has passed a time designated for each content for user authentication, a means for requesting input of the authentication information again is provided. The user authentication relay system according to any one of 1 to 3. 5. The user authentication according to claim 1, further comprising means for returning the authentication information stored in said storage means in response to a reference request from a client terminal. Relay system. 6. A means for deleting the set of the authentication information and the identification information stored in the storage means when the identification information transmitted from the client terminal is erroneously specified times or more consecutively. 1 to 5 characterized by
The user authentication relay system according to any one of 1. 7. The user authentication according to claim 1, further comprising means for charging a user of the client terminal according to the number of authentication information stored in the storage means. Relay system. 8. The user authentication relay system according to claim 1, further comprising means for charging according to the number of times the authentication process is performed on behalf of the user. 9. A user authentication relay method comprising storage means for storing authentication information and identification information for the authentication information for each authentication content for which user authentication has succeeded, and performing the user authentication processing for the user authentication content on behalf of the user authentication relay method. Therefore, a request for acquiring the content for user authentication is received from the client terminal, it is determined whether or not the identification information for authentication of the requested content for user authentication is already stored in the storage unit, and it is stored. If so, the step of transmitting authentication information corresponding to the stored identification information to the content distribution apparatus of the content acquisition request destination to perform user authentication on behalf, and if not stored, the client terminal and the content distribution apparatus The user authentication process is relayed between the storage device and the User authentication relay method characterized by comprising the steps of storing the address and authentication information and identification information.