JP2003295963A - System for terminal authentication, apparatus and program for the same - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform access control by identifying a terminal downloading a program from a server. <P>SOLUTION: When receiving a request of transmitting an external program from a portable telephone, the server creates unique terminal identification information to be allocated to the portable telephone and registers the terminal identification information. After that, the external program is transmitted to the portable telephone. The portable telephone performs processing according to the external program, and transmits the terminal identification information when requesting data or the like to the server. The server determines that the authentication is successful, if the terminal identification information equal to the received terminal identification information is registered, and meets the request from the portable telephone. The server determines that the authentication is not successful, if the terminal identification information equal to the received terminal identification information is not registered. <P>COPYRIGHT: (C)2004,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a terminal authentication system, a terminal authentication device, and a terminal authentication program for authenticating a terminal such as a mobile phone device having downloaded a program.

[0002]

2. Description of the Related Art With the spread of communication networks in recent years,
There is an increasing number of program acquisition modes in which an information processing apparatus, a mobile information terminal, or the like downloads a program via a communication network. Mobile phone devices have become more sophisticated, and various programs can be downloaded from a server to the mobile phone device via the Internet and the programs can be executed by the mobile phone device. Hereinafter, a case where the mobile phone device downloads the program will be described as an example.

The program downloaded by the mobile phone device does not always proceed only by the mobile phone device.
The mobile phone device that has downloaded the program may proceed with processing while transmitting and receiving information to and from the server. In this case, the mobile phone device operating according to the program requests the server to execute a predetermined process. The server executes a predetermined process in response to the request, and the mobile phone device advances the process by using the execution result information and the like. For example, the mobile phone device requests the server to transmit predetermined data, and proceeds with the process using the data received from the server.

[0004]

Conventionally, when a mobile phone device requests a server to execute a predetermined process in accordance with a downloaded program, the server cannot identify each mobile phone device. . Therefore, it is difficult for the server to control access to the mobile phone device. That is, it is difficult to perform control to accept a request from a certain mobile phone device and exclude a request from another mobile phone.

In some cases, the mobile phone device operating according to the downloaded program prompts the user to input personal information, transmits the personal information, and requests the server to perform processing. In this case, since the server cannot identify the mobile phone device, it is difficult to prevent spoofing. For example, the processing may be requested by the mobile phone device of the user who is trying to transmit his / her own personal information, or the processing may be requested by a mobile phone device of a third party who is trying to impersonate another person and misuse the personal information of another person. I couldn't tell if it was.

As described above, conventionally, since each mobile phone device cannot be identified, there are problems that access control to each mobile phone device is difficult and that security measures against impersonation are not sufficient.

Therefore, an object of the present invention is to identify each information terminal so that access control can be performed. It also aims to prevent spoofing.

[0008]

A terminal authentication system according to the present invention provides a terminal connected to a communication network and a program to the terminal via the communication network, and executes a predetermined process from the terminal operating according to the program. A terminal authentication system comprising a terminal authentication device for authenticating a terminal when requested to do so, wherein the terminal authentication device sends a program and terminal identification information for identifying the terminal to the terminal, When receiving the information requesting execution of a predetermined process and the terminal identification information from the terminal, the terminal identification information is used to authenticate the terminal, and the terminal performs a predetermined process on the terminal authentication device according to the program. When such a request is made, the information for requesting execution of a predetermined process and the terminal identification information are transmitted to the terminal authentication device.

For example, when the terminal authentication device receives information requesting a program from the terminal, the terminal identification information setting means for setting the terminal identification information for identifying the terminal and the terminal identification information setting means define the terminal identification information. Terminal identification information holding means for holding the terminal identification information, terminal identification information transmission means for transmitting the program requested by the terminal to the terminal together with the terminal identification information set by the terminal identification information setting means, and a terminal operating according to the program The terminal receives information for requesting execution of predetermined processing and terminal identification information, and includes an authentication means for authenticating the terminal based on the terminal identification information held by the terminal identification information holding means, and the terminal requests a program. Program requesting means for transmitting information to the effect to the terminal authentication device, and a program for receiving the program and the terminal identification information from the terminal authentication device It comprises a resulting unit, and a processing requesting means for transmitting to the terminal authentication apparatus in accordance with a program and that the information and the terminal identification information requesting execution of the predetermined process.

For example, the terminal is a portable telephone device, and the terminal identification information setting means defines the terminal identification information for identifying the portable telephone device when the information requesting the program is received from the portable telephone device. The terminal identification information transmitting means transmits the program requested by the mobile telephone device to the mobile telephone device together with the terminal identification information set by the terminal identification information setting means, and the authenticating means transmits a predetermined program from the mobile telephone device operating according to the program. The information requesting execution of the process and the terminal identification information are received, and the mobile phone device is authenticated based on the terminal identification information held by the terminal identification information holding means.

For example, the authentication means determines that the authentication is successful when the terminal identification information holding means holds the same terminal identification information as the terminal identification information received from the terminal.

The terminal authentication device comprises a user identification information holding means for holding user identification information for identifying the user of the terminal, and the terminal identification information setting means stores information for requesting a program from the terminal. When the user identification information is received and the user identification information holding means holds the same user identification information as the user identification information, the terminal identification information is determined and the terminal identification information holding means is The terminal identification information set by the identification information setting means and the user identification information received by the terminal identification information setting means are held in association with each other, and the authentication means,
Information that requests execution of a predetermined process from the terminal, terminal identification information, and user identification information is received, and the terminal is identified based on the terminal identification information and the user identification information held by the terminal identification information holding unit. The program request means authenticates and sends the information requesting the program and the user identification information to the terminal authentication device, and the processing request means requests the execution of a predetermined process and the terminal identification information. And the user identification information are preferably transmitted to the terminal authentication device. According to such a configuration, since the user identification information and the terminal identification information are used for authentication, it is possible to prevent spoofing.

For example, the authentication means extracts the user identification information corresponding to the terminal identification information received from the terminal from the terminal identification information holding means, and the extracted user identification information and the user identification information received from the terminal are combined. If they match, it is determined that the authentication was successful.

The program requesting means sends the information requesting the program and the information unique to the terminal to the terminal authentication device, and the terminal identification information setting means sends the information requesting the program from the terminal, The information unique to the terminal may be received, and the information unique to the terminal may be determined as the terminal identification information.

The terminal identification information setting means creates the terminal identification information as information separate from the program requested by the terminal, and the terminal identification information transmission means transmits the program and the terminal identification information to the terminal. May be.

The program is a program that causes the terminal to realize a function of transmitting the terminal identification information defined in the parameter, and the terminal identification information setting means writes the terminal identification information in the parameter of the program and transmits the terminal identification information. The means may transmit the program in which the terminal identification information is written in the parameter to the terminal.

The terminal authentication apparatus according to the present invention provides a program to the terminal via the communication network, and authenticates the terminal when the terminal operating according to the program requests the terminal to execute a predetermined process. An authentication device, when receiving information requesting a program from a terminal, terminal identification information setting means for setting terminal identification information for identifying the terminal, and terminal identification information set by the terminal identification information setting means A terminal identification information holding means for holding, a terminal identification information transmitting means for transmitting the program requested by the terminal to the terminal together with the terminal identification information set by the terminal identification information setting means, and a predetermined process from the terminal operating according to the program. Based on the terminal identification information held by the terminal identification information holding means, the information requesting execution and the terminal identification information are received. Characterized by comprising an authentication means for authenticating the end.

For example, the terminal to which the program is provided is a portable telephone device, and the terminal identification information setting means identifies the portable telephone device when the information requesting the program is received from the portable telephone device. The terminal identification information transmitting means transmits the program requested by the mobile telephone device to the mobile telephone device together with the terminal identification information determined by the terminal identification information setting means, and the authenticating means operates according to the program. Receives information requesting execution of predetermined processing from the mobile phone device and terminal identification information,
The mobile phone device is authenticated based on the terminal identification information held by the terminal identification information holding means.

For example, the authentication means determines that the authentication is successful when the terminal identification information holding means holds the same terminal identification information as the terminal identification information received from the terminal.

The user identification information holding means for holding the user identification information for identifying the user of the terminal is provided, and the terminal identification information setting means includes the information for requesting the program from the terminal and the user identification information. When the user identification information holding means holds the same user identification information as the user identification information, the terminal identification information is determined, and the terminal identification information holding means is The determined terminal identification information and the user identification information received by the terminal identification information setting means are held in association with each other, and the authentication means is information requesting execution of a predetermined process from the terminal, and the terminal identification information. It is preferable to receive the user identification information and authenticate the terminal based on the terminal identification information and the user identification information held by the terminal identification information holding means. According to such a configuration, since the authentication is performed using the user identification information and the terminal identification information,
Spoofing can be prevented.

For example, the authentication means extracts the user identification information corresponding to the terminal identification information received from the terminal from the terminal identification information holding means, and the extracted user identification information and the user identification information received from the terminal are combined. If they match, it is determined that the authentication was successful.

The terminal identification information setting means may receive the information requesting the program from the terminal and the information unique to the terminal, and determine the information unique to the terminal as the terminal identification information.

The terminal identification information setting means creates the terminal identification information as information different from the program requested by the terminal, and the terminal identification information transmitting means transmits the program and the terminal identification information to the terminal. May be.

Alternatively, the program is a program for causing the terminal to realize the function of transmitting the terminal identification information defined in the parameter, and the terminal identification information setting means is
The terminal identification information may be written in the parameter of the program, and the terminal identification information transmitting means may transmit the program in which the terminal identification information is written in the parameter to the terminal.

A terminal authentication program according to the present invention causes a terminal to provide a program through a communication network, and authenticates the terminal when a terminal operating according to the program requests the terminal to execute a predetermined process. In addition, when the computer receives the information requesting the program from the terminal, the function of defining the terminal identification information for identifying the terminal, the program requested by the terminal is transmitted to the terminal together with the terminal identification information. It is characterized in that a function and a function of receiving information requesting execution of a predetermined process and terminal identification information from a terminal operating according to a program and authenticating the terminal based on the terminal identification information are realized.

[0026]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing an embodiment of a terminal authentication system according to the present invention. The terminal authentication system includes a server (terminal authentication device) 1 and a terminal 21.
With. The server 1 provides the program to the terminal 21 via the Internet 40. Then, when the terminal 21 operating according to the program accesses the server 1, the server 1 authenticates the terminal 21. Less than,
The program provided by the server 1 to the terminal 21 will be referred to as an external program. In the following description, the case where the server 1 provides the program to the mobile phone device will be described as an example. Although FIG. 1 shows one mobile phone device 21,
The number of mobile phone devices that download the external program from the server 1 is not limited to one.

In the server 1, the control unit 2 operates according to the terminal authentication program 4 and the cooperation program 5 stored in the storage device 3. In addition to the terminal authentication program 4 and the cooperation program 5, the storage device 3 also stores the external program 6 provided to the mobile phone device 21. External program 6
Is created in a programming language such as Java (registered trademark). The terminal authentication program 4 causes the control unit 2 to transmit the external program 6 in response to a request from the mobile phone device 21, and performs an authentication process when the mobile phone device 21 operating according to the external program 6 accesses the server 1. It is a program to be executed. The cooperation program 5 is a program that causes the control unit 2 to execute a predetermined process in response to a request from the mobile phone device 21. For example, it is assumed that the external program 6 is a program that causes the mobile phone device 21 to display the latest stock price information, and the control unit 2 transmits stock price information in response to a request from the mobile phone device 21. In this case, the program that causes the control unit 2 to execute the stock price information transmission process to the mobile phone device 21 is the cooperation program 5.
Corresponds to.

The terminal identification information database 7 manages the terminal identification information of each mobile telephone device 21 that has downloaded the external program 6. When the external program 6 is requested from the mobile phone device 21, the control unit 2 creates terminal identification information for identifying the mobile phone device and registers it in the terminal identification information database 7. The control unit 2 creates new terminal identification information so as not to overlap with the terminal identification information already registered in the terminal identification information database 7. Control unit 2
Creates the terminal identification information as, for example, a unique value (numerical value). Further, the terminal identification information is created as information different from the external program 6.

When transmitting the external program 6 to the portable telephone device 21, the control unit 2 also transmits the created terminal identification information together with the external program 6. When the mobile phone device 21 operates according to the external program 6 and transmits information to the server 1, this terminal identification information is also transmitted to the server 1. The server 1 performs authentication using the terminal identification information from the mobile phone device 21.

The network interface section 8 transmits / receives information, the external program 6 and the like to / from the portable telephone terminal 21 via the Internet 40.

In the portable telephone device 21, the control unit 22
Operates according to each program stored in the storage device 23. The storage device 23 stores the download execution program 24 in advance. Download execution program 24
Is a program that causes the control unit 22 to acquire programs, contents, and the like via the Internet 40. The mobile phone device 21 does not always download the program and the like from the server 1 alone, but may download the program and the content from another server (not shown).

Further, the control unit 22 requests the server 1 for the external program 6 and sends the external program 6 and the terminal identification information 3 to each other.
When 1 is received, the external program 6 and the terminal identification information 31 are stored in the storage device 23. Then, it operates according to the external program 6. When the control unit 22 transmits information or the like to the server 1 according to the external program 6, the terminal identification information 31 is also transmitted to the server 1.

The display unit 25 is composed of, for example, a liquid crystal display device or the like, and displays an execution screen of the external program 6 or the like. Further, the input unit 26 is composed of, for example, a key or the like, and is used by the user to input information. The network interface unit 28 uses the Internet 4
The information, the external program 6 and the like are transmitted / received to / from the server 1 via 0.

In the present embodiment, the terminal identification information setting means is realized by the control unit 2. The terminal identification information holding means is realized by the terminal identification information database 7. The terminal identification information transmitting means and the authentication means are realized by the control unit 2 and the network interface unit 8. The program requesting unit, the program acquiring unit, and the processing requesting unit are realized by the control unit 22 and the network interface unit 28 of the mobile phone device 21.

Further, the storage device 3 has a function of defining terminal identification information for identifying the terminal when the computer receives the information requesting the program from the terminal.
A function of transmitting the program requested by the terminal together with the terminal identification information to the terminal, and the information requesting execution of a predetermined process and the terminal identification information from the terminal operating according to the program, and receiving the information based on the terminal identification information. A terminal authentication program for realizing the function of authenticating the terminal is stored.

Next, the operation will be described. FIG. 2 is a flowchart showing an example of operations of the server 1 and the mobile phone device 21. Here, the external program 6 is assumed to be a program for displaying the latest news on the control unit 22 of the mobile phone device 21. Further, the cooperation program 5 is assumed to be a program for causing the control unit 2 of the server 1 to transmit the latest news information.

First, the control unit 22 of the portable telephone device 21
When the user performs the download operation, the information indicating that the external program 6 is requested is transmitted to the server 1 according to the download execution program 24 (step S5).
1). When the control unit 2 of the server 1 receives this information via the Internet 40, it newly creates the terminal identification information 31 according to the terminal authentication program 4 (step S5).
2). At this time, the control unit 2 creates unique terminal identification information 31 so as not to overlap with the terminal identification information already registered in the terminal identification information database 7. Then, the control unit 2 registers the newly created terminal identification information 31 in the terminal identification information database 7.

Subsequently, the control unit 2 transmits the external program 6 and the newly created terminal identification information 31 to the mobile telephone device 21 via the Internet 40 (step S53). The control unit 22 of the mobile phone device 21 receives the external program 6 and the terminal identification information 31 from the server 1 in step S53. Then, the external program 6 and the terminal identification information 31 are stored in the storage device 23 as shown in FIG. The processing shown in steps S51 to S53 corresponds to the download processing of the external program 6.

The control unit 22 activates the external program 6 according to the operation of the user (step S54). When the user performs an operation of browsing the news, the control unit 22 transmits information requesting the transmission of the latest news information to the server 1 according to the external program 6 (step S5).
5). In step S55, the control unit 22 also transmits the terminal identification information 31 stored in the storage device 23 to the server 1 according to the external program 6.

When the control unit 2 of the server 1 receives the information requesting the transmission of news information and the terminal identification information 31, it authenticates the portable telephone device 21 according to the terminal authentication program 4 (step S56). Step S55
If the same terminal identification information as the terminal identification information 31 received from the mobile phone device 21 is registered in the terminal identification information database 7 at step S53 to S55, the mobile phone device 21 may not falsify the terminal identification information. It has not been done. On the other hand, in step S55, the terminal identification information 31 is not received, or the received terminal identification information 31 is received.
If the same terminal identification information as above is not registered,
It means that the mobile phone device 21 has been tampered with.
Therefore, the control unit 2 confirms whether the same terminal identification information as the received terminal identification information 31 is registered in the terminal identification information database 7, and if the same terminal identification information is registered, the authentication is successful. I judge that I did. If the terminal identification information 31 is not received in step S55 or the same terminal identification information as the received terminal identification information 31 is not registered, it is determined that the authentication has failed.

If the authentication is successful, the control unit 2 sends the latest news information to the mobile telephone device 21 according to the cooperation program 5 (step S57). Here, it is assumed that the server 1 includes a database (not shown) that manages the latest news information, and extracts the latest news information from the database and transmits it. The control unit 22 of the mobile phone device 21 follows the external program 6
The news information received from the server 1 is displayed. on the other hand,
If the authentication fails in step S56, the control unit 2 transmits information indicating that the authentication has failed to the mobile phone device 21,
The mobile phone device 21 displays this information on the display unit 25.

According to the present invention, when the external program 6 is transmitted to the portable telephone device 21, the unique terminal identification information is determined and the terminal identification information is also transmitted. When there is a processing request from the mobile phone device 21, the terminal identification information is also received and authentication is performed. Therefore, the server 1 can identify each mobile phone device that has downloaded the external program 6.

Further, a portable telephone device having the terminal identification information registered in the terminal identification information database 7,
It is possible to identify a mobile phone device that does not have it.
Therefore, the server 1 can perform access control only in response to a request from the mobile phone device having the terminal identification information. For example, it is assumed that the server 1 receives a request to transmit the external program 6 only within a predetermined period, and creates and registers the terminal identification information only within the predetermined period. In this case, the server 1 transmits the terminal identification information only to the mobile phone device that has requested the external program 6 within a predetermined period. Therefore, it is possible to distinguish a mobile phone device that has acquired the terminal identification information by downloading the external program 6 within a predetermined period from another mobile phone device and only respond to a request from the mobile phone device that has acquired the terminal identification information. it can.

In step S52, the case where the control unit 2 newly creates the terminal identification information has been described, but the information unique to each mobile phone device 21 may be used as the terminal identification information. Hereinafter, an example in which the manufacturing number information unique to each mobile phone device is used as the terminal identification information will be described. Depending on the telecommunications carrier, the manufacturer's serial number information is included in the header portion of the information transmitted by the mobile phone device 21. When the external program 6 is provided only to the mobile phone device of the telecommunications carrier who is determined to include the serial number information in the information transmitted by the mobile phone device, the serial number information can be used as the terminal identification information. When the control unit 2 of the server 1 receives the information requesting the external program 6 in step S51, it may extract the manufacturing site number information from the information and use the manufacturing number information as the terminal identification information.

Another embodiment of the present invention will be described below. FIG. 3 is a block diagram showing another embodiment of the terminal authentication system according to the present invention. In the present embodiment, the server (terminal authentication device) 11 performs authentication using not only the terminal identification information but also the user ID and password of the user of the mobile phone device. The configuration of the mobile phone device 21 is similar to that shown in FIG.

In the server 11, the control unit 12 operates according to the terminal authentication program 14 and the cooperation program 5 stored in the storage device 13. Terminal authentication program 14
Causes the control unit 12 to transmit the external program 6 in response to a request from the mobile phone device 21, or
It is a program for executing an authentication process when the mobile phone device 21 operating in accordance with the above accesses the server 11. In this authentication processing, not only the terminal identification information but also the user ID and password are used. The cooperation program 5 and the external program 6 are the same programs as the cooperation program 5 and the external program 6 in the embodiment shown in FIG.

The user information database 18 manages user IDs and passwords (user identification information) of users of each mobile phone. The user ID and password of the user who intends to download the external program 6 are registered in the user information database 18 in advance. Control unit 12
When the mobile phone device 21 downloads the external program 6, it authenticates using the user ID registered in the database 18 on the user information. That is,
The user ID and password of the user are received from the mobile phone device 21 requesting the external program 6, and the received user ID and password are compared with the user ID and password held in the user information database 18 in advance for authentication. I do.

The terminal identification information database 17 contains the terminal identification information of each mobile telephone device 21 that has downloaded the external program 6 and the user ID of the user of the mobile telephone device.
And the passwords are managed in association with each other. Control unit 12
When the mobile phone device 21 downloads the external program 6, it authenticates using the user ID and password. When this authentication is successful, new terminal identification information is created, and the terminal identification information is registered in the terminal identification information database 17 in association with the user ID and password used in the authentication. The control unit 12 creates new terminal identification information so as not to overlap with the terminal identification information already registered in the terminal identification information database 17.
The terminal identification information is created as information different from the external program 6. The production number information unique to the mobile phone device 21 may be used as the terminal identification information.

The network interface section 8 is shown in FIG.
Similarly to the case shown in (1), information, the external program 6 and the like are transmitted and received to and from the mobile phone terminal 21 via the Internet 40.

As in the case of the embodiment shown in FIG. 1, when transmitting the external program 6 to the portable telephone device 21, the control unit 12 transmits the created terminal identification information together with the external program 6. The mobile phone device 21 stores the external program 6 and the terminal identification information 31 in the storage device 23. The control unit 22 controls the server 1 according to the external program 6.
When transmitting information and the like to 1, the terminal identification information 31 is also transmitted to the server 11.

In the present embodiment, the terminal identification information setting means is realized by the control unit 12. The terminal identification information holding means is realized by the terminal identification information database 17. The terminal identification information transmitting means and the authentication means are realized by the control unit 12 and the network interface unit 8. The user identification information holding unit is realized by the user information database 18.

Next, the operation of this embodiment will be described. In the present embodiment, before the mobile phone device 21 downloads the external program 6, the user ID and password of the user of the mobile phone device 21 is registered in the user information database 18. FIG. 4 is a flowchart showing an example of an operation when registering a user ID and a password.
The control unit 22 of the mobile phone device 21 displays the registration screen of the user ID and the password on the server 1 by the operation of the user.
1 is requested (step S61). The control unit 12 of the server 11 transmits the information of the registration screen of the user ID and the password in response to this request (step S62). The server 11 holds the information of this registration screen in the storage device 13 or the like in advance.

Upon receiving the information on the registration screen, the control unit 22 of the portable telephone device 21 displays the registration screen on the display unit 25 and prompts the user to input the user ID and password (step S63). Then, the control unit 22 transmits the input user ID and password to the server 11 (step S64), and the control unit 12 of the server 11 registers the received user ID and password in the user information database 18 (step S64). S65).

The operation for registering the user ID and password is not limited to the case shown in FIG. For example,
The user of the mobile phone device 21 may apply in writing to the administrator of the server 1 for registration of the user ID and password, and the administrator may register the user ID and password.

FIG. 5 is a flow chart showing an example of the operation of the server 11 and the portable telephone device 21 after the external program 6 is downloaded. Here, the external program 6 is a program for supporting electronic commerce, and sends information about a product that the user intends to purchase and the credit card information of the user to the server, and requests the server to perform settlement processing. A case of a program will be described as an example. Cooperation program 5
Is a program that causes the control unit 12 to execute a payment process in response to a request from the mobile phone device 21.

The control unit 22 of the portable telephone device 21 transmits the user information and password registered in steps S61 to S65 to the server 11 and requests the server 11 for the external program 6 (step S71). Step S7
In 1, the control unit 22 first acquires from the server 11 a screen for inputting the user ID and password. Then, the screen is displayed on the display unit 25 to prompt the user to input the user ID and the password. When the user inputs a user ID or the like and performs an operation for instructing the transmission, the control unit 22 transmits the user ID and the password and the information requesting the external program 6 to the server 11.

Upon receiving this information via the Internet, the control unit 12 of the server 11 authenticates the user using the user ID and password according to the terminal authentication program 14 (step S72). Control unit 12
Determines that the authentication has succeeded if the user ID and password received in step S71 are registered in the user information database 18, and determines that the authentication has failed if they are not registered.

If it is determined that the authentication is successful, the control section 12 creates unique terminal identification information 31 so as not to overlap with the terminal identification information already registered in the terminal identification information database 17 (step S73). . Information unique to the mobile phone device 21 may be used as the terminal identification information.
For example, the manufacturing number information included in the header portion of the information received from the mobile phone device 21 in step S71 may be used as the terminal identification information. After step S73, the control unit 12
The user ID and password received in step S71 are associated with the terminal identification information created in step S73 and registered in the terminal identification information database 17 (step S74).

Subsequently, the control unit 12 controls the external program 6
Also, the newly created terminal identification information 31 is transmitted to the mobile phone device 21 via the Internet 40 (step S75). The control unit 22 of the mobile phone device 21 receives the external program 6 and the terminal identification information 31 from the server 11 in step S75. Then, the external program 6 and the terminal identification information 31 are stored in the storage device 23 as shown in FIG. The processing shown in steps S71 to S75 corresponds to the download processing of the external program 6. .

The control unit 22 activates the external program 6 according to the operation of the user (step S76). In the present embodiment, by starting the external program 6,
The control unit 22 displays an input screen for credit card information (credit card number or credit card company information), information on a product that the user intends to purchase, a user ID, a password, and the like. When the user inputs each information and performs an operation for instructing payment, the control unit 22 transmits the input credit card information, purchased product information, user ID, password, etc. to the server 1 for payment processing. Is requested (step S77). In step S77, the control unit 22 follows the external program 6 and stores in the storage device 23.
The terminal identification information 31 stored in is also transmitted. The control unit 12 of the server 11 receives these pieces of information.

According to the terminal authentication program 14, the control unit 12 controls the user I corresponding to the received terminal identification information 31.
The D and password are extracted from the terminal identification information database 17 (step S78). Then, step S7
The user ID and password received in 7 are collated with the user ID and password extracted from the terminal identification information database 17 (step S79).

In step S78, if the same terminal identification information as the received terminal identification information 31 is registered in the terminal identification information database 17, and the user ID and password corresponding to the terminal identification information can be extracted,
In steps S75 to S77, the terminal identification information has not been falsified. If the extracted user ID and password match the user ID and password received in step S77, it means that spoofing has not been performed. Therefore, the user ID and password can be extracted, and when the received user ID and password match the user ID and password, the control unit 12 determines that the authentication is successful. On the other hand, if the user ID and password cannot be extracted or the extracted user ID or the like does not match the received user ID or the like, it is determined that the authentication has failed.

If the authentication is successful in steps S78 and S79, the control unit 12 executes the settlement process using the credit card information or the like according to the cooperation program 5 (step S80), and displays the information indicating that the settlement process is completed. It is transmitted to the mobile terminal device 21. The mobile phone device 21 displays this information. On the other hand, when the authentication fails in steps S78 and S79, the control unit 12 transmits information indicating that the authentication has failed to the mobile phone device 21, and the mobile phone device 21 displays this information on the display unit 25.

In the present embodiment, not only the terminal identification information but also the user ID and password are used for authentication, so that impersonation by a third party can be prevented.

In each of the embodiments, the case where the server 1 transmits the external program 6 together with the terminal identification information is shown. The terminal identification information may be written in the external program 6 itself so that the external program 6 itself has the terminal identification information and the external program 6 is transmitted to the mobile phone device 21. In this case, a variable (parameter) indicating the terminal identification information is defined in the external program 6, and when the terminal identification information is created, this variable may be rewritten according to the created terminal identification information. The control unit 2 transmits the external program 6 to the mobile phone device 21. In addition, the mobile phone device 21 transmits the identification information set in the parameter to the server 11 according to the external program 6.

[0066]

According to the terminal authentication system of the present invention, the terminal authentication device transmits the program and the terminal identification information for identifying the terminal to the terminal, and requests the terminal to execute a predetermined process. When the terminal identification information is received and the terminal identification information is received, the terminal is authenticated using the terminal identification information, and the terminal performs a predetermined process when requesting the terminal authentication device to perform a predetermined process according to the program. Since the information requesting execution of and the terminal identification information are transmitted to the terminal authentication device, each terminal can be identified. Then, the terminal having the terminal identification information and the terminal not having the terminal identification information can be distinguished from each other, and the access control can be performed so as to respond only to the request from the terminal having the terminal identification information.

According to the terminal authentication device of the present invention, when the information requesting the program is received from the terminal, the terminal identification information setting means for setting the terminal identification information for identifying the terminal, and the terminal identification information setting Terminal identification information holding means for holding the terminal identification information defined by the means, terminal identification information transmission means for transmitting the program requested by the terminal to the terminal together with the terminal identification information defined by the terminal identification information setting means,
An authentication unit that receives information requesting execution of a predetermined process and terminal identification information from the terminal operating according to the program, and authenticates the terminal based on the terminal identification information held by the terminal identification information holding unit. Therefore, each terminal can be identified. Then, the terminal having the terminal identification information and the terminal not having the terminal identification information can be distinguished from each other, and the access control can be performed so as to respond only to the request from the terminal having the terminal identification information.

According to the terminal authentication program of the present invention, when the computer receives the information requesting the program from the terminal, the function of defining the terminal identification information for identifying the terminal, the program requested by the terminal With the terminal identification information, and the function of receiving the information requesting execution of a predetermined process and the terminal identification information from the terminal operating according to the program and authenticating the terminal based on the terminal identification information. Since it is realized, each terminal can be identified. Then, a terminal having terminal identification information and a terminal having no terminal identification information are distinguished,
Access control can be performed so that only a request from a terminal having terminal identification information is met.

[Brief description of drawings]

FIG. 1 is a block diagram showing an embodiment of the present invention.

FIG. 2 is a flowchart showing an example of the operation of a server (terminal authentication device).

FIG. 3 is a block diagram showing another embodiment of the present invention.

FIG. 4 is a flowchart showing an example of an operation when registering a user ID and a password.

FIG. 5 is a flowchart showing an example of the operation of a server (terminal authentication device).

[Explanation of symbols]

1 server (terminal authentication device) 2 control unit 3 storage devices 4 Terminal authentication program 6 External program 7 Terminal identification information database 21 Mobile phone device 22 Control unit 23 Storage 31 Terminal identification information

Claims (18)

[Claims] 1. A terminal connected to a communication network,
A terminal authentication system comprising a terminal authentication device that provides a program to the terminal via a communication network, and authenticates the terminal when a terminal operating according to the program requests the terminal to perform a predetermined process. The terminal authentication device transmits the program and the terminal identification information for identifying the terminal to the terminal, and when the terminal identification information and the information requesting execution of a predetermined process are received from the terminal, When the terminal is authenticated using the terminal identification information, and the terminal requests the terminal authentication device to execute a predetermined process according to the program, the information that requests execution of the predetermined process and the terminal identification information Is transmitted to the terminal authentication device. 2. The terminal authentication device, when receiving information requesting a program from the terminal, terminal identification information setting means for setting terminal identification information for identifying the terminal, and the terminal identification information setting means. A terminal identification information holding unit that holds the terminal identification information defined by the terminal identification information transmission unit that transmits the program requested by the terminal to the terminal together with the terminal identification information defined by the terminal identification information setting unit; The terminal that operates in accordance with the program receives information indicating that a predetermined process is to be executed and the terminal identification information, and includes an authentication unit that authenticates the terminal based on the terminal identification information held by the terminal identification information holding unit, The terminal has a program requesting means for transmitting information requesting the program to the terminal authentication device, and the program and the terminal identification information from the terminal authentication device. 2. The terminal authentication according to claim 1, further comprising: a program acquisition unit that receives the request, and a process request unit that sends information requesting execution of a predetermined process and terminal identification information to the terminal authentication device according to the program. system. 3. The terminal is a mobile phone device, and the terminal identification information setting means provides the terminal identification information for identifying the mobile phone device when receiving information requesting a program from the mobile phone device. The terminal identification information transmitting means transmits the program requested by the mobile telephone device to the mobile telephone device together with the terminal identification information determined by the terminal identification information setting means, and the authenticating means operates the mobile telephone operating according to the program. 3. The mobile phone device is authenticated based on the terminal identification information held by the terminal identification information holding means, the information requesting execution of a predetermined process and the terminal identification information from the telephone device.
Terminal authentication system described in. 4. The authentication unit determines that the authentication has succeeded when the terminal identification information holding unit holds the same terminal identification information as the terminal identification information received from the terminal. The terminal authentication system described. 5. The terminal authentication device comprises user identification information holding means for holding user identification information for identifying the user of the terminal, and the terminal identification information setting means requests the program from the terminal. When receiving the information and the user identification information, and the user identification information holding means holds the same user identification information as the user identification information, the terminal identification information is determined, and the terminal identification information holding means is The terminal identification information set by the terminal identification information setting means and the user identification information received by the terminal identification information setting means are held in association with each other, and the authentication means requests execution of predetermined processing from the terminal. Information to that effect, terminal identification information, and user identification information are received,
The terminal is authenticated based on the terminal identification information and the user identification information held by the terminal identification information holding means, and the program requesting means transmits the information requesting the program and the user identification information to the terminal authentication device, The process requesting means transmits information to request execution of a predetermined process, terminal identification information, and user identification information to the terminal authentication device, according to any one of claims 2 to 4. The terminal authentication system described. 6. The authentication means extracts user identification information corresponding to the terminal identification information received from the terminal from the terminal identification information holding means, and the extracted user identification information and the user identification information received from the terminal are combined. The terminal authentication system according to claim 5, wherein the terminal authentication system determines that the authentication is successful when they match. 7. The program requesting means transmits to the terminal authentication device information to request the program and the information unique to the terminal, and the terminal identification information setting means to request the program from the terminal. 7. The terminal authentication system according to any one of claims 2 to 6, which receives information uniquely owned by the terminal and determines information uniquely owned by the terminal as terminal identification information. 8. The terminal identification information setting means creates the terminal identification information as information separate from the program requested by the terminal, and the terminal identification information transmitting means transmits the program and the terminal identification information to the terminal. The terminal authentication system according to any one of claims 2 to 7. 9. The program is a program for causing a terminal to realize a function of transmitting terminal identification information defined in a parameter, wherein the terminal identification information setting means writes the terminal identification information in the parameter of the program to identify the terminal. The terminal authentication system according to any one of claims 2 to 7, wherein the information transmitting means transmits to the terminal the program in which the terminal identification information is written in the parameter. 10. A terminal authenticating device which provides a program to a terminal via a communication network, and which authenticates the terminal when the terminal operating according to the program requests the terminal to execute a predetermined process. Terminal identification information setting means for setting terminal identification information for identifying the terminal when receiving information to request a program, and terminal identification information for holding terminal identification information set by the terminal identification information setting means Holding means, terminal identification information transmitting means for transmitting the program requested by the terminal to the terminal together with the terminal identification information set by the terminal identification information setting means, and executing predetermined processing from the terminal operating according to the program. The terminal that receives the request information and the terminal identification information, and based on the terminal identification information held by the terminal identification information holding means, the terminal Terminal authentication apparatus characterized by comprising an authentication means for authenticating. 11. The terminal to which the program is provided is a mobile phone device, and the terminal identification information setting means identifies the mobile phone device when the information requesting the program is received from the mobile phone device. Terminal identification information for, the terminal identification information transmission means transmits the program requested from the mobile phone device to the mobile phone device together with the terminal identification information set by the terminal identification information setting device, and the authentication means, Claims: Information for requesting execution of a predetermined process and terminal identification information are received from a mobile phone device operating according to the program, and the mobile phone device is authenticated based on the terminal identification information held by the terminal identification information holding means. Item 1
0 is a terminal authentication device. 12. The authentication means determines that the authentication has succeeded when the terminal identification information holding means holds the same terminal identification information as the terminal identification information received from the terminal.
0 or the terminal authentication device according to claim 11. 13. A user identification information holding means for holding user identification information for identifying a user of the terminal, wherein the terminal identification information setting means has information for requesting a program from the terminal and the user identification. When the user identification information holding means holds the same user identification information as the user identification information, the terminal identification information is defined, and the terminal identification information holding means receives the information. The terminal identification information set by the setting means and the user identification information received by the terminal identification information setting means are held in association with each other, and the authentication means is information requesting execution of predetermined processing from the terminal, Receiving the terminal identification information and the user identification information,
The terminal authentication device according to any one of claims 10 to 12, which authenticates the terminal based on the terminal identification information and the user identification information held by the terminal identification information holding means. 14. The authentication means extracts the user identification information corresponding to the terminal identification information received from the terminal from the terminal identification information holding means, and the extracted user identification information and the user identification information received from the terminal are combined. The terminal authentication device according to claim 13, wherein it is determined that the authentication has succeeded if they match. 15. The terminal identification information setting means receives information indicating that a program is requested from the terminal and information unique to the terminal, and determines the information unique to the terminal as the terminal identification information. The terminal authentication device according to any one of claims 10 to 14. 16. The terminal identification information setting means creates terminal identification information as information separate from the program requested by the terminal, and the terminal identification information transmission means transmits the program and the terminal identification information to the terminal. The terminal authentication device according to any one of claims 10 to 15. 17. The program is a program for causing a terminal to realize a function of transmitting terminal identification information defined in a parameter, wherein the terminal identification information setting means writes the terminal identification information in the parameter of the program to identify the terminal. The terminal authentication device according to any one of claims 10 to 15, wherein the information transmission means transmits to the terminal the program in which the terminal identification information is written in the parameter. 18. A terminal authentication program for providing a program to a terminal via a communication network, and authenticating the terminal when a terminal operating according to the program requests the terminal to perform a predetermined process. A function of defining terminal identification information for identifying the terminal when receiving information requesting a program from the terminal, a function of transmitting the program requested by the terminal to the terminal together with the terminal identification information, A terminal authentication program for realizing a function of receiving information requesting execution of a predetermined process and terminal identification information from a terminal operating according to the program and authenticating the terminal based on the terminal identification information.