JP2004272379A - Authentication system and authentication program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system for improving security at the time of dealing with the authentication information of a user. <P>SOLUTION: This authentication system 1a is provided with: a receiving part 101 for receiving device ID and reading device ID transmitted from a reading device 10; a user information selecting part 102 for selecting user ID for specifying a user based on the received device ID; a group information selecting part 103 for specifying group ID for specifying a group to which the reading device 10 is belonging based on the received reading device ID; and a specific information transmitting part 104 for transmitting the user ID and group ID to a group system 30 corresponding to the group ID. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an authentication system and an authentication program.
[0002]
[Prior art]
As a system for linking a plurality of service providers and a user, there is a system that employs a platform for centrally processing a common procedure with little uniqueness (for example, see Patent Document 1).
[0003]
[Patent Document 1]
JP 2001-147969 A
[Problems to be solved by the invention]
With the diversification of services provided using networks, the authentication information of users required by service providers has also become diverse, and the items of authentication information required by a single service provider are diverse. In some cases, the number of items of authentication information required by other service providers may be several. However, when a conventional system is used, user authentication is performed collectively on a platform, so that authentication information that is not originally required may be handled in some cases. Originally, it is desirable to handle the minimum necessary authentication information in terms of security measures. However, if the user authentication information is uniformly handled in this way, there is a possibility that the authentication information will be leaked to the outside.
[0005]
Therefore, an object of the present invention is to provide an authentication system and an authentication program that can improve security when handling user authentication information.
[0006]
[Means for Solving the Problems]
The authentication system of the present invention acquires device identification information for identifying the device from the device used by the user, and the acquired device identification information is specified in advance together with the reader identification information for identifying itself. A reading device that transmits to the transmission destination, a receiving unit that receives the transmitted device specifying information and the reading device specifying information, and selects user specifying information for specifying a user based on the received device specifying information User information selecting means, group information selecting means for specifying group specifying information for specifying a group to which the reading device belongs based on the received reading device specifying information, and user specifying information and group specified by the user information specifying means The group specifying information specified by the information specifying unit is transmitted to the destination corresponding to the group specifying information. A specific information transmitting unit that specifies an authentication method of the user based on the transmitted user specifying information, authenticates the user based on the specified authentication method, and outputs a result of the authentication in advance to a specified output. And information processing means for outputting the information to the destination.
[0007]
According to the authentication system of the present invention, since the reading device transmits the device specifying information and the reading device specifying information, it is possible to notify which reading device has accessed which device. Since the user identification information is selected based on the transmitted device identification information, a user corresponding to the device can be selected. Since the group specifying information is selected based on the transmitted reading device specifying information, the group set for each reading device can be specified. Since the selected user identification information is transmitted to the transmission destination predetermined for each group, the user identification information can be transmitted to the transmission destination corresponding to the reading device accessed by the user. Since the authentication method is specified based on the transmitted user specifying information, and the user is authenticated by the specified authentication method, the user can be authenticated by the authentication method defined for each user and each group.
[0008]
An authentication program according to the present invention is a computer-readable storage medium that transmits, from a reading device, device identification information for identifying a device used by a user, and reading device identification information for identifying a reading device that acquires the device identification information. Receiving means for receiving user information, user information selecting means for selecting user specifying information for specifying a user based on the received device specifying information, and a group to which the reading device belongs based on the received reading device specifying information. Group information selecting means for selecting group specifying information for specifying the user, and transmitting the user specifying information specified by the user information specifying means and the group specifying information specified by the group information specifying means to a destination corresponding to the group specifying information. Function as a specific information transmitting means for transmitting the information.
[0009]
When the authentication program of the present invention is executed using a computer, the user identification information is selected based on the device identification information transmitted from the reading device, so that the user corresponding to the device can be selected. Similarly, since the group specifying information is selected based on the transmitted reading device specifying information, the group set for each reading device can be specified. Since the selected user identification information is transmitted to the transmission destination predetermined for each group, the user identification information can be transmitted to the information processing device corresponding to the reading device accessed by the user. Information that can authenticate a user by an authentication method defined for each user and each group can be provided.
[0010]
BEST MODE FOR CARRYING OUT THE INVENTION
The findings of the present invention can be readily understood by considering the following detailed description with reference to the accompanying drawings shown by way of example only. Subsequently, embodiments of the present invention will be described with reference to the accompanying drawings. When possible, the same parts are denoted by the same reference numerals, and redundant description will be omitted.
[0011]
FIG. 1 is a configuration diagram of an authentication system 1a according to an embodiment of the present invention. The authentication system 1a according to the present embodiment includes a reading device 10, a platform 20, group systems 30 to 32 (information processing means), and application systems 40 to 41. The reading device 10 and the platform 20, the platform 20 and the group systems 30 to 32, and the group system 30 and the application systems 40 to 41 are configured to be able to communicate with each other via a network. The device 50 is an information communication terminal used by a user. The user transfers a device ID (device specifying information) for specifying the device from the device 50 to the reading device 10 installed at the place where the service is to be received.
[0012]
The reading device 10 is a device installed for each service provider. In the present embodiment, one reading device is illustrated. However, a plurality of reading devices 10 are installed for each service provider and further for each service providing place. May be. A unique reader ID (reader identification information) is assigned to the reader 10, and the reader ID is stored in the reader 10. The reading device 10 transmits the device ID passed and obtained from the device 50 together with the reading device ID to the flat form 20, which is the transmission destination.
[0013]
Subsequently, the platform 20 will be described. The platform 20 is physically a computer system (or an aggregate of computer systems) including a CPU (central processing unit), a memory, an input device such as a mouse and a keyboard, a display device such as a display, and a storage device such as a hard disk. ).
[0014]
The platform 20 includes, as functional components, a receiving unit 101 (receiving unit), a user information selecting unit 102 (user information selecting unit), a group information selecting unit 103 (group information selecting unit), and a specific information transmitting unit 104. (Specific information transmitting means), a user information storage unit 110, and a group information storage unit 111. Subsequently, each component of the platform 20 will be described in detail.
[0015]
The receiving unit 101 is a unit that receives a device ID and a reading device ID transmitted from the reading device 10. The receiving unit 101 outputs the received device ID to the user information selecting unit 102 and the received reading device ID to the group information selecting unit 102.
[0016]
The user information selecting unit 102 is a unit that selects a user ID (user specifying information) for specifying the user of the device 10 based on the device ID output from the receiving unit 101. More specifically, a corresponding user ID is selected from the information stored in the user information storage unit 110 based on the device ID. FIG. 2 shows an example of information stored in the user information storage unit 110. According to the example shown in FIG. 2, the user information storage unit 110 stores “user ID” and device IDs such as “device A” and “device B” in association with each other. Therefore, if the device ID of the device 50 output from the receiving unit 101 is “D010365”, “P0001” is selected as the user ID. The user information selection unit 102 outputs the selected user ID to the specific information transmission unit 104.
[0017]
The group information selecting unit 103 is a unit that selects a group ID (group specifying information) for specifying a group to which the reading device 10 belongs based on the reading device ID output from the receiving unit 101. More specifically, a corresponding group ID is selected from the information stored in the group information storage unit 111 based on the reading device ID. FIGS. 3A and 3B show examples of information stored in the group information storage unit 111. FIG. According to the example illustrated in FIG. 3A, the “group ID” and the “reader ID” are stored in the group information storage unit 111 in association with each other. Accordingly, if the reading device ID of the reading device 10 output from the receiving unit 101 is “A661234”, “G760234” is selected as the group ID. According to the example shown in FIG. 3B, the “group ID” and the “IP address” are further stored in the group information storage unit 111 in association with each other. Therefore, when "G760234" is selected as the group ID, "XXX.XXX.XXX.XXX" is selected as the IP address of the group system that is the corresponding information processing apparatus of the transmission destination. The group information selection unit 103 outputs the selected group ID and IP address to the specific information transmission unit 104.
[0018]
The specific information transmitting unit 104 associates the user ID output from the user information selecting unit 102 with the group ID output from the group information selecting unit 103, and is specified by the IP address output from the group information selecting unit 103. The information is transmitted to the group system as the information processing device. More specifically, if the user ID is “P0001”, the group ID is “G760234”, and the IP address is “XXX.XXX.X.XXX”, the user ID is specified by the IP address “XXX.XXX.X.XXX”. The user ID “P0001” is transmitted to the group system 30.
[0019]
Subsequently, the group systems 30 to 32 will be described. The group systems 30 to 32 are computer systems managed by each group. Taking the group system 30 as an example, when a user ID “P0001” is transmitted from the platform 20, an authentication method corresponding to the user is specified based on the user ID “P0001”, and based on the specified authentication method. Then, the user is authenticated, and the result of the authentication is output to a predetermined output destination. For example, information such as “user ID”, “password”, and “attribute” is stored for each user, and authentication is performed using only “user ID” and “password” in a service requested by the user with user ID “P0001”. If so, the user is authenticated by the authentication method. The group systems 30 to 32 transmit the user authentication result to the application system corresponding to the service desired by the user. Taking the group system 30 as an example, the authentication result is transmitted to the application system 40 or the application system 41.
[0020]
The application systems 40 to 41 are parts that provide a predetermined service to the user based on the user authentication result transmitted from the group system 30.
[0021]
An authentication program according to an embodiment of the present invention and a computer-readable recording medium on which the authentication program is recorded (hereinafter, simply referred to as a recording medium) will be described. Here, the recording medium causes a change state of energy such as magnetism, light, electricity, or the like to occur in a reading device provided in a hardware resource of a computer in accordance with a description content of a program, and the recording medium corresponds to the change state. It is capable of transmitting the description content of the program to the reading device in the form of a signal. Examples of such a recording medium include a magnetic disk, an optical disk, a CD-ROM, and a memory built in a computer.
[0022]
FIG. 4 is a configuration diagram of a recording medium according to the embodiment of the present invention. The recording medium 9 has a program area 91 for recording a program, as shown in FIG. In this program area 91, an authentication program 92 is recorded. The authentication program 92 includes a main module 921 that supervises processing, a receiving module 922, a user information selecting module 923, a group information selecting module 924, and a specific information transmitting module 925. Here, the functions realized by operating each of the receiving module 922, the user information selecting module 923, the group information selecting module 924, and the specific information transmitting module 925 are the receiving unit 101, the user information selecting unit 102, The functions are the same as those of the group information selection unit 103 and the specific information transmission unit 104. In this case, each of the user information storage unit 110 and the group information storage unit 111 of the platform 20 may be stored in the data area 93 of the recording medium 9 as the user information database 931 and the group information database 932. May be stored in another recording medium.
[0023]
In the present embodiment, since the reading device 10 transmits the device ID and the reading device ID to the platform 20, it is possible to notify the platform 20 which device has accessed which reading device. Since the user ID is selected based on the transmitted device ID, a user corresponding to the device can be selected. Since the group ID is selected based on the transmitted reader ID, the group set for each reader can be specified. Since the selected user ID is transmitted to the group systems 30 to 32 predetermined for each group, the user ID can be transmitted to the group system 30 corresponding to the reading device 10 accessed by the user. Since the authentication method is specified based on the transmitted user ID and the user is authenticated by the specified authentication method, the user can be authenticated by the authentication method defined for each user and each group.
[0024]
For example, if the minimum personal information required to use each of the application systems 40 to 41 is transmitted to the group system 30, subsequent authentication is performed, thereby preventing information leakage by disclosing unnecessary personal information. As a result, the security of the authentication system 1a is improved.
[0025]
As described above, since the user ID is transmitted to the group system 30 corresponding to the reading device 10 accessed by the user, the user does not need to have a separate user ID corresponding to each of the group systems 30 to 32. Application systems (application systems 40 to 41 in the case of the group system 30) corresponding to each of.
[0026]
【The invention's effect】
According to the authentication system of the present invention, since the reading device transmits the device specifying information and the reading device specifying information, it is possible to notify which reading device has accessed which device. Since the user identification information is selected based on the transmitted device identification information, a user corresponding to the device can be selected. Since the group specifying information is selected based on the transmitted reading device specifying information, the group set for each reading device can be specified. Since the selected user identification information is transmitted to the transmission destination predetermined for each group, the user identification information can be transmitted to the transmission destination corresponding to the reading device accessed by the user. Since the authentication method is specified based on the transmitted user specifying information and the user is authenticated by the specified authentication method, the user can be authenticated by the authentication method defined for each user and each group. Therefore, the process of authenticating the user is performed for each group. Therefore, it was possible to provide an authentication system and an authentication program which can improve security when handling user authentication information, which is an object of the present invention.
[Brief description of the drawings]
FIG. 1 is a configuration diagram of an authentication system according to an embodiment of the present invention.
FIG. 2 is a configuration diagram of data stored in a user information storage unit of FIG. 1;
FIG. 3 is a configuration diagram of data stored in a group information storage unit of FIG. 1;
FIG. 4 is a configuration diagram of an authentication program according to an embodiment of the present invention.
[Explanation of symbols]
1a: authentication system, 10: reading device, 20: platform, 30-32: group system, 40-41: application system, 50: device, 101: receiving unit, 102: user information selecting unit, 103: group information selecting unit , 104: a specific information transmitting unit; 110: a user information storage unit; 111: a group information storage unit.

Claims (2)

A reading device that obtains device specifying information for specifying the device from a device used by a user, and transmits the obtained device specifying information to a pre-designated destination together with reading device specifying information for specifying itself. When,
Receiving means for receiving the transmitted device specifying information and reading device specifying information,
User information selection means for selecting user identification information for identifying the user based on the received device identification information,
Group information selecting means for selecting group specifying information for specifying a group to which the reading device belongs based on the received reading device specifying information,
Specific information transmitting means for transmitting the user specifying information specified by the user information specifying means and the group specifying information specified by the group information specifying means to a destination corresponding to the group specifying information,
Information for identifying the authentication method of the user based on the transmitted user identification information, authenticating the user based on the identified authentication method, and outputting a result of the authentication to a pre-designated output destination Processing means;
An authentication system comprising: Computer
A receiving unit that receives, from the reading device, device specifying information for specifying a device used by a user and reading device specifying information for specifying a reading device that acquires the device specifying information,
User information selection means for selecting user identification information for identifying the user based on the received device identification information,
Group information selecting means for selecting group specifying information for specifying a group to which the reading device belongs based on the received reading device specifying information,
Specific information transmitting means for transmitting the user specifying information specified by the user information specifying means and the group specifying information specified by the group information specifying means to a destination corresponding to the group specifying information,
An authentication program to function as

Images