JP2005309890A - Authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a simple system for operating user authentication by using the location information of a portable terminal. <P>SOLUTION: When a user performs access to a security document server 10 by using a client PC20, the client PC 20 acquires the location information from a portable terminal 30, and transfers the acquired location information to the security document server 10. The security document server 10 is preliminarily registered with an area(service use range) in which access to the security document should be permitted. Then, the security document server 10 confirms whether or not the location information of the portable terminal 30 transferred from the client PC 20 is within a preliminarily registered service use range, and when it is within the service use range, the client PC 20 is authorized to perform access to the security document. On the other hand, when the location information of the portable terminal 30 is beyond the service use, the client PC 20 is inhibited from performing access to the security document. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an authentication system, and more particularly to an authentication system using position information.

  There is known a system for sharing information among limited users while strictly protecting confidential documents in a company. In such a system, it is necessary to appropriately perform user authentication in order to control browsing authority and usage authority (printing, copying, etc.) of digital content such as an electronic document based on user authentication.

  As a highly secure user authentication method, for example, a system described in Patent Document 1 can be cited. This system compares the current location information of the user provided from the base station serving the current location information of the mobile phone with the location information of the client machine that requests the online information service. It is a system in which the service providing server authenticates the user by identifying the person himself / herself. A global positioning system (global positioning system: GPS) is used for detecting position information. That is, the data acquired from the GPS satellite by the mobile phone is transmitted to the base station as it is, and the base station determines the location of the mobile phone based on the data. Incidentally, positioning is performed using radio waves from a base station indoors where radio waves from GPS do not reach. Even when radio waves from a base station are used, the accuracy of position information is on the order of 5 to 10 m, which is equivalent to that of normal GPS.

JP 2002-101091 A

  However, in the user authentication method described in Patent Document 1, it is assumed that the user is carrying a mobile phone, and if the mobile phone is left somewhere or intentionally placed in another location, Detection is different from the person's position. If authentication simply fails, problems such as information leakage will not occur, but the risk of misuse cannot be denied. As an advanced version of the system of Patent Document 1, if a client machine is provided with a function capable of dynamically detecting position information like a mobile phone, authentication from an arbitrary position is possible. However, when the position information is detected by the management center that manages the position information and the detected position information is provided to the service providing server, the application system including the service providing server and the position detecting system need to be closely connected. Yes, complicating the system. It is also redundant to install a position detection function on every client machine.

  The present invention has been made in view of the above problems, and an object of the present invention is to provide a simple system that performs user authentication using position information of a mobile terminal.

  In order to achieve the above object, an authentication system according to a preferred aspect of the present invention includes a mobile terminal that provides its own location information, a client terminal to which the mobile terminal is connected, and a confidential document service provided to the client terminal. The client terminal transfers the location information acquired from the portable terminal to the service providing device, and the service providing device uses the location information transferred to the client terminal. It is characterized by confirming the position and authenticating a user who uses the client terminal. Preferably, the portable terminal acquires the position information using a global positioning system (global positioning system: GPS).

  In order to achieve the above object, a client terminal according to a preferred aspect of the present invention is connected to a mobile terminal that provides its own location information, and receives a confidential document service from a service providing apparatus. Time information including the position information and the time when the position is measured is acquired from the portable terminal. Preferably, the personal information of the user of the client terminal corresponding to the mobile terminal is acquired from the mobile terminal, and the position information, the time information, and the personal information acquired from the mobile terminal are transferred to the service providing apparatus. It is characterized by that. Preferably, the mobile terminal is connected by a dedicated short-distance line.

  In order to achieve the above object, a service providing apparatus according to a preferred aspect of the present invention provides a confidential document service to a client terminal connected to a mobile terminal that provides its own location information. The user's direct operation on the portable terminal when transmitting the location information to the client terminal and the user's direct operation on the client terminal when transferring the location information to the service providing apparatus are executed within a predetermined period. On the basis of whether or not it has been done, the location of the client terminal is confirmed, and the user who uses the client terminal is authenticated. Preferably, the direct operation is performed by identity verification using biometrics. Preferably, a terminal identifier of a client terminal connected to the portable terminal is attached to the position information by the portable terminal, and a terminal identifier of a client terminal that is to log in to a service providing apparatus and the position information are attached to the position information. It is characterized in that the access by the client terminal is permitted only when the terminal identifiers are compared and matched. Preferably, standard time information is managed, and based on the expiration date information attached to the location information, it is determined whether the location information is within the expiration date, and access by the client terminal is restricted. And

  In order to achieve the above object, an authentication information acquisition method according to a preferred aspect of the present invention is connected to a mobile terminal that provides its own location information and receives a confidential document service from a service providing apparatus. In the authentication information acquisition method executed by, time information including the position information and the time when the position is measured is acquired as the authentication information from the portable terminal. This authentication information acquisition method is realized, for example, by operating a computer with a program adapted to this method.

  In order to achieve the above object, an authentication method according to a preferred aspect of the present invention is executed by a service providing apparatus that provides a confidential document service to a client terminal connected to a mobile terminal that provides its own location information. In the authentication method, authentication of a user who uses a client terminal connected to the mobile terminal is performed from position information provided by the mobile terminal and time information including a time when the position is measured. This authentication method is realized, for example, by operating a computer with a program adapted to this method.

  According to the present invention, a simple system for performing user authentication using position information of a mobile terminal is provided.

  DESCRIPTION OF EXEMPLARY EMBODIMENTS Hereinafter, preferred embodiments of the invention will be described with reference to the drawings.

  FIG. 1 shows a preferred embodiment of an authentication system according to the present invention, and FIG. 1 is an overall configuration diagram thereof.

  In this system, a user accesses a confidential document server 10 via the Internet 50 using a client PC 20 and uses a confidential document (digital content such as an electronic document) in the confidential document server 10.

  A confidential document is a document shared among limited users in a company, for example. For this reason, the confidential document server 10 performs user authentication and controls the authority to browse and use the confidential document (authority for printing, copying, etc.). The portable terminal 30 is used for this user authentication.

  The portable terminal 30 provides the client PC 20 with its own position (position information) obtained by using the global positioning system (global positioning system: GPS). That is, the mobile terminal 30 transmits data acquired from the GPS satellite 42 to the base station 44, and the location information server 40 that acquired the data from the base station 44 or the base station 44 uses the data of the mobile terminal 30 based on the data. Confirm the position. Then, the determined position (position information) is provided to the mobile terminal 30 and transmitted to the client PC 20.

  Incidentally, when the mobile terminal 30 exists indoors where radio waves from the GPS satellites 42 do not reach, positioning is performed using radio waves from the base station 44. Even when the radio waves of the base station 44 are used, the accuracy of the position information is on the level of 5 m to 10 m, which is equivalent to the case where the normal GPS satellite 42 is used. Further, the mobile terminal 30 itself may determine the position based on the data acquired from the GPS satellite 42 and generate position information. In this case, the base station 44 and the location information server 40 become unnecessary. Hereinafter, the operation of the authentication system of FIG. 1 will be described.

  When the user accesses the confidential document server 10 using the client PC 20, the client PC 20 acquires the position information from the mobile terminal 30 and transfers the acquired position information to the confidential document server 10. In the confidential document server 10, an area (service usage range) where access to the confidential document should be permitted is registered in advance. For example, a service usage range is set in an office of a certain company. Then, the confidential document server 10 checks whether or not the location information of the mobile terminal 30 transferred from the client PC 20 is within the service usage range registered in advance. Allow access to On the other hand, if it is outside the service usage range, access to the confidential document by the client PC 20 is prohibited. As described above, the position information is used to determine the service use permission.

  Time information may be used in addition to location information when determining the service use permission. In this case, when the mobile terminal 30 manages accurate standard time information using an NTP (Network Time Protocol), a radio clock function, or the like, and transmits the position information to the client PC 20, the portable terminal 30 relates to the time at which the position information was acquired. The time information is transmitted to the client PC 20. Then, the position information and the time information are transferred to the confidential document server 10, and the confidential document server 10 confirms whether or not the service usage range and the usage period are registered in advance, and is within the service usage range, If it is within the usage period, the client PC 20 permits access to the confidential document. As the usage period, for example, the working hours of a company are set.

  Personal information (including a personal ID) of a user who uses the client PC 20 may be registered in the mobile terminal 30. And the portable terminal 30 transmits the personal information to the client PC 20 when transmitting the position information and the time information to the client PC 20. In the following description, position information, time information, and personal information are referred to as ticket information. When transmitting ticket information, it is desirable to add digest information for preventing forgery. A digital certificate having a private key or a public key based on a public key board is suitable as the personal ID, and a digital signature using a digital certificate is suitable as the digest information. The confidential document server 10 can identify the user from the personal information transferred from the client PC 20 and can use it for determining the service use permission. For example, service use is prohibited for users who are not permitted to register in advance.

  In this system, in order to confirm the position of the client PC 20 from the position information of the mobile terminal 30, it is desirable that the mobile terminal 30 and the client PC 20 are connected as close as possible (for example, within a few meters). Therefore, the portable terminal 30 and the client PC 20 are directly connected by a connector, connected by a dedicated cable with a short distance, or connected by short-range wireless communication, and ticket information is transmitted from the portable terminal 30 to the client PC 20. The An example of the connector is USB. The dedicated cable has a length of several tens of centimeters, for example. As short-range wireless communication, applications such as infrared communication (using IrDA standards), non-contact IC cards, wireless tags, and the like are conceivable.

  In order to ensure that the mobile terminal 30 and the client PC 20 are connected at a short distance, the ticket information is transmitted from the mobile terminal 30 to the client PC 20 only when the user directly operates the user interface of the mobile terminal 30. May be. Further, the access start (login) from the client PC 20 to the confidential document server 10 may be limited to a case where the user directly operates the user interface of the client PC 20. Further, when the two direct operations of the mobile terminal 30 and the direct operation of the client PC 20 by the user are performed within a predetermined period that can be regarded as almost simultaneous, the confidential document server 10 permits the use of the service. May be. By performing two direct operations almost simultaneously, it can be confirmed that the mobile terminal 30 and the client PC 20 are connected at a short distance.

  For confirmation of the user's direct operation on the portable terminal 30 or the client PC 20, personal authentication utilizing biometrics is preferable. Biometrics uses personal information that is unique to an individual for authentication. For example, it uses physical features such as fingerprints, palm prints, voice prints, and retina patterns, and information such as wrinkles in handwriting and key types. Authenticate. The mobile terminal 30 and the client PC 20 are, for example, a direct operation by a registered user by comparing and verifying the fingerprint information of a user registered in advance and the fingerprint of an operator who has operated a user interface (for example, a button). Confirm.

  Further, before the client PC 20 acquires the ticket information from the mobile terminal 30, the terminal ID information unique to the client PC 20 may be input to the mobile terminal 30 and the terminal ID information may be added to the ticket information. Then, the confidential document server 10 compares the terminal ID information of the client PC 20 attempting to log in to the service and the terminal ID information in the ticket information, and permits access to the confidential document only if they match. . In this way, it is possible to identify the client PC 20 that has received the ticket information from the portable terminal 30 and prevent login from a device other than the client PC 20 that has received the ticket information from the portable terminal 30 in a regular manner. If the ticket information is illegally transferred from the legitimate client PC 20 to another device, the login fails even if the location is forged.

  As described above, in this embodiment, when the client PC 20 logs in, the ticket information is transferred to the confidential document server 10, and the confidential document server 10 detects the user, time, and position from the ticket information, and uses the service. Limit. By verifying the digital signature, the confidential document server 10 can identify the user and guarantee that the time, location, and terminal ID are certain. A plurality of places (regions) that can be browsed for each user are set, and if a login is made from the set place, browsing of the confidential document is permitted, and if the place is not set, the confidential document cannot be browsed. It becomes possible to do. Further, since the confidential document server 10 can receive ticket information from the client PC 20 and know the accurate location information of the user, it can determine permission to use the service by location. For example, the user can restrict the places where confidential documents can be viewed. In other words, it is possible to define a confidential document that can be viewed only at the office or office designated as home. Even if a person who has permission to view confidential documents tries to view the confidential documents in a place other than the designated area, for example, in a train or a coffee shop, they cannot browse.

  Further, the confidential document server 10 also manages accurate standard time information, the expiration date is set in the ticket information, and the acquisition time of the position information described in the ticket information reaching the confidential document server 10 has expired. In this case, the processing may be invalidated or the client PC 20 may be requested to transfer new ticket information again. For example, if the expiration date is set to 60 seconds and the session between the client PC 20 and the confidential document server 10 continues for 60 seconds or more, the confidential document server 10 causes the client PC 20 to resubmit ticket information. If the ticket information expires at login, login fails. In this way, by checking the expiration date of the ticket information and not handling the expired ticket information, the current position of the user can be more accurately guaranteed. Even if the ticket information is cached and reused, forged access can be prevented if the expiration date is set appropriately.

  The confidential document server 10 providing the service is basically independent of the position information management system including the position information server 40, the GPS satellite 42, and the base station 44, and receives the data directly from the position information management system. Since it is not necessary to have a close connection with the detection function, the authentication system is not complicated and the cost is not increased. For example, the location information management system can use an existing infrastructure, and the location information management system can be easily used depending on the application.

  As mentioned above, although preferred embodiment of this invention was described, embodiment mentioned above is only a mere illustration in all the points, and does not limit the scope of the present invention.

1 is an overall configuration diagram of an authentication system according to the present invention.

Explanation of symbols

  10 confidential document server, 20 client PC, 30 portable terminal.

Claims (11)

A mobile device that provides its location,
A client terminal to which the portable terminal is connected;
A service providing apparatus for providing a confidential document service to the client terminal;
Have
The client terminal transfers the location information acquired from the mobile terminal to the service providing device,
The service providing apparatus confirms the position of the client terminal from the transferred position information and authenticates a user who uses the client terminal.
An authentication system characterized by that. The authentication system according to claim 1,
The portable terminal acquires the position information using a global positioning system (global positioning system: GPS).
An authentication system characterized by that. In a client terminal connected to a portable terminal that provides its own location information and receiving a confidential document service from a service providing device,
Obtaining time information including the position information and the time when the position is measured from the portable terminal;
A client terminal characterized by that. The client terminal according to claim 3, wherein
Acquiring personal information of a user of a client terminal corresponding to the mobile terminal from the mobile terminal, and transferring the location information, the time information, and the personal information acquired from the mobile terminal to the service providing device;
A client terminal characterized by that. The client terminal according to claim 4,
Connected to the mobile terminal by a dedicated short-distance line,
A client terminal characterized by that. In a service providing apparatus that provides a confidential document service to a client terminal connected to a mobile terminal that provides its own location information,
The user's direct operation on the portable terminal when transmitting the location information to the client terminal and the user's direct operation on the client terminal when transferring the location information to the service providing apparatus are executed within a predetermined period. Based on whether or not the client terminal is confirmed by checking the position of the client terminal,
A service providing apparatus characterized by that. The service providing apparatus according to claim 6,
The direct operation is performed by identity verification using biometrics.
A service providing apparatus characterized by that. The service providing apparatus according to claim 6,
The location information is attached by the mobile terminal with a terminal identifier of a client terminal connected to the mobile terminal,
Compare the terminal identifier of the client terminal to log in to the service providing device and the terminal identifier attached to the location information, and permit access by the client terminal only if they match.
A service providing apparatus characterized by that. The service providing apparatus according to claim 6,
Managing standard time information, based on the expiration date information attached to the location information, determining whether the location information is within the expiration date, and restricting access by the client terminal;
A service providing apparatus characterized by that. In an authentication information acquisition method executed by a client terminal connected to a portable terminal that provides its own location information and receiving a confidential document service from a service providing device
As the authentication information, the time information including the time when the position information and the position are measured is acquired from the portable terminal.
An authentication information acquisition method characterized by that. In an authentication method executed by a service providing apparatus that provides a confidential document service to a client terminal connected to a mobile terminal that provides its own location information,
From the position information provided by the mobile terminal and time information including the time when the position is measured, authentication of a user who uses the client terminal connected to the mobile terminal is performed.
An authentication method characterized by that.

Images