JP2005346630A - Authentication system, authentication method, authentication program, or the like - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a commodity image selection device which is high in convenience and can select appropriate commodity image for inserting it in the advertisement, etc. <P>SOLUTION: An authentication system S comprises an authentication device 100 which performs user authentication via a network X and a terminal device 201 which can access to the authentication device 100. The terminal device 201 has a means to acquire identification information memorized in a storage medium of 1 and a first electronic certificate for accessing a server system and transmit the acquired identification information concerned to the authentication device 100; a means to receive storage information on the first electronic certificate; and a means to store the acquired first electronic certificate in a memory means in a state accessible to the server system using the received storage information and the acquired identification information. The authentication device 100 has a means to receive the identification information transmitted from the terminal device 201; and a means to acquire storage information corresponding to the identification information and transmit it to the terminal device 201. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an authentication system including an authentication device and a terminal device, and in particular, when an access request to the server device is made from the user terminal device to the authentication device via the network, The present invention relates to an authentication system or the like for authenticating whether or not an access request is legitimate access.

  Conventionally, when a user accesses a system server or the like connected via a network from a terminal device, the user is authenticated with a digital certificate that is difficult to tamper in advance installed in the terminal device as a security measure. There was a method to input information.

  For example, the authentication information is stored in a storage medium in which an electronic certificate cannot be illegally extracted, the medium is distributed to each user, and the storage medium distributed by each user manages the authentication information. Methods for preventing spills are also known.

In addition, Patent Document 1 below discloses various improved techniques for the basic authentication method described above.
JP 2002-229952 A

  However, when each user manages the storage medium storing the authentication information as described above, there is a problem that the authentication information leaks due to the occurrence of a storage medium loss accident.

  Furthermore, if the storage medium is under the control of each user, a situation may arise in which an electronic certificate can be installed on a plurality of devices. There has been a problem that the authentication device cannot grasp the situation that it is being performed.

  Therefore, the present invention has been made in view of the above problems, and an object thereof is to provide an authentication system that is convenient for the user and has high security.

  (1) In one aspect of the present invention for solving the above problem, an authentication system comprising: an authentication device that performs user authentication via a network; and a terminal device that is accessible to the authentication device via the network. The terminal device acquires the identification information stored in the one storage medium and the first electronic certificate for accessing the server device, and uses the acquired identification information to the authentication device via the network. Identification information transmitting means for transmitting to the storage information receiving means for receiving the storage information of the first electronic certificate via the network, and the received storage information for the acquired first electronic certificate. A first storage unit that stores the acquired identification information in a storage unit in a state where the server device can be accessed. Identification information receiving means for receiving the identification information transmitted from the apparatus via the network, and storage information transmission means for acquiring the storage information corresponding to the identification information and transmitting it to the terminal apparatus via the network It is characterized by having.

  According to this, a first electronic certificate (hereinafter simply referred to as an electronic certificate) is stored in a storage medium such as a USB memory, the USB memory is distributed to users, and the electronic certificate is transferred to a server. By configuring to store (install) in a storage means such as a storage unit in a state where the device is accessible, after installing the electronic certificate, the USB printer is installed in the printing company in which the authentication device is installed, or the printing company It can be collected and managed and stored at a network management company that has partnered with, and can be managed safely by preventing accidents such as loss on the user side.

  In addition, when installing an electronic certificate, if both the identification number unique to the memory stored in the USB memory and the storage information such as installation information transmitted from the authentication device are not available, the electronic certificate is installed in the storage unit. Since it is configured so that it cannot be performed, it is possible to provide an authentication system with high security.

  (2) In another aspect of the present invention for solving the above problem, in the authentication system, the first electronic certificate is an encrypted first encrypted electronic certificate, and The first storage means decrypts the first encrypted electronic certificate using the stored information and the identification information, and stores the first encrypted electronic certificate in the storage means.

  According to this, by storing the encrypted electronic certificate in a storage medium such as a USB memory, for example, even when the USB memory is lost when distributing it to the user, the electronic certificate It becomes possible to prevent falsification of the document and to prevent unauthorized access to the server device.

  (3) In another aspect of the present invention for solving the above problem, in the authentication system, the first storage means stores the one storage medium when storing the electronic certificate in the storage means. And deleting the first electronic certificate stored in.

  According to this, since the first electronic certificate stored in the storage medium such as the USB memory is deleted when the first electronic certificate is installed in the storage unit, the USB memory is installed after the installation. Even if it is illegally taken out, unauthorized access can be prevented.

  (4) In another aspect of the present invention for solving the above problem, in the authentication system, the terminal device receives a deletion request reception for receiving a deletion request for the first electronic certificate stored in the storage unit. And when the delete request is received, the first electronic certificate stored in the storage unit is deleted, and the delete instruction information is stored together with the identification number stored in the one storage medium. Delete instruction information transmitting means for transmitting to the electronic certificate receiving means for receiving the second electronic certificate corresponding to the identification information transmitted from the authentication device via the network; And a second storage means for storing the electronic certificate in the one storage medium, wherein the authentication device receives the deletion instruction information and the identification number transmitted from the terminal device. When receiving the deletion instruction information receiving means for receiving via the network, the deletion instruction information and the identification number, the second electronic certificate corresponding to the received identification information is obtained and transmitted via the network Electronic certificate transmitting means for transmitting to the terminal device.

  According to this, it is possible to delete the first electronic certificate installed in the storage unit of the terminal device.

  (5) In another aspect of the present invention for solving the above problem, in the authentication system, the second electronic certificate is an encrypted second encrypted electronic certificate. To do.

  According to this, when the second electronic certificate is transmitted to the terminal device via the network, it is transmitted in an encrypted state, so that it is possible to transmit / receive the electronic certificate in a more secure state. become.

  (6) In another aspect of the present invention for solving the above problem, in the authentication system, the second electronic certificate is the same as the first electronic certificate, and the second cipher The encrypted electronic certificate is the same as the first encrypted electronic certificate.

  According to this, since the encrypted electronic certificate is stored in a storage medium such as a USB memory during uninstallation, the USB memory is returned to the same state as before the electronic certificate was installed in the terminal device. It becomes possible. Therefore, when the USB memory is collected by a printing company or the like where the authentication device is installed, the same is applied when installing an electronic certificate for other users and giving access authority to the server device. The USB memory can be used as it is, and convenience in management is improved.

  (7) In one aspect of the present invention for solving the above problem, in a terminal device accessible to an authentication device that performs user authentication via a network, the identification information stored in one storage medium and the server device An identification information transmitting means for acquiring a first electronic certificate for access and transmitting the acquired identification information to the authentication device via the network; and the first electronic certificate corresponding to the identification information Storage information receiving means for receiving storage information of a certificate via the network, and the server for storing the acquired first electronic certificate in the storage means using the received storage information and the acquired identification information. And first storage means for storing the apparatus in an accessible state.

  According to this, a first electronic certificate (hereinafter simply referred to as an electronic certificate) is stored in a storage medium such as a USB memory, the USB memory is distributed to users, and the electronic certificate is transferred to a server. By configuring to store (install) in a storage means such as a storage unit in a state where the device is accessible, after installing the electronic certificate, the USB printer is installed in the printing company in which the authentication device is installed, or the printing company It can be collected and managed and stored at a network management company that has partnered with, and can be managed safely by preventing accidents such as loss on the user side.

  In addition, when installing an electronic certificate, if both the identification number unique to the memory stored in the USB memory and the storage information such as installation information transmitted from the authentication device are not available, the electronic certificate is installed in the storage unit. Since it is configured so that it cannot be performed, it is possible to provide an authentication system with high security.

  (8) In one aspect of the present invention for solving the above-described problem, in an authentication device that performs user authentication for a terminal device via a network, the identification information transmitted from the terminal device is transmitted via the network. A storage information for storing identification information receiving means for receiving and a first electronic certificate for accessing the server device, wherein the storage information corresponding to the identification information is obtained via the network Storage information transmitting means for transmitting to the terminal device.

  According to this, when an electronic certificate is installed in a terminal device, it cannot be installed in the terminal device without using storage information corresponding to a memory-specific identification number stored in a storage medium such as a USB memory. With this configuration, it is possible to provide an authentication program with high security.

  (9) According to one aspect of the present invention for solving the above-described problem, a computer that can access an authentication device that performs user authentication via a network is accessed with the identification information stored in one storage medium and the server device. An identification information transmitting means for acquiring the first electronic certificate to be transmitted, and transmitting the acquired identification information to the authentication device via the network; the first electronic certificate corresponding to the identification information; Storage information receiving means for receiving storage information via the network, and the acquired first electronic certificate to the server device in the storage means using the received storage information and the acquired identification information It is characterized by functioning as a first storing means for storing in an accessible state.

  According to this, a first electronic certificate (hereinafter simply referred to as an electronic certificate) is stored in a storage medium such as a USB memory, the USB memory is distributed to users, and the electronic certificate is transferred to a server. By configuring to store (install) in a storage means such as a storage unit in a state where the device is accessible, after installing the electronic certificate, the USB printer is installed in the printing company in which the authentication device is installed, or the printing company It can be collected and managed and stored at a network management company that has partnered with, and can be managed safely by preventing accidents such as loss on the user side.

  In addition, when installing an electronic certificate, if both the identification number unique to the memory stored in the USB memory and the storage information such as installation information transmitted from the authentication device are not available, the electronic certificate is installed in the storage unit. Since it is configured so that it cannot be performed, it is possible to provide an authentication program with high security.

  (10) According to one aspect of the present invention for solving the above-described problem, a first computer for accessing a server device stored in a storage unit from a computer that can access an authentication device that performs user authentication via a network. Delete request accepting means for accepting an electronic certificate delete request, and when the delete request is accepted, the first electronic certificate stored in the storage means is deleted and the delete instruction information is sent to the authentication device. A deletion instruction information transmitting means for transmitting; a second electronic certificate corresponding to the identification information stored in one storage medium; an electronic certificate receiving means for receiving via the network; and the received second The electronic certificate is made to function as second storage means for storing in the one storage medium.

  According to this, when an electronic certificate is installed in a terminal device, it cannot be installed in the terminal device without using storage information corresponding to a memory-specific identification number stored in a storage medium such as a USB memory. With this configuration, it is possible to provide an authentication program with high security.

  (11) In one aspect of the present invention for solving the above-described problem, a computer that performs user authentication for a terminal device via a network receives identification information transmitted from the terminal device via the network. Identification information receiving means for storing the first electronic certificate for accessing the server device, the storage information corresponding to the identification information being acquired and the terminal being obtained via the network Storage information transmitting means for transmitting to the device, deletion instruction information receiving means for receiving the deletion instruction information transmitted from the terminal device via the network, and receiving the deletion instruction information received by the identification information receiving means An electronic device that acquires the second electronic certificate corresponding to the identification information and transmits the second electronic certificate to the terminal device via the network It characterized in that to function as Akirasho transmission means.

  According to this, it is possible to delete the first electronic certificate installed in the storage unit of the terminal device.

  (12) In one aspect of the present invention for solving the above problem, an authentication system comprising: an authentication device that performs user authentication via a network; and a terminal device that is accessible to the authentication device via the network. In the authentication method, the terminal device acquires identification information stored in one storage medium and a first electronic certificate for accessing the server device, and the acquired identification information is transmitted via the network. An identification information transmitting step for transmitting to the authentication device, an identification information receiving step for the authentication device to receive the identification information transmitted from the terminal device, and the authentication device for the identification information. A storage information transmission step of acquiring the corresponding storage information and transmitting it to the terminal device via the network, and the terminal device, A storage information receiving step of receiving storage information of one electronic certificate via the network; and the terminal device acquires the first electronic certificate acquired by the terminal device, and the acquired identification information. And a first storage step of storing the storage device in a state where it is accessible to the server device.

  According to this, a first electronic certificate (hereinafter simply referred to as an electronic certificate) is stored in a storage medium such as a USB memory, the USB memory is distributed to users, and the electronic certificate is transferred to a server. By configuring to store (install) in a storage means such as a storage unit in a state where the device is accessible, after installing the electronic certificate, the USB printer is installed in the printing company in which the authentication device is installed, or the printing company It can be collected and managed and stored at a network management company that has partnered with, and can be managed safely by preventing accidents such as loss on the user side.

  In addition, when installing an electronic certificate, if both the identification number unique to the memory stored in the USB memory and the storage information such as installation information transmitted from the authentication device are not available, the electronic certificate is installed in the storage unit. Since it is configured not to be able to do so, it is possible to provide a highly secure authentication method.

  According to the present invention, the electronic certificate is stored in the USB memory, the USB memory is distributed to the user, and the electronic certificate is installed in the storage unit while being accessible to the server device. After installing the electronic certificate, the USB memory can be collected and managed and stored at the printing company where the authentication device is installed or the network management company affiliated with the printing company, and lost on the user side. Accidents can be prevented and managed safely.

  In addition, when installing an electronic certificate, if both the identification number unique to the memory stored in the USB memory and the storage information such as installation information transmitted from the authentication device are not available, the electronic certificate is installed in the storage unit. Since it is configured so that it cannot be performed, it is possible to provide an authentication system with high security.

  DESCRIPTION OF EXEMPLARY EMBODIMENTS Hereinafter, preferred embodiments of the invention will be described with reference to the accompanying drawings.

  First, the configuration and function of the user authentication system according to the present embodiment will be described with reference to FIGS.

  FIG. 1 is a block diagram illustrating a schematic configuration example of a user authentication system according to the present embodiment.

  As shown in FIG. 1, a user authentication system S as an authentication system includes a server device and an authentication device 100 as an authentication device of the present application, a user terminal device 201 as a terminal device, a user terminal device 202, and a user terminal device 203. It is prepared for. The authentication device 100, the user terminal device 201, the user terminal device 202, and the user terminal device 203 are connected to each other via the network X so as to be able to exchange information.

  The authentication device 100 is installed, for example, in a printing company, and the user terminal device in the user authentication system S accesses the leaflet creation system in the authentication device via the network X to access the system. It is configured to be able to use a flyer creation system such as an ordering function for a printed material provided, a function for confirming a plate layout state, and a function for confirming a printing process of an ordered printed material. The network X is composed of, for example, a LAN, a mobile communication network, the Internet, and the like.

[Authentication device]
First, the configuration and function of the authentication device 100 will be described with reference to the drawings.

  As shown in FIG. 1, the authentication device 100 includes a storage unit 11, an authentication unit 12, a communication unit 13, a memory connection unit 14, and a control unit 15, and each component is connected to each other by a bus 16. Has been.

  The storage unit 11 is composed of, for example, an HD (Hard Disc) or the like, in which a user information database 11A and an access history database 11B are constructed.

  In the user information database 11A, as shown in FIG. 2, for each USB memory Un used in the user authentication system, a memory identification number In, an encryption key En, and electronic certificates as first and second electronic certificates. Cn and installation information Rn are stored (registered) in association with each other.

  Here, the USB memory Un functions as one recording medium in the present application. When the authentication device 100 is accessed from the user terminal devices 201 to 203 and the flyer creation system of the authentication device 100 is used, the USB memory Un Stores (stores) an encrypted electronic certificate Ccn as a first encrypted electronic certificate obtained by encrypting an electronic certificate Cn as a first electronic certificate for obtaining access permission (authentication) to the flyer creation system ).

  The memory identification number In is an identification number uniquely given to each USB memory Un. The USB memory Un is connected to the memory connection unit 14 and is read out under the control of the control unit 15. 11A is stored in advance.

  Further, the electronic certificate Cn is stored (hereinafter referred to as storage) as an encrypted electronic certificate Ccn in the USB memory Un having the corresponding memory identification number In, and each user terminal device 201 is stored. To 203 (installed). When the electronic certificate Cn is stored in the USB memory Un, based on the control of the control unit 15 of the authentication apparatus 100, the corresponding memory identification number In and encryption key En are used with reference to the user information database 11A. After the encryption process is performed, the data is stored in the USB memory Un.

  That is, in the USB memory Un, the memory identification number In uniquely given to the USB memory and the encrypted electronic certificate Ccn are stored. That is, as shown in FIG. 3, the memory identification number I1 and the encrypted electronic certificate Cc1 are stored in the USB memory U1, and the memory identification number I2 and the encrypted electronic certificate Cc2 are stored in the USB memory U2. The USB memory U3 stores the memory identification number I3 and the encrypted electronic certificate Cc3.

  If the serial number of the USB memory fixedly stored in the USB memory In is used as the memory identification number In, it becomes possible to prevent unauthorized access due to impersonation of the memory identification number In.

  Further, when the uninstall processing operation is performed, when the memory identification number In is transmitted from each of the user terminal devices 201 to 203 to the authentication device 100 to request the uninstallation of the electronic certificate, the transmitted memory identification is performed. Using the encryption key En corresponding to the number In and the memory identification number In, the encrypted electronic certificate Ccn encrypted is transmitted to each of the user terminal devices 201 to 203.

  The installation information Rn is for decrypting and installing the encrypted electronic certificate Ccn together with the memory identification number In corresponding to the installation information Rn, installing it, and deleting the encrypted electronic certificate Ccn from the USB memory Un. Contains a series of control information. That is, when the memory identification number In is transmitted from the user terminal devices 201 to 203 to the authentication device 100 and a request for installation of the electronic certificate is made, the authentication unit 12 refers to the user information database 11A and performs the access. Whether or not it is legitimate is authenticated based on the transmitted memory identification number In, and when it is determined that the access is legitimate, it is transmitted with reference to the user information database 11A. Installation information Rn corresponding to the memory identification number In is transmitted to the user terminal devices 201 to 203 via the communication unit 13.

  Since this installation information Rn is for decrypting the encrypted electronic certificate Ccn, the installation information Rn usually depends on the encryption key En obtained by encrypting the encrypted electronic certificate Ccn. Will be created. For example, in the case of encryption by the private key method, the encryption key En that encrypts the encrypted electronic certificate Ccn and the installation information Rn for decrypting the encrypted encrypted electronic certificate Ccn are: In the public key method, the encryption key En and the installation information Rn are created at the same time.

  In the access history database 11B, access histories from the user terminal devices 201 to 203 to the authentication device 100 are registered (stored). The access history includes the user identification number (the user identification number transmitted to the authentication device 100 at the time of access). Hereinafter, information for specifying an access date and time, an access time, and the like based on the user ID) is included. That is, it is possible to know how many times the user has accessed by the user ID.

  For example, when the electronic certificate Cn is installed in the user terminal devices 201 to 203, the user ID is transmitted from the user terminal devices 201 to 203 to the terminal device 100 when the installation completion information Jf is transmitted. To the user terminal device is automatically given (transmitted) together with the access password to the leaflet creation system of the authentication device 100, and the user ID and the like are registered in the access history database 11B.

  By configuring as described above, it is possible to know when (or uninstalling) the electronic certificate Cn is installed in which user terminal device, and the electronic certificate Cn is installed in the user terminal devices 201 to 203 once. Thereafter, by logging in to the authentication apparatus 100 using the user ID and access password (Log-In), it becomes possible to update and register the access date and time, access time, etc. in the access history database 11B for each user. .

  The authentication unit 12 functions as storage information transmission means together with the control unit 15 and the communication unit 13, acquires the installation information Rn corresponding to the memory identification number In, and transmits it to the user terminal device via the network X. More specifically, when the memory identification number In is transmitted from the user terminal devices 201 to 203 and the request for installing the electronic certificate is stored, the user information database 11A is referred to based on the memory identification number In. Then, it is authenticated whether or not the access is valid.

  If the access is authenticated, the user information database 11A is referred to, and the installation information Rn corresponding to the transmitted memory identification number In is transmitted to the user terminal devices 201 to 203 by the communication unit. 13 to transmit. The user terminal devices 201 to 203 that have received the installation information Rn use the installation information Rn and the memory identification number In stored in the USB memory Un to encrypt the electronic certificate stored in the USB memory Un. The document Ccn is decrypted and installed in the user terminal device.

  The communication unit 13 is for exchanging information with the user terminal devices 201 to 203 via the network X.

  More specifically, the control unit 15 functions as an identification information receiving unit together with the communication unit 13 to receive the memory identification number In from the user terminal device via the network X.

  The communication unit 13 functions as a storage information transmission unit together with the control unit 15 and the authentication unit 12, acquires installation information Rn corresponding to the memory identification number In, and transmits the installation information Rn to the user terminal device via the network X. .

  Further, the communication unit 13 functions as a deletion instruction information receiving unit together with the control unit 15 and receives the uninstallation instruction information Ja and the memory identification number In from the user terminal device via the network X.

  Further, the communication unit 13 functions as an electronic certificate transmission unit together with the control unit 15 to acquire and encrypt an electronic certificate corresponding to the received memory identification number In, and then the user terminal via the network X. Send to device.

  The memory connection unit 14 is for connecting the USB memory Un. When the USB memory Un is connected to the memory connection unit 14, the control unit 15 reads the memory identification number In of the connected USB memory Un, and then corresponds to the read memory identification number In. The electronic certificate Cn is acquired from the user information database 11A, and encrypted by using the memory identification number In and the encryption key En corresponding to the user information database 11A by referring to the user information database 11A. Later, it is stored in the USB memory Un.

  The control unit 15 includes a CPU having a calculation function, a working RAM, various processing programs (including an authentication program) including a communication processing program, a ROM for storing data, an oscillation circuit, and the like. Control information for controlling the components is generated and output to the corresponding components via the bus 16. As a result, the control unit 15 controls the operation of each component constituting the authentication device 100.

  In addition, the control unit 15 executes the authentication program stored in the ROM or the like, so that each of the components is used as the identification information receiving unit, the stored information transmitting unit, the deletion instruction information receiving unit, and the electronic certificate transmitting unit of the present application. It is supposed to function.

  More specifically, the control unit 15 functions as an identification information receiving unit together with the communication unit 13 to receive the memory identification number In from the user terminal device via the network X.

  The control unit 15 functions as a storage information transmission unit together with the authentication unit 12 and the communication unit 13, acquires the installation information Rn corresponding to the memory identification number In, and transmits it to the user terminal device via the network X. .

  Further, the control unit 15 functions as a deletion instruction information receiving unit together with the communication unit 13 and receives the uninstallation instruction information Ja and the memory identification number In from the user terminal device via the network X.

  In addition, the control unit 15 functions as an electronic certificate transmission unit together with the communication unit 13, thereby obtaining an electronic certificate corresponding to the received memory identification number In and encrypting the user certificate via the network X. Send to device.

[User terminal device]
Next, the configuration and functions of the user terminal device will be described with reference to the drawings. Since the user terminal devices 201 to 203 have the same configuration, the configuration and function of the user terminal device 201 will be described in the following description.

  FIG. 4 is a block diagram illustrating a schematic configuration example of the user terminal device 201.

  As shown in FIG. 4, the user terminal device 201 includes a memory connection unit 21, a communication unit 22, a storage unit 23, an operation unit 24, and a control unit 25, and each component is connected to each other via a bus 26. Has been.

  The memory connection unit 21 is for connecting the USB memory U1. When the user accepts a request for installing an electronic certificate by operating the operation unit 24 with the USB memory U1 connected to the memory connection unit 21, the memory identification stored in the connected USB memory U1 The installation instruction information Ji for requesting installation together with the number I1 is transmitted from the communication unit 22 to the authentication device 100 via the network X. Then, the authentication is performed by the authentication device 100, and the encryption stored in the USB memory U1 using the installation information R1 transmitted from the authentication device 100 and the memory identification number I1 stored in the USB memory U1. The decrypted electronic certificate Cc1 is decrypted and installed (stored) in a format for adding functions to the browser stored in the storage unit 23.

  Further, after the installation is completed, the encrypted electronic certificate Cc1 stored in the USB memory U1 is deleted. The USB memory U1 itself is collected and managed and stored at the printing company in which the authentication device 100 is installed or a network management company affiliated with the printing company, thereby preventing a loss accident on the user side. Can be managed safely. The specific installation processing operation will be described in detail later.

  The communication unit 22 is for exchanging information with the authentication device 100 via the network X. More specifically, the communication unit 22 functions as an identification information receiving unit together with the control unit 25, thereby transmitting the memory identification number In stored in the USB memory Un to the authentication device 100 via the network X.

  In addition, the communication unit 22 functions as a storage information receiving unit together with the control unit 25, thereby receiving the installation information Rn corresponding to the memory identification number In from the authentication device 100 via the network X.

  Further, the communication unit 22 functions as a deletion instruction information transmission unit together with the control unit 25. When the request for uninstallation is received, the communication unit 22 uninstalls the electronic certificate installed in the storage unit 23, and obtains the uninstallation instruction information Ja. The data is transmitted to the authentication device via the network X together with the memory identification number In in the USB memory.

  Furthermore, the communication unit 22 functions as an electronic certificate receiving unit together with the control unit 25, thereby receiving the electronic certificate corresponding to the memory identification number In from the authentication device 100 via the network X in an encrypted state. .

  The storage unit 23 is configured by, for example, an HD (Hard Disc) or the like, and functions as a first storage unit together with the control unit 25, thereby identifying the received installation information Rn and the memory identification stored in the USB memory Un. Using the number In, the electronic certificate stored in the USB memory Un is decrypted and installed in the storage unit 23.

  More specifically, the electronic certificate C1 decrypted using the installation information R1 transmitted from the authentication device 100 and the memory identification number I1 stored in the USB memory U1 is installed (stored). At this time, it is stored in the Plug-in format of application software (hereinafter referred to as a browser) for browsing a Web page already installed in the storage unit 23. In this way, by adding a function to an already installed browser and using it, only to access the authentication device 100 via the network X and access and use the flyer creation system of the authentication device 100, There is an advantage that it is possible to save the trouble of adding dedicated browsing application software.

  When the electronic certificate C1 is deleted (uninstalled) from the storage unit 23, the user operates the operation unit 24 with the USB memory U1 connected to the memory connection unit. Is received, the memory identification number I1 in the USB memory and the uninstallation instruction information Ja as the deletion instruction information for requesting the uninstallation are transmitted to the authentication apparatus 100 and transmitted from the authentication apparatus 100. The encrypted electronic certificate Cc1 as the second encrypted electronic certificate is stored in the USB memory U1. A specific uninstall processing operation will be described in detail later.

  The operation unit 24 includes a keyboard, a mouse, a touch panel of a display device, and the like, and functions as a deletion request reception unit together with the control unit 25, thereby receiving a request for uninstalling the electronic certificate stored in the storage unit 23. When the user operates the operation unit 24, a request for uninstalling the electronic certificate is accepted.

  The control unit 25 includes a CPU as a computer having an arithmetic function, a working RAM, various processing programs (including an installation program and an uninstallation program) including a communication processing program, a ROM for storing data, an oscillation circuit, and the like. The control information for controlling each component is generated and output to the corresponding component via the bus 26. As a result, the control unit 25 controls the operation of each component constituting the user terminal device 201.

  Further, the control unit 25 executes the installation program stored in the ROM or the like, thereby causing each of the components to function as the identification information transmitting unit, the stored information receiving unit, and the first storage unit of the present application. Yes.

  More specifically, the control unit 25 functions as an identification information receiving unit together with the communication unit 22, thereby transmitting the memory identification number In stored in the USB memory Un to the authentication device 100 via the network X.

  Then, the control unit 25 functions as a storage information receiving unit together with the communication unit 22, thereby receiving the installation information Rn corresponding to the memory identification number In from the authentication device 100 via the network X.

  In addition, the control unit 25 functions as a first storage unit together with the storage unit 23, so that it is stored in the USB memory Un using the received installation information Rn and the memory identification number In stored in the USB memory Un. The digital certificate that has been decrypted is decrypted and installed in the storage unit 23.

  Further, the control unit 25 executes the uninstall program stored in the ROM or the like, so that the deletion request receiving unit, the deletion instruction information transmitting unit, the electronic certificate receiving unit, and the second storage unit of the present application The components are made to function.

  More specifically, the control unit 25 functions as a deletion request reception unit together with the operation unit 24, thereby receiving a request for uninstalling the electronic certificate stored in the storage unit 23.

  Then, the control unit 25 functions as a deletion instruction information transmission unit together with the communication unit 22. When the control unit 25 receives an uninstall request, the control unit 25 uninstalls the electronic certificate installed in the storage unit 23 and obtains the uninstall instruction information Ja. The data is transmitted to the authentication device via the network X together with the memory identification number In in the USB memory.

  Then, the control unit 25 functions as an electronic certificate receiving unit together with the communication unit 22 to receive the electronic certificate corresponding to the memory identification number In from the authentication device 100 via the network X in an encrypted state. .

  Further, the control unit 25 functions as a second storage unit to store the received electronic certificate in the USB memory Un in an encrypted state.

[Authentication process]
Next, an authentication process in the user authentication system S will be described.

<Installation process of electronic certificate in user terminal device>
First, an electronic certificate installation (storage) process in the user terminal apparatus performed in the authentication process will be described. Since the user terminal apparatuses 201 to 203 perform the same process, the user terminal apparatus will be described in the following description. An electronic certificate installation (storage) process in 201 will be described.

  FIG. 5 is a flowchart showing an electronic certificate installation process in the control unit 25 of the user terminal apparatus 201 performed during the authentication process.

  Note that the processing in FIG. 5 is performed by the installation program being executed by the control unit 25.

  First, when the user connects the USB memory U1 distributed by the printing company or the like in which the authentication apparatus 100 is installed to the memory connection unit 21 (step S1), the user enters the USB memory U1 based on the control of the control unit 25. The stored memory identification number I1 and encrypted electronic certificate Cc1 (first encrypted electronic certificate) are read (step S2).

  Then, the read memory identification number I1 and installation instruction information Ji for requesting installation are transmitted from the communication unit 22 to the authentication device 100 (step S3).

  Next, when authentication is confirmed by the authentication apparatus 100, the authentication apparatus 100 transmits installation information R1 corresponding to the memory identification number I1, and receives the installation information R1 from the communication unit 22 of the user terminal apparatus 201. (Step S4). The authentication process in the authentication device 100 will be described in detail later with reference to FIG.

  Then, using the received installation information R1 and the memory identification number I1 stored in the USB memory U1, the encrypted electronic certificate Cc1 read in step S1 is decrypted (step S5). The decrypted electronic certificate C1 (first electronic certificate) is stored (installed) in the browser function addition format in the storage unit 23 (step S6).

  When the storage is properly completed in step S6, installation completion information Jf is transmitted from the communication unit 22 to the authentication device 100 (step S7).

  Then, after receiving the user ID and access password from the authentication device 100 (step S8), the encrypted electronic certificate Cc1 in the USB memory U1 is deleted (step S9), and the process is terminated.

  In step S1 and step S2 described above, when the USB memory U1 is connected to the memory connection unit 21, the memory identification number I1 and the encrypted electronic certificate Cc1 stored in the USB memory U1 are read. However, the present invention is not limited to this, and a configuration may be adopted in which reading is performed when the user operates the operation unit 24 to request installation.

<Authentication process in authentication device>
Next, the control operation of the authentication device 100 in the user authentication process will be described.

  FIG. 6 is a flowchart showing the authentication process in the control unit 15 of the authentication apparatus 100 performed during the user authentication process. The process of FIG. 6 is performed by executing an authentication program in the control unit 15.

  First, installation instruction information Ji and a memory identification number In are received from the user terminal device (step S10).

  The transmitted memory identification number In is the one transmitted from the user terminal device in the process of step S3 in the electronic certificate installation process in the user terminal device described above.

  Then, the authentication unit 12 refers to the user information database 11A to determine whether or not the access is valid (step S11). If the received memory identification number In is not registered in the user information database A, it is determined that the access is not valid and the process ends (step S11: No), and the access is determined to be valid. If it has been performed (step S11: Yes), the installation information Rn corresponding to the received memory identification number In is acquired from the user information database 11A (step S12). That is, when the memory identification number In received in step S1 is the memory identification number I1 (as in step S3 described above), the corresponding installation information R1 is acquired from the user information database 11A, or the memory identification number I2 If it is, the corresponding installation information R2 is acquired from the user information database 11A, or if it is the memory identification number I3, the corresponding installation information R3 is acquired from the user information database 11A (see FIG. 2). ).

  Then, the acquired installation information Rn is transmitted to the user terminal device that is the transmission source that has transmitted the memory identification number In (step S13).

  Next, when the installation completion information Jf transmitted from the user terminal device is received (step S14), a user ID and an access password to be registered in the access history database 11B are generated, registered, and transmitted to the user terminal device ( Step S15), the process is terminated.

  In the above-described embodiment, when logging in to the flyer creation system of the authentication device 100 from the user terminal devices 201 to 203, the user ID and access password that are input and used on the login screen of the flyer creation system are the user When the electronic certificate Cn is installed in the terminal devices 201 to 203, if installation completion information is transmitted from the user terminal devices 201 to 203 to the terminal device 100 as in the process of step S7, the user ID is determined in step S15. The access password is assigned (transmitted) from the terminal device 100 to the user terminal devices 201 to 203. However, the present invention is not limited to this.

  For example, a user ID and an access password may be issued in advance and communicated to the user. In this case, the user ID and the access password may be configured to be input on the login screen of the flyer creation system.

  Alternatively, when the installation completion information is transmitted, the user registration setting screen provided in the leaflet creation system of the terminal device 100 is transferred, and a user who operates the user terminal devices 201 to 203 in accordance with the instruction of the user registration setting screen is free. You may comprise so that a user ID and a password can be set.

  As described above, an electronic certificate is stored by storing an encrypted electronic certificate in a storage medium such as a USB memory, distributing the USB memory to users, and installing the electronic certificate. After installing the certificate, the USB memory can be collected and managed by the printing company where the authentication device 100 is installed or a network management company affiliated with the printing company. It is possible to prevent and manage safely.

  Also, when installing the electronic certificate, it is stored that both the memory-specific identification number (memory identification number In) stored in the USB memory and the installation information Rn transmitted from the authentication device 100 are not available. Since it is configured not to be installed in the unit 23, it is possible to provide an authentication system with high security.

  Further, since the electronic certificate in the USB memory is deleted when the electronic certificate is installed, unauthorized access can be prevented even if the USB memory is illegally taken out.

  Also, since access to the login screen to the flyer creation system is not possible unless the access is from a terminal device on which an electronic certificate is installed, for example, from other terminal devices due to unauthorized acquisition of a user ID or access password, etc. Unauthorized access can be effectively prevented.

<Electronic Certificate Uninstallation Process in User Terminal Device>
Next, the electronic certificate uninstall process in the user terminal apparatus will be described. Since the user terminal apparatuses 201 to 203 perform the same process, the electronic certificate in the user terminal apparatus 201 will be described below. The uninstall process will be described.

  7A is a flowchart showing an electronic certificate uninstall process in the control unit 25 of the user terminal device 201, and FIG. 7B is a flowchart of the electronic certificate in the control unit 15 of the authentication device 100. It is a flowchart which shows an uninstallation process. Note that the processing in FIG. 7A is performed by the control unit 25 executing an uninstall program.

  First, the user connects the USB memory U1 of the user terminal device 201 to the memory connection unit 21 (step S21).

  Next, when the user operates the operation unit 24 to accept the electronic certificate uninstall process, the electronic certificate C1 stored in the storage unit 23 is deleted (step S22).

  Then, the uninstall instruction information Ja is transmitted to the authentication device 100 via the communication unit 22 together with the memory identification number I1 stored in the USB memory U1 (step S23).

  When the authentication device 100 receives the memory identification number I1 and the uninstall instruction information Ja from the user terminal device 201 via the communication unit 13 (step S31), the authentication device 100 receives the encryption key corresponding to the received memory identification number as the user information. Obtained by referring to the database 11A (step S32). More specifically, when the memory identification number In received in step S31 is the memory identification number I1, the corresponding encryption key E1 is obtained from the user information database 11A, and when it is the memory identification number I2. Obtains the corresponding encryption key E2 from the user information database 11A, and if it is the memory identification number I3, obtains the corresponding encryption key E3 from the user information database 11A (see FIG. 2). In this embodiment, since the memory identification number I1 is received in step S31, the encryption key E1 is acquired.

  Next, using the acquired encryption key E1 and the transmitted memory identification number I1, the electronic certificate C1 as the second electronic certificate is encrypted (step S33). Then, the encrypted electronic certificate Cc1 as the second encrypted electronic certificate is transmitted to the user terminal device 201 (step S34), and the access history database 11B corresponding to the memory identification number In received in step S31 is stored. The user ID is deleted (step S35), and the process ends.

  On the other hand, when receiving the encrypted electronic certificate Cc1 from the authentication device 100 via the network X (step S24), the user terminal device 201 stores the encrypted electronic certificate Cc1 in the USB memory U1 and ends the process ( Step S25).

  As described above, according to the present embodiment, it is possible to uninstall an electronic certificate installed in the storage unit 23 of the user terminal device while preventing leakage of information on the electronic certificate. .

  More specifically, when the electronic certificate Cn is transmitted to the user terminal device via the network, the electronic certificate Cn is transmitted with the encrypted encrypted electronic certificate Ccn. Can be sent and received.

  In addition, in the process of step S25, since the encrypted electronic certificate Ccn is stored in the USB memory Un at the time of uninstallation, the USB memory Un is in a state before the electronic certificate is installed in the user terminal device. It becomes possible to return to the same state. Therefore, after the USB memory Un is collected by the printing company or the like where the authentication apparatus 100 is installed, the electronic certificate is installed in the same manner for other users, and the authority to access the flyer creation system of the authentication apparatus is granted. Also in giving, by rewriting the user information database 11A and the access history database 11B in the authentication device 100, the same USB memory Un can be used as it is, and convenience in management is improved.

  In the above-described embodiment, the USB memories Un are used as many as the number of user terminal devices. However, the present invention is not limited to this, and as another configuration example, one USB memory Un is used for a plurality of user terminal devices. It is also possible.

  In this case, an access number Pm assigned to each user terminal device is stored in the USB memory, and the user information database 11A stores an electronic certificate Cm for each access number as shown in FIG. The encryption key Em and the installation information Rm may be registered in association with each other.

  In the process of step S3 in the installation process operation described above, the user terminal device is configured to transmit the access number Pm stored in the USB memory to the authentication device 100. Further, in the process of step S11, the authentication device 100 is configured. May be configured to authenticate based on the transmitted access number Pm and transmit the installation information Rm corresponding to the transmitted access number Pm in the process of step S12 to the user terminal device.

  Further, in the process of step S23 in the uninstall process described above, the user terminal device is configured to transmit the access number Pm stored in the USB memory to the authentication device 100. Further, in the process of step S32, the authentication device 100 may be configured to acquire the encryption key Em corresponding to the transmitted access number Pm.

  Moreover, although the flyer creation system described above is configured to be provided in the authentication apparatus 100, the present invention is not limited thereto, and the flyer creation system may be configured to be provided in another computer. In this case, the authentication device 100 corresponds to the authentication device of the present application, and the other computer corresponds to the server device of the present application.

It is a block diagram which shows the example of a schematic structure of a user authentication system. It is explanatory drawing of 11A of user information databases. It is explanatory drawing of a USB memory. 3 is a block diagram illustrating a schematic configuration example of a user terminal device 201. FIG. 7 is a flowchart illustrating an electronic certificate installation process in a control unit 25. 5 is a flowchart showing an authentication process in a control unit 15. (A) It is a flowchart which shows the uninstallation process of the electronic certificate in the control part 25. FIG. (B) It is a flowchart which shows the uninstallation process of the electronic certificate in the control part 15. FIG. It is explanatory drawing of the user information database 11A in another structural example.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 ... Authentication apparatus 11 ... Memory | storage part 11A ... User information database 11B ... Access history database 12 ... Authentication part 13 ... Communication part 14 ... Memory connection part 15 ... Control part 16 ... Bus 201, 202, 203 ... User terminal device 21 ... Memory Connection unit 22 ... Communication unit 23 ... Storage unit 24 ... Operation unit 25 ... Control unit 26 ... Bus S ... User authentication system S
X ... Network Un, U1, U2, U3 ... USB memory In, I1, I2, I3 ... Memory identification number Cn, C1, C2, C3 ... Electronic certificate Rn, R1, R2, R3 ... Installation information En, E1, E2 , E3 ... Encryption key Ccn, Cc1, Cc2, Cc3 ... Encrypted electronic certificate Pm, P1, P2, P3 ... Access number Cm, C1, C2, C3 ... Electronic certificate Rm, R1, R2, R3 ... Installation information Em, E1, E2, E3 ... Encryption key Ji ... Installation instruction information Ja ... Uninstallation instruction information Jf ... Installation completion information

Claims (12)

In an authentication system comprising: an authentication device that performs user authentication via a network; and a terminal device that can access the authentication device via the network.
The terminal device
Identification information transmitting means for acquiring identification information stored in one storage medium and a first electronic certificate for accessing the server device, and transmitting the acquired identification information to the authentication device via the network When,
Storage information receiving means for receiving storage information of the first electronic certificate via the network;
First storage means for storing the acquired first electronic certificate in a storage means accessible to the server device using the received storage information and the acquired identification information. And
The authentication device
Identification information receiving means for receiving the identification information transmitted from the terminal device via the network;
An authentication system comprising: storage information transmission means for acquiring the storage information corresponding to the identification information and transmitting the storage information to the terminal device via the network. The authentication system according to claim 1,
The first electronic certificate is an encrypted first encrypted electronic certificate,
The first storage means decrypts the first encrypted electronic certificate using the stored information and the identification information, and then stores the decrypted information in the storage means. In the authentication system according to claim 1 or 2,
The first storage means deletes the first electronic certificate stored in the one storage medium when storing the electronic certificate in the storage means. In the authentication system according to any one of claims 1 to 3,
The terminal device
A delete request accepting means for accepting a delete request for the first electronic certificate stored in the storage means;
When the deletion request is received, the first electronic certificate stored in the storage unit is deleted, and the deletion instruction information is transmitted to the authentication device together with the identification number stored in the one storage medium. Delete instruction information transmitting means;
An electronic certificate receiving means for receiving, via the network, a second electronic certificate corresponding to the identification information transmitted from the authentication device;
A second storage means for storing the received second electronic certificate in the one storage medium;
The authentication device
Delete instruction information receiving means for receiving the delete instruction information and the identification number transmitted from the terminal device via the network;
Electronic certificate transmitting means for acquiring the second electronic certificate corresponding to the received identification information and transmitting the second electronic certificate to the terminal device via the network when receiving the deletion instruction information and the identification number; An authentication system comprising: The authentication system according to claim 4,
2. The authentication system according to claim 1, wherein the second electronic certificate is an encrypted second encrypted electronic certificate. In the authentication system according to claim 4 or claim 5,
The second electronic certificate is the same as the first electronic certificate, and the second encrypted electronic certificate is the same as the first encrypted electronic certificate. Authentication system. In a terminal device accessible to an authentication device that performs user authentication via a network,
Identification information transmitting means for acquiring identification information stored in one storage medium and a first electronic certificate for accessing the server device, and transmitting the acquired identification information to the authentication device via the network When,
Storage information receiving means for receiving storage information of the first electronic certificate corresponding to the identification information via the network;
First storage means for storing the acquired first electronic certificate in a storage means in an accessible state to the server device using the received storage information and the acquired identification information. A terminal device characterized by that. In an authentication device that performs user authentication for a terminal device via a network,
Identification information receiving means for receiving the identification information transmitted from the terminal device via the network;
Storage information for storing the first electronic certificate for accessing the server device, the storage information for acquiring the storage information corresponding to the identification information and transmitting it to the terminal device via the network And an authentication device. A computer that can access an authentication device that performs user authentication via a network.
Identification information transmitting means for acquiring identification information stored in one storage medium and a first electronic certificate for accessing the server device, and transmitting the acquired identification information to the authentication device via the network ,
Storage information receiving means for receiving storage information of the first electronic certificate corresponding to the identification information via the network;
Use the received storage information and the acquired identification information to cause the storage means to function as first storage means for storing the acquired first electronic certificate in a state accessible to the server device. An installation program characterized by that. A computer that can access an authentication device that performs user authentication via a network.
A deletion request receiving means for receiving a deletion request for the first electronic certificate for accessing the server device stored in the storage means;
When receiving the deletion request, the first electronic certificate stored in the storage unit is deleted, and the deletion instruction information transmission unit that transmits the deletion instruction information to the authentication device;
Electronic certificate receiving means for receiving a second electronic certificate corresponding to the identification information stored in one storage medium via the network;
An uninstallation program that causes the received second electronic certificate to function as a second storage unit that stores the second electronic certificate in the one storage medium. A computer that performs user authentication for a terminal device via a network,
Identification information receiving means for receiving identification information transmitted from the terminal device via the network;
Storage information for storing the first electronic certificate for accessing the server device, the storage information for acquiring the storage information corresponding to the identification information and transmitting it to the terminal device via the network Transmission means,
Delete instruction information receiving means for receiving the delete instruction information transmitted from the terminal device via the network;
When receiving the deletion instruction information, as the electronic certificate transmitting means for acquiring the second electronic certificate corresponding to the identification information received by the identification information receiving means and transmitting it to the terminal device via the network An authentication program characterized by functioning. In an authentication method in an authentication system comprising: an authentication device that performs user authentication via a network; and a terminal device that is accessible to the authentication device via the network.
The terminal device acquires identification information stored in one storage medium and a first electronic certificate for accessing the server device, and transmits the acquired identification information to the authentication device via the network. An identification information transmission step to perform,
An identification information receiving step in which the authentication device receives the identification information transmitted from the terminal device via the network;
A storage information transmission step in which the authentication device acquires the storage information corresponding to the identification information and transmits the storage information to the terminal device via the network;
A storage information receiving step in which the terminal device receives the storage information of the first electronic certificate via the network;
The terminal device stores the acquired first electronic certificate in a state where the server device is accessible in a storage unit using the received storage information and the acquired identification information. And a storing step.

Images