JP2006023998A - Authentication apparatus, portable telephone authentication system, method for authenticating user, and computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication apparatus for authenticating a user through a portable telephone terminal. <P>SOLUTION: The authentication apparatus 100 is constituted of an authentication server 30 and a gateway 40, wherein the authentication server 30 receives a connection request from a user's portable telephone terminal 10 through a telephone network 50, and when the sent telephone number coincides with a registered telephone number, transmits identification number input guidance. The identification number information inputted by the user is received and it is confirmed whether the combination of the sent telephone number and the identification number coincides with registered information or not. When coincidence can be confirmed, the information of ID and a password corresponding to the user can be read out for prescribed time. Then, when the gateway 40 receives a connection request including the ID and the password from a client terminal used by the user through the Internet 60 and when the combination of the received ID and password coincides with the registered information in the authentication server 30, connection to a private network is permitted. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an authentication device, a mobile phone authentication system, a user authentication method, and a computer program that authenticate a terminal device using a mobile phone terminal.

2. Description of the Related Art Conventionally, it is widely performed that a user connects to a home network or a private network in a company from the outside via the Internet using a terminal device.
At that time, in the method of performing authentication using the user ID and password fixedly set in the authentication server or the like, once the ID and password are stolen by a malicious user, it is illegally accessed. There is a problem.
In order to solve this problem, a handheld device that generates a one-time password that changes in a certain time in advance is distributed to the user to improve security (for example, see Non-Patent Document 1 and Non-Patent Document 2). ).
Hide Yamaguchi, Hironobu Suzuki, “bit separate volume information security”, Kyoritsu Publishing, January 2000, p61-63 Atsushi Matsumoto et al., “Separate volume security technology for electronic commerce”, Nikkei Digital Money System, Nikkei BP, June 1998, p51-52

  However, the above-mentioned handheld device can be used only for authentication and is expensive, and there is a problem that a burden on the cost and management is large for the company side that must be distributed for each user.

  The present invention has been made to solve the above-described problems, and its purpose is to perform user authentication using a generally-used mobile phone terminal without distributing a special handheld device to individual users. An object of the present invention is to provide an authentication device and a mobile phone authentication system that perform the method.

  In order to solve the above-described problem, the present invention provides an authentication apparatus (authentication server 30 and gateway 40) connected to a telephone network (telephone network 50) and a data network (Internet 60). A first storage unit storing a telephone number of a telephone terminal (mobile phone terminal 10); a second storage unit storing an ID given in advance to the user for each user; and the telephone network The telephone connection request is received from the mobile phone terminal via the mobile phone terminal to establish a call, and the calling telephone number included in the telephone connection request matches the telephone number stored in the first storage unit The first authentication means for authenticating whether or not the first authentication means and the first authentication means match, the second corresponding to the user of the mobile phone terminal A setting means for setting to enable reading of information stored in the storage unit for a predetermined time, and a terminal connection request including an ID from the terminal device (client terminal 20) used by the user via the data network A second authentication unit that reads out an ID corresponding to the user from the second storage unit and authenticates whether the read-out ID matches the received ID; and the second authentication unit And a connection permission means for permitting the connection of the terminal device when it is authenticated that they match.

  According to the present invention, in the above invention, the first storage unit further stores a personal identification number of the user in association with the telephone number, and the second storage unit correlates with the ID. And the first authenticating means, when the information of the outgoing telephone number included in the telephone connection request matches the telephone number stored in the first storage unit, A number input guidance is transmitted to the mobile phone terminal, information on a password entered by the user via the mobile phone terminal is received, and a combination of the calling phone number and the password is stored in the first storage unit. The second authentication unit receives a terminal connection request including an ID and a password from a terminal device used by a user via the data network, authenticating whether the combination matches the stored combination. If the ID and the password corresponding to the user are read from the second storage unit, the combination of the read ID and the password matches the received combination of the ID and the password. It is characterized by authenticating.

  According to the present invention, in the above invention, the first authentication unit receives the telephone connection request, and stores the calling telephone number included in the telephone connection request in the first storage unit. If the telephone number does not match, an unregistered telephone number notification message is transmitted, and the call is disconnected when the telephone connection request including the same outgoing telephone number is received a predetermined number of times or more. .

  According to the present invention, in the above invention, the second authentication unit is enabled by the setting unit even within a predetermined time during which reading is possible after permitting the connection of the terminal device. The read setting from the second storage unit is canceled.

  According to the present invention, in the above invention, the first authenticating unit determines that the authentication impossible message is obtained when the combination of the calling telephone number and the personal identification number does not match the combination stored in the first storage unit. If the unauthenticated message is transmitted a predetermined number of times or more, the incoming call is received from the same calling telephone number as the means for disconnecting the call, and the unauthenticated message is transmitted a predetermined number of times or more. The call is disconnected when the incoming call is received from the same calling telephone number again after the call is disconnected.

  The present invention relates to a mobile phone terminal (mobile phone terminal 10) used by a user, an authentication device (authentication server 30 and gateway 40) connected to a telephone network (phone network 50) and a data network (Internet 60), In a mobile phone authentication system comprising a terminal device (client terminal 20) connected to a data network, the mobile phone terminal receives an instruction to make a call from the user to the authentication device, and sends a calling telephone number to the telephone network. The authentication device includes a first storage unit that stores a phone number of the mobile phone terminal for each user, and the user for each user. A second storage unit storing an ID assigned in advance to the mobile phone terminal and the telephone connection request from the mobile phone terminal And a first authentication means for authenticating whether or not the calling telephone number included in the telephone connection request matches the telephone number stored in the first storage unit; A setting unit configured to perform setting for enabling reading of information stored in the second storage unit corresponding to the user for a predetermined time when it is authenticated by one authentication unit; and the terminal When a terminal connection request including an ID is received from the device, the ID corresponding to the user is read from the second storage unit, and the second ID for authenticating whether the read ID matches the received ID Authentication means and a connection permission means for permitting connection of the terminal device when it is authenticated by the second authentication means, the terminal device receiving the user's instruction, Authentication device A mobile phone authentication system characterized by being constituted by the connection request transmission means for transmitting a terminal connection request including information of the ID to.

The present invention is connected to a mobile phone terminal (mobile phone terminal 10) used by a user, a telephone network (telephone network 50), and a data network (Internet 60), and the telephone number of the user's mobile phone terminal is assigned to each user. An authentication device (authentication server 30 and gateway 40) including a first storage unit storing the second storage unit storing an ID given in advance to the user for each user; A user authentication method of a mobile phone authentication system comprising a terminal device (client terminal 20) connected to a data network, wherein the mobile phone terminal receives an instruction to make a call from the user to the authentication device, and A process of transmitting a telephone connection request including an outgoing telephone number to a telephone network, and the authentication device receives the telephone connection request from the mobile phone terminal. Receiving and authenticating whether the calling telephone number included in the telephone connection request matches the telephone number stored in the first storage unit; and A process of performing a setting to enable reading of the information of the ID corresponding to the user stored in the second storage unit for a predetermined time when it is authenticated that the telephone numbers match, and the terminal In response to an instruction from the user, a device transmits a terminal connection request including ID information to the authentication device, and the authentication device receives a terminal connection request including the ID and the password from the terminal device. Sometimes, the process of reading the ID corresponding to the user from the second storage unit, authenticating whether the read ID and the received ID match, and the authentication device matches the ID If successfully authenticated the Rukoto the steps of permitting the connection of the terminal device,
It is a user authentication method characterized by comprising.

  In the present invention, the present invention is connected to a telephone network (telephone network 50) and a data network (Internet 60), and stores the telephone number of the user's cellular phone terminal (cellular phone terminal 10) for each user. A computer of an authentication device (authentication server 30 and gateway 40) including a first storage unit and a second storage unit that stores an ID assigned to the user in advance for each user, the telephone A telephone connection request is received from the mobile phone terminal via the network to establish a call, and the calling telephone number included in the telephone connection request matches the telephone number stored in the first storage unit First authentication means for authenticating whether or not to perform the second authentication corresponding to the user of the mobile phone terminal when it is authenticated by the first authentication means to match Setting means for performing setting for enabling reading of information stored in the storage unit for a predetermined time; a terminal connection request including an ID is received from a terminal device (client terminal 20) used by a user via the data network Sometimes the ID corresponding to the user is read from the second storage unit, and the second authentication means for authenticating whether the read ID and the received ID match, the second authentication means matches. Then, when authenticated, it is a computer program for functioning as connection permission means for permitting connection of the terminal device.

  According to this invention, the authentication device receives a call from a mobile phone terminal used by a user, and if the call phone number is a phone number stored in advance, the user's phone stored in advance is stored. When it coincides with the field name, the user ID information can be read for a predetermined time. Next, when a terminal connection request is received from a terminal device that has received an instruction from the user, the user ID stored in advance is read, and if it matches the ID included in the terminal connection request, the connection is Is configured to allow. Therefore, the user can connect to a private network or the like by using his / her mobile phone terminal or the like and receiving authentication by the authentication device. This eliminates the need to distribute handheld devices to individual users, and allows companies and the like to reduce costs and administrative burdens. Also, in the case of a handheld device that generates a one-time password, if a device is stolen by a malicious person who knows the identity of a certain user, unauthorized access from the malicious user is noticed until the user notices that the user has been stolen. There is a possibility of receiving. However, when using a mobile phone terminal, even if the mobile phone terminal is stolen, a password is required for authentication on the mobile phone terminal. There is an effect that there is a low possibility that In addition, since the mobile phone terminal is used for other purposes, it is easy to notice that it has been stolen.

  In addition, according to the present invention, when the outgoing telephone number received from the mobile phone terminal used by the user is a telephone number stored in advance, a password input guidance is transmitted. Then, when the information on the personal identification number is received from the mobile phone terminal and the combination of the calling telephone number and the personal identification number matches the combination of the user's telephone number and personal identification number stored in advance, the user ID and password The information can be read for a predetermined time. Next, when a terminal connection request is received from a terminal device that has received an instruction from the user, information on the user ID and password stored in advance is read, and the combination of the ID and password included in the terminal connection request In the case of matching, the connection is permitted. Therefore, it is possible to further improve the reliability of authentication by inputting the personal identification number and the password, compared to the case where authentication is performed only with the telephone number of the user's mobile phone terminal and the ID assigned to the user.

  Further, according to the present invention, the authentication device receives the incoming call and, when the outgoing telephone number does not match the pre-stored telephone number, sends a message notifying that the telephone number is not registered. Send. When a telephone call is received from the same calling telephone number more than a predetermined number of times, the call is disconnected. Therefore, even if authentication is performed using a mobile phone terminal that is not registered in the authentication device, the authentication process is stopped after repeating the process several times, thus preventing unauthorized access from a malicious user. It becomes possible.

In addition, according to the present invention, after the connection of the terminal device is permitted, the setting for reading information stored therein is canceled even within a predetermined time during which reading is possible. For this reason, it is possible to prevent unauthorized access from a malicious user who attempts to establish a connection.

  Further, according to the present invention, when the combination of the calling telephone number and the personal identification number does not match the combination of the telephone number and personal identification number stored in advance, an authentication impossible message is transmitted, and the authentication cannot be performed more than a predetermined number of times. If a message is sent, the call is disconnected. If a call is received from the same calling telephone number for a predetermined number of times or more and a call is disconnected by sending an unauthenticated message, the call cannot be authenticated even if a call is received from the same calling telephone number again. The call is disconnected without responding to the message. Therefore, even a user who has somehow owned a mobile phone terminal registered in the authentication device will not be authenticated unless the correct password is entered, and after repeated several times, Since the authentication process is stopped, unauthorized access from a malicious user can be prevented.

Hereinafter, a mobile phone authentication system according to an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a schematic block diagram showing a mobile phone authentication system 1 according to an embodiment of the present invention.
In the figure, a mobile phone terminal 10 is a general mobile phone or the like, and can be connected to an opposite terminal via the telephone network 50 when a user presses a destination telephone number. The client terminal 20 is a personal computer owned by the user of the mobile phone terminal 10, for example, and can connect to the Internet 60 in response to a user operation. The authentication server 30 stores information on a combination of a cellular phone number and a personal identification number for each user, and receives an incoming call from the cellular phone terminal 10 via the telephone network 50 for authentication. Also, ID and password information is stored for each user, and has a function as RADIUS (Remote Authentication Dial-In User Services). By permitting access to only the information of the user ID and password for which authentication is OK in the mobile phone terminal 10, authentication of network access by the mobile phone is realized. The gateway 40 is a device installed at the boundary between a private network 70 that is a corporate intranet and the Internet 60. The gateway 40 is connected to the authentication server 30 via a LAN (Local Area Network) or the Internet. Then, a connection request to the private network 70 is received from the client terminal 20 via the Internet 60, and authentication is performed using the RADIUS of the authentication server 30. The client terminal 20 whose authentication is confirmed to be OK can connect to the private network 70 via the gateway 40. The private network 70 is a corporate intranet, a home network, or the like, and may be a server device that requires authentication at the time of connection instead of the network.
Note that the authentication server 30 and the gateway 40 may be configured by a single authentication device 100, and conversely, a configuration in which a single authentication server 30 manages data of a plurality of gateways 40 may be employed. In addition, the client terminal 20 used by the user may not be owned by the user, and may be any terminal that is near the user and can be used freely by the user.

FIG. 2 is a sequence diagram showing the flow of processing in the mobile phone authentication system 1.
In the figure, the same reference numerals as those in FIG.
First, in order to connect to the private network 70 through the gateway 40 using the client terminal 20, the user makes a call by pressing the telephone number of the authentication server 30 in the mobile phone terminal 10 (step S2-1). . The authentication server 30 confirms that there is data corresponding to the calling telephone number of the mobile phone terminal 10 from the internal database, and if there is a telephone number, transmits a guidance for entering the password. If the corresponding data does not exist, NG guidance indicating that the telephone number is not registered is transmitted (step S2-2). The user inputs a personal identification number by pressing a button on the mobile phone terminal 10, and transmits information including the personal identification number to the authentication server 30 (step S2-3). The authentication server 30 receives the information including the personal identification number, reads out the personal identification number corresponding to the calling telephone number from the internal database, and transmits an authentication OK guidance when the identification number matches with the received personal identification number. In the case of NG, NG guidance is transmitted. In the case of authentication OK, a setting is made to permit access to the preset user ID and password information for a certain period of time (step S2-4).

The user who has heard the authentication OK guidance from the authentication server 30 inputs the ID and password assigned in advance from the client terminal 20. When the correct ID and password shown in * 1 are input, the client terminal 20 receives the ID and password input by the user and transmits information including the ID and password to the gateway 40 (step S2-5). ). The gateway 40 transmits information including the ID and password to the authentication server 30 to confirm whether the ID and password are correct information (step S2-6). The authentication server 30 receives the ID and password information from the gateway 40, and returns an authentication OK response to the gateway 40 when the information matches the preset user ID and password information (step S2-7). And about ID and a password by which authentication was determined to be OK, reception of the said ID and password is complete | finished after that. In other words, in the same figure, if the authentication is OK once at the timing of * 2 after starting the reception of the ID and password information from the gateway 40 at * 1, the ID is within the authentication possible time. And access to the password is rejected (step S2-8). After that, the gateway 40 transmits an authentication OK message to the client terminal 20 (step S2-9), and the client terminal 20 starts a VPN (Virtual Private Network) connection to the private network 70 via the gateway 40 (step S2-9). S2-10).
The reason why the ID and password for which authentication is OK is rejected even within the authenticable time is to prevent unauthorized access due to the impersonation of a malicious user.

* 2 in the figure is a processing sequence when a user who has heard the authentication OK guidance from the authentication server 30 inputs an incorrect ID and password to the client terminal 20 within a certain time. Since the first steps S2-5 and S2-6 are the same as those described above, description thereof will be omitted. The authentication server 30 receives information including the ID and password from the gateway 40, and determines whether or not the information matches the preset user ID and password information. Since the ID and password are incorrect, the determination results do not match, authentication is NG, and an authentication NG message is sent to the gateway 40 (step S2-11). The gateway 40 transmits an ID and password input request to the client terminal 20 (step S2-12). The user re-enters the ID and password in the client terminal 20, and the client terminal 20 transmits the ID and password information to the gateway 40 again (step S2-14). However, in the figure, the authentication possible time of the authentication server 30, that is, the time from * 1 to * 2 has already expired between step S2-12 and step S2-14 (step S2-13). The input ID and password are rejected by the authentication server 30, and the client terminal 20 cannot start a VPN connection via the gateway 40.
In such a case, the user needs to authenticate with the authentication server 30 again using the mobile phone terminal 10.

FIG. 3 is a sequence diagram showing processing when the calling telephone number of the mobile phone terminal 10 that has arrived in step S2-2 in FIG. 2 is not registered in the authentication server 30.
First, the mobile phone terminal 10 receives the telephone number of the authentication server 30 input by the user and makes a call (step S3-1). The authentication server 30 detects the presence of data corresponding to the calling telephone number of the mobile phone terminal 10 from the internal database. In the case of the figure, since the corresponding telephone number does not exist, an NG guidance indicating that the telephone number is not registered is transmitted to the mobile phone terminal 10 (step S3-2). Then, the authentication server 30 transmits a disconnection instruction and disconnects the call (step S3-3). When the process from step S3-1 to step S3-3 is performed a predetermined number of times, even if the user makes a call from the mobile phone terminal 10, the authentication server 30 does not perform the authentication process and transmits an NG guidance. If there is no disconnection instruction, the call is disconnected (step S3-4).
Even if an attempt is made to authenticate in the authentication server 30 using the mobile phone terminal 10 whose telephone number is not registered in the authentication server 30 by this process, the authentication process is stopped if the process is repeated several times. It is possible to prevent unauthorized access from a malicious user.

FIG. 4 is a sequence diagram showing processing when the authentication server 30 transmits an NG guidance when the password entered by the user is not registered in the authentication server 30 in step S2-4 in FIG. is there.
First, the mobile phone terminal 10 receives the telephone number of the authentication server 30 entered by the user and makes a call (step S4-1). The authentication server 30 detects whether data corresponding to the calling telephone number of the mobile phone terminal 10 exists from the internal database. In the case of the figure, since the corresponding telephone number exists, the authentication is OK, and the authentication server 30 transmits the password input guidance to the mobile phone terminal 10 (step S4-2). In response to the password entered by the user, the mobile phone terminal 10 transmits information including the password to the authentication server 30 (step S4-3). In the figure, since the corresponding password is not set in the authentication server 30, the authentication NG guidance is transmitted to the mobile phone terminal 10 (step S4-4). The user re-enters the password, and the mobile phone terminal 10 performs the authentication process again (step S4-5). When the processes in steps S4-4 and S4-5 are repeated several times, the authentication server 30 transmits a disconnection instruction to the mobile phone terminal 10 to disconnect the call (step S4-6). When the mobile phone terminal 10 transmits again, after the processing from step S4-1 to step S4-6 is repeatedly performed a predetermined number of times, the authentication server 30 does not perform the authentication process and the mobile phone terminal 10 transmits. However, the authentication server 30 transmits a disconnection instruction and disconnects the call (step S4-7).
By this process, even a user who has somehow owned the mobile phone terminal 10 registered in the authentication server 30 is not authenticated by the authentication server 30 unless a correct password is entered. In addition, after repeated several times, the authentication server 30 stops the authentication process, so that unauthorized access from a malicious user can be prevented.

  Each device of the above-described mobile phone authentication system has a computer system therein. The above-described user authentication process is recorded on a computer-readable recording medium in the form of a program, and the above process is performed by the computer reading and executing the program. Here, the computer-readable recording medium means a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, a semiconductor memory, or the like. Alternatively, the computer program may be distributed to the computer via a communication line, and the computer that has received the distribution may execute the program.

It is a block diagram which shows the mobile telephone authentication system in one Embodiment of this invention. It is a sequence diagram which shows the flow of a user authentication process in the embodiment. It is a sequence diagram which shows the flow of a user authentication process at the time of the transmission from the mobile telephone terminal which is not registered in the embodiment. It is a sequence diagram which shows the flow of a user authentication process when the PIN code which is not registered in the embodiment is input.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Mobile phone terminal 20 Client terminal 30 Authentication server 40 Gateway 50 Telephone network 60 Internet 70 Private network 100 Authentication apparatus

Claims (8)

In the authentication device connected to the telephone network and the data network,
A first storage unit storing a telephone number of the user's mobile phone terminal for each user;
A second storage unit storing an ID given in advance to the user for each user;
Receiving a telephone connection request from the mobile phone terminal via the telephone network to establish a call, the telephone number included in the telephone connection request is stored in the first storage unit First authentication means for authenticating whether or not
Setting means for performing setting for enabling reading of information stored in the second storage unit corresponding to the user of the mobile phone terminal for a predetermined time when it is authenticated by the first authentication means When,
When a terminal connection request including an ID is received from a terminal device used by the user via the data network, the ID corresponding to the user is read from the second storage unit, and the read ID and the received ID are A second authentication means for authenticating whether or not they match,
A connection permission unit that permits connection of the terminal device when it is authenticated by the second authentication unit;
An authentication apparatus comprising: The first storage unit
Further storing the user's personal identification number in association with the telephone number;
The second storage unit is
Further storing the password of the user in association with the ID;
The first authentication means includes
When the information of the calling telephone number included in the telephone connection request matches the telephone number stored in the first storage unit, a password input guidance is transmitted to the mobile phone terminal, and the user Receiving the information of the password entered through the mobile phone terminal, authenticating whether the combination of the calling phone number and the password matches the combination stored in the first storage unit;
The second authentication means includes
When a terminal connection request including an ID and a password is received from a terminal device used by the user via the data network, the ID and the password corresponding to the user are read from the second storage unit and read. The authentication apparatus according to claim 1, wherein the authentication apparatus authenticates whether the combination of the ID and the password matches the received combination of the ID and the password. The first authentication means includes
If the telephone connection request is received and the calling telephone number included in the telephone connection request does not match the telephone number stored in the first storage unit, an unregistered telephone number notification message is sent. 3. The authentication apparatus according to claim 1, wherein the authentication apparatus disconnects the call when the telephone connection request including the same calling telephone number is received for a predetermined number of times or more. The second authentication means includes
After permitting the connection of the terminal device, the reading setting from the second storage unit enabled by the setting unit is canceled even within a predetermined time during which reading is possible. Item 4. The authentication device according to any one of Items 1 to 3. The first authentication means includes
When the combination of the calling telephone number and the personal identification number does not match the combination stored in the first storage unit, an unauthenticated message is transmitted, and the unauthenticated message is transmitted a predetermined number of times or more. Means for disconnecting the call;
Receiving an incoming call from the same outgoing telephone number, sending the unauthenticated message a predetermined number of times or more to disconnect, and then disconnecting the call when receiving an incoming telephone call from the same outgoing telephone number again. The authentication device according to claim 2, wherein the authentication device is characterized in that: In a mobile phone authentication system comprising a mobile phone terminal used by a user, an authentication device connected to a telephone network and a data network, and a terminal device connected to the data network,
The mobile phone terminal
A mobile phone connection means for receiving a call instruction from the user to the authentication device and transmitting a telephone connection request including a calling telephone number to the telephone network;
The authentication device
A first storage unit storing a telephone number of the mobile phone terminal for each user;
A second storage unit storing an ID given in advance to the user for each user;
Receiving the telephone connection request from the mobile phone terminal and authenticating whether or not the calling telephone number included in the telephone connection request matches the telephone number stored in the first storage unit A first authenticating means,
A setting unit configured to perform setting for enabling reading of information stored in the second storage unit corresponding to the user for a predetermined time when it is authenticated by the first authentication unit;
When a terminal connection request including an ID is received from the terminal device, the ID corresponding to the user is read from the second storage unit, and it is authenticated whether the read ID matches the received ID. A second authentication means;
A connection permission unit that permits connection of the terminal device when it is authenticated by the second authentication unit,
The terminal device
A mobile phone authentication system comprising: a connection request transmission unit that receives a user instruction and transmits a terminal connection request including the ID information to the authentication device. A mobile phone terminal used by a user, a first storage unit connected to a telephone network and a data network and storing the phone number of the user's mobile phone terminal for each user, and for each user in advance to the user A user authentication method for a mobile phone authentication system, comprising: an authentication device including a second storage unit that stores an assigned ID; and a terminal device connected to the data network,
The mobile phone terminal receives a call instruction from the user to the authentication device, and transmits a telephone connection request including a calling telephone number to the telephone network;
The authentication device receives the telephone connection request from the mobile phone terminal, and the calling telephone number included in the telephone connection request matches the telephone number stored in the first storage unit The process of authenticating whether or not
When the authentication device can authenticate that the telephone numbers match, a setting is made to enable reading of the ID information corresponding to the user stored in the second storage unit for a predetermined time. The process of doing,
The terminal device receives a user instruction and transmits a terminal connection request including ID information to the authentication device;
When the authentication device receives a terminal connection request including the ID and the password from the terminal device, the ID corresponding to the user is read from the second storage unit, and the read ID and the received ID Authenticating whether or not match,
A process of permitting connection of the terminal device when the authentication device can authenticate that the IDs match;
A user authentication method comprising: A first storage unit that is connected to a telephone network and a data network, stores a telephone number of the user's mobile phone terminal for each user, and stores an ID assigned in advance to the user for each user A computer of an authentication device comprising: a second storage unit;
Receiving a telephone connection request from the mobile phone terminal via the telephone network to establish a call, the telephone number included in the telephone connection request is stored in the first storage unit A first authentication means for authenticating whether or not
Setting means for performing setting for enabling reading of information stored in the second storage unit corresponding to the user of the mobile phone terminal for a predetermined time when it is authenticated by the first authentication means ,
When a terminal connection request including an ID is received from a terminal device used by the user via the data network, the ID corresponding to the user is read from the second storage unit, and the read ID and the received ID are A second authentication means for authenticating whether or not they match,
A connection permission means for permitting connection of the terminal device when it is authenticated by the second authentication means as a match;
Computer program to function as.

Images