JP2006079446A - Service providing server - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a service providing server that provides various services to a user terminal equipped with a USB memory using the USB memory as an authentication key. <P>SOLUTION: When a request is made for registering an icon from a user terminal 1, and certification data, a password, and a user ID are transmitted from the user terminal 1, the service providing server 4 performs user authentication based on the password and the user ID. If the server determines that the user is the one to which services can be provided as the result of the user authentication, it associates the certification data, the password, and the user ID, and stores them. It then transmits the icon containing link information for accessing a service desired by the user, to a relay server 3 or the user terminal 1. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a service providing server that uses a USB memory as an authentication key to provide various services to a user terminal equipped with the USB memory.

  In recent years, with the spread of semiconductor technology and the Internet, the spread of various computers such as personal computers (personal computers) has progressed, and the connection methods of peripheral devices have also diversified. As a result, a general-purpose peripheral device interface applicable regardless of the type of personal computer is required, and a USB (Universal Serial Bus) interface has been proposed as an example of a specific standard. In addition, with the reduction in size and weight of various computers and the expansion of mobile (mobile) applications, removable external storage devices are also required. One of them is the popularity of USB memory, a device that can be easily connected to a personal computer with a USB interface. Is growing. (For example, refer to Patent Document 1).

  Specifically, a USB memory is a detachable device that has a flash memory element inside and is about the size of a human thumb, and is connected to a USB port (connection port) of a personal computer or the like with a USB connector provided at one end. It is recognized as a removable (removable) disk drive or the like and can be accessed for reading and writing.

  In particular, the Internet has become popular today, and there are more opportunities to rent and use computers that are different from the ones you normally use. For example, you can borrow time in the city, such as Internet cafes, workplaces, business partners, family, and friends. There are many cases where a person's personal computer such as an acquaintance sends / receives his / her mail or logs in to a favorite website.

  For example, in the case of sending and receiving e-mail, such a destination computer usually does not have the data and account information of his / her e-mail, and the type and version of the mailer (e-mail sending / receiving software) is also his / her own. It is not necessarily the same as your favorite one. It is also possible to send and receive emails by setting your account information on such other people's computers.

  In such a case, it is conceivable to set such account information to send and receive emails, but privacy problems arise due to such account information settings and forgetting to delete data in sent and received emails. Therefore, such account information, mailer, sent / received mail data, etc. are recorded in a USB memory and carried around.

  In other words, not only data but also software such as mailers and shortcuts to software can be placed in the USB memory. In addition to storing and browsing data, the USB memory is used to start such software. be able to.

  As a service using such a USB memory, there is a VPN service using the USB memory as an authentication key (see, for example, Non-Patent Document 1). This means that if there is an Internet environment, access to an in-house Web system is permitted safely, quickly and easily from anytime and anywhere via an authentication center.

This non-patent document 1 is intended for access to a specific in-house Web system, but in general, it is assumed that various server systems are accessed using a USB memory. . In addition, it is assumed that the user adds a server system that can be accessed independently according to the usage situation, or that the service provider provides a new accessible server system to the user. In addition, there has been a demand for a server system that can flexibly add services that can be provided to users.
JP 2002-41247 A “SSL-VPN service & USB authentication key“ Mobile ””, [online], NTT Comware Corporation, [May 10, 2004 search], Internet <URL: http://www.nttcom.co.jp/security /shouhin/mobilis/index.html>

  The present invention has been made in view of the above circumstances, and in a network system that provides various services to a user terminal equipped with the USB memory using the USB memory as an authentication key, it is possible to flexibly add services that can be provided. An object is to provide a service providing server.

  To achieve the above object, the service providing server according to claim 1 is based on certificate data transmitted from a user terminal when a USB memory storing certificate data is attached to the user terminal. A service providing server for providing a user-desired service to the user terminal to which an icon including link information for accessing the user-desired service is provided by the relay server, When there is a request for registration of the icon from the terminal, the certificate data and the password and user ID issued to the user are transmitted from the user terminal, based on the password and the user ID. When user authentication is performed and it is determined that the user can provide a service as a result of the user authentication, the certificate Stored in association with data and the password and the user ID, the to the relay server or the user terminal, characterized in that it comprises means for transmitting the icon.

  Further, the service providing server according to claim 2 is the service providing server according to claim 1, wherein the service providing server receives the password and the registration when the user terminal requests registration of the icon. A program for acquiring the user ID from the user terminal and transmitting the user ID to the service providing server is transmitted to the user terminal.

  The service providing server according to claim 3 is the service providing server according to claim 1, wherein the service providing server receives the certificate registration request from the user terminal. A program for acquiring data, the password, and the user ID from the user terminal and transmitting the data to the service providing server is transmitted to the user terminal.

  The service providing server according to claim 4 is the service providing server according to claim 1 to claim 3, wherein the service providing server selects the icon displayed on the user terminal by the user. In this case, identification information issued by the relay server and transmitted from the user terminal is transmitted to the relay server, and the relay server performs user authentication based on the identification data, and provides a service as a result of user authentication. If it is determined that the user is a possible user, the service desired by the user is provided to the user terminal.

  The service providing server according to claim 5 is the service providing server according to claim 1 to claim 3, wherein the service providing server selects the icon displayed on the user terminal by the user. When the user authentication is performed based on the certificate data transmitted at the time, and it is determined that the user can provide the service as a result of the user authentication, the service desired by the user is provided to the user terminal. And

  The service providing server according to claim 6 is the service providing server according to claims 1 to 3, wherein the service providing server selects the icon displayed on the user terminal by the user. If the user authentication is performed based on the encrypted password and the user ID transmitted at the time, and it is determined that the user can provide a service as a result of the user authentication, the user desired service is provided to the user terminal. It is characterized by providing.

  According to the present invention, since services that can be provided to the user can be flexibly added, the convenience of the user is improved.

  An embodiment of the present invention will be described with reference to FIGS.

  As shown in FIG. 1, the network system according to the present embodiment includes a user terminal 1, a USB memory 2 attached to the user terminal 1, a relay server 3, and a service providing server 4, which are connected to each other via the Internet 5. Is done.

  In the present embodiment, the service provided by the service providing server 4 includes a service for permitting access to a specific homepage (function as a Web server), a service for sending and receiving e-mail (function as an e-mail server), a specific file An upload and download service (function as an FTP server) and the like can be mentioned, but the invention is not limited to these.

  The user terminal 1 is a general-purpose computer and includes an I / O interface such as a CPU and a USB controller, a memory, a hard disk, a network interface, a video card, an optical disk drive, and the like, and software such as an OS, an API, a driver, and a component. And the application program can be executed. When the USB memory 2 is attached to the user terminal 1 and the automatic startup program in the USB memory 2 is read and executed, the USB access control unit 11, the server access unit 12, the icon display unit 13, the password acquisition unit 14, the certificate Each functional block of the data acquisition unit 15 and the address data acquisition unit 16 is realized.

  The USB access control unit 11 has a function of inputting / outputting various data to / from the data storage unit 23 of the USB memory 2, and the server access unit 12 is connected to the relay server 3 or the service providing server 4 via the Internet 5. And a function for transmitting and receiving various data.

  The icon display unit 13 has a function of displaying an icon on a display device included in the user terminal 1, and the password acquisition unit 14 has a function of acquiring a password and a user ID from the data storage unit 23 of the USB memory 2. This password and user ID are used when using a service in a conventional method using a Web browser, a mailer, or the like.

  The certificate data acquisition unit 15 has a function of acquiring certificate data from the data storage unit 23 of the USB memory 2, and the address data acquisition unit 16 has a function of acquiring address data from the data storage unit 23 of the USB memory 2. Have

  The USB memory 2 includes a USB controller 21, a memory controller 22, and a data storage unit 23.

  The USB controller 21 has a function of controlling input / output of data between the user terminal 1 and the USB memory 2, and further includes a recognition control unit 24 to store pseudo signal pattern data.

  When the USB memory 2 is attached to the user terminal 1, the recognition control unit 24 recognizes that the USB memory 2 is a storage device that uses a removable storage medium, for example, a CD-ROM drive. Therefore, it has a function of reading the pseudo signal pattern data and transmitting it to the user terminal 1.

  The memory controller 22 has a function of controlling input of various data to the data storage unit 23 and output of various data from the data storage unit 23.

  The data storage unit 23 is a storage device for storing various data such as an automatic start program, a password, a user ID, certificate data, address data, public key data, secret key data, and other user data, and includes a flash memory, an EEPROM Composed of etc.

  The automatic startup program is a program file that is automatically read and executed by the user terminal 1 when the USB memory 2 is attached to the user terminal 1 and the USB memory 2 is recognized as a CD-ROM drive. When executed, each function of the above-described USB access control unit 11, server access unit 12, icon display unit 13, password acquisition unit 14, certificate data acquisition unit 15, and address data acquisition unit 16 is added to the user terminal 1. Is realized. The file format of this automatic startup program depends on the OS.

  The address data is address data of a transmission destination when transmitting various data to the relay server 3, URL of a home page provided by the service providing server 4, data of a transmission destination address of an e-mail, etc. At least to the relay server 3. It is assumed that the address data of the transmission destination when transmitting various data is recorded in the data storage unit 23 in advance.

  The public key data is data of a public key among a pair of keys used in the public key cryptosystem, and is recorded in the data storage unit 23 in advance.

  The secret key data is data of a key that is not disclosed out of a pair of keys used in the public key cryptosystem, and is recorded in the data storage unit 23 in advance.

  The certificate data is data certifying that the public key data for electronic signature analysis issued by the certificate authority is authentic, and the certificate data required for each service providing server 4 is stored in advance in the data storage unit 23. It shall be recorded in

  The relay server 3 includes a transmission / reception unit 31, an authentication unit 32, a service ID issuing unit 33, a one-time key issuing unit 34, and an icon issuing unit 35.

  The transmission / reception unit 31 has a function of transmitting / receiving various data to / from the user terminal 1 and the service providing server 4 via the Internet 5.

The authentication unit 32 performs an authentication process based on the certificate data transmitted from the user terminal 1 and determines whether or not to permit access from the user terminal 1 to the service providing server 4. It has a function of issuing a service ID for identifying the service to a user who intends to use the service provided by the service providing server 4.

  The one-time key issuing unit 34 has a function of temporarily issuing a one-time key to a user who intends to use a service provided by the service providing server 4 in order to authenticate the user.

  The icon issuing unit 35 has a function of issuing an icon including link information to the service providing server 4.

  The service ID is identification information for identifying a service provided by the service providing server 4.

  The one-time key is identification information temporarily issued to permit access to the service providing server 4 and is deleted from the relay server 3 after a predetermined time has elapsed.

  The transmission / reception of various data between the user terminal 1 and the relay server 3 and the transmission / reception of various data between the user terminal 1 and the service providing server 4 are performed according to the rules of a remote file transfer protocol such as HTTP. It is assumed that the message is inserted into the HTTP message header and transmitted / received.

<< Recognition process when the USB memory 2 is attached to the user terminal 1 >>
When the USB memory 2 is attached to the user terminal 1, the recognition process is started. When the user terminal 1 detects that the USB memory 2 is attached to the connection terminal, the user terminal 1 requests identification data for identifying the device attached to the connection terminal from the USB memory 2. Then, the recognition control unit 24 of the USB controller 21 reads the pseudo signal pattern data and sends it as identification data to the user terminal 1 so that the USB memory 2 is recognized as a CD-ROM drive, for example.

  When receiving the identification data, the user terminal 1 recognizes the attached USB memory 2 as a CD-ROM drive. Thereafter, the user terminal 1 can read various data stored in the USB memory 2.

  Since this recognition process is general and will not be described in detail, if the USB memory 2 is recognized as a CD-ROM drive, it is natural that data cannot be written to the USB memory 2. Therefore, when data is written to the USB memory 2, it is necessary to be recognized as another device, for example, a device capable of writing data, such as a CD-R / W.

<< Start-up process of automatic start program after USB memory 2 recognition-part 1 >>
First, the process (the 1) at the time of using the service which the service provision server 4 provides from the user terminal 1 is demonstrated using the sequence diagram of FIG.

  When the USB memory 2 is attached to the user terminal 1 and recognized, the user terminal 1 reads and starts the automatic startup program stored in the USB memory 2 (step S01). When the automatic startup program is started, the functions shown in FIG. 1 are realized on the user terminal 1 by the CPU, OS, and the like. Hereinafter, description will be made based on the functional configuration of FIG.

  After the automatic startup program is started, the certificate data acquisition unit 15 acquires the certificate data required by the relay server 3 recorded in the data storage unit 23 of the USB memory 2, and the address data acquisition unit 16 acquires the address data of the relay server 3 among the address data recorded in the data storage unit 23 of the USB memory 2. The server access unit 12 transmits the certificate data acquired by the certificate data acquisition unit 15 to the relay server 3 using the address data acquired by the address data acquisition unit 16 as a transmission destination (step S02). At this time, the server access unit 12 acquires the type and version information of the OS and the resolution information of the display device, and transmits them to the relay server 3 together with the certificate data.

  When the transmission / reception unit 31 of the relay server 3 receives the certificate data, the authentication unit 32 performs an authentication process based on the received certificate data, and permits access from the user terminal 1 to the service providing server 4 desired by the user. Is determined (step S03). When permitting access to the service providing server 4, the one-time key issuing unit 34 of the relay server 3 issues a new one-time key, and the icon issuing unit 35 displays link information to the service providing server 4. Publish an icon containing it. The transmitting / receiving unit 31 transmits the one-time key issued by the one-time key issuing unit 34 and the icon issued by the icon issuing unit 35 to the user terminal 1 (step S04). At this time, the icon is transmitted to the user terminal 1 in an optimal image file format in accordance with the OS type, version information, and display device resolution information.

  When the server access unit 12 of the user terminal 1 receives the one-time key and the icon, the icon display unit 13 displays the received icon on the display device (step S05). When the user selects an icon displayed on the display device (step S06), the server access unit 12 transmits a one-time key to the service providing server 4 using the link information included in the icon as a transmission destination (step S07). ).

  When receiving the one-time key from the user terminal 1, the service providing server 4 transmits the received one-time key to the relay server 3 (step S08).

  When the transmission / reception unit 31 of the relay server 3 receives the one-time key from the service providing server 4, the authentication unit 32 determines whether the received one-time key is the one-time key issued in step S04 first, It is determined whether or not access from the user terminal 1 to the service providing server 4 is permitted (step S09). When permitting access to the service providing server 4, the authenticating unit 32 returns a message to the effect that permitting access from the user terminal 1 to the service providing server 4 to the service providing server 4 (step S10).

  When the service providing server 4 receives a message to permit access from the relay server 3, the service providing server 4 returns a message to permit access to the service providing server 4 to the user terminal 1 (step S11).

  When the server access unit 12 of the user terminal 1 receives a message indicating that access is permitted from the service providing server 4, the server access unit 12 performs predetermined processing to receive a desired service such as access to a specific home page or transmission / reception of an e-mail. Execute (Step S12).

  In step S03, if there is any defect in the certificate data and access to the service providing server 4 is not permitted, the relay server 3 performs a predetermined process for interrupting access from the user terminal 1 (step S03). S13).

  If there is any defect in the one-time key in step S14 and access to the service providing server 4 is not permitted, the relay server 3 performs a predetermined process for interrupting access from the user terminal 1 (step S14). S14).

<< Start-up process of automatic start program after USB memory 2 recognition-part 2 >>
Processing (part 2) when using the service provided by the service providing server 4 from the user terminal 1 will be described with reference to the sequence diagram of FIG.

  When the USB memory 2 is attached to the user terminal 1 and recognized, the user terminal 1 reads and starts the automatic startup program stored in the USB memory 2 (step S21).

  After the automatic startup program is started, the certificate data acquisition unit 15 acquires the certificate data required by the relay server 3 recorded in the data storage unit 23 of the USB memory 2, and the address data acquisition unit 16 acquires the address data of the relay server 3 among the address data recorded in the data storage unit 23 of the USB memory 2. The server access unit 12 transmits the certificate data acquired by the certificate data acquisition unit 15 to the relay server 3 using the address data acquired by the address data acquisition unit 16 as a transmission destination (step S22). At this time, the server access unit 12 acquires the type and version information of the OS and the resolution information of the display device, and transmits them to the relay server 3 together with the certificate data.

  When the transmission / reception unit 31 of the relay server 3 receives the certificate data, the authentication unit 32 performs an authentication process based on the received certificate data, and permits access from the user terminal 1 to the service providing server 4 desired by the user. It is determined whether or not (step S23). When permitting access to the service providing server 4, the icon issuing unit 35 issues an icon including link information to the service providing server 4. The transmission / reception unit 31 transmits the icon issued by the icon issuing unit 35 to the user terminal 1 (step S24). At this time, the icon is transmitted to the user terminal 1 in the form of a predetermined image file. At this time, the icon is transmitted to the user terminal 1 in an optimal image file format in accordance with the OS type, version information, and display device resolution information.

  When the server access unit 12 of the user terminal 1 receives the one-time key and the icon, the icon display unit 13 displays the received icon on the display device (step S25). When the user selects an icon displayed on the display device (step S26), the certificate data acquisition unit 15 acquires the certificate data required by the service providing server 4 from the data storage unit 23 of the USB memory 2, and the server The access unit 12 transmits the certificate data to the service providing server 4 using the link information included in the icon as the transmission destination (step S27).

  The service providing server 4 performs an authentication process based on the received certificate data, and determines whether or not to permit access from the user terminal 1 to the service providing server 4 (step S28). When permitting access to the service providing server 4, the service providing server 4 returns a message to permit access to the service providing server 4 to the user terminal 1 (step S29).

  When the server access unit 12 of the user terminal 1 receives a message indicating that access is permitted from the service providing server 4, the server access unit 12 performs predetermined processing to receive a desired service such as access to a specific home page or transmission / reception of an e-mail. Execute (Step S30).

  If there is any defect in the certificate data in step S23 and access to the service providing server 4 is not permitted, the relay server 3 performs a predetermined process for interrupting access from the user terminal 1 (step S23). S31).

  In step S28, if there is any defect in the certificate data and access to the service providing server 4 is not permitted, the service providing server 4 performs a predetermined process for interrupting access from the user terminal 1 ( Step S32).

<< Start-up process of automatic start program after USB memory 2 recognition-part 3 >>
Processing (part 3) when using the service provided by the service providing server 4 from the user terminal 1 will be described with reference to the sequence diagram of FIG.

  When the USB memory 2 is attached to the user terminal 1 and recognized, the user terminal 1 reads and starts the automatic startup program stored in the USB memory 2 (step S41).

  After the automatic startup program is started, the certificate data acquisition unit 15 acquires the certificate data required by the relay server 3 recorded in the data storage unit 23 of the USB memory 2, and the address data acquisition unit 16 acquires the address data of the relay server 3 among the address data recorded in the data storage unit 23 of the USB memory 2. The server access unit 12 transmits the certificate data acquired by the certificate data acquisition unit 15 to the relay server 3 using the address data acquired by the address data acquisition unit 16 as a transmission destination (step S42). At this time, the server access unit 12 acquires the type and version information of the OS and the resolution information of the display device, and transmits them to the relay server 3 together with the certificate data.

  When the transmission / reception unit 31 of the relay server 3 receives the certificate data, the authentication unit 32 performs an authentication process based on the received certificate data, and permits access from the user terminal 1 to the service providing server 4 desired by the user. Is determined (step S43). When permitting access to the service providing server 4, the icon issuing unit 35 issues an icon including link information to the service providing server 4. The transmission / reception unit 31 transmits the icon issued by the icon issuing unit 35 to the user terminal 1 (step S44). At this time, the icon is transmitted to the user terminal 1 in the form of a predetermined image file. At this time, the icon is transmitted to the user terminal 1 in an optimal image file format in accordance with the OS type, version information, and display device resolution information.

  When the server access unit 12 of the user terminal 1 receives the one-time key and the icon, the icon display unit 13 displays the received icon on the display device (step S45). When the user selects the icon displayed on the display device (step S46), the server access unit 12 transmits a request for the encrypted password and the service ID for accessing the service providing server 4 to the relay server 3. (Step S47).

  When the service ID issuing unit 33 of the relay server 3 receives the request for the encrypted password and service ID via the transmission / reception unit 31, the service ID issuance unit 33 issues the service ID and then encrypts the password and the service ID. The encrypted password and service ID are returned to the user terminal 1 via 31 (step S48).

  The server access unit 12 of the user terminal 1 decrypts the received encrypted password and service ID (step S49). At this time, the USB access control unit 11 acquires public key data from the USB memory 2 and supplies it to the server access unit 12. The server access unit 12 transmits the decrypted password and service ID to the service providing server 4 (step S50).

  The service providing server 4 performs an authentication process based on the received password and service ID, and determines whether to permit access from the user terminal 1 to the service providing server 4 (step S51). When permitting access to the service providing server 4, the service providing server 4 returns a message to permit access to the service providing server 4 to the user terminal 1 (step S52).

  When the server access unit 12 of the user terminal 1 receives a message indicating that access is permitted from the service providing server 4, the server access unit 12 performs predetermined processing to receive a desired service such as access to a specific home page or transmission / reception of an e-mail. Execute (step S53).

  In step S43, if there is any defect in the certificate data and access to the service providing server 4 is not permitted, the relay server 3 performs a predetermined process for interrupting access from the user terminal 1 (step S43). S54).

  In step S51, if there is any defect in the certificate data and access to the service providing server 4 is not permitted, the service providing server 4 performs a predetermined process for interrupting access from the user terminal 1 ( Step S55).

  If the USB memory 2 has a decryption function, the USB access control unit 11 stores the encrypted password and service ID received by the server access unit 12 in the USB memory 2 in the process of step S49. The password and the service ID decrypted by the USB memory 2 are supplied to the server access unit 12.

  As described above, by attaching the USB memory 2 to the user terminal 1, the automatic startup program is automatically executed, and the service providing server 4 performs user-desired processing such as access to a specific home page and transmission / reception of e-mail. It becomes possible to request.

  When the above-described activation process is performed, for example, in step S06, an icon for activating a user-desired process is displayed on the display device of the user terminal 1, and a plurality of these icons are displayed. The automatic startup program that can access the plurality of service providing servers 4 and the plurality of certificate data may be recorded in the data storage unit 23 of the USB memory 2 in advance.

  In the above-described startup process, the automatic startup program can access only the service providing server 4 set in advance. For example, when adding a user-desired service later, an icon registration process is performed. Is called. The details are shown below. It is assumed that a server ID is issued and notified from the relay server 3 to the service providing server 4 prior to the icon registration process.

≪Icon registration process-part 1≫
An icon registration process (part 1) when a service provided by the service providing server 4 is newly used from the user terminal 1 will be described with reference to the sequence diagram of FIG.

  In this icon registration process-part 1, the user is registered in advance in the service providing server 4, a user ID and password are issued, and a service provided by a normal procedure that does not require the USB memory 2 is provided. It is assumed that it can be used (logged in).

  When the USB memory 2 is attached to the user terminal 1 and recognized, the user terminal 1 reads and starts an automatic activation program stored in the USB memory 2. Then, after predetermined processing is performed, as shown in FIG. 6A, a screen for inputting an icon and a server ID is displayed on the display device of the user terminal 1 (step S61). The icon shown in FIG. 6A is for accessing the service providing server 4 set in advance.

  The server ID is identification information for identifying the service providing server 4 that provides a new service that the user intends to use. When the user inputs the server ID of the service providing server 4 that provides the desired service and selects the send button (step S62), the server access unit 12 of the user terminal 1 receives the server ID input to the relay server 3. Is transmitted (step S63).

  When the transmission / reception unit 31 of the relay server 3 receives the server ID, the authentication unit 32 returns the URI of the destination to which the certificate data is sent in order to register the service providing server 4 indicated by the received server ID (step). S64).

  When receiving the certificate data destination URI from the relay server 3, when the authentication data acquisition unit acquires the certificate data from the data storage unit 23 of the USB memory 2, the server access unit 12 of the user terminal 1 transmits the URI. The certificate data is transmitted as the destination (step S65). When the service providing server 4 receives the certificate data, the service providing server 4 returns the URL of the homepage for password input (step S66).

  When the server access unit 12 of the user terminal 1 receives the URL of the password input homepage from the service providing server 4, the server 5 accesses the Internet 5 based on the URL and displays the password input homepage (step S67). FIG. 6B shows an example in which a password input home page is displayed. When the user inputs the user ID and password and selects the send button (step S68), the server access unit 12 transmits the input user ID and password to the service providing server 4 (step S69).

  Upon receiving the user ID and password, the service providing server 4 performs user authentication based on the received user ID and password, and determines whether or not to permit icon registration (step S70). When the registration of the icon is permitted, the certificate data received in advance, the password and the user ID are recorded in association with each other (step S71), and an icon including link information for providing a user-desired service is displayed on the user terminal 1. And also to the relay server 3 (step S72). At this time, the icon is transmitted to the user terminal 1 in an optimal image file format.

  When the transmission / reception unit 31 of the relay server 3 receives the icon, the authentication unit 32 records the received icon in association with the user who previously sent the certificate data destination URI (step S73). When the server access unit 12 of the user terminal 1 receives the icon, the USB access control unit 11 records the icon in the data storage unit 23 of the USB memory 2 (step S74). Moreover, the icon display part 13 of the user terminal 1 displays the received icon on a display device (step S75). FIG. 6C shows a state where an icon is newly added. In FIG. 6C, when the user selects an icon “NEW!”, The above-described automatic activation program activation processing is performed, and it becomes possible to request a service desired by the user.

  Note that only one of the processes of step S74 and step S75 may be performed. In step S70, if the password and the user ID are incomplete and the icon registration is not permitted, the service providing server 4 performs a predetermined process for interrupting access from the user terminal 1 (step S76). .

≪Icon registration process-part 2≫
The icon registration process (part 2) when a service provided by the service providing server 4 from the user terminal 1 is newly used will be described with reference to the sequence diagram of FIG.

  In this icon registration process-part 2, the user is registered in advance in the service providing server 4, a user ID and password are issued, and a service provided by a normal procedure that does not require the USB memory 2 is provided. It can be used but it is not logged in. Further, it is assumed that the USB memory 2 is attached to the user terminal 1.

  First, the user terminal 1 displays a hyperlink including a server ID on a display device based on a predetermined URL (step S81). The underlined portion in FIG. 8A is a hyperlink for accessing the service providing server 4. When the user selects this hyperlink (step S82), the user terminal 1 transmits a server ID to the service providing server 4 (step S83).

  Upon receiving the server ID, the service providing server 4 transmits a program for automatically transmitting certificate data to the user terminal 1 (step S84). When the user terminal 1 receives a program from the service providing server 4, the user terminal 1 executes the program. When this program is executed, the server access unit 12, USB access control unit 11, icon display unit 13, and certificate data acquisition unit 15 shown in FIG. 1 are realized. Further, it is assumed that the sending destination URI of certificate data to the service providing server 4 is set in advance in the program.

  When the program is executed and the certificate data acquisition unit 15 acquires the certificate data from the data storage unit 23 of the USB memory 2, the server access unit 12 of the user terminal 1 uses the preset URI as a certificate as a certificate. Data is transmitted (step S86). When the service providing server 4 receives the certificate data, the service providing server 4 returns the URL of the homepage for inputting the password (step S87).

  When the server access unit 12 of the user terminal 1 receives the URL of the password input homepage from the service providing server 4, the server 5 accesses the Internet 5 based on the URL and displays the password input homepage (step S88). FIG. 8B shows an example in which a password input home page is displayed. When the user inputs the user ID and password and selects the send button (step S89), the server access unit 12 transmits the input user ID and password to the service providing server 4 (step S90).

  Upon receiving the user ID and password, the service providing server 4 performs user authentication based on the received user ID and password, and determines whether or not to permit icon registration (step S91). When the registration of the icon is permitted, the certificate data received in advance, the password and the user ID are recorded in association with each other (step S92), and an icon including link information for providing a user-desired service is displayed on the user terminal 1. And also to the relay server 3 (step S93). At this time, the icon is transmitted to the user terminal 1 in an optimal image file format.

  When the transmission / reception unit 31 of the relay server 3 receives the icon, the authentication unit 32 records the received icon in association with the user who has previously returned the certificate data destination URI (step S94). When the server access unit 12 of the user terminal 1 receives the icon, the USB access control unit 11 records the icon in the data storage unit 23 of the USB memory 2 (step S95). Moreover, the icon display part 13 of the user terminal 1 displays the received icon on a display device (step S96). FIG. 8C shows a state where an icon is newly added. In FIG. 8C, when the user selects an icon “NEW!”, The above-described automatic activation program activation process is performed, and the user-desired service can be requested.

  Note that only one of the processes of step S94 and step S95 may be performed. In step S91, if the password and the user ID are incomplete and the registration of the icon is not permitted, the service providing server 4 performs a predetermined process for interrupting access from the user terminal 1 (step S97). .

≪Icon registration process-part 3≫
An icon registration process (No. 3) when a service provided by the service providing server 4 is newly used from the user terminal 1 will be described with reference to the sequence diagram of FIG. In this icon registration process-part 3, the user is registered in advance in the service providing server 4, a user ID and password are issued, and a service provided by a normal procedure that does not require the USB memory 2 is provided. It is assumed that it can be used. Further, it is assumed that the USB memory 2 is attached to the user terminal 1.

  First, the user terminal 1 displays a hyperlink including a server ID on a display device based on a predetermined URL (step S101). The underlined portion in FIG. 10A is a hyperlink for accessing the service providing server 4. When the user selects this hyperlink (step S102), the user terminal 1 transmits a server ID to the service providing server 4 (step S103).

  Upon receiving the server ID, the service providing server 4 transmits a program for automatically transmitting certificate data, a password, and a user ID to the user terminal 1 (step S104). When the user terminal 1 receives a program from the service providing server 4, the user terminal 1 executes the program. When this program is executed, the server access unit 12, USB access control unit 11, icon display unit 13, password acquisition unit 14, and certificate data acquisition unit 15 shown in FIG. 1 are realized. Further, it is assumed that a sending destination URI of certificate data to the service providing server 4 is set in advance in this program.

  When the program is executed, the password acquisition unit 14 acquires the password and the user ID from the data storage unit 23 of the USB memory 2, and the certificate data acquisition unit 15 acquires the certificate data from the data storage unit 23 of the USB memory 2. The server access unit 12 of the user terminal 1 transmits certificate data, a password, and a user ID from the USB memory 2 using a preset URI as a transmission destination (step S106).

  Upon receiving the certificate data, password, and user ID, the service providing server 4 records the certificate data, password, and user ID in association with each other (step S107), and provides link information for providing the user-desired service. The included icon is transmitted to the user terminal 1 and also transmitted to the relay server 3 (step S108). At this time, the icon is transmitted to the user terminal 1 in an optimal image file format. Note that only one of the processes of step S109 and step S110 may be performed.

  When the transmission / reception unit 31 of the relay server 3 receives the icon, the authentication unit 32 records the received icon in association with the user who previously sent the certificate data destination URI (step S109). When the server access unit 12 of the user terminal 1 receives the icon, the USB access control unit 11 records the icon in the data storage unit 23 of the USB memory 2 (step S110). Moreover, the icon display part 13 of the user terminal 1 displays the received icon on a display device (step S111). FIG. 10B shows a state where an icon is newly added. In FIG. 10B, when the user selects an icon “NEW!”, The above-described automatic activation program activation process is performed, and it becomes possible to request a service desired by the user.

It is a figure which shows the system configuration | structure and functional structure in this embodiment. It is a sequence diagram which shows the starting process (the 1) of the automatic starting program after USB memory recognition. It is a sequence diagram which shows the starting process (the 2) of the automatic starting program after USB memory recognition. FIG. 12 is a sequence diagram showing a startup process (part 3) of an automatic startup program after USB memory recognition. It is a sequence diagram which shows the process at the time of registering an icon (the 1). It is a figure which shows the transition of the screen display (the 1) at the time of registering an icon. It is a sequence diagram which shows the process at the time of registering an icon (the 2). It is a figure which shows the transition of the screen display (the 2) at the time of registering an icon. It is a sequence diagram which shows the process at the time of registering an icon (the 3). It is a figure which shows the transition of the screen display (the 3) at the time of registering an icon.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... User terminal (computer), 2 ... USB memory, 3 ... Relay server, 4 ... Service provision server, 5 ... Internet, 11 ... USB access control part, 12 ... Server access part, 13 ... Icon display part, 14 ... Password Acquisition unit, 15 ... certificate data acquisition unit, 16 ... address data acquisition unit, 21 ... USB controller, 22 ... memory controller, 23 ... data storage unit, 24 ... recognition control unit, 31 ... transmission / reception unit, 32 ... authentication unit, 33 ... Service ID issuing unit, 34 ... One-time key issuing unit, 35 ... Icon issuing unit

Claims (6)

When a USB memory for storing certificate data is attached to a user terminal, a user authentication is performed by the relay server based on the certificate data transmitted from the user terminal, and a link for accessing a service desired by the user A service providing server that provides a service desired by the user to the user terminal to which an icon including information is supplied,
When there is a registration request for the icon from the user terminal,
When the certificate data and the password and user ID issued to the user are transmitted from the user terminal, user authentication is performed based on the password and the user ID,
As a result of user authentication, if it is determined that the user can provide the service, the certificate data, the password, and the user ID are stored in association with each other,
A service providing server comprising means for transmitting the icon to the relay server or the user terminal. The service providing server includes:
When there is a registration request for the icon from the user terminal,
The service providing server according to claim 1, wherein a program for acquiring the password and the user ID from the user terminal and transmitting the password and the user ID to the service providing server is transmitted to the user terminal. The service providing server includes:
When there is a registration request for the icon from the user terminal,
The service providing server according to claim 1, wherein a program for acquiring the certificate data, the password, and the user ID from the user terminal and transmitting the certificate data, the password, and the user ID to the service providing server is transmitted to the user terminal. The service providing server includes:
When the user selects the icon displayed on the user terminal, the identification information issued by the relay server and transmitted from the user terminal is transmitted to the relay server, and the relay server transmits the identification data. The user authentication is performed based on the user authentication, and if it is determined that the user can provide the service as a result of the user authentication, the service desired by the user is provided to the user terminal. The service providing server according to any one of claims. The service providing server includes:
When user authentication is performed based on the certificate data transmitted when the user selects the icon displayed on the user terminal, and it is determined that the user can provide a service as a result of user authentication, the user terminal The service providing server according to any one of claims 1 to 3, wherein the service desired by the user is provided. The service providing server includes:
The user is authenticated based on the encrypted password and the user ID transmitted when the user selects the icon displayed on the user terminal, and as a result of user authentication, the user can provide a service. The service providing server according to any one of claims 1 to 3, wherein if determined, the service desired by the user is provided to the user terminal.

Images