JP2006185110A - Authentication system, authentication server and authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To determine whether to permit an operation using a communication terminal, without requiring preliminary databasing of information necessary for authentication. <P>SOLUTION: An authentication server 11 determines whether data received from a cellular telephone 4 are two-dimensional code data on an authentication plate 21 or two-dimensional code data on an article plate 22. If the authentication plate 21 is identified, terminal-specific information and task execution location identification data in the data are stored in an access permission table. If the article plate 22 is identified, the access permission table is searched for the terminal-specific information in the data. If it is found, screen information indicating an operation start is sent to the communication terminal. If not, screen information indicating access denial is sent to the communication terminal. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an authentication technique for determining whether to permit a job using a communication terminal such as a mobile phone.

As a conventional authentication technology of this type, an identification code displayed on a medium is captured by a communication terminal and image data is captured. The image data of the identification code is converted into a signal, and the signal is converted into an identification code decoding device. Transmitting to the communication terminal, decrypting the authentication data stored in the database of the identification code decrypting device with the image data, converting the decrypted data into a signal, and transmitting the signal to the communication terminal; A method is known that includes receiving a decrypted authentication result and displaying identification information on a display unit of a communication terminal (see, for example, Patent Document 1).
JP 2004-297440 A

  In the conventional authentication technology as described above, in order to recognize various identification information related to personal authentication or product names using the identification code, the identification information and the identification code corresponding to the identification information are previously stored in the information manager. Had to be stored in the database.

  The present invention has been made based on such circumstances, and an object of the present invention is an authentication technique for determining whether to permit a job using a communication terminal without previously storing information necessary for authentication in a database. That is, an authentication system, an authentication server, and an authentication method are to be provided.

  The authentication system of the present invention includes a communication terminal and an authentication server that determines whether to permit a job using the communication terminal. The communication terminal can read the authentication code including the connection information to the authentication server and the identification data of the job execution location, and the code for reading the business code including the connection information to the authentication server and the identification data of the job target. Means, analyzing the code read by the code reading means to obtain connection information and identification data to the authentication server, and connecting to the authentication server based on the connection information acquired from the code analysis means A connection requesting unit for performing authentication, a data transmitting unit for transmitting the identification data acquired by the code analyzing unit to the authentication server together with the terminal-specific information held in advance when connected to the authentication server, and a screen responding from the authentication server Display control means for displaying the information on the display unit, and the authentication server receives the data received from the communication terminal as identification data of a business execution location. Data judging means for judging whether the authentication request data includes the identification data of the business object or the data for identifying the business object, and if the data judging means determines that the authentication request data has been received, the terminal in the data It is determined that the business activation request data is received by the authentication processing means for storing the unique information and the identification data of the business execution location in the access permission table and transmitting screen information indicating access permission to the communication terminal, and the data judging means. Then, a table search means for searching whether the terminal specific information in the data exists in the access permission table, and when the table search means confirms that the terminal specific information exists in the access permission table, it indicates an operation start. The task start processing means for transmitting screen information to the communication terminal and the table search means for the terminal specific information There is obtained; and a inaccessible processing means for transmitting the screen information indicating the inaccessible is confirmed that there is no access permission table to the communication terminal.

  An authentication server according to the present invention includes a code reading unit capable of reading an authentication code including server connection information and business execution location identification data, and a business code including server connection information and business target identification data. Code analysis means for analyzing the code read by the reading means to obtain server connection information and identification data, connection request means for connecting to the server based on the connection information obtained from the code analysis means, and connected to the server Then, a communication terminal including a data transmission unit that transmits the identification data acquired by the code analysis unit to the server together with the terminal-specific information that is held in advance, and a display control unit that displays the screen information returned from the server on the display unit An authentication server that determines whether or not to permit a job that uses a client, and the received data from the communication terminal is used to identify the job execution location. Data determination means for determining whether the authentication request data includes the data or the business start request data including the identification data of the business object, and when the data determination means determines that the authentication request data has been received, It is determined that the application start request data is received by the authentication processing means for storing the terminal specific information and the identification data of the business execution location in the access permission table and transmitting screen information indicating access permission to the communication terminal, and the data judging means. Then, the table search means for searching whether the terminal specific information in the data exists in the access permission table, and when the table search means confirms that the terminal specific information exists in the access permission table, the operation start is indicated. Terminal-specific information by means of business start processing means for sending screen information to the communication terminal and table search means When it is confirmed that does not exist in the access permission table is obtained by including a inaccessible processing means for transmitting the screen information indicating refusal of access to the communication terminal.

  An authentication method according to the present invention is an authentication method for determining whether or not a business using a communication terminal is permitted by using an authentication server capable of communicating with the communication terminal, the communication terminal including connection information to the authentication server and a business execution location. When the authentication code including the identification data is read by the code reading means, the code is analyzed to obtain the connection information to the authentication server and the job execution location identification data. Based on the acquired connection information, the authentication server When the connection is established and the authentication server is connected, the acquired business execution location identification data and the terminal-specific information held in advance are transmitted to the authentication server as authentication request data. Next, when the authentication server receives the authentication request data from the communication terminal, the authentication server stores the terminal specific information and the job execution location identification data in the data in the access permission table and transmits screen information indicating access permission to the communication terminal. To do. Next, when the communication terminal reads the business code including the connection information to the authentication server and the business object identification data by the code reading unit, the communication terminal analyzes the code and connects the authentication server to the authentication server and the business object identification data. Are connected to the authentication server based on the acquired connection information, and when connected to the authentication server, the acquired business object identification data and the terminal-specific information held in advance are authenticated as the business activation request data. Send to server. Next, when the authentication server receives the job activation request data from the communication terminal, the authentication server searches the access permission table for the terminal-specific information in the data, and screen information indicating the job activation when the existence is confirmed. Is transmitted to the communication terminal, and when it is confirmed that it does not exist, screen information indicating that access is not possible is transmitted to the communication terminal.

  According to the present invention in which such measures are taken, an authentication technique that can determine whether or not to permit a task using a communication terminal without storing information necessary for authentication in a database in advance, that is, an authentication system, an authentication server, and an authentication method Can be provided.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
In this embodiment, an article management operation for centrally managing articles (POS terminals, copiers, merchandise display shelves, microwave ovens, fixtures, etc.) installed in each store at the article management center is started. Sometimes the authentication technique of the present invention is applied.

  FIG. 1 is a system configuration diagram for realizing the article management work of the present embodiment. In the figure, reference numeral 1 indicates an article management center, and reference numeral 2 indicates a store which is a business execution place.

  The article management center 1 is provided with an authentication server 11 and a database server 12, and the servers 11 and 12 are connected by a LAN (Local Area Network) 13. The authentication server 11 has a function as a web server published on the web, and can be accessed by designating a predetermined URL (Uniform Resource Name) via the Internet 3. The database server 12 manages a database 50 (see FIG. 10) for storing article management data for each store 2.

  In the store 2, an authentication plate 21 and an article plate 22 for each article are prepared. The authentication plate 21 is managed by a store manager such as a store manager. Each article plate 22 is attached to each article, which is the object of the article management business, in a one-to-one correspondence. On the authentication plate 21, the name of the store where the authentication plate 21 is prepared and the two-dimensional code 23a are displayed. Each article plate 22 displays the name of the article to which the article plate 22 is attached and a two-dimensional code 23b.

  As shown in FIG. 2, the two-dimensional code 23a, 23b is a symbol that represents a character / numerical string in a vertical and horizontal pattern. In this embodiment, the two-dimensional code 23a, 23b is a URL, an identification code, and the like. In addition, letters and numbers of each item are expressed in the order of the identification names. The URL is the URL of the authentication server 11 and functions as connection information to the authentication server 11.

  In the case of the two-dimensional code 23a of the authentication plate 21, the identification code is composed of the upper 6-digit fixed code [000000] and the lower 6-digit store code [SSSSSS], and in the case of the two-dimensional code 23b of the article plate 22 It consists of a fixed code [20] of the upper 2 digits and an article code [XXXXXXXXXXXXX] of the lower 11 digits. The store code is an identification code of a store where the authentication plate 21 is prepared, and means identification data of a business execution place. The article code is an identification code of an article to which the article plate 22 is attached, and means business object identification data. Note that the number of digits of each code is not limited to the present embodiment, and can be appropriately changed by the user as needed.

  The identification name is a fixed name “for authentication” in the case of the two-dimensional code 23a of the authentication plate 21, and in the case of the two-dimensional code 23b of the article plate 22, the unique name of the article to which the plate 2 is attached (for example, POS). Terminal, copier, etc.). Here, the two-dimensional code 23a of the authentication plate 21 functions as an authentication code. The two-dimensional code 23b of the article plate 22 functions as a business code.

  In FIG. 1, reference numeral 4 denotes a mobile phone. This mobile phone 4 is equipped with a camera. The camera has a two-dimensional code reader function (code reading means) for reading the two-dimensional codes 23a and 23b using the camera. The mobile phone 4 also has a browser function for accelerating to various websites from the nearest access point 5 via the Internet 3 and browsing web pages.

  The cellular phone 4 having such a function is owned by an article management person who goes to the store 2 and checks the articles installed in the store 2. When the person in charge of article management arrives at the store 2 to be managed, first, the person in charge of the article performs an operation for reading the two-dimensional code 23a of the authentication plate 21 prepared in the store. That is, the two-dimensional code reader function of the mobile phone 4 is activated.

  Thereby, in the mobile phone 4, as shown in ST (step) 1 in FIG. 5, the timer is started at the same time when the camera operates to start reading the two-dimensional code 23a. When the two-dimensional code 23a is displayed in the imaging area of the camera and the two-dimensional code 23a is read within 5 seconds, for example, when the timer times out (see screen 31 in FIG. 3), the cellular phone 4 5, the read two-dimensional code 23a is analyzed to obtain character / numeric string information (code analysis means).

  Here, when the URL is included in the character / numeric string information obtained from the two-dimensional code 23a, the cellular phone 4 displays the character / numeric string information on the display unit as shown in ST3 of FIG. (See screen 32 in FIG. 3). Here, when the “Return” function key is operated, the mobile phone 4 reads the two-dimensional code again.

  On the other hand, when the “connect” function key is operated, the mobile phone 4 starts a browser as shown in ST4 of FIG. 5, and the URL included in the character / numeric string information of the two-dimensional code 23a is displayed. An access request signal to the designated website is transmitted (connection request means).

  This access request signal is transmitted from the nearest access point 5 to the authentication server 11 of the article management center 1 via the Internet 3.

  As a result, the authentication server 11 determines the telephone company of the cellular phone 4 from the cellular phone company code incorporated in the access request signal, as shown in ST11 of FIG. Then, a telephone information request command corresponding to the telephone company is generated, and an authentication start page including the telephone information request command is edited. Then, as shown in ST12 of FIG. 6, this authentication start page signal is transmitted via the Internet 3 to the mobile phone 4 that has requested access.

  In the mobile phone 4 that has received the authentication start page signal, the authentication start page, which is a response page screen, is displayed on the display unit as shown in ST5 of FIG. 5 (see screen 33 of FIG. 3).

  That is, the person in charge of article management performs an operation of reading the two-dimensional code 23a of the authentication plate 21 with the mobile phone 4, and the two-dimensional code 23a is read and the contents (URL, store code and fixed name “for authentication”) are read. If displayed on the screen 32, the "connect" function key is operated. Then, the mobile phone 4 is connected to the authentication server 11 and the authentication start page screen 33 is displayed. Therefore, the person in charge of article management clicks the [OK] button on the screen 33.

  Thereby, in the mobile phone 4, as shown in ST6 of FIG. 5, a screen for confirming to the user whether or not the unique phone ID information held in advance by the mobile phone 4 may be transmitted (FIG. 3). Is displayed on the display unit. The phone ID information may be a mobile phone number, or may be a unique ID set for each mobile phone separately from the phone number.

  Here, when the [Yes] button on the screen 34 is operated, the mobile phone 4 holds in advance the store code read from the two-dimensional code 23a and the fixed name “for authentication” as shown in ST7 of FIG. The authentication request data is edited from the telephone ID information. The authentication request data signal is transmitted to the authentication server 11 via the Internet 3 (data transmission means). At this time, a screen for notifying that authentication is in progress (see screen 35 in FIG. 3) is displayed.

  As a result, the authentication server 11 determines whether or not the data signal received via the Internet 3 from the mobile phone 4 that transmitted the authentication start page is the signal of the authentication request data, as shown in ST13 of FIG. Data judgment means). If it is determined that the signal is authentication request data, authentication processing specifically shown in FIG. 7 is executed.

  That is, the authentication server 11 acquires a store code that is business execution location identification data and telephone ID information that is terminal-specific information from the received authentication request data. Then, the access permission table 60 (see FIG. 11) is searched with the acquired store code, and the elapsed time from the authentication date to the current date is less than the preset access denial time in the record in which the same store code is set. The record number A is acquired.

  Incidentally, as shown in FIG. 11, the access permission table 60 is a storage area in which records composed of item data of store code, telephone ID information, and authentication date are accumulated and stored in the order of occurrence. It is formed on a hard disk drive (HDD) device. The current date / time is date / time data measured in real time by a clock function provided in the authentication server 1. The access refusal time is a time for invalidating the authentication permitted at the previous access when the business stop time from the previous access to the current access takes a certain time or more, for example, 30 minutes is set. .

  When the record number A is acquired, the authentication server 11 compares the record number A with the permission setting number (permission setting number determination means). The number of permitted settings is the number of persons permitted to perform the article management work using the mobile phone 4 in one store. For example, when up to three persons are permitted, the number of permitted settings is set to 3. ing.

  If the record number A exceeds the permitted setting number, the business using the mobile phone 4 is not permitted in the store 1 that is the business execution location, so the authentication server 11 edits the response page indicating that access is not possible, The response page signal is transmitted via the Internet 3 to the mobile phone 4 that has requested access.

  Thereby, as shown in ST8 of FIG. 5, in the mobile phone 4, the screen of the received response page, that is, a screen not permitting access (see screen 36 of FIG. 3) is displayed on the display unit.

  On the other hand, when the record number A is equal to or less than the permitted setting number, since the business using the mobile phone 4 is permitted in the store 1, the authentication server 11 stores the store code and the telephone ID acquired from the authentication request data. A record including information and authentication date / time data which is the current date / time is additionally registered in the access permission table 60. Further, the access permission information including the store code acquired from the authentication request data is edited as a response page indicating business activation, and a signal of this response page is transmitted to the mobile phone 4 that requested the access via the Internet 3 ( Authentication processing means).

  Thereby, on the mobile phone 4, a response page screen (see screen 37 in FIG. 3) of access permission information including the store code is displayed on the display unit (display control means).

  That is, the person in charge of article management confirms the content of the confirmation screen 34 displayed by clicking the [OK] button on the screen 33, and if there is no problem, clicks the [Yes] button. Then, authentication request data including the store code of the two-dimensional code 23 a and the telephone ID information of the mobile phone 4 is transmitted to the authentication server 11, and it is determined whether or not an operation performed using the mobile phone 4 can be performed.

  Specifically, the number of mobile phones 4 that are already permitted to execute business in the same store is checked, and if the number is less than the permitted setting number, business using the mobile phone 4 is permitted. If the access is permitted, a response page screen 37 for access permission information is displayed on the display unit of the mobile phone 4. Accordingly, the person in charge of article management who confirms the response page screen 37 for the access permission information clicks the [OK] button.

  Thus, the person in charge of article management uses the mobile phone 4 to execute article management work. That is, an operation of reading the two-dimensional code 23b of the article plate 22 attached to each article placed in the store 1 one by one is performed. That is, the two-dimensional code reader function of the mobile phone 4 is activated again.

  As a result, in the mobile phone 4, as shown in FIG. 5, the camera operates to start reading the two-dimensional code 23b, and at the same time, the timer is started. When the two-dimensional code 23b is displayed in the imaging area of the camera and the two-dimensional code 23b is read before the timer times out (see screen 41 in FIG. 4), the mobile phone 4 reads the two-dimensional code 23b. The two-dimensional code 23b is analyzed to obtain character / number string information (code analysis means).

  In this case, since the character / numeric string information obtained from the two-dimensional code 23b includes a URL, the cellular phone 4 displays the character / numeric string information on the display unit (see screen 42 in FIG. 4). Here, when the “Return” function key is operated, the mobile phone 4 reads the two-dimensional code again.

  On the other hand, when the “connect” function key is operated, the mobile phone 4 starts up the browser and goes to the website specified by the URL included in the character / numeric string information of the two-dimensional code 23b. An access request signal is transmitted (connection request means).

  This access request signal is transmitted to the authentication server 11 via the Internet 3 as described above, and the authentication start page including the telephone information request command corresponding to the telephone company is edited, and the mobile phone 4 that has made an access request. Sent to. Thereby, in the mobile phone 4, the authentication start page is displayed on the display unit (see the screen 33 in FIG. 3).

  That is, the article management person who is permitted to manage the article performs an operation of reading the two-dimensional code 23b of the article plate 22 attached to the POS terminal, for example, with the mobile phone 4, and the two-dimensional code 23b is read and When the contents (URL, article code, and article name “POS terminal”) are displayed on the screen 42, the “connect” function key is operated. Then, the mobile phone 4 is connected to the authentication server 11 and the authentication start page screen 43 is displayed. Therefore, the person in charge of article management clicks the [OK] button on the screen 43. Then, a screen (see screen 44 in FIG. 4) for confirming to the user whether the mobile phone 4 may transmit the unique telephone ID information held in advance by the mobile phone 4 is displayed. Click the [Yes] button on the screen 34.

  Thereby, in the mobile phone 4, the article management activation request data is edited from the article code and article name “POS terminal” read from the two-dimensional code 23a and the telephone ID information held in advance. Then, the activation request data signal is transmitted to the authentication server 11 via the Internet 3 (data transmission means). At this time, a screen for notifying that communication is in progress (see screen 45 in FIG. 4) is displayed on the display unit.

  As a result, the authentication server 11 determines whether or not the data signal received from the mobile phone 4 via the Internet 3 is the signal of the article management activation request data, as shown in ST14 of FIG. 6 (data determination means). . If it is determined that the signal is an article management activation request data signal, an article management activation process specifically shown in FIG. 8 is executed.

  That is, the authentication server 11 acquires the article code and article name as the business object identification data and the telephone ID information as the terminal specific information from the received article management activation request data. Then, the access permission table 60 is searched with the acquired telephone ID information to determine whether there is a record in which the same telephone ID information is set (table searching means).

  Here, when the corresponding record is registered in the access permission table 60, the authentication server 11 calculates the elapsed time from the authentication date / time of the record to the current date / time. Then, it is determined whether this elapsed time is equal to or shorter than the access refusal time (elapsed time determination means).

  As a result, when the elapsed time exceeds the access denial time, or when the telephone ID information corresponding to the access permission table 60 is not registered, a response page indicating that access is not possible is edited, and the signal of this response page Is transmitted via the Internet 3 to the mobile phone 4 that has requested access (access impossibility processing means).

  Thereby, on the mobile phone 4, the screen of the received response page, that is, a screen indicating that access is not permitted (see screen 46 in FIG. 4) is displayed on the display unit.

  On the other hand, when the elapsed time is equal to or shorter than the access refusal time, the authentication server 11 updates the authentication date / time of the record to the current date / time. Further, the store code of the record is acquired from the access permission table 60. The article management confirmation response page indicating the article management contents is edited from the store code and the article code and the article name in the received article management activation request data, and the mobile phone that has requested access to the response page signal 4 is transmitted via the Internet 3 (operation start processing means).

  Thereby, on the mobile phone 4, the screen of the received response page, that is, the screen of the article management confirmation page (see screen 47 in FIG. 4) is displayed on the display unit.

  That is, the person in charge of article management confirms the content of the confirmation screen 44 displayed by clicking the [OK] button on the screen 43, and if there is no problem, clicks the [Yes] button. Then, the article management activation request data including the article code and article name of the two-dimensional code 23b and the telephone ID information of the mobile phone 4 is transmitted to the authentication server 11, and the article management work performed using the mobile phone 4 is performed. Effectiveness is determined.

  That is, if the telephone ID information of the mobile phone 4 is registered in the access permission table 60 and the elapsed time from the latest authentication date corresponding to the telephone ID information is within a predetermined access refusal time, the article management service Is approved. If approved, an article management confirmation screen 47 is displayed on the display unit of the mobile phone 4. Accordingly, the person in charge of article management who has confirmed the contents of the article management confirmation screen 47 clicks the [Update] button.

  Then, in the mobile phone 4, the article management update request data including the article code, the article name and the store code displayed on the article management confirmation screen 47 and the telephone ID information unique to the mobile phone is edited. Then, the article management update request data signal is transmitted to the authentication server 11 via the Internet 3. At this time, a screen for notifying that communication is in progress (see screen 45 in FIG. 4) is displayed on the display unit.

  As a result, the authentication server 11 determines whether or not the data signal received from the mobile phone 4 via the Internet 3 is a signal of article management update request data, as shown in ST15 of FIG. If it is determined that the signal is an article management update request data signal, an article management update process specifically shown in FIG. 9 is executed.

  That is, the authentication server 11 acquires an article code, an article name, telephone ID information, and a store code from the received article management update request data. Then, the access permission table 60 is searched with the acquired telephone ID information to determine whether there is a record in which the same telephone ID information is set.

  Here, when the corresponding record is registered in the access permission table 60, the authentication server 11 calculates the elapsed time from the authentication date / time of the record to the current date / time. Then, it is determined whether this elapsed time is equal to or shorter than the access rejection time.

  As a result, when the elapsed time exceeds the access denial time, or when the telephone ID information corresponding to the access permission table 60 is not registered, a response page indicating that access is not possible is edited, and a signal of this response page is displayed. The data is transmitted via the Internet 3 to the mobile phone 4 that has requested access.

  Thereby, on the mobile phone 4, the screen of the received response page, that is, a screen indicating that access is not permitted (see screen 46 in FIG. 4) is displayed on the display unit.

  On the other hand, when the elapsed time is equal to or shorter than the access refusal time, the authentication server 11 updates the authentication date / time of the record to the current date / time. Also, the article management data is edited by adding classification data identifying the article management data to the store code, article code, article name, and current date (processing date) data acquired from the article management update request data. . Then, the article management data is added to the article management database 50 managed by the database server 12. Further, the response page indicating the update result of the article management data is edited, and a signal of the response page is transmitted to the mobile phone 4 that has requested access via the Internet 3.

  Thereby, on the mobile phone 4, the screen of the received response page, that is, the screen showing the update result of the article management data (see the screen 48 in FIG. 4) is displayed on the display unit.

  As described above, in the present embodiment, by using the camera of the mobile phone 4 and reading the two-dimensional code 23b displayed on the article plate 22 of various articles installed in the store 1, the store It is possible to execute an article management service for managing information on various articles installed in the database 1 using the database server 22. However, simply reading the two-dimensional code 23b of the article plate 22 with the mobile phone 4 does not permit the execution of the article management work. Only the mobile phone owner who has read and operated the two-dimensional code 23a displayed on the authentication plate 21 previously managed by the store manager of the store 1 with the mobile phone 4 in advance can use the mobile phone 4 to Can perform management tasks. Therefore, the security of the article management business is ensured.

  Moreover, the specific authentication method is that the authentication server 11 registers the phone ID information unique to the mobile phone obtained by reading the two-dimensional code 23a displayed on the authentication plate 21 in the access permission table 60, and this registration is performed. Only the mobile phone 4 having the telephone ID information is allowed to be used in the article management business. Therefore, since it is not necessary to previously store information necessary for authentication in the database or the like in the database or the like, there is no need to store information necessary for authentication in the database in advance. In addition, since the user forgot to store necessary information in the database, a legitimate user is not authenticated.

  In the present embodiment, even when the mobile phone 4 in which the telephone ID information is registered in the access permission table 60 is used, when a certain time (access denied time) has elapsed since the registration time or the latest authentication time. No further use is permitted. Therefore, since the registration data which is old is not authenticated, sufficient security can be obtained from this point.

  The present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage.

  For example, in the above-described embodiment, the authentication date / time data is stored in the access permission table 60, and when the elapsed time from the authentication date / time has passed a predetermined access refusal time, the mobile phone 4 in which the corresponding phone ID information is set is stored. Although the use is refused, the effect of the present invention is obtained even if this function is omitted.

  Further, when it is not necessary to limit the number of uses in one store, the process of obtaining the record number A and comparing it with the permitted set number can be omitted in the authentication process of FIG.

  In the above embodiment, the case where the authentication technology of the present invention is applied at the time of starting the article management service has been described. However, the present invention is not limited to the authentication technology at the time of starting the article management service, and other communication It can be applied to authentication technology at the time of business startup using a terminal. Further, the business execution place is not limited to the tempo, and the business target is not limited to goods. Furthermore, the communication terminal is not limited to a mobile phone, and may be a mobile information terminal, for example. Moreover, it is not necessarily portable.

  In addition, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, the constituent elements over different embodiments may be combined.

The system block diagram for implement | achieving the article management work which is one embodiment of this invention. The schematic diagram which shows the structure of the two-dimensional code used in this Embodiment. The display screen transition diagram of the mobile phone at the time of two-dimensional code reading of the authentication plate in the same embodiment. The display screen transition diagram of the mobile phone at the time of reading the two-dimensional code of the plate for goods in the embodiment. The flowchart which shows the principal part process sequence of a mobile telephone in the embodiment. The flowchart which shows the principal part process sequence of an authentication server in the embodiment. The flowchart which shows the authentication process in FIG. 6 concretely. The flowchart which shows the article management starting process in FIG. 6 concretely. The flowchart which shows the article management update process in FIG. 6 concretely. The schematic diagram which shows the database structure used in the embodiment. The schematic diagram which shows the structure of the access permission table which an authentication server has in the embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Article management center, 2 ... Store, 3 ... Internet, 4 ... Mobile phone, 11 ... Authentication server, 12 ... Database server, 21 ... Authentication plate, 22 ... Article plate, 23a, 23b ... Two-dimensional code, 60 ... access permission table.

Claims (16)

A communication terminal and an authentication server for determining whether to permit a job using the communication terminal;
The communication terminal can read an authentication code including connection information to the authentication server and business execution location identification data, and a business code including connection information to the authentication server and business object identification data. A code reading means; a code analysis means for analyzing the code read by the code reading means to obtain connection information and identification data to the authentication server; and the connection information obtained from the code analysis means based on the connection information. A connection requesting means for connecting to an authentication server, and a data transmission means for transmitting the identification data acquired by the code analyzing means to the authentication server together with terminal-specific information held in advance when connected to the authentication server; Display control means for displaying on the display unit screen information returned from the authentication server,
The authentication server includes data determining means for determining whether the data received from the communication terminal is authentication request data including identification data of the business execution place or business activation request data including identification data of the business object, When it is determined by the data determining means that the authentication request data has been received, the terminal-specific information in the data and the identification data of the job execution location are stored in an access permission table and screen information indicating access permission is displayed. A table search for searching whether the terminal-specific information in the data exists in the access permission table when the authentication processing means to be transmitted to the communication terminal and the data determination means determine that the job activation request data has been received. And the terminal specific information is present in the access permission table by the table search means. If it is confirmed that the terminal specific information does not exist in the access permission table by the business activation processing means for transmitting the screen information indicating the business activation to the communication terminal and the table retrieval means, the access is not allowed. And an inaccessible processing means for transmitting to the communication terminal screen information indicating the above. A communication terminal and an authentication server for determining whether to permit a job using the communication terminal;
The communication terminal can read an authentication code including connection information to the authentication server and business execution location identification data, and a business code including connection information to the authentication server and business object identification data. A code reading means; a code analysis means for analyzing the code read by the code reading means to obtain connection information and identification data to the authentication server; and the connection information obtained from the code analysis means based on the connection information. A connection requesting means for connecting to an authentication server, and a data transmission means for transmitting the identification data acquired by the code analyzing means to the authentication server together with terminal-specific information held in advance when connected to the authentication server; Display control means for displaying on the display unit screen information returned from the authentication server,
The authentication server includes data determining means for determining whether the data received from the communication terminal is authentication request data including identification data of the business execution place or business activation request data including identification data of the business object, If it is determined by the data determining means that the authentication request data has been received, the terminal specific information and the business execution location identification data in the data are stored in the access permission table together with the authentication time data which is the current time. When it is determined that the job activation request data has been received by the authentication processing means for transmitting screen information indicating access permission to the communication terminal and the data determination means, the terminal specific information in the data is stored in the access permission table. Table search means for searching whether or not the terminal-specific information exists, and the table search means Is determined to exist in the access permission table, an elapsed time determination means for determining whether the elapsed time from the authentication time stored corresponding to the terminal specific information exceeds a predetermined access refusal time; When the elapsed time determining means determines that the elapsed time from the authentication time is within the access refusal time, the business activation processing means for transmitting screen information indicating the business activation to the communication terminal, and the table search means Access is not possible when it is confirmed that the terminal specific information does not exist in the access permission table, and when the elapsed time from the authentication time is determined to exceed the access denied time by the elapsed time determination means. An inaccessible processing means for transmitting screen information indicating the communication information to the communication terminal.   The authentication processing means includes permission setting number determination means for determining whether or not the job execution location identification data in the received authentication request data is already stored in the access permission table in a number greater than the set number, and is not stored in more than the set number. The terminal unique information in the authentication request data and the job execution location identification data are stored in an access permission table only when the screen information indicating access permission is transmitted to the communication terminal. The described authentication system.   The job activation processing means displays screen information including job execution location identification data stored in the table corresponding to the terminal-specific information confirmed to exist in the access permission table as screen information indicating the job activation. The authentication system according to any one of claims 1 to 3, wherein the authentication system is edited and transmitted to the communication terminal.   5. The authentication system according to claim 1, wherein the code reading unit is a unit that reads a two-dimensional code expressing a character / numerical string in a vertical and horizontal pattern.   6. The authentication system according to claim 5, wherein the communication terminal is a portable communication terminal such as a mobile phone or a portable information terminal.   The authentication system according to claim 6, wherein the communication terminal and the authentication server are connected via the Internet. Code reading means capable of reading an authentication code including server connection information and business execution location identification data, and a business code including the server connection information and business target identification data, read by the code reading means Code analysis means for analyzing the code to acquire the server connection information and identification data, connection request means for connecting to the server based on the connection information acquired from the code analysis means, and when connected to the server, A communication terminal comprising data transmission means for transmitting to the server together with terminal-specific information preliminarily holding identification data acquired by the code analysis means, and display control means for displaying screen information responded from the server on a display unit In the authentication server that determines whether to allow the business using
Data determining means for determining whether the data received from the communication terminal is authentication request data including identification data of the business execution place or business activation request data including identification data of the business target, and the data determining means When it is determined that the authentication request data has been received, the terminal-specific information and the business execution location identification data in the data are stored in the access permission table and screen information indicating access permission is transmitted to the communication terminal. An authentication processing means, and a table search means for searching whether the terminal specific information in the data exists in the access permission table when the data determination means determines that the job activation request data is received; A search means confirms that the terminal specific information exists in the access permission table. The business activation processing means for transmitting the screen information indicating the business activation to the communication terminal, and the screen information indicating the inaccessibility when the table search means confirms that the terminal specific information does not exist in the access permission table. An authentication server comprising an inaccessible processing means for transmitting to a communication terminal. Code reading means capable of reading an authentication code including server connection information and business execution location identification data, and a business code including the server connection information and business target identification data, read by the code reading means Code analysis means for analyzing the code to acquire the server connection information and identification data, connection request means for connecting to the server based on the connection information acquired from the code analysis means, and when connected to the server, A communication terminal comprising data transmission means for transmitting to the server together with terminal-specific information preliminarily holding identification data acquired by the code analysis means, and display control means for displaying screen information responded from the server on a display unit In the authentication server that determines whether to allow the business using
Data determining means for determining whether the data received from the communication terminal is authentication request data including identification data of the business execution place or business activation request data including identification data of the business target, and the data determining means When it is determined that the authentication request data has been received, the terminal-specific information in the data and the identification data of the business execution location are stored in the access permission table together with the authentication time data that is the current time, and the screen shows the access permission When it is determined by the authentication processing means that transmits information to the communication terminal and the data determination means that the job activation request data has been received, a search is performed to determine whether the terminal-specific information in the data exists in the access permission table And a table search means that performs the access permission to the terminal-specific information. When it is confirmed that the table exists, the elapsed time determination means for determining whether the elapsed time from the authentication time stored corresponding to the terminal-specific information exceeds a predetermined access rejection time, and this elapsed time determination When the means determines that the elapsed time from the authentication time is within the access refusal time, the service start processing means for transmitting screen information indicating the work start to the communication terminal, and the terminal search information by the table search means Screen information indicating that access is not possible when it is confirmed that the access permission table does not exist in the access permission table and when the elapsed time from the authentication time exceeds the access rejection time by the elapsed time determination means An authentication server comprising: an inaccessible processing means for transmitting a message to the communication terminal.   The authentication processing means includes permission setting number determination means for determining whether or not the job execution location identification data in the received authentication request data is already stored in the access permission table in a number greater than the set number, and is not stored in more than the set number. The terminal unique information in the authentication request data and the job execution location identification data are stored in an access permission table only when the screen information indicating access permission is transmitted to the communication terminal. The listed authentication server.   The job activation processing means displays screen information including job execution location identification data stored in the table corresponding to the terminal-specific information confirmed to exist in the access permission table as screen information indicating the job activation. The authentication server according to claim 8, wherein the authentication server is edited and transmitted to the communication terminal. In an authentication method for determining whether to permit a job using the communication terminal using an authentication server capable of communicating with the communication terminal,
When the communication terminal reads the authentication code including the connection information to the authentication server and the identification data of the business execution location by the code reading unit, the communication terminal analyzes the code and analyzes the connection information to the authentication server and the business execution location. Acquire identification data, connect to the authentication server based on the acquired connection information, and when connected to the authentication server, authenticate the acquired business execution location identification data and pre-held terminal-specific information Sent to the authentication server as request data,
When the authentication server receives the authentication request data from the communication terminal, the authentication server stores the terminal-specific information and the job execution location identification data in the data in an access permission table and displays screen information indicating access permission in the communication Send it to your device,
The communication terminal reads the business code including the connection information to the authentication server and the identification data of the business object by the code reading means, and analyzes the code to identify the connection information to the authentication server and the business object identification. The data is acquired, connected to the authentication server based on the acquired connection information, and when connected to the authentication server, the business start request is made for the acquired business object identification data and the terminal-specific information held in advance. Sent as data to the authentication server,
When the authentication server receives the job activation request data from the communication terminal, the authentication server searches the access permission table for the terminal-specific information in the data, and indicates the job activation when the existence is confirmed. An authentication method, comprising: transmitting screen information to the communication terminal; and transmitting screen information indicating that access is disabled to the communication terminal when it is confirmed that the screen information does not exist. In an authentication method for determining whether to permit a job using the communication terminal using an authentication server capable of communicating with the communication terminal,
When the communication terminal reads the authentication code including the connection information to the authentication server and the identification data of the business execution location by the code reading unit, the communication terminal analyzes the code and analyzes the connection information to the authentication server and the business execution location. Acquire identification data, connect to the authentication server based on the acquired connection information, and when connected to the authentication server, authenticate the acquired business execution location identification data and pre-held terminal-specific information Sent to the authentication server as request data,
When the authentication server receives the authentication request data from the communication terminal, the authentication server stores the terminal-specific information and the job execution location identification data in the data together with the authentication time data that is the current time in the access permission table and access. Send screen information indicating permission to the communication terminal,
The communication terminal reads the business code including the connection information to the authentication server and the identification data of the business object by the code reading means, and analyzes the code to identify the connection information to the authentication server and the business object identification. The data is acquired, connected to the authentication server based on the acquired connection information, and when connected to the authentication server, the business start request is made for the acquired business object identification data and the terminal-specific information held in advance. Sent as data to the authentication server,
When the authentication server receives the job activation request data from the communication terminal, the authentication server searches whether the terminal specific information in the data exists in the access permission table, and if it is confirmed, the terminal specific information And determining whether the elapsed time from the authentication time stored corresponding to the predetermined access denial time has passed, and when the elapsed time from the authentication time is within the access denial time, When it is confirmed that the terminal-specific information is not present in the access permission table when transmitted to the communication terminal, and when the elapsed time from the authentication time exceeds the access denied time by the elapsed time determination means An authentication method characterized by transmitting screen information indicating inaccessibility to the communication terminal when judged.   The authentication server determines whether or not the business execution location identification data in the received authentication request data is already stored in the access permission table at a set number or more, and only when the set number or more is not stored in the authentication request data. The authentication method according to claim 12 or 13, wherein terminal-specific information and the job execution location identification data are stored in an access permission table and screen information indicating access permission is transmitted to the communication terminal.   15. The authentication method according to claim 12, wherein the code readable by the code reading means of the communication terminal is a two-dimensional code expressing a character / numerical string in a vertical and horizontal pattern. .   The authentication method according to claim 15, wherein the communication terminal is a portable communication terminal such as a mobile phone or a portable information terminal.

Images