JP2007249538A - Authentication method and system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technology for achieving high safety without imposing any troublesome labor on a user of terminal equipment. <P>SOLUTION: A WWW server 114 of a site 102 automatically issues a passcode as a unique character string as necessary for every user of a portable telephone set 104, and prepares and transmits a mail for notifying it. The issued passcode is stored in a database managed by a DB server 116 by setting a term of validity. When the passcode is received from the portable telephone set 104, the passcode is transmitted to the DB server 116, and retrieval for confirming whether or not any passcode matched with the passcode among passcodes whose term of validity has not passed is stored in the database is operated. Access is permitted and a service is provided to only the user of the portable telephone set 104 whose confirmation has been successful. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a technique for authenticating a user who causes a computer to access a terminal device via a communication network.

  In recent years, communication networks have rapidly developed as information infrastructures. On the Internet, which is a global information infrastructure that connects various communication networks, many sites have been established for the purpose of providing various services related to information transmission and product sales. As a result, the Internet is widely used as a means for providing services. At present, in addition to personal computers (hereinafter referred to as PCs), PDAs (Personal Digital Assistants) and mobile phones are also widely used as terminal devices.

  The provision of a service via a communication network may be performed by giving a registered person the right to receive it rather than targeting an unspecified person. Authentication is done to provide services only to registered persons with that right. The authentication is usually performed when a user accesses a terminal computer to a site computer or requests a service limited to a registered person.

  In conventional authentication, a user name (hereinafter referred to as ID), which is a character string for identifying a user, and a password, which is a character string that only the user should know, are registered as identification information for user identification, and the terminal is connected to the site. This is done by confirming whether an ID / password combination entered by a user who has accessed the device is registered as identification information. As a result, since the third party can impersonate the person (person) who has the ID / password only by knowing the ID / password, there is a problem that the safety is likely to be lowered.

  In order to prevent a decrease in security, it is necessary for each individual to properly manage a password. Currently, there are many sites that require membership registration to provide services, and many people have multiple passwords. However, password management becomes more complicated as the number increases. For this reason, there are many people who are obsessed with managing passwords. For this reason, it is considered impractical to maintain a high level of security by performing authentication using only an ID / password.

  At present, a password that is valid only once (one-time password) is automatically issued, and the password is used for authentication. By enabling the password only once, even if a third party steals it at the time of authentication, it cannot be impersonated, and high security is realized.

  However, the password is issued by a dedicated device that can be connected to the terminal device, dedicated software installed on the terminal device, or a server (computer) connected to a communication network. For this reason, when a user of a terminal device is authenticated by a one-time password, the user has to acquire a dedicated device, install dedicated software, or access a server.

  When a password is issued to a dedicated device or dedicated software, the user of the terminal device must be requested to do so. In other words, the user must use a dedicated device or install dedicated software on the terminal device. However, such a trouble is not desirable because it is considered that there are many users who feel bothersome and want to avoid it if possible. On the other hand, when acquiring a password from a server, such trouble is saved, but it is necessary to access it to acquire a password, so that another troublesome trouble is required. For this reason, it is not desirable either.

A person who feels troublesome tries to avoid the trouble. For this reason, it can be said that it is also important to avoid troublesome authentication in order to allow many people to access the computer (site). That is, it is considered important to achieve high security without causing the user to perform troublesome authentication.
JP 2006-039728 A JP 2004-272614 A

  An object of this invention is to provide the technique for implement | achieving high safety | security, without making the user of a terminal device troublesome trouble.

  The authentication method of the present invention is a method used to authenticate a user who causes a computer to access a terminal device via a communication network, and whether a URL for authentication is prepared on the computer side and has an access right. A character string for identifying whether or not it is automatically issued for each user of the terminal device at any time to notify the user of the corresponding terminal device and let the user access the authentication URL prepared on the computer side. A column is input, and the user is authenticated based on the input character string.

  The above authentication is performed by a user who registers identification information for specifying a user consisting of a plurality of character strings for each user of a terminal device having the right to access and accesses the terminal device to an authentication URL prepared on the computer side. It is desirable that the identification information is input to the computer, and the input identification information is further used. It is desirable to add the character string issued for each user of the terminal device to the URL for authentication and notify the user of the terminal device by e-mail. The character string has a valid period set in advance and is automatically issued at any time based on the valid period to notify the user of the terminal device. The user authentication of the terminal device is a character input by the user. It is desirable to consider the lifetime of the column.

  The authentication system of the present invention is based on the premise that a user is allowed to access a terminal device through a communication network, and a character string for identifying whether or not the user has the right to access is classified for each user of the terminal device. A character string issuing unit that automatically issues, a notification unit that notifies the user of the corresponding terminal device by e-mail of a character string issued by the character string issuing unit, and an authentication URL prepared on the computer side Character string receiving means for receiving at least a character string transmitted from a terminal device to be accessed, and authentication means for authenticating a user of the terminal device based on the character string received by the character string receiving means.

  In the present invention, the user of the corresponding terminal apparatus automatically issues a character string for identifying whether or not the user has the right to access the terminal apparatus to the computer via the communication network. The user is made to input a character string to the terminal device to access the authentication URL prepared on the computer side, and authentication is performed based on the input character string.

  If the character string used for authentication is automatically issued and notified to the user, the troublesome task of acquiring it is not necessary. Even if it is leaked due to cunning management, it is possible to control the degree to which the leak affects the safety by enabling the character string. For these reasons, high safety can be realized without making the user of the terminal device troublesome.

  For each user of the terminal device having the right to access, identification information for identifying the user consisting of a plurality of character strings is registered, and the user is made to input the identification information by allowing the user to access the terminal device to the authentication URL. When the identification information is further used for authentication, higher security can be realized.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
FIG. 1 is a diagram showing a configuration of a network system to which an authentication system according to the present embodiment is applied.

  The network system is constructed to provide various services to users of terminal devices that can be connected to the Internet 101. As shown in FIG. 1, a site 102 established for providing various services to users of terminal devices is connected to the Internet 101. As a terminal device, a mobile phone 104 connected to the Internet 101 via a mobile phone network 103 is shown. As a result, the authentication system according to the present embodiment is realized as authenticating a user of a terminal device such as the mobile phone 104 connected to the site 102 via the Internet 101. The terminal device may be a telephone network and ISP (Internet Service Provider), or a PC or PDA connected via a LAN or the like. Here, in order to avoid confusion, only the mobile phone 104 is focused. Hereinafter, the mobile phone 104 is also referred to as a mobile terminal.

  As shown in FIG. 1, the system of the site 102 connects a router 113 to the Internet 101, connects a LAN 111 connecting a WWW server 114 and a firewall server (hereinafter referred to as FW server) 115 to the router 113, and the FW server. A database (DB) server 116 is connected to 115 via the LAN 112. The authentication system according to the present embodiment is realized by the LAN 111, the FW server 115, and the WWW server 114 and the DB server 116 connected via the LAN 112.

In the above configuration, the operation will be described focusing on the authentication of the user of the portable terminal 104.
The site 102 is established, for example, to provide various services including membership limitation to the user of the mobile terminal 104. For registration as a member, for example, after specifying the URL (Uniform Resource Locators) for registration and accessing the WWW server 114, the necessary information is entered on the personal information input screen transmitted by the server 114. This is done by instructing transmission.

  By instructing the transmission, the personal information input by the user is transmitted from the portable terminal 104 to the WWW server 114. When the WWW server 114 receives personal information from the portable terminal 104, the WWW server 114 sends it to the DB server 116 and stores it in a database for managing personal information of the user (hereinafter referred to as user DB) managed by the WWW server 114. Member registration is performed by storing personal information in this way. The user DB is stored in a storage device mounted on or connected to the DB server 114, for example.

  As personal information stored in the user DB, in addition to name, address, e-mail address, etc., an ID (user name) that is a character string for identifying a user, and a character string that only the user to whom the ID is assigned should know There is only one ID including the password that is specified by the user or automatically issued by the WWW server 114. The password is specified by the user. The password can be changed at any time.

  The member-only service is provided only for users who have been authenticated by accessing an authentication URL prepared on the WWW server 114 (hereinafter referred to as an authentication URL for convenience). In authentication by ID and password (Password), it is very difficult to reliably avoid spoofing by a third party. Therefore, in the authentication, the following information is used in addition to the ID and password input by the user.

  When authentication information such as a password is set (designated) by the user of the portable terminal 104, the level of security depends on how the user manages the information. It is very difficult to maintain high security with authentication using only such information, that is, authentication using only ID / password, because there are many people who are obscene in management. It is. For this reason, in order to reliably maintain high security, information to be input by the user in addition to the ID and password is automatically generated (issued) by the site 102 side (here, the WWW server 114), and the mobile terminal 104 To notify users. The notification is made by sending an e-mail to an e-mail address stored as personal information. The e-mail is created, for example, by placing the issued information or the name of the user saved as personal information in the original e-mail.

  If authentication information is managed on the site 102 side, a device or software for generating the information becomes unnecessary on the mobile terminal 104 side. When the information is notified by e-mail, the necessity of accessing the mobile terminal 104 to the site 102 or another site in order to acquire the information is avoided. For these reasons, it is possible for the user of the portable terminal 104 to avoid the need for troublesome work, and the information can always be acquired easily and quickly.

  In this embodiment, as the information, a unique character string (for example, random number) is generated (issued) for each user of the portable terminal 104 (who is a registered user). By issuing a character string for identification for each user (member), even if the character string is leaked to a third party, the third party is a person other than the user of the mobile terminal 104 that issued the character string. Can not impersonate. For this reason, the fall of the safety | security at the time of a leak will also be suppressed. The issued character string is stored in the user DB.

  The issued character string is input together with the authentication URL in the input box for inputting the URL to be accessed. Thus, when the authentication URL is accessed, authentication using the character string is performed.

  In this embodiment, the authentication URL and the character string added with the character string are notified by e-mail so that the authentication URL and the character string can be easily input. Thereby, the authentication URL including the character string is copied into the input box, and authentication by the character string can be performed only by instructing access to the input URL. The character string is added to the authentication URL, for example, with a symbol indicating that the subsequent character string is authentication data.

  When an authentication URL including a character string is input and the user instructs access to the authentication URL, the character string and the authentication URL are transmitted to the WWW server 114. When the WWW server 114 receives them, the character string is transmitted to the DB server 116 via the LAN 101, the FW server 115, and the LAN 112 to search the user DB using it as a key, and receives the result. Accordingly, the WWW server 114 is assigned an authentication URL when a record including the received character string exists in the user DB, that is, when it is confirmed that the user who issued the character string exists. The authentication screen (page, for example, HTML data) is transmitted to the mobile terminal 104.

  In this screen, input boxes for ID and password are arranged. As a result, the authentication using the ID / password entered by the user is performed following the authentication using the issued character string. Since the authentication is performed in combination with the previously entered character string, for example, whether the ID and password stored in the record having the previously entered character string match the ID and password entered by the user, respectively. Do this by checking. Note that the authentication may be performed by sending a character string, ID, and password input by the user to the DB server 116 and searching for a record that stores them all in the user DB.

  A valid period is set in advance for the character string to be issued. In the e-mail used to notify it, a certain amount of time lag (hereinafter, e-mail transmission / reception) occurs between the time when the e-mail is sent and the time when the mobile terminal 104 is ready for opening (until it is received by the mobile phone). Called time lag). The current lag is not negligible. Therefore, the effective period is set in consideration of the time lag. The effective number of times is one, and the effective period ends when the character string is used for authentication before the effective period expires. Thereby, even if a character string is leaked at the time of authentication, the security is not lowered. Hereinafter, a character string automatically issued on the site 102 side is referred to as a passcode.

  FIG. 2 is a diagram for explaining the relationship between the passcode issuance period, its validity period, and the time lag of mail transmission / reception. In the figure, the passcode issuance cycle coincides with the login URL (authentication URL) notification cycle, and the passcode validity period coincides with the login URL validity period.

  If the time lag of mail transmission / reception is not considered, that is, if the user of the mobile terminal 104 can always confirm the issued passcode by mail immediately, the password validity period is issued and then issued. It means that the period until is good. However, since the current time lag cannot be ignored, in this embodiment, a possible time lag (hereinafter referred to as an assumed time lag to distinguish it from the actual time lag) is added to the notification cycle as a grace period. The validity period is set in the form. As a result, the validity period is from the time when the password is issued until the time when the estimated time lag has passed from the time when the next password is issued, and the user can receive the services limited to members by the actual time lag shorter than the estimated time lag. There is definitely no avoidance of login.

  With mobile phones, the actual time lag for sending and receiving e-mails may be about one day. However, even if the actual time lag is such a long time, it should be reflected (considered) in the effective period setting as an assumed time lag. Thus, it is possible to reliably avoid a blank space during the login period.

FIG. 3 is a diagram for explaining passcode issuance management and its validity period management.
As shown in FIG. 3, the passcode is issued every time a preset issuing period elapses, and the valid period is from the time it is issued until the period obtained by adding an assumed time lag to the issue period elapses. As a result, a portion that overlaps the validity period of two consecutive passcodes is created so that a blank space does not occur in the login period.

  Each time the WWW server 114 issues a passcode, the valid period is set and stored in the user DB. For example, when the DB server 116 is requested to store a passcode or collate for authentication from the WWW server 114, the reason is that the validity period has passed in the target record or the user has used for authentication. Then, it is determined whether or not there is a passcode whose valid period has expired, and the passcode whose valid period has expired is deleted together with its valid period. As a result, the passcode whose validity period has ended and its validity period are deleted from the user DB as needed. The verification is performed in consideration of whether or not the passcode validity period has passed. Even if the passcodes match, it is determined that the passcodes do not match if the valid period has passed. . In this way, matching is performed in consideration of the validity period.

  FIG. 4 is a diagram showing a functional configuration related to authentication of the mobile terminal 104 and the system on the site 102 side. Next, with reference to FIG. 4, the functional configuration related to authentication and the function of each unit will be described in detail.

  The database management unit 430 manages the DB 440 and is realized by the DB server 116. The DB 440 collectively represents a DB storing management data such as a passcode notification period and a use grace period (assumed time lag) in addition to the user DB. Here, these DBs are treated as one for convenience.

  The external connection management unit 410 inputs and outputs data related to authentication with the mobile terminal 104. The internal connection management unit 420 is interposed between the external connection management unit 410 and the database management unit 430, and exchanges data between them and controls the external connection management unit 410. Both the management units 410 and 420 are realized by the WWW server 114.

  The notification cycle management unit 421 of the internal connection management unit 420 manages the issuance of a pass code for each user of the mobile terminal 104 according to the notification cycle stored in the DB 440. In order to issue a passcode at that cycle, the date and time when the passcode was issued last time for each user of the portable terminal 104 is recorded and stored. As a result, the recorded issue date and time is referred to, the timing for issuing the passcode is specified, and the mail transmission request unit 423 is instructed to issue the passcode.

  The valid period management unit 422 manages the valid period of the passcode managed by the notification cycle management unit 421. The effective period is set by determining the date and time when the period ends, for example. The date and time is obtained by adding the notification cycle and the grace period stored in the DB 440 to the date and time when the notification cycle management unit 421 instructs the issuance of the passcode.

  The mail transmission request unit 423 issues a passcode in accordance with the instruction from the notification cycle management unit 421 and requests the mail notification management unit 411 of the external connection management unit 410 to transmit a mail. In order to send the mail, the newly issued passcode, the mail address designated by the user of the mobile terminal 104 to which the passcode should be notified, and the like are sent to the mail notification management unit 411.

  When mail transmission is requested from the mail transmission request unit 423, the mail notification management unit 411 creates a mail to be transmitted using the data received from the mail transmission request unit 423, and sends the mail to the mail transmission unit 412. As a result, a mail is transmitted via the mail transmission unit 412, and the newly issued passcode is notified to the user of the portable terminal 104 by mail. As described above, the mail is expressed by adding a passcode to the authentication URL.

  When the internal connection management unit 420 transmits the mail for notifying the passcode to the external connection management unit 410 as described above, the internal connection management unit 420 sends the passcode and the valid period via the internal data input / output unit 424 to the database management unit. 430 to instruct storage to the DB 440.

  The database management unit 430 receives the data via the data input / output unit 431 and accesses the DB 440 via the database connection unit 432. Thereby, the newly issued passcode and its valid period are stored in the record to be stored. On the other hand, the valid period of the passcode stored in the record is read, and by determining whether or not the current date and time is later, the valid period has been extracted. Thus, when the valid period that has passed is extracted, the valid period and the passcode in which the valid period is set are deleted from the record.

  The authentication data input / output unit 401 of the portable terminal 104 performs data input / output for authentication with the site 102 side. The mail transmitted from the mail transmission unit 412 of the external connection management unit 410 is received by the input / output unit 401 and viewed by the user.

  When the user accesses the mobile terminal 104 to the site 102, the authentication input unit 402 requests the user to input data related to authentication, and transmits the data to the external connection management unit 410. Data that prompts the user to input includes an authentication URL with a passcode, an ID, and a password. The ID and password are requested to be input after the authentication URL with the passcode is input, that is, after the site 102 confirms that the passcode is valid and the user can be specified from the passcode.

  The authentication URL with a passcode input by the user is transmitted to the external connection management unit 410, and the passcode is sent to the data input / output unit 431 of the database management unit 430 via the internal data input / output unit 424 of the internal connection management unit 420. Sent to.

  The database connection unit 432 searches the DB 440 using the passcode sent to the data input / output unit 431 as a key. The search is performed in consideration of the validity period of the passcode stored in the DB 440, thereby extracting a matching passcode from the passcodes whose validity period has not expired. The result of the search performed in this way is output to the internal data input / output unit 424 via the data input / output unit 431.

  The internal data input / output unit 424 transmits data corresponding to the search result received from the data input / output unit 431 to the mobile terminal 104 via the external data input / output unit 413. Accordingly, if a passcode that has not expired and that matches the passcode transmitted from the mobile terminal 104 is stored in the DB 440, that is, if it can be confirmed that the user can be identified from the passcode, The authentication screen to which the authentication URL is assigned is transmitted to the portable terminal 104, and the authentication input unit 402 is requested to input the ID and password. On the other hand, if not, data for notifying the fact is transmitted to the portable terminal 104 to notify the user of the fact.

  The authentication input unit 402 encrypts the ID and password input by the user and transmits them to the external connection management unit 410. When the external data input / output unit 413 of the management unit 410 receives the encrypted ID and password from the portable terminal 104, it decompresses them and sends them to the internal data input / output unit 424 of the internal connection management unit 420. The input / output unit 424 sends them to the database management unit 430, and performs a search to check whether the DB 440 contains a record that stores the set and all the passcodes previously input by the user. Receive the result. The received result is transmitted to the portable terminal 104 via the external data input / output unit 413 of the external connection management unit 410.

  The authentication output unit 403 of the authentication data input / output unit 401 indicates that the search result transmitted via the external connection management unit 410 is successful, that is, the transmitted ID / password pair and the passcode transmitted before that are the same. If it represents that it is stored in the record, the connection with the external connection management unit 410 is held. As a result, the session is continued and the user can receive a member-limited service provided by the site 102. In other words, the session is continued. On the other hand, if the search result is not successful, the user is informed of this fact and shifts to an instruction waiting state.

  If the search result is successful, the database management unit 430 deletes the passcode and its validity period from the record in the DB 440 having the passcode, ID, and password transmitted from the mobile terminal 104. As a result, once used passcode is made unusable again.

  In this embodiment, the passcode is valid only once, but it may be used multiple times. About the input, you may make it make it perform on the screen which inputs ID and a password. The authentication URL may be prepared for each user of the mobile terminal 104.

  The authentication system according to the present embodiment is realized by the LAN 111, the FW server 115, and the WWW server 114 and the DB server 116 connected via the LAN 112, but the configuration for realizing the authentication system is limited thereto. It is not a thing. You may implement | achieve by 1 unit | set or 3 or more computers.

  The authentication system automatically issues a passcode, notifies the user by e-mail, and performs authentication using the notified passcode. The authentication needs to be performed on the site 102 side accessed by the mobile terminal 104, but since the issued passcode is notified by e-mail, the issuance of a password and transmission of an e-mail for notifying it are performed on the site 102 side. It is not always necessary. For this reason, for example, a function that automatically issues a passcode as needed, and a function that notifies the user of the mobile terminal 104 of the issued passcode by e-mail, and authentication using a passcode that is automatically issued / notified An authentication system to which the present invention is applied may be realized by constructing the system having the function of performing the above as separate systems and linking these systems. Separately constructed systems may be connected via a communication network, and thus may not be installed at the same location. As is apparent from the above, the present invention can be variously modified.

It is a figure which shows the structure of the network system to which the authentication system by this Embodiment was applied. It is a figure explaining the relationship of the issuing period of a passcode, its effective period, and the time lag of mail transmission / reception. It is a figure explaining the issue management of a passcode, and its effective period management. It is a figure which shows the function structure regarding authentication of a portable terminal and the site side system.

Explanation of symbols

101 Internet 102 Site 103 Mobile Phone Network 104 Mobile Phone (Terminal Device)
111, 112 LAN
113 router 114 WWW server 116 DB server 401 authentication data input / output unit 410 external connection management unit 420 internal connection management unit 430 database management unit 440 database

Claims (5)

A method used for authenticating a user who causes a computer to access a terminal device via a communication network,
Prepare the URL for authentication on the computer side,
A character string for identifying whether or not the user has the right to access is automatically issued from time to time for each user of the terminal device to notify the corresponding terminal device user,
Allowing the user to access the terminal device to the authentication URL prepared on the computer side to input the character string, and authenticating the user based on the input character string;
An authentication method characterized by that. For each user of the terminal device having the access right, register identification information for user identification consisting of a plurality of character strings,
Allowing the user to access the terminal device to the authentication URL prepared on the computer side to input the identification information, and further using the input identification information for authentication of the user;
The authentication method according to claim 1. The character string issued for each user of the terminal device is added to the authentication URL and notified to the user of the terminal device by e-mail.
The authentication method according to claim 1 or 2, characterized in that The character string presets an effective period, and automatically issues it at any time based on the effective period to notify the user of the terminal device,
The user authentication of the terminal device is performed in consideration of the validity period of the character string input by the user.
The authentication method according to claim 1, 2, or 3. A system for authenticating a user who causes a computer to access a terminal device via a communication network,
A character string issuing means for automatically issuing a character string for identifying whether or not the user has the right to access, as needed, for each user of the terminal device;
A notification means for notifying the user of the corresponding terminal device of the character string issued by the character string issuing means by e-mail;
A character string receiving means for receiving at least the character string transmitted from the terminal device accessing a URL for authentication prepared on the computer side;
Authentication means for authenticating the user of the terminal device based on the character string received by the character string receiving means;
An authentication system comprising: