JP2008028709A - Authentication method, and network system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable authentication of a user's terminal device even when the user is existent at a location separated from the terminal device, and simplify an authentication function. <P>SOLUTION: A telephone network includes a database of telephone numbers which are identification numbers of user terminals, and performs authentication based on an originator telephone number from a user terminal. The originator is authenticated based on a telephone number from a telephone terminal utilizing an authentication database technique based on the telephone numbers of the telephone network and a connection request is implemented from the telephone terminal to user equipment connected to another network such as an IP network. Hereby, interconnection of the user equipment in the IP network is implemented under the condition of the authentication of the telephone network to establish communication. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a user authentication technique in a network system. The present invention relates to an authentication method or a network system for transferring data using an IP (Internet) network or the like.

  In recent years, with the development of network technology, it has become possible to transmit digitized data such as images, moving images, sounds, and music using an IP network. Along with this, authentication methods and security for using the network have become problems.

  Conventionally, a generally used method is to provide an authentication server having a database for identifying a user on the network, and a user requesting connection to this server accesses and inputs a user ID, a password, etc. for authentication. When the server authenticates, the connection with the other user device is permitted.

  Also, Patent Document 1 proposes a method of performing authentication by authenticating a user using authentication data of another network (for example, a mobile communication telephone network).

JP 2004-364166 A

  In such a conventional authentication method in a network, a user needs to input data necessary for authentication or transmit authentication data from a device to be connected to the network. For example, even in Patent Document 1, the user needs to transmit authentication information and the like from the terminal device to the network authentication server.

  According to this, when the user is away from the user's terminal device, authentication of the terminal device is impossible. For example, when a user is at a friend's house, the user's terminal device and the friend's terminal device are connected via a network, and data transmission from the user's terminal device to the friend's terminal device is not possible. Is possible.

  In addition, authentication information or encryption information is installed on the terminal or server side to perform authentication or encryption, but when adding a new authentication function, new authentication data is added to the terminal or server side. It is necessary to perform complicated operations such as addition or change.

  The present invention has been performed under such a background, and enables authentication of a terminal device even when a user is away from his / her terminal device, and simplifies an authentication function. It is an object of the present invention to provide an authentication method and a network system that can perform authentication.

  The telephone network includes a database of telephone numbers that are identification numbers of user terminals, and authentication can be performed based on a caller telephone number from the user terminal. The present invention uses the authentication database technology based on the telephone number of the telephone network, authenticates the caller based on the telephone number from the telephone terminal, and is connected from the telephone terminal to another network such as an IP network. A connection request is made to a user device (for example, a personal computer having a telephone function), and communication is established by interconnecting the user device on the IP network on condition that the telephone network is authenticated.

  The user authenticates the user by making a connection request to the IP network using the telephone number from the telephone terminal that is always used. Therefore, troublesome authentication work for connecting the user device in the IP network or the like is performed. There is no need to do it.

  That is, the present invention includes a first communication system including a user terminal authentication unit and a second communication system to which a user device is connected, and identification information for identifying the user device is given in advance. The authentication means includes a user management database for authenticating user terminals. The user management database includes identification information for identifying a user device connected to the second communication system for each identification number of the user terminal. A destination user device connected to the second communication system from a user terminal of the first communication system when the user devices are connected to each other by the second communication system. A connection request including identification information to be transmitted, and the authentication means authenticates the user terminal based on the identification number of the user terminal that transmitted the connection request. A transmission source user device of the user who has made the connection request to the transmission destination user device connected to the second communication system that has made the connection request based on the identification information of the transmission destination user device The connection information used for connection is transmitted, and when there is a response to the connection information from the transmission destination user device, the connection information used for connection with the transmission destination user device is transmitted to the transmission source user device, The transmission source user device and the transmission destination user device are authentication methods for establishing communication between user devices via the second communication system using the received connection information.

  In this way, by separately using a communication system that performs authentication and a communication system that performs data transmission, the user can authenticate the terminal device without using a terminal device that performs data transmission. Thus, even when the user is at a friend's house, the terminal device at the user's home can be authenticated, and the user can use the data between the user's terminal device and the friend's terminal device via the network while at the friend's house. Transmission is possible.

  For example, the first communication system is a telephone network, the second communication system is an Internet network, the user terminal is a telephone, and the user equipment is a terminal device assigned a telephone number. The user management database is a telephone terminal management database in which the telephone number of the user equipment and additional information of the user equipment necessary for connection are stored based on the telephone number of the user terminal, and the connection request Inputs the telephone number of the destination user device to be connected from the user terminal.

  According to this, since the authentication method of the present invention can be realized using the existing function of the telephone network, the authentication function for realizing the present invention can be simplified. As the existing function, for example, the caller can be identified by acquiring the caller's number (telephone number), the identity can be identified by the telephone number, and an independent network such as a telephone network is used for authentication. By doing so, there is a function that reliability such as security can be improved as compared with the IP network or the like, and this function can be used.

  When the user devices are connected to each other by the second communication system, identification information for designating a transmission destination user device connected to the second communication system from a user terminal of the first communication system. The authentication means authenticates the user terminal based on the identification number of the user terminal that transmitted the first connection request, and sends the first connection request to the destination user device. The connection information used for connection with the transmission source user device of the user who made the connection request is transmitted, and the transmission destination user device transmits the second connection information to the transmission source user device using the received connection information. The transmission source user equipment that has transmitted the second connection request via the communication system and has received the second connection request performs a response to the second connection request so that the user equipments communicate with each other. It may be to establish a communication.

  According to this, since the connection information only needs to be transmitted to one user device, the communication establishment procedure can be simplified.

  The present invention can also be viewed from the viewpoint of a network system. That is, the present invention includes a first communication system including a user terminal authentication unit and a second communication system to which a user device is connected, and identification information for identifying the user device is given in advance. The authentication means includes a user management database for authenticating user terminals. The user management database includes identification information for identifying a user device connected to the second communication system for each identification number of the user terminal. When the user equipments are connected to each other by the second communication system, the user terminal transmits the second communication system to the authentication unit via the first communication system. Means for transmitting a connection request including identification information for designating a destination user device connected to the authentication device, and the authentication means includes a user who has transmitted the connection request. The destination user equipment connected to the second communication system that has made the connection request based on the identification information of the destination user equipment by performing authentication of the user terminal based on the terminal identification number, Means for transmitting connection information used for connection with the transmission source user device of the user who has made a connection request, and when there is a response to the connection information from the transmission destination user device, the transmission to the transmission source user device Means for transmitting connection information used for connection with a destination user device, and the transmission source user device and the transmission destination user device use the received connection information via the second communication system. It is a network system provided with means for establishing communication between each other.

  For example, the first communication system is a telephone network, the second communication system is an Internet network, the user terminal is a telephone, and the user equipment is a terminal device assigned a telephone number. The user management database is a telephone terminal management database in which the telephone number of the user equipment and additional information of the user equipment necessary for connection are stored based on the telephone number of the user terminal.

  When the user devices are connected to each other by the second communication system, the user terminal is connected to the second communication system with respect to the authentication unit via the first communication system. Means for transmitting a first connection request including identification information for designating a destination user device, wherein the authentication means authenticates the user terminal based on the identification number of the user terminal that has transmitted the first connection request; And transmitting to the transmission destination user device connection information used for connection with the transmission source user device of the user who has made the first connection request, the transmission destination user device including the transmission source user device Means for transmitting a second connection request to the device via the second communication system using the received connection information, and the source user who has received the second connection request Vessel may also be provided with means for establishing the communication between the user equipment by performing a response to the second connection request.

  ADVANTAGE OF THE INVENTION According to this invention, even if a user exists in the place away from his terminal device, the said terminal device can be authenticated and an authentication function can be simplified.

  An authentication method and a network system according to an embodiment of the present invention will be described with reference to FIGS. FIG. 1 is an overall configuration diagram of a network system according to this embodiment. FIG. 2 is a diagram showing a table included in the telephone terminal management database.

  In the network system of the present embodiment, as shown in FIG. 1, a telephone network 2 including a relay / conversion device 3 including authentication means for a telephone terminal 1 as a user terminal is connected to devices A and B as user equipment. IP network 4 is provided, and identification information for identifying the devices A and B is given in advance. The relay / conversion device 3 includes a telephone terminal management database 5 for authenticating the telephone terminal 1, and this telephone terminal management The database 5 includes a table (FIG. 2) in which identification information for identifying the devices A and B connected to the IP network 4 is added for each identification number of the telephone terminal 1. When connecting to each other, the telephone terminal 1 designates a destination user device (device B (# 0002) in this case) connected to the IP network 4 with respect to the relay / conversion device 3 via the telephone network 2. Includes identification information The relay / conversion device 3 includes a means for transmitting a connection request, and the relay / conversion device 3 authenticates the telephone terminal 1 based on the identification number of the telephone terminal 1 that transmitted the connection request and performs the connection based on the identification information of the device B. Means for transmitting to the device B connected to the requested IP network 4 connection information used for connection with the transmission source user device (here, device A (# 0001)) of the user A who made the connection request; And a means for transmitting connection information used for connection with the device A when there is a response to the connection information from the device B. The devices A and B use the received connection information to establish the IP network 4. A network system having means for establishing communication between the devices A and B via the network.

  In this embodiment, the devices A and B are, for example, personal computers having an IP telephone function. The user can register the device identification information in the relay / conversion device 3 in association with the telephone number of the telephone terminal owned by the user. At this time, when one user has a plurality of devices, identification information of the plurality of devices can be registered in association with one telephone number.

  As a registration method, a carrier of the telephone network 2 registers based on an application from a user, or when the telephone terminal is a mobile phone terminal, it registers from a mobile phone website, or an Internet website You can take the method of registering from.

  In FIG. 1, the relay / conversion device 3 is illustrated at a position not included in the telephone network 2 or the IP network 4, but the installation position of the relay / conversion device 3 may be within the telephone network 2 or the IP network 4. It may be within. Regardless of the location, it functions as an additional function of the telephone network 2.

  A telephone network / relay / conversion device GW (Gate Way) server 9 shown in FIG. 1 is a server for connecting the telephone network 2 and the relay / conversion device 3. If the installation position of the relay / conversion device 3 is in the IP network 4, the telephone network / relay / conversion device GW server 9 has a function of intercommunication between the telephone network 2 and the IP network 4. Become.

  The registration server 8 of the relay / conversion device 3 accepts registration from the device A or B, which is an IP device, and enters identification information (such as an IP address) in the telephone terminal management device 6. The telephone terminal 1 can directly register the identification information in the telephone terminal management apparatus 5 via the telephone network / relay / conversion apparatus GW server 9 of the telephone network 2. The telephone terminal management device 6 performs authentication by managing the telephone number of the telephone terminal 1 and the identification information (IP address or the like) of the device A or B. The proxy server 7 manages and relays the connection of the telephone terminal 1, the device A, and the device B.

  Next, the operation of the network system of this embodiment will be described with reference to FIGS. 3 and 4 are sequence diagrams showing the operation of the network system according to the present embodiment. In this example, the user A requests mutual connection between the devices A and B and establishes communication. As shown in FIG. 3, the user A inputs the telephone number (# 0002) of the device B, which is the counterpart user device, to the telephone terminal 1 (S1). The telephone terminal 1 adds its own telephone number (# 9999) and makes a connection request (call) to the relay / conversion device 3 using the destination telephone number (# 0002) (S2). This connection request is accepted by the proxy server 7 of the relay / conversion device 3. The proxy server 7 issues an authentication request to the telephone terminal management device 6 using the telephone number (# 9999) of the telephone terminal 1 (S3). Note that a password or the like may be used for the authentication request instead of the telephone number (# 9999).

  The telephone terminal management device 6 searches the telephone terminal database 5 for a telephone number (# 9999) or a personal identification number and confirms the authentication (S4). When the authentication confirmation is completed, the telephone terminal management device 6 notifies the proxy server 7 that the authentication confirmation has been completed successfully as an authentication confirmation response (S5).

  The proxy server 7 that has received the authentication confirmation response requests the device information from the telephone terminal management apparatus 6 using the telephone number (# 9999) of the telephone terminal 1 and the telephone number (# 0002) of the apparatus B (S6). The telephone terminal management device 6 searches the telephone terminal management database 5 using the telephone numbers (# 9999) and (# 0002), information on the device A (phone number (# 0001), additional / authentication / identification information), and information on the device B. Information (telephone number (# 0002), additional / authentication / identification information) is obtained.

  The addition / authentication / identification information includes, for example, a global / unique ID for one connection, connection information (IP address, port number, telephone number, etc. of a connection destination IP device), retransmission information, capability information, and authentication information. The encryption key, expiration date, and session start time.

  The telephone terminal management device 6 returns these pieces of device information to the proxy server 7 (S8). The proxy server 7 transmits connection information including addition / authentication / identification information of the device A and the device B to the device B (S9). The device B can connect to the device A using this connection information. If the device B can be connected to the device A, the device B transmits a connection information response to the proxy server 7 (S10). When the proxy server 7 receives the connection information response from the device B, the proxy server 7 transmits connection information including addition / authentication / identification information of the devices A and B to the device A (S11). The device A can connect to the device B using this connection information.

  When the device A receives the connection information, it directly transmits (calls) a connection request to the device B using the telephone number (# 0002) (S12). When device B receives this connection request, device B transmits a connection request response to device A (incoming call) (S13).

  Thereby, the device A and the device B are connected to each other, and after confirming the addition / authentication / identification information and the like, establish communication and start communication (S14). At this time, a relay device or the like may be interposed between the device A and the device B.

  When communication is established between the device A and the device B, the device A notifies the proxy server 7 to that effect as a communication establishment completion notification (S15). When the proxy server 7 receives the communication establishment completion notification, the proxy server 7 transmits to the telephone terminal 1 that the communication establishment is completed as a communication establishment completion notification (S16). By this notification, the user of the telephone terminal 1 can recognize that communication has been established between the device A and the device B, and can start data transmission.

  Of course, it is possible to recognize that communication has been established between the device A and the device B by confirming the connection state of the device A in the user A's home without receiving the communication establishment completion notification. As described above, when the user A is in the user B's home, the state of the device A cannot be directly confirmed, and thus the communication establishment completion notification by the telephone terminal 1 is useful.

  In the example of FIG. 3, when the telephone terminal 1 makes a connection request to the proxy server 7 via the telephone network / relay / conversion device GW server 9 of the telephone network 2, the telephone terminal 1 makes a call using a telephone function. In the example of FIG. 4, using the network connection function of the telephone terminal 1, first, the telephone terminal 1 makes a data communication connection request to the proxy server 7 (S21), and the data communication connection request response from the proxy server 7 ( By receiving S22), communication via the network is established between the telephone terminal 1 and the proxy server 7 (S23), and then a connection request (S24) is made by data communication using a Web browser or the like. Do. The system configuration in this case is the same as in FIG. 1, but the relay / conversion device 3 is included in the telephone network 2 or the IP network 4.

  In the example of FIGS. 3 and 4, the connection request is made from the device A to the device B in steps S12 and S13, and then the connection request response is sent from the device B to the device A. The connection request may be sent from the device B to the device A, and the connection request response may be sent from the device A to the device B.

  Alternatively, in steps S9 and S11, the proxy server 7 transmits the connection information to both the device A and the device B, but transmits the connection information only to the device B, and transmits the connection information to the device A. Instead, the communication between the device A and the device B may be established by the device A responding to the connection request from the device B. The procedure in this case is shown in FIGS. 5 and 6, step S11 in FIGS. 3 and 4 can be omitted.

  According to the present invention, even when a user is away from his / her terminal device, the terminal device can be authenticated and the authentication function can be simplified, so that the convenience of the user can be improved. it can. Further, since the authentication function can be simplified even in a network carrier, efficient network operation can be performed.

1 is an overall configuration diagram of a network system according to an embodiment. The figure which shows the table which the telephone terminal management database of a present Example has. The sequence diagram (telephone number input) which shows operation | movement of the network system of a present Example. The sequence diagram (data communication connection request) which shows operation | movement of the network system of a present Example. The sequence diagram (telephone number input) which shows operation | movement of the network system of a present Example. The sequence diagram (data communication connection request) which shows other operation | movement of the network system of a present Example.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Telephone terminal 2 Telephone network 3 Relay / conversion apparatus 4 IP network 5 Telephone terminal management database 6 Telephone terminal management apparatus 7 Proxy server 8 Registration server 9 Telephone network / relay / conversion apparatus GW server A, B Equipment

Claims (6)

A first communication system comprising user terminal authentication means;
A second communication system to which the user equipment is connected,
Identification information for identifying the user equipment is given in advance,
The authentication means includes a user management database for authenticating user terminals,
The user management database includes a table to which identification information for identifying a user device connected to the second communication system is added for each identification number of the user terminal.
When connecting the user equipment to each other by the second communication system,
Transmitting a connection request including identification information for specifying a destination user device connected to the second communication system from a user terminal of the first communication system;
The authentication means authenticates the user terminal based on the identification number of the user terminal that has transmitted the connection request, and has made the connection request based on the identification information of the destination user device. Transmitting connection information used for connection with the transmission source user device of the user who made the connection request to the transmission destination user device connected to
When there is a response to the connection information from the transmission destination user device, the connection information used for connection with the transmission destination user device is transmitted to the transmission source user device,
The authentication method in which the transmission source user device and the transmission destination user device establish communication between user devices via the second communication system using the received connection information. The first communication system is a telephone network;
The second communication system is an Internet network;
The user terminal is a telephone;
The user equipment is a terminal device provided with a telephone number,
The user management database is a telephone terminal management database that stores the telephone number of the user equipment and additional information of the user equipment necessary for connection based on the telephone number of the user terminal,
The authentication method according to claim 1, wherein the connection request inputs a telephone number of the destination user device to be connected from the user terminal. A first communication system comprising user terminal authentication means;
A second communication system to which the user equipment is connected,
Identification information for identifying the user equipment is given in advance,
The authentication means includes a user management database for authenticating user terminals,
The user management database includes a table to which identification information for identifying a user device connected to the second communication system is added for each identification number of the user terminal.
When connecting the user equipment to each other by the second communication system,
Transmitting a first connection request including identification information specifying a destination user device connected to the second communication system from a user terminal of the first communication system;
The authentication means authenticates the user terminal based on the identification number of the user terminal that transmitted the first connection request, and transmits to the transmission destination user device the transmission source of the user who made the first connection request Send connection information for connection with user equipment,
The transmission destination user device transmits a second connection request to the transmission source user device via the second communication system using the received connection information, and receives the second connection request. The source user device establishes communication between user devices by responding to the second connection request. A first communication system comprising user terminal authentication means;
A second communication system to which the user equipment is connected,
Identification information for identifying the user equipment is given in advance,
The authentication means includes a user management database for authenticating user terminals,
The user management database includes a table to which identification information for identifying a user device connected to the second communication system is added for each identification number of the user terminal.
In connecting the user equipment to each other by the second communication system,
The user terminal includes means for transmitting a connection request including identification information specifying a destination user device connected to the second communication system to the authentication means via the first communication system,
The authentication means includes
The user terminal is authenticated based on the identification number of the user terminal that transmitted the connection request, and connected to the second communication system that has made the connection request based on the identification information of the destination user device Means for transmitting connection information used for connection with the transmission source user device of the user who has made the connection request to the counterpart user device;
Means for transmitting connection information used for connection with the transmission destination user device to the transmission source user device when there is a response to the connection information from the transmission destination user device;
The transmission source user device and the transmission destination user device include a unit that establishes communication between user devices via the second communication system using the received connection information. The first communication system is a telephone network;
The second communication system is an Internet network;
The user terminal is a telephone;
The user equipment is a terminal device provided with a telephone number,
5. The network system according to claim 4, wherein the user management database is a telephone terminal management database that stores a telephone number of the user equipment and additional information of the user equipment necessary for connection based on a telephone number of the user terminal. . A first communication system comprising user terminal authentication means;
A second communication system to which the user equipment is connected,
Identification information for identifying the user equipment is given in advance,
The authentication means includes a user management database for authenticating user terminals,
The user management database includes a table to which identification information for identifying a user device connected to the second communication system is added for each identification number of the user terminal.
In connecting the user equipment to each other by the second communication system,
The user terminal transmits a first connection request including identification information specifying a destination user device connected to the second communication system to the authentication unit via the first communication system. With
The authentication means authenticates the user terminal based on the identification number of the user terminal that transmitted the first connection request, and transmits to the transmission destination user device the transmission source of the user who made the first connection request Means for transmitting connection information used for connection with the user equipment,
The transmission destination user device comprises means for transmitting a second connection request to the transmission source user device via the second communication system using the received connection information,
The network system comprising means for establishing the communication between the user devices by sending a response to the second connection request, when the transmission source user device receives the second connection request.

Images