JP2008225790A - Authentication server, authentication method, communication terminal and authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To further improve security when a communication terminal uses a service via a network. <P>SOLUTION: This authentication server 10 has: a storage part 12 associating and storing a telephone number, a production number, and first to third passwords; a decision part 13 deciding whether the telephone number and the production number transmitted from a cellphone 30, and the telephone number and the production number stored in the storage part 12 accord or not; a determination part 14 determining that one password among the first to third passwords is requested to the cellphone 30 based on a decided accordance degree of the telephone number and the production number; a transmission part 15 requesting the determined password from the cellphone 30; and a consent part 16 deciding whether the password transmitted from the cellphone 30 according to the request and the requested password accord or not, and consenting to use the service by the cellphone 30 when the passwords accord. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an authentication server, an authentication method, a communication terminal, and an authentication system that permit the communication terminal to use a service that can be provided to the communication terminal.

2. Description of the Related Art Conventionally, techniques for securing communication between a communication terminal and various servers such as a distribution server are known. For example, Patent Document 1 below discloses a security improvement system that can improve both security of connection functions and security against theft. In addition to using the unique identification information of the communication terminal and the user specific information set by the user, this security improvement system introduces a function limiting method based on the control of the connection time and the location information. Two types of security have been improved.
JP 2006-115433 A

  In the case of a mobile phone, the phone number is stored in a SIM card (Sim Card, Subscriber Identity Module Card). By replacing this SIM card, the user's own phone number can be used on another mobile phone. A plurality of telephone numbers can be switched and used with one mobile phone. Thereby, while the user can easily use a plurality of mobile phones, a situation in which the user's SIM card is used by another person may occur. For this reason, it is required to further improve the safety of a communication device such as a mobile phone in which a recording medium having specific information can be attached and detached. However, even if the security improvement system described in Patent Document 1 is used, such a safety improvement cannot be sufficiently obtained.

  The present invention has been made to solve the above problems, and provides an authentication server, an authentication method, a communication terminal, and an authentication system capable of further enhancing security when a communication terminal uses a service via a network. The purpose is to provide.

  The authentication server of the present invention uses a storage means for storing user identification information for identifying a user of a communication terminal and terminal identification information for individually identifying the communication terminal, and a service. Identification information receiving means for receiving user identification information and terminal identification information from the communication terminal, user identification information and terminal identification information received by the identification information receiving means, and user identification information stored in the storage means Determining means for determining whether or not the terminal identification information matches, and authentication means for authenticating the use of the service by the communication terminal based on the degree of coincidence between the user identification information and the terminal identification information determined by the determining means With.

  Further, the authentication method of the present invention is such that an authentication server that authenticates a communication terminal to use a service that can be provided to a communication terminal individually identifies user identification information for identifying the user of the communication terminal, and the communication terminal. A storage step of storing the terminal identification information in association with each other, an authentication server receiving an identification information receiving step of receiving user identification information and terminal identification information from a communication terminal that intends to use the service, and an authentication server A determination step for determining whether or not the user identification information and the terminal identification information received in the identification information receiving step match the user identification information and the terminal identification information stored in the storage step, and an authentication server, An authentication step for authenticating the use of the service by the communication terminal based on the degree of coincidence between the user identification information and the terminal identification information determined in the determination step. Tsu and a flop.

  Further, the communication terminal of the present invention is a communication terminal that can communicate with the authentication server, and separately uses user identification information for identifying the user of the own terminal and the own terminal in order to use the service. Identification information transmission means for transmitting terminal identification information for identification to the authentication server, and use of the service by the authentication server based on the user identification information and terminal identification information transmitted by the identification information transmission means And an authentication acquisition means for acquiring the authentication.

  The authentication system of the present invention is an authentication system including a communication terminal and an authentication server that authenticates the use of a service that can be provided to the communication terminal. The authentication server identifies a user of the communication terminal. Storage means for associating and storing user identification information for performing communication and terminal identification information for individually identifying communication terminals, and user identification information and terminal identification information from a communication terminal that intends to use the service. It is determined whether or not the received identification information receiving means matches the user identification information and terminal identification information received by the identification information receiving means with the user identification information and terminal identification information stored in the storage means. A determination unit; and an authentication unit that authenticates the use of the service by the communication terminal based on the degree of coincidence between the user identification information and the terminal identification information determined by the determination unit. In order for the terminal to use the service, based on the identification information transmitting means for transmitting the user identification information and the terminal identification information to the authentication server, the user identification information and the terminal identification information transmitted by the identification information transmitting means And authentication acquisition means for acquiring the authentication when the use of the service is authenticated by the authentication means.

  According to such an authentication server, authentication method, communication terminal, and authentication system, user identification information and terminal identification information transmitted from a communication terminal that intends to use the service, and these stored in the authentication server in advance The identification information is compared, and the degree of coincidence between the user identification information and the terminal identification information is determined. Based on the determined degree of coincidence, the use of the service by the communication terminal is authenticated. Thus, at the time of authentication, by considering the degree of coincidence between the user identification information and the terminal identification information, authentication according to the configuration of the communication terminal that intends to use the service becomes possible. That is, it is possible to perform a plurality of types of authentication according to the combination of one having user identification information (for example, a SIM card) and one having terminal identification information (for example, a mobile phone body). As a result, it is possible to further increase security when the communication terminal uses the service via the network. In addition, since a plurality of types of authentication can be performed, a service corresponding to the authentication can be provided.

  In the authentication server of the present invention, the storage means stores user identification information, terminal identification information, and a plurality of types of passwords for using a service that can be provided to the communication terminal in association with each other. Based on the degree of coincidence between the user identification information and the terminal identification information determined by the determination unit, a determination unit that determines to request one of the plurality of passwords from the communication terminal, and the determination unit Password request means for requesting a password from the communication terminal, password receiving means for receiving a password transmitted from the communication terminal in response to a request from the password request means, a password received by the password receiving means, and a request by the password request means It is determined whether the passwords match, and if these passwords match, the communication end It is preferable and a license means for licensed services by.

  In this case, based on the determined degree of coincidence between the user identification information and the terminal identification information, one password is selected from a plurality of types of passwords and requested from the communication terminal. Thereafter, when a password is transmitted from the communication terminal in response to the request, the password is compared with the requested password, and if the two passwords match, the use of the service by the communication terminal is permitted. Thus, by requesting a password at the time of authentication, it becomes possible to further increase security when a communication terminal uses a service via a network. Further, since the required password is determined based on the degree of coincidence between the two types of identification information, the authentication difficulty level can be changed. As a result, the security can be further enhanced.

  In the authentication server of the present invention, the determining unit requests a predetermined password from the communication terminal when the combination of the user identification information and the terminal identification information received by the identification information receiving unit is stored in the storage unit. Preferably, when the combination is not stored by the storage unit, it is preferable to request the communication terminal to request another password different from the predetermined password.

  In this case, since the required password is different depending on whether the combination of the received user identification information and terminal identification information matches the one stored in the storage means or not, the above identification information is completely Different authentication methods can be used depending on whether they match or not.

  In the authentication server of the present invention, the separate password is a terminal in which the user identification information received by the identification information receiving means matches the user identification information stored by the storage means and received by the identification information receiving means. If another user identification information corresponding to the identification information is not stored by the storage means, the first separate password is used, corresponding to the terminal identification information received by the identification information receiving means, and by the identification information receiving means When another user identification information different from the received user identification information is stored in the storage means, the second separate password is preferably used.

  In this case, the password required when the combination of the user identification information and the terminal identification information does not match that stored in the storage means is set more finely according to the degree of coincidence of the identification information. Therefore, it is possible to use an authentication method corresponding to the degree of coincidence of each identification information.

  In the authentication server of the present invention, when it is determined by the determining means to request the second separate password from the communication terminal, the second separate password is transmitted to another communication terminal having different user identification information. An inquiry means for inquiring whether or not the request is permitted, and an answer receiving means for receiving an answer notification indicating an answer to the inquiry transmitted from another communication terminal in response to the inquiry by the inquiry means, and a password Preferably, the requesting unit requests the second separate password from the communication terminal when the reply notification received by the reply receiving unit indicates that the request for the second separate password is permitted.

  In this case, when another user identification information corresponding to the received terminal identification information and different from the received user identification information is present in the storage unit, another user identification information having the other user identification information is stored. An inquiry is made to the communication terminal as to whether or not the request for the second different password is permitted. Thereafter, when the authentication server receives a reply notification indicating that the request for the second separate password is permitted, the second separate password is requested from the communication terminal. As a result, when a user intends to use a service contracted by another person (service contractor), the service contractor is based on the user identification information (other user identification information) of the service contractor. An inquiry is made to Therefore, the service contractor can recognize that the contracted service is about to be used by a third party. Further, if the service contractor does not permit the request for the second separate password, the second separate password is not requested for the communication terminal that intends to use the service. Therefore, the use of the service by a third party can be prevented more reliably. As a result, it is possible to further increase security when the communication terminal uses the service via the network.

  In the authentication server of the present invention, the position information receiving means for receiving the position information indicating the current position of the communication terminal from the communication terminal that intends to use the service, and the position information received by the position information receiving means as another communication terminal It is preferable to further comprise position information transmitting means for transmitting to

  In this case, the location information of the communication terminal that intends to use the service is transmitted to another communication terminal via the authentication server. As a result, the holder of another communication terminal, that is, the service contractor who is going to use the contracted service by a third party can know the location of the third party and track the third party. It is possible to take measures such as As a result, it is possible to further increase security when the communication terminal uses the service via the network.

  In the authentication server of the present invention, the determining unit requests a predetermined password from the communication terminal when the combination of the user identification information and the terminal identification information received by the identification information receiving unit is stored in the storage unit. Preferably, it is determined that the use of the service by the communication terminal is permitted, and the permission unit permits the use of the service by the communication terminal based on the determination by the determination unit.

  In this case, when the combination of the user identification information transmitted from the communication terminal and the terminal identification information matches that stored in the authentication server, the user can immediately perform without entering the password at the communication terminal. You can use the service. Therefore, the convenience of the service is improved and the authentication server can be configured more simply.

  According to such an authentication server, an authentication method, a communication terminal, and an authentication system, the security at the time of a communication terminal using a service via a network can be improved more.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the description of the drawings, the same or equivalent elements are denoted by the same reference numerals, and redundant description is omitted.

  First, an authentication system 1 according to the embodiment will be described with reference to FIG. FIG. 1 is a diagram showing the overall configuration of the authentication system 1. The authentication system 1 includes an authentication server 10, a mobile phone (communication terminal) 30 and another mobile phone (other communication terminal) 40 that can communicate with the authentication server 10 via the mobile communication network 20, and these authentications. A data storage server 50 capable of communicating with the server 10, the mobile phone 30, and another mobile phone 40 is provided.

  When each mobile phone uses the data storage service provided by the data storage server 50, the authentication server 10 authenticates the use of the service by the mobile phone under a certain condition. The data storage server 50 stores telephone directory data registered in each mobile phone, setting information of each mobile phone, and the like, and provides the data to the mobile phone in response to a request from the mobile phone. Each of the mobile phone 30 and the other mobile phone 40 includes a SIM card in which a telephone number is stored. Various data can be stored in the server by using the data storage service, and the stored data is stored in the server. Can be obtained from In the present embodiment, the mobile phone 30 requires authentication of the authentication server 10 in order to use the data storage service, and the other mobile phones 40 can use the data storage service by the mobile phone 30 as necessary. The use (password request from the authentication server 10 to the mobile phone 30) is permitted or denied. At this time, the other mobile phone 40 communicates with the authentication server 10.

  Although only two mobile phones are shown in FIG. 1, the number of mobile phones 30 and other mobile phones 40 included in the authentication system 1 is not limited.

  Next, the functional configuration of the authentication server 10 will be described with reference to FIG. FIG. 2 is a diagram showing a functional configuration of the authentication server 10 shown in FIG.

  The authentication server 10 includes, as functional components, a receiving unit (identification information receiving unit, password receiving unit, answer receiving unit and position information receiving unit) 11, a storage unit (storage unit) 12, a determination unit (determination unit) 13, and a determination unit. Unit (determination unit) 14, transmission unit (password request unit, inquiry unit and position information transmission unit) 15, and permission unit (permission unit) 16. That is, the reception unit 11, the determination unit 14, the transmission unit 15, and the permission unit 16 also function as an authentication unit.

  The receiving unit 11 is a part that receives data from the mobile phone 30 or another mobile phone 40 and outputs the data to other components according to the type of the received data. Specifically, the reception unit 11 outputs a registration request to the storage unit 12, a usage request to the determination unit 13, location information and a response notification to the determination unit 14, and a password notification to the permission unit 16. Details of the registration request, usage request, location information, reply notification, and password notification received by the receiving unit 11 will be described later.

  The storage unit 12 is a part that stores the content of the registration request input from the receiving unit 11. The registration request includes a telephone number (user identification information) for identifying the user of the mobile phone, a manufacturing number (terminal identification information) for individually identifying the mobile phone, and a data storage service for each mobile phone. Data including first to third passwords (a plurality of types of passwords including a predetermined password, a first different password, and a second different password) for use. The storage unit 12 stores these data included in the registration request in association with each other. The registration request is stored when the mobile phone registers with the data storage service or when the password is changed. FIG. 3 is an example of data stored in the storage unit 12. In this figure, for example, telephone number “03-1111-2222”, serial number “123456789”, first password (predetermined password) “1234”, second password (first different password) “5678” and A third password (second different password) “9012” is stored in association with each other.

  When accepting registration or update of a plurality of passwords, the complexity of each password may be different from each other. For example, the first password is required to be 4 characters or more, while the second and third passwords are required to be 8 characters or more, so that the complexity of the second and third passwords is more than that of the first password. May be raised. In addition, the first password may include only numbers, while the second and third passwords may include an alphanumeric character. Of course, the complexity of the first password may be higher than that of the second and third passwords, or the complexity may be changed between the second password and the third password. In this way, by changing the complexity between a plurality of passwords, password setting according to the strictness of authentication can be performed. As a result, the security when the mobile phone 30 uses the data storage service can be further increased.

  The determination unit 13 is a part that compares the usage request input from the reception unit 11 with the data stored in the storage unit 12 to determine the degree of coincidence thereof, and outputs the determination result to the determination unit 14. Here, the use request is data including a telephone number and a manufacturing number.

The determination unit 13 determines the degree of coincidence between the telephone number and the manufacturing number. Specifically, the determination unit 13 outputs one determination result among the following four types to the determination unit 14.
A. The combination of the input telephone number and manufacturing number is stored in the storage unit 12 (hereinafter referred to as “determination A”).
B. The input telephone number matches that stored in the storage unit 12, and another telephone number corresponding to the input manufacturing number is not stored in the storage unit 12 (hereinafter referred to as determination B).
C. A telephone number (another telephone number) corresponding to the input manufacturing number and different from the input telephone number is stored in the storage unit 12 (hereinafter referred to as determination C).
D. Neither the input telephone number nor the manufacturing number is stored in the storage unit 12 (hereinafter referred to as determination D).

  The determination A is a determination issued when a use request including a telephone number and a manufacturing number when the user of the mobile phone 30 registers in the data storage service is transmitted from the mobile phone 30. Therefore, this determination A is derived for normal use. On the other hand, the judgments B and C are judgments issued when the combination of the telephone number and the manufacturing number included in the use request is different from that at the time of service registration. For example, if the service contractor intends to use the data storage service after changing the model of the mobile phone, the determination B is derived. On the other hand, the determination C may be derived when the SIM card is damaged, lost, stolen, transferred, or the like. The determination D is derived when the mobile phone 30 tries to connect to the data storage server 50 using the telephone number and manufacturing number for which the data storage service is not contracted.

  A specific example of the determination will be shown on the assumption that the data shown in FIG. 3 is stored in the storage unit 12. For example, when a usage request including a telephone number “03-1111-2222” and a serial number “123456789” is input, the determination unit 13 outputs a determination result indicating determination A. When the telephone number “03-1111-2222” and the production number “987654321” are input, the determination unit 13 outputs a determination result indicating the determination B. Furthermore, when the telephone number “03-1111-2222” and the manufacturing number “2234456789” are input, the determination result indicating the determination C is output, and the telephone number “03-8888-9999” and the manufacturing number “987654321” are output. Is input, a determination result indicating determination D is output.

  The determination unit 14 determines a password to be requested to the mobile phone 30 based on the determination result input from the determination unit 13 and determines whether or not to transmit the location information of the mobile phone 30 to another mobile phone 40. Part. Then, the determination unit 14 generates a password request or a position request based on these determinations and outputs the request to the transmission unit 15.

  Specifically, the determination unit 14 determines that the first password is requested when the input determination result indicates determination A, and the second password is requested when the determination result indicates determination B, respectively. Then, the determination unit 14 generates a password request indicating that the first or second password is requested and outputs the password request to the transmission unit 15.

  On the other hand, when the determination result indicates determination C, the determination unit 14 determines to request the third password. In this case, the determination unit 14 extracts a telephone number (another telephone number) corresponding to the received manufacturing number. Then, the determination unit 14 generates an inquiry notification for inquiring whether the third mobile phone 40 having the extracted telephone number is permitted to request the third password, and outputs the inquiry notification to the transmission unit 15. In addition, the determination unit 14 generates a position request for acquiring the position information of the mobile phone 30 and outputs the position request to the transmission unit 15. Then, the determination unit 14 suspends requesting the mobile phone 30 for the third password until an answer notification is obtained from another mobile phone 40.

  Thereafter, the determination unit 14 generates a position notification for transmitting the position information input from the reception unit 11 to another mobile phone 40 and outputs the position notification to the transmission unit 15. In addition, the determination unit 14 generates a password request indicating that the third password is requested when the reply notification input from the receiving unit 11 indicates that the third password request is permitted. To the transmitter 15. On the other hand, when the answer notification indicates that the password request is prohibited, the determination unit 14 outputs a non-permission signal to the permission unit 16 for prohibiting the connection of the mobile phone 30 to the data storage server 50.

  If the input determination result indicates determination D, the determination unit 14 determines to prohibit the connection between the mobile phone 30 and the data storage server 50, and outputs a non-permission signal to the permission unit 16.

  The transmission part 15 is a part which transmits the data input from the other component. Specifically, the transmission unit 15 transmits the password request and the position request input from the determination unit 14 to the mobile phone 30, and similarly transmits the inquiry notification and the position notification input to the other mobile phone 40.

  The permission unit 16 determines whether or not the password included in the password notification input from the reception unit 11 matches the requested password, and if both match, the use of the data storage service by the mobile phone 30 is permitted. It is a part to do. In other words, the permission unit 16 is a part that finally authenticates the use of the service by the mobile phone 30. As will be described later, a telephone number is associated with the password notification input from the receiving unit 11. Therefore, the permission unit 16 searches the storage unit 12 on the condition of the telephone number, and acquires one of the first to third passwords (requested password) corresponding to the telephone number, It is determined whether or not the use of the service is permitted by comparing the password and the input password.

  If the passwords match, the permission unit 16 generates a permission notification indicating that the connection between the mobile phone 30 and the data storage server 50 is permitted, and transmits the permission notification to the mobile phone 30. On the other hand, when the passwords do not match, the permission unit 16 generates a non-permission notice indicating that the connection of the mobile phone 30 to the data storage server 50 is refused and transmits the notification to the mobile phone 30. The permission unit 16 also generates and transmits a non-permission notice even when a non-permission signal is input from the determination unit 14.

  Next, the functional configuration of the mobile phone 30 shown in FIG. 1 will be described with reference to FIG. FIG. 4 is a diagram illustrating a functional configuration of the mobile phone 30.

  The cellular phone 30 includes, as functional components, a telephone number storage unit 31, a serial number storage unit 32, a request generation unit 33, a transmission unit (identification information transmission unit and password transmission unit) 34, a reception unit 35, and a reception unit (reception unit). 36), a position acquisition unit 37, and a permission acquisition unit (authentication acquisition means) 38.

  The telephone number storage unit 31 is a part that stores a telephone number for identifying a user of the mobile phone. The telephone number storage unit 31 is detachably attached to the main body of the mobile phone 30 by being mounted on a SIM card (not shown).

  The production number storage unit 32 is a part for storing a production number for individually identifying the mobile phone 30 and is mounted on the telephone body.

  The request generation unit 33 generates a use request including a telephone number and a manufacturing number based on an instruction input via an operation unit (not shown) in order to use the data storage service and outputs the use request to the transmission unit 34. It is a part to do. For this purpose, the request generation unit 33 acquires a telephone number and a manufacturing number from the telephone number storage unit 31 and the manufacturing number storage unit 32, respectively.

  The transmission unit 34 is a part that transmits data input from other components of the mobile phone 30 to the authentication server 10. Specifically, the transmission unit 34 transmits the usage request input from the request generation unit 33, the password notification input from the reception unit 36, and the position information input from the position acquisition unit 37. Details of the location information and password notification will be described later.

  The receiving unit 35 is a part that receives data transmitted from the authentication server 10 via the mobile communication network 20 and outputs the data to other components. Specifically, the reception unit 35 outputs a password request to the reception unit 36, a position request to the position acquisition unit 37, and a permission notification to the permission acquisition unit 38.

  The receiving unit 36 receives an input of one of the first to third passwords based on the password request input from the receiving unit 35 and acquires a telephone number from the telephone number storage unit 31. Then, the reception unit 36 generates a password notification by associating the password input via the operation unit (not shown) with the acquired telephone number, and outputs the password notification to the transmission unit 34.

  The position acquisition unit 37 measures the current position (latitude and longitude) of its own device using a GPS (Global Positioning System) (not shown) when a position request is input from the reception unit 35. The acquired latitude and longitude are output to the transmission unit 34 as position information. Note that the acquisition unit for the current position of the own device is not limited to the GPS, but the position acquisition unit 37 may use the area information (for example, “Roppongi area”) based on a signal from a base station (not shown) in the mobile communication network 20 ) May be output as position information.

  The permission acquisition unit 38 is a part that establishes a connection with the data storage server 50 by acquiring the permission notification input from the reception unit 35. Thereby, the user of the mobile phone 30 can use the data storage service. When the receiving unit 35 receives the non-permission notice, the connection between the mobile phone 30 and the data storage server 50 is rejected. However, the non-permission notification process may be performed by the permission obtaining unit 38. , May be performed by other components (not shown).

  Next, the functional configuration of another mobile phone 40 shown in FIG. 1 will be described with reference to FIG. FIG. 5 is a diagram showing a functional configuration of another mobile phone 40.

  The other mobile phone 40 includes a reception unit 41, a position display unit 42, a reception unit 43, and a transmission unit 44 as functional components.

  The receiving unit 41 is a part that receives data transmitted from the authentication server 10 via the mobile communication network 20 and outputs the data to other components. Specifically, the reception unit 41 outputs the position information of the mobile phone 30 to the position display unit 42 and outputs an inquiry notification to the reception unit 43.

  The position display unit 42 outputs the position information input from the receiving unit 41 to a display device such as a liquid crystal display (not shown).

  The accepting unit 43 is a part that accepts an input of an answer as to whether or not to request the third password from the mobile phone 30 based on the inquiry notification input from the receiving unit 41. Then, the reception unit 43 generates a response notification based on the response input via the operation unit (not shown) and outputs the response notification to the transmission unit 15.

  The transmission unit 44 is a part that transmits the reply notification input from the reception unit 43 to the authentication server 10.

  Next, the processing of the authentication system 1 shown in FIG. 1 and the authentication method according to the present embodiment will be described with reference to FIGS. FIG. 6 is a sequence diagram illustrating a process when the determination unit 13 derives the determination A or B. FIGS. 7 and 8 are sequence diagrams showing processing when determination C is derived. FIG. 7 shows a case where another mobile phone 40 permits the third password request, and FIG. The cases where the cellular phone 40 refuses are shown.

  First, it demonstrates using FIG. Among the processes shown in FIG. 6, steps S101 and S102 are performed when the cellular phone 30 uses the data storage service for the first time. At this time, a registration request is transmitted from the mobile phone 30 to the authentication server 10 (step S101), and the authentication server 10 extracts the telephone number, the manufacturing number, and the first to third passwords from the registration request, and the storage unit 12 (Step S102, storage step).

  Thereafter, when the mobile phone 30 uses the data storage service, the authentication server 10 first receives a use request from the mobile phone 30 (step S103, identification information receiving step). Then, the authentication server 10 extracts the telephone number and the manufacturing number from the usage request, and determines the degree of coincidence between the number and the telephone number and the manufacturing number stored in the storage unit 12 (step S104, determination step). ). When a determination result indicating determination A or B is derived here, a password to be requested to the mobile phone 30 is determined according to the determination result (step S105, determination step) for requesting the first or second password. A password request is transmitted to the mobile phone 30 (step S106, password request step). The mobile phone 30 that has received the password request receives the password input (step S107), and transmits a password notification including the received password to the authentication server 10 (step S108).

  Then, the authentication server 10 receives the password notification (password reception step), and then determines whether or not the passwords match (step S109, permission step). Then, based on the determination result, a permission notification or a non-permission notification is transmitted to the mobile phone 30 (step S110, permission step). When the mobile phone 30 receives the permission notification (step S111; YES), the mobile phone 30 and the data storage server 50 are connected, and the mobile phone 30 can use the data storage service ( Step S112). On the other hand, when the mobile phone 30 receives the non-permission notice (step S111; NO), the process ends.

  Next, a description will be given with reference to FIGS. Note that processing based on the registration request is omitted. First, the authentication server 10 receives a use request from the mobile phone 30 (step S201, identification information receiving step), and the authentication server 10 determines the degree of coincidence between the telephone number and the manufacturing number (step S202, determination step). If a determination result indicating determination C is derived here, a location request is transmitted to the mobile phone 30 and another telephone number corresponding to the received manufacturing number is extracted (step S203).

  At this time, a location request is transmitted from the authentication server 10 to the mobile phone 30 (step S204), the current location of the mobile phone 30 is acquired (step S205), and the current location is sent to another mobile phone via the authentication server 10 as location information. It is transmitted to the telephone 40 (step S206).

  Then, an inquiry notification is transmitted to another mobile phone 40 having another telephone number extracted in the process of step S203 (step S207). In another mobile phone 40, an input of an answer to the inquiry notification is accepted (step S208), and the answer notification is transmitted to the authentication server 10 (step S209). Here, if the response notification permits the request for the third password, a password request is transmitted from the authentication server 10 to the mobile phone 30 (step S210, password request step). The processing of steps S211 to S216 is the same as the processing of steps S107 to S112 in FIG.

  On the other hand, if the reply notification transmitted from the other mobile phone 40 rejects the request for the third password, a non-permission notification is transmitted from the authentication server 10 to the mobile phone 30 as shown in FIG. (Step S221), the process ends (Step S222). In this case, the mobile phone 30 cannot use the data storage service.

  FIG. 9 is a flowchart showing in detail the determination process (determination step) of the number matching degree and the determination process (determination step) of the requested password shown in FIGS. Hereinafter, these processes will be described.

  First, telephone numbers and manufacturing numbers are extracted from the received usage request (step S301), and these numbers are compared with the telephone numbers and manufacturing numbers stored in the storage unit 12. Here, when the combination of the extracted telephone number and manufacturing number exists in the storage unit 12 (step S302; YES), it is determined to request the first password (step S303).

  On the other hand, when such a combination does not exist (step S302; NO), it is checked whether or not a telephone number that matches the extracted telephone number is stored in the storage unit 12 (step S304). If there is a matching telephone number (step S304; YES), it is further checked whether another telephone number corresponding to the extracted production number exists (step S305). Here, the fact that such another telephone number exists (step S305; YES) means that it corresponds to the above-mentioned determination C, so that it is determined to request the third password (step S306). Thereafter, processing such as an inquiry to another mobile phone 40 is performed. On the other hand, when the other telephone number does not exist (step S305; NO), it is determined to request the second password (step S307).

  On the other hand, if the extracted telephone number does not exist in the storage unit 12 (step S304; NO), it is checked whether or not a manufacturing number that matches the extracted manufacturing number is stored in the storage unit 12 (step S304). S308). If there is a matching production number, that is, if there is another telephone number corresponding to the extracted production number (step S308; YES), it is determined to request a third password (step S308; YES). Step S309). On the other hand, if the serial numbers do not match (step S308; NO), that is, if the determination D is satisfied, prohibition of connection between the mobile phone 30 and the data storage server 50 is determined (step S310).

  As described above, according to the present embodiment, the telephone number and the manufacturing number transmitted from the mobile phone 30 that intends to use the data custody service and these numbers stored in the authentication server 10 in advance are included. The comparison is made to determine the degree of coincidence between the telephone number and the serial number. Based on the determined degree of coincidence, the use of the data storage service by the mobile phone 30 is authenticated. Thus, at the time of authentication, by considering the degree of coincidence between the telephone number and the manufacturing number, authentication according to the configuration of the mobile phone 30 that intends to use the service becomes possible. That is, a plurality of types of authentication can be performed according to the combination of a SIM card having a telephone number and a telephone body having a manufacturing number. As a result, it is possible to further increase security when the mobile phone 30 uses the service via the mobile communication network 20. In addition, since a plurality of types of authentication can be performed, a service corresponding to the authentication can be provided.

  In addition, according to the present embodiment, one of the first to third passwords is selected and requested to the mobile phone 30 based on the determined degree of matching between the telephone number and the manufacturing number. Thereafter, when a password is transmitted from the mobile phone 30 in response to the request, the password is compared with the requested password, and if the two passwords match, the use of the service by the mobile phone 30 is permitted. Thus, by requesting a password at the time of authentication, it becomes possible to further increase security when the mobile phone 30 uses a service via the mobile communication network 20. Further, since the required password is determined based on the degree of coincidence between the telephone number and the manufacturing number, the authentication difficulty level can be changed. As a result, the security can be further increased.

  Further, according to the present embodiment, when another telephone number corresponding to the received manufacturing number and different from the received telephone number exists in the storage unit 12, the other telephone number having the other telephone number is stored. The mobile phone 40 is inquired whether to permit the third password request. Thereafter, when the authentication server 10 receives a reply notification indicating that the third password request is permitted, the third password is requested from the mobile phone 30. As a result, when a user intends to use a service contracted by another person (service contractor), an inquiry is made to the service contractor based on the telephone number (another telephone number) of the service contractor. Is called. Therefore, the service contractor can recognize that the contracted service is about to be used by a third party. In addition, if the service contractor does not permit the request for the third password, the third password is not requested for the mobile phone 30 to use the service. Therefore, the use of the service by a third party can be prevented more reliably. As a result, it is possible to further enhance security when the mobile phone 30 uses a service via the mobile communication network 20.

  Further, according to the present embodiment, the location information of the mobile phone 30 that intends to use the service is transmitted to another mobile phone 40 via the authentication server 10. As a result, the holder of the other mobile phone 40, that is, the service contractor who is going to use the contracted service to a third party can know the location of the third party and It is possible to take measures such as tracking. As a result, it is possible to further enhance security when the mobile phone 30 uses a service via the mobile communication network 20.

  The present invention has been described in detail based on the embodiments. However, the present invention is not limited to the above embodiment. The present invention can be modified in various ways as described below without departing from the scope of the invention.

  In the above embodiment, the determination unit 14 requests the first password from the mobile phone 30 when the combination of the received telephone number and manufacturing number is stored in the storage unit 12 (in the case of determination A). In this case, the authentication server 10 may grant the use of the service immediately without requesting the first password. Specifically, first, the determination unit 14 that has acquired the determination result indicating the determination A determines to permit the use of the data storage service by the mobile phone 30, and outputs a permission signal to the permission unit 16. Then, the permission unit 16 generates a permission notification indicating that the connection between the mobile phone 30 and the data storage server 50 is permitted based on the permission signal, and transmits the permission notification to the mobile phone 30.

  According to such a modification, when the combination of the telephone number and the manufacturing number transmitted from the mobile phone 30 matches the one stored in the storage unit 12, the user can enter the password in the mobile phone 30. The service can be used immediately without any input. Therefore, the convenience of the service is improved and the authentication server 10 can be configured more simply.

  Moreover, in the said embodiment, although the mobile telephone 30 itself acquired the present position of an own machine, the positional information was produced | generated, and the positional information was transmitted to the authentication server 10, However, The acquisition method of positional information is not limited to this. For example, the location area (for example, “Roppongi area”) of the mobile phone 30 is acquired based on data acquired by the authentication server 10 from a base station (not shown) in the mobile communication network 20 and is used as position information. May be used. Thereby, since the communication between the mobile communication network 20 and the mobile phone 30 is reduced, the processing of the mobile communication network 20 and the mobile phone 30 can be reduced.

  In the above-described embodiment, the authentication server 10 acquires the current position (position information) of the mobile phone 30 after it is determined that the third password is requested. However, the timing for acquiring the position information is not limited to this. For example, the authentication system 1 may be configured so that location information is included in a use request transmitted from the mobile phone 30. As a result, it is not necessary to determine whether or not the authentication server 10 requests position information, and the processing in the authentication server 10 can be simplified.

  Moreover, in the said embodiment, although the 1st-3rd password was prepared based on the coincidence degree of a telephone number and a manufacturing number for authentication, the kind of password to prepare is not limited to this. For example, when the combination of the telephone number and the production number included in the use request exists in the storage unit 12, the first password is requested, and when the combination does not exist in the storage unit 12, the second password is requested. You may make it do. It is also conceivable to increase the types of passwords required.

  Moreover, in the said embodiment, although the telephone number was used as user identification information and the manufacturing number was used as terminal identification information, another identifier may be applied to these identification information. For example, a mail address may be used as the user identification information, or a serial number may be used as the terminal identification information.

  In the above embodiment, the content of the service provided after the mobile phone 30 is connected to the data storage server 50 is not specifically limited, but a predetermined process is executed based on the password used at the time of authentication. Alternatively, the authentication system 1 may be configured. For example, when the authentication with the second password is executed (in the case of model change or the like), the data storage server 50 automatically transmits the phone book data or the like to the mobile phone 30, and the authentication with the other password is performed. In such a case, the system may be configured so that the data storage server 50 does not automatically execute.

  In the above embodiment, the authentication server 10 requests a password from the mobile phone 30 based on the matching degree between the telephone number and the manufacturing number, and performs authentication based on the password transmitted in response to the request. Is not limited to this. For example, the authentication server 10 may perform authentication immediately without requesting a password based on the degree of coincidence between the received telephone number and manufacturing number. In this case, when the combination of the received telephone number and manufacturing number is stored in the storage unit 12, it is conceivable that the authentication server 10 authenticates the entire use of the data storage service. Further, when only one of the received telephone number and manufacturing number matches the stored one, it is conceivable that the authentication server 10 authenticates the use of a part of the data storage service. Further, the authentication server 10 may determine whether or not a password request is necessary based on the degree of coincidence between the telephone number and the manufacturing number.

  In the above embodiment, the data storage server 50 provides a service to the mobile phone 30, but the type of service provided to the mobile phone 30 is not limited. Further, the function of the authentication server 10 and the service providing function may be mounted on one server.

  In the above embodiment, the mobile phone 30 is used as a communication terminal. However, a simple mobile phone (PHS: Personal Handy-phone System) or a portable information terminal (PDA: Personal Digital Assistant) is used as a communication terminal. May be used. A notebook or desktop personal computer may be used as a communication terminal.

It is a figure which shows the whole structure of the authentication system which concerns on embodiment. It is a figure which shows the function structure of the authentication server shown by FIG. It is an example of the data stored in a storage part. It is a figure which shows the function structure of the mobile telephone shown by FIG. It is a figure which shows the function structure of the other mobile telephone shown by FIG. It is a sequence diagram which shows the process of the authentication system shown in FIG. It is a sequence diagram which shows the process of the authentication system shown in FIG. It is a sequence diagram which shows the process of the authentication system shown in FIG. It is a flowchart which shows the determination process of the matching degree of the number shown by FIGS. 6-8, and the determination process of a request | requirement password.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Authentication system, 10 ... Authentication server, 11 ... Receiving part (identification information receiving means, password receiving means, answer receiving means and position information receiving means), 12 ... Storage part (storage means), 13 ... Determination part (determination means) ), 14... Determination unit (determination unit), 15... Transmission unit (password request unit, inquiry unit and location information transmission unit), 16... Authorization unit (permission unit), 30. Units (identification information transmitting unit and password transmitting unit), 36... Accepting unit (accepting unit), 38 .. permission obtaining unit (authentication obtaining unit) 40... Other mobile phone (other communication terminal).

Claims (10)

Storage means for storing user identification information for identifying a user of a communication terminal and terminal identification information for individually identifying the communication terminal;
Identification information receiving means for receiving the user identification information and the terminal identification information from the communication terminal that intends to use the service;
Determining means for determining whether the user identification information and terminal identification information received by the identification information receiving means match the user identification information and terminal identification information stored in the storage means;
An authentication server comprising authentication means for authenticating use of the service by the communication terminal based on the degree of coincidence between the user identification information and the terminal identification information determined by the determination means. The storage means stores the user identification information, the terminal identification information, and a plurality of types of passwords for using a service that can be provided to the communication terminal in association with each other,
The authentication means is
A determining unit that determines to request the communication terminal for one password among the plurality of types of passwords based on the degree of coincidence between the user identification information and the terminal identification information determined by the determination unit;
Password request means for requesting the communication terminal for the password determined by the determination means;
Password receiving means for receiving a password transmitted from the communication terminal in response to a request by the password request means;
Permission to determine whether the password received by the password receiving means matches the password requested by the password requesting means, and to permit use of the service by the communication terminal if these passwords match Means,
The authentication server according to claim 1.   The determining means determines to request a predetermined password from the communication terminal when a combination of user identification information and terminal identification information received by the identification information receiving means is stored by the storage means. 3. The authentication server according to claim 2, wherein when the combination is not stored by the storage means, it is determined to request another password different from the predetermined password from the communication terminal.   The separate password includes the terminal identification information received by the identification information receiving means, and the user identification information received by the identification information receiving means matches the user identification information stored by the storage means. If the corresponding other user identification information is not stored by the storage means, the first separate password is used, corresponding to the terminal identification information received by the identification information receiving means, and by the identification information receiving means The authentication server according to claim 3, wherein when another user identification information different from the received user identification information is stored in the storage means, the second separate password is used. When the determination means determines to request the second separate password from the communication terminal, the second separate password request is issued to the other communication terminal having the other user identification information. Inquiry means for inquiring whether or not to permit,
Response receiving means for receiving an answer notification indicating an answer to the inquiry transmitted from the other communication terminal in response to the inquiry by the inquiry means; and
The password request means requests the second separate password from the communication terminal when the reply notification received by the reply receiving means indicates that the request for the second separate password is permitted. 4. The authentication server according to 4. Position information receiving means for receiving position information indicating the current position of the communication terminal from the communication terminal that intends to use the service;
The authentication server according to claim 5, further comprising a position information transmitting unit that transmits the position information received by the position information receiving unit to the other communication terminal. The determination unit determines to request the communication terminal for the predetermined password when a combination of user identification information and terminal identification information received by the identification information reception unit is stored in the storage unit. Instead of deciding to authorize the use of the service by the communication terminal,
The authentication server according to any one of claims 2 to 6, wherein the permission unit permits the use of the service by the communication terminal based on the determination by the determination unit. An authentication server for authenticating use of a service that can be provided to a communication terminal to the communication terminal, user identification information for identifying a user of the communication terminal, and terminal identification information for individually identifying the communication terminal And a storage step for storing and
An identification information receiving step in which the authentication server receives the user identification information and the terminal identification information from the communication terminal that intends to use the service;
A determination step in which the authentication server determines whether or not the user identification information and terminal identification information received in the identification information reception step match the user identification information and terminal identification information stored in the storage step. When,
An authentication method comprising: an authentication step in which the authentication server authenticates use of the service by the communication terminal based on a degree of coincidence between the user identification information and the terminal identification information determined in the determination step. A communication terminal capable of communicating with the authentication server according to claim 1,
Identification information transmitting means for transmitting user identification information for identifying a user of the terminal and terminal identification information for individually identifying the terminal to the authentication server in order to use the service;
A communication terminal comprising: an authentication acquisition unit configured to acquire the authentication when the use of the service is authenticated by the authentication server based on the user identification information and the terminal identification information transmitted by the identification information transmission unit. An authentication system comprising: a communication terminal; and an authentication server that authenticates the communication terminal to use a service that can be provided to the communication terminal,
The authentication server is
Storage means for storing user identification information for identifying a user of the communication terminal and terminal identification information for individually identifying the communication terminal;
Identification information receiving means for receiving the user identification information and the terminal identification information from the communication terminal that intends to use the service;
Determining means for determining whether the user identification information and terminal identification information received by the identification information receiving means match the user identification information and terminal identification information stored in the storage means;
Authentication means for authenticating use of the service by the communication terminal based on the degree of coincidence of the user identification information and the terminal identification information determined by the determination means;
The communication terminal is
Identification information transmitting means for transmitting the user identification information and the terminal identification information to the authentication server in order to use the service;
An authentication acquisition unit that acquires the authentication when the authentication unit authenticates the use of the service based on the user identification information and the terminal identification information transmitted by the identification information transmission unit;
An authentication system characterized by that.

Images