JP2008226200A - Authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To securely execute personal authentication to any server on a network of all the world without causing deterioration in operability. <P>SOLUTION: The authentication system includes a user terminal, a network terminal and a management server connected through the network to authenticate a user who provides a service, wherein the management server includes: a means for managing a session ID corresponding to a service; a means for generating information obtained by encoding a URL including the session ID; a means for providing a network terminal with the service through the network and transmitting the information obtained by encoding the URL including the session ID in accordance with access of the network terminal; a means for managing user information; and a means for performing user authentication when the user terminal reads the information obtained by encoding the URL including the session ID from the network terminal and accesses the information. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an authentication system that performs personal authentication of a user who accesses a server, and more particularly to an authentication system that can securely perform personal authentication for any server in the world on a network.

  As the use of networks such as the Internet becomes active, opportunities for authentication using the networks are increasing. Therefore, when performing authentication on the network, there is a risk that authentication information used for authentication is stolen. Here, if authentication information is stolen, a situation may occur in which a third party impersonates the person and gains access to information that should be kept secret, or without permission for commercial transactions. There is nothing.

  Therefore, in order to avoid the above situation, when accessing an application server from a client WWW (World Wide Web) browser, first, a secure authentication is performed with an authentication server using an IC card from the mobile phone side. A technique is known in which authentication is performed by receiving a disposable authentication key issued from an authentication server and inputting a disposable authentication key and a mobile phone number on a client WWW browser (see, for example, Patent Document 1). .)

In addition, when authenticating from the user terminal to the net server, instead of inputting authentication information directly on the user terminal, the session ID obtained from the net server is input on the mobile phone and the mobile phone company server makes a call. A technique is also known in which a number and a session ID are transmitted to a net server and authenticated (see, for example, Patent Document 2). Such a conventional technique has an advantage that safety can be further improved by using a mobile phone without directly inputting information necessary for authentication on the user terminal.
JP 2001-243196 A JP 2005-309860 A

  However, in the conventional technique described in Patent Document 1, since it is necessary to manually input the telephone number on the client WWW browser in the authentication procedure, there is a problem that the telephone number may be leaked by spyware or the like. Further, in the prior art described in Patent Document 2, when it is necessary to input the telephone number of the mobile phone on the user terminal, only when performing user registration, the telephone number from the mobile phone company server at the time of authentication is used. Since transmission is necessary, a contract with a mobile phone company is required for using the server, and there is a problem that versatility is lowered. Furthermore, since it is necessary to manually input the session ID acquired from the net server on the mobile phone, there is a problem that the operability is deteriorated.

  Accordingly, the present invention has been made in view of the above-described problems, and provides an authentication system that can safely perform personal authentication to any server in the world on the network without deteriorating operability. The purpose is to do.

The present invention proposes the following items in order to solve the above problems.
(1) The present invention is an authentication system that includes a user terminal, a network terminal, and a management server connected via a network, and authenticates a user who provides a service, wherein the management server has a session corresponding to the service. Session ID management means (for example, corresponding to the session ID management unit 11 in FIG. 1) for managing the ID, and encoded information generation means (for example, the code in FIG. 1) for generating information obtained by encoding the URL including the session ID And an application process for providing a service to the network terminal via the network and transmitting information encoded with a URL including the session ID in response to the access of the network terminal. Means (for example, equivalent to the application processing unit 13 in FIG. 1) and user information for managing user information A user who performs user authentication when the user terminal accesses information obtained by encoding a URL including the session ID from the network terminal (for example, corresponding to the user information management unit 14 in FIG. 1) and the user terminal. An authentication system comprising an authentication processing means (for example, corresponding to the user authentication processing unit 15 in FIG. 1) is proposed.

  According to the present invention, the session ID management unit of the management server manages the session ID corresponding to the service, and the encoded information generation unit generates information in which the URL including the session ID is encoded. The application processing means provides a service to the network terminal via the network, and transmits information obtained by encoding a URL including a session ID according to the access of the network terminal. The user information management means manages user information, and the user authentication processing means performs user authentication when the user terminal reads and accesses information obtained by encoding the URL including the session ID from the network terminal. Therefore, it is possible to easily authenticate the user by reading the encoded information without the telephone number input operation.

  (2) In the authentication system according to (1), the user information management unit manages the personal information of the user in combination with the ID information of the user terminal that is transmitted when the user terminal accesses the authentication system. We have proposed an authentication system characterized by

  According to the present invention, the user information management means manages the personal information of the user in combination with the ID information of the user terminal that is transmitted when the user terminal accesses. Therefore, the user can be uniquely specified by the ID information of the user terminal.

  (3) The present invention provides the authentication system according to (1), wherein the user terminal is a mobile phone, and the user authentication processing means accepts only access from an IP address of a dedicated network. is suggesting.

  According to this invention, the user terminal is a mobile phone, and the user authentication processing means accepts only access from the IP address of the dedicated network. Accordingly, since the IP address is transferred from the mobile phone through a secure dedicated network operated by the communication company, information leakage can be effectively prevented.

  (4) In the authentication system according to (1), the user terminal transmits code information obtained by converting a combination of a session ID and a user terminal ID by a one-way function to the user authentication processing unit. The authentication processing means executes user authentication by comparing the code information obtained by converting the combination of the session ID registered in the session ID management means and the ID of the user terminal by the one-way function with the transmitted code information. We have proposed an authentication system characterized by

  According to this invention, the user terminal transmits the code information obtained by converting the combination of the session ID and the user terminal ID by a one-way function to the user authentication processing means, and the user authentication processing means is registered in the session ID management means. The user authentication is executed by comparing the code information obtained by converting the combination of the session ID and the ID of the user terminal by a one-way function with the transmitted code information. Therefore, by using the code information converted by the one-way function, it is possible to improve the safety by preventing the ID of the user terminal from being directly decoded from the converted code information.

  (5) The present invention proposes an authentication system in which the information obtained by encoding the URL including the session ID is a two-dimensional code for the authentication system of (1).

  According to the present invention, since the information obtained by encoding the URL including the session ID is a two-dimensional code, the URL can be easily obtained and accessed by using a camera function of a mobile phone that is widely used at present. It can be carried out.

  (6) The present invention proposes an authentication system in which the information obtained by encoding the URL including the session ID is an image with a digital watermark in the authentication system of (1).

  According to the present invention, since the information obtained by encoding the URL including the session ID is an image with a digital watermark, the URL can be easily obtained and accessed by using a camera function of a mobile phone that is widely used at present. In addition, the presence of information encoded by a third party can be concealed.

  (7) The present invention proposes an authentication system for the authentication system of (1), characterized in that information obtained by encoding a URL including the session ID is stored in a non-contact IC.

  According to the present invention, since the information obtained by encoding the URL including the session ID is stored in the non-contact IC, it is possible to store the large-capacity encoded information, and it is easy only by holding it over the non-contact IC. In addition, encoded information can be acquired.

  (8) The present invention is an authentication system that includes a user terminal, a network terminal, and a management server connected via a network, and authenticates a user who provides a service, wherein the management server has a session corresponding to the service. Session ID management means for managing ID (for example, equivalent to the session ID management unit 11 in FIG. 7), and encoded information generation means for generating information obtained by encoding the URL including the session ID and user ID (for example, FIG. 7), and provides the service to the network terminal via the network, and transmits information encoded with the URL including the session ID according to the access of the network terminal. Application processing means (for example, equivalent to the application processing unit 13 in FIG. 7) and user information User information management means (for example, equivalent to the user information management unit 16 in FIG. 7) and network terminal authentication processing means for executing user authentication of the network terminal (for example, equivalent to the network terminal authentication processing unit 19 in FIG. 7) And user authentication processing means (for example, equivalent to the user authentication processing unit 17 in FIG. 7) for performing user authentication when the user terminal reads and accesses information obtained by encoding the URL including the session ID from the network terminal. And an authentication system characterized by comprising:

  According to this invention, the session ID managing means of the management server manages the session ID corresponding to the service, and the encoded information generating means includes a URL including a code converted by a one-way function based on the session ID and the user ID Is generated. The application processing means provides a service to the network terminal via the network and transmits information encoded with a URL including a session ID according to the access of the network terminal. The user information management means manages the user information. To do. Then, the net terminal authentication processing unit performs user authentication of the net terminal, and the user authentication processing unit performs user authentication when the user terminal reads and accesses information obtained by encoding a URL including a session ID from the net terminal. Do. Therefore, it is possible to easily authenticate the user by reading the encoded information without the telephone number input operation. Even if the user terminal is lost or stolen, user authentication on the network terminal is required, so that a more secure system can be constructed.

  (9) The present invention relates to the authentication system according to (7), wherein the user information management means combines the personal information and user ID of the user with the ID information of the user terminal transmitted when the user terminal performs access. We propose an authentication system characterized by management.

  According to this invention, the user information management means manages the user's personal information and user ID in combination with the user terminal ID information transmitted when the user terminal accesses. Therefore, the user can be uniquely specified by the ID information and user ID of the user terminal.

  (10) In the authentication system according to (7), the encoded information generation unit is unidirectional based on the session ID and the user ID after the network terminal authentication processing by the network terminal authentication processing unit is completed. An authentication system is proposed that generates information obtained by encoding a URL including a code converted by a function.

  According to this invention, on the condition that the authentication processing of the network terminal is completed, the encoded information generating means encodes the information including the URL including the code converted by the one-way function based on the session ID and the user ID. Since it is generated, safety can be ensured even if the user terminal is lost or stolen.

  (11) The present invention proposes an authentication system according to (8) or (10), characterized in that information obtained by encoding a URL including the session ID and the user ID is a two-dimensional code. Yes.

  According to the present invention, since information obtained by encoding a URL including a code converted by a one-way function based on a session ID and a user ID is a two-dimensional code, a mobile phone camera that is currently widely used By using the function, the URL can be easily acquired and accessed.

  (12) The present invention proposes an authentication system according to (8) or (10), wherein information obtained by encoding a URL including the session ID and the user ID is a digital watermarked image. ing.

  According to the present invention, since the information obtained by encoding the URL including the code converted by the one-way function based on the session ID and the user ID is an image with a digital watermark, By using the camera function, the URL can be easily obtained and accessed, and the presence of information encoded by a third party can be concealed.

  (13) The present invention relates to the authentication system according to (8) or (10), characterized in that information obtained by encoding a URL including the session ID and the user ID is stored in a contactless IC. is suggesting.

  According to the present invention, since the encoded information of the URL including the session ID and the user ID is stored in the non-contact IC, it is possible to store a large amount of encoded information and hold it over the non-contact IC. The encoded information can be easily acquired by just using this method.

  (14) The authentication system according to (8), wherein the user terminal is a mobile phone, and the user authentication processing means accepts only access from an IP address of a dedicated network. is suggesting.

  According to this invention, the user terminal is a mobile phone, and the user authentication processing means accepts only access from the IP address of the dedicated network. Accordingly, since the IP address is transferred from the mobile phone through a secure dedicated network operated by the communication company, information leakage can be effectively prevented.

  (15) In the authentication system according to (8), the user terminal transmits code information obtained by converting a combination of a session ID, a user ID, and a user terminal ID by a one-way function to the user authentication processing unit. The user authentication processing unit compares the code information obtained by converting the combination of the session ID registered in the session ID management unit, the user ID, and the user terminal ID by the one-way function with the transmitted code information. Therefore, an authentication system characterized by performing user authentication is proposed.

  According to the present invention, the user terminal transmits code information obtained by converting the combination of the session ID, the user ID, and the user terminal ID by a one-way function to the user authentication processing unit, and the user authentication processing unit sends the code information to the session ID management unit. The user authentication is executed by comparing the code information obtained by converting the combination of the registered session ID, user ID, and user terminal ID by a one-way function with the transmitted code information. Therefore, by using the code information converted by the one-way function, it is possible to improve the safety by preventing the ID of the user terminal from being directly decoded from the converted code information.

  According to the present invention, there is an effect that simple personal authentication using reading of encoded information such as a two-dimensional code can be performed without requiring input of a telephone number. In addition, since it is only necessary to build a system on the Internet and does not require access to a mobile phone company's dedicated network or telephone number database, a system can be easily built on the general Internet and secure personal authentication is possible. It has the effect of becoming. Furthermore, even if the mobile terminal is lost or stolen, user authentication on the network terminal is required, so that a more secure system can be constructed.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
Note that the constituent elements in the present embodiment can be appropriately replaced with existing constituent elements and the like, and various variations including combinations with other existing constituent elements are possible. Therefore, the description of the present embodiment does not limit the contents of the invention described in the claims.

<First Embodiment>
First, a first embodiment of the present invention will be described with reference to FIGS. In the present embodiment, a mobile phone is exemplified as a user terminal.

<Configuration of authentication system and management server>
As shown in FIG. 1, the authentication system according to the present embodiment includes a management server 10, a mobile phone 20, and a network terminal 30, and the network terminal 30 is connected to the management server 10 via the Internet network 40. The mobile phone 20 is connected to the management server 10 via the mobile phone dedicated network network 50 and the Internet network 40.

  As shown in FIG. 1, the management server 10 includes a session ID management unit 11, an encoded information generation unit 12, an application processing unit 13, a user information management unit 14, and a user authentication processing unit 15. Has been.

  Here, the session ID management unit 11 manages the session ID corresponding to the service. The encoded information generation unit 12 generates information obtained by encoding a URL including a session ID. Examples of encoded information include two-dimensional codes such as QR codes, digital watermarked images, encoded information stored in non-contact ICs, and the like, but are not limited thereto.

  The application processing unit 13 provides a service to the network terminal 30 via the network, and transmits information obtained by encoding a URL including a session ID in response to the access of the network terminal 30.

  The user information management unit 14 manages user information. Specifically, for example, the personal information of the user and the ID information of the mobile phone transmitted when the mobile phone 20 accesses are combined and managed.

  The user authentication processing unit 15 performs user authentication when the mobile phone 20 reads and accesses information obtained by encoding a URL including a session ID from the network terminal 30. Specifically, for example, the user authentication processing unit 15 transmits from the mobile phone 20 code information obtained by converting a combination of the session ID registered in the session ID management unit 11 and the ID of the mobile phone 20 by a one-way function. The user authentication is executed by comparing the code information obtained by converting the combination of the session ID and the ID of the mobile phone 20 with the same one-way function as described above.

<Processing of authentication system>
Next, processing of the authentication system according to the present embodiment will be described with reference to FIGS.
First, the network terminal 30 accesses the application processing unit 13 (step S101). Next, the application processing unit 13 checks whether or not the session ID is transmitted from the network terminal 30 (step S102). If the session ID is transmitted (“Yes” in step S102), the session ID is the session ID. It is confirmed whether or not it is registered in the ID management unit 11 (step S103). Here, when the session ID is not transmitted from the network terminal 30 (“No” in step S102), and when the session ID is transmitted from the network terminal 30 but is not registered in the session ID management unit 11 (step S103). ("No")), the session ID management unit 11 generates a new session ID (step S106).

  Then, the session IDs (for example, session IDs “ba878342decf194435647e3”, “784392bcdae76341308dfe”, “043287cdbef643bfae6dc” in FIG. 5) are registered in the session management table shown in FIG. 5 to generate a URL for the mobile phone (step S107). The encoded information generation unit 12 generates, for example, a two-dimensional code obtained by encoding a URL including a session ID (step S108), and transmits the generated two-dimensional code to the network terminal 30 (step S109). Note that the session ID management unit 11 waits until the authentication procedure in the mobile phone 20 is completed. The network terminal 30 periodically accesses the application processing unit 13 during this standby state, but the same two-dimensional code is repeatedly transmitted until authentication by the mobile phone 20 is completed.

  On the other hand, when the mobile phone side authentication is completed when the session ID is transmitted from the network terminal 30 and registered in the session ID management unit 11, the application processing unit 13 performs the network terminal 30. The application information is transmitted to (step S105), and a series of processing operations is completed.

  On the other hand, if the mobile phone side authentication is not completed when the session ID is transmitted from the network terminal 30 and registered in the session ID management unit 11, the encoded information generation unit 12 For example, a two-dimensional code obtained by encoding a URL for a mobile phone including an ID is generated (step S108), and the generated two-dimensional code is transmitted to the network terminal 30 (step S109).

  Next, the user reads the two-dimensional code displayed on the network terminal 30 by the camera function of the mobile phone 20 and acquires the URL. When this URL is accessed (step S201), the user authentication processing unit 15 is notified of the session ID and the mobile phone terminal ID (step S202). Here, the current mobile phone has a function of notifying a terminal-specific ID when connected to the Internet. Therefore, the user authentication processing unit 15 checks whether the access is from the mobile phone 20 by inquiring whether the access source IP address is on a network dedicated to the mobile phone.

  Furthermore, it is confirmed whether or not the session ID is registered in the session ID management unit 11 (step S203), and whether or not the terminal ID of the mobile phone 20 is registered in the user information management unit 14 (step S204). Is not registered ("No" in step S203, "No" in step S204), the process ends.

  On the other hand, when the session ID is registered in the session ID management unit 11 and the terminal ID of the mobile phone 20 is registered in the user information management unit 14 (“Yes” in step S203, “Yes” in step S204). The session ID management unit 11 inquires of the user information management unit 14 about the user information management table shown in FIG. 4, registers the terminal ID of the mobile phone 20 in the session corresponding to the session management table as shown in FIG. The personal information is associated with the session ID (step S205). When the mobile phone terminal ID is registered in the session management table, the session ID management unit 11 transitions from the standby state to the service providing state (step S206). At this time, when the network terminal 30 accesses the application processing unit 13, an individual service is provided from the application processing unit 13 to the network terminal 30 according to the personal information of the user associated with the session ID.

  Therefore, according to the present embodiment, it is possible to perform simple personal authentication using reading of encoded information such as a two-dimensional code without requiring input of a telephone number. In addition, since it is only necessary to build a system on the Internet and does not require access to a mobile phone company's dedicated network or telephone number database, a system can be easily built on the general Internet and secure personal authentication is possible. It becomes.

<Second Embodiment>
A second embodiment of the present invention will be described with reference to FIGS. In the present embodiment, a mobile phone is exemplified as a user terminal.

<Configuration of authentication system and management server>
As shown in FIG. 7, the authentication system according to the present embodiment includes a management server 10, a mobile phone 20, and a network terminal 30, and the network terminal 30 is connected to the management server 10 via the Internet network 40. The mobile phone 20 is connected to the management server 10 via the mobile phone dedicated network network 50 and the Internet network 40.

  As shown in FIG. 1, the management server 10 includes a session ID management unit 11, an application processing unit 13, a user information management unit 16, a user authentication processing unit 17, an encoded information generation unit 18, a network The terminal authentication processing unit 19 is configured. In addition, about the component which attaches | subjects the same code | symbol as 1st Embodiment, since it has the same function, detailed description is abbreviate | omitted.

  The user information management unit 16 manages the personal information and user ID of the user in combination with the ID information of the mobile phone 20 that is transmitted when the mobile phone 20 accesses. For example, the user authentication processing unit 17 is transmitted from the mobile phone 20 with code information obtained by converting a combination of the session ID registered in the session ID management unit 11, the user ID, and the mobile phone 20 ID with a one-way function. The user authentication is executed by comparing the combination of the session ID, the user ID, and the ID of the mobile phone 20 with code information obtained by converting the combination of the session ID, the mobile ID, and the mobile phone 20 with the same one-way function as described above.

  The encoded information generation unit 18 generates information obtained by encoding a URL including a session ID and a user ID. The network terminal authentication processing unit 19 performs user authentication of the network terminal 30.

<Processing of authentication system>
Next, processing of the authentication system according to the present embodiment will be described with reference to FIGS.
In the present embodiment, as shown in FIG. 9, in the user management table, the user's personal information is associated with the user ID, the password, and the terminal ID of the Keita phone 20. First, the network terminal 30 accesses the application processing unit 13 (step S301). Next, the application processing unit 13 checks whether or not the session ID is transmitted from the network terminal 30 (step S302). If the session ID is transmitted (“Yes” in step S302), the session ID is the session ID. It is confirmed whether or not it is registered in the ID management unit 11 (step S303). Here, when the session ID is not transmitted from the network terminal 30 (“No” in step S302) and when the session ID is transmitted from the network terminal 30 but is not registered in the session ID management unit 11 (step S303). ("No")), the network terminal authentication unit 19 performs authentication using the user ID and password (step S306).

  Next, the session management unit 11 generates a session ID and associates the session ID with the user ID as shown in FIG. 11 (step S307). Then, the mobile phone URL is generated from the session ID (step S308). The encoded information generation unit 18 generates, for example, a two-dimensional code from the user ID and the mobile phone URL (step S309), and transmits the generated two-dimensional code to the network terminal 30 (step S310). Note that the session ID management unit 11 waits until the authentication procedure in the mobile phone 20 is completed.

  On the other hand, when the mobile phone side authentication is completed when the session ID is transmitted from the network terminal 30 and registered in the session ID management unit 11, the application processing unit 13 performs the network terminal 30. The application information is transmitted to (step S305), and a series of processing operations is completed.

  On the other hand, when the mobile phone side authentication is not completed when the session ID is transmitted from the network terminal 30 and is registered in the session ID management unit 11, the encoded information generation unit 18 For example, a two-dimensional code is generated from the ID and the mobile phone URL (step S309), and the generated two-dimensional code is transmitted to the network terminal 30 (step S310).

  Next, the user reads the two-dimensional code displayed on the network terminal 30 by the camera function of the mobile phone 20 and acquires the URL. When this URL is accessed (step S401), the user authentication processing unit 17 is notified of the session ID, the mobile phone terminal ID, and the user ID in the URL (step S402).

  Furthermore, it is confirmed whether or not the session ID and user ID are registered in the session ID management unit 11 (step S403), and whether or not the terminal ID of the mobile phone 20 is correctly associated with the user ID (step S404). If either one is not satisfied (“No” in step S403, “No” in step S404), the process ends.

  On the other hand, if the session ID is registered in the session ID management unit 11 and the terminal ID of the mobile phone 20 is correctly associated with the user ID (“Yes” in step S403, “Yes” in step S404), the session The ID management unit 11 inquires of the user information management unit 16 for the user information management table shown in FIG. 10, registers the terminal ID and user ID of the mobile phone 20 in the session management table as shown in FIG. The user's personal information is associated with the session ID (step S405). When the mobile phone terminal ID is registered in the session management table, the session ID management unit 11 shifts from the standby state to the service providing state (step S406). At this time, when the network terminal 30 accesses the application processing unit 13, an individual service is provided from the application processing unit 13 to the network terminal 30 according to the personal information of the user associated with the session ID.

  Therefore, according to the present embodiment, in addition to the operation in the first embodiment, even if the mobile terminal is lost or stolen, user authentication on the network terminal is required. Can be built.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes a design and the like within a scope not departing from the gist of the present invention.

It is a system configuration figure concerning a 1st embodiment. It is a processing flow at the time of access by the network terminal which concerns on 1st Embodiment. It is a processing flow at the time of access by the mobile phone which concerns on 1st Embodiment. It is a figure which shows an example of the management table of the user information management part which concerns on 1st Embodiment. It is a figure which shows an example of the management table of the session ID management part which concerns on 1st Embodiment. It is a figure which shows an example of the management table of the session ID management part which concerns on 1st Embodiment. It is a system configuration figure concerning a 2nd embodiment. It is a processing flow at the time of access by the network terminal which concerns on 2nd Embodiment. It is a processing flow at the time of access by the mobile phone which concerns on 2nd Embodiment. It is a figure which shows an example of the management table of the user information management part which concerns on 2nd Embodiment. It is a figure which shows an example of the management table of the session ID management part which concerns on 2nd Embodiment. It is a figure which shows an example of the management table of the session ID management part which concerns on 2nd Embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Management server, 11 ... Session ID management part, 12, 18 ... Encoding information generation part, 13 ... Application processing part, 14, 16 ... User information management part, 15, 17 ... User authentication processing unit, 19 ... Net terminal authentication processing unit, 20 ... Mobile phone, 30 ... Net terminal

Claims (15)

An authentication system consisting of a user terminal, a network terminal and a management server connected via a network, for authenticating a user who provides a service,
The management server is
Session ID management means for managing a session ID corresponding to the service;
Encoded information generating means for generating information obtained by encoding a URL including the session ID;
Application processing means for providing a service to the network terminal via the network and transmitting information obtained by encoding a URL including the session ID in response to the access of the network terminal;
User information management means for managing user information;
User authentication processing means for performing user authentication when the user terminal reads and accesses information obtained by encoding a URL including the session ID from the network terminal;
An authentication system comprising:   2. The authentication system according to claim 1, wherein the user information management means manages the personal information of the user in combination with the ID information of the user terminal that is transmitted when the user terminal accesses.   2. The authentication system according to claim 1, wherein the user terminal is a mobile phone, and the user authentication processing unit accepts only access from an IP address of a dedicated network.   The user terminal transmits code information obtained by converting a combination of a session ID and a user terminal ID by a one-way function to the user authentication processing unit, and the user authentication processing unit is registered in the session ID management unit. The authentication system according to claim 1, wherein user authentication is performed by comparing code information obtained by converting a combination of a user terminal ID with a one-way function with the transmitted code information.   The authentication system according to claim 1, wherein information obtained by encoding a URL including the session ID is a two-dimensional code.   2. The authentication system according to claim 1, wherein information obtained by encoding a URL including the session ID is an image with a digital watermark.   The authentication system according to claim 1, wherein information obtained by encoding a URL including the session ID is stored in a contactless IC. An authentication system consisting of a user terminal, a network terminal and a management server connected via a network, for authenticating a user who provides a service,
The management server is
Session ID management means for managing a session ID corresponding to the service;
Encoded information generating means for generating information obtained by encoding a URL including the session ID and user ID;
Application processing means for providing a service to the network terminal via the network and transmitting information obtained by encoding a URL including the session ID in response to the access of the network terminal;
User information management means for managing user information;
Net terminal authentication processing means for performing user authentication of the net terminal;
User authentication processing means for performing user authentication when the user terminal reads and accesses information obtained by encoding a URL including the session ID from the network terminal;
An authentication system comprising:   8. The user information managing means manages the personal information and user ID of the user in combination with the ID information of the user terminal that is transmitted when the user terminal accesses. Authentication system.   Information obtained by encoding the URL including the code converted by the one-way function based on the session ID and the user ID after the encoded information generating unit completes the authentication process of the network terminal by the network terminal authentication processing unit. The authentication system according to claim 8, wherein the authentication system is generated.   The authentication system according to claim 8 or 10, wherein information obtained by encoding a URL including the session ID and the user ID is a two-dimensional code.   The authentication system according to claim 8 or 10, wherein information obtained by encoding a URL including the session ID and the user ID is an image with a digital watermark.   The authentication system according to claim 8 or 10, wherein information obtained by encoding a URL including the session ID and the user ID is stored in a contactless IC.   9. The authentication system according to claim 8, wherein the user terminal is a mobile phone, and the user authentication processing unit accepts only access from an IP address of a dedicated network.   The user terminal transmits code information obtained by converting a combination of a session ID, a user ID, and a user terminal ID by a one-way function to the user authentication processing unit, and the user authentication processing unit is registered in the session ID management unit. 9. The user authentication is performed by comparing code information obtained by converting a combination of a session ID, a user ID, and a user terminal ID with the one-way function with the transmitted code information. The authentication system described in.

Images