JP2008269220A - Authentication transfer system, authentication transfer method, terminal device and authentication server - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system and authentication method, capable of flexibly responding to authentication needed for use of a service and rapidly performing authentication processing even in an environment where a plurality of different authentication protocols by a plurality of authentication servers is used, and an authentication condition is differed depending on a client, a user of the client or an application. <P>SOLUTION: A request receiving part 202 determines whether authentication in an authentication server has been performed in the past or not. When the determination result is affirmative, an agent control part 204 activates, in response to a request from the request receiving part 202, a corresponding agent. The agent activated by the agent control part 204 performs preset authentication processing based on access management information. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an authentication delegation system and an authentication delegation method, and more particularly to an authentication delegation system, an authentication delegation method, a terminal device, and an authentication server that can be applied to a downloaded application.

  Conventionally, a server / client type authentication method has been used. When a user or an application uses a specific function, the client asks a server on the network (hereinafter referred to as an authentication server) and uses the function within a predetermined limit. However, with this method, it is necessary to connect to the authentication server each time a specific function is used, and this requires time and fees. In addition, if the function is not connected to the network, the function may be used. There was a problem that it was not possible.

  A technique (method) for solving such a conventional problem has been proposed (see Patent Document 1). In this method, authentication information is stored in the client (client machine), and if the connection to the network is not possible during the authentication process, the authentication process is performed in the client to solve the above-described problem.

  FIG. 12 is a configuration diagram showing the configuration of the application management client 41 in the client machine for realizing the method of Patent Document 1 described above. To explain this operation, when performing authentication processing in the client, first, the client side authentication unit 51 displays the login form 59 on the display device 42 and requests the client user to input information necessary for user authentication. As a result, when predetermined information is input by the user's operation, the client-side authentication unit 51 compares the input information input by the client user to the login form 59 through the input device 43 and the authentication information 52 to perform user authentication. I do.

  Also, it accepts service authentication requests from client terminals, issues an agent authentication certificate through authentication processing, accepts service use requests from client terminals, and if the authentication certificate attached to the service use request is valid For example, the first server authentication certificate of the first server designated by the client terminal or the user is acquired from the first server S using the authentication information internally held, or the first acquired if previously acquired Take out one server authentication certificate as necessary, present the acquired or taken out server authentication certificate, make a service use request to the first server, and return the transmission result from the first server to the client terminal Technology has also been proposed (see Patent Document 2). According to this technique, when a client terminal requests processing to a plurality of servers, authentication work is not required twice or more, and the client terminal itself does not need to hold information necessary for accessing the plurality of servers.

JP 2005-141427 A JP 2002-324049 A

  However, the conventional technique has the following problems. First, the first problem is that the authentication process for using the service is fixed and not flexible. This is because the conventional technology presupposes an authentication process using an ID and a password input by a user operation (see, for example, Patent Document 1, paragraph 0042 or 0159).

  Generally, the authentication protocol differs depending on the authentication server, so the client needs to support a plurality of authentication servers. If the above authentication process is assumed, a plurality of authentication servers and authentication processes It is difficult to deal with For example, some authentication servers may ask for information such as names in addition to IDs and passwords, while other authentication servers do not require IDs and passwords, but may only set the number of times or the period for which the function is allowed to be used. . In addition, since the authentication process and the authentication conditions differ depending on the client, the client user, and the application, it is necessary to set the system in consideration of these conditions.

  Next, the second problem is that it takes time for authentication. This is because in the conventional technique, authentication processing is performed in the client when connection to the network is not possible at the time of authentication (see Patent Document 1, paragraph 0157, etc.). For this reason, it takes time to determine that connection to the network is impossible. Further, in the conventional technique (Patent Document 2), the service is connected to the server every time it is used, and it takes time to use the service.

  The present invention has been made in order to solve the above-described problems. The object of the present invention is to use a plurality of different authentication protocols by a plurality of authentication servers, and depending on a client, a client user, or an application. An object of the present invention is to provide an authentication system and an authentication method capable of flexibly dealing with authentication required for use of a service even in an environment with different authentication conditions and capable of promptly performing authentication processing.

  An authentication delegation system according to the present invention includes a terminal device, an authentication server, and an application distribution server connected via a network, and the terminal device uses the application distribution server to execute applications and application service information. Corresponding to the terminal device communication control means to download the attribute file consisting of, the application control unit to control the execution operation of the application, and the agent that is accepted from the authentication server and authenticates the service required when the application is executed Authentication determination for determining that the authentication of the service required when the application control unit executes the application downloaded by the communication control means and the terminal device storage unit that stores the access management information to be performed In addition, the agent control that stores the agent received from the authentication server and activates the agent that authenticates the service requested by the application executed by the application control unit by determining that the authentication determination unit has already authenticated. And an agent generating means for receiving an authentication request for a service from the terminal device and generating an agent for performing authentication in the terminal device based on access management information provided in advance. At least an agent generated by the agent generating means and a server communication control means for sending the access management information used for generating the agent to the terminal device. The agent generating means responds to the authentication request received from the terminal device. Corresponding Generating an agent based on the access management information, in the terminal device, the agent is obtained to perform authentication based on the corresponding access management information stored in the terminal device storage unit.

  In the authentication delegation system, the terminal device determines that the service requested when the application control unit executes the application downloaded by the communication control unit by the authentication determination unit is not yet authenticated to the authentication server. Authentication request means for requesting authentication for the service is provided. In addition, the agent requests authentication from the authentication server based on the use restriction information included in the corresponding access management information, and as a result of this request, the agent handles the new access management information received from the authentication server. Updated as access management information. In this case, the authentication server sends new access management information corresponding to the agent to the terminal device in response to an authentication request from the agent.

  In addition, the authentication delegation method according to the present invention downloads an attribute file composed of an application and service information used when the application is executed from an application distribution server connected via the network, and is connected via the network. Stores access management information corresponding to an agent that is accepted from the authentication server and authenticates the service requested when the application is executed, and authenticates the service requested when the application downloaded from the application distribution server is executed. In response to the action of the agent based on the access management information corresponding to the started agent, the agent that authenticates the service requested by the executed application is started. It is obtained to carry out the testimony.

  In the above authentication delegation method, a request for authentication of the service is made to the authentication server by determining that the service requested when the application control unit executes the application downloaded by the communication control means is not yet authenticated. . In addition, authentication is requested to the authentication server by the agent action based on the usage restriction information included in the access management information corresponding to the activated agent, and the new access management received from the authentication server as a result of this request. The information may be updated as access management information corresponding to itself.

  In addition, the terminal device according to the present invention includes a terminal device communication control unit that downloads an attribute file including information on an application and a service used when the application is executed from an application distribution server connected via a network, and execution of the application. An application control unit that controls operations, and a terminal device storage that stores access management information corresponding to an agent that authenticates a service required when an application is executed, received from an authentication server connected via a network An authentication determination unit that determines that the service requested when the application control unit executes the application downloaded by the communication control unit, and an agent received from the authentication server. And at least agent control means for starting an agent that authenticates the service requested by the application executed by the application control unit when it is determined that authentication by the authentication determination means has already been performed. The agent is generated based on the access management information provided, and the agent performs authentication based on the corresponding access management information stored in the terminal device storage unit.

  In the above terminal device, the authentication determining means authenticates the service to the authentication server by determining that the service requested when the application control unit executes the application downloaded by the communication control means has not yet been authenticated. Authentication request means for making the above request. In addition, the agent requests authentication from the authentication server based on the use restriction information included in the corresponding access management information, and as a result of this request, the agent handles the new access management information received from the authentication server. Updated as access management information.

  The authentication server according to the present invention receives an authentication request for a service from a terminal device connected via a network, and performs authentication in the terminal device based on access management information provided in advance. Agent generating means, and an agent generated by the agent generating means and server communication control means for sending access management information used to generate the agent to the terminal device, the agent generating means comprising the terminal device The agent is generated based on the access management information corresponding to the accepted authentication request.

  As described above, according to the present invention, the service required when the application is executed is authenticated by the operation of the agent based on the corresponding access management information, and this authentication has already been performed. Authentication is performed by activating an agent provided in the terminal device, a plurality of different authentication protocols by a plurality of authentication servers are used, and clients and client users Even in an environment where the authentication conditions differ depending on the application, it is possible to flexibly cope with the authentication necessary for using the service, and it is possible to obtain an excellent effect that authentication processing can be performed quickly.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a configuration diagram showing a configuration example of an authentication delegation system according to an embodiment of the present invention. This system includes a plurality of authentication servers 100, a portable terminal (terminal device) 200, and an application server (application distribution server). ) 300. For example, each authentication server 100 uses a different authentication protocol. These are connected by a network such as the Internet.

  The authentication server 100 includes a communication control unit 101, a storage device (server storage unit) 102, an access control unit 103, and an agent generation unit 104. The communication control unit 101 has a function of receiving a request from the mobile terminal 200. In addition, a function of transmitting the agent generated by the agent generation unit 104 and the access management information acquired by the access control unit 103 to the mobile terminal 200 is provided. The storage device 102 stores a management table including information on the mobile terminal 200 and service information. The access control unit 103 has a function of referring to a management table stored in the storage device 102 and acquiring access management information corresponding to a request transmitted from the mobile terminal 200. The agent generation unit 104 has a function of generating an agent composed of a program and data for executing a predetermined process based on the access management information acquired by the access control unit 103. Therefore, the agent performs an authentication process based on the access control information.

  The portable terminal 200 includes a communication control unit 201, a request reception unit 202, an application control unit 203, an agent control unit 204, a storage device (terminal storage unit) 205, and a service group 206. The communication control unit 201 has a function of communicating with the authentication server 100 based on information from the request reception unit 202. In addition, a function of receiving an agent and access management information transmitted from the authentication server 100 is provided. Furthermore, a function of downloading an application and an attribute file from the application server 300 is provided. The request reception unit 202 has a function of receiving a request from the application control unit 203 and passing the received request to the communication control unit 201 or the agent control unit 204 based on access request information in the storage device 205. In addition, a function of creating / updating access request information in the storage device 205 is provided.

  The application control unit 203 has a function of managing a life cycle (execution operation) such as activation and termination of an application. Further, it has a function of receiving a service request from an application and passing it to the request receiving unit 202. Furthermore, it has a function of managing the service group 206 and providing a service to an application. The agent control unit 204 has a function of storing an agent transmitted from the authentication server 100 and receiving a request from the request receiving unit 202 and starting a corresponding agent.

  The storage device 205 is a device that stores access management information transmitted from the authentication server 100, applications and attribute files downloaded from the application server 300, and access request information created by the request receiving unit 202. The service group 206 manages services including hardware resources such as a file system and storage, or data such as image files and moving image files.

  Next, the overall operation of the present embodiment will be described in detail with reference to the flowcharts of FIGS. 1, 2, 3, and 4.

  First, service request processing in the mobile terminal 200 will be described with reference to the flowchart of FIG. First, an application activated by a user's operation of the mobile terminal 200 requests access to a service such as a file system at the time of execution (step S21). At the time of this request, the application control unit 203 passes the request source application name and the requested service name to the request reception unit 202. Here, the application name and the service name do not have to be names, but may be information that can identify the application and service.

  The request receiving unit 202 that has received the request source application name and the requested service name in this way uses the above information passed from the application control unit 203 as a key to access request among the information stored in the storage device 205. Information is searched, and it is determined whether or not the authentication server 100 has been authenticated so far (step S22). In this example, the request reception unit 202 serves as an authentication determination unit. Here, when the authentication is not performed, a request process to the authentication server 100 for authentication corresponding to the application is performed through the communication control unit 201 (step S23).

  The communication control unit 201 acquires the terminal ID and transmits it to the authentication server 100 together with the service name passed from the request reception unit 202. Connection to the authentication server 100 is performed by a method such as a URL stored (stored) in the mobile terminal 200 in advance, or by a URL of the authentication server 100 described (included) in an application attribute. Although a method is conceivable, it is not specified here. It is only necessary to access the authentication server 100 associated with the application. This authentication process will be described later.

  On the other hand, if the authentication has already been performed in step S22 and it is not the first request, the process proceeds to step S24, and the process proceeds to the authentication process in the mobile terminal 200. In step S24, the request reception unit 202 requests the agent control unit 204 to start an agent corresponding to the application based on the application name passed from the application control unit 203. As a result, the agent control unit 204 activates the corresponding agent. The agent is a program or data generated by the authentication server 100. Next, the activated agent performs a preset authentication process based on the access management information (step S25). This authentication process includes a process for displaying a dialog prompting the user to input an ID and a password so that the user can see it, and a process for controlling access by limiting the period and the number of times. do not do.

  When the authentication process by the agent described above is completed and the authentication is confirmed based on the result of the authentication process (step S26), the application executes the service (step S27). On the other hand, if the authentication in step S26 is not successful, the service request is interrupted (step S28).

  Next, the authentication process in the authentication server 100 after S23 in FIG. 2 will be described with reference to the flowchart in FIG. The communication control unit 101 receives a service request from the mobile terminal 200 and passes the transmitted information (terminal ID and service name) to the access control unit 103 (step S31). Here, the communication by the communication control units 101 and 201 between the authentication server 100 and the portable terminal 200 may use existing communication means such as HTTP (Hyper Text Transport Protocol) communication or e-mail, or unique communication. Means may be provided and used.

  Next, the access control unit 103 refers to the management table in the storage device 102 using the terminal ID and the service name as keys, and determines whether or not the request can be made (step S32). If the request is NG, the communication control unit 101 notifies the portable terminal 200 to that effect (step S33). On the other hand, if the request is OK, access management information is acquired from the management table (step S34). In this access management information, the number of times that the application can access the service provided by the application, a period, and the like are set.

  Next, the agent generation unit 104 generates an agent for performing a predetermined process based on the above-described access management information and terminal ID (step S35). The agent generated by this process performs authentication in the mobile terminal 200, and plays a role for the authentication server 100 to delegate the authentication process. The authentication server 100 embeds processing corresponding to the authentication processing performed by itself, such as a program for inputting a password for authentication, in the agent. Through these processes, the acquired access management information and the generated agent are transmitted to the mobile terminal 200 through the communication control unit 101 (step S36).

  Next, update processing of access management information in the storage device 205 in the agent control unit 204 of the portable terminal 200 will be described with reference to the flowchart of FIG. The agent in the agent control unit 204 monitors access management information corresponding to itself (step S41). The timing and cycle for monitoring may be set as appropriate, and are not specified here. For example, the authentication server 100 may have a timing or period set when generating an agent, or may be determined for each application. Moreover, the timing and period decided for every portable terminal may be sufficient.

  The agent uses the access management information currently stored based on the use restriction information provided in the access management information such as the number of times and the period (expiration date) provided in the access management information stored (stored) in the storage device 205. Whether the access management information needs to be updated is monitored (step S42). If updating is required, an authentication request is made to the corresponding authentication server 100 (step S43). The access management information includes corresponding authentication server information (URL). Here, when the mobile terminal 200 cannot be connected to the authentication server 100 because it is not connected to the network, the connection is attempted again at the next monitoring timing. Alternatively, connection may be attempted at the timing when the mobile terminal 200 is connected to the network.

  If the above authentication processing is necessary, the request source terminal ID and service name, and further the request source agent name are transmitted to the authentication server 100, and the authentication processing is requested (step S44). This authentication process is a re-authentication process including an update of access management information. Here, the agent name may not be a name. That is, any information can be used as long as the agent can be identified.

  Next, the authentication server 100 that has received the request performs an authentication process (step S45). When the agent name is included in the transmitted information, the authentication server 100 does not generate the agent, but only performs the authentication processing and access management information acquisition shown in steps S32 and S34 of FIG. Do. When the authentication in step S46 is OK, the access management information is transmitted to the portable terminal 200. Further, the agent in the agent control unit 204 updates the access management information in the storage device 205 (step S47).

  If the authentication in step S46 is NG, the mobile terminal 200 is notified accordingly. Further, the agent in the agent control unit 204 deletes the entry in the access request information in the storage device 205 (step S48). Thereby, at the time of the next service request, it is determined that the authentication is not performed in the process shown in step S22 of FIG. 2, and the authentication server 100 is requested to perform the authentication process again. As described above, the agent performs an authentication operation based on the corresponding access management information.

  The authentication server 100 and the terminal device are, for example, computer devices including a CPU, a main storage device, an external storage device, a network connection device, and the like, and the CPU is operated by a program developed in the main storage device. Each function described above is realized. Each function may be distributed among a plurality of computer devices. Further, the terminal device may be a mobile phone having functions equivalent to these.

  Next, effects of the authentication delegation system and the authentication delegation method in the present embodiment described above will be described.

  According to this system and method, the application, the authentication server 100, and the agent are associated with each other. For this reason, the authentication server 100 can create an agent that performs authentication processing corresponding to the authentication server 100 and operate the mobile terminal 200. As a result, it is possible to absorb differences in authentication processing (authentication protocols, etc.) by a plurality of different authentication servers 100 by the agent. Therefore, according to the present system and method, it is possible to flexibly cope with various conditions such as an environment in which a plurality of authentication servers of different authentication protocols are used.

  Further, according to the authentication delegation system and the authentication delegation method in the present embodiment, the authentication process performed by the authentication server 100 is caused to be performed (delegated) by the agent. No need to connect. As a result, according to the system and method in the present embodiment, it is possible to realize a quicker authentication process and to reduce the time and fee for authentication.

  Incidentally, in the above-described embodiment, the terminal ID and the service name are transmitted in step S31 of FIG. 3, but the present invention is not limited to this. For example, a SIM (Subscriber Identification Module) ID may be transmitted. In this case, the authentication server 100 side can perform authentication “service availability by contractor”. As described above, the authentication server 100 can control or manage the conditions for determining whether to access the service based on the transmitted information, regardless of the information transmitted from the mobile terminal 200. Is possible.

  Further, in the above description, when the authentication process is NG in step S48 of FIG. 4, only the entry of the access request information is deleted. In this case, the authentication process is performed again every time the agent refers to the access management information even though the authentication process is NG. For this reason, when the authentication process is NG, in addition to deleting the entry of the access request information, the access management information corresponding to the agent and the agent may be deleted. In the above description, the number of application servers that distribute applications is one, but a plurality of application servers may exist. Furthermore, in the above-described embodiment, a mobile terminal is used as an example of a client. However, a device (fixed terminal) having a communication function such as a personal computer or a home appliance may be used.

  Furthermore, in the above description, data encryption is not performed, but data to be transmitted / received may be encrypted from the viewpoint of security. For example, the application and attribute file distributed from the application server 300, the terminal ID and service name transmitted from the mobile terminal 200 to the authentication server 100, the access management information and agent transmitted from the authentication server 100 to the mobile terminal 200, the mobile terminal Access management information and access request information in 200 may be encrypted so that they cannot be browsed or altered.

  Next, it demonstrates in detail using a specific Example. First, application download processing will be described with reference to FIG. The user of the portable terminal 200 performs an instruction input for selecting download of a desired application by operating an input device (not shown) of the portable terminal 200. In response to this operation instruction, the communication control unit 201 of the mobile terminal 200 downloads the designated application and this attribute file from the application server 300 and stores them in the storage device 205. In addition to the application name, the attribute file includes the service used by the application and the URL of the authentication server 100. In this embodiment, it is assumed that the attributes shown in FIG. 5 are included. Other attributes may be included, but are not specified here.

  Next, service request processing during application execution will be described. The user of the portable terminal 200 instructs selection of a desired application by operating an input device (not shown). Here, it is assumed that the downloaded application (application A) is selected as described. In response to this instruction input, the application control unit 203 activates the application A in the storage device 205.

  Next, the activated application A requests a service at the time of execution. As an example, by calling a function such as “getSDCardInfo ()” in the program constituting the application A, an attempt is made to access the SD card indicated by its own attribute file. At this time, the application control unit 203 detects the issuance of the above function and authenticates whether the application A can access the SD card.

  Thereafter, the request receiving unit 202 searches the access request information in the storage device 205 using the application name and service name passed from the application control unit 203 as keys as shown in step S22 of FIG. This is shown in FIG. In this example, since there is no corresponding entry in the access request information, it is determined that no authentication process has been performed so far, and the process proceeds to a request process to the authentication server 100. Here, when requesting the authentication server 100, the terminal ID and the service name are transmitted. The communication control unit 101 transmits the terminal ID and service name passed from the request reception unit 102 to the authentication server 100. The connection destination refers to the URL of the authentication server 100 of the attribute file in the storage device 205 described above.

  Next, authentication processing in the authentication server 100 will be described. As illustrated in step S <b> 31 of FIG. 3, the communication control unit 101 passes the information transmitted from the mobile terminal 200 to the access control unit 103. The access control unit 103 refers to the management table in the storage device 102 using the passed information as a key, and determines whether or not the request can be made. This operation will be described with reference to FIG. As illustrated in FIG. 7, the access control unit 103 refers to “1” that is a table corresponding to the terminal ID “000A”.

  As an example of the table of ID “1”, as shown in FIG. 8, “password input” and “access count limitation” are set as conditions for accessing the “SD card”. Therefore, it can be seen that the application A can access the SD card within the range of the above conditions. The access control unit 103 cuts out an entry related to “SD card” from the management table. The cut out information is the access management information shown in step S34 in FIG. If there is no entry corresponding to the service name in the table, the access control unit 103 makes a request NG and notifies the mobile terminal 200 of this. The notification means is not particularly defined here.

  Next, agent generation processing by the agent generation unit 104 will be described. The agent generation unit 104 generates an agent based on the terminal ID of the mobile terminal 200 and the access management information acquired by the access control unit 103. The agent generation unit 104 determines whether an agent has been generated so far from the terminal ID. If it is generated, only the part that performs processing corresponding to the current access management information is generated (hereinafter referred to as a differential agent). In this example, it is assumed that no agent has been generated so far.

  Referring to the access management information, the agent includes at least “password inquiry” and “access count management”. The “password inquiry” includes at least a process of (1) displaying a dialog for inputting a password and (2) verifying whether the input password is correct. As for “access count management”, (1) processing for managing the number of accesses, (2) processing for notifying an error when the number of accesses exceeds the limit, (3) processing for notifying the remaining number of times, etc. Including. The access management information acquired by these things and the generated agent are transmitted to the mobile terminal 200. An example of the acquired access information and the generated agent is shown in FIG.

  Next, processing (operation) in the mobile terminal 200 will be described. The communication control unit 201 receives the information illustrated in FIG. 9 and stores access management information in the storage device 205. Further, the agent is stored in the agent control unit 204. Here, when the agent transmitted from any one of the authentication servers 100 is a differential agent, the access management information is updated, and a differential process is added to the corresponding agent.

If the received information includes information, the communication control unit 201 determines that the request from the application A is permitted, and notifies the request reception unit 202 to that effect. Upon receiving the notification, the request receiving unit 202 updates the access request information as shown in FIG.
The request reception unit 202 receives the permission notification and notifies the application manager 203 to that effect. The application manager permits the application A to access the SD card. That is, a return value of success is returned to “getSDCardInfo ()” that is a function issued by the application A. Application A accesses the SD card.
The above is the service request processing at the first access to the service.

Next, the service request process after the above (second and subsequent times) will be described.
Assume that the application A is activated again after the authentication processing, and the application A calls the function “getSDCardInfo ()”. As described above, the application control unit 203 detects the issuance of the function, and the request reception unit 202 searches the access request information in the storage device 205 using the application name and service name as keys. Here, as shown in FIG. 10, since the corresponding entry exists in the access request information, the connection to the authentication server 100 is not performed, and the process proceeds to the authentication process in the mobile terminal 200.

  The request reception unit 202 activates an agent corresponding to the application based on the application name and service name passed from the application control unit 203. This is shown in FIG. The agent manager in the agent control unit 204 that has received the request refers to the correspondence table and activates the agent. In this example, “Agent01.prog” that is an agent corresponding to the application A is activated.

  The activated agent performs a predetermined authentication process based on the service name passed from the agent manager. In this example, as described above, “password inquiry” and “access count management” are performed. In “password inquiry”, a dialog is displayed and the input of the user of the portable terminal 200 (not shown) is waited for. It is determined whether the input password matches the password in the access management information. If they do not match, an error is notified by an output device (not shown). In this example, it is assumed that they match. In the “access count management”, the cumulative access count may be stored, or the access count limit in the access management information may be reduced by one. In this example, the numerical value is rewritten as in the latter case.

  When the authentication process is completed, the agent control unit 204 notifies the request reception unit 202 of success. The request reception unit 202 receives the permission notification and notifies the application manager 203 to that effect. The application manager permits the application A to access the SD card, and returns a success return value to “getSDCardInfo ()” that is a function issued by the application A. As a result, the application A accesses the SD card.

  This is the second and subsequent service request processing for the service. Since the authentication process can be performed in the portable terminal 200, the service can be used within the permitted range even when the authentication server 100 cannot be connected.

  Next, update processing of access management information in the storage device 205 in the agent control unit 204 of the portable terminal 200 will be described. As shown in step S41 of FIG. 4, the agent in the agent control unit 204 monitors the corresponding access management information. In this example, it is assumed that the monitoring timing is determined once a week.

  “Agent01.prog”, which is the agent of application A, monitors the access frequency limit in the corresponding access management information. Here, it is assumed that the access frequency limit is “0”. In this case, the agent determines that authentication processing is necessary and connects to the authentication server 100. At this time, the terminal ID, the service name, and the request source agent name are transmitted. Subsequent processing is the same as the update processing described above. In the above update process, if the authentication is OK, the agent updates the access frequency limit in the access management information (for example, to “10”). If it is authentication NG, the agent deletes the entry in the access request information.

  By performing the updating process as described above, in the present invention, even if authentication is performed once, use of a service by an application in the mobile terminal 200 can be restricted on the authentication server 100 side.

  The present invention can be applied to uses such as an authentication system that performs authentication when using a service, and a method for realizing authentication processing.

It is a block diagram which shows the structural example of the authentication delegation system in embodiment of this invention. It is a flowchart for demonstrating the authentication delegation method by the authentication delegation system in embodiment of this invention. It is a flowchart for demonstrating the authentication delegation method by the authentication delegation system in embodiment of this invention. It is a flowchart for demonstrating the authentication delegation method by the authentication delegation system in embodiment of this invention. It is explanatory drawing which shows an example of an attribute file. 6 is an explanatory diagram for explaining operations of a request receiving unit 202 and an application control unit 203. FIG. 6 is an explanatory diagram for explaining operations of a communication control unit 101 and an access control unit 103. FIG. 3 is a configuration diagram illustrating a configuration example of a management table stored in a storage device 102. FIG. It is a block diagram which shows the structural example of the access information and the produced | generated agent. 6 is an explanatory diagram for explaining an operation of a request reception unit 202. FIG. 6 is an explanatory diagram for explaining an operation of an agent control unit 204. FIG. It is a block diagram which shows the structure of the conventional authentication system.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 ... Authentication server 101 ... Communication control part 102 ... Memory | storage device 103 ... Access control part 104 ... Agent production | generation part 200 ... Portable terminal (terminal device) 201 ... Communication control part 202 ... Request reception part 203 ... Application control unit, 204 ... Agent control unit, 205 ... Storage device (terminal storage unit), 206 ... Service group, 300 ... Application server (application distribution server).

Claims (11)

A terminal device, an authentication server, and an application distribution server connected via a network;
The terminal device
A terminal device communication control means for downloading an attribute file comprising information of an application and a service used when the application is executed from the application distribution server;
An application control unit for controlling the execution operation of the application;
A terminal device storage unit that stores access management information corresponding to an agent that performs authentication of the service requested when the application is executed, received from the authentication server;
Authentication determination means for determining that the authentication of the service requested when the application control unit executes the application downloaded by the communication control means;
The agent received from the authentication server is stored, and the agent that authenticates the service requested by the application executed by the application control unit is activated when the authentication determination unit determines that the authentication has already been performed. Agent control means and at least
The authentication server is
An agent generating means for receiving an authentication request for the service from the terminal device and generating an agent for performing the authentication in the terminal device based on access management information provided in advance;
And at least server communication control means for sending the agent generated by the agent generating means and access management information used for generating the agent to the terminal device,
The agent generation means generates the agent based on access management information corresponding to an authentication request received from the terminal device,
In the terminal device, the agent performs the authentication based on corresponding access management information stored in the terminal device storage unit. In the authentication delegation system according to claim 1,
The terminal device
Authentication by the authentication determination unit with respect to the service with respect to the authentication server by determining that the service requested when the application control unit executes the application downloaded by the communication control unit has not yet been authenticated. An authentication delegation system comprising an authentication request means for making a request. In the authentication delegation system according to claim 1 or 2,
The agent
Based on the use restriction information included in the corresponding access management information, the authentication server is requested to authenticate, and as a result of this request, the new access management information received from the authentication server is associated with the access management corresponding to itself. An authentication delegation system characterized by being updated as information. In the authentication delegation system according to claim 3,
The authentication delegation system, wherein the authentication server sends new access management information corresponding to the agent to the terminal device in response to an authentication request from the agent. Download an attribute file consisting of application and service information used when the application is executed from an application distribution server connected via a network,
Storing access management information corresponding to an agent that authenticates the service requested when the application is executed, received from an authentication server connected via a network;
In the determination that the service requested when executing the application downloaded from the application distribution server has already been authenticated, start the agent that authenticates the service requested by the executed application,
An authentication delegation method comprising: performing the authentication by the operation of the agent based on access management information corresponding to the activated agent. In the authentication delegation method according to claim 5,
Requesting the authentication server to authenticate the service by determining that the service requested when the application control unit executes the application downloaded by the communication control means is not yet authenticated. A feature of authentication delegation. In the authentication delegation method according to claim 5 or 6,
The authentication server is requested to authenticate by the operation of the agent based on the use restriction information included in the access management information corresponding to the activated agent. An authentication delegation method characterized by updating access management information as access management information corresponding to itself. A terminal device communication control means for downloading an attribute file comprising information of an application and a service used when the application is executed from an application distribution server connected via a network;
An application control unit for controlling the execution operation of the application;
A terminal storage unit that stores access management information corresponding to an agent that performs authentication of the service requested when the application is executed, received from an authentication server connected via a network;
Authentication determination means for determining that the authentication of the service requested when the application control unit executes the application downloaded by the communication control means;
The agent received from the authentication server is stored, and the agent that authenticates the service requested by the application executed by the application control unit is activated when the authentication determination unit determines that the authentication has already been performed. Agent control means and at least
The agent is generated based on access management information provided in advance,
The terminal device, wherein the agent performs the authentication based on corresponding access management information stored in the terminal device storage unit. The terminal device according to claim 8, wherein
Authentication by the authentication determination unit for the service to the authentication server by determining that the service requested when the application control unit executes the application downloaded by the communication control unit has not yet been authenticated. A terminal device comprising authentication request means for making a request. The terminal according to claim 8 or 9,
The agent
Based on the use restriction information included in the corresponding access management information, the authentication server is requested to authenticate, and as a result of this request, the new access management information received from the authentication server is associated with the access management corresponding to itself. A terminal device that is updated as information. An agent generating means for receiving an authentication request for a service from a terminal device connected via a network, and generating an agent for performing the authentication in the terminal device based on access management information provided in advance;
And at least server communication control means for sending the agent generated by the agent generating means and access management information used for generating the agent to the terminal device,
The agent generation means generates the agent based on access management information corresponding to an authentication request received from the terminal device.

Images