JP2009009541A - Authentication system, terminal, server, authentication method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system, a terminal, a server, an authentication method, and a program for enabling authentication among a plurality of users or terminals. <P>SOLUTION: The authentication system has an authentication means for checking commonality between specified history information among pieces of history information owned by itself and history information to be designated by history designation information designating history information corresponding to the specified history information among pieces of history information owned by the terminal, and for authenticating that the terminal is a right terminal if the commonality is recognized. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an authentication system, a terminal, a server, an authentication method, and a program, and more particularly, to an authentication technique based on commonality between history information of different users.

  Many services have been proposed that use an operation history in a terminal such as a mobile phone to authenticate use by a legitimate user.

  For example, the technique described in Patent Document 1 is an information input device that inputs information after specifying a user, and detects information change means for inputting predetermined information and a change of the user. A change detection level storage means for preliminarily storing the change detection level, an operation status acquisition means for acquiring an operation status of the user of the information input means, and an operation feature amount from the operation status acquired by the operation status acquisition means. The operation feature quantity based on the operation feature quantity calculation means, the history information storage means for storing the history information of the operation feature quantity, the operation feature quantity calculated by the operation feature quantity calculation means, and the history information. A change amount calculating means for calculating a change amount of the user, a user change detecting means for detecting a change of the user based on the change amount of the operation feature amount and the change detection level, and the user change detecting means. By when it is detected a change in the user, and a display means for displaying an input screen for inputting the identification information of the user.

  With such a configuration, even in an environment where a physical feature such as a fingerprint cannot be used as a user authentication method such as a clean room, and without having to prepare a unique device for each user, the user's operation feature Depending on the amount, automatic user authentication can be implemented to enhance security. In addition, when the user of a computer device is changed, the user information is automatically set without being conscious of the user in order to prevent forgetting to reset the user information and to prevent the computer device from being impersonated. The user change detection method is used in the clean room by using the operation features of the input device such as keyboard operation speed, operation pattern, mouse button click speed, etc. Even in an environment where gloves are worn, it is possible to detect a change of the user regardless of physical characteristics, and to enhance the security of the information system.

In addition, data of a section used for authentication is extracted from time-series data such as acceleration according to arm swing behavior and angular acceleration output from a detection unit including an acceleration sensor and a gyro sensor, and the extracted data Is normalized to data in a certain interval. Then, the similarity between the normalized data and the registered data of the person's arm swing behavior registered in advance in the storage unit is calculated, and when the similarity is equal to or higher than a determination threshold, the person is determined. On the other hand, Japanese Patent Application Laid-Open No. 2004-228561 describes a technique for determining that the person is another person when the threshold is smaller than the determination threshold.
JP 2006-243947 A JP 2007-193656 A

  The techniques disclosed in Patent Documents 1 and 2 described above are techniques for authenticating whether a user is a correct user, and cannot be used for authentication between a plurality of users or terminals.

  Therefore, the present invention has been invented in view of the above problems, and provides an authentication system, a terminal, a server, an authentication method, and a program that enable authentication between a plurality of users or terminals.

  The present invention that solves the above problems is specified by history specifying information that specifies specific history information among history information held by itself and history information corresponding to the specific history information among history information held by a terminal. The authentication system includes authentication means for verifying that the terminal is a legitimate terminal when the commonality with the history information is verified and the commonality is recognized.

  The present invention that solves the above problems is specified by history specifying information that specifies specific history information among history information held by itself and history information corresponding to the specific history information among history information held by a terminal. A terminal having authentication means for verifying that the terminal is a legitimate terminal when the commonality with the history information is verified.

  The present invention that solves the above-described problems includes a selection unit that selects history information specified by history specifying information that specifies history information necessary for service authentication from history information held by a terminal, and the selected history information. The terminal has a history hash generating means for performing a hash calculation based on the terminal and generating a history hash of the terminal, and a transmitting means for transmitting the history hash.

  The present invention for solving the above-mentioned problems is a selection means for selecting history information designated by history designation information for designating history information necessary for service authentication from history information held by a terminal, and the selected history information And a transmission means for transmitting.

  The present invention that solves the above problems is specified by history specifying information that specifies specific history information among history information held by itself and history information corresponding to the specific history information among history information held by a terminal. The server includes authentication means for verifying that the terminal is a legitimate terminal when the commonality with the history information is verified and the commonality is recognized.

  The present invention that solves the above problems is specified by history specifying information that specifies specific history information among history information held by itself and history information corresponding to the specific history information among history information held by a terminal. The authentication method further includes an authentication process for verifying that the terminal is a valid terminal when the commonality with the history information is verified and the commonality is recognized.

  The present invention that solves the above problems is specified by history specifying information that specifies specific history information among history information held by itself and history information corresponding to the specific history information among history information held by a terminal. The information processing apparatus executes an authentication process for authenticating that the terminal is a valid terminal when the commonality with the history information is verified and the commonality is recognized.

  According to the present invention, the history information specified by the history specifying information for specifying the history information corresponding to the specific history information among the history information held by the terminal among the history information held by the terminal, Since the authentication is performed by verifying the commonality of users, it is possible to authenticate whether the user has a common experience.

  An embodiment of the present invention will be described.

  Various history information stored in a terminal such as a mobile phone contains a lot of information closely related to the daily life of the user, and if commonality can be found between history information of different users, a user group having a common experience can be identified. Can be detected. For example, a person who has watched the same baseball game, a person who has participated in a tour of the same trip, or a person who has been to a certain sightseeing spot. By detecting such a group, for example, only the person who actually went there can write on a blog site in a specific tourist spot that presents his / her presence to the tour crew and other participating members only during the tour In this way, services such as enhancing the credibility of the written information of the blog and promoting the subsequent information exchange by forming an SNS in ad hoc with those who participated in the same event can be realized.

In order to realize such a service, a typical example for authenticating whether or not the user has a common experience will be described.
<First Embodiment>
First, an example in which authentication is performed from history information of information that does not differ between users, such as electronic tickets and advertisements, will be described.

  FIG. 15 shows a schematic diagram in the present embodiment.

FIG. 15 shows an example in which authentication is performed between a mobile phone and an authentication server. However, when authenticating whether or not an experience is shared among a plurality of mobile phones, the authenticating mobile phone is an authentication server. What is necessary is just to comprise so that it may have these functions.
(1) Pre-processing First, a service administrator who provides a service to a group having a common experience defines a management policy that defines history information to be held by a terminal that accesses the service. For example, a specific electronic ticket transmitted for a certain period or data obtained by concatenating an electronic mail received from a specific sender within a certain period can be raised.
(2) Authentication process Next, the following process is performed as an authentication process when the cellular phone receives a service.

  When an authentication request is transmitted from the mobile phone, the authentication server refers to the management policy and transmits a challenge (random value) r together with an index of what is necessary as history information.

  Next, the mobile phone creates the following data as the authenticator α and transmits it to the authentication server.

ここで、Ｒ_ｔは認証サーバから送信されたｉｎｄｅｘに対応する履歴を集めたものである。

Here, R _t is a collection of histories corresponding to the indexes transmitted from the authentication server.

The authentication server receives the authenticator alpha, creating a authenticator alpha 'by R _t and r Tokara formula 1 held themselves. And then. When α = α ′, it is determined that the authentication is successful, and the service is provided to the mobile phone.
<Second Embodiment>
Next, an example will be described in which it is determined whether or not a history of a specific experience is held from sensor output mounted on a mobile phone or the like, and whether or not access to the service is determined from the verification result.

Although FIG. 16 shows an example in which authentication is performed between a plurality of mobile phones, an authentication server may be inserted between a plurality of mobile phones, and each history information may be collected and authenticated.
(1) Pre-processing First, a mobile phone (hereinafter referred to as a mobile phone 2) that provides a service (for example, providing its own presence, allowing local connection, allowing information sharing, etc.) The user defines a management policy that defines history information to be held by a terminal that accesses the service. For example, sensor type, data acquisition period, sampling interval, and the like. Further, a similarity calculation method for determining that the management policy has a common experience, and a threshold value as a reference for similarity are also set. Although it seems realistic to set this management policy in advance, it may be set on demand by the user when an authentication request is made.
(2) Authentication Process Next, the mobile phone (hereinafter referred to as the mobile phone 1) and the mobile phone 2 that want to receive the service provide the following processing as authentication processing.

  When an authentication request is transmitted from the mobile phone 1, the mobile phone 2 refers to the management policy, and specifies history designation information that designates what is required as history information (sensor type, data acquisition period, sampling interval, etc.). Send to mobile phone 1.

Next, the mobile phone 1 transmits to the mobile phone 2 history information R ¹ _t corresponding to that specified by the history specification information. At this time, if there is a sensor output leak, data interpolation is performed in accordance with the sampling interval. However, if data with sufficient accuracy cannot be obtained even if interpolation is performed, the fact that the history information R ¹ _t cannot be transmitted is transmitted to the mobile phone 2. In this case, authentication fails and the service is not provided.

When the mobile phone 2 receives the history information R ¹ _t , the mobile phone 2 calculates the similarity between the history information R ¹ _t and the history information R ² _t that is its own history based on what is set as a management policy. There are many similarity determination methods, but here, as one of the most well-known methods, a correlation value is set as a management policy.

Here, the value obtained by dividing the time from the start time to the end time of the history target by the sampling interval is N, the sensor output value of the mobile phone 1 is x _i, and the sensor output value of the mobile phone 2 is y _i. , X _i (i = 0,..., N−1) is an x bar (a character formed by drawing a horizontal line on x), and y _i (i = 0,..., N If the average value of -1) is y bar (characters formed by drawing a horizontal line on y), the correlation value s can be calculated as in the following Equation 2.

ここで、相関値ｓの値が管理ポリシーに定めた値よりも大きい場合、類似度が高いと判断され、携帯電話２は携帯電話１に対してサービスを提供する。

Here, when the value of the correlation value s is larger than the value determined in the management policy, it is determined that the degree of similarity is high, and the mobile phone 2 provides a service to the mobile phone 1.

  In this way, it is possible to authenticate whether or not they have a common experience.

Specific examples will be described below.
[First embodiment]
1 to 3 show an authentication system according to a first embodiment of the present invention. Among these, the authentication system shown in FIG. 1 includes a user terminal 10 such as a portable terminal, and a communication management center 30 that is an authentication server connected to the user terminal 10 via a network. The communication management center (authentication server) 30 described above has a function of authenticating the user terminal 10 under certain conditions and permitting use for various services. In the embodiment shown in FIG. 1, the above-described network is configured by wireless communication provided by relaying the base station 21. Further, the base station 21 is connected to the above-described communication management center via the exchange control station 22. (Authentication server) 30 is connected.

  The user terminal 10 is mobile, for example, and is connected to the nearest base station 21 by radio communication during a call. The exchange control station 22 is connected to the base station 21 and at the same time connected to a fixed telephone or other communication device via a public network, and exchanges between a desired user terminal (mobile terminal) 10 and a desired telephone. Control is performed.

  Further, the user terminal 10 has a function of transmitting the latest history information data on the user terminal 10 side to the communication management center 30 when a specific condition is satisfied, and the latest history information related to the transmission. A terminal-side authentication key generation function for generating a new terminal-side history hash by performing a hash operation based on the data, generating a terminal-side authentication key based on the generated history hash, and transmitting the generated terminal-side authentication key to the communication management center 30; It has.

  In this case, as the history information data described above, in this embodiment, the hardware configuration information such as the remaining memory capacity and the remaining battery capacity, the installed software version and patch application information, and the peripheral base used At least one of the electric field strength information transmitted from the station is provided.

  Here, as will be described later, the user terminal 10 performs a hash operation based on the latest history information data on the user terminal 10 side to generate a new terminal-side history hash, A terminal-side authentication key generating means for generating a terminal-side authentication key based on the terminal-side history hash and transmitting it to the communication management center (authentication server) 30, thereby providing the terminal-side authentication It is configured to perform a key generation function.

  The history update unit 16 periodically executes the hash calculation at the transmission timing of the history information data to periodically generate a new history hash and stores it in the corresponding storage unit 12 equipped in advance. It has a function to do.

  Further, the communication management center (authentication server) 30 performs a hash operation based on the received history information data to generate a new history hash on the management center side, and on the basis of the history hash on the management center side. A server-side authentication key creation function for generating a server-side authentication key is provided.

  Here, the communication management center (authentication server) 30 performs a hash operation based on the history information data received as will be described later, and generates a new server-side history hash, A conversion unit 33 that is a server-side authentication key generating unit that generates a server-side authentication key based on the server-side history hash is provided, thereby executing the server-side authentication key generation function.

  The history update information receiving unit 36 described above periodically generates the new history hash by periodically executing the hash calculation at the timing of receiving the history information sent from the history update unit 16 described above. A function of storing in a corresponding storage unit 32 equipped in advance is provided.

  Then, the communication management center 30 compares the communication authentication key generated on the user terminal 10 side with the communication authentication key generated on the communication management center 30, and when both are equal, the user terminal is authorized. An authentication function for authenticating the terminal is provided.

  That is, as described above, the basic configuration of the authentication system in the present embodiment is assembled by the combination of the user terminal 10 and the communication management center (authentication server) 30.

  Therefore, according to this, a history hash is generated based on irregular history information on the user terminal 10 side, an authentication key is formed based on the history hash, and a similar authentication key is assigned to the communication management center (authentication server) 30. Since it is also formed on the side and collated, it is possible to provide authentication with higher security strength for the user terminal, and this makes it possible to more effectively prevent the generation of clone terminals You can get a system.

  The above-described timing of transmitting the history information to the communication management center 30 by the mobile terminal 10 is configured to be periodically executed at a specific transmission time set in advance as the specific condition.

  Here, the specific condition is not necessarily limited to a specific transmission time. For example, when a specific time set in advance is reached, when there is a transmission request for history information from the communication management center 30, And when authentication by the said communication management center 30 is performed, any one may be sufficient.

  Furthermore, the communication management center (authentication server) 30 described above includes an authentication unit 31A. In the first embodiment shown in FIG. 1, the authentication means 31A is installed and executed in the server-side control unit 31 of the management center. This authentication means 31A determines whether or not the user terminal 10 is a legitimate use, and if it is judged that the user terminal 10 is a legitimate use, the authentication means 31A permits the connection to the exchange control station 22 and illegal use. If it is determined that the connection is not established, the switching control station 22 has a function of rejecting the connection.

  Hereinafter, this will be described in more detail.

(About user terminals)
As described above, the user terminal 10 such as a portable terminal includes a history update unit (history update unit) 16 that generates a terminal-side history hash, and a conversion that generates a terminal-side authentication key based on the generated history hash. Unit (authentication key generation means) 13 and the generated terminal-side authentication key and the history hash are stored in the storage unit 12 preliminarily provided, and the terminal-side authentication key is transmitted to the communication management center 30 for authentication. And a terminal-side control unit 11.

  Here, as described above, the history update unit 16 has a function of transmitting the latest history information data on the user terminal side to the communication management center 30 when a specific condition set in advance is satisfied, And a function of generating a new terminal-side history hash by performing the above-described hash operation based on the latest history information data related to transmission.

  In this case, the history update unit 16 excludes the latest history information data to be transmitted to the communication management center 30 from the history information accumulated as history information in the communication management center 30 such as an incoming call history of a telephone or e-mail. It is configured to function so as to transmit only to.

  The user terminal 10 is further equipped with a wireless circuit unit 15 that is controlled by the terminal-side control unit 11 described above and performs communication with the communication management center 30 or an external terminal described above via the network described above. Has been. The storage unit 12 is also provided with an erasure circuit 18 and an unauthorized open detection circuit 17.

  Next, functions and the like of each component of the user terminal 10 will be described.

  The terminal-side control unit 11 described above performs overall control of the user terminal 10 and calculation and storage of a history hash for the storage unit 12 described above.

  The storage unit 12 stores a user terminal identification number 12a, a fixed authentication key 12c for each registered user terminal, and a history hash 12b. More specifically, the storage unit 12 includes at least a user terminal identification number specified in advance, a history hash calculated and updated by the history update unit 16, and a conversion unit (authentication key generation unit) 13. The generated new communication authentication key is stored and held as authentication processing data.

  Here, the history hash 12b described above includes various data disclosed in the related art, that is, the past number of calls of each registered mobile terminal, the past call destination telephone number, the past call start time, the past In addition to the call end time, past call time, and past call position, hardware such as remaining memory and remaining battery power managed by the mobile phone (device management function) shown in Non-Patent Document 1 described above The data is converted to a constant data length by a hash operation based on almost all device information such as software configuration information, installed software version and patch application information. The storage unit 12 also stores control data and control procedure information.

  As described above, the history update unit (history update means) 16 updates the history information in response to a request from the communication management center 30 at a predetermined interval (for example, every day or a specific time in the night) at a preset time. All or part of the data is transmitted to the communication management center 30, and a new history hash is generated from the data obtained by concatenating the transmitted data and the past history hash, and this is stored as the history hash 12b. A function of registering in the unit 12 is provided.

  The unauthorized release detection means 17 and the erasure circuit 18 are for preventing data in the storage unit 12 from being illegally dumped to the outside. For example, the unauthorized opening detection means 17 functions to output a power supply voltage signal unless a plurality of screws for stopping the casing of the portable terminal are loosened in a predetermined order. The erasure circuit 18 is for erasing the stored contents of the storage unit 12 constituted by, for example, an EEP-ROM, based on the signal from the unauthorized opening detection means 17.

  The terminal side conversion unit (authentication key generation means) 13 obtains a new communication authentication key according to the first embodiment based on the fixed authentication key 12c and the history hash 12b stored in the storage unit 12 on the terminal side. It has a function to generate. Here, since the history hash 12b is sequentially rewritten at regular intervals as described above, the newly generated authentication key 12c becomes a sequentially variable authentication key 12c. Therefore, compared to the conventional case of the fixed authentication key 12c, it becomes difficult for others to obtain fraudulently, and it is also difficult to make unauthorized calls.

  The radio circuit unit 15 is a high-frequency circuit unit having a function of processing a radio signal transmitted or received from the antenna 10a shown in FIG.

(About the Administration Center)
The communication management center 30 as an authentication server performs authentication processing based on the history information when history information, which is terminal information for authentication, is sent from the user terminal 10 such as a mobile terminal via the network. It has a function of authenticating that the user terminal related to the information is a valid terminal.

  In this case, the communication management center 30 performs a hash calculation based on the history information from the user terminal 10 and generates a new history hash on the communication management center (authentication server) 30 side (history update). (Information receiving means) 36, a conversion unit (authentication key generating means) 33 having an authentication key generating function for generating a communication authentication key based on the generated history hash, the generated communication authentication key and the history A server-side control unit 31 that stores the hash in advance in a storage unit 32 on the communication management center (authentication server) 30 side.

  Here, history information from the user terminal 10 is specified by the history updating means 16 only for history information excluding history information accumulated as history information in the communication management center, such as incoming calls and emails. The history information receiving means 36 is configured to generate the history hash by using the data relating to the history information transmitted from the history updating means 16 and the incoming call history of the telephone and e-mail stored by itself. .

  The server-side control unit 31 further inputs the communication authentication key generated by the user terminal 10, and the input communication authentication key is equal to the communication authentication key generated by the communication management center (authentication server) 30. In this case, a terminal authentication function (a function as the authentication unit 31A) for authenticating the user terminal 10 as a valid terminal is provided.

  Next, various functions of the above components in the communication management center (authentication server) 30 will be described.

  First, the server-side control unit 31 has a function of controlling the operation of each component of the communication management center 30 including history hash calculation, storage, and the like.

  The storage unit 32 includes at least terminal identification numbers 32a of all user terminals registered in advance in the communication management center 30, the new history hash 32b calculated by the history update information receiving unit 36, and the conversion. A new communication authentication key 32c generated by the unit (authentication key generating means) 33 is stored and held as authentication processing data.

  Here, the history hash 32b is, for example, the past number of calls of each registered user terminal, the past call destination telephone number, the past call start time, the past call end time, the past call time, In addition to past call locations, hardware configuration information such as remaining memory and battery power managed by the device management function of mobile phones shown in Non-Patent Document 1, application of installed software versions and patches Information is converted to a fixed data length by hash calculation based on almost all device information such as information.

  On the other hand, the information stored in the storage unit 12 of the user terminal 10 described above is only the information of the individual user terminal 10, whereas the information stored in the storage unit 32 of the communication management center 30 is All the terminal identification numbers of all user terminals 10, 10,..., The fixed authentication key 32c of each user terminal, and the history hash 32b are stored.

  Here, the history hash 32 b is sequentially rewritten every time it is received from the history update information receiving unit 36, and the history hash 12 b stored in the storage unit 12 of the user terminal 10 and the storage unit of the communication management center 30. The history hash 32b stored in 32 is the same. The storage unit 32 also stores control data and control procedure information.

  Further, the conversion unit (authentication key generation means) 33 generates a new communication authentication key according to the first embodiment based on the fixed authentication key and the history hash 32b stored in the storage unit 32.

(Description of operation)
Next, the overall operation of the first embodiment will be described with reference to the flowcharts of FIGS.

  In the first embodiment, the operation content is divided into a history hash generation update operation and an authentication operation. For this reason, these are demonstrated separately.

  Here, the operation of updating the history hashes 12b and 32b may be executed independently of the operation for performing authentication, or may be executed immediately after the operation for executing authentication. In the latter case, how to implement will be described in detail in the description of the flowchart.

<History hash update operation>
First, the history hash update operation will be described with reference to FIGS.

  First, the history hash update timing is determined from various events of the user terminal 10. Here, the history hash update timing in the user terminal 10 is a fixed time (a specific time in the night), a request from the communication management center 30, or an authentication described later, as described above. When the operation is executed between the specific user terminal 10 and the communication management center 30, at least three ways are conceivable (FIG. 2: Step A1).

  Next, the history update unit 16 calculates a history hash. This history hash calculation is performed by, for example, the past number of calls for each registered user terminal, the past call destination telephone number, the past call start time, the past call end time, the past call time, the past call time, In addition to the call location, HW configuration information such as the remaining memory and battery power managed by the device management function of the mobile phone shown in Non-Patent Document 1, the installed software version and patch application information, etc. Hash operation (SHA-1, MD5, etc.) is performed based on the data obtained by concatenating the past history hash and the difference from the time when the history hash is calculated in the past for almost all device information (terminal-side history hash generation) Process).

  These descriptions are merely examples, and any description may be used as long as the hash calculation is performed based on information that can effectively update the history hash within a certain period (for example, every other day) (FIG. 2). : Step A2). Furthermore, in the history hash generation, a history calculation is performed by excluding information that can be synchronized without using the history update unit 16 and the history update reception unit 36 between the user terminal 10 and the communication management center 30. It may be stored as a hash. For example, information such as the number of calls made in the past and the telephone number of the other party to call is always stored in the same data between the user terminal 10 and the communication management center 30 at the time of making a call. Therefore, it is not necessary to store this separately as a history hash. Processing in this case will be described in paragraph numbers [0088] to [0091] in the subsequent stage.

  Thereafter, the history update unit 16 updates the history hash 12b of the terminal-side storage unit 12 described above to a new history hash of the calculation result (FIG. 2: step A3). Further, the history update unit 16 of the user terminal 10 transmits history information updated from the previous transmission to the history update reception unit 36 on the communication management center 30 side. The history information to be transmitted may exclude a user operation history (such as an incoming call history of a telephone or a mail) that can be grasped without being transmitted from the mobile phone by the mobile phone carrier (step A4: history transmission in FIG. 2). Process).

  Here, the above-mentioned history information is periodically transmitted to the communication management center (authentication server) 30 at least at a specific transmission time which is a condition specified in advance, and the terminal described above at the timing of this transmission. The side history hash may be periodically generated and stored.

  In addition, the specific condition described above is at least one of a case where a predetermined time is reached, a case where a history information transmission request is received from the authentication server, and a case where authentication is performed by the authentication server. It is good also as a specific condition of operation start limited to one.

  Next, the history update receiving unit 36 on the communication management center (authentication server) 30 side calculates a history hash from the received information and the user operation history after receiving the previous history. This calculation method is the same as that shown in step A3 (step A5 in FIG. 2: server-side history hash generation step).

  In this server-side history hash generation step, the hash calculation is periodically executed at the timing of receiving the history information described above to periodically generate a new history hash and store it in the storage unit 32 provided in advance. You may comprise.

  Finally, the history update information receiving unit 36 on the communication management center 30 side updates the history hash 32b in the storage unit 32 with the new history hash of the calculation result described above (step A6: server side history in FIG. 2). Hash update process).

<Authentication operation>
Next, an operation for performing authentication on the user terminal will be described with reference to FIGS.

  This authenticates whether or not the user terminal 10 such as a portable terminal trying to connect to the base station 21 is a legitimate user terminal permitted to connect.

  First, when the user of the user terminal 10 makes a call by pressing the other party's telephone number, the user terminal 10 sends the terminal identification number stored in the storage unit 12 to the communication management center (authentication server) 30. It transmits via the base station 21 (step B1 in FIG. 3).

  Next, the communication management center 30 checks whether or not the transmitted terminal identification number is registered in advance, and if registered, stores the history hash and fixed authentication key corresponding to the terminal identification number. The search is performed from the unit 32 (step C1 in FIG. 3).

  Thereafter, the conversion unit 13 of the user terminal 10 and the conversion unit 32 of the communication management center 30 each generate a communication authentication key. In this case, the user terminal 10 performs a hash calculation in advance on the latest history information data (history information data transmitted to the communication management center 30) described above, and based on the new history hash calculated thereby, An authentication key is generated (communication authentication key generation step). In the case where the history hash is obtained by excluding information that can always be synchronized between the user terminal 10 and the communication management center 30, such as the number of calls in the past and the telephone number of the other party to call, Then, a data obtained by performing a hash operation on data obtained by concatenating such synchronized information is generated (for convenience of explanation, this is referred to as key generation hash data).

  For example, a communication authentication key is generated by generating pseudo-random numbers using data obtained by concatenating a history hash and an authentication key as seeds, or by performing a hash operation (SHA-1, MD5) on data obtained by concatenating a history hash and an authentication key. Etc.).

  In the case where the history hash is obtained by excluding information that can always be synchronized between the user terminal 10 and the communication management center 30 such as the number of calls in the past and the telephone number of the other party to call, the key generation is performed. Pseudo random numbers are generated using data obtained by concatenating the hash data for authentication and the authentication key as seeds, or hash operation (SHA-1, MD5, etc.) is performed on the data obtained by concatenating the hash data for key generation and the authentication key. Can be generated by

  The above-described content is merely an example, and any algorithm having randomness that has a high possibility of generating a different communication authentication key when the original data for generating the communication authentication key is different may be used (FIG. 3). : Step B2, Step C2).

  Next, the server-side control unit 31 of the communication management center (authentication server) 30 transmits the authentication data A to the user terminal 10 via the base station 21 (FIG. 3: step C3).

  When receiving the authentication data A, the control unit 11 of the user terminal 10 calculates the authenticator a from the authentication data A sent from the communication management center 30 based on the communication authentication key generated in step B2. . The calculation method itself is the same as the case where the authentication data A is encrypted by an encryption algorithm (DES, AES, etc.) preset with the communication authentication key (FIG. 3: step B3).

  Similarly, the server-side control unit 31 of the communication management center 30 calculates the authenticator a ′ from the authentication data A based on the communication authentication key generated in step B2 (FIG. 3: step C4).

  Next, the terminal-side control unit 11 of the user terminal 10 transmits the authenticator a as authentication response data via the wireless circuit unit 15 to the communication management center 30 via the base station 21 (FIG. 3: Step B4). ). Thereafter, the user terminal 10 waits for a service response (FIG. 3: step B5).

  On the other hand, the server-side control unit 31 of the communication management center (authentication server) 30 receives the authentication response (authenticator) a transferred from the user terminal 10 and the authenticator a created on the communication management center 30 side in step C4. Is compared (step C5 in FIG. 3), and it is determined whether or not the comparison results match (step C6 in FIG. 3). If they match, the communication management center 30 permits the call to the exchange control unit 22 (step C7 in FIG. 3). If they do not match, the communication management center 30 denies the call to the exchange control unit 22, thereby The authentication operation of the above-described authentication system for the user terminal 10 is completed (step C8 in FIG. 3: authentication step).

  Here, in the first embodiment, each operation content of the component part is programmed for each invention as shown in the following “authentication request program” and “terminal authentication program” and executed by the computer. Also good.

  That is, at the time of the authentication request operation to the communication management center (authentication server) 30 executed in the use terminal 10 described above, history information which is its own terminal information is transmitted to the authentication server in order to receive authentication prior to starting communication. And a user terminal configured to receive authentication information based on the history information and allow communication with a communication destination as a valid terminal, and set in advance corresponding to the operation of each component. When the specified condition is satisfied, the latest history information data on the user terminal side is transmitted to the authentication server, and a hash calculation is performed based on the latest history information data on the transmission to obtain a new terminal side history. History update processing function for generating a hash, authentication key generation function for generating a terminal-side authentication key based on the generated history hash, and the generated terminal-side authentication And an authentication key data transmission control function for storing the history hash in a storage unit equipped in advance and transmitting the data on the terminal side authentication key to the authentication server for authentication. May be.

  Here, in the history update processing function described above, the transmission processing of the terminal side history information to the authentication server is performed periodically at a specific transmission time set in advance as the specific condition. A program may be configured.

  In addition, the specific condition described above is at least one of a case where a predetermined time is reached, a case where a history information transmission request is received from the authentication server, and a case where authentication is performed by the authentication server. One of them may be the content.

  Further, in the authentication processing for the user terminal 10 executed in the communication management center (authentication server) 30 described above, history information that is terminal information for authentication is sent from the user terminal via the network. An authentication server for performing authentication processing based on the history information and authenticating that the user terminal related to the history information is a valid terminal, and performing a hash operation based on the history information from the user terminal History update information reception processing function for generating a history hash, an authentication key generation function for generating a communication authentication key based on the generated history hash, a storage unit preliminarily equipped with the generated communication authentication key and the history hash The server side storage control function for storage processing and the communication authentication key generated at the user terminal are input and the communication authentication key If serial equals communication authentication key generated by the authentication server, a terminal authentication function for authenticating the user terminal that is an authorized terminal, may be caused to execute the programmed computerized.

(Effect of Example)
Since the first embodiment is configured and functions as described above, according to this, various operations can be performed between the mobile terminal 10 and the communication management center 30 by the operations of the history update unit 16 and the history update information reception unit 36. History can be shared and data compression is realized using hash operations. Therefore, a call authentication key can be generated using more operation histories. For this reason, hacking by a clone terminal can be made more difficult.

  In other words, more history information (almost all device information such as hardware configuration information such as remaining memory and remaining battery capacity, installed software version and patch application information) was used, compared to conventional related technologies. Therefore, it has become possible to provide an authentication system with high security.

  Here, in the above-described first embodiment, when authentication is performed in the communication management center 30 which is an authentication server, new history information on the user terminal 10 side is stored in the user terminal 10 and the authentication server (communication management center) 30 respectively. The call authentication key is generated based on this and the user terminal 10 is authenticated by comparing the generated key. However, the present invention is not necessarily limited to this. It may be configured to authenticate the user terminal 10 by specifying the information, that is, a new history hash and comparing it.

  A configuration example in this case (a new authentication example based on history hash matching) is shown below.

(1). In the case of an authentication system In the authentication system, an authentication server (communication management center) 30 connected to the user terminal 10 via a network authenticates the user terminal 10 and allows the use of various services. The user terminal 10 has a history information transmission function for transmitting the latest history information on the user terminal 10 side to the authentication server 30 when a specific condition is satisfied, and the latest history information related to the transmission. A history hash generation / transmission function for generating a new terminal-side history hash by performing a hash operation based on the data and transmitting the generated history hash to the authentication server 30 is provided.

  The authentication server 30 described above includes a function of performing a hash operation based on the history information from the user terminal 10 to generate a new history hash, and a history hash generated on the user terminal 10 side The configuration includes a user terminal authentication function for authenticating that the user terminal 10 is a legitimate terminal when it is equal to the history hash generated on the server 30 side. In place of the user terminal authentication function, there are the following two practical alternative functions for confirming that the user terminal 10 and the authentication server 30 generate the same history hash. It is good also as a structure content.

First, when an authentication request is issued from the user terminal 10 to the authentication server 30, the authentication server 30 sends a random number. The user terminal 10 encrypts the random number based on the encryption key generated using the history hash as a seed, and sends it back to the authentication server 30. (Alternatively, the user terminal 10 encrypts a history hash based on an encryption key generated using a random number as a seed, and sends it back to the authentication server 30.) The authentication server 30 uses a history hash generated by itself as a seed and uses a decryption key as a seed. The data generated and transmitted from the user terminal 10 is decrypted. If the originally transmitted random number can be decrypted, the user terminal 10 is authenticated as a valid terminal. (Alternatively, the authentication server 30 decrypts the data transmitted from the user terminal 10 based on the encryption key generated using the random number as a seed, and if it matches the history hash generated by itself, the user terminal 10 is authenticated as a valid terminal.)
The other is that when the user terminal 10 issues an authentication request to the authentication server 30, the authentication server 30 transmits a random number to the user terminal. The user terminal 10 generates data obtained by performing a hash operation on the data obtained by concatenating the history hash and the random number, and returns the data to the authentication server 30. The authentication server 30 generates data obtained by performing a hash operation on the data obtained by concatenating the history hash and the random number generated by itself, and if the data matches the data transmitted from the user terminal 10, the user The terminal 10 is authenticated as a valid terminal. Further, as shown in paragraph numbers [0077], [0088], [0089], [0090], [0091], the history update unit 16 is connected between the user terminal 10 and the authentication server (communication management center) 30. In addition, except for information that can be synchronized without using the history update receiving unit 36, a hashed operation is stored as a history hash, and the history is stored in both the user terminal 10 and the authentication server 30 during authentication. Data obtained by performing a hash operation on data obtained by concatenating the hash and such synchronized information is generated as authentication hash data, and the authentication server 30 uses the history hash generation and transmission function from the user terminal 10. When the authentication hash data is transmitted, it is compared with the authentication hash data generated by itself, and if they match, the user terminal 10 is authenticated as a valid terminal. The content of the user terminal authentication function may be included.

(2). In the case of a user terminal The user terminal 10 transmits history information, which is its own terminal information, to the authentication server (communication management center) 30 in order to receive authentication prior to the start of communication, and based on the history information. Is a user terminal 10 configured to receive authentication information to be allowed to communicate with a communication destination as a legitimate user terminal 10, and when the predetermined condition is satisfied, the user terminal 10 side The history update means 16 for transmitting the latest history information data to the authentication server 30 and performing a hash operation based on the latest history information data related to the transmission to generate a new terminal-side history hash, A new terminal-side history hash is stored in the storage unit 12 equipped in advance, and the terminal-side control unit 11 is transmitted to the authentication server 30 for authentication. This is the content of the configuration.

  In place of the terminal-side control unit 11, there are the following two practical alternative methods, which may be the contents of the configuration.

One is to perform an authentication request from the user terminal 10 to the authentication server 30 at the time of authentication, and when receiving a random number from the authentication server 30, the random number is encrypted based on an encryption key generated using a history hash as a seed, It returns to the authentication server 30. (Alternatively, the user terminal 10 encrypts the history hash based on an encryption key generated using a random number as a seed, and sends it back to the authentication server 30.)
The other is to perform an authentication request from the user terminal 10 to the authentication server 30 and receive a random number from the authentication server 30 at the time of authentication. It is generated and returned to the authentication server 30. Further, as indicated by paragraph numbers [0077], [0088], [0089], [0090], and [0091], the user terminal 10 uses its own terminal information to receive authentication prior to the start of communication. Use of a configuration that transmits certain history information to the authentication server (communication management center) 30, receives authentication information based on the history information, and allows communication with a communication destination as a valid user terminal 10 The user terminal 10 transmits the latest history information data on the user terminal 10 side to the authentication server 30 when a predetermined condition is satisfied, and based on the latest history information data related to the transmission. The history update unit 16 that performs a hash operation and generates a new terminal-side history hash, and the storage unit 12 that is preliminarily equipped with the generated new terminal-side history hash In both cases, for authentication, a hash calculation is performed on data obtained by concatenating information that can be synchronized without using the history hash, the history update unit 16 and the history update reception unit 36, and is sent to the authentication server 30 as authentication data. It is good also as the structure content having provided the terminal side control part 11 which performs.

(3). In the case of a communication management center (authentication server) In the communication management center (authentication server) 30, when history information that is terminal information for authentication is sent from the user terminal 10 via a network, based on the history information. An authentication server 30 that performs authentication processing and authenticates that the user terminal 10 related to the history information is a valid terminal, and performs a hash operation based on the history information from the user terminal 10 to obtain a new history hash. A history update information receiving unit 36 to be generated and a server side control unit (center side control unit) 31 for storing the generated new history hash in a storage unit 32 provided in advance are provided. Further, the server-side control unit (center-side control unit) 31 inputs a new history hash generated by the user terminal 10 and the history hash is generated by the authentication server (communication management center). In the case where the hash value is equal to the history hash, the configuration content includes a terminal authentication function (function as an authentication unit) that authenticates the user terminal 10 as a valid terminal. Note that, in place of the terminal authentication function, there are the following two practical alternative methods for confirming that the user terminal 10 and the authentication server 30 generate the same history hash. It is good.

First, when there is an authentication request from the user terminal 10 to the authentication server 30, the authentication server 30 transmits a random number to the user terminal 10. The authentication server 30 generates a decryption key using the history hash generated by itself as a seed, decrypts the data transmitted from the user terminal 10, and authenticates the user terminal 10 when the originally transmitted random number can be decrypted. Authenticate as a secure terminal. (Alternatively, the authentication server 30 decrypts the data transmitted from the user terminal 10 based on the encryption key generated using the random number as a seed, and if it matches the history hash generated by itself, the user terminal 10 is authenticated as a valid terminal.)
The other is that when the authentication request is issued from the user terminal 10 to the authentication server 30, the authentication server 30 transmits a random number to the user terminal 10. The user terminal 10 generates data obtained by performing a hash operation on the data obtained by concatenating the history hash and the random number, and returns the data to the authentication server 30. The authentication server 30 generates data obtained by performing a hash operation on the data obtained by concatenating the history hash and the random number generated by itself, and if the data matches the data transmitted from the user terminal 10, the user The terminal 10 is authenticated as a valid terminal. Furthermore, as shown in paragraph numbers [0077], [0088], [0089], [0090], and [0091], in the communication management center (authentication server) 30, history information as terminal information for authentication is stored in the network. An authentication server 30 that authenticates that the user terminal 10 related to the history information is a legitimate terminal by performing an authentication process based on the history information when being sent from the user terminal 10 via History update information receiving means 36 that performs a hash operation based on history information from the user terminal 10 and generates a new history hash, and a server side that stores the generated new history hash in the storage unit 32 provided in advance. And a control unit (center side control unit) 31. Further, the server-side control unit (center-side control unit) 31 does not use the authentication hash generated by the user terminal 10 (the history update unit 16 and the history update reception unit 36 not included in the history hash). If the information that can be synchronized is connected to the history hash and the hash operation is performed on the data, and this authentication hash is equal to the new authentication hash generated by the authentication server (communication management center) Further, the configuration content includes a terminal authentication function (function as an authentication unit) for authenticating that the user terminal 10 is a valid terminal.

(4). In the case of the authentication method In the case of the authentication method, history information as terminal information is transmitted from the user terminal 10 to the authentication server 30 via the network in order to receive authentication of the communication management center (authentication server) 30 prior to communication. In addition, the authentication server 30 authenticates the corresponding user terminal 10 based on the history information under a certain condition, and the user terminal 10 is updated when a specific condition is satisfied. History information transmitting step for transmitting the history information data to the authentication server 30, and receiving the latest history information from the user terminal 10, performing a hash operation based on the history information, and a new history hash on the authentication server 30 side The server-side history hash generation step for generating the latest history information of the user terminal 10 that is executed almost simultaneously with the server-side history hash generation step And a terminal-side history hash generation step for generating a new history hash on the terminal side and transmitting the new history hash to the authentication server 30 based on the user terminal 10 side. Provided that the authentication server authenticates the user terminal as a valid terminal when the new history hash generated by the user terminal is equal to the new history hash generated by the authentication server. Is the content of the configuration.

  As a method for confirming that the user terminal 10 and the authentication server 30 generate the same history hash instead of the authentication step, there are the following two practical alternative steps. Also good.

First, when an authentication request is issued from the user terminal 10 to the authentication server 30, the authentication server 30 sends a random number. The user terminal 10 encrypts the random number based on the encryption key generated using the history hash as a seed, and sends it back to the authentication server 30. (Alternatively, the user terminal 10 encrypts a history hash based on an encryption key generated using a random number as a seed, and sends it back to the authentication server 30.) The authentication server 30 uses a history hash generated by itself as a seed and uses a decryption key as a seed. The data generated and transmitted from the user terminal 10 is decrypted. If the originally transmitted random number can be decrypted, the user terminal 10 is authenticated as a valid terminal. (Alternatively, the authentication server 30 decrypts the data transmitted from the user terminal 10 based on the encryption key generated using the random number as a seed, and if it matches the history hash generated by itself, the user terminal 10 is authenticated as a valid terminal.)
The other is that when the user terminal 10 issues an authentication request to the authentication server 30, the authentication server 30 transmits a random number to the user terminal. The user terminal 10 generates data obtained by performing a hash operation on the data obtained by concatenating the history hash and the random number, and returns the data to the authentication server 30. The authentication server 30 generates data obtained by performing a hash operation on the data obtained by concatenating the history hash and the random number generated by itself, and if the data matches the data transmitted from the user terminal 10, the user The terminal 10 is authenticated as a valid terminal. Furthermore, as shown in paragraph numbers [0077], [0088], [0089], [0090], and [0091], the following alternative steps may be included as the authentication step. Except for information that can always be synchronized between the user terminal 10 and the authentication server (communication management center) 30, a hash operation is stored as a history hash, and the user terminal 10 and the authentication server 30 are used for authentication. The authentication server 30 generates the hash data for authentication as the hash data for authentication for the data obtained by concatenating the history hash and such information that is always synchronized with each other. When the hash data for authentication is transmitted by the history hash generation / transmission function, the user compares with the hash data for authentication generated by himself / herself, and authenticates that the user terminal 10 is a legitimate terminal when they match. The provision of the terminal authentication function is the content of the authentication process.

(5). In the case of an authentication request program, the authentication request program transmits history information, which is its own terminal information, to the communication management center (authentication server) 30 to receive authentication prior to the start of communication, and is based on the history information. The latest history information data on the user terminal side when a specific condition set in advance is satisfied when the authentication information is transmitted and the communication with the communication destination is permitted as a valid terminal. A history update processing function for generating a new terminal-side history hash by performing a hash operation based on the latest history information data related to the transmission and pre-equipped with the generated terminal-side history hash The history hash is stored in the storage unit and transmitted to the authentication server for authentication. The transmission control function is executed by a computer, and this is the content of the configuration.

  Note that, in place of the hash transmission control function, there are the following two practical alternative functions, which may be the configuration contents.

The first is to store in a storage unit preliminarily equipped with a terminal-side history hash, receive an authentication request, receive a random number, and generate the random number based on an encryption key generated using the terminal-side history hash as a seed. Is a hash transmission control function. (Alternatively, the terminal-side history hash is stored in a storage unit equipped with the terminal-side history hash in advance, an authentication request is made, a random number is received, and the terminal-side history hash is stored based on an encryption key generated using the random number as a seed. Encrypting and returning to the authentication server 30 is a hash transmission control function.)
The other is to store the terminal-side history hash in a storage unit equipped in advance, receive an authentication request, receive a random number, and perform a hash operation on the terminal-side history hash and the data concatenated with the random number. Generating the performed data and returning it to the authentication server 30 is a hash transmission control function. Furthermore, as shown in paragraph numbers [0077], [0088], [0089], [0090], and [0091], the following alternative configuration may be used. In the authentication request program, history information as its terminal information is transmitted to the communication management center (authentication server) 30 in order to receive authentication prior to the start of communication, and authentication information based on the history information is transmitted. Data that can be synchronized with the authentication server 30 on the user terminal side when a predetermined condition is satisfied when the user terminal is configured as a legitimate terminal and is allowed to communicate with the communication destination. A history update processing function for generating a new terminal-side history hash by performing hash calculation based on the latest history information data related to the transmission and transmitting the latest history information data excluding the The terminal-side history hash is stored in a storage unit equipped in advance, and the terminal-side history hash is always synchronized with the authentication server 30. From those concatenated data so as to perform the history hash transmission control function for the transmission processing to the authentication server the data obtained with the hash operation for authentication, to the computer, do this and its configuration contents.

(6). In the case of a terminal authentication program In the terminal authentication program, when history information, which is terminal information for authentication, is sent from the user terminal 10 via a network, an authentication process is performed based on the history information, and the history information is used. History update in a communication management center (authentication server) 30 for authenticating that the user terminal 10 is a valid terminal and performing a hash operation based on the history information from the user terminal 10 to generate a new history hash An information reception processing function, a server-side storage control function for storing and processing the generated new history hash in the storage unit 32 equipped in advance, and a new history hash generated by the user terminal 10 and the history hash Authenticate that the user terminal 10 is a legitimate terminal if is equal to the new history hash generated by the authentication server The terminal authentication function is executed by a computer, and this is the content of the configuration.

  Note that, in place of the terminal authentication function, there are the following two practical alternative functions, which may be the configuration contents.

One is to transmit a random number to the user terminal 10 at the time of authentication, decrypt the data received from the user terminal 10 based on an encryption key generated using the history hash as a seed, If they match, authenticating the user terminal 10 as a valid terminal is used as a terminal authentication function. (Or, at the time of authentication, a random number is transmitted to the user terminal 10, and the data received from the user terminal 10 is decrypted based on an encryption key generated using the random number as a seed, and matches the history hash. In the case of performing authentication, authenticating the user terminal 10 as a valid terminal is assumed to be a terminal authentication function.)
The other is that at the time of authentication, a random number is transmitted to the user terminal 10 to generate data obtained by performing a hash operation on the history hash and data obtained by concatenating the random number and received from the user terminal If the data matches that, the terminal authentication function is to authenticate the user terminal 10 as a valid terminal. Furthermore, as shown in paragraph numbers [0077], [0088], [0089], [0090], and [0091], the following alternative configuration may be used. In the terminal authentication program, when history information that is terminal information for authentication is sent from the user terminal 10 via the network, authentication processing is performed based on the history information, and the user terminal 10 related to the history information is valid. A history update information reception processing function for generating a new history hash by performing a hash operation based on the history information from the user terminal 10 in the communication management center (authentication server) 30 for authenticating that the terminal is a secure terminal; A server-side storage control function for storing and processing the generated new history hash in the storage unit 32 equipped in advance, and generating data that concatenates data that is always synchronized between the history hash and the user terminal 10, If the data obtained by hashing the data is equal to the data transmitted from the user terminal 10, the user terminal 10 is Terminal authentication function of authenticating that a such terminal, so as to execute the computer, do this and its configuration contents.

  Even if it does in this way, the objective can be achieved like the case of the 1st example mentioned above. In this case, in particular, on the communication management center (authentication server) 30 side, a history hash having a difficulty that is almost impossible to estimate by using the latest history information on the use terminal side for generating a history hash for authentication is provided. Based on this, a new history hash on the user terminal 10 side is compared and collated to authenticate the user terminal, so that an authentication service with higher security strength can be provided.

[Second Embodiment]
Next, a second embodiment of the present invention will be described with reference to FIGS.

(Constitution)
In this embodiment, when the service receiving unit 19 of the user terminal 10 receives some service from the service provider 40, the communication management center (authentication server) 30 performs alternative authentication.

  As shown in FIG. 4, in the second embodiment, the Internet 23 and the service provider 40 are added to the first embodiment, and the service receiver 19 is added to the user terminal 10. Further, in the communication management center 30, what is described as the center-side control unit 31 in the first embodiment is replaced with an authentication determination unit 39.

  In FIG. 4, the exchange control station 22 is connected to the base station 21 and at the same time to various service providers 40 via the Internet 23, so that a desired user terminal (portable terminal) 10 and a desired service provider are connected. The communication control with the IP protocol 40 is performed.

  The service provider 40 is a provider of various services provided from the Internet 23 to the user terminal (mobile terminal) 10. Examples of the various services include various information distribution services, music distribution, moving image distribution, blog service, SNS (social network service), and the like. Other configurations and operation functions of the respective components are the same as those in the first embodiment.

  The service receiving unit 19 of the user terminal 10 has a function of accessing the service provider 40 and receiving an actual service. For example, it refers to a web browser function.

  The authentication determination unit 39 receives an authentication request from the service provider 40 and inputs the communication authentication key generated by the user terminal 10, and the input communication authentication key is generated by the communication management center (authentication server) 30. The terminal authentication function (function as authentication means 31A) for authenticating the user terminal 10 as a valid terminal and transmitting the authentication result to the service provider 40 when the communication authentication key is equal to the communication authentication key. Yes.

(Overall operation)
Next, the overall operation of the second embodiment will be described.

<History hash update operation>
First, of the operations of the second embodiment, the operations relating to the update of the history hash are executed in the same manner as in the first embodiment shown in FIG. A new history hash is created and updated.

<Authentication operation>
Next, the authentication operation of the second embodiment will be described based on the flowchart of FIG.

  First, the user terminal 10 such as a portable terminal transmits an access request for the service via the service receiving unit 19 and transmits its own terminal identification number to the service provider 40. This terminal identification number may be the same as that in the first embodiment, or may be another ID that can be verified by the management center 30 (FIG. 5: Step D1).

  Next, the service provider 40 requests the communication management center 30 for an authentication request for a terminal corresponding to the transmitted terminal identification number (or another ID that can be verified by the communication management center 30) (FIG. 5: Step E1). ).

  Thereafter, an authentication process is performed between the user terminal 10 and the communication management center 30. This authentication process is the same as the operation up to step C6 disclosed in FIG. 3 in the first embodiment.

  In this case, if an authentication request is made using another ID that can be collated at the communication management center 30 in step E1, the authentication determination unit 39 of the communication management center 30 is based on the terminal identification number to be collated. Refer to authentication key and history hash. Then, the authentication determination unit 39 of the communication management center 30 determines that the authentication is successful when the comparison result of step C6 matches, and returns data indicating the authentication success to the service provider 40.

  Further, the authentication determination unit 39 of the communication management center 30 returns data indicating the authentication failure to the service provider 40 when the comparison result in Step C6 fails (when they do not match). The service provider 40 receives data related to such a result (FIG. 5: Step E2).

Subsequently, the service provider 40 determines whether or not data indicating successful authentication has been received (FIG. 5: Step E3). When data indicating successful authentication is received, the service is started (FIG. 5: Step E4), and the service is received from the service receiving unit 19 of the user terminal 10. On the other hand, when data indicating an authentication failure is received, service distribution is rejected (FIG. 5: step E5), whereby the authentication operation by the communication management center (authentication server) 30 is completed. In this case, the service reception unit 19 of the user terminal 10 displays that the authentication has failed.
[Third embodiment]
Next, a third embodiment of the present invention will be described with reference to FIGS.

(Constitution)
In the third embodiment, a case where contents and services are shared between a plurality of user terminals 10 is shown. Here, the sharing of contents and services means, for example, that contents (music, photos, etc.) downloaded by a certain user to his / her mobile phone are shared by transmitting them to another user's mobile phone via a local network. . Furthermore, the sharing can also be applied when a VPN (Virtual Private Network) is established between a plurality of user terminals 10.

  As shown in FIG. 6, in the third embodiment, the storage units 12 of the individual user terminals 10-1 and 10-2 have history identification information 12e and history information 12f. Instead of the conversion unit 13, a history hash calculation unit 13a is provided. Here, the individual user terminals 10-1 and 10-2 described above are shown as 10-1 and 10-2 in order to distinguish each other in the figure, but the inside is the same.

  That is, the user terminals 10-1 and 10-2 such as mobile terminals include a terminal-side control unit 11, a storage unit 12, a history hash calculation unit 13 a, a wireless circuit unit 15, an unauthorized open detection circuit 17, An erasing circuit 18 and a service receiving unit 19 are provided.

The terminal-side control unit 11 performs overall control of the user terminal 10, storage of various information in the storage unit 12 described above, and access control regarding functions / services held by each terminal.
The storage unit 12 stores a user terminal identification number 12a, history identification information 12e, and history information 12f. In FIG. 6, history identification information 12e is meta information for identifying history information 12f. For example, information such as a file name, an expiration date, and an information creator corresponds to this. In the third embodiment, the history information 12f indicates information of a service that is accessed and downloaded by a user via a Web browser on a mobile phone. For example, this includes information such as electronic tickets, content (music, games, moving images, etc.), advertisements, and the like.

The history hash calculation unit 13a calculates a hash value of history information related to history identification information exchanged at the time of authentication between a plurality of user terminals.
The wireless circuit unit 15 is a high-frequency circuit unit having a function of processing a wireless signal communicating between a plurality of user terminals. The main ones found in mobile phones include wireless LAN, Bluetooth, infrared communication, or proximity wireless communication such as FeliCa.

  The unauthorized release detection means 17 and the erasure circuit 18 are for preventing data in the storage unit 12 from being illegally dumped to the outside. For example, the unauthorized opening detection means 17 functions to output a power supply voltage signal unless a plurality of screws for stopping the casing of the portable terminal are loosened in a predetermined order. The erasure circuit 18 is for erasing the stored contents of the storage unit 12 constituted by, for example, an EEP-ROM, based on the signal from the unauthorized opening detection means 17.

  The service receiving unit 19 has a function of accessing the partner terminal 10-1 or 10-2 and receiving an actual service. For example, it refers to a web browser function, a music player function, an image viewer function, and a presence service function.

  In FIG. 6, history identification information 12e is meta information for identifying history information 12f. For example, information such as a file name, an expiration date, and an information creator corresponds to this.

  In the third embodiment, the history information 12f indicates information of a service that is accessed and downloaded by a user via a Web browser on a mobile phone. For example, this includes information such as electronic tickets, content (music, games, videos, etc.), advertisements, and the like.

  Further, the history hash calculation unit 13a calculates a hash of a history necessary for authentication in authentication between a plurality of terminals. Other configurations and operation functions of the respective components are the same as those of the second embodiment described above.

(Overall operation)
Next, the overall operation of the third embodiment will be described.

<Authentication operation>
Next, an operation for executing authentication between user terminals will be described with reference to FIGS.

  Here, when authenticating whether the user terminal 10-1 such as a portable terminal can share the content or service held by another user terminal 10-2 that can be connected to the local network Will be described with an example.

  First, when the user of the user terminal 10-1 connects to the user terminal 10-2 by local communication, the user terminal 10-1 transmits the content / service name to be shared to the user terminal 10-2. (Step F1 in FIG. 7).

  Next, the user terminal 10-2 selects history information as a source of authentication necessary for sharing the content / service name transmitted. This is because the user of the user terminal 10-2 defines a group that the user wants to share in advance, and history information is registered in advance as characteristics relating to the group, and is selected or content / service is selected from the user terminal 10-1. When the name is transmitted, it may be displayed on the screen of the user terminal 10-2 and the user may specify the history information. Then, history identification information related to the history information is transmitted to the user terminal 10-1 (step G1 in FIG. 7).

  Thereafter, the history hash calculation unit 13 of the user terminal 10-1 and the history hash calculation unit 13 of the user terminal 10-2 calculate a hash value of the history information corresponding to the transmitted history identification information, respectively (FIG. 7). Step F2, Step G2).

  Next, the radio circuit unit 15 of the user terminal 10-1 transmits the hash value generated in Step F2 to the user terminal 10-2 (FIG. 7: Step F3). Thereafter, the user terminal 10-1 waits for a service response (FIG. 7: Step F4).

  On the other hand, the terminal-side control unit 11 of the user terminal 10-2 compares the hash value transferred from the user terminal 10-1 with the hash value created on the user terminal 10-2 side in step G2. (Step G3 in FIG. 7), it is determined whether or not the comparison results match (Step G4 in FIG. 7). If they match, the user terminal 10-2 permits the terminal-side control unit 11 to share content / service (step G5 in FIG. 7). If they do not match, the user terminal 10-2 receives the terminal-side control unit 11 The content / service sharing is rejected (step G6 in FIG. 7), whereby the authentication operation of the above-described authentication system for the user terminal 10-1 is completed.

  Here, in the third embodiment, each operation content of the component part is configured to be programmed for each invention and executed by a computer as in the following “authentication request program” and “terminal authentication program”. Also good.

(Effect of Example)
Since the third embodiment is configured and functions as described above, it is possible to perform authentication for sharing contents and services between terminals having common history information. Since the history information is information with time change, it is effective for time-limited sharing or ad hoc sharing.

[Fourth embodiment]
Next, a fourth embodiment of the present invention will be described with reference to FIGS.

(Constitution)
The fourth embodiment shows a case where a plurality of user terminals 10 authenticate services managed by a server such as SNS. The authentication here is, for example, realizing a service in which only a terminal sharing a specific experience can participate in a specific SNS group.

  As shown in FIG. 8, in the fourth embodiment, the service provider 40 includes a storage unit 42, a history hash calculation unit 43, a history update information reception unit 46, and an authentication determination unit 49. Furthermore, the storage unit 42 holds history identification information 42e and history information 42f. The user terminal (portable terminal) 10 of the fourth embodiment is the same as that of the third embodiment described above, and the base station 21, the exchange control station 22, the Internet 23, and the management center connected thereto. 30 is the same as that of the second embodiment.

  In FIG. 8, the history identification information 42e is meta information for identifying the history information 42f. For example, information such as a file name, an expiration date, and an information creator.

  The history identification information 42e has the same information quality as the history identification information 12e on the mobile terminal 10 side, but is characterized in that the history identification information 42e is information received by a history update information receiving unit 46 described later.

  In the present embodiment, the history information 42f indicates information of a service that is accessed and downloaded by a user via a Web browser on a mobile phone. For example, this includes information such as electronic tickets, content (music, games, moving images, etc.), advertisements, and the like. Also in this regard, the history information 42f has the same information quality as the history information 12f, but is characterized in that it is information received by the history update information receiving unit 46 described later.

  Further, the history hash calculation unit 43 calculates a hash of a history necessary for authentication in the authentication between the user terminal 10 and the service provider 40.

  The history update information receiving unit 46 receives history information necessary for authentication determined by a specific service administrator. This is used when a specific group manager of the SNS determines history information necessary for joining the group, and this administrator registers the history information.

  The authentication determination unit 49 compares and determines whether or not the history hash value received from the user terminal 10 and the history hash value generated by the user terminal 10 are the same. , Allow access to specific services. Other configurations and operation functions of the respective components are the same as those of the second and third embodiments described above.

(Overall operation)
Next, the overall operation of the fourth embodiment will be described.

  Here, when the user terminal 10 such as a portable terminal is connected to the service provider 40 via a base station / Internet, the service provider 40 determines whether the connected user terminal 10 has experienced a specific experience. A case where the authentication is performed will be described as an example.

<History information update operation>
First, the history information registration operation of the service provider 40 will be described with reference to FIGS.

  First, for a group that has experienced a specific experience, an administrator (such as an SNS administrator) that provides some service receives history update information for identifying the group and history identification information relating to the history information. Registration is performed via the unit 46.

  For example, when the SNS manager of the baseball team manages an SNS that is desired to be accessed only by a person who has obtained a specific latest game ticket, the contents of the ticket are registered as history information. Alternatively, when the administrator wants a person who has downloaded a specific advertisement to access a trial service use site, the contents of the advertisement are registered as history information. When the user of the user terminal 10-1 connects to the user terminal 10-2 by local communication to know whether the topic is known or not, the user terminal 10-1 sets the content / service name to be shared to the user terminal 10- 2 (step J1 in FIG. 9).

<Authentication operation>
Next, an operation for executing authentication between user terminals will be described with reference to FIGS.

First, the user terminal 10 transmits a service name to be shared to the service provider. (Step H1 in FIG. 9)
Next, the service provider 40 transmits history identification information as a basis for authentication necessary for sharing the content to the service name transmitted from the user terminal 10. This uses what was previously registered in step H1 (step J2 in FIG. 9).

  Thereafter, the history hash calculation unit 13 of the user terminal 10 and the history hash calculation unit 43 of the service provider 40 each calculate a hash value of the history information corresponding to the transmitted history identification information (step H2 in FIG. Y2, step J3).

  Next, the radio circuit unit 15 of the user terminal 10 transmits the hash value generated in Step H2 to the service provider 40 (FIG. 9: Step H3). Thereafter, the user terminal 10 waits for a service response (FIG. 9: Step H4).

  On the other hand, the authentication determination unit 49 of the service provider 40 compares the hash value transferred from the user terminal 10 with the hash value created on the user terminal 10 side in step J3 (step J4 in FIG. 9). Then, it is determined whether or not the comparison results match (step J5 in FIG. 9). If they match, the service provider 40 permits the user terminal 10 to use the service (step J6 in FIG. 9). If they do not match, the service provider 40 denies the user terminal 10 to use the service (FIG. 9). Step J7), thereby completing the above-described authentication operation of the authentication system for the user terminal 10.

  Here, in the fourth embodiment, the operation contents of the constituent parts are separated from the mobile terminal 10 and the service provider 40 (for each invention, as in the “authentication request program” and “terminal authentication program”). ) It may be configured to be programmed and executed by a computer.

(Effect of Example)
Since the fourth embodiment is configured and functions as described above, authentication for providing services such as SNS can be performed only to terminals having common history information (experience).

[Fifth embodiment]
Next, a fifth embodiment of the present invention will be described with reference to FIGS.

(Constitution)
In the fifth embodiment, as in the third embodiment described above, a case where a plurality of user terminals 10 share contents and services is shown. Here, the sharing means, for example, that content (music, photos, etc.) downloaded by a certain user to his / her mobile phone is shared by transmitting it to another user's mobile phone via a local network. Furthermore, the present invention can be applied to a case where a VPN is established between a plurality of user terminals 10.

  However, as a condition for sharing, the mobile phone has a characteristic of determining whether or not the past state of the mobile phone (location obtained by GPS, movement obtained by the acceleration sensor, etc.) is the same state.

  As shown in FIG. 10, in this fifth embodiment, the individual user terminals 10 (in the figure, 10-1 and 10-2 are shown to distinguish each other, but the inside is the same. ), Instead of the history hash calculation unit 13a of the third embodiment, a similarity calculation unit 13b is provided.

  In FIG. 10, history identification information 12e is meta information for identifying history information 12f. An example of meta information in this case is shown in FIG. As shown in FIG. 11, the history identification information 12e includes a history target, an information creator, a history target time (start, end), a sampling frequency, and a similarity determination condition.

  Further, as shown in FIG. 11, the history information 12f is a value acquired at a sampling frequency defined from the history target time (start) to the history target time (end) in the sensor output indicated by the information creator. Is a set of

  Furthermore, the similarity calculation unit 13b calculates a value corresponding to the similarity determination condition of FIG. In FIG. 11, the correlation value mainly increases as an example, but the calculation of the correlation value s indicates the following.

A value obtained by dividing the time from the history target time (start) to the history target time (end) by the sampling interval is N, the sensor output value of the user terminal 10-1 at each time is x _i , and the user terminal 10 -2 sensor output y _i , x _i (i = 0, ..., N-1) average value x bar (characters formed by drawing a horizontal line on x), y _i (i = 0, .., N-1) is y bar (characters formed by drawing a horizontal line on y), the correlation value s can be calculated as follows.

  This value ranges from -1 to 1, and the closer the value is to 1, the higher the similarity. There are many similarities calculating methods other than this method, and the calculation of the correlation value is merely an example of the similarity calculating method in the present embodiment. Other configurations and operation functions of the respective components are the same as those in the second embodiment described above.

(Overall operation)
Next, the overall operation of the fifth embodiment will be described.

<Authentication operation>
Next, an operation for executing authentication between user terminals will be described with reference to FIGS.

  Here, it is authenticated whether or not the user terminal 10-1 such as a portable terminal can share contents or services held in another user terminal 10-2 that can be connected to the local network. A case will be described as an example.

  First, when the user of the user terminal 10-1 connects to the user terminal 10-2 by local communication, the user terminal 10-1 transmits the content / service name to be shared to the user terminal 10-2. (Step K1 in FIG. 12).

  Next, the user terminal 10-2 selects history information that is the basis of authentication necessary for sharing the content / service name that has been transmitted. This is because the user of the user terminal 10-2 defines a group that the user terminal 10-2 wants to share in advance, and history information is registered in advance as characteristics relating to the group, or the content / service name is transmitted from the user terminal 10-1. At this point, it may be displayed on the screen of the user terminal 10-2 and the user may specify history information. Then, the user terminal 10-2 transmits history identification information related to the history information to the user terminal 10-1 (step L1 in FIG. 12).

  Thereafter, the user terminal 10-1 determines whether there is history information corresponding to the history identification information (step K3 in FIG. 12). This is because whether there is a corresponding sensor, whether the data can be acquired from the history target time (start) to the history target time (end), acquired at the sampling interval described in the history identification information, If there is an omission, it is determined whether interpolation can be performed by interpolation.

  If it is determined that the transmission of the data described in the history identification information does not provide data satisfying the above conditions, the corresponding history information is not transmitted (step K4 in FIG. 12), and the process ends. .

  On the other hand, if the data described in the history identification information can be sent, such data is created and sent to the user terminal 10-2 as history information (step K5 in FIG. 12). Thereafter, the user terminal 10-1 waits for a service response (FIG. 12: Step K6).

  Next, the similarity calculator 13b of the user terminal 10-2 calculates the similarity between the transmitted history information and the history information held by itself (step L2 in FIG. 12). Here, for example, when the correlation value is specified as the similarity determination condition in the history identification information, the similarity value is calculated as in (Expression 2).

  Then, the terminal-side control unit 11 of the user terminal 10-2 determines whether or not the calculated similarity satisfies the condition described in the similarity determination condition (step L3 in FIG. 12). The terminal 10-2 permits content / service sharing to the terminal-side control unit 11 (step L4 in FIG. 12). If not satisfied, the user terminal 10-2 refuses content / service sharing to the terminal-side control unit 11. (Step L5 in FIG. 12) Thus, the above-described authentication operation of the authentication system for the user terminal 10-1 is completed.

  Here, in the fifth embodiment, the contents of each operation of the constituent parts are separated into the mobile terminal 10-1 and the user terminal 10-2 like “authentication request program” and “terminal authentication program”. It may be configured to be programmed and executed by a computer (for each invention).

(Effect of Example)
Since the fifth embodiment is configured and functions as described above, it is possible to perform authentication for sharing contents and services between terminals having common history information that can be determined from sensor outputs. Since the history information is information with time change, it is effective for time-limited sharing or ad hoc sharing.

[Sixth embodiment]
Next, a sixth embodiment of the present invention will be described with reference to FIGS.

(Constitution)
In the sixth embodiment, a case where a plurality of user terminals 10 authenticate services managed by a server such as SNS is shown. The authentication here is, for example, realizing a service in which only a terminal sharing a specific experience can participate in a specific SNS group. However, it is a feature to determine whether or not a specific experience is shared because the past state of the mobile phone (location obtained by GPS, movement obtained by acceleration sensor, etc.) is the same state. .

  As shown in FIG. 13, the sixth embodiment has a similarity calculation section 43a instead of the history hash calculation section 43 of the fourth embodiment. Other configurations are the same as those of the fourth embodiment, but some of the contents and operations are different, so the different ones will be described in detail.

  In FIG. 13, history identification information 42e is meta information for identifying history information 42f. This is meta information for identifying the history information 12f. An example of the meta information in this case is the same as that shown in FIG. 11 in the fifth embodiment described above. The history identification information 42e has the same information quality as the history identification information 12e of the fifth embodiment, but is characterized in that the history identification information 42e is information received by a history update information receiving unit 46 described later.

  In the sixth embodiment, the history information 42f is defined from the history target time (start) to the history target time (end) among the sensor outputs indicated by the information creator as shown in FIG. This is a set of values acquired at a sampling frequency. Also in this regard, the history information 42f has the same information quality as the history information 12f of the fifth embodiment, but is characterized in that it is information received by the history update information receiving unit 46 described later.

  Furthermore, the similarity calculation unit 43a calculates the similarity required for authentication in the authentication between the user terminal 10 and the service provider 40. Similar to the fifth embodiment, the similarity is a value corresponding to the similarity determination condition in FIG.

  The history update information receiving unit 46 receives history information necessary for authentication determined by a specific service manager. This is used when a specific group manager of the SNS determines history information necessary for joining the group, and this administrator registers the history information.

  Furthermore, the authentication determination unit 49 determines whether or not the value obtained by the similarity calculation unit 43a satisfies the similarity determination condition of FIG. Access is permitted. The other configurations and the operation functions of the respective components are the same as those of the above-described fourth or fifth embodiments.

(Overall operation)
Next, the overall operation of the sixth embodiment will be described.

  Here, the user terminal 10 such as a portable terminal is connected to the service provider 40 via the base station 21 and the Internet 23, and the service provider 40 authenticates whether the terminal has experienced a specific experience based on the sensor output. An example of the case will be described.

<History information update operation>
First, the history information registration operation of the service provider 40 will be described with reference to FIGS.

  First, for a group that has experienced a specific experience, an administrator (such as an SNS administrator) that provides some service receives history update information for identifying the group and history identification information relating to the history information. Registration is performed via the unit 46. For example, when the SNS administrator of the ski resort manages an SNS that only a person who has visited the ski resort on a specific day accesses the SNS, the appropriate similarity determination condition is set as history identification information on the specific date. GPS position information in the vicinity of the ski resort is registered as history information (step N1 in FIG. 14).

<Authentication operation>
Next, an operation for executing authentication between user terminals will be described with reference to FIGS.

  First, the user terminal 10 transmits a service name to be shared to the service provider. (Step M1 in FIG. 14)

  Next, the service provider 40 transmits history identification information, which is a source of authentication necessary for sharing the content, to the service name transmitted from the user terminal 10. This uses what was previously registered in step N1 (step N2 in FIG. 14).

  Thereafter, the user terminal 10 determines whether there is history information corresponding to the history identification information. This is because whether there is a corresponding sensor, whether the data can be acquired from the history target time (start) to the history target time (end), acquired at the sampling interval described in the history identification information, If there is an omission, it is determined whether interpolation can be performed by interpolation (step M2 in FIG. 14).

  If it is determined that data satisfying the above conditions cannot be obtained by sending the data described in the history identification information, the corresponding history information is transmitted (step M3 in FIG. 14), and the process ends. .

  On the contrary, if the data described in the history identification information can be sent, such data is created and sent to the service provider 40 as history information (step M4 in FIG. 14). Thereafter, the user terminal 10 waits for a service response (FIG. 14: step M5).

  On the other hand, the similarity calculation unit 43a of the service provider 40 calculates the similarity between the history information transferred from the user terminal 10 and the history information registered in advance in Step N1 (Step N3 in FIG. 14). Then, it is determined whether or not the calculated similarity satisfies the condition described in the similarity determination condition (step N4 in FIG. 14), and if satisfied, the service provider 40 uses the service to the user terminal 10. (Step N5 in FIG. 14) and if not satisfied, the service provider 40 denies the user terminal 10 to use the service (step N6 in FIG. 14), thereby the above-described authentication system for the user terminal 10 The authentication operation of is completed.

  Here, in the sixth embodiment, each operation content of the constituent parts is configured to be programmed for each invention and executed by a computer as in the following “authentication request program” and “terminal authentication program”. Also good.

(Effect of Example)
Since the sixth embodiment is configured and functions as described above, it is possible to perform authentication for providing services such as SNS only to terminals having common history information (experience) that can be determined from sensor outputs.

  According to the present invention, the present invention can be effectively applied to authentication for a service requiring high security for a user terminal such as a portable terminal. For example, the present invention can be applied to applications such as terminal authentication for music distribution services, moving image distribution services, and broadcast services for mobile terminals. Moreover, it is applicable also to uses, such as terminal authentication, such as a banking service using a form terminal, a credit service, and an electronic ticket purchase service.

It is a block diagram which shows 1st Example of this invention. It is a flowchart which shows the update operation | movement of the history hash in 1st Example disclosed in FIG. It is a flowchart which shows the authentication operation | movement in 1st Example disclosed in FIG. It is a block diagram which shows 2nd Example of this invention. It is a flowchart which shows the authentication operation | movement in 2nd Example disclosed in FIG. It is a block diagram which shows 3rd Example of this invention. It is a flowchart which shows the authentication operation | movement in 3rd Example disclosed in FIG. It is a block diagram which shows 4th Example of this invention. It is a flowchart which shows the authentication operation | movement in 4th Example disclosed in FIG. It is a block diagram which shows 5th Example of this invention. It is a graph which shows the example of the log | history identification information of the portable terminal in 5th Example disclosed in FIG. It is a flowchart which shows the authentication operation | movement in 5th Example disclosed in FIG. It is a block diagram which shows 6th Example of this invention. It is a flowchart which shows the authentication operation | movement in 6th Example disclosed in FIG. It is a figure for demonstrating the 1st Embodiment of this invention. It is a figure for demonstrating the 2nd Embodiment of this invention.

Explanation of symbols

10 User terminal (mobile terminal)
DESCRIPTION OF SYMBOLS 11 Terminal side control part 12 Terminal side memory | storage part 12a Terminal identification number 12b, 32b History hash 12e History identification information 12f History information 16 History update part (history update means)
13, 33 Conversion unit (authentication key generation means)
13a History Hash Calculation Unit 13b Similarity Calculation Unit 17 Unauthorized Opening Detection Unit 18 Erasing Circuit 19 Service Receiving Unit 21 Base Station 22 Exchange Control Station 23 Internet 30 Communication Management Center (Authentication Server)
31 Server-side control unit 32 Server-side storage unit 36 History update information receiving unit (history update information receiving means)
40 service provider 42 storage unit 42a terminal identification number 42e history identification information 42f history information 43 history hash calculation unit 43a similarity calculation unit 46 history update information reception unit (history update unit)
49 Authentication Judgment Unit

Claims (31)

  Verifies the commonality between specific history information among the history information held by itself and history information specified by history specification information that specifies history information corresponding to the specific history information among history information held by the terminal And an authentication system for authenticating that the terminal is a legitimate terminal when commonality is recognized.   The authentication means includes a self-history hash generated by performing a hash operation based on specific history information corresponding to a service requested from the terminal, and a hash operation based on the history information specified by the history designation information. 2. The authentication system according to claim 1, wherein a history hash of the terminal generated by performing the verification is collated, and if the history hash matches, the terminal is allowed to use the service.   The authentication unit calculates a similarity between the specific history information of the user corresponding to the service requested from the terminal and the history information specified by the history specifying information, and has a certain degree of similarity between the history information. 2. The authentication system according to claim 1, wherein the terminal is allowed to use the service. The first terminal has the authentication means, and means for receiving a service request from the second terminal and transmitting the history designation information corresponding to the service to the second terminal,
The second terminal has a selection means for selecting the history information specified by the history specification information from the history information held, and a history hash generation for generating a history hash by performing a hash operation based on the selected history information The authentication system according to claim 1, further comprising: means; and means for transmitting the history hash to the first terminal. The server has the authentication means, and means for receiving a request for service from the terminal and transmitting the history designation information corresponding to the service to the terminal,
The terminal is a selection unit that selects history information specified by the history specification information from the history information held, a history hash generation unit that performs a hash operation based on the selected history information, and generates a history hash, The authentication system according to claim 1, further comprising means for transmitting a history hash to the server. The first terminal has the authentication means, and means for receiving a service request from the second terminal and transmitting the history designation information corresponding to the service to the second terminal,
The second terminal has selection means for selecting history information designated by the history designation information from the history information held, and transmission means for transmitting the selected history information to the first terminal. The authentication system according to claim 1 or 3. The server has the authentication means, and means for receiving a request for service from the terminal and transmitting the history designation information corresponding to the service to the terminal,
2. The terminal according to claim 1, further comprising: selection means for selecting history information designated by the history designation information from history information held therein; and transmission means for transmitting the selected history information to a server. Item 4. The authentication system according to item 3.   8. The authentication system according to any one of claims 1 to 7, wherein the history information held is information about a service or information obtained by a sensor.   The authentication system according to any one of claims 1 to 8, wherein the history designation information includes at least one of an identifier for identifying a history, a target history period, and a history information creator. .   10. The authentication system according to claim 1, wherein the service is content management, a VPN (Virtual Private Network) probability, and a service managed by a server. 11.   Verifies the commonality between specific history information among the history information held by itself and history information specified by history specification information that specifies history information corresponding to the specific history information among history information held by the terminal And a terminal having authentication means for authenticating that the terminal is a valid terminal when the commonality is recognized.   The authentication means includes a self-history hash generated by performing a hash operation based on specific history information corresponding to a service requested from the terminal, and a hash operation based on the history information specified by the history designation information. The terminal according to claim 11, wherein the terminal is allowed to use the service if the history hashes are matched with a history hash of the terminal generated by performing the check.   The authentication unit calculates a similarity between the specific history information of the user corresponding to the service requested from the terminal and the history information specified by the history specifying information, and has a certain degree of similarity between the history information. The terminal according to claim 1, wherein the terminal is allowed to use the service. A selection means for selecting history information designated by history designation information for designating history information necessary for service authentication from history information held by the terminal;
A history hash generation means for performing a hash operation based on the selected history information and generating a history hash of the terminal;
And a transmission means for transmitting the history hash. A selection means for selecting history information designated by history designation information for designating history information necessary for service authentication from history information held by the terminal;
A terminal comprising: transmitting means for transmitting the selected history information.   Verifies the commonality between specific history information among the history information held by itself and history information specified by history specification information that specifies history information corresponding to the specific history information among history information held by the terminal And a server having authentication means for authenticating that the terminal is a valid terminal when commonality is recognized.   The authentication means includes a self-history hash generated by performing a hash operation based on specific history information corresponding to a service requested from the terminal, and a hash operation based on the history information specified by the history designation information. The server according to claim 16, wherein the server is allowed to use the service if the history hashes match with a history hash of the terminal generated by performing the check.   The authentication unit calculates a similarity between the specific history information of the user corresponding to the service requested from the terminal and the history information specified by the history specifying information, and has a certain degree of similarity between the history information. The server according to claim 16, wherein the server is allowed to use the service.   Verifies the commonality between specific history information among the history information held by itself and history information specified by history specification information that specifies history information corresponding to the specific history information among history information held by the terminal An authentication method comprising: an authentication process for authenticating that the terminal is a valid terminal when commonality is recognized.   The authentication processing is performed based on the own history hash generated by performing the hash operation based on the specific history information corresponding to the service requested from the terminal, and the history information specified by the history designation information. The authentication method according to claim 19, wherein a history hash of the terminal generated by performing the verification is collated, and if the history hash matches, the terminal is allowed to use the service.   The authentication process calculates the degree of similarity between the specific history information of the user corresponding to the service requested from the terminal and the history information specified by the history specifying information, and has a certain degree of similarity between the history information 20. The authentication method according to claim 19, wherein the terminal is allowed to use the service. A first terminal receives a request for a service from a second terminal and transmits the history designation information corresponding to the service to the second terminal;
The second terminal selects history information designated by the history designation information from the history information held, performs a hash operation based on the selected history information, generates a history hash of the terminal, To the first terminal,
21. The authentication method according to claim 19 or 20, wherein the first terminal performs the authentication process. A server receives a request for a service from a terminal and sends the history designation information corresponding to the service to the terminal;
The terminal selects history information designated by the history designation information from the history information held, generates a hash by performing a hash operation based on the selected history information, and transmits the history hash to the server And
21. The authentication method according to claim 19, wherein the server performs the authentication process. A first terminal receives a request for a service from a second terminal and transmits the history designation information corresponding to the service to the second terminal;
The second terminal selects history information designated by the history designation information from the history information held, and transmits the selected history information to the first terminal,
The authentication method according to claim 19 or 21, wherein the first terminal performs the authentication process. The server receives a request for service from the terminal and transmits the history designation information corresponding to the service to the terminal,
The terminal selects history information designated by the history designation information from the history information held, and transmits the selected history information to the server,
The authentication method according to claim 19 or 21, wherein the server performs the authentication process.   The authentication method according to any one of claims 19 to 25, wherein the history information to be held is information about a service or information obtained by a sensor.   The authentication method according to any one of claims 19 to 26, wherein the history designation information includes at least one of an identifier for identifying a history, a target history period, and a history information creator. .   The authentication method according to any one of claims 19 to 27, wherein the service is content sharing, VPN (Virtual Private Network) probability, and a service managed by a server.   Verifies the commonality between specific history information among the history information held by itself and history information specified by history specification information that specifies history information corresponding to the specific history information among history information held by the terminal When the commonality is recognized, the information processing apparatus executes an authentication process for authenticating that the terminal is a valid terminal.   The authentication processing is performed based on the own history hash generated by performing the hash operation based on the specific history information corresponding to the service requested from the terminal, and the history information specified by the history designation information. 30. The program according to claim 29, wherein the history hash of the terminal generated by performing the verification is collated, and if the history hash matches, the terminal is allowed to use the service.   The authentication process calculates the degree of similarity between the specific history information of the user corresponding to the service requested from the terminal and the history information specified by the history specifying information, and has a certain degree of similarity between the history information 30. The program according to claim 29, wherein the terminal is allowed to use the service.

Images