JP2009017516A - Authentication system, and authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system capable of remotely restricting use of a computer that deviates from a predetermined application approved beforehand. <P>SOLUTION: The authentication system 1 includes: a portable terminal 10 including a GPS function capable of acquiring its own positional information; a PC 30 which is connected with the portable terminal 10 and can be put into usable state by the input of a use authentication permission key from the portable terminal 10; and an authentication server 40 where use application information including moving route information of a user of the PC 30 is registered. When the use authentication permission request of the PC 30 is received from the portable terminal 10, the authentication server 40 collates the positional information of the portable terminal 10 with the registered moving route information and outputs the use authentication permission key to the portable terminal on the basis of the result of the collation. The portable terminal 10 outputs to the PC 30 the use authentication permission key acquired from the authentication server 40. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an authentication system and an authentication method, and more particularly to an authentication system and an authentication method for remotely managing the use of a computer using a mobile terminal.

Conventionally, a technique for remotely managing the use of a portable terminal or the like is known. For example, Patent Document 1 discloses a mobile communication network system capable of restricting the use of a mobile terminal at an arbitrary date and time in a facility where it is desired to restrict the use of the mobile terminal such as a school or a public facility. This mobile communication network system includes a service control node that performs use restriction control of a mobile terminal, and a location register node that manages location information and subscriber data of the mobile terminal, and stores specific information such as a telephone number of the mobile terminal. Registered in the register node and stored in the service control node is the area information that enables the use restriction control of the mobile terminal and the date and time to restrict the use of the mobile terminal, and the unique information is registered in the location register node When the mobile terminal is located in an area where the use of the mobile terminal is restricted and the stored use restriction date and time match the actual date and time, the service control node cannot use the mobile terminal. To control.
JP 2005-72630 A

  According to the system described above, the use of the mobile terminal can be restricted at any date and time in a facility where the use of the mobile terminal is desired to be restricted. On the other hand, from the viewpoint of enhancing information security, for example, when a company personal computer is used on a business trip or the like, there is a social need to limit use for purposes other than work. However, in the above-described system, it has not been possible to restrict the use depending on whether or not the system is used outside of the predetermined use.

  The present invention has been made to solve the above-mentioned problems, and provides an authentication system and an authentication method capable of remotely restricting the use of a computer that deviates from a predetermined use recognized in advance. Objective.

  An authentication system according to the present invention includes a mobile terminal capable of acquiring position information of the own device, a computer connected to the mobile terminal, and in a usable state when a use authentication permission key is input from the mobile terminal. An authentication server that is configured to be communicable with a mobile terminal and that registers use application information including travel route information of a computer user, and the authentication server includes location authentication information from the mobile terminal. Is received, the location information of the mobile device and the registered travel route information are collated, and the use authentication permission information received from the mobile device is collated with the registered use application information. Based on the result, the use authentication permission key is output to the mobile terminal, and when the mobile terminal acquires the use authentication permission key from the authentication server, the use authentication permission key is And outputs to the computer.

  In addition, the authentication method according to the present invention authenticates use application information including travel route information of a computer user who is connected to a mobile terminal and enters a usable state when a use authentication permission key is input from the mobile terminal. Registering at the registration step of registering in the server, the location information acquisition step of acquiring the location information by the mobile terminal, and the location information and registration step of the mobile terminal when receiving the use authorization permission information including the location information from the mobile terminal And the use authentication permission information received from the mobile terminal and the use application information registered in the registration step are checked, and the use authentication permission key is stored in the mobile terminal based on the check result. The collation step to output, and the authorization key output step to output the use authentication authorization key output in the collation step to the computer Characterized in that it comprises a.

  According to the authentication system or the authentication method of the present invention, when the computer use authentication permission information is received from the mobile terminal, the travel route information applied by the user and registered in the authentication server and the current position of the mobile terminal The information is collated, and based on the collation result, a use authentication permission key that enables the use of the computer is issued. Therefore, for example, in a situation where a computer is used during a business trip, if the computer is used on a travel route that has been applied (that is, a planned business trip route), it is assumed that the computer is used for work and the use of the computer is When a computer is used in a location that is permitted and deviated from the requested travel route, it is possible to presume that the computer is not used for work and prohibit the use. Therefore, it is possible to remotely limit the use of a computer that deviates from a predetermined use that is recognized in advance.

  The authentication server preferably stops outputting the use authentication permission key when the position information of the mobile terminal is away from the registered travel route by a predetermined range or more.

  In this case, the issuance of the use authorization permission key is stopped when it is away from the requested travel route by a predetermined range or more, so it is possible to flexibly operate usage restrictions at locations outside the requested travel route. It becomes.

  In the authentication system according to the present invention, it is preferable that the mobile terminal transmits use application information to the authentication server.

  In this way, it is possible to improve the user's convenience because the prior application for use and the issuance of the use authentication permission information when using the computer can be performed with one portable terminal.

  In the authentication system according to the present invention, it is preferable that the authentication server requests the administrator to input the use approval information when the use application information is received.

  In this way, when a user makes an application for use of a computer, confirmation and approval by a computer administrator can be reliably performed.

  In the authentication system according to the present invention, it is preferable that the authentication server stores the administrator's use approval information, and further outputs the use authentication permission key to the portable terminal in consideration of the use approval information.

  In this way, it becomes possible to restrict the use of the computer according to the approval result of the computer administrator.

  According to the present invention, when the computer use authentication permission information is received from the portable terminal, the position information of the portable terminal is collated with the registered movement route information, and the use authentication permission key is determined based on the collation result. Since it is configured to output, it is possible to remotely limit the use of a computer that deviates from a predetermined use that has been recognized in advance.

  DESCRIPTION OF EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings. In addition, in each figure, the same code | symbol is attached | subjected to the same element and the overlapping description is abbreviate | omitted. Here, a case where a company employee uses a mobile personal computer during a business trip will be described as an example.

  First, the configuration of the authentication system 1 according to the embodiment will be described with reference to FIG. FIG. 1 is a diagram showing a schematic configuration of the authentication system 1. The authentication system 1 shown in FIG. 1 includes a portable terminal 10 carried by a company employee (hereinafter also referred to as “user”) and a computer manager (hereinafter referred to as “manager”) who is the superior of the employee. Mobile terminal 20, a personal computer (hereinafter referred to as “PC”) 30 connected to mobile terminal 10 via a communication cable 19 such as a USB (Universal Serial Bus) cable, a mobile communication network and an Internet network. The authentication server 40 is configured to be connectable to the mobile terminal 10 and the mobile terminal 20 via the mobile terminal 10 and remotely manages the usage state of the PC 30 via the mobile terminal 10.

  The mobile terminal 10 is a mobile terminal having a function of acquiring its own position information by, for example, GPS positioning using GPS (Global Positioning System) or cell positioning using base information of mobile phone carrier radio waves.

  As described above, the mobile terminal 10 is configured to be connectable to the authentication server 40 via a mobile communication network or the Internet network. For example, when the user wants to take the PC 30 out of the office on a business trip and use it, the user transmits the use application information (authentication information) to the authentication server 40 in advance using the mobile terminal 10 and registers it. Here, as usage application information, for example, numbering authentication information (telephone number) of the mobile terminal 10, user information such as user face information, usage time information, unique information of the take-out PC (PC 30), PC manufacturing, etc. Number QR code (two-dimensional code), business trip route (travel route), and the like.

  Further, when the user wants to use the PC 30 during a business trip, the mobile terminal 10 sends use authentication permission information requesting the authentication server 40 to issue a use authentication permission key, which is an electronic key. When the authentication of the use of the PC 30 is permitted by the authentication server 40, the mobile terminal 10 obtains the use authentication permission key from the authentication server 40 and outputs the use authentication permission key to the PC 30, thereby making the PC 30 usable. To do.

  Here, the PC 30 is connected to the mobile terminal 10 via the communication cable 19, and is set to be usable when the use authentication permission key is input from the mobile terminal 10.

  The mobile terminal 10 has an operating system (mobile device OS), and a browser function, a viewer function, a JAM (Java (registered trademark) Application Manager) and other functions operate on the mobile device OS. Further, the mobile terminal 10 has a normal telephone function and a mail function.

  As described above, the portable terminal 20 is also configured to be connectable to the authentication server 40 via a mobile communication network, the Internet network, or the like. In addition to the function of the mobile terminal 10, the mobile terminal 20 has an approval function for confirming and approving use application information applied by the user. When the use application information transmitted from the portable terminal 10 is registered in the authentication server 40, the fact is notified from the authentication server 40 to the portable terminal 20. At that time, the administrator uses the mobile terminal 20 to transmit information about whether or not to approve the use of the PC 30 (use approval information) to the authentication server 40 and register it.

  The authentication server 40 registers and stores use application information including user business trip route information input from the mobile terminal 10, administrator use approval information input from the mobile terminal 20, and the like. Further, as described above, when the use application information is registered from the mobile terminal 10, the authentication server 40 outputs information indicating that the mobile terminal 20 is requested to input use approval information.

  Further, when the authentication server 40 receives the use authentication permission information of the PC 30 from the mobile terminal 10, the authentication server 40 collates the location information of the mobile terminal 10 with the registered business trip route information and is included in the use authentication permission information. When the authentication information and the registered use application information (authentication information) are collated, the position of the mobile terminal 10 is not off the business trip route, the authentication information matches, and the administrator's approval is obtained. In addition, a use authentication permission key that enables use of the PC 30 is output to the mobile terminal 10. On the other hand, if any of the conditions is not satisfied, the authentication server 40 stops outputting the use authentication permission key.

  FIG. 2 is a block diagram illustrating a schematic configuration of the mobile terminal 10. Note that the configuration shown in FIG. 2 is simplified to explain the present invention, and includes components that are mounted on a normal mobile terminal.

  The mobile terminal 10 includes a control unit 11, a communication unit 12, a positioning unit 13, a use application unit 14, an authentication permission request unit 15, a PC connection unit 16, a display unit 17, and the like.

  The control unit 11 includes a CPU, a ROM, a RAM, and the like, and controls the entire apparatus according to various programs stored in the ROM. The communication unit 12 communicates with the authentication server 40 via a mobile communication network or the Internet network. The positioning unit 13 acquires the position information of the own device by GPS positioning, cell positioning, or the like. The acquired position information is transmitted to the authentication server 40 by the communication unit 12 together with the use authentication permission information.

  The use application unit 14 transmits use application information to the authentication server 40 via the communication unit 12, and the authentication permission request unit 15 transmits use authentication permission information to the authentication server 40 via the communication unit 12. The PC connection unit 16 provides a connection interface with the PC 30 and outputs the use authentication permission key acquired by the communication unit 12 to the PC 30. The display unit 17 includes a liquid crystal display and displays characters and images.

  FIG. 3 is a block diagram illustrating a schematic configuration of the authentication server 40. The authentication server 40 includes a control unit 41, a communication unit 42, a storage unit 43, an approval information input request unit 44, a verification unit 45, an authentication permission unit 46, and the like.

  The control unit 41 includes a CPU, a ROM, a RAM, and the like, and integrally controls the entire apparatus by executing an OS (Operating system), a server program, a program that realizes an authentication permission function, and the like. The communication unit 42 communicates with the mobile terminal 10 and the mobile terminal 20 via a mobile communication network or the Internet network. The storage unit 43 stores use application information from the mobile terminal 10 received by the communication unit 42, use approval information from the mobile terminal 20, and the like.

  When the use application information from the mobile terminal 10 is input, the approval information input request unit 44 outputs transmission information for requesting the administrator to input the use approval information to the communication unit 42. The collation unit 45 collates the location information of the mobile terminal 10 with the business trip route information stored in the storage unit 43 when the use authentication permission information of the PC 30 is received by the communication unit 42, and the use authentication permission information Are compared with the use application information (authentication information) stored in the storage unit 43, and the comparison result is output to the authentication permission unit 46.

  The authentication permission unit 46 issues / stops the use authentication permission key based on the collation result input from the collation unit 45. In other words, the authentication permission unit 46 uses the use authentication permission to enable the PC 30 when the position of the mobile terminal 10 is not deviated from the business trip route, the authentication information matches, and the administrator's approval is obtained. Issue a key. On the other hand, if any of the conditions is not satisfied, the authentication server 40 stops issuing the use authentication permission key.

  Next, the operation (authentication method) of the authentication system 1 will be described with reference to FIGS. Here, FIG. 4 is a sequence diagram of the pre-registration application process, and FIG. 5 is a sequence diagram of the use authentication permission process when the PC 30 is used. FIG. 6 is a diagram illustrating an example of the usage authentication DB table stored in the storage unit 43 of the authentication server 40. Moreover, FIGS. 7-14 is a figure which shows the example of a liquid crystal display of the portable terminal 10 in each process.

  First, a pre-registration application process that is performed before the user makes a business trip will be described with reference to FIGS. 4 and 6 to 11 together.

  First, from the mobile terminal 10, user application information such as the numbering authentication information of the mobile terminal 10, user information such as user's face information, usage time information, PC30 specific information, QR code of PC manufacturing number, and business trip route, etc. Information is transmitted to the authentication server 40 (steps S100 and S102).

  Here, the application procedure in the pre-registration application process will be described with reference to FIGS. Each of FIGS. 7 to 10 is a diagram illustrating a display example of the liquid crystal display of the mobile terminal 10 in the pre-registration application process. More specifically, FIG. 7 is a diagram illustrating a transition state of the use location setting screen when using a train, and FIG. 8 is a diagram illustrating a transition state of the use location setting screen when using a car. FIG. 9 is a diagram illustrating a transition state of a use location setting screen when using RF-ID (Radio Frequency Identification). FIG. 10 shows transition states of the user face information setting screen and the PC 30 unique information setting screen.

  When using a train on a business trip, the user operates the mobile terminal 10 and inputs the user's “ID” and “password” from the ID / password input screen D100 as shown in FIG. Launches the setter selection screen D101. Next, the user selects the item “user setting” on the setter selection screen D101, starts up the setting item selection screen D102, selects the item “use place setting” on the screen, and selects the route. The designation screen D103 is displayed. Subsequently, the user selects the item “designate route during movement” on the route designation screen D103, launches the movement means selection screen D104, selects the item “move train” on the screen, and sets the route. A screen D105 is displayed. Then, the user selects the item “route setting automatic input” on the route setting screen D105 to start up the train name input screen D106, on which “train name”, “ride section”, “departure time” The input application information is transmitted to the authentication server 40 by selecting the “apply” switch after inputting “terminal” and “reason for application”. When transmission of the use application information ends, an end message screen D107 is displayed, and the business trip route application ends.

  When a car is used on a business trip, the moving means selection screen D104 shown in FIG. 8 is launched according to the above-described procedure, and the item “car movement” is selected on the screen to display the route setting screen D105. Let Next, the user selects the item “automatic input of route setting” on the route setting screen D105, starts up the car navigation designation screen D110, and displays “car navigation designation 1”, “car navigation designation 2” or “car navigation designation” on the screen. After selecting “3” alternatively, the “use time setting” switch is selected to display the use time setting screen D111. Then, the user inputs “use”, “use time”, “terminal”, “application reason” on the use time setting screen D111, and then selects the “apply” switch to input the use application information that has been entered into the authentication server 40. Send to. When transmission of the use application information ends, an end message screen D107 is displayed, and the business trip route application ends.

  Further, when using RF-ID, the route designation screen D103 shown in FIG. 9 is launched according to the above-described procedure, and the item “pinpoint designation within branch, hotel etc.” is selected on the screen, The use place designation screen D120 is displayed. Next, the user selects the item “Branch Designation” on the use location designation screen D120, launches the positioning method setting screen D121, and sets the item “Wireless LAN, RF-ID setting” on the screen. The selected branch name etc. input screen D122 is displayed. Subsequently, the user selects the item “enter branch name etc.” on the branch name etc. selection screen D122 to start up the branch name input screen D123, on which “Osaka branch”, “Nagoya branch” or “ After selectively selecting “Hakata Branch”, the “Use time setting” switch is selected to display the use time setting screen D111. Then, the user inputs “use”, “use time”, “terminal”, “application reason” on the use time setting screen D111, and then selects the “apply” switch to input the use application information that has been entered into the authentication server 40. Send to. When transmission of the use application information ends, an end message screen D107 is displayed, and the business trip route application ends.

  On the other hand, when applying for user information, the user operates the mobile terminal 10 and inputs the user's “ID” and “password” from the ID / password input screen D100 as shown in FIG. Then, the setting person selection screen D101 is launched. Next, the user selects the item “user setting” on the setting user selection screen D101, launches the setting item selection screen D102, selects the item “user information setting” on the screen, A setting information selection screen D130 is displayed. Subsequently, the user selects the item “face photo setting” on the setting information selection screen D130, starts up the face photo setting screen D131, inputs the face photo information to be applied on the screen, and then performs “registration”. The face photo information input by selecting the switch is transmitted to the authentication server 40. When transmission of usage application information ends, an end message screen is displayed and user information application ends.

  Further, when applying for take-out PC information, the item “user setting” is selected on the setter selection screen D101, the setting item selection screen D102 is launched, and the item “use terminal setting” is set on the screen. The setting information selection screen D132 is displayed by selection. Subsequently, the user selects the item “MAC address” on the setting information selection screen D132, starts up the MAC address setting screen D133, and inputs “user”, “terminal”, and “MAC address” on the screen. After that, the selected PC information is sent to the authentication server 40 by selecting the “Setting” switch. When the use application information has been transmitted, an end message screen is displayed and the take-out PC information application is completed.

  Returning to FIG. The authentication server 40 that has received the use application information registers and stores the use application information in the storage unit 43. Further, the authentication server 40 notifies the portable terminal 20 carried by the administrator whether to approve the use of the PC 30, that is, to request the administrator to input the use approval information (step). S104, S106).

  The portable terminal 20 returns the use approval information to the authentication server 40 by the operation of the administrator who has received the use approval request (steps S108 and S110).

  Here, the procedure for approving the use application information will be described with reference to FIG. FIG. 11 is a diagram showing a display example of the liquid crystal display of the mobile terminal 20 in use approval registration, and more specifically, a diagram showing a transition state of the use approval registration screen.

  When approving the use application, the administrator operates the portable terminal 20 and inputs the administrator's “ID” and “password” from the ID / password input screen D100 as shown in FIG. Launches the setter selection screen D101. Next, the administrator selects the item “upper manager setting” on the setter selection screen D101, launches the approval item selection screen D140, selects the item “use application list” on the screen, and applies for the application. A list screen D141 is displayed. Subsequently, the administrator selects the date / user of the application information to be confirmed / approved on the application list screen D141, launches the usage application information screen D142, and displays the “user” displayed on the screen. Check “boarding section”, “transportation”, “departure time”, “terminal”, “reason for application”, select the “Approve” switch to approve the contents, and select the “deny” switch to disapprove the contents. select. Thereafter, the approval item selection screen D140 is launched again, and the item “error setting” is selected on the screen to display the error setting screen D143. Next, the administrator checks the “user”, “route deviation tolerance” and “time deviation tolerance” displayed on the error setting screen, and selects the “approval” switch to approve the contents. When the content is not approved, information indicating that the use application is approved or rejected, that is, the use approval information is transmitted to the authentication server 40 by selecting the “deny” switch. When the transmission of the use approval information is finished, an end message screen D144 is displayed and the use approval is finished.

  Returning to FIG. Upon receiving the use approval information from the portable terminal 20, the authentication server 40 stores and registers the use approval information in the storage unit 43 (step S112). Here, FIG. 6 shows an example of a use authentication DB table that stores use application information and use approval information. As shown in FIG. 6, the use authentication DB table includes “authentication information” for each authentication item such as “user”, “use PC”, “use place”, “use time”, “use mobile phone”, and “route information”. (Authentication Technology) ”“ User Registration Information ”“ Manager Registration Information ”and“ Approval Flag ”are managed and stored. The “approval flag” is a flag indicating whether or not the use application has been approved. This completes a series of pre-registration application processes.

  Next, the use authentication permission process when using the PC 30 will be described with reference to FIGS.

  When it is desired to use the PC 30 during a business trip, a usage authentication permission request is issued from the portable terminal 10 to the authentication server 40 for requesting issuance of a usage authentication permission key. More specifically, the mobile terminal 10 is used for authentication authorization, and is used for authentication information of the mobile terminal 10, user information such as user's face information, usage time information, unique information of the PC 30, and the PC manufacturing number. Authentication permission information such as a QR code and a business trip route is transmitted to the authentication server 40 (steps S200 and S202).

  Here, with reference to FIG. 12, a procedure for transmitting a use authentication permission information request will be described. FIG. 12 is a diagram illustrating a display example of the liquid crystal display of the mobile terminal 10 in the use authentication permission request, and more specifically, a transition state of the use authentication permission request screen.

  If the user wants to use the PC 30 during a business trip, the user operates the mobile terminal 10 and inputs the user's “ID” and “password” from the ID / password input screen D100 as shown in FIG. Then, the setting person selection screen D101 is started up. Next, the user selects the item “user setting” on the setting user selection screen D101, launches the setting item selection screen D102, selects the item “setting when used” on the screen, and performs authentication. The permission request screen D150 is displayed. Subsequently, on the authentication permission request screen D150, the user selects the requesting date / time and the user, selects the positioning method, and then selects the “confirm” switch. Is sent to the authentication server 40. When transmission of the use authentication permission request is completed, an end message screen is displayed, and a series of processing ends.

  Returning to FIG. 5 and continuing the description, when the authentication server 40 receives a use authentication permission request for the PC 30 from the mobile terminal 10, the location information of the mobile terminal 10 and the business trip route information registered in the use authentication DB table. And the authentication information attached to the use authentication permission request and the use application information (authentication information) registered in the use authentication DB table are checked, and the position of the mobile terminal 10 is a predetermined distance from the business trip route. Use authorization permission key for enabling the PC 30 when it is not deviated (for example, 5 km) or more, the authentication information is the same, and the administrator's approval is obtained (that is, when the approval flag is set). Is output to the mobile terminal 10. On the other hand, if any of the conditions is not satisfied, the authentication server 40 stops outputting the use authentication permission key (steps S204 and S206).

  The mobile terminal 10 obtains the use authentication permission key from the authentication server 40 and outputs the use authentication permission key to the PC 30 to make the PC 30 usable (step S208). More specifically, the PC 30 can be activated (logged on) by inputting a use authentication permission key. The use authentication permission key is stored in a directory in the PC 30 registry that cannot be accessed by the user. The use authentication permission key has a predetermined valid time (for example, 30 minutes). Therefore, in order to use the PC 30 continuously, it is necessary to obtain an authentication permission every time the effective time elapses.

  When a predetermined time (for example, 30 minutes) has elapsed from the time when the use authentication permission key is acquired, the above-described steps S200 to S208 are repeated again. Here, since the processing content of each of steps S210 to S216 has already been described, redundant description is omitted here. As described above, by repeatedly executing the above-described steps S200 to S208 every predetermined time, the PC 30 can be continuously used as long as the above-described conditions are satisfied. On the other hand, when any of the above conditions is no longer satisfied, the use authentication permission key issuance is stopped and the use of the PC 30 is restricted.

  Note that, for example, when the user wants to change the registered usage time of the PC 30 due to a delay in the transportation system used, the user can apply for registration information change from the portable terminal 10 to the authentication server 40.

  Here, the application procedure of the registration information change application will be described with reference to FIG. FIG. 13 is a diagram showing a display example of the liquid crystal display of the mobile terminal 10 in the registration information change application, and more specifically, a diagram showing a transition state of the registration information change application screen.

  When it is desired to change the registered information such as the usage time that has already been registered, the user operates the mobile terminal 10 and, as shown in FIG. 13, the user's “ID” is displayed from the ID / password input screen D100. “Password” is entered to launch the setter selection screen D101. Next, the user selects the item “user setting” on the setter selection screen D101, launches the setting item selection screen D102, and selects the item “application for extension of use / others” on the screen. The application list screen D160 is displayed. Subsequently, the administrator selects the registration information to be changed on the application list screen D141 and then selects the “confirm” switch to start the usage time setting screen D161. On the screen, the “user name” is displayed. The registration information change application is transmitted to the authentication server 40 by selecting the “request” switch after entering “section”, “moving means”, “confirmation time”, “situation”, and “extension time”. When the transmission of the registration information change application ends, an end message screen D162 is displayed, and the process ends.

  When the registration information change application is transmitted, the mobile terminal 20 is notified to that effect. Upon receiving this notification, the administrator confirms the change contents of the registration information and returns to the authentication server 40 whether or not to approve the change contents.

  Here, the registration information change application approval procedure will be described with reference to FIG. FIG. 14 is a diagram illustrating a display example of the liquid crystal display of the mobile terminal 20 in the change approval registration for the registration information change application, and more specifically, a diagram illustrating a transition state of the change approval registration screen.

  When approving the registration information change application, the administrator operates the portable terminal 20 and inputs the administrator's “ID” and “password” from the ID / password input screen D100 as shown in FIG. Then, the setting person selection screen D101 is launched. Next, the administrator selects the item “upper manager setting” on the setter selection screen D101, launches the approval item selection screen D140, selects the item “confirm user status” on the screen, The application list screen D170 is displayed. Subsequently, the administrator selects the registration change information to be confirmed / approved on the application list screen D170 by the date / time and the user, launches the change application information screen D171, and displays the “user” displayed on the screen. ”“ Section ”“ Transportation ”“ Confirmation time ”“ Kyogyo ”is confirmed by selecting the“ Approve ”switch to approve the contents, and by selecting the“ Deny ”switch if not approving the contents. Information indicating approval or denial of the registration information change application, that is, change approval information is transmitted to the authentication server 40. When the transmission of the use approval information ends, an end message screen D172 is displayed and the change approval ends.

  Returning to FIG. The authentication system 1 has a function of forcibly shutting down the PC 30 by the administrator when, for example, the usable route is deviated or when a predetermined valid time (for example, 30 minutes) has passed. When the forced shutdown of the PC 30 is executed, a forced shutdown signal is transmitted from the portable terminal 20 to the authentication server 40 (steps S210 and S212).

  When the forced shutdown signal is received, the authentication server 40 forcibly shuts down the PC 30 by sending a PC disconnection control key to the mobile terminal 10 (steps S214 and S216). Instead of forcibly shutting down, the use of the PC 30 may be prohibited by stopping the issuance of the use authentication permission key when the next use authentication permission request is made.

  According to the present embodiment, when a use authentication permission request for the PC 30 is received from the mobile terminal 10, the business trip route information registered in the authentication server 40 and the location information of the mobile terminal 10 are collated, and the collation result is Based on this, a use authentication permission key that enables use of the PC 30 is issued. Therefore, in a situation where the PC 30 is used during a business trip, if the PC 30 is used on the requested business trip route, it is presumed to be used for work, and the use of the PC 30 is permitted. When the PC 30 is used in a place that is out of the range, it is presumed that it is not used for work, and the use can be prohibited. Therefore, it is possible to remotely limit the use of the PC 30 that deviates from a predetermined use that is recognized in advance.

  According to the present embodiment, since the issuance of the use authentication permission key is stopped when a predetermined distance or more is deviated from the registered business trip route, the use restriction of the PC 30 at a place deviating from the requested business trip route is restricted. It becomes possible to operate flexibly. In addition, according to the present embodiment, since the use of the PC 30 can be limited by the user, the use route, and the use time, the risk of information security when the PC 30 is stolen or lost can be reduced. Is possible.

  According to the present embodiment, since it is possible to perform a prior use application and issue a use authentication permission request during a business trip with a single mobile terminal 10, it is possible to improve user convenience. .

  Further, according to the present embodiment, when the use application information is received, the authentication server 40 requests the administrator to input the use approval information. In addition, confirmation and approval by the administrator can be reliably performed.

  Furthermore, according to the present embodiment, since the use authentication permission key is issued according to the use approval information of the administrator, the use restriction of the PC 30 can be performed in consideration of the approval result of the administrator.

  Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments, and various modifications can be made. For example, in the above embodiment, cell positioning, GPS positioning (self-positioning, other-party positioning), and positioning by PF-ID are used as the location information acquisition method of the own device. A positioning method using (registered trademark) or AP (Access Point) information of a wireless LAN may be employed.

  Authentication information used when performing authentication permission is not limited to the information described above. For example, fingerprint information or voiceprint information may be used instead of the user's face information. Also, it is possible to use moving image dynamic authentication that performs authentication based on a specific action (for example, a piece sign is continued for 3 seconds). Furthermore, instead of the QR code of the PC manufacturing number, a PC-specific identification ID such as NIC may be used.

  In the above embodiment, the use (activation) of the PC 30 is restricted when the travel route is deviated. However, the function of the PC 30 may be restricted. For example, the configuration may be such that the USB port is disabled or the printout function is limited by rewriting the registry of the PC 30 temporarily.

  Moreover, in the said embodiment, although the portable terminal 10 and PC30 were connected with the communication cable 19, it replaces with the communication cable 19 and is good also as a structure connected by near field radio | wireless etc. For example, the use authorization permission key may be processed into ToruCa (registered trademark) or FeliCa (registered trademark) related data and the like, and authorization may be performed by holding the mobile terminal 10 over the PC 30.

  Furthermore, it goes without saying that the liquid crystal display on the portable terminal 10 and the portable terminal 20 is not limited to the display example shown in the drawings. Moreover, unless it deviates from the scope of the present invention, the processing unit and the processing procedure can be appropriately changed and implemented. Other modifications can be made without departing from the scope of the present invention.

  The present invention is not limited to the embodiment described above, and can be implemented with various modifications. Although the case where the present invention is applied to a mobile personal computer has been described in the above embodiment, the present invention is not limited to this and can be applied to other mobile devices. In addition, the screen display, the processing unit, and the processing procedure can be changed as appropriate without departing from the scope of the present invention. Other modifications can be made without departing from the scope of the present invention.

It is a figure which shows schematic structure of the authentication system which concerns on embodiment. It is a block diagram which shows schematic structure of the portable terminal which comprises the authentication system which concerns on embodiment. It is a block diagram which shows schematic structure of the authentication server which comprises the authentication system which concerns on embodiment. It is a sequence diagram of a prior registration application process. It is a sequence diagram of the use authentication permission process at the time of computer use. It is a figure which shows an example of the use authentication DB table memorize | stored in the memory | storage part of an authentication server. It is a figure which shows the example of a display of the screen of the portable terminal in a prior registration application. It is a figure which shows the example of a display of the screen of the portable terminal in a prior registration application. It is a figure which shows the example of a display of the screen of the portable terminal in a prior registration application. It is a figure which shows the example of a display of the screen of the portable terminal in a prior registration application. It is a figure which shows the example of a display of the screen of the portable terminal in the approval registration with respect to a prior registration application. It is a figure which shows the example of a display of the screen of the portable terminal in a use authentication permission request | requirement. It is a figure which shows the example of a display of the screen of the portable terminal in a registration information change application. It is a figure which shows the example of a display of the screen of the portable terminal in the approval registration with respect to a registration information change application.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Authentication system 10,20 Portable terminal 11 Control part 12 Communication part 13 Positioning part 14 Use application part 15 Authentication permission request part 16 PC connection part 17 Display part 30 Personal computer 40 Authentication server 41 Control part 42 Communication part 43 Storage part 44 Approval Information input request part 45 Verification part 46 Authentication permission part

Claims (6)

  A mobile terminal capable of acquiring location information of the own device, a computer connected to the mobile terminal, and being enabled by inputting a use authentication permission key from the mobile terminal, and communicable with the mobile terminal And an authentication server in which use application information including movement route information of the user of the computer is registered, and the authentication server receives use authentication permission information including the position information from the portable terminal. When received, it collates the location information of the mobile terminal with the registered travel route information, and collates the use authentication permission information received from the mobile terminal with the registered use application information. And outputting the use authentication permission key to the portable terminal based on the collation result, and the portable terminal sends the use authentication permission key from the authentication server. When the acquired authentication system and outputs an authentication authorization key for said use the computer.   2. The authentication according to claim 1, wherein the authentication server stops outputting the use authentication permission key when the location information of the mobile terminal is away from a registered travel route by a predetermined range or more. system.   The authentication system according to claim 1, wherein the portable terminal transmits the use application information to the authentication server.   4. The authentication system according to claim 3, wherein the authentication server requests the administrator to input use approval information when the use application information is received.   The authentication system according to claim 4, wherein the authentication server stores use approval information of the administrator, and further outputs the use authentication permission key to the mobile terminal in consideration of the use approval information.   A registration step of registering use application information including movement route information of a computer user who is connected to a portable terminal and enters a usable state when a use authentication permission key is input from the portable terminal with the authentication server; The location information acquisition step of acquiring location information by the terminal, and the location information of the mobile terminal and the travel route information registered in the registration step when receiving the use authentication permission information including the location information from the mobile terminal And the use authentication permission information received from the portable terminal and the use application information registered in the registration step are collated, and the use authentication permission key is determined based on the comparison result. Output to the computer, and the use authentication permission key output in the verification step. Authentication method comprising: the authorization key output step of, a.

Images