JP2010079795A - Client authentication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To achieve two-factor user authentication concerning a client authentication system. <P>SOLUTION: A log-in application program is installed in a mobile phone 2. Unique application ID for identifying the installed application program and user ID are stored in a scratch pad region which can be accessed by the application program. When the mobile phone 2 accesses a mobile service, user authentication is performed on the basis of two factors such as the application ID and the password known by the user. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a client authentication system, a server device, a client terminal device, a control method thereof, and a control program thereof.

User authentication is performed to confirm whether the user has access authority. For user authentication, for example, a user ID and a password are used. However, the user ID and the password are easily intercepted because they are communicated each time communication between the client terminal device and the server device is performed. Some use client certificates (Patent Document 1), but some do not support cellular phones.
Japanese Patent Laid-Open No. 11-272614

  An object of the present invention is to perform two-factor authentication relatively easily.

  The present invention relates to a client authentication system including a server device and a client terminal device.

  The server device includes: a login application program / ID transmitting means for transmitting a login application program and an application ID for identifying the login application program (client ID for identifying the client terminal device) to the client terminal device; And the application ID and the authentication password transmitted from the client terminal device in response to the login application program being transmitted from the login application program / ID transmitting means to the client terminal device. A password / application ID storage means is also provided.

  The client terminal device receives a login application program transmitted from the login application program / ID transmission means of the server device, and inputs a first authentication password to input an authentication password. Means, an authentication password transmitting means for transmitting the authentication password input from the first authentication password input means to the server device as the first authentication password, and the login application program / Login application program installation means for installing the login application program transmitted from the ID transmission means, and the login application program / ID transmission means of the server device. Application ID storage means for storing the application ID so that it can be accessed by the login application program, and second authentication for inputting a second authentication password in response to the login application program being activated Password / application for transmitting the second authentication password input from the second password input means, the second authentication password input from the second authentication password input means, and the application ID stored in the application ID storage means to the server device for user authentication ID transmission means is provided.

  The server device includes a first authentication password and application ID pair transmitted by the password / application ID transmission unit of the client terminal device, and a first stored in the password / application ID storage unit. User authentication means for performing user authentication based on the combination of the authentication password and the application ID is further provided.

  According to the present invention, the login application program and the application ID are transmitted from the server device to the client terminal device. Then, the first authentication password is input in the client terminal device, and the input first authentication password is transmitted to the server device. In the server device, the first authentication password and the application ID are stored in association with each other.

  In the client terminal device, a login application program is installed and an application ID is stored. When the login application program is activated in the client terminal device, the second authentication password is input. The input second authentication password and application ID are transmitted from the client terminal device to the server device.

  In the server device, based on the set of the second authentication password and application ID transmitted from the client terminal device, and the set of the first authentication password and application ID stored in the server device. User authentication is performed.

  The first authentication password and the second authentication password (these passwords should be the same password) are known only by the user of the client terminal device, and the application ID is unique to the client terminal device. Is. User authentication using two elements, one element of the first authentication password and the second authentication password known only to the user of the client terminal apparatus, and one element of the application ID unique to the client terminal apparatus Will be able to do.

  Temporary URL data transmitting means for transmitting temporary URL data representing a temporary URL to the client terminal apparatus, temporary password transmitting means for transmitting a first temporary password to a user terminal apparatus different from the client terminal apparatus, A determination means for determining whether or not a request for a web page having a temporary URL represented by the temporary URL data transmitted from the temporary URL data transmission means has been received from the client terminal device, and a web having a temporary URL by the determination means. -Temporary password input image data transmission means for transmitting temporary password input image data to the client terminal device in response to determination that a page request has been made, and a temporary password by the temporary password input image data transmission means The input image data The temporary password receiving means for receiving the second temporary password transmitted from the client terminal device in response to the transmission to the client terminal apparatus, the second temporary password received by the temporary password receiving means, and the temporary password When the first temporary password transmitted by the password transmission means matches, the client terminal receives authentication password input image data representing an authentication password input image for inputting the first authentication password. You may further provide the password input image data transmission means for authentication transmitted to an apparatus. In this case, the first authentication password input means of the client terminal device uses the authentication password input image represented by the authentication password input image data transmitted from the authentication password input image data transmission means. It will be a password for authentication.

  The server device may further include user ID transmission means for transmitting a user ID associated with the application ID to the client terminal device. In this case, the password and application ID stored in the password / application ID storage means may be hashed. The application ID storage means of the client terminal device stores the user ID transmitted from the user ID transmission means of the server device so that it can be accessed by the login application program together with the application ID. The password / application ID communication means of the client terminal device will transmit the user ID, the hashed password, and the hashed application ID to the client terminal device. The server device stores the hashed password, the hashed application ID, and the password stored in the password / application ID storage unit based on the user ID transmitted from the password / application ID transmission unit of the client terminal device. Detecting means for detecting the password, and the user authenticating means of the server device is a password / application ID transmitting means of the client terminal device and a set of a hashed password and a hashed application ID found by the detecting means. The user authentication will be performed based on the pair of the hashed password and the hashed application ID transmitted from.

  In response to the user authentication of the server device by the user authentication means of the server device, data representing a temporary URL different from the fixed URL indicating the storage location of the web page stored in the web server is stored in the client. You may further provide the temporary URL data transmission means transmitted to a terminal device. In this case, the client terminal device requests a web page having a temporary URL in response to receiving data representing the temporary URL transmitted from the temporary URL data transmitting means of the server device. A means will be further provided. Then, the server device requests the web server for web page data representing the web page having the fixed URL in response to a request by the first request means of the client terminal device. In response to a request by the request means and the second request means, the apparatus further comprises web page data transmission means for transmitting the web page data transmitted from the web server to the client terminal device. Let's go.

  The present invention also provides a server device constituting the user authentication system. That is, in a server device constituting a client authentication system including a server device and a client terminal device, a login application program for transmitting a login application program and an application ID for identifying the login application program to the client terminal device Program / ID transmission means, the application ID, and a first application transmitted from the client terminal device in response to the login application program being transmitted from the login application program / ID transmission device to the client terminal device. Password / application ID storage means for storing the authentication password in association with each other, and the login application program / ID sender A second authentication password input from the client terminal device and transmitted from the client terminal device in response to installation and activation of the login application program transmitted from the client terminal device; Password / application ID receiving means for receiving an application ID, a pair of second authentication password and application ID received by the password / application ID receiving means, and a password / application ID storage means stored in the password / application ID storage means It is characterized by comprising user authentication means for performing user authentication based on a set of one authentication password and application ID.

  The present invention also provides a control method suitable for the server device. In other words, this method is a method for controlling a server device that constitutes a client authentication system including a server device and a client terminal device, in which a login application program / ID transmission means includes a login application program and the login application program An application ID for identifying the program is transmitted to the client terminal device (the login application program and the application ID may be transmitted at the same time or may be transmitted separately in time), and password / application ID storage The means that the login application program is transmitted from the application ID and the login application program / ID transmission means to the client terminal device. In response, the first authentication password transmitted from the client terminal device is stored in association with each other, and the password / application ID receiving unit transmits the login application transmitted from the login application program / ID transmitting unit. The second authentication password input from the client terminal device and the application ID transmitted from the client terminal device in response to the program being installed and activated in the client terminal device are received, and the user The authentication means is a first authentication password stored in the password / application ID storage means and a set of the second authentication password and application ID received by the password / application ID reception means. A set of Seward and application ID, and performs user authentication based on.

  The present invention also provides a program for controlling the server device. A recording medium storing such a program may also be provided.

  The present invention also provides a client terminal device constituting the user authentication system. That is, in the client terminal device constituting the client authentication system including the server device and the client terminal device, the first authentication password is input in response to receiving the login application program transmitted from the server device. Authentication password input means, authentication password transmission means for transmitting the authentication password input from the first authentication password input means to the server apparatus as a first authentication password, transmitted from the server apparatus The login application program installation means for installing the login application program and the application ID transmitted from the server device can be accessed by the login application program. Application ID storage means for storing the second authentication password, second authentication password input means for inputting a second authentication password in response to the activation of the login application program, and input of the second authentication password And a password / application ID transmission means for transmitting the second authentication password input from the means and the application ID stored in the application ID storage means to the server device for user authentication.

  The present invention also provides a control method suitable for the client terminal device. That is, this method is a method for controlling a client terminal device that constitutes a client authentication system including a server device and a client terminal device, wherein the first authentication password input means is a login application application transmitted from the server device. In response to receiving the program, an authentication password is input, and the authentication password transmitting means uses the authentication password input from the first authentication password input means as the first authentication password. The login application program installation means installs the login application program transmitted from the server apparatus, and the application ID storage means stores the application ID transmitted from the server apparatus. And the second authentication password input means inputs the second authentication password in response to the login application program being activated, and the password / password is stored. The application ID transmission means transmits the second authentication password input from the second authentication password input means and the application ID stored in the application ID storage means to the server device for user authentication. is there.

  The present invention also provides a program for controlling the client terminal device. A recording medium storing such a program may be provided.

  FIG. 1 shows an embodiment of the present invention and shows an outline of a user authentication system.

  The user authentication system includes a user PC (personal computer: user terminal device) 1, a mobile phone (client terminal device) 2, a proxy server (server device 4), an administrator PC 8 and a web that can communicate with each other via the Internet. A server 9 is included.

  The mobile phone 2 is installed with a client program 3 for performing operations described later. The proxy server 4 is installed with a first server program 5 for performing operations described later, and the web server 9 is installed with a second server program 10 for performing operations described later. These server programs may be installed via the Internet, or may be stored on a memory card, CD-ROM (compact disk-read only memory), etc. May be read and installed.

  As will be described in detail later, the proxy server 4 is connected to a temporary registration database 6 in which temporary registration data is stored and a user information database 7 in which user information is stored.

  The user PC 1, proxy server 4, administrator PC 8 and web server 9 include a CPU, memory, communication device, hard disk, hard disk drive, and the like.

  In this embodiment, the client terminal device is the cellular phone 2, but is not limited to the cellular phone, and may be another portable terminal device, a personal computer, or the like.

  FIG. 2 is a block diagram showing an electrical configuration of the mobile phone 2.

  The overall operation of the mobile phone 2 is controlled by the control device 20.

  A communication device 26 is connected to the control device 20 and can communicate with the Internet or the like via the antenna 25. The control device 20 is also connected with a first memory 27 storing a control program, predetermined data, etc., a sound control device 22 and an LCD (liquid crystal display) driver 23. A microphone and a speaker 21 are connected to the voice control device 22, and voice input / output is possible. A liquid crystal display device 24 is connected to the LCD driver 23, and an image or the like is displayed.

  The mobile phone 2 also includes an application CPU 29. The application CPU 29 is connected to a second memory 28 for storing predetermined data and the like, a power supply circuit 30 and an image sensor 31.

  FIG. 3 is an example of a user information table.

  As will be described later in detail, user authentication is performed in this embodiment. The user ID for user authentication is the user ID. In the user authentication, a login application program (a normal application program may be provided with a login authentication function) is used, and an application ID (activation ID) identifies the login application program. The user information table stores a user ID, an application ID, a password, and the like. The application ID and password are hashed. Other user information is also stored in the user information table, but is omitted in FIG.

  The user information table is stored in a user information database 7 connected to the proxy server 4.

  FIG. 4 is an example of a URL table.

  In this embodiment, when user authentication is performed, web page data is transmitted from the web server 9 to the mobile phone 2 via the proxy server 4. Data representing a URL (referred to as a temporary URL) converted from a URL (Uniform Resource Locator) (referred to as a unique URL) representing the storage location of the web page data is transferred from the proxy server 4 to the mobile phone 2. Sent. When there is a web page request for the temporary URL from the mobile phone 2, the web page data is transmitted from the web server 9 to the mobile phone 2 via the proxy server 4. For such processing, a user ID, a fixed URL, and a temporary URL are stored in the URL table.

  The URL table is also stored in the user information database 7 connected to the proxy server 4.

  5 to 7 are flowcharts showing the procedure of the user registration sequence. 7 shows an example of a window displayed on the administrator PC 8, FIG. 8 shows an example of a window displayed on the user PC 1, and FIGS. 9 to 12 show examples of images displayed on the mobile phone 2. .

  Referring to FIG. 8, user information to be a new user of the service is stored in administrator PC 8 that manages the service provided by mobile phone 2. New user information stored in the administrator PC 8 is read, and a new user registration window 90 is displayed on the display screen of the administrator PC 8. The new user registration window 90 includes user information such as the user's account name, name, e-mail address (PC mail address) using a personal computer, and e-mail address (mobile mail address) of the mobile phone 2. Is displayed. These pieces of user information are transmitted from the administrator PC 8 to the proxy server 4 (step 42 in FIG. 5).

  When the user information transmitted from the administrator PC 8 is received by the proxy server 4 (step 51 in FIG. 5), the user information is stored in the user information database 7 (step 52 in FIG. 5). Further, the proxy server 4 generates a temporary password including the temporary user ID and a temporary URL for login (step 52 in FIG. 5). The temporary password is a character string (numerical string) of about 10 characters, for example, and a plurality of character strings in the character string are used as temporary user IDs (temporary password with temporary user ID). The generated temporary password and temporary URL are stored in the temporary registration database 6. The generated temporary password is transmitted from the proxy server 4 to the user PC 1 by e-mail addressed to the PC mail address (step 53 in FIG. 5).

  The temporary password transmitted from the proxy server 4 is received by the user PC 1 (step 41 in FIG. 5).

  FIG. 9 is an example of a mail display window 100 displayed on the display screen of the user PC 1. In the mail display window 100, a character string 103 and a temporary password 102 for notifying a temporary password for user registration are displayed. The user of the mobile phone 2 can know the temporary password by looking at the temporary password displayed on the display screen of the user PC 1.

  Data representing the temporary URL is also transmitted from the proxy server 4 to the mobile phone 2 by e-mail to the e-mail address of the mobile phone 2 (step 54 in FIG. 6).

  FIG. 10 is an example of the display screen of the mobile phone 2. When the e-mail transmitted from the proxy server 4 is received by the mobile phone 10 (step 71 in FIG. 6) and the e-mail is opened, the content of the e-mail is displayed on the display screen 100 of the mobile phone 2. On the display screen 100 of the mobile phone 2, a text 110 of user-registered e-mail is displayed. A character string 111 of the temporary URL is clickably displayed below the e-mail body 110. When the character string 111 of the temporary URL is clicked by the user of the mobile phone 2, the data representing the character string 111 of the temporary URL and the request data are transmitted from the mobile phone 2 to the proxy server 4. A web page having a URL is requested to the proxy server 4 (step 72 in FIG. 6).

  It is confirmed whether or not the temporary URL character string 111 represented by the data transmitted from the cellular phone 2 is valid (whether it is transmitted from the proxy server 4 to the cellular phone 2) (step 55 in FIG. 6). . If the temporary URL character string 111 is valid (if it is transmitted from the proxy server 4 to the mobile phone 2) (YES in step 55 in FIG. 6), the web page data for user registration is proxy. The data is transmitted from the server 4 to the mobile phone 2 (step 56 in FIG. 6). If the character string of the temporary URL 111 is not valid (NO in step 55 in FIG. 6), error processing is performed.

  When the user registration web page data transmitted from the proxy server 4 is received by the mobile phone 2, the user registration image 121 on the web page shown in FIG. 11 is displayed on the display screen of the mobile phone 2. Is done. In the user registration image 121, an installation start character string 122 is clickably displayed below a character string 123 indicating that a login application program is to be installed. When the installation start character string 122 is clicked, request data for requesting a login application program is transmitted from the mobile phone 2 to the proxy server 4 (step 73 in FIG. 6).

  When the request data transmitted from the mobile phone 2 is received by the proxy server 4, the login application program is transmitted from the proxy server 4 to the mobile phone 2 (step 57 in FIG. 6).

  When the login application program transmitted from the proxy server 4 is received by the mobile phone 2, installation of the login application program is started (step 74 in FIG. 6). When installation of the login application program is completed, the temporary password input image 131 shown in FIG. 12 is displayed on the display screen 100 of the mobile phone 2 (step 75 in FIG. 6). In the temporary password input image 131, a character string 133 that prompts input of the temporary password is displayed. Under this character string 133, a temporary password input area 132 and a send button 133 are formed. The user of the cellular phone 2 inputs a temporary password with a temporary user ID that has been delivered to the user PC 1 by e-mail (step 76 in FIG. 6). Each time a temporary password is input, an asterisk is displayed in the temporary password input area 132. When the transmission button 133 is pressed (clicked) by the user of the cellular phone 2, the entered temporary password is transmitted from the cellular phone 2 to the proxy server 4 (step 77 in FIG. 6).

  When the temporary password transmitted from the mobile phone 2 is received by the proxy server 4, it is confirmed whether the received temporary password is correct (step 54 in FIG. 6). If it is confirmed that the temporary password is correct (YES in step 58 in FIG. 6), it is confirmed whether or not the proxy server 4 is accessed via the web page of the temporary URL (step 59 in FIG. 6). If the proxy server 4 is accessed via the web page of the temporary URL (YES in step 59 in FIG. 6), the proxy server 4 is considered to be a user who is permitted to temporarily register. The approval command is transmitted from 4 to the mobile phone 2 (step 60 in FIG. 7).

  If the temporary password is not valid (NO in step 58 in FIG. 6), and if it is not via the temporary URL web page (NO in step 59 in FIG. 6), error processing is performed. Since it is confirmed whether or not the proxy server 4 has been accessed via the temporary URL web page, it is possible to prevent unauthorized user authentication by a user who has illegally acquired only the login application program. It goes without saying that the temporary password, temporary URL, and the like are stored in the temporary registration database 6.

  When the approval command transmitted from the proxy server 4 is received by the mobile phone 2, a password setting image 141 shown in FIG. 13 is displayed by the login application program (step 78 in FIG. 7). In the password setting image 141, a character string 144 for setting a password is displayed. The temporary password is transmitted from the proxy server 4, but the set password is determined by the user. Under the character string 144, a password input area 142 and a send button 143 are formed. A new password (first authentication password) input by the user is displayed in the password input area 142 (step 79 in FIG. 7). When the send button 143 is pressed (when the send button 143 is clicked), the input new password and the temporary user ID included in the temporary password are transmitted from the mobile phone 2 to the proxy server 4 (FIG. 7). Step 80).

  When the password and temporary user ID transmitted from the mobile phone 2 are received by the proxy server 4, the received password is registered in the proxy server 4 (step 61 in FIG. 7). Also, a new user ID and application ID are generated (step 62 in FIG. 7). The application ID identifies the login application program installed in the mobile phone 2 and is unique to the login application program installed in the mobile phone 2 (specific to the mobile phone 2). The password and application ID are hashed with the challenge key and stored in the user information table corresponding to the user ID as shown in FIG. 3 (step 62 in FIG. 7). It goes without saying that the user information table also stores other user information corresponding to the generated user ID. An OK command, a user ID, and an application ID are transmitted from the proxy server 4 to the mobile phone 2 (step 63 in FIG. 7).

  When the mobile phone 2 receives the OK command, user ID, and application ID transmitted from the proxy server 4, the user ID and application ID can be accessed only by the login application program in the storage area of the memory. Stored in the pad area (step 81 in FIG. 7). The scratch pad area may be formed in either the first memory 27 or the second memory 28 of the mobile phone 2. A setting completion image 151 shown in FIG. 14 is displayed on the display screen 100 of the cellular phone 2 by the login application program (step 82 in FIG. 7). In the setting completion image 151, a character string 153 indicating the completion of setting is displayed. When the service top button 152 in which the service top button 152 in which the character string for the service top is displayed is clickably displayed is clicked below the character string 153 of the completion of setting, a predetermined value is displayed. A service web page is requested.

  The user ID and the like are registered in the proxy server 4 by the user registration sequence as described above.

  FIGS. 15 and 16 are flowcharts showing the processing procedure of the user login sequence, and FIGS. 17 to 19 are examples of images displayed on the mobile phone 2.

  The mobile phone 2 is turned on, and a stored application list display image is displayed on the display screen 100 of the mobile phone 2 as shown in FIG. 17 (step 161 in FIG. 15). Referring to FIG. 17, stored application list display image 190 displays a list of application programs installed in mobile phone 2. Character strings “GPS map”, “puzzle game”, and “mobile service” are clickably displayed, and an application program specified by these character strings is installed in the mobile phone 2. It is assumed that the “mobile service” is an application program logged in by the above-described login application program.

  When “mobile service” is clicked by the user of the mobile phone 2 (step 162 in FIG. 15), the login application program for the mobile service is activated (step 163 in FIG. 15). Then, the password input image 200 shown in FIG. 18 is displayed on the display screen 100 of the mobile phone 2 (step 164 in FIG. 15). The password input image 200 displays a character string 203 that prompts the user to enter a password. Under this character string 203, a password input area 201 and a send button 202 are formed. A password (second authentication password) set by the user using the numeric keypad of the mobile phone 203 is input (step 165 in FIG. 16). The entered password is displayed in the password entry area 201. When the send button 202 is pressed (YES in step 166 in FIG. 15), the challenge is the same as the challenge key used to hash the first authentication password and application ID from the mobile phone 2 to the proxy server 4. A key is requested (step 167 in FIG. 16).

  In response to a request from the mobile phone 2, a challenge key is transmitted from the proxy server 4 to the mobile phone 2 (step 181 in FIG. 16).

  In the mobile phone 2, the user ID and application ID stored in the scratch pad area are read (step 168 in FIG. 16). The read user ID and application ID are hashed by the challenge key transmitted from the proxy server 4 (step 109 in FIG. 16). Then, the user ID, the hashed password, and the hashed application ID are transmitted from the mobile phone 2 to the proxy server 4 (step 170 in FIG. 16).

  When the user ID transmitted from the mobile phone 2 and the hashed password and the hashed application ID are received by the proxy server 4, it corresponds to the received user ID from the user information table stored in the user information database 7. The hashed password and hashed application ID stored in this way are read (step 182 in FIG. 16). It is confirmed whether the pair of the hashed password and the hashed application ID read from the user information table matches the pair of the hashed password and the hashed application ID transmitted from the mobile phone 2 (see FIG. 16 step 183).

  If these sets match, the user of the mobile phone 2 is authenticated as a registered user. Then, data representing the URL (temporary URL) in which the URL of the top page of the mobile service web page is changed is transmitted from the proxy server 4 to the mobile phone 2 (step 184 in FIG. 16). If these sets do not match, error handling is performed.

  When data representing the temporary URL transmitted from the proxy server 4 is received by the mobile phone 2, a web page of the temporary URL is requested to the proxy server 4 (step 171 in FIG. 16).

  When there is a request for a temporary URL web page from the mobile phone 2 to the proxy server 4, the temporary URL is returned to the fixed URL with reference to the URL table (step 185 in FIG. 16). Then, a web page with a fixed URL is requested from the proxy server 4 to the web server 9 (step 186 in FIG. 16). When data representing a fixed URL web page is transmitted from the web server 9 to the proxy server 4 in response to the request, the web page data is received by the proxy server 4 (step 187 in FIG. 16). The received web page data is transmitted from the proxy server 4 to the mobile phone 2 (step 187 in FIG. 16).

  When the web page data transmitted from the proxy server 4 is received by the mobile phone 172, the service top page 210 shown in FIG. 19 is displayed on the display screen 100 of the mobile phone 2 (step 172 in FIG. 16). ). The user of the mobile phone 2 can use the mobile service from the service top page 210.

  In the above-described embodiment, the application ID and the password are hashed and transmitted from the mobile phone 2 to the proxy server 4. However, the application ID and the password are not necessarily hashed. In this case, since the proxy server 4 can recognize the application ID and password, user authentication of the mobile phone 2 can be performed using the transmitted non-hashed application ID and password. The user ID may not be transmitted.

  In the above-described embodiment, user authentication is performed from the access to the proxy server 4 from the mobile phone 2 storing the login application program and the input password, so that two-factor authentication can be realized. In addition, since the application ID is unique to the mobile phone 2, even if a login application program is illegally installed and another person's password is used, user authentication is not performed. Further, even if the mobile phone 2 in which the login application program is installed is lost and the password is stolen, the user authentication cannot be performed if the application ID stored in the proxy server 4 is deleted. Further, after the user authentication, data representing the temporary URL is transmitted to the mobile phone 2, and data representing the top page of the service is transmitted to the mobile phone 2 due to a request for a web page having the temporary URL. Therefore, even if the service top page is accessed directly, error handling can be performed.

1 shows an overview of a user authentication system. It is a block diagram which shows the electric constitution of a mobile telephone. It is an example of a user information table. It is an example of a URL table. It is a flowchart which shows a user registration process procedure. It is a flowchart which shows a user registration process procedure. It is a flowchart which shows a user registration process procedure. It is an example of the window displayed on administrator PC. It is an example of the window displayed on user PC. It is an example of the image displayed on a mobile telephone. It is an example of the image displayed on a mobile telephone. It is an example of the image displayed on a mobile telephone. It is an example of the image displayed on a mobile telephone. It is an example of the image displayed on a mobile telephone. It is a flowchart which shows a user login process procedure. It is a flowchart which shows a user login process procedure. It is an example of the image displayed on a mobile telephone. It is an example of the image displayed on a mobile telephone. It is an example of the image displayed on a mobile telephone.

Explanation of symbols

2 Mobile phone 4 Proxy server 6 Temporary registration database 7 User information database 9 Web server

Claims (10)

In a client authentication system including a server device and a client terminal device,
The server device is
Login application program and login application program / ID transmission means for transmitting to the client terminal device an application ID for identifying the login application program, and the application ID and login application program / ID transmission And a password / application ID storage means for storing the first authentication password transmitted from the client terminal device in association with the login application program transmitted from the device to the client terminal device. ,
The client terminal device
First authentication password input means for inputting an authentication password in response to receiving the login application program transmitted from the login application program / ID transmission means of the server device;
Authentication password transmitting means for transmitting the authentication password input from the first authentication password input means to the server device as the first authentication password;
Login application program installation means for installing the login application program transmitted from the login application program / ID transmission means of the server device;
Application ID storage means for storing the application ID transmitted from the login application program / ID transmission means of the server device so as to be accessible by the login application program;
Second authentication password input means for inputting a second authentication password in response to activation of the login application program;
A password / application ID transmitting means for transmitting the second authentication password input from the second authentication password input means and the application ID stored in the application ID storage means to the server device for user authentication; ,
The server device is
A set of the second authentication password and application ID transmitted by the password / application ID transmission means of the client terminal device, and the first authentication password and application stored in the password / application ID storage means A user authentication means for performing user authentication based on the pair with the ID,
Client authentication system with The server device is
Temporary URL data transmission means for transmitting temporary URL data representing a temporary URL to the client terminal device;
Temporary password transmission means for transmitting the first temporary password to a user terminal device different from the client terminal device;
Determining means for determining whether or not there is a request for a web page having a temporary URL represented by the temporary URL data transmitted from the temporary URL data transmitting means from the client terminal device;
Temporary password input image data transmitting means for transmitting temporary password input image data to the client terminal device in response to determination by the determination means that a request for a web page having a temporary URL has been made;
Temporary password receiving means for receiving a second temporary password transmitted from the client terminal device in response to provisional password input image data being transmitted to the client terminal device by the temporary password input image data transmitting means. And inputting the first authentication password in response to a match between the second temporary password received by the temporary password receiving means and the first temporary password transmitted by the temporary password transmitting means. Authentication password input image data transmitting means for transmitting the authentication password input image data representing the authentication password input image to the client terminal device,
The first authentication password input means of the client terminal device uses an authentication password input image represented by the authentication password input image data transmitted from the authentication password input image data transmission means to use an authentication password. Is input,
The client authentication system according to claim 1. The server device
The client terminal device further comprises user ID transmission means for transmitting a user ID associated with the application ID,
The password and application ID stored in the password / application ID storage means are hashed,
The application ID storage means of the client terminal device is
The user ID transmitted from the user ID transmission means of the server device is stored together with the application ID so as to be accessible by the login application program,
The password / application ID transmission means of the client terminal device is:
Transmitting the user ID, the hashed password, and the hashed application ID to the client terminal device;
The server device
Detection means for finding a hashed password and a hashed application ID stored in the password / application ID storage means based on the user ID transmitted from the password / application ID transmission means of the client terminal device ,
The user authentication means of the server device is found by the detection means, and is sent from the hash / password ID / application ID transmission means of the client terminal device and the hashed password that is found by the hashed password and the hashed application ID. And user authentication based on a set of hashed application IDs,
The client authentication system according to claim 2. The server device is
In response to the user authentication by the user authentication means of the server device, data representing a temporary URL different from the fixed URL indicating the storage location of the web page stored in the web server is transmitted to the client terminal device. A temporary URL data transmission means;
The client terminal device
First request means for requesting a web page having a temporary URL in response to receiving data representing the temporary URL transmitted from the temporary URL data transmitting means of the server device;
The server device is
Second request means for requesting the web server for web page data representing the web page having the fixed URL in response to a request by the first request means of the client terminal device; and Web page data transmission means for transmitting the web page data transmitted from the web server to the client terminal device in response to a request by the request means.
The user authentication system according to any one of claims 1 to 3, further comprising: In a server device constituting a client authentication system including a server device and a client terminal device,
Login application program / ID transmission means for transmitting to the client terminal device an application ID for identifying the login application program and the login application program;
The application ID, a first authentication password transmitted from the client terminal device in response to the login application program being transmitted from the login application program / ID transmitting means to the client terminal device, Password / application ID storage means for storing the information in association with each other,
Input at the client terminal device is transmitted from the client terminal device in response to the login application program transmitted from the login application program / ID transmitting means being installed and activated at the client terminal device. A password / application ID receiving means for receiving the second authentication password and the application ID, a pair of the second authentication password and the application ID received by the password / application ID receiving means, and the password / User authentication means for performing user authentication based on the first authentication password and application ID pair stored in the application ID storage means;
Server device. In a client terminal device constituting a client authentication system including a server device and a client terminal device,
First authentication password input means for inputting an authentication password in response to receiving the login application program transmitted from the server device;
Authentication password transmitting means for transmitting the authentication password input from the first authentication password input means to the server device as a first authentication password;
Login application program installation means for installing the login application program transmitted from the server device;
Application ID storage means for storing the application ID transmitted from the server device so that it can be accessed by the login application program;
A second authentication password input means for inputting a second authentication password in response to activation of the login application program; and a second input from the second authentication password input means. Password / application ID transmission means for transmitting the authentication password and the application ID stored in the application ID storage means to the server device for user authentication;
A client terminal device. In a control method of a server device constituting a client authentication system including a server device and a client terminal device,
The login application program / ID transmitting means transmits an application ID for identifying the login application program and the login application program to the client terminal device,
The password / application ID storage means is transmitted from the client terminal apparatus in response to the login of the application ID and the login application program / ID transmission means to the client terminal apparatus. Storing the first authentication password in association with each other;
The password / application ID receiving means transmits from the client terminal apparatus in response to the login application program transmitted from the login application program / ID transmitting means being installed and activated in the client terminal apparatus. Receiving the second authentication password and the application ID input in the client terminal device,
The first authentication password and application ID stored in the password / application ID storage means, and the set of the second authentication password and application ID received by the user authentication means by the password / application ID reception means User authentication is performed based on
A method for controlling a server device. In a control method of a client terminal device constituting a client authentication system including a server device and a client terminal device,
The first authentication password input means inputs the authentication password in response to receiving the login application program transmitted from the server device,
An authentication password transmitting means transmits the authentication password input from the first authentication password input means to the server device as a first authentication password;
The login application program installation means installs the login application program transmitted from the server device, and
An application ID storage means stores the application ID transmitted from the server device so that it can be accessed by the login application program;
The second authentication password input means inputs the second authentication password in response to the login application program being activated,
The password / application ID transmission means transmits the second authentication password input from the second authentication password input means and the application ID stored in the application ID storage means to the server device for user authentication. ,
A method for controlling a client terminal device. A program for controlling a server device constituting a client authentication system including a server device and a client terminal device,
A login application program and an application ID for identifying the login application program are transmitted to the client terminal device;
Storing the application ID in association with the first authentication password transmitted from the client terminal device in response to the login application program being transmitted to the client terminal device;
The second authentication password input in the client terminal device and the application transmitted from the client terminal device in response to the transmitted login application program being installed and activated in the client terminal device ID is received,
A computer that controls the server device to perform user authentication based on the received pair of the second authentication password and the application ID and the stored pair of the first authentication password and the application ID. A readable program. In a program for controlling a client terminal device constituting a client authentication system including a server device and a client terminal device,
In response to receiving the login application program transmitted from the server device, the authentication password is entered,
The input authentication password is transmitted to the server device as a first authentication password,
Install the login application program sent from the server device,
Storing the application ID transmitted from the server device so that it can be accessed by the login application program;
In response to the login application program being launched, the second authentication password is entered,
A computer-readable program for controlling a client terminal device to cause the server device to transmit an input second authentication password and a stored application ID for user authentication.

Images