JP2012238216A - Authentication data management system, authentication data management method, authentication server device, service provision device, authentication server processing program and authentication processing program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To build a system for authentication processing at low cost, while securing security.SOLUTION: In an authentication data management system 1, an authentication server device 2 generates data for first authentication in an authentication processing device using authentication processing device unique information which is different depending on each authentication processing device 4 and transmits it to the authentication processing device 4. The authentication processing devices 4 register the data for first authentication in an authentication processing device in an authentication processing device storage part. The authentication server device 2 generates second authentication information for an authentication processing device using the authentication processing device unique information determined based on a service which a user specifies and transmits it to a client device 3. The client device 3 transmits the second authentication information for an authentication processing device to the authentication processing device 4. The authentication processing device 4 collates the second authentication information for an authentication processing device with first authentication information for an authentication processing device generated by using the data for first authentication in an authentication processing device.

Description

  The present invention relates to a system configuration form for accessing a control device when using services such as entrance / exit management, energy management, and facility equipment management, and in particular, access to a control device installed in a building, office, factory, or other facility. The present invention relates to a technology such as authentication processing in a system to perform.

In a system in which a service is performed by both a center server device and a control device that are connected to each other via a network, in general, both the center server device and the control device require user authentication.
If the control device attempts to store user authentication data in the control device for the purpose of performing user authentication equivalent to the user authentication in the center server device, the control device requires a large amount of memory.

  If data for user authentication is not stored in the control device but only user authentication is performed in the center server device, and access to the control device is restricted to access via the center server device, access to the center server device is concentrated. . Therefore, for services such as moving image data with a large amount of data, it is necessary to reinforce the line on the center server device side and the center server device, which increases costs.

As another method, after the user is authenticated by the center server device, the user obtains an authentication ID (IDentification) and authentication information for the control device from the center server device, and then the user accesses the control device to perform control. A technique for enabling user authentication in an apparatus is known (see, for example, Patent Document 1).
According to this method, a large storage area is not required for the control device. Also, concentration of access to the center server device can be avoided.

As another method, a public key certificate and a private key are registered in a remote operation target terminal, and the public key of the certificate authority is stored in the remote operation device. A method of performing authentication when connecting to a terminal is known (see, for example, Patent Document 2).
According to this method, since the same secret key is registered in any remote operation target terminal, the same public key is used for any device that performs remote operation regardless of which remote operation target terminal performs user authentication. Good. Therefore, multiple public keys are not required. Even if the remote operation target terminal is stolen, the public key cannot be obtained from the secret key, and therefore, it is impossible to illegally access another remote operation target terminal.

JP 2004-240637 A JP 2003-230186 A

If the control device authentication data, which is the data that is the source of the authentication information, is illegally acquired in the communication path between each control device and the center server device, the control device authentication data that has been illegally acquired is In order to prevent unauthorized authentication by other control devices, the control device authentication data needs to be different for each control device.
However, in the technique disclosed in Patent Document 1, in order to realize this, the center server device stores control device authentication data for each control device. Then, when there is a large amount of control devices, there is a problem that a large amount of storage storage area is required in the center server device.
Further, in the technique disclosed in Patent Document 2, when a public key is found because a device that performs remote operation is stolen, all remote operation target terminals can be illegally accessed. There is a problem.

  Therefore, the present invention has been made in view of the above problems, and is an authentication data management system, an authentication data management method, an authentication server device, a service providing device, and an authentication server processing program that are constructed at low cost while ensuring security. It is an object to provide an authentication processing program.

  In order to solve the above problems, an authentication data management system according to the present invention includes at least one service providing apparatus that provides a service to a user via a client apparatus, and authentication that processes authentication information related to the one or more service providing apparatuses. An authentication data management system in which a server device is connected to each other via a network, and the authentication server device uses the service providing device unique information that differs for each service providing device to perform authentication in the service providing device. Service providing device first authentication data is generated, and the service providing device first authentication data is used as the service providing device first authentication data. To the service providing device, the service providing device from the authentication server device The service providing device first authentication data to be registered is registered in the service providing device storage unit, and the authentication server device acquires the user information of the user and performs authentication processing of the user, and the user authentication is successful. In this case, the service providing device second authentication data, which is data for authentication in the service providing device, is generated using the service providing device specific information determined based on the service specified by the user, The service providing device second authentication information is generated using the service providing device second authentication data, and the service providing device second authentication information is transmitted to the client device. The service provision transmitted by the client device when receiving the service provision via the client device When the second authentication information is received, it is generated using the received second authentication information for the service providing device and the service authentication device first authentication data received and registered in advance from the authentication server device. It collates with the 1st authentication information for service provision apparatuses, It is characterized by the above-mentioned.

  ADVANTAGE OF THE INVENTION According to this invention, the system regarding an authentication process can be constructed | assembled at low cost, ensuring security.

It is a figure which shows the structure of the authentication data management system which concerns on embodiment of this invention. It is a figure which shows the structure of the center server apparatus of the authentication data management system which concerns on embodiment of this invention. It is a figure which shows the structure of the control apparatus of the authentication data management system which concerns on embodiment of this invention. It is a figure which shows the structure of the client apparatus of the authentication data management system which concerns on embodiment of this invention. It is a figure which shows an example of the user information table which the center server apparatus of the authentication data management system which concerns on embodiment of this invention manages. It is a figure which shows an example of the service list table which the center server apparatus of the authentication data management system which concerns on embodiment of this invention manages. It is a figure which shows an example of the table for center server apparatus authentication which the center server apparatus of the authentication data management system which concerns on embodiment of this invention manages. It is a figure which shows an example of the control apparatus table which the center server apparatus of the authentication data management system which concerns on embodiment of this invention manages. It is a figure which shows an example of the table for control apparatus authentication which the control apparatus of the authentication data management system which concerns on embodiment of this invention manages. It is a figure which shows an example of the service content table which the control apparatus of the authentication data management system which concerns on embodiment of this invention manages. It is a sequence diagram which shows operation | movement of the authentication data management system which concerns on embodiment of this invention. It is a flowchart which shows operation | movement of the control apparatus 1st authentication data pre-transmission process in the center server apparatus of the authentication data management system which concerns on embodiment of this invention. It is a flowchart which shows operation | movement of the 2nd authentication information production | generation transmission process for control apparatuses in the center server apparatus of the authentication data management system which concerns on embodiment of this invention. It is a flowchart which shows operation | movement of the control apparatus 1st authentication data pre-registration process in the control apparatus of the authentication data management system which concerns on embodiment of this invention. It is a flowchart which shows the operation | movement of the service content output process in the control apparatus of the authentication data management system which concerns on embodiment of this invention. It is a flowchart which shows the operation | movement of the service content acquisition process in the client apparatus of the authentication data management system which concerns on embodiment of this invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. In each figure, common portions are denoted by the same reference numerals, and redundant description is omitted.
[Configuration of Authentication Data Management System 1]
As shown in FIG. 1, the authentication data management system 1 includes a center server device 2, a client device 3, and a plurality of control devices 4 (4a, 4b,..., 4x) connected to each other via a network 5. And comprising. Further, a communication device such as a gateway device may be provided between the network 5 and the control device 4.
In the present specification and the like, the control device 4 is a service providing device. The center server device 2 is an authentication server device.

The client apparatus 3 has a GUI (Graphical User Interface) such as a general-purpose browser, and displays login information input items and a service list to the user. Further, the client device 3 accepts user operations such as input of login information and selection of services.
The center server device 2 is centrally responsible for user authentication processing and generation of authentication information related to the control device 4.

The control device 4 controls equipment not shown, and provides a service to the user. The services include, for example, entrance / exit management, energy management, equipment management, and the like in buildings, offices, condominiums, factories, and other facilities.
The network 5 is a local network such as a LAN (Local Area Network) or a global network such as the Internet. For example, the LAN is wired in a building.

[Outline of operation of authentication data management system 1]
Here, an outline of the operation of the authentication data management system 1 will be briefly described.
First, the center server device 2 transmits “information used for authentication in the control device 4” to the control device 4 in advance and registers it in the control device 4.
When using the service, the user logs in the center server device 2 by inputting a user ID, a password, biometric authentication information and the like in the client device 3. The center server device 2 authenticates the user. When the authentication is successful, the center server device 2 transmits “information used for authentication by the control device 4” to the client device 3.

The user logs in to the control device 4 using “information used for authentication in the control device 4” received by the client device 3 from the center server device 2.
The control device 4 collates “information used for authentication in the control device 4” received in advance from the center server device 2 with “information used for authentication in the control device 4” received from the client device 3. . If the authentication is successful, the control device 4 provides a service to the user.

[Configuration of Center Server Device 2]
Next, the configuration of the center server device 2 will be described with reference to FIGS. 2 and 5 to 8.
As shown in FIG. 2, the center server device 2 includes a center server device storage unit 20, a center server device authentication data generation unit 21, a control device authentication data generation unit 22, and a control device authentication data transmission unit 23. A user authentication unit 24, a service list output unit 25, a control device ID acquisition unit 26, and a control device second authentication information generation / transmission unit 27.

The center server device storage unit 20 stores a user information table 201, a service list table 202, a center server device authentication table 203, and a control device table 204.
For example, as shown in FIG. 5, the user information table 201 includes data items of a user ID item D10 and a user authentication data item D11. The user ID item D10 stores an identifier for specifying a user. The user authentication data item D11 stores data necessary for the identity verification of the user who presented the user ID, and the data is, for example, a password, biometric authentication information, a hash value, or the like.

  As shown in FIG. 6, for example, the service list table 202 includes data items of a service ID item D20, a service name item D21, and a control device ID item D22. The service ID item D20 stores an identifier for specifying a service used from a number of services. The service name item D21 stores the name of the service provided by the control device 4. The control device ID item D22 stores an identifier for specifying each control device 4. For example, the service ID of the A district power consumption is SRV001, and the control device ID of the usable control device 4 is CTL001.

  As shown in FIG. 7, for example, the center server device authentication table 203 includes a center server device authentication data ID item D30, a center server device authentication data item D31, a start date and time item D32, an end date and time item D33, Each data item is provided. The center server device authentication data ID item D30 stores an identifier for specifying the center server device authentication data 53. The center server device authentication data 53 is data used to generate control device authentication data 50 described later. The center server device authentication data item D31 stores the center server device authentication data 53. In this example, random numbers are stored. The start date / time item D32 and the end date / time item D33 store the valid period of the data for authentication of the center server device, and are indicated by, for example, “year / month / day hour: minute: second”. The range of the validity period is set so as not to overlap with any center server apparatus authentication data 53. In this example, the validity period is half a year.

As shown in FIG. 8, for example, the control device table 204 includes a control device ID item D40, a control device access destination item D41, a control device first authentication data registration date / time item D42, and a center server device authentication data ID item. D43 and each data item. The control device ID item D40 is the same as the control device ID item D22 (see FIG. 6). The control device access destination item D41 stores access destination information of the control device 4, and the access destination information is, for example, a URL (Uniform Resource Locator). The control device first authentication data registration date and time item D42 stores the date and time when the control device first authentication data 51 described later is registered in the control device 4. The center server device authentication data ID item D43 is the same as the center server device authentication data ID item D30 (see FIG. 7).
The control device ID and the control device access destination are collectively referred to as control device specific information 63.

Returning to FIG. 2, the description will be continued.
The center server device authentication data generation unit 21 generates center server device authentication data 53. The center server device authentication data 53 is data used to generate control device authentication data 50 to be described later, and is an appropriate random number. The generated center server device authentication data 53 is registered in the center server device authentication table 203 (see FIG. 7). The center server device authentication data generation unit 21 periodically changes the center server device authentication data 53 in order to improve the security level. The change period is not particularly limited, but is, for example, six months or one year.

The control device authentication data generation unit 22 generates control device authentication data 50.
Hereinafter, the control device authentication data 50 transmitted to the control device 4 in advance is referred to as the control device first authentication data 51, and the control device authentication data 50 generated when the user logs into the center server device 2 is controlled. It will be referred to as device second authentication data 52.
The outline of the authentication process of the authentication data management system 1 is as follows. Information generated based on the control device first authentication data 51 (control device first authentication information 510) and the control device second authentication data 52. This is performed by collating the information generated based on the information (second authentication information for control device 520) in the control device 4.

Here, a method of generating the control device first authentication data 51 will be described.
(Method for Generating Control Device First Authentication Data 51)
The control device authentication data generation unit 22 refers to the center server device authentication table 203 (see FIG. 7), and the center server device authentication data whose current time is within the range of the start date / time item D32 and the end date / time item D33. The center server device authentication data 53 of item D31 is acquired. Also, the control device authentication data generation unit 22 refers to the control device table 204 (see FIG. 8) and acquires the control device ID. Further, the control device authentication data generation unit 22 acquires a value α (not shown).

The value α is a key value, and the control device first authentication data 51 is periodically changed by periodically changing the value α. The change cycle is, for example, 10 days. Corresponding to this cycle, the control device authentication data generation unit 22 also generates a valid period of the control device first authentication data 51.
By periodically changing the control device first authentication data 51, the control device authentication is performed on the communication path between the client apparatus 3 and the center server apparatus 2 or on the communication path between the client apparatus 3 and the control apparatus 4. When the data is acquired illegally, it is possible to prevent the control device 4 from performing unauthorized authentication using the control device authentication data acquired illegally.

  The control device authentication data generation unit 22 generates the control device first authentication data 51 by generating a random number using the set of the acquired center server device authentication data 53, the control device ID and the value α as random seed data. Generate. The random seed data is an initial value when generating a random number. If the initial value and the random number generation algorithm are the same, the same random number is generated. Various methods can be used as a method for converting a plurality of data sets into random seed data according to the conventional technique. For example, the random seed data may be obtained by simply connecting a plurality of data.

The reason for making the control device ID a part of the random seed data is that, since the control device ID is different for each control device, different control device first authentication data 51 is generated for each control device. Therefore, a control device access destination that is different for each control device may be part of the random seed data. However, the random seed data used when generating the control device first authentication data 51 is the same as the random seed data used when generating the control device second authentication data 52 described later.
By generating different control device first authentication data 51 for each control device 4, it is possible to prevent unauthorized authentication by another control device 4 based on the control device authentication data that has been acquired illegally. .
The generated control device first authentication data 51 and its validity period are transmitted to the control device 4.

Returning to FIG. 2, the description will be continued.
The control device authentication data transmitter 23 transmits the control device first authentication data 51 to the control device 4.
The user authentication unit 24 refers to the user information table 201 (see FIG. 5) and authenticates the user using the user information 62 received from the client device 3. The user information 62 is a user ID and user authentication information input by the user. The user authentication information is, for example, a password or biometric authentication information.

When the user authentication is successful, the service list output unit 25 acquires a plurality of service IDs and service names from the service list table 202 (see FIG. 6), and outputs them to the client device 3 as a service list. is there.
The control device ID acquisition unit 26 receives the service ID of the service selected by the user from the client device 3, refers to the service list table 202, and acquires the control device ID corresponding to the acquired service ID. . The control device ID is output to the control device authentication data generation unit 22 and the control device second authentication information generation transmission unit 27.

The control device second authentication information generation / transmission unit 27 generates the control device second authentication information 520 and transmits it to the client device 3.
Here, a method for generating the second authentication information for control device 520 will be described.
(Method for generating second authentication information 520 for control device)
The control device second authentication information generation / transmission unit 27 requests the control device authentication data generation unit 22 to generate the control device second authentication data 52.
The control device authentication data generation unit 22 acquires the control device ID from the control device ID acquisition unit 26, refers to the control device table 204 (see FIG. 8), and performs center server device authentication corresponding to the acquired control device ID. Get the data ID. Next, the control device authentication data generation unit 22 refers to the center server device authentication table 203 (see FIG. 7), and obtains the center server device authentication data 53 corresponding to the acquired center server device authentication data ID. get. Next, the control device authentication data generation unit 22 generates a random number using the set of the acquired center server device authentication data 53, the value α, and the control device ID acquired from the control device ID acquisition unit 26 as random seed data. Thus, the control device second authentication data 52 is generated.
The control device second authentication information generation / transmission unit 27 generates a random seed from the control device second authentication data 52 generated by the control device authentication data generation unit 22 and the control device ID acquired from the control device ID acquisition unit 26. The control device second authentication information 520 is generated by generating a random number as data.

In addition, the second authentication information generation / transmission unit 27 for the control device generates an authentication information generation time 61 that is a time for generating the second authentication information for the control device 520.
Further, the second authentication information generation / transmission unit 27 for control device acquires a control device access destination corresponding to the control device ID acquired from the control device ID acquisition unit 26 with reference to the control device table 204 (see FIG. 8). To do.
Thereafter, the control device second authentication information generation / transmission unit 27 sends the generated control device second authentication information 520 together with the control device unique information 63 (control device ID, control device access destination) and authentication information generation time 61. It transmits to the client device 3.

When generating the second authentication information for control device 520, instead of or in addition to the control device ID, as the random seed data, among the authentication information generation time 61, the user information 62, and the control device access destination One or more may be used. In this case, the data used as random seed data is also transmitted to the client device 3. The control device second authentication data 52 may be used as the control device second authentication information 520 as it is.
Here, what is transmitted to the client device 3 is collectively referred to as control device login information.

Until the control device first authentication data 51, the control device second authentication data 52, and the control device second authentication information 520 generated by the center server device 2 are transmitted to the control device 4 or the client device 3, Although temporarily present in the transmission buffer or the like, the center server device 2 deletes them immediately after transmission.
As a result, even if there is a large amount of the control device 4, the center server device 2 does not need a storage area for storing authentication data related to the control device 4, and thus the center server device 2 can be constructed at low cost.
The value α is held in the center server device 2. This is because the control device authentication data generation unit 22 can be used to generate the control device second authentication data 52 when the user logs into the center server device 2.

In this specification and the like, the control device unique information 63 (control device ID, control device access destination) is service provision device unique information. The center server device authentication data 53 is authentication server device authentication data.
In this specification and the like, the control device first authentication data 51 is the service providing device first authentication data, and the control device second authentication data 52 is the service providing device second authentication data. It is data, and the second authentication information for control device 520 is the second authentication information for service providing device.

  The center server device 2 can be realized by a general computer equipped with a CPU (Central Processing Unit) and a memory (not shown). At this time, the center server device 2 operates according to a program that causes the computer to function as each functional unit described above.

[Configuration of Control Device 4]
Next, the configuration of the control device 4 will be described with reference to FIG. 3, FIG. 9, and FIG.
As illustrated in FIG. 3, the control device 4 includes a control device storage unit 40, a control device authentication data acquisition unit 41, a control device first authentication information generation unit 42, and a control device authentication information collation unit 43. A service content output unit 44.

The control device storage unit 40 stores a control device authentication table 401 and a service content table 402.
As shown in FIG. 9, for example, the control device authentication table 401 includes a control device authentication data ID item D50, a control device first authentication data item D51, a start date and time item D52, and an end date and time item D53. Each data item is provided. The control device authentication data ID item D50 stores an identifier for specifying the control device first authentication data 51. The control device first authentication data item D51 stores the control device first authentication data 51. In this example, random numbers are stored. The start date / time item D52 and the end date / time item D53 store the validity period of the control device first authentication data 51, and are indicated by, for example, “year / month / day hour: minute: second”. It is assumed that registration is made on the assumption that the range of the validity period does not overlap with any control device first authentication data 51. In this example, the validity period is 10 days.

As shown in FIG. 10, for example, the service content table 402 includes data items of a date / time item D60, a power usage item D61, and a temperature item D62. The date and time item D60 stores the date and time when data is acquired for the service. The power usage amount item D61 stores the power usage amount of the equipment, such as a packaged air conditioner, acquired at the date and time. The temperature item D62 stores the room temperature acquired at the date and time.
The service content table 402 takes various forms depending on the content of services such as entrance / exit management, energy management, and equipment management.

Returning to FIG. 3, the description will be continued.
The control device authentication data acquisition unit 41 acquires the control device first authentication data 51 received from the center server device 2 and the validity period thereof, and the control device authentication table 401 of the control device storage unit 40 (see FIG. 9). To register. In addition, the control device authentication data acquisition unit 41 transmits registration success information to the center server device 2 when the registration is successful.
The first authentication information generation unit for control device 42 refers to the control device authentication table 401, and the authentication information generation time 61 included in the log-in information for control device to be described later is a range between the start date / time item D52 and the end date / time item D53. The control device first authentication data 51 is acquired. Further, the control device first authentication information generation unit 42 acquires the control device login information from the client device 3, and obtains the control device first authentication data 51 and the control device ID included in the control device login information. The first authentication information 510 for the control device is generated by generating a random number using the set as random seed data.

When generating the second authentication information for control device 520, instead of or in addition to the control device ID, as the random seed data, among the authentication information generation time 61, the user information 62, and the control device access destination When one or more are used, when generating the first authentication information for control device 510, the same information is acquired from the login information for control device and used as random seed data.
When the control device second authentication data 52 is directly used as the control device second authentication information 520, the control device first authentication data 51 is used as the control device first authentication information 510 as it is.

The control device authentication information collating unit 43 collates the control device first authentication information 510 and the control device second authentication information 520 to determine whether or not they match. If they match, authentication is successful.
If the authentication is successful, the service content output unit 44 refers to the service content table 402 (see FIG. 10), acquires the service content, and outputs the service content to the client device 3.

In the present specification and the like, the control device first authentication information 510 is the service providing device first authentication information.
The control device 4 can be realized by a general computer equipped with a CPU and a memory (not shown). At this time, the control device 4 operates according to a program that causes the computer to function as each functional unit described above.

[Configuration of Client Device 3]
Next, the configuration of the client device 3 will be described with reference to FIG.
As shown in FIG. 4, the client device 3 includes a center server device login unit 31, a service list display unit 32, a control device login information acquisition unit 33, a control device login unit 34, and a service content display unit 35. .

  The center server device login unit 31 displays a login screen for the user and transmits user information 62 input by the user to the center server device 2. The user information 62 is a user ID and user authentication information. At the time of login, in addition to the user ID, a barcode, a two-dimensional barcode, figure selection, capture, or the like may be used.

The service list display unit 32 displays the service list received from the center server device 2 and transmits the service ID of the service selected by the user to the center server device 2.
The control device login information acquisition unit 33 acquires control device login information from the center server device 2. The control device login information includes control device second authentication information 520, control device unique information 63 (control device ID, control device access destination), and authentication information generation time 61. In addition, when the user information 62 (user ID, user authentication information) is also added as random seed data when the control device second authentication information 520 is generated, the user information 62 is also included in the control device login information. included.

The control device login unit 34 refers to the control device access destination included in the acquired control device login information, and transmits the control device login information to the control device 4.
The service content display unit 35 displays the service content received from the control device 4. The service content display unit 35 displays the service content as a table or a graph, for example.

[Operation of Authentication Data Management System 1]
Next, the operation of the authentication data management system 1 will be described with reference to FIG.
Note that FIG. 11 is an overall flow, and shows the processing contents for a typical operation pattern. Moreover, since FIGS. 12-16 has shown the operation | movement flow of an individual apparatus, it has shown the processing content in detail rather than FIG.

As shown in FIG. 11, in step S <b> 101, the center server device 2 generates control device first authentication data 51.
In step S <b> 102, the center server device 2 transmits the control device first authentication data 51 to the control device 4.
In step S <b> 103, the control device 4 registers the control device first authentication data 51 in the control device storage unit 40.

In step S <b> 104, the client device 3 logs into the center server device 2.
In step S105, the center server device 2 authenticates the user.
In step S <b> 106, the center server device 2 generates the control device second authentication data 52 when the user authentication is successful.
In step S <b> 107, the center server device 2 further generates control device second authentication information 520 and transmits it to the client device 3.

In step S <b> 108, the client device 3 logs in the control device 4 after acquiring the second authentication information for control device 520.
In step S <b> 109, the control device 4 generates first control device authentication information 510.
In step S110, the control device 4 collates the first authentication information for control device 510 with the second authentication information for control device 520.
In step S <b> 111, the control device 4 outputs the service content to the client device 3.

[Operation of Center Server Device 2]
Next, operation | movement of the center server apparatus 2 is demonstrated with reference to FIG. 12, FIG. 13 (a structure is FIG. 2 suitably).
(Control device first authentication data pre-transmission process)
This processing is processing in which the center server device 2 generates the control device first authentication data 51 and transmits it to the control device 4 in advance. This process is periodically performed to periodically change the control device first authentication data 51.

  As shown in the flowchart of FIG. 12, in step S201, the center server device 2 initializes the control device first authentication data registration date / time item D42 in the control device table 204 (see FIG. 8). That is, the center server device 2 leaves all the control device first authentication data registration date and time items D42 in the control device table 204 blank. By doing so in advance, it is possible to discriminate later the control device 4 for which the new control device first authentication data 51 has not yet been registered.

  In step S202, the control device authentication data generation unit 22 refers to the center server device authentication table 203 (see FIG. 7), and the center server has a current time within the range of the start date / time item D32 and the end date / time item D33. The center server device authentication data 53 of the device authentication data item D31 is acquired. In addition, the control device authentication data generation unit 22 acquires the value α.

In the loop L203, the center server device 2 repeats the processing from step S204 to step S208 until new control device first authentication data 51 is registered in all the control devices 4. Further, the center server device 2 ends this loop process when the control device ID cannot be obtained because all the control device first authentication data registration date and time items D42 are not blank. This loop processing is performed because the control device first authentication data 51 may not be registered in the target control device 4 when the communication environment of the network 5 is poor.
In step S204, the control device authentication data generation unit 22 refers to the control device table 204 (see FIG. 8) and acquires the control device ID in which the control device first authentication data registration date and time item D42 is blank. To do. That is, the control device authentication data generation unit 22 acquires the control device ID of the control device 4 in which the control device first authentication data 51 is not registered.

In step S205, the control device authentication data generation unit 22 generates a random number using the set of the acquired center server device authentication data 53, the value α, and the control device ID as random seed data. Data 51 is generated.
In step S <b> 206, the control device authentication data generation unit 22 generates a valid period of the generated control device first authentication data 51.

In step S <b> 207, the control device authentication data transmission unit 23 transmits the control device first authentication data 51 and the validity period to the control device 4.
In step S208, the center server device 2 deletes the control device first authentication data 51 so as not to be held in the center server device 2.
When the center server device 2 receives the registration success information from the control device 4, the center server device 2 updates the control device first authentication data registration date / time item D42 in the control device table 204 (see FIG. 8) with the current time.
Thus, the control device first authentication data pre-transmission process ends.

(Second authentication information generation / transmission process for control device)
This processing is processing in which the center server device 2 generates the control device second authentication information 520 and transmits it to the client device 3. This process is performed when the user logs in to the center server device 2.

As shown in the flowchart of FIG. 13, in step S <b> 301, the user authentication unit 24 acquires user information 62.
In step S302, the user authentication unit 24 determines whether or not the user authentication is successful. That is, the user authentication unit 24 searches the user information table 201 (see FIG. 5) using the acquired user ID as a search key, and acquires user authentication data with the matching user ID. Then, the user authentication unit 24 determines whether or not the user authentication data matches the user authentication information. When the user authentication data matches the user authentication information, the user authentication is successful.

When the user authentication is not successful (No at Step S302), the center server device 2 ends the control device second authentication information generation / transmission processing as a login failure.
On the other hand, if the user authentication is successful (step S302: Yes), in step S303, the service list output unit 25 acquires a plurality of service IDs and service names from the service list table 202 (see FIG. 6), and the service Are output to the client apparatus 3 as a list of

In step S <b> 304, the control device ID acquisition unit 26 receives the service ID selected by the user on the client device 3.
In step S305, the control device ID acquisition unit 26 refers to the service list table 202 and acquires a control device ID corresponding to the acquired service ID.
In step S306, the control device authentication data generation unit 22 generates the control device second authentication data 52 (see the item “Generation Method of Control Device Second Authentication Information 520”).

In step S <b> 307, the control device second authentication information generation / transmission unit 27 generates an authentication information generation time 61.
In step S308, the control device second authentication information generation / transmission unit 27 includes the control device second authentication data 52 generated by the control device authentication data generation unit 22 and the control device ID acquired from the control device ID acquisition unit 26. By generating a random number using the set as random seed data, the second authentication information 520 for the control device is generated, and the client device together with the control device specific information 63 (control device ID, control device access destination) and the authentication information generation time 61 3 to send.

In step S309, the center server device 2 deletes the control device second authentication data 52 and the control device second authentication information 520 so as not to be held in the center server device 2.
Thus, the second authentication information generation / transmission process for the control device ends.

[Operation of Control Device 4]
Next, the operation of the control device 4 will be described with reference to FIGS. 14 and 15 (the configuration is shown in FIG. 3 as appropriate).
(Control device first authentication data pre-registration process)
This process is a process of periodically registering and changing the control device first authentication data 51 registered by the control device 4 in the control device authentication table 401 (see FIG. 9). This process is performed every time new control device first authentication data 51 is periodically received from the center server device 2.

As shown in the flowchart of FIG. 14, in step S 401, the control device authentication data acquisition unit 41 receives the control device first authentication data 51 from the center server device 2.
In step S402, the control device authentication data acquisition unit 41 registers the control device first authentication data 51 in the control device authentication table 401 (see FIG. 9).
In step S <b> 403, the control device authentication data acquisition unit 41 transmits registration success information to the center server device 2 when the registration is successful.
Thus, the control device first authentication data pre-registration process ends.

(Service content output processing)
In this process, when the user logs in to the control device 4, the control device 4 performs an authentication process.

As shown in the flowchart of FIG. 15, in step S <b> 501, the control device 4 acquires control device login information from the client device 3.
In step S502, the control device 4 determines whether or not the authentication information generation time 61 included in the control device login information is within a predetermined range from the current time. The predetermined range is appropriately set in advance in consideration of security.

If the authentication information generation time 61 is not within the predetermined range from the current time (No in step S502), login fails.
On the other hand, if the authentication information generation time 61 is within a predetermined range from the current time (Yes in step S502), in step S503, the first authentication information generation unit for control device 42 controls the first authentication information for control device 510. Is generated. That is, the first authentication information generation unit for control device 42 refers to the control device authentication table 401 (see FIG. 9), and the authentication information generation time 61 included in the login information for control device ends with the start date / time item D52. The control device first authentication data 51 of the control device first authentication data item D51 within the range of the date / time item D53 is acquired. Next, the control device first authentication information generation unit 42 generates a random number using the control device ID included in the control device login information and the acquired control device first authentication data 51 as random seed data. Then, the control device first authentication information 510 is generated.

  When the second authentication information for control device 520 is generated in step S308 (see FIG. 13), the authentication information generation time 61, the user information 62, or the control device access destination is added as random seed data. Since the control device login information includes these pieces of information, the control device first authentication information generation unit 42 generates the control device first authentication information 510 in addition to the random seed data. To do.

In step S504, the control device authentication information collating unit 43 collates the control device first authentication information 510 and the control device second authentication information 520 to determine whether or not they match. That is, it is a determination as to whether or not the authentication is successful.
If the authentication is not successful (step S504, No), the login fails.
On the other hand, when the authentication is successful (step S504: Yes), in step S505, the service content output unit 44 refers to the service content table 402 (see FIG. 10) and outputs the service content to the client device 3.
Thus, the service content output process ends.

[Operation of Client Device 3]
Next, the operation of the client apparatus 3 will be described with reference to FIG. 16 (configuration is appropriately shown in FIG. 4).
(Service content acquisition processing)
This process is a process in which the client device 3 acquires service contents from the control device 4.

As shown in the flowchart of FIG. 16, in step S <b> 601, the center server device login unit 31 transmits user information 62 (user ID and user authentication information) input by the user to the center server device 2.
In step S602, the center server apparatus login unit 31 determines whether or not the login to the center server apparatus 2 has been successful.
If the login is not successful (step S602, No), the login fails.
On the other hand, when the login is successful (step S602: Yes), the service list display unit 32 displays the service list received from the center server device 2 in step S603.

In step S <b> 604, the service list display unit 32 transmits the service ID of the service selected by the user to the center server device 2.
In step S <b> 605, the control device login information acquisition unit 33 acquires control device login information from the center server device 2. The control device login information includes control device second authentication information 520, control device unique information 63 (control device ID, control device access destination), and authentication information generation time 61. In addition, when the user information 62 (user ID, user authentication information) is also added as random seed data when the control device second authentication information 520 is generated, the user information 62 is also included in the control device login information. included.

In step S <b> 606, the control device login unit 34 refers to the control device access destination included in the acquired control device login information, and transmits the control device login information to the control device 4.
In step S607, the control device login unit 34 determines whether or not the login to the control device 4 has been successful.

If the login is not successful (No in step S607), the login fails.
On the other hand, if the login is successful (step S607: Yes), the service content display unit 35 displays the service content received from the control device 4 in step S608.
Thus, the service content acquisition process ends.

  According to the present embodiment, even if there is a large amount of the control device 4, the center server device 2 does not need a storage area for storing authentication data related to the control device 4, so that the center server device 2 can be constructed at low cost.

  By generating different control device first authentication data 51 for each control device 4, it is possible to prevent unauthorized authentication by another control device 4 based on the control device authentication data that has been acquired illegally. .

  By periodically changing the control device first authentication data 51, the control device authentication is performed on the communication path between the client apparatus 3 and the center server apparatus 2 or on the communication path between the client apparatus 3 and the control apparatus 4. When the data is acquired illegally, it is possible to prevent the control device 4 from performing unauthorized authentication using the control device authentication data acquired illegally.

  As mentioned above, although one Embodiment of this invention was described, this invention is not limited to this, It can change in the range which does not deviate from the meaning of this invention.

  In the embodiment of the present invention, the steps of the flowchart show an example of processing performed in time series according to the described order. However, the steps of the flowchart are not necessarily processed in time series, but are executed in parallel or individually. It also includes processing.

  In addition, various inventions can be formed by appropriately combining a plurality of components disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements over different embodiments may be appropriately combined.

1 Authentication data management system 2 Center server device (authentication server device)
3 Client device 4 Control device (service providing device)
5 Network 20 Center server device storage unit (authentication server device storage unit)
21 Center server device authentication data generation unit (authentication server device authentication data generation unit)
22 Control device authentication data generation unit (service providing device authentication data generation unit)
23. Data transmission unit for control device authentication (data transmission unit for service providing device authentication)
24 User Authentication Unit 25 Service List Output Unit 26 Control Device ID Acquisition Unit (Service Providing Device ID Acquisition Unit)
27 Second authentication information generation / transmission unit for control device (second authentication information generation / transmission unit for service providing device)
31 Center server device login section (authentication server device login section)
32 Service List Display Unit 33 Control Device Login Information Acquisition Unit (Service Providing Device Login Information Acquisition Unit)
34 Control device login unit (service providing device login unit)
35 Service Content Display Unit 40 Control Device Storage Unit (Service Providing Device Storage Unit)
41 Control device authentication data acquisition unit (service providing device authentication data acquisition unit)
42. First authentication information generating unit for control device (first authentication information generating unit for service providing device)
43. Authentication information verification unit for control device (authentication information verification unit for service providing device)
44 Service content output unit 50 Control device authentication data (service providing device authentication data)
51 Control device first authentication data (service providing device first authentication data)
52 Control device second authentication data (service providing device second authentication data)
53 Center server device authentication data (authentication server device authentication data)
61 Authentication information generation time 62 User information 63 Control device specific information (service providing device specific information)
201 User Information Table 202 Service List Table 203 Center Server Device Authentication Table (Authentication Server Device Authentication Table)
204 Control device table (service providing device table)
401 Control device authentication table (service providing device authentication table)
402 Service content table 510 First authentication information for control device (first authentication information for service providing device)
520 Second authentication information for control device (second authentication information for service providing device)
D10 User ID item D11 User authentication data item D20 Service ID item D21 Service name item D22 Control device ID item D30 Center server device authentication data ID item D31 Center server device authentication data item D32 Start date and time item D33 End date and time item D40 Control Device ID item D41 Control device access destination item D42 Control device first authentication data registration date / time item D43 Center server device authentication data ID item D50 Control device authentication data ID item D51 Control device first authentication data item D52 Start date / time item D53 End date / time item D60 Date / time item D61 Power consumption item D62 Temperature item

Claims (14)

An authentication data management system in which one or more service providing devices that provide services to a user via a client device and an authentication server device that processes authentication information related to the one or more service providing devices are interconnected by a network There,
The authentication server device
The service providing device first authentication data, which is data for authentication in the service providing device, is generated using service providing device specific information that is different for each service providing device, and the service providing device first authentication data is generated. And transmitting to the service providing device indicated by the service providing device specific information used when generating the service providing device first authentication data,
The service providing apparatus includes:
Registering the service providing device first authentication data received from the authentication server device in a service providing device storage unit;
The authentication server device
The user information of the user is acquired and the user authentication process is performed. When the user authentication is successful, the service providing apparatus specific information determined based on the service specified by the user is used. Service providing apparatus second authentication data, which is data for authentication in the service providing apparatus, is generated, service authentication apparatus second authentication information is generated using the service providing apparatus second authentication data, and the service provision is performed. Sending device second authentication information to the client device;
The service providing apparatus includes:
When the user receives the service provision via the client device, when receiving the second authentication information for the service providing device transmitted by the client device, the received second authentication information for the service providing device and An authentication data management system characterized by collating the service providing device first authentication information generated using the service providing device first authentication data received and registered in advance from the authentication server device. The authentication server device prevents the service providing device first authentication data from being held in the authentication server device after transmitting the service providing device first authentication data to the service providing device, and the service providing device. The second authentication information for service is transmitted to the client device, and the second authentication data for service providing device and the second authentication information for service providing device are not held in the authentication server device. 2. The authentication data management system according to 1. The authentication server device periodically generates the service providing device first authentication data different from the previous time, and the service providing device receives and registers the service providing device first authentication data. The authentication data management system according to claim 1 or 2. The authentication server device generates the service providing device first authentication data using the service providing device specific information and the authentication server device authentication data generated in the authentication server device, and the user The service providing device second authentication data is generated using the service providing device specific information determined based on the identified service and the authentication server device authentication data. The authentication data management system according to claim 3. The authentication data management system according to claim 4, wherein the authentication server device periodically generates the authentication server device authentication data different from the previous one. The authentication data management system according to any one of claims 1 to 5, wherein the service providing apparatus stores a plurality of data for the service providing apparatus first authentication having different validity periods. The authentication data management system according to claim 4 or 5, wherein the authentication server device stores a plurality of authentication server device authentication data having different validity periods. The authentication server device is determined based on the authentication information generation time, which is the current time of the authentication server device, the user information, and the service specified by the user, in addition to the service providing device second authentication data. The service providing device second authentication information is generated using at least one of the service providing device specific information, and the service providing device second authentication information and the authentication information used at the time of generation are generated. Transmitting at least one of the generation time, the user information, and the service providing apparatus specific information to the client apparatus;
The service providing apparatus includes:
When the user receives provision of the service via the client device, the second authentication information for the service providing device transmitted by the client device, the authentication information generation time, the user information, and the service providing device specific When receiving at least one of the information, the service providing device first authentication data received and registered in advance from the authentication server device, the authentication information generation time received from the client device, and the user Information and at least one of the service providing device specific information are used to generate first authentication information for the service providing device, the second authentication information for the service providing device, and the first authentication for the service providing device. The authentication data according to any one of claims 1 to 7, wherein information is collated. Data management system. In an authentication data management system in which one or more service providing devices that provide services to a user via a client device and an authentication server device that processes authentication information related to the one or more service providing devices are interconnected by a network An authentication data management method,
The authentication server device is
The service providing device first authentication data, which is data for authentication in the service providing device, is generated using service providing device specific information that is different for each service providing device, and the service providing device first authentication data is generated. A service providing device first authentication data transmission step for transmitting to the service providing device indicated by the service providing device specific information used when generating the service providing device first authentication data;
The service providing device is
A service providing apparatus first authentication data registration step of registering the service providing apparatus first authentication data received from the authentication server apparatus in a service providing apparatus storage unit;
The authentication server device is
The user information of the user is acquired and the user authentication process is performed. When the user authentication is successful, the service providing apparatus specific information determined based on the service specified by the user is used. Service providing apparatus second authentication data, which is data for authentication in the service providing apparatus, is generated, service authentication apparatus second authentication information is generated using the service providing apparatus second authentication data, and the service provision is performed. A service providing device second authentication information transmitting step of transmitting device second authentication information to the client device;
The service providing device is
When the user receives the service provision via the client device, when receiving the second authentication information for the service providing device transmitted by the client device, the received second authentication information for the service providing device and A collating step of collating the service providing device first authentication information generated using the service providing device first authentication data received and registered in advance from the authentication server device;
An authentication data management method comprising: In an authentication data management system in which one or more service providing devices that provide services to a user via a client device and an authentication server device that processes authentication information related to the one or more service providing devices are interconnected by a network An authentication server device,
When service-providing device first authentication data, which is data for authentication in the service-providing device, is generated using service-providing device-specific information that is different for each service-providing device, and the user is successfully authenticated Further, a service providing apparatus that generates data for service providing apparatus second authentication, which is data for authentication in the service providing apparatus, using the service providing apparatus specific information determined based on the service specified by the user A data generator for authentication;
A service providing apparatus authentication data transmitting unit that transmits the service providing apparatus first authentication data to the service providing apparatus indicated by the service providing apparatus specific information used when generating the service providing apparatus first authentication data. When,
A user authentication unit that acquires user information of the user and performs authentication processing of the user;
The service providing device second authentication information is generated using the service providing device second authentication data, and the service providing device second authentication information is generated and transmitted to the client device. And
An authentication server device comprising: After the service providing device first authentication data is transmitted to the service providing device, the service providing device first authentication data is not held in the authentication server device, and the service providing device second authentication information is stored in the authentication server device. The authentication server device according to claim 10, wherein after the transmission to the client device, the control device second authentication data and the service providing device second authentication information are not held in the authentication server device. . In an authentication data management system in which one or more service providing devices that provide services to a user via a client device and an authentication server device that processes authentication information related to the one or more service providing devices are interconnected by a network The computer of the authentication server device
When service-providing device first authentication data, which is data for authentication in the service-providing device, is generated using service-providing device-specific information that is different for each service-providing device, and the user is successfully authenticated Further, a service providing apparatus that generates data for service providing apparatus second authentication, which is data for authentication in the service providing apparatus, using the service providing apparatus specific information determined based on the service specified by the user Authentication data generator,
A service providing apparatus authentication data transmitting unit that transmits the service providing apparatus first authentication data to the service providing apparatus indicated by the service providing apparatus specific information used when generating the service providing apparatus first authentication data. ,
A user authentication unit that acquires user information of the user and performs authentication processing of the user;
The service providing device second authentication information is generated using the service providing device second authentication data, and the service providing device second authentication information is generated and transmitted to the client device. Part,
Authentication server processing program to function as In an authentication data management system in which one or more service providing devices that provide services to a user via a client device and an authentication server device that processes authentication information related to the one or more service providing devices are interconnected by a network A service providing device,
A service providing device storage unit for registering data for authentication;
A service providing device authentication information matching unit that performs authentication processing in the service providing device,
The authentication server device
The service providing device first authentication data, which is data for authentication in the service providing device, is generated using service providing device specific information that is different for each service providing device, and the service providing device first authentication data is generated. And transmitting to the service providing device indicated by the service providing device specific information used when generating the service providing device first authentication data,
The service providing device storage unit includes:
The service providing device first authentication data, which is data for authentication, is received from the authentication server device and registered,
The authentication server device
The user information of the user is acquired and the user authentication process is performed. When the user authentication is successful, the service providing apparatus specific information determined based on the service specified by the user is used. Service providing apparatus second authentication data, which is data for authentication in the service providing apparatus, is generated, service authentication apparatus second authentication information is generated using the service providing apparatus second authentication data, and the service provision is performed. Sending device second authentication information to the client device;
The service providing device authentication information verification unit
When the user receives the service provision via the client device, when receiving the second authentication information for the service providing device transmitted by the client device, the received second authentication information for the service providing device and A service providing apparatus that collates the service providing apparatus first authentication information generated by using the service providing apparatus first authentication data received and registered in advance from the authentication server apparatus. One or more service providing devices including a service providing device storage unit that registers data for authentication and an authentication server device that processes authentication information related to the one or more service providing devices are connected to each other via a network. The computer of the service providing apparatus in the authentication data management system
Function as an authentication information verification unit for a service providing apparatus that performs authentication processing in the service providing apparatus,
The authentication server device
The service providing device first authentication data, which is data for authentication in the service providing device, is generated using service providing device specific information that is different for each service providing device, and the service providing device first authentication data is generated. And transmitting to the service providing device indicated by the service providing device specific information used when generating the service providing device first authentication data,
The service providing device storage unit includes:
The service providing device first authentication data, which is data for authentication, is received from the authentication server device and registered,
The authentication server device
The user information of the user is acquired and the user authentication process is performed. When the user authentication is successful, the service providing apparatus specific information determined based on the service specified by the user is used. Service providing apparatus second authentication data, which is data for authentication in the service providing apparatus, is generated, service authentication apparatus second authentication information is generated using the service providing apparatus second authentication data, and the service provision is performed. Sending device second authentication information to the client device;
The client device is
When receiving the second authentication information for the service providing apparatus and logging in to the service providing apparatus, the second authentication information for the service providing apparatus is transmitted to the service providing apparatus,
The service providing device authentication information verification unit
The second authentication information for the service providing device is received and generated using the second authentication information for the service providing device and the service authentication device first authentication data received and registered in advance from the authentication server device. An authentication processing program characterized by collating with first authentication information for a service providing apparatus.

Images