JP2013085186A - Communication terminal and terminal control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To properly perform authentication of use authority of an application even when information stored in a subscriber authentication module has been changed.SOLUTION: A communication terminal 1 comprises: a storage unit 42 for storing application identification information of an application 10, first information for identifying a UIM card 20, and second information which is contracted for the first information or identifies the communication terminal 1, in association; a comparison unit 44 for, when the communication terminal 1 receives an authentication request for the application 10, comparing the first information and the second information stored in association with the application identification information of the application 10 by the storage unit 42, with first information and second information of the UIM card 20 attached to the communication terminal 1, respectively; and a determination unit 46 for determining whether a subscriber who possesses the UIM card 20 has use authority of the application 10 on the basis of a determination result by the comparison unit 44.

Description

  The present invention relates to a communication terminal and a terminal control method.

  In recent years, with the enhancement of functions of communication terminals such as mobile phones, it is possible to download applications to the communication terminals and execute the applications on the communication terminals. In such a communication terminal, in order to prevent the use of the application by a user who does not have the right to use the application, authentication of the use right of the application is required.

  By the way, conventionally, as a method for determining whether or not to perform initialization in a mobile phone, first information stored in a SIM (Subscriber Identity Module) card, which is a subscriber authentication module attached to the communication terminal, and the communication terminal A method of comparing the second information already stored in the storage device is known (for example, Patent Document 1 below).

JP 2006-157913 A

  However, when the above method is adopted as an authentication method for use authority of an application in a communication terminal, there is a problem that authentication cannot be performed correctly. For example, when a SIM card is reissued because the SIM card breaks down or the SIM card is lost, the information stored in the reissued SIM card is the same as before This is different from the information stored in the SIM card. In that case, in the above method, information stored in the SIM card after reissuance attached to the communication terminal and information stored in the SIM card before reissuance already stored in the storage device of the communication terminal are stored. Authentication fails because they do not match. Therefore, in the above case, even a user who has the right to use an application cannot use the application.

  The present invention has been made to solve such a problem, and a communication terminal and terminal control that can appropriately authenticate use authority of an application even when information stored in a subscriber authentication module is changed. A method can be provided.

  In order to achieve the above object, the communication terminal according to the present invention is capable of performing mobile communication by mounting a subscriber authentication module, and also includes application identification information for identifying an application operating on the terminal. A communication terminal having storage means for storing the first information for identifying the subscriber authentication module and the second information for which the first information is contracted or for identifying the terminal, When there is an authentication request for an application, the storage means stores the first information and the second information stored in association with the application identification information of the application, and the subscriber authentication module attached to the terminal. Comparing means for comparing the first information and the second information respectively, and comparing the first information and the second information by the comparing means. If it is determined that they do not match, it is determined that the subscriber who owns the subscriber authentication module does not have the right to use the application, and at least one of the first information and the second information is determined by the comparing means. And determining means for determining that the subscriber has the right to use the application when it is determined that they match.

  In the communication terminal according to the present invention, when there is an authentication request for an application operating on the terminal, the first information and the second information stored in association with the application identification information of the application are stored by the storage unit. The first information and the second information stored in the subscriber authentication module attached to the terminal are respectively compared. When it is determined that the first information and the second information do not match, it is determined that the subscriber who owns the subscriber authentication module does not have the right to use the application. Further, when it is determined that at least one of the first information and the second information matches, it is determined that the subscriber has the right to use the application. Therefore, according to the communication terminal according to the present invention, for example, the first information and the second information stored in the subscriber authentication module are stored in advance by the storage means, and thereafter the first information stored in the subscriber authentication module is stored. If both the information and the second information are not changed, it is determined in the comparison that both the first information and the second information match, so the subscriber is determined to have the right to use the application, and the application User authority can be properly authenticated. On the other hand, for example, the first information and the second information stored in the subscriber authentication module are stored in advance by the storage means, and thereafter either the first information or the second information stored in the subscriber authentication module is stored. If it is changed, it is determined in the comparison that the first information and the second information that have not been changed match, so it is determined that the subscriber has the right to use the application, and authentication of the right to use the application is verified. Can be done appropriately.

  In the communication terminal according to the present invention, when it is determined by the comparing means that only the first information does not match, the first information stored by the storage means is stored in the subscriber authentication module attached to the terminal. If the comparison unit determines that only the second information does not match, the second information stored in the storage unit is transferred to the subscriber authentication module attached to the own terminal. It is desirable to further comprise update means for overwriting and updating with the stored second information. According to this configuration, when it is determined that the subscriber has the right to use the application, the first information and the second information stored in the storage unit are stored in the subscriber authentication module attached to the terminal. The first information and the second information are equal to each other. Therefore, even if one of the first information and the second information stored in the subscriber authentication module attached to the terminal is changed thereafter, the first information and the second information are changed in the comparison. Since it is determined that the information that has not been matched, the subscriber is determined to have the right to use the application, and the application usage right can be appropriately authenticated.

  When the application is successfully downloaded to the own terminal, the storage means includes application identification information of the application, first information stored in a subscriber authentication module attached to the own terminal, and the subscriber authentication. It is desirable to store the second information stored in the module in association with each other. According to this configuration, when the application is successfully downloaded to the terminal, the first information and the second information stored in the storage unit are stored in the subscriber authentication module attached to the terminal. The first information and the second information are equal. In general, it is appropriate to determine that the subscriber who owns the subscriber authentication module installed when the application is downloaded has the right to use the application. That is, according to the present embodiment, it is possible to appropriately authenticate use authority of the application.

  When executing the application for the first time on the own terminal, the storage means stores the application identification information of the application, the first information stored in the subscriber authentication module attached to the own terminal, and the subscriber authentication module. It is desirable to store the second information stored in association with each other. According to this configuration, when the application is executed for the first time in the own terminal, the first information and the second information stored in the storage unit are stored in the subscriber authentication module attached to the own terminal. It becomes equal to 1 information and 2nd information, respectively. In general, it is appropriate to determine that the subscriber who owns the subscriber authentication module installed when the application is executed for the first time has the right to use the application. That is, according to the present embodiment, it is possible to appropriately authenticate use authority of the application.

  By the way, the present invention can be described as an invention of a communication terminal as described above, and can also be described as an invention of a terminal control method as follows. This is substantially the same invention only in different categories, and has the same operations and effects.

  That is, the terminal control method according to the present invention is capable of performing mobile communication by mounting a subscriber authentication module, application identification information for identifying an application operating on the terminal, and the subscriber authentication module. A terminal control method by a communication terminal having storage means for storing the first information for identifying and the second information for which the first information is contracted or for identifying the own terminal, Stored in the subscriber authentication module attached to the terminal and the first information and the second information stored in association with the application identification information of the application by the storage means. A comparison step for comparing the first information and the second information respectively, and the first information and the second information in the comparison step If it is determined that each of the information does not match, it is determined that the subscriber who owns the subscriber authentication module does not have the right to use the application, and at least for each of the first information and the second information in the comparison step A determination step of determining that the subscriber has the right to use the application when it is determined that the two match.

  According to the present invention, even when the information stored in the subscriber authentication module is changed, it is possible to appropriately authenticate the usage authority of the application.

It is a figure which shows the function structure of the communication terminal which concerns on embodiment of this invention. It is a table which shows matching with the package name of application, 1st information, and 2nd information. It is a figure which shows the hardware constitutions of the communication terminal which concerns on embodiment of this invention. It is a flowchart which shows the process (terminal control method) performed with the communication terminal which concerns on embodiment of this invention. It is a flowchart which shows another example of the process (terminal control method) performed with the communication terminal which concerns on embodiment of this invention.

  Hereinafter, preferred embodiments of a communication terminal and a terminal control method according to the present invention will be described in detail with reference to the drawings. In the description of the drawings, the same elements are denoted by the same reference numerals, and redundant description is omitted.

  FIG. 1 shows a communication terminal 1 according to this embodiment. The communication terminal 1 is a mobile phone terminal capable of performing mobile communication by mounting a UIM (User Identity Module) card 20 which will be described later as a subscriber authentication module. As illustrated in FIG. 1, the communication terminal 1 includes an application 10, a UIM card 20, an OS framework 30, and an application management unit 40. The communication terminal 1 may have a function as a mobile phone terminal, for example, in addition to the above-described components.

  The application 10 is a software application that operates on the communication terminal 1. The application 10 is downloaded to the communication terminal 1 from an external server or the like using mobile communication by the communication terminal 1. In the communication terminal 1, a plurality of applications 10 can be stored and executed. Among the applications 10, there is an application 10 that requests authentication of a usage right for executing the application 10. An application developer or the like can specify for each application 10 whether or not to request authentication of usage authority and when to request authentication of usage authority. The triggers for the application 10 requesting authentication of usage rights include the time when the application 10 is executed for the first time, when a specific operation is received from the user during the execution of the application 10, and a preset time.

  The UIM card 20 is a subscriber authentication module such as a UIM card or a SIM card. The UIM card 20 stores first information for identifying the UIM card 20 and second information for contracting with the first information or identifying the communication terminal 1. Specific examples of the first information include IMSI (International Mobile Subscriber Identity) and ICCID (Integrated Circuit Card Identifier). Specific examples of the second information include MSN (Mobile Subscriber Number) and IMEI (International Mobile Equipment). Identity). The first information and the second information are also used as information for specifying individual subscribers. The subscriber who owns the UIM card 20 changes the second information contracted with respect to the first information of the UIM card 20 by applying to a company that provides mobile communication, By attaching the UIM card 20 to a different communication terminal, the existing second information of the UIM card 20 can be changed to the second information for identifying the different communication terminal. It can be issued and changed to the new first information UIM card 20 of the same second information.

  The OS framework 30 is a software framework provided by an OS (Operating System) executed on the communication terminal 1. Software operating on the OS executed on the communication terminal 1, for example, an application management unit 40 described later, stores information in the UIM card 20 via the OS framework 30, and reads information from the UIM card 20. can do. In principle, the OS framework 30 reads information stored in the UIM card 20 without error when reading information from the UIM card 20, but due to an attack on the OS framework 30 by a terminal user or the like. It is not required to completely eliminate the risk of causing the application management unit 40 to erroneously transmit the first information and the second information different from the information recorded in the UIM card 20, that is, misleading.

  The application management unit 40 is software that manages the application 10. As shown in FIG. 1, the application management unit 40 includes a download unit 41, a storage unit 42, an authentication request acquisition unit 43, a comparison unit 44, an update unit 45, a determination unit 46, and a control unit 47. It is prepared for. The application management unit 40 preferably performs obfuscation or the like so that the logic is not easily deciphered by reverse engineering or the like by an attacker.

  The main components of the communication terminal 1 have been described above. Next, details of each component of the application management unit 40 illustrated in FIG. 1 will be described.

  The download unit 41 is a download unit that downloads the application 10 to the communication terminal 1. Specifically, when receiving a specific operation from a user or the like, the download unit 41 downloads the application 10 from an external server or the like via mobile communication using the communication terminal 1. Then, when the download of the application 10 is successful, the download unit 41 outputs the package name of the application 10 that is application identification information for identifying the application 10 to the storage unit 42.

  When the download of the application 10 to the communication terminal 1 is successful, the storage unit 42 stores the package name of the application 10, the first information stored in the UIM card 20 attached to the communication terminal 1, It is a storage means for storing the second information stored in the UIM card 20 in association with the first information or identifying the communication terminal 1 in association with each other. Specifically, when the download of the application 10 by the download unit 41 is successful and the package name of the application 10 is input from the download unit 41, the storage unit 42 is attached to the communication terminal 1 via the OS framework 30. The first information and the second information stored in the UIM card 20 are acquired. Then, the storage unit 42 stores the package name of the application 10 input from the download unit 41 and the first information and the second information acquired from the UIM card 20 in association with each other. The storage unit 42 can acquire a set (entry) of the package name, first information, and second information of the application 10 stored in association with each other using the package name of the application 10 as a key.

  FIG. 2 is a diagram illustrating a table including a plurality of entries stored by the storage unit 42. As illustrated in FIG. 2, the storage unit 42 includes the package name of the application 10, the first information stored in the UIM card 20 attached to the communication terminal 1 when the download of the application 10 is successful, and the second information. Information is stored in association with each other.

  In addition, although the memory | storage part 42 demonstrated that an entry was memorize | stored when the download of the application 10 to the communication terminal 1 was successful, the opportunity to memorize | store is not restricted to this. For example, the storage unit 42 may store the entry when the application 10 is installed in the communication terminal 1, when the application 10 is executed for the first time, at a preset time, when the user manually inputs, and the like. . In addition, when storing an entry, the storage unit 42 may overwrite and store an entry that already contains the same package name. Further, when the application 10 is deleted from the communication terminal 1, the storage unit 42 does not necessarily need to delete the entry corresponding to the application 10 stored in the storage unit 42. Further, the storage unit 42 does not delete the entry stored in the storage unit 42 by the user data deletion function which is a function of the OS framework 30.

  The storage unit 42 preferably performs access control so that reading and writing can be performed only based on an instruction from the application 10. Furthermore, even when the access control is invalidated by some means, the storage unit 42 is concealed (encrypted) so that the stored information such as the first information and the second information is not stolen. It is preferable to carry out. Further, it is preferable that the storage unit 42 has a tampering detection mechanism so that an illegal entry is given by falsification of the stored entry and authentication of the application 10 does not perform an erroneous operation. Note that the tamper detection mechanism uses conventional tamper detection technology.

  The authentication request acquisition unit 43 is an authentication request acquisition unit that acquires an authentication request for executing the application 10 from the application 10. When the authentication request acquisition unit 43 acquires the authentication request of the application 10, the authentication request acquisition unit 43 outputs the package name of the application 10 to the comparison unit 44.

  The comparison unit 44 is attached to the communication terminal 1 with the first information and the second information stored in association with the application identification information of the application 10 by the storage unit 42 when there is an authentication request for the application 10. It is a comparison means for comparing the first information and the second information stored in the UIM card 20 being stored. Specifically, when the package name of the application 10 is input from the authentication request acquisition unit 43 that has acquired the authentication request of the application 10, the comparison unit 44 first associates the package name with the input package name of the application 10. The first information and the second information stored in the storage unit 42 are acquired. Subsequently, the comparison unit 44 acquires first information and second information stored in the UIM card 20 attached to the communication terminal 1 via the OS framework 30. Then, the comparison unit 44 determines whether or not the first information stored as described above and stored in the storage unit 42 matches the first information stored in the UIM card 20. Further, the comparison unit 44 determines whether or not the second information stored as described above and stored in the storage unit 42 matches the second information stored in the UIM card 20.

  The comparison unit 44 may determine whether or not the second information matches after determining whether or not the first information matches, or whether or not the second information matches. It may be determined whether or not the first information matches after the determination. Then, the comparison unit 44 outputs the determination result as to whether or not the first information and the second information match each other to the update unit 45 and the determination unit 46 described later.

  When the comparison unit 44 determines that only the first information does not match, the update unit 45 stores the first information stored in the storage unit 42 in the UIM card 20 attached to the communication terminal 1. The second information stored in the storage unit 42 is replaced with the UIM card 20 attached to the communication terminal 1 when the comparison unit 44 determines that only the second information does not match. Updating means for overwriting and updating with the second information stored in. Specifically, when the determination result “first information does not match and second information matches” is input from the comparison unit 44, the update unit 45 is attached to the communication terminal 1 via the OS framework 30. The first information stored in the UIM card 20 is acquired, and the first information stored in the storage unit 42 is overwritten and updated using the acquired first information. Here, as described above, the first information stored in the storage unit 42 to be overwritten and updated is stored in the storage unit 42 in association with the package name of the application 10 for which the authentication request has been made. Information. In addition, when the determination result “first information matches, second information does not match” is input from the comparison unit 44, the update unit 45 receives the UIM attached to the communication terminal 1 via the OS framework 30. The second information stored in the card 20 is acquired, and the second information stored in the storage unit 42 is overwritten and updated using the acquired second information. Here, the second information stored in the storage unit 42 to be overwritten and updated is the second information stored in the storage unit 42 in association with the package name of the application 10 for which the authentication request has been made, as described above. Information.

  The determination unit 46 determines that the subscriber who owns the UIM card 20 does not have the right to use the application 10 when the comparison unit 44 determines that the first information and the second information do not match. When the comparison unit 44 determines that at least one of the first information and the second information matches, the determination unit determines that the subscriber has the right to use the application 10. Specifically, when the determination result “first information does not match, second information does not match” is input from the comparison unit 44, the determination unit 46 uses the application 10 to the subscriber who owns the UIM card 20. Judge that there is no right. In addition, the determination unit 46 determines whether the first information matches, the second information does not match, the first information does not match, the second information matches, and the first information matches, the second information If any of the determination results “matched” is input, it is determined that the subscriber who owns the UIM card 20 has the right to use the application 10.

  Note that the determination unit 46 cannot acquire the first information or the second information stored in the UIM card 20 attached to the communication terminal 1 via the OS framework 30 by the comparison unit 44, or the UIM When the card 20 is not attached to the communication terminal 1, it is determined that there is no right to use the application 10. Further, when the determination unit 46 detects that the value stored in the UIM card 20 attached to the communication terminal 1 has been tampered with, the right to use the application 10 regardless of the determination result by the comparison unit 44. Judge that there is no. Here, the tampering detection by the determination unit 46 uses a conventional tampering detection technique. Then, the determination unit 46 outputs a determination result regarding the usage right to the control unit 47.

  The control unit 47 is a control unit that controls the operation of the communication terminal 1 based on the determination result by the determination unit 46. Specifically, when the determination result that “the user has the right to use the application 10” is input from the determination unit 46, the control unit 47 permits the execution of the application 10 and actually executes the application 10. On the other hand, when the determination result “no use right of application 10” is input from the determination unit 46, the control unit 47 prohibits the execution of the application 10 and actually stops the execution of the application 10. Further, the control unit 47 may output the content of the determination result input from the determination unit 46 to the display 106 or the like. The control unit 47, for example, includes a dialog box including text such as “Authentication of this application failed. Check if you have the right to use this application.” Or “Authentication of this application was successful.” May be displayed on the display 106. In addition, the control unit 47 may provide an API (Application Programming Interface) that returns the determination result by the determination unit 46 to the application 10. The above is the description of each component of the application management unit 40.

  FIG. 3 shows a hardware configuration of the communication terminal 1. As shown in FIG. 3, the communication terminal 1 includes a CPU (Central Processing Unit) 101, a RAM (Random Access Memory) 102 and a ROM (Read Only Memory) 103, which are main storage devices, an operation unit 104 which is an input device, and data. The wireless communication unit 105 that is a transmission / reception device, the display 106 that is an output device, and an antenna 107 are configured. When these components operate, the functions of the components of the communication terminal 1 shown in FIG. 1 are exhibited.

  Subsequently, processing (terminal control method) executed by the communication terminal 1 according to the present embodiment will be described using the flowcharts of FIGS. 4 and 5. FIG. 4 is a flowchart showing processing when the application 10 is downloaded, and FIG. 5 is a flowchart showing processing when an authentication request is made to the application 10.

  First, FIG. 4 will be described. In this process, first, the download unit 41 downloads the application 10 to the communication terminal 1 (S1). If the download is successful in S1, the storage unit 42 associates the package name of the downloaded application 10 with the first information and the second information stored in the UIM card 20 attached to the communication terminal 1. (S2). The above is the description of the processing shown in FIG.

  Next, FIG. 5 will be described. In this process, first, the authentication request acquisition unit 43 acquires an authentication request for the application 10 from the application 10 (S10). When the authentication request is acquired in S10, the comparison unit 44, the first information and the second information stored in the storage unit 42 in association with the package name of the application 10 that is the target of the authentication request, and the communication terminal The first information and the second information stored in the UIM card 20 attached to 1 are respectively compared (S11, comparison step). If it is determined in S11 that both the first information and the second information do not match (S12: YES), the determination unit 46 determines that there is no right to use the application 10 (S13, determination step).

  On the other hand, when it is determined in S11 that one of the first information and the second information matches (S12: NO, S14: YES), the determination unit 46 determines that there is a right to use the application 10 ( S15, determination step). And when it determines with only 1st information not matching in S11, the 1st information memorize | stored in the memory | storage part 42 is updated by the update part 45 by S15, UIM with which the communication terminal 1 is mounted | worn. It is overwritten and updated with the first information stored in the card 20 (S16). Further, when it is determined in S11 that only the second information does not match, the second information stored in the storage unit 42 is updated by the updating unit 45 after S15, and the UIM mounted on the communication terminal 1 is used. It is overwritten and updated with the second information stored in the card 20 (S16).

  On the other hand, if it is determined in S11 that both the first information and the second information match (S12: NO, S14: NO), the determination unit 46 determines that there is a right to use the application 10 (S17, Judgment step). The above is the description of the processing shown in FIG.

  As described above, in the present embodiment, when there is an authentication request for the application 10 running on the communication terminal 1 in the communication terminal 1, the storage unit 42 stores the authentication name in association with the package name of the application 10. The first information and the second information are compared with the first information and the second information stored in the UIM card 20 attached to the communication terminal 1, respectively. When it is determined that the first information and the second information do not match, it is determined that the subscriber who owns the UIM card 20 does not have the right to use the application 10. Further, when it is determined that at least one of the first information and the second information matches, it is determined that the subscriber has the right to use the application 10.

  Therefore, according to the present embodiment, for example, the first information and the second information stored in the UIM card 20 are stored in advance by the storage unit 42, and the first information and the second information stored in the UIM card 20 are stored thereafter. If both of the information are not changed, it is determined that both the first information and the second information match in the comparison, and therefore it is determined that the subscriber has the right to use the application 10. Thus, when both 1st information and 2nd information correspond, UIM card 20 concerning a subscriber at the time of having memorized the 1st information and 2nd information beforehand by storage part 42, 1st information, Since the UIM card 20 associated with the subscriber at the time of comparing the second information matches, it is appropriate to determine that the subscriber has the right to use the application 10. That is, according to the present embodiment, the use authority of the application 10 can be appropriately authenticated.

  On the other hand, in this embodiment, for example, the first information and the second information stored in the UIM card 20 are stored in advance by the storage unit 42, and thereafter the first information or the second information stored in the UIM card 20 is stored. When either one is changed, it is determined in the comparison that the information not changed in the first information and the second information matches, so that the subscriber is determined to have the right to use the application 10. As described above, when one of the first information and the second information matches, for example, the UIM card 20 is reissued when the UIM card 20 breaks down or the UIM card 20 is lost. The case where only is changed. Further, for example, the subscriber may use the same UIM card 20 and change only the second information. In such a case, the subscriber at the time when the first information and the second information are stored in the storage unit 42 in advance matches the subscriber at the time when the first information and the second information are compared. It is appropriate to determine that the person has the right to use the application 10. That is, according to the present embodiment, the use authority of the application 10 can be appropriately authenticated.

  Further, as in the present embodiment, when the comparison unit 44 determines that only the first information does not match, the first information stored in the storage unit 42 is used as the UIM card 20 attached to the communication terminal 1. If the comparison unit 44 determines that only the second information does not match, the second information stored in the storage unit 42 is attached to the communication terminal 1. And an update unit 45 that overwrites and updates the second information stored in the UIM card 20. According to this configuration, when it is determined that the subscriber has the right to use the application 10, the first information and the second information stored in the storage unit 42 are stored in the UIM card 20 attached to the communication terminal 1. Are equal to the first information and the second information stored in Therefore, even if either the first information or the second information stored in the UIM card 20 attached to the communication terminal 1 is changed thereafter, the first information and the second information are changed in the comparison. Since it is determined that the information that has not been matched, the subscriber is determined to have the right to use the application 10, and as described above, the use right of the application 10 can be appropriately authenticated.

  Further, as in this embodiment, when the application 10 is successfully downloaded to the communication terminal 1, the storage unit 42 stores the package name of the application 10 and the UIM card 20 attached to the communication terminal 1. The first information being stored may be stored in association with the second information stored in the UIM card 20. According to this configuration, when the application 10 is successfully downloaded to the communication terminal 1, the first information and the second information stored in the storage unit 42 are stored in the UIM card 20 attached to the communication terminal 1. The first information and the second information stored are equal to each other. In general, it is appropriate to determine that the UIM card 20 installed when the application 10 is downloaded or the subscriber who owns the UIM card 20 has the right to use the application 10. That is, according to the present embodiment, the use authority of the application 10 can be appropriately authenticated.

  Further, as in the present embodiment, when the application 10 is executed for the first time on the communication terminal 1, the storage unit 42 is stored in the package name of the application 10 and the UIM card 20 attached to the communication terminal 1. The first information and the second information stored in the UIM card 20 may be stored in association with each other. According to this configuration, when the application 10 is executed for the first time on the communication terminal 1, the first information and the second information stored in the storage unit 42 are stored in the UIM card 20 attached to the communication terminal 1. The first information and the second information are equal to each other. In general, it is appropriate to determine that the UIM card 20 that is installed when the application 10 is executed for the first time or the subscriber who owns the UIM card 20 has the right to use the application 10. That is, according to the present embodiment, it is possible to appropriately authenticate use authority of the application.

  As described above, in the communication terminal 1 according to the present embodiment, for example, even when only the first information is changed by reissuing the UIM card 20, or when only the second information is changed, the application 10 It is possible to properly authenticate usage rights. Therefore, the communication terminal 1 according to the present embodiment can provide a developer or the like of the application 10 with a method for easily preventing the user who does not have the right to use the application 10 from using the application 10.

  Here, it is assumed that whether or not the authentication function of the application 10 is used in the communication terminal 1 according to the present embodiment can be freely selected by the application developer, and the authentication function is uniformly used for the application 10. It is not assumed to be forced.

  In the communication terminal 1 according to the present embodiment, the authentication request acquisition unit 43, the comparison unit 44, the update unit 45, the determination unit 46, and the control unit 47 are authenticated by a plurality of applications 10 as long as the memory (RAM 102) permits. Requests can be obtained and processed in parallel.

  In the communication terminal 1 according to the present embodiment, the first information and the second information are used as the determination elements for authentication of the usage authority of the application 10, but the present invention is not limited to these. For example, in addition to the first information and the second information, in the comparison by the comparison unit 44 and the determination by the determination unit 46, the subscriber's e-mail address, the password entered by the subscriber himself, the subscriber's fingerprint, and the like You may use similarly to 1st information and 2nd information. That is, not only the two pieces of information of the first information and the second piece of information but also three or more pieces of information may be used as determination elements.

  Further, in the communication terminal 1 according to the present embodiment, it has been described that the control unit 47 may perform output to the display 106 and the like, but does not perform output to the display 106 and the like, and is included in the application management unit 40. It is also possible for all the components to take an embodiment without a user interface. Note that when the use authority of the application 10 is authenticated in the communication terminal 1 according to the present embodiment, communication from the communication terminal 1 to the outside does not occur.

  Further, in the communication terminal 1 according to the present embodiment, the application management unit 40 uses the “use authority authentication agent” that executes the use authority authentication and the use authority authentication agent for the application 10 that wants to perform the use authority authentication. It is provided in two parts: “Usage authority authentication library” that provides an interface for accessing. The usage authority authentication agent is a service (function) that operates independently of the usage authority authentication library. The usage authority authentication agent accepts a usage authority authentication request through a usage authority authentication library and interprocess communication (IPC). At this time, it is preferable that appropriate processing can be performed in parallel even if there are requests from a plurality of use authority authentication libraries at the same time. On the other hand, the usage authority authentication library is provided in the form of a library so that the application developer can incorporate and use it in the application 10 developed by himself / herself. The usage authority authentication library is activated when the usage authority authentication agent is not activated. The usage authority authentication library can make a usage authority authentication request by the usage authority authentication agent and the IPC and receive the result. In this embodiment, the use authority authentication agent corresponds to the download unit 41, the storage unit 42, the authentication request acquisition unit 43, the comparison unit 44, the update unit 45, the determination unit 46, and the control unit 47, and the authentication request acquisition unit 43 Obtain a usage authorization request from the usage authorization library.

DESCRIPTION OF SYMBOLS 1 ... Communication terminal, 10 ... Application, 20 ... UIM card, 30 ... OS framework, 40 ... Application management part, 41 ... Download part, 42 ... Memory | storage part, 43 ... Authentication request acquisition part, 44 ... Comparison part, 45 ... Update unit, 46 ... determination unit, 47 ... control unit.

Claims (5)

It is possible to perform mobile communication by mounting a subscriber authentication module, and also includes application identification information for identifying an application that operates on its own terminal, first information for identifying the subscriber authentication module, A communication terminal having storage means for storing the second information for contracting with one information or identifying the own terminal in association with each other;
When there is an authentication request for the application, the storage unit stores the first information and the second information stored in association with the application identification information of the application, and the subscription attached to the terminal. Comparison means for comparing the first information and the second information stored in the person authentication module,
If it is determined by the comparing means that the first information and the second information do not match, it is determined that the subscriber who owns the subscriber authentication module does not have the right to use the application, and the comparison A determination means for determining that the subscriber has a right to use the application when it is determined by the means that at least one of the first information and the second information matches,
A communication terminal comprising: When it is determined by the comparing means that only the first information does not match, the first information stored by the storage means is stored in the subscriber authentication module attached to the terminal. If the second information is overwritten with the first information and the comparison means determines that only the second information does not match, the second information stored in the storage means is replaced with the subscriber who is attached to the terminal. Update means for overwriting and updating the second information stored in the authentication module;
The communication terminal according to claim 1, further comprising: The storage means, when the application is successfully downloaded to the terminal, the application identification information of the application, and the first information stored in the subscriber authentication module attached to the terminal , Storing the second information stored in the subscriber authentication module in association with each other.
The communication terminal according to claim 1 or 2. The storage means, when executing the application for the first time on its own terminal, the application identification information of the application, the first information stored in the subscriber authentication module attached to the terminal, Storing the second information stored in the subscriber authentication module in association with each other;
The communication terminal as described in any one of Claims 1-3 characterized by the above-mentioned. It is possible to perform mobile communication by mounting a subscriber authentication module, and also includes application identification information for identifying an application that operates on its own terminal, first information for identifying the subscriber authentication module, It is a terminal control method by a communication terminal having a storage means for storing in association with second information that is contracted for one information or that identifies its own terminal,
When there is an authentication request for the application, the storage unit stores the first information and the second information stored in association with the application identification information of the application, and the subscription attached to the terminal. A comparison step of comparing the first information and the second information stored in the person authentication module,
If it is determined in the comparison step that the first information and the second information do not match, it is determined that the subscriber who owns the subscriber authentication module does not have the right to use the application, and the comparison If it is determined in the step that at least one of the first information and the second information matches, the determination step determines that the subscriber has the right to use the application;
A terminal control method including:

Images