JP2017017559A - Communication system and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a communication system and program that simplify an authentication procedure.SOLUTION: A communication system comprises: an authentication device positioned in a first network; and a management device positioned in a second network. The authentication device authenticates a first communication terminal positioned in the second network, by using a user ID; keeps a state in which the first communication terminal has logged in information provision service; and, by using an authenticated token that includes the user ID and has been transmitted to a second communication terminal, authenticates the second communication terminal.SELECTED DRAWING: Figure 5

Description

  The present invention relates to a communication system and a program.

There has been known a communication system that performs control so that a communication terminal located in an open network can view data in a closed network (see, for example, Patent Document 1).
[Prior art documents]
[Patent Literature]
[Patent Document 1] Japanese Patent No. 4551218

  It was desired to simplify the authentication procedure.

  According to the first aspect of the present invention, the authentication device includes an authentication device located in the first network and a management device located in the second network, and the authentication device authenticates the first communication terminal with the user ID, A terminal authentication unit that maintains a state in which the first communication terminal is logged into the information providing service; an authentication data generation unit that generates authentication data including a user ID, first key data, and second key data; Authentication data transmitting unit for transmitting data to the management device, a first key data transmitting unit for transmitting first key data to a first communication terminal located in the second network, and a second key from the first communication terminal A first key data receiving unit that receives data, a first key authentication propriety determining unit that determines whether authentication is possible based on the second key data and the authentication data received by the first key data receiving unit, and a first key Authentication is possible by the authentication enable / disable determination unit A first token transmission unit that transmits an authenticated token including a user ID to the management device, and an ID that receives a user ID included in the authenticated token from a second communication terminal located in the second network, if determined The second communication is performed when the receiving unit, the ID authentication propriety determining unit that determines whether authentication is possible based on the user ID and the authentication data received by the ID receiving unit, and the ID authentication propriety determining unit determine that authentication is possible. A communication connection establishment unit that establishes a communication connection with the terminal, and the management device receives the first key data from the second communication terminal and the authentication data storage unit that stores the authentication data received from the authentication device Second key data receiving unit, second key data receiving unit determining whether authentication is possible based on first key data received by second key data receiving unit, and authentication data stored in authentication data storage unit A second key data transmitting unit that transmits second key data to the second communication terminal and an authenticated token received from the authentication device when it is determined that authentication is possible by the determination unit and the second key authentication propriety determining unit A communication system is provided that includes a token receiver and a second token transmitter that transmits an authenticated token to a second communication terminal.

  The authentication apparatus may further include an encryption unit that encrypts the user ID using an encryption key, and the first token transmission unit includes the authentication including the user ID encrypted by the encryption unit. The ID token may be transmitted to the management device, the ID receiving unit may receive the encrypted user ID included in the authenticated token, and the ID authentication permission determination unit may be encrypted. The user ID can be decrypted, and if the decrypted user ID matches the user ID included in the authentication data generated by the authentication data generation unit, it is determined that authentication is possible. Good. The first token transmission unit may transmit the authenticated token including the user ID and address information of a relay device located in the first network to the management device, and the ID reception unit The user ID included in the authenticated token may be received from the second communication terminal via a relay device.

  The communication system further includes a terminal group registration unit that registers the first communication terminal authenticated by the user ID and the communication terminal authenticated by using the authenticated token including the user ID as a terminal group. Good. The communication system stores provider registration information including a plurality of provider information indicating each provider of data displayed by each of a plurality of communication terminals registered as the terminal group by the terminal group registration unit. A registration information storage unit, a designation information receiving unit for receiving designation information for designating the provider registration information from at least one of the plurality of communication terminals, and the plurality of communications in response to reception of the designation information. Providing each of the plurality of provider information to each of the plurality of communication terminals in order to display data provided by the provider indicated by the plurality of provider information included in the provider registration information on each of the terminals An original information transmission unit may be further provided.

  According to the 2nd aspect of this invention, the program for functioning a computer as said communication system is provided.

  It should be noted that the above summary of the invention does not enumerate all the necessary features of the present invention. In addition, a sub-combination of these feature groups can also be an invention.

An example of the communication environment of the information provision apparatus 100 is shown schematically. An example of the flow of processing by information providing device 100 is shown roughly. An example of a functional composition of information providing device 100 is shown roughly. An example of the flow of processing by information providing device 100 is shown roughly. An example of functional composition of token authentication part 110 is shown roughly. An example of a functional composition of management device 300 is shown roughly. An example of the flow of processing by information providing device 100 is shown roughly. An example of the functional configuration of the provider information processing unit 150 is schematically shown. An example of the provider registration information table 500 is shown schematically. An example of the flow of processing by information providing device 100 is shown roughly. An example of the flow of processing by information providing device 100 is shown roughly. An example of the flow of processing by information providing device 100 is shown roughly. An example of a functional configuration of the copy data processing unit 170 is schematically shown. An example of the flow of processing by relay device 200 is shown roughly. An example of functional composition of relay device 200 is shown roughly. An example of a functional composition of communication terminal 400 is shown roughly. The example of a display by the communication terminal 400 is shown schematically. The example of a display by the communication terminal 400 is shown schematically.

  Hereinafter, the present invention will be described through embodiments of the invention, but the following embodiments do not limit the invention according to the claims. In addition, not all the combinations of features described in the embodiments are essential for the solving means of the invention.

  FIG. 1 schematically shows an example of a communication environment of the information providing apparatus 100. In the present embodiment, the information providing apparatus 100 is connected to a network 10 that is a closed network. The information providing apparatus 100 supplies an information providing service 101 that provides information in the closed network to the communication terminal 400 connected to the network 50 that is an open network. The information providing apparatus 100 may be an example of a communication system.

  The network 10 is, for example, a corporate network in which access from an open network is restricted. The network 50 includes, for example, the Internet and a mobile phone communication network. The communication terminal 400 is, for example, a mobile phone such as a smartphone, a tablet terminal, and a PC (Personal Computer). The network 50 may be an example of a first network. The network 10 may be an example of a second network.

  In the present embodiment, a file server 12, a mail server 14, and a web server 16 are connected to the network 10. These are merely examples, and an arbitrary application server may be connected to the network 10. For example, in addition to the file server 12, the mail server 14, and the web server 16, a groupware server and a web database may be connected to the network 10. The electronic file managed by the file server 12, the mail data managed by the mail server 14, and the web data managed by the web server 16 may be an example of information provided by the information providing service 101. The file server 12, the mail server 14, and the web server 16 may be an example of a data storage device.

  In the present embodiment, the network 10 is connected to the network 50 via the router 20. The router 20 passes a connection request from the network 10 to the network 50 but does not pass a connection request from the network 50 to the network 10.

  The communication terminal 400 registered in the information providing service 101 and located in the network 50 establishes a communication connection with the information providing apparatus 100 via the relay apparatus 200 connected to the network 50. The information providing apparatus 100 provides data managed by the file server 12, the mail server 14, and the web server 16 to the communication terminal 400 that has established the communication connection via the relay apparatus 200. The relay device 200 and the information providing device 100 establish a communication connection between the communication terminal 400, the file server 12, the mail server 14, and the web server 16, and the communication terminal 400, the file server 12, and the mail server. 14 and the web server 16 may directly communicate with each other.

  The information providing service 101 supplied by the information providing apparatus 100 may provide information in the network 50 to the communication terminal 400. For example, after the information providing apparatus 100 and the communication terminal 400 establish a communication connection via the relay apparatus 200, the information providing apparatus 100 transmits data provided by a service located in the network 50 to the communication terminal 400. And provided via the relay device 200. The cloud service 52 and the cloud service 54 may be examples of services located in the network 50. The cloud service 52 and the cloud service 54 may be SaaS (Software as a Service), PaaS (Platform as a Service), IaaS (Infrastructure as a Service), or the like. The information providing apparatus 100 and the relay apparatus 200 establish a communication connection between the communication terminal 400, the cloud service 52, and the cloud service 54, and the communication terminal 400, the cloud service 52, and the cloud service 54 directly communicate with each other. May be executed.

  The information providing apparatus 100 according to the present embodiment may execute a token authentication function. The token authentication function may be a process of authenticating the communication terminal 400 that is not logged in to the information providing service 101 via the communication terminal 400 that is logged in to the information providing service 101. Further, the token authentication function may be processing for authenticating a communication terminal 400 that is not registered in the information providing service 101 via the communication terminal 400 that is logged in to the information providing service 101. The information providing apparatus 100 may execute the token authentication function in cooperation with the management apparatus 300 located in the network 50.

  The information providing apparatus 100 according to the present embodiment may execute an active bookmark function. The active bookmark function is registration of provider registration information including a plurality of provider information indicating a provider of each data displayed by each of a plurality of communication terminals 400 registered as a terminal group, and the provider When registration information is designated, the function may be such that data provided by a provider indicated by a plurality of provider information included in the provider registration information is displayed on a plurality of communication terminals 400.

  The information providing apparatus 100 according to the present embodiment may execute an inter-device clipboard function. The inter-device clipboard function may be a function of pasting data that has been copied in the communication terminal 400 to the outside of the communication terminal 400. The inter-device clipboard function is, for example, a function of pasting data that has been copied in one communication terminal 400 of the plurality of communication terminals 400 to another communication terminal 400 of the plurality of communication terminals 400.

  FIG. 2 schematically shows an example of the flow of processing by the information providing apparatus 100. FIG. 2 shows a process flow in which the information providing apparatus 100 establishes a communication connection with the communication terminal 400 registered in the information providing service 101.

  In step (step may be abbreviated as “S”) 202, communication terminal 400 transmits a connection request to relay device 200. The connection request may include a user ID for identifying a user who uses the communication terminal 400, a password, a terminal ID for identifying the communication terminal 400, and an information providing apparatus ID for identifying the information providing apparatus 100. In S204, the relay device 200 stores the received connection request.

  In S <b> 206, the information providing apparatus 100 confirms with the relay apparatus 200 whether or not a connection request for the information providing apparatus 100 is stored in the relay apparatus 200. The information providing apparatus 100 may intermittently check the connection request. For example, the information providing apparatus 100 performs connection request confirmation every second.

  In S <b> 208, the relay apparatus 200 transmits the connection request received from the communication terminal 400 to the information providing apparatus 100. When receiving a connection request confirmation from the information providing apparatus 100, the relay apparatus 200 determines whether or not a connection request including the information providing apparatus ID of the information providing apparatus 100 is stored. When the relay apparatus 200 stores a connection request including the information providing apparatus ID of the information providing apparatus 100, the relay apparatus 200 transmits the connection request to the information providing apparatus 100.

  In S210, the information providing apparatus 100 determines whether or not authentication is possible based on the connection request received in S208. The information providing apparatus 100 determines whether or not authentication is possible by checking whether or not the user ID, password, and terminal ID included in the connection request match data registered in advance.

  In S212, the information providing apparatus 100 transmits a connection execution request for executing communication connection with the communication terminal 400 to the relay apparatus 200 in response to the determination that authentication is possible in S210.

  In S214, the relay device 200 establishes a communication connection between the information providing device 100 and the communication terminal 400. For example, the relay device 200 uses the IP address and port number used for transmitting the connection execution request in S212 as the IP address and port number for identifying the logical line on the network 10 side, from the communication terminal 400 in S202. The communication connection between the information providing apparatus 100 and the communication terminal 400 is established by associating with the IP address and the port number used when transmitting the connection request.

  FIG. 3 schematically illustrates an example of a functional configuration of the information providing apparatus 100. The information providing device 100 includes an authentication information storage unit 102, a terminal authentication unit 103, a relay device confirmation unit 104, a communication connection establishment unit 105, a content management unit 106, a content provision unit 107, a token authentication unit 110, and a source information processing unit 150. And a copy data processing unit 170. Note that it is not essential that the information providing apparatus 100 includes all of these configurations.

  The authentication information storage unit 102 stores authentication information used to authenticate the communication terminal 400 that has transmitted the connection request. The authentication information may include a combination of a user ID, a password, and a terminal ID. The terminal ID may be any data as long as it can identify the plurality of communication terminals 400 registered in the information providing service 101. For example, the terminal ID is the MAC address of the communication terminal 400. The terminal ID may be data assigned by the information providing apparatus 100 when registering the communication terminal 400.

  The terminal authentication unit 103 determines whether or not the communication terminal 400 can be authenticated using the authentication information stored in the authentication information storage unit 102, and authenticates the communication terminal 400 when it is determined that authentication is possible. If it is determined that the authentication is not permitted, the terminal authentication unit 103 does not authenticate the communication terminal 400. The terminal authentication unit 103 manages the authenticated communication terminal 400 as being logged into the information providing service 101.

  The terminal authentication unit 103 according to the present embodiment can authenticate each of the plurality of communication terminals 400 with the same user ID and maintain a state in which the plurality of communication terminals 400 are logged into the information providing service 101. Accordingly, a user who owns a plurality of communication terminals 400 can log in to the information providing service 101 at the same time using a single user ID in the plurality of communication terminals 400.

  The relay device confirmation unit 104 intermittently confirms with the relay device 200 whether various requests transmitted from the communication terminal 400 to the information providing device 100 are stored in the relay device 200. For example, the relay device confirmation unit 104 periodically performs the confirmation. Further, the relay device confirmation unit 104 may perform the confirmation irregularly. The relay device confirmation unit 104 may be an example of a paste request confirmation unit.

  The communication connection establishment unit 105 establishes a communication connection with the communication terminal 400. The communication connection establishment unit 105 may establish a communication connection with the communication terminal 400 by transmitting a connection execution request to the relay device 200.

  The content management unit 106 manages content in the network 10 provided to the communication terminal 400. The content in the network 10 may be data stored in an application server connected to the network 10. Electronic file data stored in the file server 12, mail data stored in the mail server 14, and Web data stored in the web server 16 may be an example of content in the network 10. For example, when the content stored in the file server 12 is specified by the communication terminal 400 established by the communication connection establishment unit 105, the content management unit 106 receives the content from the file server 12 and stores it. To do. The content management unit 106 may manage content in the network 50 provided to the communication terminal 400. The content in the network 50 may be data managed by a service connected to the network 50. For example, the content in the network 50 is data provided by the cloud service 52 and the cloud service 54.

  The content providing unit 107 provides the content managed by the content management unit 106 to the communication terminal 400 in which the communication connection is established by the communication connection establishment unit 105. For example, when the content stored in the file server 12 is specified by the communication terminal 400, the content providing unit 107 transmits the content managed by the content management unit 106 to the communication terminal 400.

  The token authentication unit 110 executes a token authentication function. The token authenticating unit 110 is registered in the communication terminal 400 or the information providing service 101 that is not logged in to the information providing service 101 via the communication terminal 400 that is authenticated by the terminal authenticating unit 103 and logged in to the information providing service 101. The communication terminal 400 that has not been authenticated is authenticated.

  The provider information processing unit 150 executes an active bookmark function. The provider information processing unit 150 executes an active bookmark function for a plurality of communication terminals 400 authenticated by at least one of the terminal authentication unit 103 and the token authentication unit 110.

  The copy data processing unit 170 executes an inter-device clipboard function. The copy data processing unit 170 executes an inter-device clipboard function for a plurality of communication terminals 400 authenticated by at least one of the terminal authentication unit 103 and the token authentication unit 110.

  FIG. 4 schematically shows an example of the flow of processing by the information providing apparatus 100. FIG. 4 schematically shows a processing flow when the token authentication unit 110 of the information providing apparatus 100 executes the token authentication function. Here, a description will be given assuming that a state in which one user uses the communication terminal 402 and the communication terminal 404 and the communication terminal 402 is logged in to the information providing service 101 is a start state. As illustrated in FIG. 4, the communication terminal 402, the communication terminal 404, and the information providing apparatus 100 may communicate via the relay apparatus 200.

  In S402, the communication terminal 402 transmits a key data request for requesting a challenge key to the information providing apparatus 100. The challenge key may be an example of first key data.

  In S404, the information providing apparatus 100 generates key data in response to receiving the key data request. The information providing apparatus 100 may generate a challenge key and a response key. The response key may be an example of second key data.

  In S <b> 406, the information providing apparatus 100 generates authentication data for authenticating a communication terminal other than the communication terminal 402 and transmits it to the management apparatus 300. The information providing apparatus 100 may generate authentication data including the challenge key and the response key generated in S404 and the user ID used at the time of authentication by the communication terminal 402 that transmitted the key data request. The management device 300 stores the received authentication data.

  In S408, the information providing apparatus 100 transmits the challenge key generated in S404 to the communication terminal 402. The communication terminal 402 that has received the challenge key may notify the user that the challenge key has been received.

  In S410, the communication terminal 404 accesses the management apparatus 300. The users of the communication terminal 402 and the communication terminal 404 access the management apparatus 300 using the communication terminal 404 that is to log into the information providing service 101 after the key data request is transmitted by the communication terminal 402.

  In S <b> 412, the management apparatus 300 transmits a key acquisition instruction to the communication terminal 404. The communication terminal 404 shifts to a state of waiting for a challenge key in response to receiving the key acquisition instruction. The communication terminal 404 may shift to a reception standby state in which a challenge key is received via short-range wireless communication. Short-range wireless communication is, for example, other than wireless LAN (Local Area Network) such as Bluetooth (registered trademark), NFC (Near Field Communication), Wi-Fi (registered trademark) (Wireless Fidelity), optical communication, and wireless communication. For example, voice communication.

  In S <b> 414, the communication terminal 402 transmits a challenge key to the communication terminal 404. For example, the communication terminal 402 first searches for a communication terminal that has shifted to the reception standby state within the short-range wireless communication possible range. When a communication terminal that has shifted to the reception standby state is detected, a challenge key is transmitted to the communication terminal using the short-range wireless communication function.

  Here, although an example has been described in which the communication terminal 404 receives a challenge key from the communication terminal 402 via short-range wireless communication, the present invention is not limited thereto. The communication terminal 404 may accept an input of a challenge key from the user. For example, first, the communication terminal 402 displays the challenge key received in S408. Further, the communication terminal 404 displays an input screen for inputting a challenge key in response to receiving the key acquisition instruction in S412. Then, the user browses the challenge key displayed on the communication terminal 402 and inputs it to the communication terminal 404.

  In S416, the communication terminal 404 transmits the challenge key acquired in S414 to the management apparatus 300. In S418, the management apparatus 300 determines whether or not authentication is possible based on the challenge key received in S416 and the authentication data received in S406. When determining that the challenge key received in S416 matches the challenge key included in the authentication data, the management apparatus may determine that authentication is possible. When the management apparatus 300 determines that the authentication is not permitted, the management apparatus 300 may notify at least one of the communication terminal 402 and the communication terminal 404 that the authentication is not permitted.

  In S420, the management apparatus 300 transmits the response key included in the authentication data received in S406 to the communication terminal 404. In S422, the communication terminal 404 transmits a response key to the communication terminal 402 via short-range wireless communication.

  Here, although an example has been described in which the communication terminal 402 receives a response key from the communication terminal 404 via short-range wireless communication, the present invention is not limited thereto. The communication terminal 402 may accept input of a response key from the user. For example, first, the communication terminal 404 displays the response key received in S420. In addition, after the communication terminal 402 transmits the challenge key in S414, an input screen for inputting a response key is displayed. Then, the user browses the response key displayed on the communication terminal 404 and inputs it to the communication terminal 402.

  In S424, the communication terminal 402 transmits the response key acquired in S422 to the information providing apparatus 100. In S426, the information providing apparatus 100 determines whether or not authentication is possible based on the response key received in S424 and the response key generated in S404.

  If the information providing apparatus 100 determines that the response key received in S424 matches the response key generated in S404, the information providing apparatus 100 may determine that authentication is possible. When the information providing apparatus 100 determines that the authentication is not permitted, the information providing apparatus 100 may notify at least one of the communication terminal 402 and the communication terminal 404 that the authentication is not permitted.

  In S428, the information providing apparatus 100 generates an authenticated token and transmits it to the management apparatus 300. The information providing apparatus 100 may generate an authenticated token including the user ID used for authentication by the communication terminal 402 that transmitted the key data request and the address information of the relay apparatus 200. The information providing apparatus 100 may generate an authenticated token including an encrypted user ID encrypted using a prestored encryption key.

  In S430, the management apparatus 300 transmits the authenticated token received in S428 to the communication terminal 404. In S432, the communication terminal 404 refers to the address information of the relay device 200 included in the authenticated token received in S430, and transmits the encrypted user ID included in the authenticated token to the relay device 200.

  In S434, the information providing apparatus 100 determines whether or not authentication is possible based on the encrypted user ID received in S432 and the user ID included in the authentication data generated in S406. The information providing apparatus 100 may determine that authentication is possible when it is determined that the user ID obtained by decrypting the encrypted user ID matches the user ID included in the authentication data. When the information providing apparatus 100 determines that the authentication is not permitted, the information providing apparatus 100 may notify at least one of the communication terminal 402 and the communication terminal 404 that the authentication is not permitted.

  In S436, the information providing apparatus 100 transmits a connection execution request to the relay apparatus 200. In S438, the relay apparatus 200 establishes a communication connection between the information providing apparatus 100 and the communication terminal 404. As a result, the communication terminal 404 is logged into the information providing service 101 with the same user ID as the communication terminal 402. The terminal authentication unit 103 may authenticate the communication terminal 402 and the communication terminal 404 with the same user ID and maintain a state where both the communication terminal 402 and the communication terminal 404 are logged in to the information providing service 101.

  The information providing apparatus 100 may be an example of an authentication apparatus. Communication terminal 402 may be an example of the 1st communication terminal. The communication terminal 404 may be an example of a second communication terminal.

  FIG. 5 schematically illustrates an example of a functional configuration of the token authentication unit 110. The token authentication unit 110 includes a key data request reception unit 112, a key data generation unit 114, an authentication data generation unit 116, an encryption unit 118, an authentication data storage unit 120, a key data transmission unit 122, and an authentication data transmission unit 124. A key data receiving unit 126, a key authentication availability determination unit 128, a token transmission unit 130, an ID reception unit 132, an authentication availability determination unit 134, a communication connection establishment unit 136, and a terminal group registration unit 138. Note that the token authenticating unit 110 is not necessarily required to have all of these configurations.

  The key data request receiving unit 112 receives the key data request transmitted from the communication terminal 400. The key data request receiving unit 112 may receive a key data request via the relay device 200.

  The key data generation unit 114 generates key data in response to the key data request reception unit 112 receiving the key data request. The key data generation unit 114 may generate a challenge key and a response key.

  The authentication data generation unit 116 generates authentication data for authenticating the communication terminal 400 other than the communication terminal 400 that has transmitted the key data request. The authentication data may include a challenge key and a response key generated by the key data generation unit 114, and a user ID used at the time of authentication by the communication terminal 400 that transmitted the key data request.

  The encryption unit 118 encrypts the user ID used at the time of authentication by the communication terminal 400 that transmitted the key data request. The encryption unit 118 may encrypt the user ID using an encryption key stored in advance. For example, the encryption unit 118 encrypts the user ID using the session key. The authentication data generation unit 116 may generate authentication data including a challenge key and a response key, and the encrypted user ID encrypted by the encryption unit 118. The authentication data storage unit 120 stores the authentication data generated by the authentication data generation unit 116.

  The key data transmission unit 122 transmits the challenge key generated by the key data generation unit 114 to the communication terminal 400 that transmitted the key data request. The key data transmission unit 122 may transmit the challenge key to the communication terminal 400 that transmitted the key data request via the relay device 200. The key data transmission unit 122 may be an example of a first key data transmission unit. The authentication data transmission unit 124 transmits the authentication data generated by the authentication data generation unit 116 to the management apparatus 300.

  The key data receiving unit 126 receives a response key from the communication terminal 400 that has transmitted the key data request. The key data receiving unit 126 may be an example of a first key data receiving unit.

  The key authentication propriety determination unit 128 determines whether authentication is possible based on the response key received by the key data receiving unit 126 and the response key generated by the key data generation unit 114. The key authentication availability determination unit 128 determines that authentication is possible when it is determined that the response key received by the key data reception unit 126 matches the response key generated by the key data generation unit 114. The key authentication availability determination unit 128 may be an example of a first key authentication availability determination unit.

  The token transmission unit 130 transmits the authenticated token to the management apparatus 300 when the key authentication propriety determination unit 128 determines that authentication is possible. The token transmission unit 130 may be an example of a first token transmission unit. The ID receiving unit 132 receives the encrypted user ID from the communication terminal 400 other than the communication terminal 400 that transmitted the key data request.

  The authentication propriety determination unit 134 determines the authentication propriety based on the encrypted user ID received by the ID reception unit 132 and the user ID included in the authentication data generated by the authentication data generation unit 116. If it is determined that the encrypted user ID can be decrypted and the decrypted user ID matches the user ID included in the authentication data, the authentication propriety determination unit 134 determines that authentication is possible. If the encrypted user ID cannot be decrypted, and if it is determined that the decrypted user ID does not match the user ID included in the authentication data, the authentication propriety determination unit 134 determines that the authentication is not successful. The token authentication availability determination unit 134 may be an example of an ID authentication availability determination unit.

  The communication connection establishment unit 136 establishes a communication connection with the communication terminal 400 that has transmitted the encrypted user ID received by the ID reception unit 132 when the authentication determination unit 134 determines that authentication is possible. The communication connection establishment unit 136 may establish a communication connection with the communication terminal 400 that has transmitted the encrypted user ID by transmitting a connection establishment request to the relay device 200.

  The terminal group registration unit 138 registers the communication terminal 400 that transmitted the key data request received by the key data request reception unit 112 and the communication terminal 400 that the communication connection establishment unit 136 has established a communication connection in the same terminal group. .

  FIG. 6 schematically illustrates an example of a functional configuration of the management apparatus 300. The management apparatus 300 includes an authentication data reception unit 302, an authentication data storage unit 304, a terminal request reception unit 306, a key acquisition instruction transmission unit 308, a key data reception unit 310, a key authentication availability determination unit 312, and a key data transmission unit 314. A token receiving unit 316 and an ID transmitting unit 318. In addition, it is not essential that the management apparatus 300 includes all of these configurations.

  The authentication data receiving unit 302 receives the authentication data transmitted by the authentication data transmitting unit 124. The authentication data storage unit 304 stores the authentication data received by the authentication data receiving unit 302.

  Terminal request receiving unit 306 accepts access from communication terminal 400. The access from the communication terminal 400 is, for example, an authentication request. The access from the communication terminal 400 may be a key input page acquisition request. The key acquisition instruction transmission unit 308 transmits a key acquisition instruction to the communication terminal 400 when the terminal request reception unit 306 receives an access from the communication terminal 400.

  The key data receiving unit 310 receives a challenge key from the communication terminal 400 that the terminal request receiving unit 306 has accepted access to. The key data receiving unit 310 may be an example of a second key data receiving unit.

  The key authentication availability determination unit 312 determines whether authentication is possible based on the challenge key received by the key data reception unit 310 and the challenge key included in the authentication data stored in the authentication data storage unit 304. When it is determined that the challenge key received by the key data receiving unit 310 matches the challenge key included in the authentication data, the key authentication availability determination unit 312 may determine that authentication is possible. The key authentication availability determination unit 312 may be an example of a second key authentication availability determination unit.

  The key data transmission unit 314 accesses the response key included in the authentication data stored in the authentication data storage unit 304 by the terminal request reception unit 306 when the key authentication permission determination unit 312 determines that authentication is possible. Is transmitted to the communication terminal 400 that received the message. The key data transmission unit 314 may be an example of a second key data transmission unit.

  The token reception unit 316 receives the authenticated token transmitted by the token transmission unit 130. The ID transmission unit 318 transmits the authenticated token received by the token reception unit 316 to the communication terminal 400 from which the terminal request reception unit 306 has accepted access.

  FIG. 7 schematically shows an example of the flow of processing by the information providing apparatus 100. FIG. 7 shows a processing flow when the information providing apparatus 100 executes the active bookmark function. Here, it is active for the communication terminal 402, the communication terminal 404, and the communication terminal 406 that are authenticated by the same user ID and logged into the information providing service 101 by at least one of the terminal authentication unit 103 and the token authentication unit 110. A case where the bookmark function is executed will be described as an example. As illustrated in FIG. 7, the communication terminal 402, the communication terminal 404, the communication terminal 406, and the information providing apparatus 100 may communicate via the relay apparatus 200.

  In S <b> 702, the communication terminal 402 transmits a display request for data stored in the file server 12 to the information providing apparatus 100. In step S <b> 704, the information providing apparatus 100 transmits a data acquisition request requested from the communication terminal 402 to the file server 12. In step S <b> 706, the file server 12 transmits data to the information providing apparatus 100 in response to an acquisition request from the information providing apparatus 100. In S <b> 708, the information providing apparatus 100 converts the data received from the file server 12 into browsing data to be displayed on the communication terminal 402, and transmits the browsing data to the communication terminal 402.

  In step S <b> 710, the communication terminal 404 transmits a display request for data stored in the mail server 14 to the information providing apparatus 100. In step S <b> 712, the information providing apparatus 100 transmits a data acquisition request requested from the communication terminal 404 to the mail server 14. In S <b> 714, the mail server 14 transmits data to the information providing apparatus 100 in response to an acquisition request from the information providing apparatus 100. In step S <b> 716, the information providing apparatus 100 converts the data received from the mail server 14 into browsing data to be displayed on the communication terminal 404 and transmits the browsing data to the communication terminal 404.

  In S <b> 718, the communication terminal 406 transmits a display request for data stored in the web server 16 to the information providing apparatus 100. In S <b> 720, the information providing apparatus 100 transmits a data acquisition request requested from the communication terminal 406 to the web server 16. In S <b> 722, the web server 16 transmits data to the information providing apparatus 100 in response to an acquisition request from the information providing apparatus 100. In S724, the information providing apparatus 100 converts the data received from the web server 16 into browsing data to be displayed on the communication terminal 406, and transmits the browsing data to the communication terminal 406.

  In step S <b> 726, the communication terminal 402 transmits a registration instruction for registering provider registration information to the information providing apparatus 100. The registration instruction may include the name of the provider registration information. The registration instruction may be an example of a provider registration information generation instruction.

  In S728, in response to the registration instruction received in S726 by the information providing apparatus 100, a plurality of pieces of provider information indicating the providers of the data displayed by the communication terminal 402, the communication terminal 404, and the communication terminal 406, respectively. To get. In the example of FIG. 7, the information providing apparatus 100 acquires providing source information indicating the file server 12, providing source information indicating the mail server 14, and providing source information indicating the web server 16. In S730, the information providing apparatus 100 generates provider registration information including a plurality of provider information acquired in S728.

  In S732, the communication terminal 402 transmits to the information providing apparatus 100 a display instruction for providing source registration information that has transmitted the registration instruction in S726. The display instruction may include the name of the provider registration information.

  In S734, the information providing apparatus 100 refers to the provider registration information generated in S730 according to the display instruction received in S732. The information providing apparatus 100 acquires a plurality of pieces of provider information included in the provider registration information. In this example, the provider registration information includes provider information indicating the file server 12, provider information indicating the mail server 14, and provider information indicating the web server 16.

  In S <b> 736, the information providing apparatus 100 transmits providing source information indicating the file server 12 acquired in S <b> 734 to the communication terminal 402. The communication terminal 402 transmits a display request for requesting data of the file server 12 to the information providing apparatus 100 according to the received provider information.

  In S738, the information providing apparatus 100 transmits the providing source information indicating the mail server 14 acquired in S734 to the communication terminal 404. The communication terminal 404 transmits a display request for requesting data of the mail server 14 to the information providing apparatus 100 according to the received provider information.

  In S740, the information providing apparatus 100 transmits providing source information indicating the web server 16 acquired in S734 to the communication terminal 406. The communication terminal 406 transmits a display request for requesting data of the web server 16 to the information providing apparatus 100 according to the received provider information.

  Through the above-described processing, the work status in the plurality of communication terminals 400 at a certain point in time can be reproduced at an arbitrary timing thereafter. Thereby, when the user who uses the plurality of communication terminals 400 continues the work, it is possible to reduce the trouble of reproducing the action state.

  FIG. 8 schematically illustrates an example of a functional configuration of the provider information processing unit 150. The provider information processing unit 150 includes a generation instruction receiver 152, a provider information acquisition unit 154, a registration information generator 156, a registration information storage unit 158, a designation information receiver 160, a provider information transmitter 162, and an inquiry output unit. 164 and an inquiry response receiving unit 166. In addition, it is not necessarily essential that the provider information processing unit 150 includes all of these configurations.

  The generation instruction receiving unit 152 receives an instruction to generate provider registration information from the communication terminal 400. The provider registration information generation instruction may include the name of the provider registration information. Also, the provider registration information generation instruction may include designation of a terminal group for which provider registration information is to be generated. The designation of the terminal group may include the terminal IDs of the communication terminals 400 belonging to the terminal group.

  The provider information acquisition unit 154 acquires provider information in response to the generation instruction receiving unit 152 receiving an instruction to generate provider registration information from the communication terminal 400. When the generation instruction includes designation of a terminal group for which the provision source registration information is to be generated, the provision source information acquisition unit 154 displays the communication terminal 400 and the generation instruction indicated by the terminal ID included in the designation. The provider information indicating the provider of the data displayed by the transmitted communication terminal 400 is acquired.

  When the generation instruction does not include the designation of the terminal group for which the provider registration information is to be generated, the provider information acquisition unit 154 is the same user as the communication terminal 400 that has transmitted the provider registration information generation instruction. The provider information indicating the provider of data displayed by the communication terminal 400 authenticated by the ID and logged in to the information providing service 101 and the communication terminal 400 that has transmitted the generation instruction is acquired.

  The registration information generation unit 156 generates provider registration information including a plurality of provider information acquired by the provider information acquisition unit 154. The registration information generation unit 156 may generate provider registration information in which each of the plurality of provider information is associated with the terminal ID of the communication terminal 400 from which each provider has provided data.

  The registration information storage unit 158 stores the provider registration information generated by the registration information generation unit 156. The registration information storage unit 158 may store the provider registration information in association with the name of the provider registration information included in the provider registration information generation instruction.

  The designation information receiving unit 160 receives designation information for designating provider registration information from the communication terminal 400. The designation information may include the name of the provider registration information.

  The provider information transmission unit 162 acquires and refers to the provider registration information specified by the specification information received by the specification information reception unit 160 from the registration information storage unit 158. Then, the provider information transmitting unit 162 transmits the provider information to each of the plurality of communication terminals 400 so as to display data provided by the provider indicated by the plurality of provider information included in the referred provider registration information. To do.

  The provider information transmission unit 162 may transmit a plurality of provider information to the communication terminal 400 that transmitted the designation information and the communication terminal 400 that belongs to the same terminal group as the communication terminal 400. For example, the provider information transmission unit 162 provides the provider information to the communication terminal 400 that transmitted the designation information and the communication terminal 400 that has been authenticated by the same user ID as the communication terminal 400 and logged into the information providing service 101. Send.

  The provider information transmission unit 162 includes a plurality of communication terminals 400 included in the same terminal group as the communication terminal 400 that transmitted the designation information, and the number of communication terminals 400 that are logged into the information providing service 101 is When the number of communication terminals 400 corresponding to a plurality of pieces of provider information included in the provider registration information is smaller, a plurality of pieces of provider information may be transmitted to at least one of the communication terminals 400 in a logged-in state.

  Further, the provider information transmitting unit 162 is associated with a plurality of provider information, and when the communication terminal 400 indicated by each terminal ID is logged in to the information providing service 101, The provider information may be transmitted to the communication terminal 400 indicated by the terminal ID associated with each of the plurality of provider information.

  The provider information transmitting unit 162 is in a state in which at least one of the plurality of communication terminals 400 indicated by the terminal IDs associated with each of the plurality of provider information is not logged in to the information providing service 101. In some cases, the provider information associated with the terminal ID of the communication terminal that is not logged in may be transmitted to any one of the plurality of communication terminals 400.

  Further, the provider information transmission unit 162 transmits data such as icons indicating the provider information associated with the terminal IDs of the communication terminals that are not logged in to all the other communication terminals 400. You may transmit to the communication terminal 400. The communication terminal 400 that has received the data transmits a display request to the information providing apparatus 100 to display the data provided by the provider indicated by the provider information when the data is designated by the user. Good.

  Thus, even when the number of communication terminals 400 logged in to the information providing service 101 is smaller when the provider registration information is specified than when the provider registration information is registered, the provider All of the data provided by the provider indicated by the plurality of provider information included in the registration information can be displayed by the logged-in communication terminal 400.

  When the designation information receiving unit 160 receives the designation information, the inquiry output unit 164 includes the communication terminal 400 identified by the plurality of terminal IDs associated with the plurality of source information included in the source registration information. When at least one of the communication terminals 400 is not logged in to the information providing service 101, inquiry information is transmitted to the communication terminal that transmitted the designation information. The inquiry information may include content for inquiring to which communication terminal 400 the provider information corresponding to the terminal ID of the communication terminal 400 that is not logged in is transmitted. Further, the inquiry information may include a content for inquiring which communication terminal 400 is not to be transmitted.

  The inquiry response receiving unit 166 receives a response to the inquiry information output from the inquiry output unit 164. The provider information transmitting unit 162 may transmit the provider information to the plurality of communication terminals 400 according to the response received by the inquiry response receiving unit 166.

  FIG. 9 schematically shows an example of the provider registration information table 500. In the provider registration information table 500, provider registration information for each terminal group may be registered. The provider registration information table 500 includes a main terminal column 502, a group terminal column 504, a name column 506, and a provider source information column 508.

  The main terminal column 502 includes the terminal ID of the main terminal of the terminal group. The group terminal column 504 includes terminal IDs of group terminals in the terminal group. The group terminal column 504 may include the number of group terminals belonging to the terminal group.

  The name column 506 includes the name of the provider registration information. The provider information column 508 includes a plurality of provider information. When the group terminal column 504 includes a terminal ID, the provider information column 508 may include provider information for each terminal ID. When the group terminal column 504 includes the number of group terminals, the provider information column 508 may include provider information for each communication terminal 400.

  In FIG. 9, provider registration information with a name for work of a terminal group including terminal IDs: AAA001, AAA002, AAA003, AAA004, and a name for business trip of a terminal group including terminal ID: BBB001 and two communication terminals 400. The provider registration information is exemplified.

  When the information providing apparatus 100 receives the designation information designating the provider registration information named “work” from the communication terminal 400 whose terminal ID is AAA001, AAA002, AAA003, or AAA004, the communication whose terminal ID is AAA001 is received. The provider information indicating the file server 12 and the cloud service 52 is transmitted to the terminal 400. In the present embodiment, the cloud service 52 is located in the network 50, but may be located in the network 10.

  Further, the information providing apparatus 100 transmits providing source information indicating the mail server 14 to the communication terminal 400 whose terminal ID is AAA002. Further, the information providing apparatus 100 transmits providing source information indicating the web server 16 to the communication terminal 400 whose terminal ID is AAA003. Further, the information providing apparatus 100 transmits providing source information indicating the cloud service B to the communication terminal 400 whose terminal ID is AAA04. In the present embodiment, the cloud service 54 is located in the network 50, but may be located in the network 10.

  When the information providing apparatus 100 receives the designation information designating the provider registration information with the name “for business trip” from the communication terminal 400 whose terminal ID is BBB001, the information providing apparatus 100 sends the file server 12 to the communication terminal 400 whose terminal ID is BBB001. The provider information indicating is transmitted. Further, the information providing apparatus 100 includes the first communication terminal 400 among the plurality of communication terminals 400 that are authenticated by the same user ID as the user ID used by the communication terminal 400 having the terminal ID BBB001 and are logged in the information providing service 101. The provider information indicating the mail server 14 and the cloud service 52 is transmitted to the first communication terminal 400, and the provider information indicating the web server 16 is transmitted to the second communication terminal 400.

  FIG. 10 schematically shows an example of the flow of processing by the information providing apparatus 100. FIG. 10 shows a flow of processing in which the information providing apparatus 100 pastes data that has been copied in the communication terminal 402 to the communication terminal 404. Here, a state in which the communication terminal 402 and the communication terminal 404 are authenticated with the same user ID and both are logged in to the information providing service 101 will be described as a start state.

  In step S <b> 1002, the communication terminal 402 performs a copy operation on the data stored in the communication terminal 402. The communication terminal 402 may execute a copy operation according to an operation by a user of the communication terminal 402.

  In S1004, the communication terminal 402 transmits the data for which the copy operation has been performed to the relay apparatus 200 in response to the copy operation in S1002. The communication terminal 402 may add information indicating that the copy operation has been performed and transmit the data to the relay device 200. The relay device 200 may store the received data in association with the terminal ID of the communication terminal 402 that transmitted the data.

  In step S <b> 1006, the relay apparatus 200 determines whether the information providing apparatus 100 has transmitted data subjected to a copy operation from any of the plurality of communication terminals 400 registered in the information providing service 101 to the relay apparatus 200. Check with. The confirmation is performed by the relay device confirmation unit 104.

  In S1008, the relay apparatus 200 transmits the data received in S1004 to the information providing apparatus 100 in response to the confirmation in S1006. The relay apparatus 200 may transmit data to the information providing apparatus 100 together with the terminal ID of the communication terminal 402.

  In S1010, the information providing apparatus 100 stores the data received in S1008. The information providing apparatus 100 may store the data in association with the terminal ID received in S1008.

  In S1012, the communication terminal 404 transmits a paste request to the relay device 200. The relay apparatus 200 may store the received paste request in association with the terminal ID of the communication terminal 404 that has transmitted the paste request.

  In step S <b> 1014, the information providing apparatus 100 confirms with the relay apparatus 200 whether a paste request has been transmitted to the relay apparatus 200 from any of the plurality of communication terminals 400 registered in the information provision service 101. The confirmation is performed by the relay device confirmation unit 104.

  In S1016, the relay apparatus 200 transmits the paste request received in S1012 to the information providing apparatus 100 in response to the confirmation in S1014. The relay apparatus 200 may transmit a paste request to the information providing apparatus 100 together with the terminal ID of the communication terminal 404.

  In S1018, in response to receiving the paste request in S1016, the information providing apparatus 100 is authenticated with the same user ID as the communication terminal 404 indicated by the terminal ID received together with the paste request and logs into the information providing service 101. It is determined whether data received from the communication terminal 402 being stored is stored.

  In S1020, in response to the determination that data is stored in S1018, the information providing apparatus 100 transmits the data stored in S1010 to the communication terminal 404. The information providing apparatus 100 may transmit the data to the communication terminal 404 via the relay apparatus 200.

  Through the above-described processing, the user of the communication terminal 402 and the communication terminal 404 can easily copy the data copied in the communication terminal 402 as if the user copied and pasted between the communication terminal 402 and the communication terminal 404. Can be pasted into.

  FIG. 11 schematically shows an example of the flow of processing by the information providing apparatus 100. FIG. 11 shows a flow of processing in which the information providing apparatus 100 pastes data in the network 10 that has been copied in the communication terminal 402 to the communication terminal 404. Here, a state in which the communication terminal 402 and the communication terminal 404 are authenticated with the same user ID and both are logged in to the information providing service 101 will be described as a start state.

  In S <b> 1102, the communication terminal 402 located in the network 50 transmits a browsing request for browsing data stored in the file server 12 to the information providing apparatus 100 via the relay apparatus 200. In S1104, the information providing apparatus 100 transmits a data request to the file server 12 in response to the browsing request received in S1102.

  In S1106, the file server 12 transmits data to the information providing apparatus 100 in response to the data request received in S1104. In S <b> 1108, the information providing apparatus 100 generates browsing data for displaying the data received from the file server 12 on the communication terminal 402, and transmits the browsing data to the communication terminal 402.

  In S1110, the communication terminal 402 detects a copy operation for the data stored in the file server 12 being displayed. In step S <b> 1112, the communication terminal 402 transmits copy notification information indicating that a copy operation has been performed on data stored in the file server 12 to the relay apparatus 200. The relay device 200 stores the received copy notification information.

  In step S <b> 1114, the information providing apparatus 100 confirms with the relay apparatus 200 whether copy notification information has been transmitted to the relay apparatus 200 from any of the plurality of communication terminals 400 registered in the information providing service 101. The confirmation is performed by the relay device confirmation unit 104.

  In S1116, the relay apparatus 200 transmits the copy notification information received in S1112 to the information providing apparatus 100 in response to the confirmation in S1114. The relay apparatus 200 may transmit copy notification information to the information providing apparatus 100 together with the terminal ID of the communication terminal 402. In S1118, the information providing apparatus 100 stores link information for the data for which the copy operation indicated by the copy notification information received in S1116 has been performed.

  In S <b> 1120, the communication terminal 404 located in the network 50 transmits a paste request to the relay device 200. The communication terminal 404 may transmit a paste request to the relay device 200 together with the terminal ID of the communication terminal 404. The relay device 200 stores the received paste request in association with the terminal ID of the communication terminal 404.

  In S <b> 1122, the information providing apparatus 100 confirms with the relay apparatus 200 whether a paste request has been transmitted to the relay apparatus 200 from any of the plurality of communication terminals 400 registered in the information providing service 101. The confirmation is performed by the relay device confirmation unit 104.

  In S1124, the relay apparatus 200 transmits the paste request received in S1120 to the information providing apparatus 100 in response to the confirmation in S1122. The relay apparatus 200 may transmit a paste request to the information providing apparatus 100 together with the terminal ID of the communication terminal 404.

  In S1126, in response to the paste request received in S1124, the information providing apparatus 100 is authenticated by the communication terminal 402 that has been authenticated with the same user ID as the communication terminal 404 that has transmitted the paste request and logged into the information providing service 101. It is determined whether the link information for the data for which the copy operation indicated by the copy notification information is stored is stored. In S1128, in response to the determination that the link information is stored in S1126, the information providing apparatus 100 transmits the link information to the communication terminal 404.

  In S1130, the communication terminal 404 transmits a data request to the file server 12 to the relay apparatus 200 using the link information received in S1128. The relay device 200 stores the received data request in association with the terminal ID of the communication terminal 404.

  In S1132, the information providing apparatus 100 confirms with the relay apparatus 200 whether or not a data request is transmitted from any of the plurality of communication terminals 400 registered in the information providing service 101 to the relay apparatus 200. The confirmation is performed by the relay device confirmation unit 104.

  In S1134, the relay apparatus 200 transmits the data request received in S1130 to the information providing apparatus 100 in response to the confirmation in S1132. The relay apparatus 200 may transmit a data request together with the terminal ID of the communication terminal 404 to the information providing apparatus 100.

  In S1136, the information providing apparatus 100 transmits a data download request to the file server 12 in response to the data request received in S1134. In S1138, the file server 12 transmits data to the information providing apparatus 100 in response to the download request received in S1136. In S1140, the information providing apparatus 100 transmits the data received in S1138 to the communication terminal 404.

  Through the processing described above, the user of the communication terminal 402 and the communication terminal 404 can copy the data in the file server 12 to be viewed on the communication terminal 402 as if copying and pasting between the communication terminal 402 and the communication terminal 404. It can be easily pasted on the communication terminal 404.

  FIG. 12 schematically shows an example of the flow of processing by the information providing apparatus 100. FIG. 12 shows a flow of processing in which the information providing apparatus 100 pastes data in the network 10 that has been copied in the communication terminal 402 in the network 10 in response to a paste request from the communication terminal 404. Here, a state in which the communication terminal 402 and the communication terminal 404 are authenticated with the same user ID and both are logged in to the information providing service 101 will be described as a start state.

  In S <b> 1202, the communication terminal 402 located in the network 50 transmits a browsing request for browsing data stored in the mail server 14 to the information providing apparatus 100 via the relay apparatus 200. In S1204, the information providing apparatus 100 transmits a data request to the mail server 14 in response to the browsing request received in S1202.

  In S1206, the mail server 14 transmits data to the information providing apparatus 100 in response to the data request received in S1204. In step S <b> 1208, the information providing apparatus 100 generates browsing data for displaying data received from the mail server 14 on the communication terminal 402, and transmits the browsing data to the communication terminal 402.

  In S <b> 1210, the communication terminal 404 located in the network 50 transmits a browsing request for browsing the data stored in the file server 12 to the information providing apparatus 100 via the relay apparatus 200. In S1212, the information providing apparatus 100 transmits a data request to the file server 12 in response to the browsing request received in S1210.

  In S1214, the file server 12 transmits data to the information providing apparatus 100 in response to the data request received in S1212. In step S <b> 1216, the information providing apparatus 100 generates browsing data for displaying data received from the file server 12 on the communication terminal 402, and transmits the browsing data to the communication terminal 402.

  In step S <b> 1218, the communication terminal 402 detects a copy operation for the data stored in the displayed mail server 14. In step S <b> 1220, the communication terminal 402 transmits to the relay device 200 copy notification information indicating that a copy operation has been performed on the data stored in the mail server 14. The relay device 200 stores the received copy notification information.

  In step S <b> 1224, the information providing apparatus 100 confirms with the relay apparatus 200 whether copy notification information is transmitted to the relay apparatus 200 from any of the plurality of communication terminals 400 registered in the information providing service 101. The confirmation is performed by the relay device confirmation unit 104.

  In S1226, the relay apparatus 200 transmits the copy notification information received in S1220 to the information providing apparatus 100 in response to the confirmation in S1224. The relay apparatus 200 may transmit copy notification information to the information providing apparatus 100 together with the terminal ID of the communication terminal 402.

  In S <b> 1228, the information providing apparatus 100 transmits a download request for downloading the data on which the copy operation indicated by the copy notification information received in S <b> 1226 has been performed to the mail server 14. In S1230, the mail server 14 transmits data to the information providing apparatus 100 in response to the download request received in S1228. In S1232, the information providing apparatus 100 stores the data received in S1230.

  In S1234, the communication terminal 404 transmits a paste request to the relay apparatus 200. The communication terminal 404 may transmit a paste request to the relay device 200 together with the terminal ID of the communication terminal 404. The relay device 200 stores the received paste request in association with the terminal ID of the communication terminal 404.

  In S1236, the information providing apparatus 100 confirms with the relay apparatus 200 whether or not a paste request has been transmitted to the relay apparatus 200 from any of the plurality of communication terminals 400 registered in the information providing service 101. The confirmation is performed by the relay device confirmation unit 104.

  In S1238, the relay apparatus 200 transmits a paste request to the information providing apparatus 100 in response to the confirmation in S1236. The relay apparatus 200 may transmit a paste request to the information providing apparatus 100 together with the terminal ID of the communication terminal 404.

  In S1240, in response to the paste request received in S1238, the information providing apparatus 100 has been transmitted by the communication terminal 402 that has been authenticated with the same user ID as that of the communication terminal 404 that has transmitted the paste request and has been logged in. It is determined whether data for which a copy operation indicated by the copy notification information has been stored is stored.

  In S <b> 1242, the information providing apparatus 100 transmits data to the file server 12 in response to the determination that data is stored in S <b> 1240. The file server 12 stores the received data in association with the terminal ID of the communication terminal 404.

  Through the processing described above, the user of the communication terminal 402 and the communication terminal 404 can copy the data in the mail server 14 to be viewed on the communication terminal 402 as if the user is copying and pasting between the communication terminal 402 and the communication terminal 404. The communication terminal 404 can easily paste to the file server 12 browsing the data.

  FIG. 13 schematically illustrates an example of a functional configuration of the copy data processing unit 170. The copy data processing unit 170 includes a copy data reception unit 172, a copy data storage unit 174, a paste request reception unit 176, a data determination unit 178, a data transmission unit 180, a copy notification information reception unit 182, a link information storage unit 184, and link information. A determination unit 186, a link information transmission unit 188, a download request reception unit 190, a data acquisition unit 192, a history storage unit 194, a history transmission unit 196, and a designation reception unit 198 are provided. Note that it is not essential that the copy data processing unit 170 has all these configurations.

  The copy data receiving unit 172 receives copy data for which a copy operation has been performed at the communication terminal 400 from the communication terminal 400 logged into the information providing service 101. The copy data may be text data, audio data, image data, an electronic file, or the like.

  The copy data storage unit 174 stores the copy data received by the copy data receiving unit 172. The copy data storage unit 174 may store the copy data in association with the terminal ID of the communication terminal 400 that transmitted the copy data. The copy data storage unit 174 may measure an elapsed time after the copy data receiving unit 172 receives the copy data. Then, the copy data storage unit 174 may delete the data when a predetermined time has elapsed since the copy data receiving unit 172 received the copy data. As a result, the possibility of data leakage can be reduced, and security can be improved.

  The paste request receiving unit 176 receives a paste request from the communication terminal 400 that has logged into the information providing service 101. When the paste request receiving unit 176 receives the paste request, the data determining unit 178 is authenticated with the same user ID as the communication terminal 400 that has transmitted the paste request, and logs into the information providing service 101 together with the communication terminal 400. It is determined whether or not the copy data received from the existing communication terminal 400 is stored in the copy data storage unit 174.

  In response to the paste request received by the paste request reception unit 176, the data transmission unit 180 transmits the copy data stored in the copy data storage unit 174 to the communication terminal 400 that has transmitted the paste request. When the data determination unit 178 determines that the copy data is stored in the copy data storage unit 174, the data transmission unit 180 may transmit the copy data to the communication terminal 400 that has transmitted the paste request. .

  The copy notification information receiving unit 182 includes copy notification information indicating that a copy operation has been performed on data in the network 10 in the communication terminal 400 that is located in the network 50 and is logged in to the information providing service 101. Received from the communication terminal 400.

  The link information storage unit 184 stores link information for data indicating that a copy operation has been performed by the copy notification information received by the copy notification information receiving unit 182. The link information storage unit 184 may store the link information in association with the terminal ID of the communication terminal 400 that has transmitted the copy notification information.

  When the paste request reception unit 176 receives the paste request, the link information determination unit 186 is authenticated with the same user ID as the communication terminal 400 that has transmitted the paste request, and logs into the information providing service 101 together with the communication terminal 400. It is determined whether or not the link information for the data for which the copy operation indicated by the copy notification information received from the communication terminal 400 is stored in the link information storage unit 184.

  In response to the paste request reception unit 176 receiving the paste request, the link information transmission unit 188 transmits the link information stored in the link information storage unit 184 to the communication terminal 400 that has transmitted the paste request. The link information transmission unit 188 may transmit the link information to the communication terminal 404 when the link information determination unit 186 determines that the link information is stored in the link information storage unit 184.

  The download request receiving unit 190 receives a download request for data in the network 10 from the communication terminal 400. The data acquisition unit 192 acquires the requested data from a server or the like in the network 10 when the download request reception unit 190 receives the download request. The data transmission unit 180 may transmit the data acquired by the data acquisition unit 192 to the communication terminal 400 that transmitted the download request. The data transmission unit 180 and the data acquisition unit 192 may be an example of a storage control unit.

  The history storage unit 194 stores the history of data that has been copied by the communication terminal 400 and received by the copy data receiving unit 172. The history storage unit 194 may store the history of the data for a predetermined period. The history storage unit 194 may delete the history when a predetermined period has elapsed since the history of the data was stored.

  The history storage unit 194 may store a history of data indicating that the copy notification information received by the copy notification information receiving unit 182 has been copied. The history storage unit 194 may store the history of the data for a predetermined period. The history storage unit 194 may delete the history when a predetermined period has elapsed since the history of the data was stored.

  The history transmission unit 196 transmits the history stored in the history storage unit 194 to the communication terminal 400 when the paste request reception unit 176 receives the paste request from the communication terminal 400. The communication terminal 400 may display and output the history received from the history transmission unit 196. For example, when the history stored in the history storage unit 194 includes three data histories, the communication terminal 400 displays and outputs a history indicating the three data.

  The designation receiving unit 198 receives data designation for the history transmitted by the history transmitting unit 196. For example, when a history of three data is included in the history transmitted by the history transmitting unit 196, the designation of any one of the three data is received from the communication terminal 400. The designation of data for the history may be performed by the user of the communication terminal 400.

  The data transmission unit 180 may transmit the designated data to the communication terminal 400 that has transmitted the data designation in response to the designation receiving unit 198 receiving the data designation for the history. Further, the link information transmission unit 188 sends link information corresponding to the designated data to the communication terminal 400 that has transmitted the data designation in response to the designation receiving unit 198 accepting the designation of data for the history. May be sent.

  FIG. 14 schematically shows an example of the flow of processing by the relay apparatus 200. FIG. 14 shows a flow of processing in which the relay apparatus 200 pastes data that has been copied in the communication terminal 402 to the communication terminal 404. Here, a state in which the communication terminal 402 and the communication terminal 404 are authenticated with the same user ID and both are logged in to the information providing service 101 will be described as a start state.

  In step S <b> 1402, the communication terminal 402 performs a copy operation on the data stored in the communication terminal 402. The communication terminal 402 may execute a copy operation according to an operation by a user of the communication terminal 402.

  In S1404, the communication terminal 402 transmits the data subjected to the copy operation to the relay apparatus 200 in response to the copy operation in S1402. The communication terminal 402 may add information indicating that the copy operation has been performed and transmit the data to the relay device 200.

  In S1406, the relay apparatus 200 stores the data received in S1404. The relay device 200 may store the received data in association with the terminal ID of the communication terminal 402 that transmitted the data.

  In S1408, the communication terminal 404 transmits a paste request to the relay apparatus 200. The communication terminal 404 may transmit a paste request to the relay device 200 together with the terminal ID of the communication terminal 404.

  In S1410, in response to the paste request received in S1408, the relay apparatus 200 is authenticated with the same user ID as the communication terminal 404 indicated by the terminal ID received together with the paste request and is logged in to the information providing service 101 It is determined whether data received from the terminal 402 is stored.

  In S1412, the relay apparatus 200 transmits the data stored in S1406 to the communication terminal 404 in response to the determination that the data is stored in S1410.

  Through the processing described above, copy and paste via the relay device 200 can be realized between the communication terminal 402 and the communication terminal 404.

  FIG. 15 schematically illustrates an example of a functional configuration of the copy data processing unit 210 included in the relay apparatus 200. The copy data processing unit 210 includes a copy data reception unit 212, a copy data storage unit 214, a paste request reception unit 216, a data determination unit 218, and a data transmission unit 220.

  The copy data receiving unit 212 receives data for which a copy operation has been performed in the communication terminal 400 from the communication terminal 400. The copy data storage unit 214 stores the data received by the copy data reception unit 212. The copy data storage unit 214 may store the data in association with the terminal ID of the communication terminal 400 that transmitted the data.

  Paste request receiving unit 216 receives a paste request from communication terminal 400. In response to the paste request receiving unit 216 receiving the paste request, the data determination unit 218 is authenticated with the same user ID as the communication terminal 400 that has transmitted the paste request and is logged in to the information providing service 101 It is determined whether the data received from the terminal 400 is stored in the copy data storage unit 214.

  The data transmission unit 220 receives the data received from the communication terminal 400 that has been authenticated by the data determination unit 218 with the same user ID as the communication terminal 400 that transmitted the paste request and logged into the information providing service 101. If it is determined that the data is stored in 214, the data is transmitted to the communication terminal 400 that has transmitted the paste request.

  FIG. 16 schematically illustrates an example of a functional configuration of the communication terminal 400. The communication terminal 400 includes a communication unit 412, a data storage unit 414, a display unit 416, and an operation unit 418.

  The communication unit 412 performs communication via the network 50. Note that the communication terminal 400 can be located in the network 10, and when the communication terminal 400 is located in the network 10, the communication unit 412 performs communication via the network 10.

  The data storage unit 414 stores various data. The data storage unit 414 may store data received by the communication unit 412. The communication unit 412 may transmit data stored in the data storage unit 414.

  The display unit 416 displays the data stored in the data storage unit 414. Display unit 416 may be a touch panel display.

  The operation unit 418 receives an operation from the user. The operation unit 418 receives a touch operation on the display unit 416 which is a touch panel display, for example. In addition, the operation unit 418 receives an operation on an input unit such as buttons and keys provided in the communication terminal 400, for example.

  The operation unit 418 may accept a copy operation for data displayed on the display unit 416. For example, first, when data displayed on the display unit 416 is selected via the operation unit 418, the display unit 416 displays a menu for the selected data. The menu includes a copy. Then, the operation unit 418 receives selection of a copy included in the menu as a copy operation for the data.

  In addition, when an arbitrary position in the display area of the display unit 416 is selected via the operation unit 418, the communication unit 412 may transmit a paste request to the relay device 200. When the communication unit 412 transmits a paste request to the relay device 200, when the notification that the data to be pasted exists from the relay device 200, the display unit 416 displays a menu including the paste. You can do it. When the operation unit 418 receives selection of a paste included in the menu, the communication unit 412 may receive data to be pasted from the relay device 200 and store the data in the data storage unit 414.

  FIG. 17 schematically shows a display example by the communication terminal 400. FIG. 17 shows that “Copy” indicates that the display unit 416 is a copy for pasting to the outside of the communication terminal 400 in response to detecting a touch operation on the data icon 420 displayed on the display unit 416. An example of displaying a menu 430 including “(server)” and “copy (terminal)” indicating that the copy is for copying inside the communication terminal 400 is shown.

  When the data indicated by the data icon 420 is data in the communication terminal 400 and “copy (server)” is selected, the communication unit 412 regards the data as data for which a copy operation has been performed, and the relay device 200. It may be transmitted to the information providing apparatus 100 via When the data indicated by the data icon 420 is data in the network 10 and “copy (server)” is selected, the communication unit 412 performs a copy operation on the data in the network 10. The copy notification information indicating this may be transmitted to the information providing apparatus 100 via the relay apparatus 200. When “copy (terminal)” is selected, the communication terminal 400 may copy the data indicated by the data icon 420 to the clipboard.

  Here, the case where the menu 430 including “copy (server)” and “copy (terminal)” is displayed has been described as an example, but the present invention is not limited thereto. Communication terminal 400 may display menu 430 including one copy in response to detecting a touch operation on data icon 420. When the one copy is selected, the communication terminal 400 may transmit the data indicated by the data icon 420 or the copy notification information to the information providing apparatus 100 and store the data on the clipboard. Further, when the one copy is selected, the communication terminal 400 may transmit the data or the copy notification information to the information providing apparatus 100 without storing the data indicated by the data icon 420 on the clipboard. .

  FIG. 18 schematically shows a display example by the communication terminal 400. 18 shows “paste (server)” indicating that the display unit 416 is a paste for pasting data received from the outside of the communication terminal 400 in response to detecting a touch operation on the display unit 416. An example in which a menu 440 including “paste (terminal)” indicating paste for pasting data inside the communication terminal 400 is displayed is shown.

  When “Paste (Server)” is selected, the communication terminal 400 may paste data received from the information providing apparatus 100 via the relay apparatus 200. When “Paste (terminal)” is selected, the communication terminal 400 may paste data stored on the clipboard of the communication terminal 400.

  In the above embodiment, the information providing apparatus 100 has been described as an example of a communication system, but the present invention is not limited thereto. The communication system may include an information providing apparatus 100 and a relay apparatus 200. The communication system may include the information providing apparatus 100 and the management apparatus 300. The communication system may include an information providing apparatus 100, a relay apparatus 200, and a management apparatus 300.

  Further, in the above-described embodiment, the information providing apparatus 100 has been described with an example in which a communication connection is established with the communication terminal 400 via the relay apparatus 200 and data is transmitted to and received from the communication terminal 400 via the relay apparatus 200. However, it is not limited to this. The information providing apparatus 100 may establish a communication connection with the communication terminal 400 via the relay apparatus 200, and may transmit / receive data to / from the communication terminal 400 without using the relay apparatus 200.

  In the above embodiment, the case where the relay apparatus 200 and the management apparatus 300 are separate is described as an example, but the present invention is not limited to this. The relay apparatus 200 and the management apparatus 300 may be integrated. For example, the relay apparatus 200 may have the function of the management apparatus 300.

  In the above description, each unit of the information providing apparatus 100, the relay apparatus 200, the management apparatus 300, and the communication terminal 400 may be realized by hardware or may be realized by software. Further, it may be realized by a combination of hardware and software. In addition, the computer may function as any of the information providing apparatus 100, the relay apparatus 200, the management apparatus 300, and the communication terminal 400 by executing the program. The program may be installed from a computer-readable medium or a storage device connected to a network to a computer constituting at least a part of any of the information providing device 100, the relay device 200, the management device 300, and the communication terminal 400. .

  A program that is installed in a computer and causes the computer to function as any one of the information providing apparatus 100, the relay apparatus 200, the management apparatus 300, and the communication terminal 400 according to the present embodiment works on a CPU or the like to cause the computer to operate as the information providing apparatus 100. , Function as any one of the relay device 200, the management device 300, and the communication terminal 400. The information processing described in these programs is read by a computer, and the software and the hardware resources of the information providing apparatus 100, the relay apparatus 200, the management apparatus 300, and the communication terminal 400 cooperate with each other. It functions as a specific means.

  As mentioned above, although this invention was demonstrated using embodiment, the technical scope of this invention is not limited to the range as described in the said embodiment. It will be apparent to those skilled in the art that various modifications or improvements can be added to the above-described embodiment. It is apparent from the scope of the claims that the embodiments added with such changes or improvements can be included in the technical scope of the present invention.

  The order of execution of each process such as operations, procedures, steps, and stages in the apparatus, system, program, and method shown in the claims, the description, and the drawings is particularly “before” or “prior to”. It should be noted that it can be realized in any order unless the output of the previous process is used in the subsequent process. Regarding the operation flow in the claims, the description, and the drawings, even if it is described using “first,” “next,” etc. for convenience, it means that it is essential to carry out in this order. It is not a thing.

10 network, 12 file server, 14 mail server, 16 web server, 20 router, 50 network, 100 information providing device, 101 information providing service, 102 authentication information storage unit, 103 terminal authentication unit, 104 relay device confirmation unit, 105 communication Connection establishment unit, 106 content management unit, 107 content providing unit, 110 token authentication unit, 112 key data request receiving unit, 114 key data generation unit, 116 authentication data generation unit, 118 encryption unit, 120 authentication data storage unit 122 Key data transmission unit, 124 Authentication data transmission unit, 126 Key data reception unit, 128 Key authentication availability determination unit, 130 Token transmission unit, 132 ID reception unit, 134 Authentication availability determination unit, 136 Communication connection establishment unit, 138 Terminal group registration unit, 150 Providing source information processing unit, 152 generation instruction receiving unit, 154 providing source information obtaining unit, 156 registration information generating unit, 158 registration information storing unit, 160 designation information receiving unit, 162 providing source information transmitting unit, 164 inquiry output unit, 166 Query response reception unit, 170 Copy data processing unit, 172 Copy data reception unit, 174 Copy data storage unit, 176 Paste request reception unit, 178 Data determination unit, 180 Data transmission unit, 182 Copy notification information reception unit, 184 Link Information storage unit, 186 Link information determination unit, 188 Link information transmission unit, 190 Download request reception unit, 192 Data acquisition unit, 194 History storage unit, 196 History transmission unit, 198 Designated reception unit, 200 Relay device, 210 Copy data processing Part, 212 copy data receiving part, 214 copy data Storage unit, 216 paste request reception unit, 218 data determination unit, 220 data transmission unit, 300 management device, 302 authentication data reception unit, 304 authentication data storage unit, 306 terminal request reception unit, 308 key acquisition instruction transmission unit, 310 Key data receiving unit, 312 Key authentication enable / disable determining unit, 314 Key data transmitting unit, 316 Token receiving unit, 318 ID transmitting unit, 400 communication terminal, 402 communication terminal, 404 communication terminal, 406 communication terminal, 412 communication unit, 414 Data storage unit, 416 display unit, 418 operation unit, 420 data icon, 430 menu, 440 menu, 500 provider registration information table, 502 main terminal column, 504 group terminal column, 506 name column, 508 provider source information column

Claims (6)

An authentication device located in the first network;
A management device located in the second network,
The authentication device
A terminal authentication unit that authenticates the first communication terminal with a user ID and maintains a state in which the first communication terminal is logged into the information providing service;
An authentication data generation unit for generating authentication data including the user ID, the first key data, and the second key data;
An authentication data transmitter for transmitting the authentication data to the management device;
A first key data transmission unit for transmitting the first key data to the first communication terminal located in the second network;
A first key data receiving unit for receiving the second key data from the first communication terminal;
A first key authentication availability determination unit that determines whether authentication is possible based on the second key data received by the first key data reception unit and the authentication data;
A first token transmission unit that transmits an authenticated token including the user ID to the management device when it is determined that authentication is possible by the first key authentication availability determination unit;
An ID receiving unit that receives the user ID included in the authenticated token from a second communication terminal located in the second network;
An ID authentication availability determination unit that determines whether authentication is possible based on the user ID and the authentication data received by the ID reception unit;
A communication connection establishment unit that establishes a communication connection with the second communication terminal when the ID authentication enable / disable determination unit determines that authentication is possible;
The management device
An authentication data storage unit for storing the authentication data received from the authentication device;
A second key data receiving unit for receiving the first key data from the second communication terminal;
A second key authentication enable / disable determining unit that determines whether authentication is possible based on the first key data received by the second key data receiving unit and the authentication data stored in the authentication data storage unit; A second key data transmitting unit that transmits the second key data to the second communication terminal when the two-key authentication permission / non-permission determining unit determines that authentication is possible;
A token receiver for receiving the authenticated token from the authentication device;
A second token transmission unit that transmits the authenticated token to the second communication terminal. The authentication device
An encryption unit that encrypts the user ID using an encryption key;
The first token transmission unit transmits the authenticated token including the user ID encrypted by the encryption unit to the management device;
The ID receiving unit receives the encrypted user ID included in the authenticated token;
The ID authentication enable / disable determining unit can decrypt the encrypted user ID, and the decrypted user ID is included in the authentication data generated by the authentication data generating unit. The communication system according to claim 1, wherein authentication is determined to be possible when the two match. The first token transmission unit transmits the authenticated token including the user ID and address information of a relay device located in the first network to the management device;
The communication system according to claim 1 or 2, wherein the ID reception unit receives the user ID included in the authenticated token from the second communication terminal via the relay device. The terminal group registration part which registers as a terminal group the said 1st communication terminal authenticated by the said user ID and the communication terminal authenticated using the said authenticated token containing the said user ID is provided. The communication system according to any one of the above. A registration information storage unit for storing provider registration information including a plurality of provider information indicating each provider of data displayed by each of the plurality of communication terminals registered as the terminal group by the terminal group registration unit When,
A designation information receiving unit for receiving designation information for designating the provider registration information from at least one of the plurality of communication terminals;
Each of the plurality of communication terminals is configured to display data provided by the provider indicated by the plurality of provider information included in the provider registration information on each of the plurality of communication terminals in response to reception of the designation information. The communication system according to claim 4, further comprising: a provider information transmitting unit that transmits each of the plurality of provider information.   A program for causing a computer to function as the communication system according to any one of claims 1 to 5.

Images