JP2020141357A - Server device, terminal device, authentication system, and authentication method - Google Patents

Abstract

To ensure security of information even if information duplicated by a third party is improperly transmitted to a communication opposite party in encrypted communication by a common key with the communication opposite party.SOLUTION: When a server device 100 receives an event ID issuance request including terminal information on a terminal device 200 from the terminal device 200, event ID is issued and transmitted to the terminal device 200 which is an issuance request source corresponding to the terminal information. Identification information used in the terminal device 200 of the event ID issuance request source in a database 119 of a file storage unit 107 of the server device 100 is updated to new identification information obtained by encrypting the issued event ID with a common key of the terminal device 200 of the issuance request source. The terminal device 200 of the event ID issuance request source that receives the event ID from the server device 100 includes identification information obtained by encrypting the received event ID with the common key of the terminal device 200 in an execution request for an event and transmits it to the server device 100.SELECTED DRAWING: Figure 1

Description

The present disclosure relates to a technique in which a communication device authenticates a communication partner.

The technology in which a communication device authenticates a communication partner is widely used for preventing unauthorized access of the communication partner.

For example, in a system that issues and purchases electronic tickets for an event between a server device on the Internet and a mobile phone such as a smartphone, the mobile phone authentication process is performed to prevent unauthorized purchase of the electronic tickets by a user who does not have purchase authority. Is done. As an example, there are the following proposals.

In this proposal, the ticket application (application software) installed on the mobile phone is started to access the ticket purchase site provided by the server device from the mobile phone. Then, the user of the mobile phone applies for the purchase of the ticket by inputting necessary items such as the e-mail address of the mobile phone on the application screen displayed on the browser of the display of the mobile phone. Then, the ticket purchase application is registered in the server device with the input contents.

When the registered user wins the lottery held on the server device, a winning notification email is sent from the server device to the user's mobile phone. The user who receives the e-mail activates the ticket application of the mobile phone and displays the winning ticket receiving screen on the browser of the display. Then, an input operation for requesting receipt of the ticket is performed on the receipt screen. Then, a one-time password in which the terminal ID of the mobile phone and the time stamp are encrypted with a common key is generated. For the terminal ID of the mobile phone, for example, identification information unique to the ticket application of the mobile phone can be used.

The user's mobile phone transmits an SMS (Short Message Service) message including the generated one-time password in the text to the server device as an authentication request by the SMS application. The transmitted authentication request is received by the server device via the communication network. The authentication request is also received by the gateway device of the communication network.

The server device decrypts the one-time password of the SMS message received as the authentication request with the common key, and acquires the terminal ID and the time stamp of the mobile phone as the authentication request log.

The gateway device transmits the source telephone number of the SMS message received as an authentication request, that is, the mobile phone number of the user, to the server device together with the one-time password of the body of the SMS message.

The server device performs the first authenticity determination of the authentication request by collating the mobile phone number of the user received from the gateway device with the mobile phone number of the winner registered in the server device. Further, the server device decrypts the one-time password received from the gateway device with the common key, and acquires the terminal ID and the time stamp of the mobile phone as an authentication request log. Then, the second authenticity of the authentication request is determined by collating the acquired authentication request log and the mobile phone terminal ID and time stamp of the authentication request log with the authentication request log acquired from the authentication request received by itself. ..

When the authenticity of the authentication request is confirmed by both the first and second authenticity determinations, the user's mobile phone is authenticated as the winner's mobile phone. When the mobile phone is authenticated, the ticket data is transmitted from the server device to the user's mobile phone. Then, an electronic ticket is issued on the mobile phone of the user who has received the ticket data (for example, Patent Document 1).

Japanese Patent No. 6259536

In the above proposal, if the communication content between the server device and the user's mobile phone is stolen by a third party, the third party will use the information that would otherwise be sent from the user's mobile phone for fraudulent purposes. You can duplicate it and send it from your mobile phone to the server device. When such a situation occurs, the server device performs an operation unintended by the user.

For example, if the transmission information of a legitimate user snooped by a third party is the content that is repeatedly transmitted to the server device, the server device repeatedly executes the corresponding process each time it is received. Especially in such a case, it becomes difficult to secure information security even if encrypted communication is performed with the server device.

This disclosure has been made in view of the above circumstances, and the purpose of this disclosure is encrypted communication with a communication partner using a common key, and information copied by a third party by eavesdropping on the communication content is sent to the communication partner. The purpose is to ensure the security of information even if it is sent illegally.

In order to achieve the above object, the server device according to the first aspect of the present disclosure is
A database section that stores a database of identification information for events involving communication terminal devices,
An ID issuing unit that issues an event ID corresponding to a signal related to the event received from the communication terminal device each time a trigger condition is satisfied.
Each time the ID issuing unit issues the event ID, an ID transmitting unit that transmits the issued event ID to the communication terminal device that is the source of the signal corresponding to the issued event ID.
Each time the ID issuing unit issues the event ID, the updating unit updates the identification information of the database with the identification information obtained by encrypting the issued event ID with a common key.
Regarding the terminal information of the communication terminal device from the communication terminal device that received the event ID, the identification information obtained by encrypting the latest event ID received by the communication terminal device with the common key, and the event. A signal receiving unit that receives the signal including event information,
A determination unit that determines the authenticity of the signal by collating the identification information in the signal received by the signal receiving unit with the identification information in the database.
To be equipped.

According to the server device according to the first aspect of the present disclosure, an event ID corresponding to a signal received from the communication terminal device for an event involving the communication terminal device is issued each time a trigger condition is satisfied, and the signal is transmitted. It is transmitted to the original communication terminal device.

Further, every time the event ID is issued, the contents of the database stored in the database unit are updated. This database defines identification information for events involving communication terminal devices. This identification information is generated by encrypting the event ID transmitted to each communication terminal device with a common key. Therefore, when the event ID is issued, the identification information specified in the database is updated with the identification information generated by using the newly issued event ID.

On the other hand, in the communication terminal device that is the source of the signal, when an event involving the communication terminal device occurs, identification information in which the event ID received from the server device is encrypted with the same common key as the server device is generated. Then, a signal including the generated identification information, the terminal information for identifying its own communication terminal device, and the event information regarding the event in which it is involved is transmitted from the communication terminal device to the server device.

In the server device that receives the signal from the communication terminal device, the authenticity of the received signal is determined. In this determination, it is confirmed whether or not the identification information in the signal received by the server device matches the identification information specified in the database.

Then, as a result of database collation, if the identification information in the received signal matches the identification information in the database, it is determined that the received signal is genuine, and if they do not match, it is determined that the received signal is not genuine. To.

Here, as the identification information generated by the communication terminal device, the latest event ID among the event IDs received by the communication terminal device up to the time when the event involving the communication terminal device occurs is used. Therefore, the identification information included in the signal transmitted by the communication terminal device to the server device is updated with new contents each time the communication terminal device receives a new event ID from the server device.

Therefore, even if a third party who snoops on the signal transmitted from the communication terminal device at a certain point sends the duplicated signal for an illegal purpose later, the received signal is collated by the identification information using the database. It is judged that it is not genuine.

Therefore, even if a third party snoops on the communication contents of the communication terminal device and illegally sends the duplicated information to the server device in the encrypted communication using the common key performed by the communication terminal device with the server device, the encryption is performed. It is possible to ensure the security of information in cryptographic communication.

Further, the server device according to the second aspect of the present disclosure is the server device according to the first aspect of the present disclosure.
The ID issuing unit issues the event ID for each communication terminal device corresponding to the execution request of the event received as the signal from each communication terminal device.
The ID transmission unit transmits the issued event ID to the communication terminal device which is the request source of the execution request corresponding to the issued event ID.
The event information in the execution request received by the signal receiving unit includes the content information of the event for which the communication terminal device that has received the event ID requests execution in response to the execution request.
The determination unit stores the identification information in the execution request received by the signal receiving unit in the database unit for the communication terminal device corresponding to the terminal information in the execution request. The authenticity of the execution request is determined by collating with the identification information.

According to the server device according to the second aspect of the present disclosure, in the server device according to the first aspect of the present disclosure, every time the trigger condition is satisfied, the event ID corresponding to the execution request of the event received from the communication terminal device is satisfied. publish. The issued event ID is transmitted to the communication terminal device that is the request source of the event execution request.

The database unit stores a database of event identification information requested to be executed by the communication terminal device for each communication terminal device. Then, each time the event ID is issued, the identification information in the database stored in the database unit for the communication terminal device to which the issued event ID is transmitted is updated.

On the other hand, when the communication terminal device requests the server device to execute the event, the communication terminal device sends the event execution request to the server device. In this execution request, the server device is requested to execute the latest event ID received from the server device by the communication terminal device together with the identification information encrypted with the same common key as the server device and the identification information of the own communication terminal device. Contains information about the event to be played.

Therefore, the server device that has received the event execution request from the communication terminal device collates the identification information in the execution request with the identification information specified in the database for the communication terminal device of the terminal information in the same execution request. As a result of the collation, if both identification information matches, the server device determines that the execution request of the received event is genuine, and if they do not match, the server device determines that the execution request of the received event is not genuine.

Therefore, when the server device receives the event execution request from the communication terminal device, the server device executes the event requested by the communication terminal device after confirming that the received execution request is genuine. Therefore, when the server device receives a request to execute an invalid event, the server device executes the requested invalid event, and the execution of the illegal event impairs the security of the information of the server device. Can be prevented.

Further, the server device according to the third aspect of the present disclosure causes the event corresponding to the content information in the execution request determined by the determination unit to be genuine in the server device according to the second aspect of the present disclosure. The event execution unit further includes an event execution unit to be executed, the ID issuing unit issues the event ID with the execution of the event by the event execution unit as the establishment of the trigger condition, and the ID transmission unit is executed by the event execution unit. The issued event ID is transmitted to the communication terminal device of the request source of the event.

According to the server device according to the third aspect of the present disclosure, a new event ID is issued and executed each time the event requested from the communication terminal device is executed in the server device according to the second aspect of the present disclosure. It is sent to the communication terminal device that requested the event.

Therefore, when a new event execution request occurs in the communication terminal device that requests the executed event, the communication terminal device sends an event execution request including the identification information that encrypts the newly issued event ID. To.

Therefore, it is determined that the execution request of the event sent by a third party for an illegal purpose after the execution of the event is surely not genuine by collating with the identification information of the database updated by the new issuance of the event ID. can do.

Further, the server device according to the fourth aspect of the present disclosure is the server device according to the first aspect of the present disclosure.
The ID issuing unit issues the event ID corresponding to the execution response of the event received as the signal from the communication terminal device that executed the event in response to the execution request of the event.
The ID transmission unit transmits the issued event ID to the communication terminal device as a response source of the execution response corresponding to the issued event ID.
The event information in the execution response received by the signal receiving unit includes the result information of the event executed by the communication terminal device receiving the event ID in response to the execution request.
The determination unit stores the identification information in the execution response received by the signal receiving unit in the database unit for the communication terminal device corresponding to the terminal information in the execution response. The authenticity of the execution response is determined by collating with the identification information.

According to the server device according to the fourth aspect of the present disclosure, in the server device according to the first aspect of the present disclosure, every time the trigger condition is satisfied, the event ID corresponding to the execution response of the event received from the communication terminal device is satisfied. publish. The issued event ID is transmitted to the communication terminal device that is the response source of the event execution response.

The database unit stores a database for each communication terminal device of identification information of an event executed by the communication terminal device in response to an execution request of the server device. Then, each time the event ID is issued, the identification information in the database stored in the database unit for the communication terminal device to which the issued event ID is transmitted is updated.

On the other hand, when the communication terminal device executes the event in response to the event execution request from the server device, the communication terminal device sends an event execution response to the server device. In this execution response, the latest event ID received from the server device by the communication terminal device is encrypted with the same common key as the server device, along with the identification information of the own communication terminal device and the event executed by the communication terminal device. Result information is included.

Therefore, the server device that receives the execution response of the event from the communication terminal device collates the identification information in the execution response with the identification information specified in the database for the terminal information in the same execution response. As a result of the collation, if both identification information matches, the server device determines that the execution response of the received event is genuine, and if they do not match, the server device determines that the execution response of the received event is not genuine.

Therefore, when the server device receives the execution response of the event from the communication terminal device, the server device takes in the result information of the event executed by the communication terminal device after confirming that the received execution response is genuine. Therefore, when the server device receives the execution response of the illegal event, it is possible to prevent the server device from taking in the result information of the received illegal event and impairing the security of the information of the server device.

Further, the server device according to the fifth aspect of the present disclosure is a request for issuing the event ID including the terminal information from the communication terminal device in the server device according to the second, third or fourth aspect of the present disclosure. The ID issuing unit further includes an issuing request receiving unit for receiving the event ID, the ID issuing unit issues the event ID with the reception of the issuing request by the issuing request receiving unit as the satisfaction of the trigger condition, and the ID transmitting unit receives the event. The issued event ID is transmitted to the ID issuance request source, and the update unit identifies the communication terminal device corresponding to the terminal information in the issuance request in the database stored in the database unit. Update the information.

According to the server device according to the fifth aspect of the present disclosure, when the server device according to the second, third or fourth aspect of the present disclosure receives a request for issuing an event ID from the communication terminal device, a new event occurs. An ID will be issued. The issued event ID is transmitted to the communication terminal device that requested the event ID issuance request.

Therefore, when the communication terminal device first transmits a signal about an event involving the communication terminal device, the event ID is issued and transmitted to the communication terminal device that has not transmitted the signal to the server device in the past. can do.

Further, when the event ID is issued in response to the event ID issuance request received from the communication terminal device, the identification information in which the issued event ID is encrypted is the identification information corresponding to which communication terminal device. , Can be easily identified by the terminal information included in the issuance request.

Further, in order to achieve the above object, the communication terminal device according to the sixth aspect of the present disclosure is
An ID receiver that receives event IDs from the server device to which signals related to event execution are transmitted, and
A signal transmission for transmitting the signal including the latest event ID received by the ID receiving unit, which is encrypted with a common key, own terminal information, and event information related to the execution of the event, to the server device. Department and
To be equipped.

According to the communication terminal device according to the sixth aspect of the present disclosure, when an event ID from a server device that has transmitted a signal about an event involving the communication terminal device is received, the identification information in which the event ID is encrypted with a common key is received. Is generated. Then, when an event involving the communication terminal device occurs, the generated identification information, the terminal information for identifying the own communication terminal device, and the event information related to the execution of the event involving the communication terminal device are obtained. The including signal is transmitted to the server device.

Therefore, the server device that has received the signal from the communication terminal device can determine the authenticity of the received signal. This determination is to confirm whether or not the identification information in the signal transmitted by the communication terminal device to the server device matches the identification information in which the event ID transmitted by the server device to the communication terminal device is encrypted with the common key. Then, it can be executed by the server device.

Specifically, for example, the server device encrypts the event ID transmitted to the communication terminal device with a common key to generate identification information. Then, it is confirmed whether or not the generated identification information matches the identification information in the signal received by the server device from the communication terminal device to which the event ID is transmitted. Then, if both identification information match, it is determined that the received signal is genuine, and if they do not match, it is determined that the received signal is not genuine.

Therefore, even if a third party snoops on the communication contents of the communication terminal device and illegally sends the duplicated information to the server device in the encrypted communication using the common key performed by the communication terminal device with the server device, the encryption is performed. It is possible to ensure the security of information in cryptographic communication.

Further, the communication terminal device according to the seventh aspect of the present disclosure is the communication terminal device according to the sixth aspect of the present disclosure.
The ID receiving unit receives the event ID addressed to itself from the server device to which the event execution request, which is the signal, is requested, and receives the event ID.
The event information in the execution request transmitted by the signal transmission unit includes content information of the event for which the server device is requested to execute.

According to the communication terminal device according to the seventh aspect of the present disclosure, in the communication terminal device according to the sixth aspect of the present disclosure, the ID receiving unit receives the event ID addressed to itself from the server device of the other party requesting the execution of the event. To receive. Then, when requesting the server device to execute the event, the signal transmission unit transmits the event execution request to the server device.

In the event execution request transmitted by the signal transmitter, the server device is requested to execute the event ID issued by the server device together with the identification information encrypted with the same common key as the server device and the identification information of its own communication terminal device. Contains information about the event to be played.

Therefore, when the server device receives the event execution request from the communication terminal device, the server device can determine the authenticity of the received event execution request. This determination is made by confirming whether or not the identification information of the communication terminal device during the event execution request received by the server device matches the identification information of the event ID generated by the server device encrypted with the common key. , Can be implemented by the server device.

Therefore, even if a third party snoops on the communication contents of the communication terminal device and illegally sends the duplicated information to the server device in the encrypted communication using the common key performed by the communication terminal device with the server device, the encryption is performed. It is possible to ensure the security of information in cryptographic communication.

Further, the communication terminal device according to the eighth aspect of the present disclosure is the communication terminal device according to the sixth aspect of the present disclosure.
The ID receiving unit receives the event ID addressed to itself from the server device that requests the execution request of the event, and receives the event ID.
When the event is executed in response to the execution request of the event received from the server device, the event information in the execution response of the event transmitted as the signal by the signal transmitting unit is the event information executed by the execution request. Contains result information.

According to the communication terminal device according to the eighth aspect of the present disclosure, in the communication terminal device according to the sixth aspect of the present disclosure, the ID receiving unit receives the event ID addressed to itself from the server device that is the request source of the event execution request. To receive. Then, when the event requested by the server device is executed, the signal transmission unit transmits the execution response of the event to the server device.

In the execution response of the event transmitted by the signal transmitter, the server device is requested with the identification information obtained by encrypting the event ID issued by the server device with the same common key as the server device and the identification information of its own communication terminal device. Contains the result information of the executed event.

Therefore, when the server device receives the execution response of the event from the communication terminal device, the server device can determine the authenticity of the execution response of the received event. This determination is made by confirming whether or not the identification information of the communication terminal device during the execution response of the event received by the server device matches the identification information of the event ID generated by the server device encrypted with the common key. , Can be implemented by the server device.

Therefore, even if a third party snoops on the communication contents of the communication terminal device and illegally sends the duplicated information to the server device in the encrypted communication using the common key performed by the communication terminal device with the server device, the encryption is performed. It is possible to ensure the security of information in cryptographic communication.

Further, the communication terminal device according to the ninth aspect of the present disclosure transmits a request for issuing the event ID including the own terminal information to the server device in the communication terminal device according to the seventh or eighth aspect of the present disclosure. The issuance request transmission unit is further provided, and the ID receiving unit receives the event ID addressed to itself from the server device that has received the issuance request.

According to the communication terminal device according to the ninth aspect of the present disclosure, when the issuance request of the event ID including its own terminal information is transmitted to the server device in the communication terminal device according to the seventh or eighth aspect of the present disclosure, the server The event ID is generated in the device. This event ID is generated as an event ID for the communication terminal device corresponding to its own terminal information included in the issuance request. Then, it is transmitted from the server device with the self as the destination.

Therefore, by sending an event ID issuance request to the server device, the server device is made to generate the event ID necessary for ensuring the security of information in encrypted communication using the common key, and the server device sends the event ID to itself. Can be sent.

Further, in order to achieve the above object, the authentication system according to the tenth aspect of the present disclosure is
The server device according to the first aspect of the present disclosure and
The communication terminal device according to the sixth aspect of the present disclosure,
To be equipped.

According to the authentication system according to the tenth aspect of the present disclosure, the effect exerted by the server device according to the first aspect of the present disclosure and the effect exerted by the communication terminal device according to the sixth aspect of the present disclosure can be obtained. Be done.

That is, every time the trigger condition is satisfied in the server device that receives the signal about the event involving the communication terminal device from the communication terminal device, a new event ID is issued and transmitted to the communication terminal device that requests the executed event. Will be done.

Therefore, the communication terminal device that has transmitted the signal about the event involving the communication terminal device to the server device receives the new event ID issued by the server device after the trigger condition is satisfied in the server device. In the communication terminal device that has received the new event ID, when a new event involving the communication terminal device occurs, self-identification information in which the new event ID is encrypted with a common key is generated. Then, a new signal including the generated identification information, the terminal information for identifying the own communication terminal device, and the event information regarding the event in which the communication terminal device is involved is transmitted from the communication terminal device to the server device.

Therefore, in the server device, the authenticity of the received event execution request is verified by collating the identification information in the new signal received from the communication terminal device with the identification information in which the event ID transmitted to the communication terminal device is encrypted with the common key. Gender can be judged.

Therefore, in the server device that has received the signal about the event in which the communication terminal device is involved, the authenticity of the received signal can be determined, and the security of the information in the encrypted communication can be ensured.

Furthermore, the authentication system according to the eleventh aspect of the present disclosure
The server device according to the second or third aspect of the present disclosure, and
The communication terminal device of the seventh aspect of the present disclosure and
To be equipped.

According to the authentication system according to the eleventh aspect of the present disclosure, the effect exerted by the server device according to the second or third aspect of the present disclosure and the effect exerted by the communication terminal device according to the seventh aspect of the present disclosure. And are obtained.

That is, every time the event requested by the communication terminal device is executed in the server device, a new event ID is issued and transmitted to the communication terminal device that requests the executed event.

Therefore, when a new event execution request is generated in the communication terminal device that requests the executed event, new identification information is generated in which the event ID newly issued by the server device is encrypted with the common key. Then, a new event execution request including the generated new identification information, terminal information for identifying its own communication terminal device, and event content information requesting execution from the server device is transmitted to the server device. To.

Therefore, in the server device, the event execution request received by collating the identification information in the event execution request received from the communication terminal device with the identification information in which the event ID transmitted to the communication terminal device is encrypted with the common key. Authenticity can be judged.

Therefore, the server device that has received the event execution request from the communication terminal device can determine the authenticity of the received event execution request, and can ensure the security of the information in the encrypted communication.

In addition, in order to achieve the above object, the authentication system according to the twelfth aspect of the present disclosure is
The server device according to the fourth aspect of the present disclosure and
The communication terminal device according to the eighth aspect of the present disclosure,
To be equipped.

According to the authentication system according to the twelfth aspect of the present disclosure, the effect exerted by the server device according to the fourth aspect of the present disclosure and the effect exerted by the communication terminal device according to the eighth aspect of the present disclosure can be obtained. Be done.

That is, in the server device that receives the execution response of the event transmitted from the communication terminal device that executed the event in response to the execution request from the server device, a new event ID is issued and executed each time the trigger condition is satisfied. It is transmitted to the communication terminal device that is the source of the response.

On the other hand, in the communication terminal device that sends the execution response of the event to the server device, when the event is newly executed in response to the new execution request from the server device, the event ID newly issued by the server device is shared with the server device. A new key-encrypted identity is generated. Then, the execution response of the new event including the generated new identification information, the terminal information for identifying the own communication terminal device, and the result information of the newly executed event is transmitted to the server device.

Therefore, in the server device, the execution response of the received event is collated with the identification information in the execution response of the event received from the communication terminal device and the identification information in which the event ID transmitted to the communication terminal device is encrypted with the common key. Authenticity can be judged.

Therefore, in the server device that has received the event execution response from the communication terminal device, the authenticity of the received event execution response can be determined, and the security of information in encrypted communication can be ensured.

Furthermore, in order to achieve the above object, the authentication system according to the thirteenth aspect of the present disclosure is
The server device according to the fifth aspect of the present disclosure and
The communication terminal device of the ninth aspect of the present disclosure and
To be equipped.

According to the authentication system according to the thirteenth aspect of the present disclosure, the effect exerted by the server device according to the fifth aspect of the present disclosure and the effect exerted by the communication terminal device according to the ninth aspect of the present disclosure can be obtained. Be done.

That is, when an event ID issuance request including its own terminal information is transmitted to the server device, the event ID is generated in the server device. This event ID is generated as an event ID for the communication terminal device corresponding to its own terminal information included in the issuance request. Then, it is transmitted from the server device with the self as the destination.

Further, in the communication terminal device that has received the event ID addressed to itself from the server device, the identification information in which the event ID is encrypted with the same common key as the server device is generated. Then, when an execution request or execution response for the event to be transmitted to the server device occurs, the generated identification information, the terminal information for identifying the own communication terminal device, and the content information or result information of the event are input. The execution request or execution response of the including event is transmitted to the server device.

Therefore, in the server device, the identification information in the execution request or execution response of the event received from the communication terminal device is collated with the identification information in which the event ID transmitted to the communication terminal device is encrypted with the common key. The authenticity of the event execution request or execution response can be determined.

Therefore, the server device that has received the event execution request or execution response from the communication terminal device can determine the authenticity of the received event execution request or execution response so that the security of information in encrypted communication can be ensured. can do.

Further, in order to achieve the above object, the authentication method according to the fourteenth aspect of the present disclosure is described.
An ID issuing step of issuing an event ID corresponding to a signal received by the server device from the communication terminal device to the event involving the communication terminal device in the server device each time the trigger condition is satisfied.
Each time the event ID is issued in the server device, an ID transmission step of transmitting the issued event ID to the communication terminal device that is the source of the signal corresponding to the issued event ID.
Each time the event ID is issued in the server device, the identification information of the event related to the communication terminal device in the database stored in the database unit of the server device is encrypted with the issued event ID using a common key. An update step to update to the converted identification information,
The communication terminal device transmits the latest signal received from the server device to the server device, including identification information obtained by encrypting the latest event ID with the common key, own terminal information, and event information related to the event. The signal transmission step to be transmitted and
A determination step in which the server device collates the identification information in the signal received from the communication terminal device with the identification information in the database to determine the authenticity of the signal.
including.

According to the authentication method according to the fourteenth aspect of the present disclosure, in the server device, an event ID corresponding to the signal related to the event received from the communication terminal device is issued every time the trigger condition is satisfied, and the signal source and the source of the signal are used. It is transmitted to the communication terminal device.

Further, every time the event ID is issued in the server device, the contents of the database stored in the database unit are updated. This database defines identification information for events involving communication terminal devices. This identification information is generated by encrypting the event ID transmitted to each communication terminal device with a common key. Therefore, when the event ID is issued in the server device, the identification information defined in the database is updated to the identification information generated by using the newly issued event ID.

On the other hand, in the communication terminal device that is the source of the signal, when an event involving the communication terminal device occurs, the identification information in which the event ID received from the server device is encrypted with the same common key as the server device in the communication terminal device. Is generated. Then, a signal including the generated identification information, the terminal information for identifying its own communication terminal device, and the event information regarding the event in which it is involved is transmitted from the communication terminal device to the server device.

In the server device that receives the signal from the communication terminal device, the authenticity of the received signal is determined. In this determination, it is confirmed whether or not the identification information in the signal received by the server device matches the identification information specified in the database.

Then, in the server device, if the identification information in the received signal matches the identification information of the database as a result of collating the database, it is determined that the received signal is genuine. Further, if the identification information in the received signal does not match the identification information in the database, it is determined that the received signal is not genuine.

Here, as the identification information generated by the communication terminal device, the latest event ID among the event IDs received by the communication terminal device up to the time when the event involving the communication terminal device occurs is used. Therefore, the identification information included in the signal transmitted by the communication terminal device to the server device is updated with new contents each time the communication terminal device receives a new event ID from the server device.

Therefore, even if a third party who snoops on the signal transmitted from the communication terminal device at a certain point sends the duplicated signal for an illegal purpose later, the server device checks the identification information and receives the event. Judge that the execution request is not genuine.

Therefore, even if a third party snoops on the communication contents of the communication terminal device and illegally sends the duplicated information to the server device in the encrypted communication using the common key performed by the communication terminal device with the server device, the encryption is performed. It is possible to ensure the security of information in cryptographic communication.

According to the present disclosure, the security of information is ensured even if a third party snoops on the communication contents and illegally sends the duplicated information to the communication partner in the encrypted communication with the communication partner by the common key. It can be planned.

It is a block diagram which shows the communication system which concerns on one Embodiment of this disclosure. It is explanatory drawing of the database stored in the file storage part of the server apparatus of FIG. FIG. 5 is a flowchart showing a procedure of an authentication method executed in an authentication process for an event execution request transmitted from the terminal device to the server device of FIG. 1. FIG. 5 is a flowchart showing a processing procedure including an authentication process for an event execution request from a terminal device executed by the CPU of the server device of FIG. 1 according to a program such as ROM. It is a flowchart which shows the procedure of the process including the authentication enable process for the execution request of the event to the server device which the CPU of the terminal device of FIG. It is a block diagram which shows the communication system which concerns on other embodiment of this disclosure. 6 is a flowchart showing a processing procedure including an authentication process for an information signal from a terminal device executed by the CPU of the server device of FIG. 6 according to a program such as a ROM. 6 is a flowchart showing a processing procedure including an authentication enablement process for an event execution request to the server device executed by the CPU of the terminal device in FIG. 6 according to a program in the storage unit.

Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. FIG. 1 is a block diagram showing a communication system according to an embodiment of the present disclosure.

The communication system 1 (authentication system) of the embodiment shown in FIG. 1 is configured by connecting a server device 100 and a terminal device 200 (communication terminal device) via a network 300. One terminal device 200 may be connected to the network 300, or a plurality of terminal devices 200 may be connected to the network 300. The network 300 can be configured by, for example, a wired or wireless communication line.

Note that FIG. 1 shows a case where one terminal device 200 is connected to the network 300 for the sake of simplicity.

The server device 100 has a CPU 101, a ROM 103, a RAM 105, and a communication unit 109. The ROM 103, RAM 105, file storage unit 107, and communication unit 109 are connected to the CPU 101.

By executing the program of the ROM 103 or each program of the ROM 103 and the file storage unit 107, the CPU 101 virtually puts the instruction execution unit 111, the ID issuing unit 113, the ID transmitting unit 115, and the encryption unit 117 on the CPU 101. To construct. When executing a program such as ROM 103, the CPU 101 uses the RAM 105 as a work area.

The command execution unit 111 (determination unit, issuance request reception unit, event execution unit) outputs an event ID issuance command to the ID issuance unit 113 each time the trigger condition is satisfied. Further, the instruction execution unit 111 determines the authenticity of the signal received from the terminal device 200 by the server device 100 with respect to the event involving the terminal device 200.

The trigger condition can be satisfied, for example, when the server device 100 receives a request for issuing an event ID from the terminal device 200. Further, the trigger condition may be satisfied when the server device 100 finishes executing the processing related to the signal received from the terminal device 200.

Further, when the signal received from the terminal device 200 is a genuine signal, the command execution unit 111 causes the server device 100 to perform processing related to the signal received from the terminal device 200.

The ID issuing unit 113 issues an event ID corresponding to a signal received by the server device 100 from the terminal device 200. The event ID may have unique contents for each signal received from the terminal device 200, and may not be limited to a specific format.

When a plurality of terminal devices 200 are connected to the network 300, the ID issuing unit 113 issues a unique event ID for each terminal device 200. As a result, the authenticity of the signal received from each terminal device 200 can be discriminated by each terminal device 200 and determined by the server device 100.

The ID transmitting unit 115 transmits the event ID issued by the ID issuing unit 113 to the terminal device 200 via the communication unit 109.

The encryption unit 117 (update unit) encrypts the event ID issued by the ID issuing unit 113 with a common key to generate identification information. As the common key, for example, a key stored in the file storage unit 107 described later can be used.

The processes performed by the command execution unit 111, the ID issuing unit 113, the ID transmitting unit 115, and the encryption unit 117 will be described in detail in the following description.

When a plurality of terminal devices 200 are connected to the network 300, a unique common key may be used for each terminal device 200. In that case, for example, the identification information used in the terminal device 200 to which the event ID is transmitted is encrypted with the event ID transmitted to the terminal device 200 with the common key unique to the terminal device 200 of the file storage unit 107. Can be generated.

Alternatively, a shared key common to a plurality of terminal devices 200 connected to the network 300 may be used. In that case, for example, the event ID transmitted to the terminal device 200 is encrypted with the shared key common to each terminal device 200 of the file storage unit 107, and the identification information used in the terminal device 200 to which the event ID is transmitted is transmitted. Can be generated.

Further, the encryption unit 117 uses the identification information generated from the event ID issued by the ID issuing unit 113 as the identification information used in the terminal device 200 to which the ID transmitting unit 115 transmits the event ID, as the database of the file storage unit 107. Store in 119.

The file storage unit 107 (database unit) can be configured by, for example, a non-volatile memory (flash memory), a hard disk drive, or a combination thereof.

As described above, the file storage unit 107 can store the same common key used in the terminal device 200. When a plurality of terminal devices 200 are connected to the network 300, the file storage unit 107 can store a common key unique to each terminal device 200 or a shared key common to each terminal device 200.

The database 119 stored in the file storage unit 107 is a data file that defines the identification information used in the terminal device 200. When the identification information is stored in the database 119, the identification information of the database 119 is updated to the latest identification information every time the identification information is generated by the encryption unit 117.

When a plurality of terminal devices 200 are connected to the network 300, as shown in the explanatory diagram of FIG. 2, identification information is defined in the database 119 for each terminal device 200, and the identification information of the database 119 is stored. It may be updated for each terminal device 200.

When the identification information is specified in the database 119 for a plurality of terminal devices 200, when the server device 100 receives the event ID issuance request from the terminal device 200 and the trigger condition is satisfied, the request source terminal device in the database 119 Update the identification information of 200.

Further, for example, when the server device 100 finishes executing the event requested by the terminal device 200 and the trigger condition is satisfied, the identification information of the request source terminal device 200 in the database 119 is updated.

The communication unit 201 of the terminal device 200 can be connected to the communication unit 109 by a wired or wireless network 300. The communication units 109 and 201 of the server device 100 and the terminal device 200 are communication interfaces that control communication between the server device 100 and the terminal device 200.

In addition to the communication unit 201 described above, the terminal device 200 includes a CPU 203, a storage unit 205, an input unit 207, a display unit 209, and the like.

By executing the program of the storage unit 205, the CPU 203 virtually constructs the ID receiving unit 211, the issuance request transmitting unit 213, and the execution request transmitting unit 215 on the CPU 203.

The CPU 203 can generate a command having the content corresponding to the input operation of the input unit 207 and output the command to the CPU 101 of the server device 100 via the network 300. The command generated by the CPU 203 can be, for example, a command for requesting the execution of an event in the server device 100, or a command for requesting the issuance of an event ID corresponding to the event execution request.

The ID receiving unit 211 receives the event ID transmitted to itself by the server device 100 via the communication unit 201 each time the trigger condition is satisfied.

The issue request transmission unit 213 transmits an event ID issuance request to the server device 100 via the communication unit 201 each time the request condition is satisfied. The requirement condition of the event ID shall be satisfied, for example, when the power of the terminal device 200 is turned on, or when an event execution request for the server device 100 is input from the input unit 207 for the first time after the power of the terminal device 200 is turned on. Can be done.

The execution request transmission unit 215 (signal transmission unit) encrypts the event ID received by the ID reception unit 211 with a common key to generate an identification signal. As the common key, for example, a key stored in the storage unit 205 described later can be used.

The processes performed by the ID receiving unit 211, the issuing request transmitting unit 213, and the execution request transmitting unit 215 will be described in detail in the following description.

The storage unit 205 can be configured by, for example, a non-volatile memory (flash memory), a hard disk drive, or a combination thereof.

For example, the storage unit 205 can store terminal information for identifying the terminal device 200. The terminal information of the terminal device 200 can be attached as terminal information indicating the requesting terminal device 200 to, for example, a command generated by the CPU 203 for requesting execution of an event in the server device 100.

Further, the storage unit 205 can store, for example, a common key used for encryption. The common key stored in the storage unit 205 is the same as the common key stored in the file storage unit 107 of the server device 100 as the common key used by the own terminal device 200. This common key can be used to encrypt the event ID received from the server device 100 and generate identification information. This identification information can be used, for example, to distinguish a signal transmitted by the terminal device 200 to the server device 100 with respect to an event involving the terminal device 200 from other signals.

The input unit 207 can be configured by, for example, a keyboard, a mouse, a touch panel provided on the screen of the display unit 209, or the like. Further, the input contents of the input unit 207 can be confirmed, for example, on the UI (user interface) screen displayed on the display unit 209. The display unit 209 can be configured by, for example, a liquid crystal display.

Between the server device 100 and the terminal device 200 described above, the authentication process by the authentication method shown in the flowchart of FIG. 3 is executed for the signal transmitted by the terminal device 200 to the server device 100 via the network 300. .. This signal is transmitted by the terminal device 200 to the server device 100 with respect to an event involving the terminal device 200.

The authentication method shown in FIG. 3 includes ID issuance, ID transmission, update, signal transmission, and determination steps (step S1, step S3, step S5, step S7, and step S9).

Of these, the ID issuance step of step S1 is a step in which the server device 100 issues an event ID corresponding to a signal received from the terminal device 200 via the network 300 each time the above-mentioned trigger condition is satisfied.

Further, the ID transmission step in step S3 is a step in which the server device 100 transmits the issued event ID to the terminal device 200 each time the event ID is issued in the ID issuance step in step S1.

The destination of the event ID can be, for example, the terminal device 200 that is the request source of the event ID issuance request received by the server device 100. Further, for example, the terminal device 200, which is the execution request source of the event that the server device 100 has finished executing, may be the transmission destination of the event ID. Details of the destination of the event ID will be described later.

Further, the update step of step S5 is a step in which the server device 100 updates the identification information used in the terminal device 200 that has transmitted the event ID in the ID transmission step of step S3 in the database 119 of the file storage unit 107.

In this update step, the server device 100 encrypts the event ID issued in the ID issuance step of step S1 with the common key to generate new identification information. Then, for the terminal device 200 to which the event ID is transmitted, the identification information of the database 119 is updated with the newly generated identification information. For encryption of the event ID, for example, a common key stored in the file storage unit 107 can be used. The common key of the file storage unit 107 is the same common key used in the terminal device 200 to which the event ID is transmitted in the ID transmission step of step S3.

Further, the signal transmission step of step S7 is a step in which the terminal device 200 that has received the event ID transmitted by the server device 100 in the ID transmission step of step S3 transmits a signal relating to the event in which it is involved to the server device 100. ..

Here, the signal transmitted by the terminal device 200 to the server device 100 may include, for example, terminal information of the source terminal device 200, signal identification information, and event information related to an event in which the terminal device 200 is involved. it can.

The event identification information involving the terminal device 200 is obtained by, for example, the terminal device 200 receiving the event ID transmitted by the server device 100 in the ID transmission step of step S3 encrypting the received event ID with a common key. Can be generated. For encryption of the event ID, for example, a common key stored in the storage unit 205 can be used. The common key of the storage unit 205 is the same common key used by the server device 100 for encrypting the event ID in the update step of step S5.

Further, the determination step of step S9 is a step of determining the authenticity of the signal transmitted by the terminal device 200 in the signal transmission step of step S7. The details of the procedure for determining the authenticity of the signal transmitted by the terminal device 200 will be described later.

Each of the above steps is not always performed in the order shown in the flowchart of FIG. All or part of each step may be performed in a procedure different from the order shown in FIG.

Next, an example of a procedure of processing performed by the CPU 101 of the server device 100 according to a program such as ROM 103 in order to authenticate the execution request of the event received by the server device 100 from the terminal device 200 by the method shown in FIG. explain.

FIG. 4 is a flowchart showing an example of a procedure of processing including authentication processing for an event execution request received from the terminal device 200, which is performed by the CPU 101 of the server device 100 according to a program such as ROM 103. The CPU 101 of the server device 100 periodically repeats the processing of the procedure shown in FIG.

First, as shown in FIG. 4, the CPU 101 of the server device 100 confirms whether or not it has received the event ID issuance request from the terminal device 200 connected to the communication unit 109 (step S11). If the event ID issuance request has not been received (NO in step S11), the process proceeds to step S21 described later.

When the event ID issuance request is received (YES in step S11), the CPU 101 issues the event ID on the assumption that the trigger condition is satisfied (step S13).

Then, the CPU 101 transmits the issued event ID to the terminal device 200 that requests the issuance of the event ID via the communication unit 109 (step S15). Further, the CPU 101 encrypts the event ID issued in step S13 with the common key of the event ID issuance request source stored in the file storage unit 107 to generate identification information (step S17).

Further, the CPU 101 updates the identification information used in the terminal device 200 of the event ID issuance request source in the database 119 of the file storage unit 107 with the new identification information generated in step S17 (step S19).

Here, the event ID issuance request includes terminal information for identifying the terminal device 200 that is the event ID issuance request source. Therefore, among the identification information in the database 119 of the file storage unit 107, the identification information updated to the new identification information generated in step S17 is the terminal information of the terminal device 200 during the issuance request of the event ID received in step S11. Can be identified by.

The database 119 of the file storage unit 107 may not store the identification information used in the terminal device 200 that requests the issuance of the event ID. In this case, the terminal information of the terminal device 200 that is requesting the issuance of the event ID received in step S11 is associated with the identification information generated in step S17 using the event ID issued in step S13. Then, the associated terminal information and the identification information are added to and stored in the database 119 of the file storage unit 107, and the identification information used in the terminal device 200 of the event ID issuance request source is updated.

The above-mentioned step S15, step S17 and step S19 may be executed in the reverse order, or may be executed in parallel at the same time. After executing the processes up to step S19, a series of processes is completed.

On the other hand, in step S11, when the event ID issuance request is not received (NO), the CPU 101 receives an event execution request (corresponding to a signal) from the terminal device 200 connected to the communication unit 109. ) Is received or not. If the event execution request has not been received (NO in step S21), the series of processes is terminated.

When the event execution request is received (YES in step S21), the CPU 101 determines whether or not the received event execution request is genuine (step S23).

Here, the received event execution request includes the terminal information of the terminal device 200 that is the event execution request source, the event execution request identification information (corresponding to the signal identification information), and the content of the event for which execution is requested. Contains the content information (corresponding to event information) to be shown. The identification information included in the event execution request is generated by the terminal device 200, which is the source of the event ID issuance request that received the event ID transmitted in step S15, by encrypting the received event ID with a common key.

Therefore, the authenticity of the execution request of the event received in step S21 is, for example, the identification information in the received execution request and the identification information defined in the database 119 of the file storage unit 107 for the terminal device 200 of the execution request source. It can be judged by the collation of. The identification information defined in the database 119 for the terminal device 200 of the execution request source can be specified by the terminal information in the execution request of the event received in step S21.

Then, for example, if the identification information in the execution request of the received event matches the identification information of the database 119, the CPU 101 determines that the execution request of the received event is genuine. Further, for example, if the identification information in the execution request of the received event does not match the identification information of the database 119, the CPU 101 determines that the execution request of the received event is not genuine.

As a result of the determination, if the received event execution request is not genuine (NO in step S23), the CPU 101 discards the received event execution request (step S25). Then, the CPU 101 notifies the terminal device 200 of the event execution request source that the event execution request has been discarded (step S27), and ends a series of processes.

If the execution request of the received event is genuine (YES in step S23), the CPU 101 causes the server device 100 to execute the event corresponding to the content information in the execution request of the received event (step S29).

Then, the CPU 101 confirms whether or not the event executed by the server device 100 has ended (step S31). If the event has not ended (NO in step S31), step S31 is repeated. When the event ends (YES in step S31), the CPU 101 issues an event ID assuming that the trigger condition is satisfied (step S33).

Then, the CPU 101 transmits the issued event ID to the terminal device 200 of the event execution request source via the communication unit 109 (step S35). Further, the CPU 101 encrypts the event ID issued in step S33 with the common key of the event execution request source to generate identification information (step S37).

Further, the CPU 101 updates the identification information about the event execution request source in the database 119 of the file storage unit 107 with the new identification information generated in step S37 (step S39).

The terminal device 200 of the signal transmission source can be specified by the terminal information during the execution request of the event received in step S21.

The above-mentioned step S35, step S37 and step S39 may be executed in the reverse order, or may be executed in parallel at the same time. After executing the processes up to step S39, a series of processes is completed.

As is clear from the above description, in the present embodiment, step S11 in the flowchart of FIG. 4 corresponds to the process performed by the command execution unit 111 of FIG. 1 corresponding to the issuance request receiving unit. Further, in the present embodiment, step S23 in FIG. 4 corresponds to the process performed by the command execution unit 111 of FIG. 1 corresponding to the determination unit and the process of the determination step of step S9 in the flowchart of FIG. ..

Further, in the present embodiment, step S29 in FIG. 4 corresponds to the process performed by the command execution unit 111 of FIG. 1 corresponding to the event execution unit. Further, in the present embodiment, steps S13 and S33 in FIG. 4 correspond to the processing performed by the ID issuing unit 113 in FIG. 1 and the processing of the ID issuing step in step S1 in FIG.

Further, in the present embodiment, steps S15 and S35 in FIG. 4 correspond to the processing performed by the ID transmission unit 115 of FIG. 1 and the processing of the ID transmission step of step S3 in the flowchart of FIG. Further, in the present embodiment, step S17, step S19, step S37 and step S39 in FIG. 4 correspond to the process performed by the encryption unit 117 in FIG. 1 and the process of the update step in step S5 in FIG. are doing. Further, in the present embodiment, step S21 in FIG. 4 performed by the CPU 101 is a process corresponding to a signal receiving unit that receives a signal related to an event from the communication terminal device.

Next, an example of a processing procedure performed by the CPU 203 of the terminal device 200 according to the program of the storage unit 205 in order to authenticate the execution request of the event received by the server device 100 from the terminal device 200 by the method shown in FIG. To explain.

FIG. 5 is a flowchart showing an example of a processing procedure including an authentication enablement process for an event execution request transmitted to the server device 100, which is performed by the CPU 203 of the terminal device 200 according to the program of the storage unit 205. The CPU 203 of the terminal device 200 periodically repeats the process of the procedure shown in FIG.

First, as shown in FIG. 5, the CPU 203 of the terminal device 200 confirms whether or not the event ID from the server device 100 connected to the communication unit 201 has been received (step S41). When the event ID is received (YES in step S41), the CPU 203 stores the received event ID in the storage unit 205 (step S43), and then ends a series of processes. If the event ID is already stored in the storage unit 205, the new event ID received in step S41 is overwritten and stored in the storage unit 205.

If the event ID has not been received (NO in step S41), the CPU 203 confirms whether or not the condition for requesting the server device 100 to issue the event ID is satisfied (step S45).

The condition for requesting the server device 100 to issue an event ID may be satisfied, for example, when the power of the terminal device 200 is turned on, and the event execution request for the server device 100 is first input from the input unit 207. It may be established when (before input).

If the issuance of the event ID is requested when the power of the terminal device 200 is turned on, the event ID issued by the server device 100 can be acquired before the event execution request is transmitted from the terminal device 200 to the server device 100. ..

Therefore, the terminal device 200 can generate the identification information in which the event ID is encrypted with the same common key as the server device 100 in advance before the transmission of the event execution request. Therefore, the timing at which the terminal device 200 outputs the event execution request including the identification information as well as the terminal information and the content information to the server device 100 can be accelerated.

On the other hand, if the issuance of the event ID is requested when the event execution request to the server device 100 is first input from the input unit 207, the process from the issuance of the event ID by the server device 100 to the transmission of the event execution request by the terminal device 200 is performed. The time difference becomes shorter. Therefore, for example, the risk of occurrence of a problem such as a failure of the server device 100 after the issuance of the event ID and the event ID of the file storage unit 107 which is the same as the event ID of the storage unit 205 of the terminal device 200 is deleted is reduced as much as possible. be able to.

Then, when the condition for requesting the issuance of the event ID is satisfied (YES in step S45), the CPU 203 transmits the event ID issuance request to the server device 100 via the communication unit 201 (step S47). Then, a series of processing is completed.

The event ID issuance request transmitted by the CPU 203 to the server device 100 includes terminal information for identifying the terminal device 200 stored in the storage unit 205.

On the other hand, if the condition for requesting the issuance of the event ID is not satisfied (NO in step S45), the CPU 203 has input from the input unit 207 requesting the server device 100 to execute the event. Is confirmed (step S49). If there is no input requesting the execution of the event (NO in step S49), the series of processes is terminated.

If there is an input requesting the execution of the event (YES in step S49), the CPU 203 transmits the event execution request to the server device 100 via the communication unit 201 (step S51). Then, a series of processing is completed.

The event execution request transmitted by the CPU 203 to the server device 100 includes the terminal information of the terminal device 200 stored in the storage unit 205, the identification information of the event execution request, and the event requesting the server device 100 to execute the event. Content information indicating the content of is included.

The identification information of the event execution request can be generated by encrypting the event ID stored in the storage unit 205 with the common key stored in the storage unit 205.

The content of the event for which the server device 100 is requested to be executed can be specified from the content information during the event execution request from the input unit 207 for which the input is confirmed in step S45.

As is clear from the above description, in the present embodiment, step S41 in the flowchart of FIG. 5 corresponds to the process performed by the ID receiving unit 211 of FIG. Further, in the present embodiment, step S47 in FIG. 5 corresponds to the process performed by the issuance request transmission unit 213 of FIG. Further, in the present embodiment, step S51 in FIG. 5 corresponds to the process performed by the execution request transmission unit 215 in FIG. 1 and the process of the signal transmission step in step S7 in FIG.

According to the communication system 1 of the present embodiment described above, when the server device 100 receives an event ID issuance request from the terminal device 200 including the terminal information of the terminal device 200, the event ID is issued and the terminal information is issued. It is transmitted to the terminal device 200 of the issuance request source corresponding to. Further, the identification information used in the terminal device 200 of the event ID issuance request source in the database 119 of the file storage unit 107 of the server device 100 encrypts the issued event ID with the common key of the issuance request source terminal device 200. It will be updated with the new identification information.

On the other hand, in the terminal device 200 that has received the event ID from the server device 100 and is the source of the event ID issuance request, the event ID of the storage unit 205 is updated to the new event ID received.

Further, when an event execution request to the server device 100 is input from the input unit 207 of the terminal device 200, the event ID stored in the storage unit 205 is encrypted with the common key stored in the storage unit 205. Identification information for the event execution request is generated. Then, the identification information of the generated event execution request, the content information of the event requested to be executed by the server device 100 input from the input unit 207, and the terminal information of the terminal device 200 stored in the storage unit 205 are included. The event execution request is transmitted to the server device 100.

The server device 100 that has received the event execution request from the terminal device 200 determines the authenticity of the received event execution request. In this determination, it is confirmed whether or not the identification information in the execution request received by the server device 100 matches the identification information specified in the database 119 of the file storage unit 107 for the terminal device 200 that is the execution request source of the event. To.

If the identification information in the execution request of the event received by the server device 100 does not match the identification information of the database 119, it is determined that the execution request of the received event is not genuine. Then, the execution request of the event determined to be not genuine is discarded. Therefore, the execution request of the event that is not genuine is not executed by the server device 100.

On the other hand, when the identification information in the execution request of the event received by the server device 100 matches the identification information of the database 119, it is determined that the execution request of the received event is genuine. Then, the event indicated in the content information of the event of the execution request determined to be genuine is executed by the server device 100.

When the event requested from the terminal device 200 is completely executed by the server device 100, the event ID is issued by the server device 100, and the execution request corresponding to the terminal information in the execution request of the event received by the server device 100 is issued. It is transmitted to the original terminal device 200. In addition, new identification information in which the issued event ID is encrypted with the common key of the terminal device 200 that is the execution request source is generated in the server device 100. Then, the identification information used in the terminal device 200 of the event execution request source in the database 119 of the file storage unit 107 of the server device 100 is updated with the generated new identification information.

On the other hand, in the terminal device 200 of the event execution request source that has received the event ID from the server device 100, the event ID of the storage unit 205 is updated with the new event ID received.

Therefore, every time the event requested to be executed by the terminal device 200 is executed by the server device 100, the event ID used for determining the authenticity of the event execution request is updated.

Therefore, even if a third party snoops on the communication contents of the terminal device 200 and illegally transmits the duplicated information to the server device 100 in the encrypted communication by the terminal device 200 with the server device 100 by the common key. , Information security in encrypted communication can be ensured.

The configuration in which the terminal device 200 sends an event ID issuance request to the server device 100, causes the server device 100 to issue the event ID, and sends the event ID to the issuing request source terminal device 200 is omitted. May be good.

Alternatively, when the event requested by the terminal device 200 is completed in the server device 100, the configuration in which the server device 100 issues the event ID and transmits the event to the terminal device 200 that requests the execution of the event may be omitted. Good.

Further, when a plurality of terminal devices 200 are connected to the network 300, the ID issuing unit 113 may simultaneously issue a common event ID to each terminal device 200.

For example, in the case of an operation in which the server device 100 requests and collects the information that each terminal device 200 has, it is common to the signals transmitted by each terminal device 200 to provide the information to the server device 100. The identification information generated from the event ID of can be used.

In another embodiment of the present disclosure relating to this case, the communication system 1 (authentication system) connects the server device 100 and the terminal device 200 (communication terminal device) via the network 300 as shown in the block diagram of FIG. It is composed of. One terminal device 200 may be connected to the network 300, or a plurality of terminal devices 200 may be connected to the network 300. The network 300 can be configured by, for example, a wired or wireless communication line.

Note that FIG. 6 also shows a case where one terminal device 200 is connected to the network 300 for ease of explanation, as in the previous embodiment.

Then, in the communication system 1 of the present embodiment, the issuance request transmission unit 213 virtually constructed on the CPU 203 of the terminal device 200 in the previous embodiment is omitted, and the execution request transmission unit 215 is the information signal transmission unit 217. Has been replaced by. The other parts of the terminal device 200 are configured in the same manner as the terminal device 200 of the previous embodiment except for the program of the storage unit 205 executed by the CPU 203. Further, the server device 100 is also configured in the same manner as the server device 100 of the previous embodiment except for the program of the file storage unit 107 executed by the CPU 101.

Next, an example of a procedure of processing performed by the CPU 101 of the server device 100 according to a program such as ROM 103 in order to authenticate the information signal received by the server device 100 from the terminal device 200 by the method shown in FIG. 3 will be described. ..

FIG. 7 is a flowchart showing an example of a procedure of processing including authentication processing for an information signal received from the terminal device 200, which is performed by the CPU 101 of the server device 100 according to a program such as ROM 103, according to another embodiment of the present disclosure. is there. The CPU 101 of the server device 100 periodically repeats the processing of the procedure shown in FIG. 7.

First, as shown in FIG. 7, the CPU 101 of the server device 100 confirms whether or not the condition for requesting information collection from each terminal device 200 is satisfied (step S61). If the condition is not satisfied (NO in step S61), the process proceeds to step S71 described later.

If the condition is satisfied (YES in step S61), the CPU 101 issues an event ID (step S63).

Then, the CPU 101 broadcasts an information collection request (corresponding to an event execution request) including the issued event ID to each terminal device 200 on the network 300 via the communication unit 109 (step S65). Further, the CPU 101 encrypts the event ID issued in step S63 with a common key corresponding to each terminal device 200 stored in the file storage unit 107 to generate identification information (step S67).

At this time, if the common key is different for each terminal device 200, the identification information used in each terminal device 200 is generated by encrypting the common event ID with the common key for each terminal device 200. When the common key of each terminal device 200 is the same, the common event ID is encrypted with the same common key to generate common identification information used in each terminal device 200.

Then, the CPU 101 updates the identification information used in each terminal device 200 in the database 119 of the file storage unit 107 with the new identification information generated in step S67 (step S69).

The database 119 of the file storage unit 107 may not store the identification information used in each terminal device 200. In this case, the terminal information of each terminal device 200 is associated with the identification information generated in step S17 by using the event ID issued in step S63. Then, the terminal information and the identification information of the associated terminal device 200 are added to the database 119 of the file storage unit 107 and stored, and the identification information used in each terminal device 200 is updated.

The above-mentioned step S65, step S67 and step S69 may be executed in the reverse order, or may be executed in parallel at the same time. After executing the processes up to step S69, the CPU 101 confirms whether or not it has received an information signal (corresponding to a signal and an event execution response) from each terminal device 200 in response to the transmission request of the collected information (step S71). ..

If the information signal from each terminal device 200 is not received (at least in part) (NO in step S71), step S71 is repeated. Further, when (all) the information signals from the terminal devices 200 are received (YES in step S71), the CPU 101 determines whether or not the received information signals are genuine (step S73).

Here, the received information signal is the terminal information of the terminal device 200 of the source of the information signal, the identification information of the information signal (corresponding to the identification information of the signal), and the contents of the information collected by the terminal device 200 of the transmission source. Contains content information (corresponding to event result information) indicating (data). The identification information included in the information signal is generated by the terminal device 200, which is the source of the information signal that received the event ID transmitted in step S65, by encrypting the received event ID with a common key.

Therefore, the authenticity of the information signal received in step S71 is, for example, the identification information in the received information signal and the identification information defined in the database 119 of the file storage unit 107 for the terminal device 200 that is the source of the information signal. It can be judged by the collation of. The identification information defined in the database 119 for the terminal device 200 that is the source of the information signal can be specified by the terminal information in the information signal received in step S71.

Then, for example, if the identification information in the received information signal matches the identification information in the database 119, the CPU 101 determines that the received information signal is genuine. Further, for example, if the identification information in the received information signal does not match the identification information in the database 119, the CPU 101 determines that the received information signal is not genuine.

As a result of the determination, if the received information signal is not genuine (NO in step S73), the CPU 101 discards the received information signal (step S75). Then, the CPU 101 notifies the terminal device 200 of the information signal transmission source that the information signal has been discarded (step S77), and ends the series of processes.

If the received information signal is genuine (YES in step S73), the CPU 101 acquires the content information data in the received information signal (step S79). The acquired data can be stored in the file storage unit 107 together with the time stamp and used for analysis or the like.

If the received information signal is not genuine, only the non-genuine information signal may be discarded in step S75, and only the source of the non-genuine information signal may be notified in step S77. Alternatively, if the received information signal is not genuine, all the information signals including the genuine information signal may be discarded in step S75, and the source of all the information signals may be notified in step S77 that the signal has been discarded. ..

As is clear from the above description, in the present embodiment, step S63 in the flowchart of FIG. 7 is a process performed by the ID issuing unit 113 of FIG. 6 and a process of the ID issuing step of step S1 in FIG. It corresponds. Further, in the present embodiment, step S55 in FIG. 7 corresponds to the process performed by the ID transmission unit 115 in FIG. 6 and the process of the ID transmission step in step S3 in the flowchart of FIG.

Further, in the present embodiment, steps S67 and S69 in FIG. 7 correspond to the process performed by the encryption unit 117 in FIG. 6 and the process of the update step in step S5 in FIG. Further, in the present embodiment, step S73 in FIG. 7 corresponds to the process performed by the command execution unit 111 of FIG. 6 corresponding to the determination unit and the process of the determination step of step S9 in the flowchart of FIG. ..

Next, an example of a procedure of processing performed by the CPU 203 of the terminal device 200 according to the program of the storage unit 205 in order to authenticate the information signal received by the server device 100 from the terminal device 200 by the method shown in FIG. 3 will be described. To do.

FIG. 8 shows an example of a procedure of processing including authentication enabling processing for an information signal transmitted to the server device 100, which is performed by the CPU 203 of the terminal device 200 according to the program of the storage unit 205, according to another embodiment of the present disclosure. It is a flowchart which shows. The CPU 203 of the terminal device 200 periodically repeats the process of the procedure shown in FIG.

First, as shown in FIG. 8, the CPU 203 of the terminal device 200 confirms whether or not it has received the information collection request from the server device 100 connected to the communication unit 201 (step S81). If the collection request has not been received (NO in step S81), the series of processes is terminated.

When the collection request is received (YES in step S81), the CPU 203 stores the event ID in the received collection request in the storage unit 205 (step S83). If the event ID is already stored in the storage unit 205, the new event ID received in step S81 is overwritten and stored in the storage unit 205.

Then, the CPU 203 transmits an information signal to the server device 100 via the communication unit 201 (step S85). Then, a series of processing is completed.

The information signal transmitted by the CPU 203 to the server device 100 includes the terminal information of the terminal device 200 stored in the storage unit 205, the identification information of the information signal, and the content (data) of the information collected by the terminal device 200. The content information to be shown is included.

The identification information of the information signal can be generated by encrypting the event ID stored in the storage unit 205 with the common key stored in the storage unit 205.

The information transmitted from the terminal device 200 to the server device 100 by the information signal is collected by the information collection process performed by the CPU 203 according to a program (not shown) of the storage unit 205.

As is clear from the above description, in the present embodiment, step S81 in the flowchart of FIG. 8 corresponds to the process performed by the ID receiving unit 211 of FIG. Further, in the present embodiment, step S85 in FIG. 8 corresponds to the process performed by the execution request transmission unit 215 in FIG. 6 and the process of the signal transmission step in step S7 in FIG.

According to the communication system 1 of the present embodiment described above, the event ID is issued in the server device 100 each time the condition for requesting information collection from each terminal device 200 is satisfied. Then, the information collection request including the issued event ID is broadcast-transmitted from the server device 100 to each terminal device 200. Further, the identification information used in the terminal device 200 of the event ID issuance request source in the database 119 of the file storage unit 107 of the server device 100 encrypts the issued event ID with the common key of the issuance request source terminal device 200. It will be updated with the new identification information.

In each terminal device 200 that has received the information collection request from the server device 100, the event ID of the storage unit 205 is updated to the event ID in the received information collection request. Further, the identification information of the information signal is generated by encrypting the updated event ID with the common key stored in the storage unit 205. Then, the information signal including the identification information of the generated information signal, the content information indicating the content (data) of the information collected in the terminal device 200, and the terminal information of the terminal device 200 stored in the storage unit 205 is It is transmitted to the server device 100.

In the server device 100 that has received the information signal from each terminal device 200, the authenticity of the received information signal is determined for each information signal from each terminal device 200. In this determination, it is confirmed whether or not the identification information in the information signal received by the server device 100 matches the identification information defined in the database 119 of the file storage unit 107 for the terminal device 200 that is the source of the information signal. To.

When the identification information in the information signal received by the server device 100 matches the identification information in the database 119, it is determined that the received information signal is genuine. Then, the data shown in the content information of the information signal determined to be genuine is acquired by the server device 100.

On the other hand, if the identification information in the information signal received by the server device 100 does not match the identification information in the database 119, it is determined that the received information signal is not genuine. Then, the information signal determined to be not genuine is discarded. At this time, the genuine information signal from the other terminal device 200 may be discarded together with the non-genuine information signal, or may not be discarded. When only the information signal that is not genuine is discarded, the data of the content information of the information signal that is genuine is acquired by the server device 100. In any case, the data of the information signal which is not genuine is not acquired by the server device 100.

After that, each time the condition for requesting information collection from each terminal device 200 is satisfied, the above-mentioned series of processes is repeatedly executed.

Therefore, even if a third party snoops on the communication contents of the terminal device 200 and illegally transmits the duplicated information to the server device 100 in the encrypted communication by the terminal device 200 with the server device 100 by the common key. , Information security in encrypted communication can be ensured.

The method for authenticating the authenticity of the event execution request from the server device, the communication terminal device, and the communication terminal device to the server device described in each of the above embodiments is between the server device and the communication terminal device. It can be widely applied in a system that executes communication with a server.

1 Communication system (authentication system)
100 Server device 101 CPU (Issue request receiver)
103 ROM
105 RAM
107 File storage (database)
109,201 Communication unit 111 Command execution unit (judgment unit, event execution unit)
113 ID issuing unit 115 ID transmitting unit 117 Encryption unit (update unit)
119 Database 200 Terminal device (communication terminal device)
203 CPU
205 Storage unit 207 Input unit 209 Display unit 211 ID reception unit 213 Issuance request transmission unit 215 Execution request transmission unit 217 Information signal transmission unit 300 Network

Claims (14)

A database section that stores a database of identification information for events involving communication terminal devices,
An ID issuing unit that issues an event ID corresponding to a signal related to the event received from the communication terminal device each time a trigger condition is satisfied.
Each time the ID issuing unit issues the event ID, an ID transmitting unit that transmits the issued event ID to the communication terminal device that is the source of the signal corresponding to the issued event ID.
Each time the ID issuing unit issues the event ID, the updating unit updates the identification information of the database with the identification information obtained by encrypting the issued event ID with a common key.
Regarding the terminal information of the communication terminal device from the communication terminal device that received the event ID, the identification information obtained by encrypting the latest event ID received by the communication terminal device with the common key, and the event. A signal receiving unit that receives the signal including event information,
A determination unit that determines the authenticity of the signal by collating the identification information in the signal received by the signal receiving unit with the identification information in the database.
A server device that comprises. The ID issuing unit issues the event ID for each communication terminal device corresponding to the execution request of the event received as the signal from each communication terminal device.
The ID transmission unit transmits the issued event ID to the communication terminal device which is the request source of the execution request corresponding to the issued event ID.
The event information in the execution request received by the signal receiving unit includes the content information of the event for which the communication terminal device that has received the event ID requests execution in response to the execution request.
The determination unit stores the identification information in the execution request received by the signal receiving unit in the database unit for the communication terminal device corresponding to the terminal information in the execution request. The authenticity of the execution request is determined by collating with the identification information.
The server device according to claim 1. The ID issuing unit further includes an event execution unit that executes the event corresponding to the content information in the execution request that the determination unit determines to be genuine, and the ID issuing unit executes the event execution by the event execution unit. The second aspect of claim 2, wherein the event ID is issued as the trigger condition is satisfied, and the ID transmission unit transmits the issued event ID to the communication terminal device of the request source of the event executed by the event execution unit. Server device. The ID issuing unit issues the event ID corresponding to the execution response of the event received as the signal from the communication terminal device that executed the event in response to the execution request of the event.
The ID transmission unit transmits the issued event ID to the communication terminal device as a response source of the execution response corresponding to the issued event ID.
The event information in the execution response received by the signal receiving unit includes the result information of the event executed by the communication terminal device that received the event ID in response to the execution request.
The determination unit stores the identification information in the execution response received by the signal receiving unit in the database unit for the communication terminal device corresponding to the terminal information in the execution response. The authenticity of the execution response is determined by collating with the identification information.
The server device according to claim 1. The issue request receiving unit for receiving the issuance request of the event ID including the terminal information from the communication terminal device is further provided, and the ID issuing unit triggers the reception of the issuing request by the issuing request receiving unit as the trigger condition. Is established, the event ID is issued, the ID transmission unit transmits the issued event ID to the event ID issuance request source, and the update unit corresponds to the terminal information in the issuance request. The server device according to claim 2, 3 or 4, which updates the identification information in the database stored in the database unit for the communication terminal device. An ID receiver that receives event IDs from the server device to which signals related to event execution are transmitted, and
A signal transmission for transmitting the signal including the latest event ID received by the ID receiving unit, which is encrypted with a common key, own terminal information, and event information related to the execution of the event, to the server device. Department and
Communication terminal device including. The ID receiving unit receives the event ID addressed to itself from the server device to which the event execution request, which is the signal, is requested, and receives the event ID.
The event information in the execution request transmitted by the signal transmission unit includes content information of the event for which the server device is requested to execute.
The communication terminal device according to claim 6. The ID receiving unit receives the event ID addressed to itself from the server device that requests the execution request of the event, and receives the event ID.
When the event is executed in response to the execution request of the event received from the server device, the event information in the execution response of the event transmitted as the signal by the signal transmitting unit is the event information executed by the execution request. Contains result information,
The communication terminal device according to claim 6. An issuance request transmitting unit for transmitting an event ID issuance request including its own terminal information to the server device is further provided, and the ID receiving unit is an event addressed to the self from the server device that has received the issuance request. The communication terminal device according to claim 7 or 8, which receives an ID. The server device according to claim 1 and
The communication terminal device according to claim 6 and
Authentication system with. The server device according to claim 2 or 3,
The communication terminal device according to claim 7 and
Authentication system with. The server device according to claim 4 and
The communication terminal device according to claim 8 and
Authentication system with. The server device according to claim 5 and
The communication terminal device according to claim 9 and
Authentication system with. An ID issuing step of issuing an event ID corresponding to a signal received by the server device from the communication terminal device to the event involving the communication terminal device in the server device each time the trigger condition is satisfied.
Each time the event ID is issued in the server device, an ID transmission step of transmitting the issued event ID to the communication terminal device that is the source of the signal corresponding to the issued event ID.
Each time the event ID is issued in the server device, the identification information of the event related to the communication terminal device in the database stored in the database unit of the server device is encrypted with the issued event ID using a common key. An update step to update to the converted identification information,
The communication terminal device transmits the latest signal received from the server device to the server device, including identification information obtained by encrypting the latest event ID with the common key, own terminal information, and event information related to the event. The signal transmission step to be transmitted and
A determination step in which the server device collates the identification information in the signal received from the communication terminal device with the identification information in the database to determine the authenticity of the signal.
Authentication methods including.

Images