JP2022077449A - Authentication system using location information - Google Patents

Abstract

To propose an authentication system with enhanced security by taking into account a user's location.SOLUTION: A location authentication unit 78 determines whether the user is in a pre-set location where an application server 26 is available for use on the basis of information regarding a location of a user terminal transmitted from a user information transmitting unit 54 or a user and location information transmitting unit 64, user identification information, and information stored in a location information authentication database 88. A user authentication unit 74 determines whether the user is qualified to use a service by a user on the basis of the user identification information transmitted from the user information transmitting unit 54 and the user and location information transmitting unit 64 and the information stored in the location information authentication database 88 when the user is determined by a location authentication unit 78 to be in the available location.SELECTED DRAWING: Figure 1

Description

The present invention relates to an authentication system when using a server via a network, and particularly relates to a technique that enables authentication in consideration of the position of a user.

In recent years, a form of using software (application) via a network, such as ASP (Application Service Provider) or SaaS (Software as a Service), has been used. In this embodiment, the software is executed on the server, while the client computer is connected to the server via the network. Therefore, the software executed by the server can be used by the client like a service.

In such a form, authentication is performed to confirm the usage qualification of the server. For example, a person who is qualified to use and / or whether or not it is a computer is authenticated. Patent Document 1 discloses an example of such certification in SaaS.

Here, in the authentication, for example, authentication using a user's ID and password or authentication using a code unique to the computer as the user terminal (for example, MAC address) is performed, so that the user qualification can be used in advance. It is determined whether the user is given the password or the user is using the computer registered in advance.

Japanese Unexamined Patent Publication No. 2002-149607

By the way, in the form like SaaS, if the user terminal can connect to the server via the network and the user qualification can be confirmed by the above-mentioned authentication, the user terminal can be connected to the server regardless of the location of the user terminal. You will be able to do it. While such a point is an advantage of the form like SaaS, there are cases where it is desired to limit the available place from the viewpoint of confidentiality and the like.

The present invention has been made to solve such a problem, and relates to an authentication system using location information.

The gist of the first invention is that (a) a transmitter that transmits information about the position of the user terminal and user identification information, and (b) information about a position that the user can authenticate is the user. The available location database stored for each user, (c) the authentication database stored for each user with information about the user's usage qualification, and (d) the information about the location of the user terminal transmitted from the transmitter. A position authentication unit that determines whether or not the user is in a preset available position of the service based on the information stored in the available location database, and (e) the user by the location authentication unit. When it is determined that the user is in the available position, it is determined whether or not the user is eligible to use the service based on the user's identification information transmitted from the transmitter and the information stored in the authentication database. It is an authentication system using location information, which is characterized by having a usage qualification authentication unit.

According to the first invention, the user is preset by the location authentication unit based on the information regarding the position of the user terminal transmitted from the transmission unit and the information stored in the available position database. When it is determined whether the service is in the available position and the location authentication unit determines that the user is in the available position, the usage qualification authentication unit transmits the usage from the transmission unit. Whether or not the user is eligible to use the service is determined based on the identification information of the person and the information stored in the authentication database.

Preferably, (f) the authentication database stores information about the user's usage qualification for each of the plurality of services, and (g) the usage qualification authentication unit has the plurality of users. For each of the services of the above, it is determined whether or not the user is qualified to use the service. In this way, when a plurality of services are provided, it is possible to determine whether or not there is a usage qualification for each of the plurality of services.

Preferably, (h) the user qualification authentication unit has a transmission unit that transmits information for making the user available for each of the servers that provide each of the plurality of services. .. By doing so, the user does not hold the information for making the user available for the server in advance, so that the security can be improved.

Preferably, (i) the information regarding the position of the user terminal is the position information obtained by positioning the position of the user terminal. By doing so, the position of the terminal to be used can be automatically acquired.

Preferably, (j) the information regarding the position of the user terminal is the position-fixed terminal identification information uniquely given in advance to the position-fixed terminal installed in the position-fixed position with which the user terminal can communicate, and (k). The available position database is characterized in that information about a position that can be authenticated by the user is stored as a combination of the user's identification information and the position-fixed terminal identification information. By doing so, the information regarding the position of the terminal to be used is given in advance, so that subsequent falsification can be prevented.

It is a figure explaining the outline of the structure in one Example of the authentication system of this invention. It is a functional block diagram explaining the outline of the function which a user terminal has in the authentication system of FIG. It is a functional block diagram explaining the outline of the function which a position authentication terminal has in the authentication system of FIG. It is a functional block diagram explaining the outline of the function which the authentication server has in the authentication system of FIG. It is a functional block diagram explaining the outline of the function which a storage device has in the authentication system of FIG. It is a figure explaining an example of the information stored in the position information database in the storage device of FIG. It is a figure explaining an example of the information stored in the location information authentication database in the storage device of FIG. It is a figure explaining an example of the information stored in the SSO authentication database in the storage device of FIG. It is a functional block diagram explaining the outline of the function which the application server which operates in cooperation with the authentication system of FIG. 1 has. It is a flowchart explaining the outline of the authentication operation of the user terminal in the authentication system of FIG. 1, and mainly explains the operation of the part until the position information is registered in the position information database. It is a flowchart explaining the outline of the authentication operation of a user terminal in the authentication system of FIG. 1, and mainly explains the part corresponding to the authentication operation using the location information. It is a functional block diagram explaining the outline of the function which a position authentication terminal has in another embodiment of the authentication system of FIG. 1, and is the figure corresponding to FIG. It is a figure explaining another example of the information stored in the position information authentication database in the storage device of FIG. 5, and is the figure corresponding to FIG. 7. It is a figure explaining another example of the information stored in the SSO authentication database in the storage device of FIG. 5, and is the figure corresponding to FIG.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a diagram illustrating an example of a configuration of an authentication system 10 (hereinafter, also simply referred to as “authentication system 10”) using the position information of the present invention. The authentication system 10 includes a user terminal 12, a location authentication terminal (location authentication device) 14, an access point 16, an authentication server 22, a storage device 24 as a database, and an application server 26. In FIG. 1, three position authentication terminals 14A, 14B, and 14C are provided at different positions as a plurality of position authentication terminals 14. Two application servers 26A and 26B are provided as the application server 26. These application servers 26A and 26B provide different applications, for example, and the user himself / herself specifies which of the application servers 26A and 26B he / she wants to use. In the following description, when each of the plurality of location authentication terminals 14A to B is not distinguished, it is simply referred to as the location authentication terminal 14. The same applies to the application server 26. Further, the access point 16, the authentication server 22, the storage device 24, and the application server 26 are connected to a network 30 such as the Internet, and can communicate with each other. Communication between each device via the network 30 may be appropriately taken by means such as encryption.

The user terminal 12 and the location authentication device 14 are connected to the access point 16 so as to be able to communicate with each other by wireless communication. As a result, the user terminal 12 and the location authentication device 14 can communicate with the device connected to the network 30 via the network 30, respectively. Further, the user terminal 12 and the location authentication device 14 can communicate with each other. Here, the fact that the user terminal 12 and the location authentication device 14 can communicate with each other can be regarded as the fact that the user terminal and the location authentication device 14 are at the same position, so that the user terminal and the location authentication device 14 can communicate with each other. The standard, frequency, radio wave strength, etc. of the wireless communication with the position authentication device 14 are selected. It should be noted that the three position authentication devices 14A, 14B, 14C in this embodiment not only have different positions, but also have overlapping ranges in which wireless communication is possible between each of the position authentication devices 14A, 14B, 14C and the user terminal 12. It is arranged so as not to.

FIG. 2 is a functional block diagram illustrating a part of the functions of the user terminal 12. The user terminal 12 is a so-called personal computer PC, a tablet computer, or the like, and by being operated by the user using an input / output device, the location authentication device 14, the authentication server 22, and the application server 26 can be operated as described later. Operates including transmission and reception of information.

As shown in FIG. 2, the user terminal 12 functionally has a user authentication request unit 52, a user information transmission unit 54, a service authentication information acquisition unit 56, a service authentication request unit 58, and a service disconnection execution unit 59. There is. The user authentication request unit 52, for example, provides user authentication information for the authentication server 22 input from an input device such as a keyboard or a touch panel, specifically, a user ID and password, to a user information transmission unit 54, which will be described later, and It is transmitted to the user authentication unit 74 of the authentication server 22 described later via the wireless communication unit 60, respectively.

The user information transmission unit 54 transmits the user authentication information input to the user authentication request unit 52 to the user / location information transmission unit 64 of the location authentication terminal 14 and the user authentication unit 74 of the authentication server 22 via the wireless communication unit 60. And send.

The wireless communication unit 60 performs wireless communication according to a standard such as a wireless LAN or Bluetooth (registered trademark).

The service authentication information acquisition unit 56 transmits the user authentication information to the service authentication information issuing unit 80 of the authentication server 22 described later, and if the authentication result service can be used, the service authentication information acquisition unit 56 is used for using the application server 26. The service authentication information is acquired from the service authentication information issuing unit 80.

When the service authentication information acquisition unit 56 acquires the authentication information from the service authentication information issuing unit 80, the service authentication request unit 58 uses the authentication information to contact the service authentication unit 94 of the application server 26 corresponding to the authentication information. On the other hand, authentication for use is required.

The service disconnection execution unit 59 is for the user terminal 12 to use the application server 26 once the application server 26 becomes available based on the authentication requested by the service authentication request unit 58 to the application server 26. When the requirements of the above are not satisfied, the use of the application server 26 by the user terminal 12 is terminated according to an instruction from the authentication server 22 or the like.

FIG. 3 is a functional block diagram illustrating a part of the functions of the position authentication terminal 14. The position authentication terminal 14 is immovably fixed and arranged at a predetermined position. The position information storage unit 62 stores information about the location (position) where the position authentication terminal 14 is arranged, that is, the position information, and is, for example, an authentication system having a preset write authority. It is written in advance by 10 administrators and the like. At the time of writing, authentication of whether or not the user has write authority may be performed by the combination of the user name and the password. This writing may be performed by wireless communication via the wireless communication unit 66, or may be performed by an input means such as a keyboard temporarily connected to an interface (not shown). The location information stored in the location information storage unit 62 is stored, for example, encrypted so that it is difficult for the user or a third party to falsify it.

The user / location information transmission unit 64 will describe later the user authentication information transmitted from the user information transmission unit 54 of the user terminal 12 and the position information of the position authentication terminal 14 stored in the position information storage unit 62. It is transmitted to the location information collecting unit 76 of the authentication server 22 via the wireless communication unit 66. The location information is transmitted by the user / location information transmission unit 64 at predetermined intervals. The user information transmission unit 54 and the user / location information transmission unit 64 described above correspond to the transmission unit of the present invention.

Similar to the wireless communication unit 60 of the user terminal 12, the wireless communication unit 66 performs wireless communication according to a standard such as a wireless LAN or Bluetooth (registered trademark).

FIG. 4 is a functional block diagram illustrating a part of the functions of the authentication server 22. The authentication server 22 includes a CPU (central processing unit), a main storage device such as RAM and ROM, an auxiliary storage device such as a hard disk device, and the like, and functions are generated by executing a program stored in these storage devices by the CPU. It is a so-called computer. The authentication server 22 has a network interface 72 as hardware, and also functionally has a user authentication unit 74, a location information collection unit 76, a location authentication unit 78, a service authentication information issuing unit 80, a login status confirmation unit 82, and the like. It is composed of.

The network interface 72 connects the authentication server 22 to the network 30 so as to be capable of information communication. As a result, the authentication server 22 can communicate information with the user terminal 12, the location authentication terminal 14, the storage device 24, the application server 26, etc. via the network 30.

The user authentication unit 74 is based on the user authentication information transmitted from the user authentication request unit 52 of the user terminal 12 or the user authentication information transmitted from the user / location information transmission unit 64 of the location authentication terminal 14. Determines whether or not the user has the right to use the application server 26. This determination is based on whether or not the user authentication information transmitted from the user authentication request unit 52 and the user information stored in the SSO authentication database 90 of the storage device 24, which will be described later, match. At the same time as performing authentication, it is determined whether or not the user has the right to use the application server 26 based on the information stored in the SSO authentication database 90. This user authentication unit 74 corresponds to the usage qualification authentication unit of the present invention.

The location information collecting unit 76 acquires the user ID transmitted from the user / location information transmitting unit 64 of the location authentication terminal 14 and the location information of the location authentication terminal 14. Further, the location information collection unit 76 stores time information, specifically, information such as a transmission time in the user / location information transmission unit 64 of the location authentication terminal 14, or a reception time in the location information collection unit 76. It is stored in the location information database 86 of 24.

The position authentication unit 78 corresponds to the user ID by collating the user ID collected by the position information collection unit 76 with the position information of the position authentication device 14 with the information of the position information authentication database 88 of the storage device 24. It is determined whether or not the user is in a position permitted in advance to use the application server 26. Specifically, the location information authentication database 88, which will be described later, stores information about the location where the application server 26 can be used for each user ID, and the location authentication unit 78 stores the location information. It is determined whether or not the location matches the position where the application server 26 can be used, and if it matches, the user determines that the application server 26 can be used (location authentication). As described above, the position matching in this embodiment is not only the physical position matching, but also the position authentication terminal 14 when the position of the user terminal 12 is within the communication range of the position authentication terminal 14. This includes the case where the position of is corresponding to the position where the application server 26 can be used. This means that the user terminal 12 used by the user and the location authentication terminal 14 that has transmitted the user authentication information from the user terminal 12 can perform short-distance communication directly or via the access point 16. Therefore, based on the fact that the user terminal 12 and the position authentication terminal 14 can be regarded as being located in the vicinity, when the position information of the position authentication terminal 14 is a position where the application server 26 can be used. This is because it is determined that the user terminal 12 can also use the application server 26.

The service authentication information issuing unit 80 applies the application to the user terminal 12 when it is determined that both the user authentication by the user authentication unit 74 and the location authentication by the location authentication unit 78 are valid. Issue and transmit service authentication information, which is information for using the server 26. This service authentication information is information including, for example, an ID and a password for using the application server 26. The service authentication information issuing unit 80 corresponds to the service authentication information transmitting unit of the present invention.

The login status confirmation unit 82 determines whether or not the location authentication by the location authentication unit 78 is continuously performed for the user whose service authentication information is once issued by the service authentication information issuing unit 80. Then, when the location authentication by the location authentication unit 78 is established once, but is not established after that, that is, the position of the user coincides with the position where the application server 26 can be used. If it disappears, the service authentication information issuing unit 80 once issued will take measures to stop the effect of the service authentication information for the user. Specifically, for example, the service disconnection execution unit 59 described above makes an inquiry to the login status confirmation unit 82 whether or not the location authentication is established at predetermined time intervals, for example, every 30 seconds. Upon receiving this inquiry, the login status confirmation unit 82 refers to the result of the position authentication of the user terminal 12 by the position authentication unit 78. Here, the position authentication of the user terminal 12 by the position authentication unit 78 is performed using the position information transmitted by the user / position information transmission unit 64 at predetermined intervals, which is the closest retroactively from that point in time. Then, when the authentication by the location authentication unit 78 is unsuccessful, the login status confirmation unit 82 transmits information indicating that the location authentication is unsuccessful to the service disconnection execution unit 59. Upon receiving this information, the service disconnection execution unit 59 executes an operation for forcibly logging out the user terminal 12 from the application server 26. Specifically, the service disconnection execution unit 59 of the user terminal 12 forcibly logs off (logs out) the user terminal 12 from the application server 26, or is stored in the application server 26. The session information with the user terminal 12 is deleted so that the communication between the user terminal 12 and the application server 26 cannot be continued in the logged-in state. In this way, even if the location authentication unit 78 authenticates once and the service authentication information is issued by the service authentication information issuing unit 80, the position different from the position previously permitted by the user terminal 12 thereafter. If you move to, you can prevent the application server 26 from continuing to be used.

FIG. 5 is a functional block diagram illustrating a part of the functions of the storage device 24. The storage device 24 has a network interface 84 as hardware, and is configured to functionally include a location information database 86, a location information authentication database 88, an SSO authentication database 90, and the like. That is, it is a database server that provides a database via a network. The network interface 84 connects the storage device 24 to the network 30 so as to be capable of information communication. As a result, the authentication server 22 can communicate with the user terminal 12, the location authentication terminal 14, the authentication server 22, the application server 26, and the like via the network 30. As a result, the location information database 86, the location information authentication database 88, and the SSO authentication database 90 can accept input of information and output in response to an inquiry via the network.

The location information database 86 is transmitted by the user / location information transmission unit 64 of the location authentication terminal 14, and stores the information collected by the location information collection unit 76 of the authentication server. Specifically, the location information database 86 stores at least the user ID, the location information of the location authentication terminal 14, and the time information in association with each other. Specifically, the time information is information such as the transmission time in the user / position information transmission unit 64 of the position authentication terminal 14 or the reception time in the position information collection unit 76. FIG. 6 shows an example of the information stored in the location information database 86 in a table format. FIG. 6 shows an example showing that the user “user 1” stays at the “location authentication terminal 01” in chronological order. Here, the "location authentication terminal 01" indicates a unique code attached in advance representing the location authentication information terminal 01 (any one of the location authentication terminals 14A to 14C). The same applies to the position authentication terminals 02 and 03.

Returning to FIG. 5, the location information authentication database 88 stores information about the locations (permitted locations) where the application server 26 is permitted to be used for each user. Specifically, the location information authentication database 88 stores a user ID, information for specifying a target application server 26, and information about a permitted position corresponding to the application server 26. FIG. 7 shows an example of the information stored in the location information authentication database 88 in a table format. In FIG. 7, when the user “user 1” uses the application server “server A”, the position “location authentication terminal 01” is used, and when the user “user 1” uses the application server “server B”, the position “location” is shown. It indicates that it needs to be in the position information terminal 02. This location information authentication database 88 corresponds to the available location database of the present invention.

Returning to FIG. 5, the SSO authentication database 90 has a user ID and password (or one-to-one correspondence with the password such as its hash value) and a user for performing user authentication for each user. The authentication information for using the application server 26 when the authentication is established is stored. The authentication information is, for example, an ID and a password for using the application server 26. FIG. 8 shows an example of the information stored in the SSO authentication database 90 in a table format. FIG. 8 shows a password hash value for user authentication of the user “user 1”, and a user ID and password of each application server for the user 1 to use the application servers “server A” and “server B”. It shows an example in which etc. are stored.

FIG. 9 is a functional block diagram illustrating a part of the functions of the application server 26. The application server 26 does not necessarily constitute the authentication system 10 of the present invention, but can be used by receiving authentication by the authentication system 10 of the present invention. The application server 26 includes a CPU (central processing unit), a main storage device such as RAM and ROM, an auxiliary storage device such as a hard disk device, and the like, and functions are generated by executing a program stored in these storage devices by the CPU. It is a so-called computer.

The network interface 92 connects the application server 26 to the network 30 so as to be capable of information communication. As a result, the application server 26 can communicate with the user terminal 12, the location authentication terminal 14, the authentication server 22, the storage device 24, and the like via the network 30.

The service authentication unit 94 determines the usage qualification of the application server 26 based on the authentication information of the application server 26 transmitted from the service authentication request unit 58 of the user terminal 12. Specifically, it is determined whether or not the authentication information transmitted from the service authentication request unit 58 matches the user authentication information stored in advance in the application server 26, and if they match, the use is concerned. Allow the person to use the application server 26.

The application providing unit 96 provides the application to the user authenticated by the service authentication unit 94. Specifically, it accepts an input from the user terminal 12 of the user, activates an application in response to the input, and transmits a predetermined output, screen display, or the like to the user terminal 12.

FIGS. 10 and 11 are flowcharts illustrating an example of an authentication operation using position information by the authentication device 10 of the present invention. Although it is divided into FIGS. 10 and 11 for the convenience of space, they can be executed as a series.

First, in step S1 (hereinafter, “step” is abbreviated as appropriate), the administrator inputs and stores information about the position of the position information terminal 14 in the position information storage unit 62 of the position authentication terminal 14. The information (position information) regarding this position may be information representing the absolute position itself such as latitude and longitude, or may be a code capable of identifying each position authentication terminal 14. good. That is, when a user terminal 12 capable of wireless communication exists in the position authentication terminal 14 by identifying each position authentication terminal 14, the user terminal 12 can wirelessly communicate with the position authentication terminal 14. This is because it can be grasped that they are in close proximity.

Next, in S2, the user who wants to use the application server 26 inputs the user authentication information of the authentication server 22, specifically, the user ID and the password in the user terminal 12. The input user authentication information is passed to the user authentication request unit 52.

S3 corresponds to the user authentication request unit 52 of the user terminal 12, and the user authentication information input in S2 is transmitted to the user authentication unit 74 of the authentication server 22 via the network 30.

S4 corresponds to the user authentication unit 74 of the authentication server 22, and whether or not the user authentication information transmitted in S3 is correct is stored in advance in the SSO authentication database 90 of the storage device 24. Judgment is made by collating with personal information. When the transmitted user authentication information and the user information stored in advance match, it is determined that the user authentication information transmitted in S3 is correct, and a notification is issued that the authentication is completed. This authentication completion notification is transmitted to the user authentication request unit 52 of the user terminal 12.

S5 corresponds to the user authentication request unit 52 of the user terminal 12, and the authentication information transmitted from the authentication server 22 in S4 is sent to the user information transmission unit 54.

S6 corresponds to the user information transmission unit 54 of the user terminal 12, and the user information included in the authentication information received in S5 is transmitted to the user / location information transmission unit 64 of the location authentication terminal 14. This user information is, for example, the user ID input in S2.

S7 corresponds to the position information storage unit 62 of the position authentication terminal 14, and the position information of the position authentication terminal 14 stored in S1 is transmitted to the user / position information transmission unit 64.

S8 corresponds to the user / location information transmission unit 64 of the location authentication terminal 14, and the user information transmitted in S6 and the location information transmitted in S7 are the location information collection unit 76 of the authentication server 22. Will be sent to.

S9 corresponds to the location information collecting unit 76 of the authentication server 22, and the user information and location information transmitted in S8, and the time information about the information are stored in the location information database 86 of the storage device 24. It will be remembered. Here, the time information is, for example, the time when the user information and the position information are received by the position information collecting unit 76. As a result, the position of the user terminal 12 used by the user related to the authenticated user ID is regarded as the position information of the position authentication terminal 14 with which the user terminal 12 is wirelessly communicating, so that the user ID is used. And, the position of the user terminal 12 and the time at that position can be recorded in the position information database 86 as a data entry.

By repeatedly executing S6 to S8 at predetermined intervals in the flowchart shown in FIG. 10, the position of the user terminal 12 can be recorded in the position information database 86 with the passage of time.

Moving to FIG. 11, in S11, the user authentication information including the user ID and the password is input by the user using the input device of the user terminal 12. When S11 is executed following the flowchart shown in FIG. 10, the user authentication information input in S2 of FIG. 10 may be used instead of the execution of S11.

S12 corresponds to the service authentication information acquisition unit 56 of the user terminal 12, and the user authentication information input in S11 or S2 is transmitted to the service authentication information issuing unit 80 of the authentication server 22.

S13 corresponds to the service authentication information issuing unit 80 and the like, and the user authentication information transmitted in S12 is transmitted to the user authentication unit 74.

S14 corresponds to the user authentication unit 74 and the like, and the user authentication information transmitted in S13 is authenticated. This authentication is performed by the same procedure as in S4 described above. When the authentication is performed, the service authentication information issuing unit 80 is notified of the completion of the authentication. This notification of the completion of authentication corresponds to the user authentication, that is, the determination result that the combination of the user ID and the password is valid.

S15 corresponds to the service authentication information issuing unit 80 and the like, transmits the authentication information issued in S14 to the location authentication unit 78, and requests authentication using the location information.

S16 to S20 correspond to the position authentication unit 78 and the like. Of these, in S16, based on the user information transmitted to the location authentication unit 78 in S15, the location information database 86 is inquired about the latest location information of the user corresponding to the user information. In S17, the answer to the inquiry in S16 is transmitted from the location information database 86 to the location authentication unit. As a result, information about the position of the user corresponding to the user information in S12 can be obtained.

In S18, based on the user information transmitted to the location authentication unit 78 in S15, the user corresponding to the user information is inquired about the location where the application server 26 is permitted to be used in advance. , The location information authentication database 88 is performed. In S19, the answer to the inquiry in S18 is transmitted from the location information authentication database 88 to the location authentication unit. As a result, information about the position where the user corresponding to the user information in S12 can use the application server 26 can be obtained.

In S20, it is determined whether or not the latest position of the user obtained in S17 and the position obtained in S19 where the user can use the application server 26 match. If they match, it is determined that the authentication has been established, the authentication information for permitting the user to use the application server 26 is issued, and the authentication information is transmitted to the service authentication information issuing unit 80. As shown in the example of the user 1 in FIG. 7, the "location authentication terminal 01" and "location authentication terminal 01" and "location authentication terminal 01" which are different permission positions for each of the "server A" and "server B" which are the application servers 26 that can be used. When the "location authentication terminal 02" is set, the available application server 26 is determined according to the location of the user 1 obtained from the location information database 86. That is, if the user 1 is in the "location authentication terminal 01", the usage permission of the "server A" is granted, and if the user 1 is in the "location authentication terminal 02", the usage permission of the "server B" is granted.

S21 to S22 correspond to the service authentication information issuing unit 80 and the like. Of these, in S21, for the user related to the user information transmitted in S12, the application server 26 is used based on the issuance of the authentication information for using the application server 26 in S20. Query the SSO authentication database 90 for service authentication information.

In S22, the service authentication information of the user is transmitted to the service authentication information issuing unit 80 as an answer to the inquiry in S21. This service authentication information is information for authentication performed when using the application server 26, and is, for example, a combination of a user ID and a password entered by the user to use the application server 26. At this time, if it is determined that a plurality of available application servers 26 are applicable, service authentication information for the plurality of available application servers 26 is issued.

S23 corresponds to the service authentication information issuing unit 80 and the like, and transmits the service authentication information obtained in S22 to the service authentication information acquisition unit 56 of the user terminal 12.

Note that S16 to S23 are repeatedly executed at predetermined intervals, for example, every 30 seconds, in response to a request from the service disconnection execution unit 59. This repeated operation in the authentication server 22 corresponds to the login status confirmation unit 82. When it is determined in S20 that the position of the user terminal 12 is no longer in a position where the application server 26 can be used in the repeating process (authentication fails), instead of executing S22 and S23, In order to invalidate the service authentication information issued in S22 in the execution process of the flowchart up to that point, the user terminal 12 is forcibly logged off from the application server 26, or the user is stored in the application server 26. An instruction for deleting the session information with the terminal 12 is issued. Alternatively, when the position of the user terminal 12 continues to exist at a position where the application server 26 can be used, the user terminal 12 outputs the service authentication information with the repeated execution of S16 to S23. On the other hand, if the communication with the authentication server 22 is interrupted, the service authentication information cannot be received. In this way, when the user terminal receives the information that invalidates the service authentication information, or when the service authentication information is not received within a time several times as long as the execution interval of the above-mentioned flowchart, for example, the user. The terminal 12 can determine that it has lost the usage qualification of the application server 26 and can disconnect the connection with the application server 26 that has already started. These operations correspond to the service disconnection execution unit 59 described above.

S24 to S25 are steps in the user terminal 12. S24 corresponds to the service authentication information acquisition unit 56 and the like, and passes the service authentication information received in S23 to the service authentication request unit 58. S25 corresponds to the service authentication request unit 58 and the like, and requests authentication by the application server 26 by transmitting the service authentication information passed in S24 to the service authentication unit 94 of the application server 26. At this time, the user tries to connect to the application server 26 to be used among the plurality of application servers 26 by the user's selection.

If the service authentication information of each application server 26 issued in S23 does not include the application server 26 that the user wants to use, the user has the right to use the application server 26 at least at that position. The application server 26 cannot be used.

In the application server 26, although not shown in the flowchart, the service authentication unit 94 determines whether or not the service authentication information received by S25 is appropriate. Then, if the service authentication information is appropriate, the application providing unit 96 is permitted to provide the application to the user terminal 12.

Here, the service authentication information received by the service authentication information acquisition unit 56 in S23 is passed from the service authentication information acquisition unit 56 to the service authentication unit 58 inside the user terminal 12, so that the service authentication information is displayed on the screen. It is not necessary for the user who displays or operates the user terminal 12 to input the information by himself / herself, so that the content can be hidden from the user's eyes.

According to the authentication system 10 of this embodiment, the location authentication unit 78 provides information and user identification information regarding the position of the user terminal transmitted from the user information transmission unit 54 and the user / location information transmission unit 64, and a location information authentication database. Based on the information stored in 88, it is determined whether the user is in the available position of the preset application server 26, and the position authentication unit 78 determines that the user is in the available position. If so, the user authentication unit 74 will use the user based on the user identification information transmitted from the user information transmission unit 54 and the user / location information transmission unit 64 and the information stored in the location information authentication database 88. Whether or not a person is eligible to use the service is determined. Therefore, the user can use the application server 26 from the user terminal 12 only in the place corresponding to the predetermined available position, and conversely, in the place other than the predetermined available position. , The user cannot use the application server 26 from the user terminal 12, and the security when using the application server 26 via the network 30 is improved.

Further, according to the authentication system 10 according to the above-described embodiment, the location information authentication database 88 stores user information, which is information about user qualifications, for each user for each of the plurality of application servers 26. The user authentication unit 74 determines whether or not the user has the usage qualification for each of the plurality of application servers 26. Therefore, when a plurality of services are provided, each of the plurality of services is used. Whether or not you are eligible to use it can be determined. That is, for users who are qualified to use the plurality of application servers 26, the available positions can be different for each application server 26.

Further, according to the authentication system 10 according to the above-described embodiment, the service authentication information issuing unit 80 for transmitting the service authentication information for making the user available for each of the plurality of application servers 26 is provided. Therefore, since the user does not hold the information for making the user available about the application server 26 in advance, the security can be improved. That is, so-called single sign-on can be realized.

Further, according to the authentication system 10 according to the above-described embodiment, the information regarding the position of the user terminal 12, that is, the position of the position authentication terminal 14, is the identification of the position-fixed terminal uniquely given to the position authentication terminal 14 in advance. Since the location information authentication database 88 stores information about a position that can be authenticated by the user as a combination of the user's identification information and the position-fixed terminal identification information, the location authentication terminal 88 is information. The information in the position information storage unit 62 of 14 is given in advance, and subsequent falsification can be prevented.

Subsequently, another embodiment of the present invention will be described in detail with reference to the drawings. In the following description, the parts common to each other in the examples are designated by the same reference numerals and the description thereof will be omitted.

FIG. 12 is another embodiment of the authentication system 10 of the present invention, and is a diagram illustrating another embodiment of the location authentication terminal 14 in the above-mentioned first embodiment. In FIG. 10, the position authentication terminal 114 differs from the position authentication terminal 14 in that it has a positioning unit 61 in addition to the above-mentioned position information storage unit 62, user / position information transmission unit 64, and wireless communication unit 66.

The positioning unit 61 positions its own position, for example, using a known GPS (Global Positioning System) to receive radio waves from a plurality of satellites, and the latitude and longitude based on the difference in arrival time between them. Is calculated. Information about the position of the position authentication terminal 114 positioned by the positioning unit 61 is passed to and stored in the position information storage unit 62.

By doing so, it is not necessary for the administrator to input the position information into each position authentication terminal 114 in advance, and the time and effort can be reduced.

Further, according to the authentication system 10 according to the above-described embodiment, the information regarding the position of the user terminal 12, that is, the position of the position authentication terminal 14, is the positioning unit 61 for positioning the position of the position authentication terminal 14 user terminal. Since it is the position information obtained by the above, the position of the terminal using the position authentication terminal 14 can be automatically acquired and stored in the position information storage unit 62.

13 and 14 are diagrams showing another example of the information stored in the location information authentication database 88 and the SSO authentication database 90, respectively. 13 and 14 correspond to FIGS. 7 and 8 in the above-mentioned Example 1, respectively.

As shown in FIG. 13, the location information authentication database 88 of this embodiment stores information about the locations (permitted locations) where the application server 26 is permitted to be used for each user. In particular, when the user has a plurality of different privileges on the application server 26, information about the permitted position is stored for each of the privileges. Specifically, the location information authentication database 88 stores a user ID, information for specifying a target application server 26, a type of usage authority in the application server 26, and information about a corresponding permitted position. To. FIG. 13 shows an example of the information stored in the location information authentication database 88 in a table format. In FIG. 13, when the user “user 1” uses the application server “server A” with the usage authority “general user”, either the location “location authentication terminal 01” or the location “location authentication terminal 03” is shown. On the other hand, it indicates that the "user 1" needs to be in the position "location information terminal 01" when the "server A" is used as the usage authority "administrator".

Further, as shown in FIG. 14, the SSO authentication database 90 of this embodiment has a user ID and a password (or a hash value thereof, etc., one-to-one with a password) for user authentication for each user. The corresponding one) and the authentication information for using the application server 26 when the user authentication is established are stored for each usage authority of the application server 26. Specifically, as shown in FIG. 14, the password hash value for user authentication of the user "user 1" and the user 1 use the application server "server A" with the usage authority "general user". An example is shown in which the user ID and password of the application server 26 for the purpose, and the user ID and password when the "user 1" uses the "server A" with the usage authority "administrator" are stored.

According to the authentication system 10 of this embodiment, when the user has a plurality of different levels of usage authority for the application server 26, the available position can be set for each of the usage authority. That is, it is permissible to access the application server 26 only in a place where security is guaranteed for usage modes that require special attention, such as confidentiality being displayed on the output device (display, etc.) of the user terminal 12. And so on.

Although the embodiments of the present invention have been described in detail with reference to the drawings, the present invention is also applicable to other aspects.

For example, in the above-described embodiment, the storage device 24 is connected to the network 30, but the present invention is not limited to this mode, and the storage device 24 may be readable and writable connected to the authentication server 22. It may be connected to the network via the authentication server 22 or another computer, or may be provided as a storage device inside the authentication server 22.

In the above-described embodiment, communication with the user terminal 12, the location authentication device 14, and the access point 16 is performed wirelessly with each other, and the communicable distance in the wireless communication is determined by the location authentication terminal 14 and the user terminal. It is preferable that the specifications are such that 12 and 12 can be regarded as being in the same place. However, the present invention is not limited to this, and for example, the communication between the access point 16 and the location authentication terminal 14 and the communication between the access point 16 and the user terminal 12 have a relatively long radio range, such as 802.11. While adopting such a wireless LAN standard, direct communication between the location authentication terminal 14 and the user terminal 12 can be limited to a standard having a relatively short reach such as Bluetooth.

Further, the communication between the access point 16 and the location authentication device 14, and the communication between the access point 16 and the user terminal 12 may be connected by a public mobile phone network. In such a case, the access point 16 corresponds to a base station of a mobile phone.

Further, in the above-described embodiment, the user terminal 12 and the location authentication device 14 can be wirelessly communicated with each other via the access point 16, but the present invention is not limited to this mode, and the user terminal 12 and the access point are not limited to this. 16, or the location authentication device 14 and the access point 16 may be made capable of communicating with each other by wired communication. Even in that case, the user terminal 12 and the position authentication device 14 can communicate with each other wirelessly, and by selecting the wireless communication standard, frequency, radio wave strength, etc. at that time, the user terminal and the position authentication device are authenticated. It can be considered that the device 14 is in the same position.

Further, in the above-described embodiment, for example, an ID and a password are used as the user authentication information, but the user authentication information is not limited to such an embodiment. For example, it may be biometric information such as a fingerprint or a vein shape, or a code unique to the user terminal such as a MAC address may be used.

Further, in the above-described embodiment, the access point 16 and the location authentication terminal 14 are composed of separate hardware, but the present invention is not limited to this, and the access point 16 and the location authentication terminal 14 may be composed of one common hardware.

The position information stored in the position information storage unit 62 of the position authentication device 14, the position information database 86, the position information authentication database 88, etc. is unique to each position authentication device 14 attached to each of the position authentication devices 14 in advance. Although it was a code, it may be information representing the position itself.

Further, in the above-described embodiment, the service authentication information acquisition unit 56 of the user terminal 12, the service authentication request unit 58, and the service authentication information issuing unit 80 of the authentication server perform proxy input in so-called SSO (Single sign-on). Although it was explained that it behaves according to the method, it is not limited to this. After the authentication by the location authentication unit 78 in the authentication server 22, information corresponding to the reverse proxy method, the agent method, etc. in SSO can be exchanged between the user terminal 12 and the authentication server 22. .. In such a case, the service authentication information issued by the service authentication information issuing unit 80 (S23) becomes a cookie or a token indicating that the authentication has been completed.

Further, in the above-described embodiment, three position authentication devices 14 are illustrated as 14A, 14B, and 14C, but this is only an example, and two or four or more may be used, and position authentication may be performed. Only one device 14 produces a certain effect. Similarly, two examples of the application server 26 are shown, but the present invention is not limited to this example, and may be three or more, or may be one. Further, although one example is shown for the user terminal 12, there is no problem even if a plurality of user terminals 12 exist in the authentication system 10 at the same time.

Further, in the above-described embodiment, the user terminal 12 is a single device and includes a user authentication request unit 52, a user information transmission unit 54, a service authentication information acquisition unit 56, and a service authentication request unit 58. However, it is not limited to such an aspect. For example, instead of the user terminal 12, there are two terminals, a terminal having a user authentication request unit 52 and a user information transmission unit 54, and a terminal having a service authentication information acquisition unit 56 and a service authentication request unit 58. It may be provided as a terminal capable of communicating with each other or with another location authentication device 14, an access point 16, or the like.

Further, in the above-described embodiment, when a plurality of application servers 26 that can be used by the user terminal 12 are prepared, for example, the application server 26 to be used in advance according to an operation by a user who uses the user terminal 12. May be specified, and the service authentication information acquisition unit 56 of the user terminal 12 may request the authentication server 22 for the service authentication information of the application server 26 to be used.

Further, in the above-described embodiment, in the series of steps shown in the flowchart of FIG. 11, S11 to S25 are sequentially executed, but the series is not necessarily limited to such an embodiment. Specifically, for example, S11 to S25 in FIG. 11 are executed at least at the first execution. Once the authentication completion notification is given in S14, the user authentication completion information indicating that effect is transmitted from the authentication server 22 to the user terminal 12 and stored in the user terminal 12. After that, when the flowchart of FIG. 11 is executed in order to use the application server 26 again after the use is finished, or to use the application server 26 different from the first execution time, S11 to Instead of the step of S14, the authentication server 22 confirms that the user terminal 12 has valid user authentication completion information, and it is also possible to execute the steps after S15 in the flowchart of FIG. be. Here, since the user authentication completion information is transmitted and stored in a form such as Cookie, the user authentication completion information may have an expiration date or may be deleted by the service disconnection execution unit 59 described above. It is possible. As described above, since the user terminal 12 has the valid user authentication completion information, the user (user) can be guaranteed to be authenticated even if the steps S11 to S14 are omitted.

Further, in the above-described embodiment, the login status confirmation unit 82 determines whether the user's location authentication is established in response to the inquiry from the service disconnection execution unit 59, but the present invention is not limited to this mode. .. For example, it may be determined whether or not the user's position authentication is established at regular time intervals.

Further, in the above-described embodiment, the operation by the service disconnection execution unit 59 is to log out the user terminal 12 or delete the session information with the user terminal 12 stored in the application server 26. However, instead of this, for example, the cookie or token as the service authentication information issued by the service authentication information issuing unit 80 (S23) or the cookie as the user authentication completion information may be deleted.

It should be noted that the above is only one embodiment, and the present invention can be carried out in a mode in which various changes and improvements are made based on the knowledge of those skilled in the art.

10: Authentication system 12: User terminal 14: Location authentication terminal 22: Authentication server 24: Storage device 26: Application server 54: User information transmission unit (transmitter unit of user terminal 12)
61: Positioning unit 64: User / location information transmission unit 64 (transmitter of location authentication terminal 14)
74: User Authentication Department (Usage Qualification Authentication Department)
78: Location authentication unit (location authentication unit)
80: Service authentication information issuing department (service authentication information transmitting department)
88: Location information authentication database (available location database)

The gist of the first invention is that (a) a transmitter that transmits information about the position of the user terminal and user identification information, and (b) information about a position that the user can authenticate is the user. The available location database stored for each user, (c) the authentication database stored for each user with information about the user's usage qualification, and (d) the information about the location of the user terminal transmitted from the transmitter. A position authentication unit that determines whether or not the user is in a preset available position of the service based on the information stored in the available position database, and (e) the user by the position authentication unit. When it is determined that the user is in the available position, it is determined whether or not the user is eligible to use the service based on the user's identification information transmitted from the transmitter and the information stored in the authentication database. It has a usage qualification authentication unit, and (e1) includes a position authentication terminal fixed at a predetermined position and capable of communicating with the user terminal, and (e2) information regarding the position of the user terminal is the user terminal. Is an authentication system using location information, which is characterized by the fact that is information unique to nearby location authentication terminals .

According to the first invention, the user is preset by the location authentication unit based on the information regarding the position of the user terminal transmitted from the transmission unit and the information stored in the available position database. When it is determined whether the service is in the available position and the location authentication unit determines that the user is in the available position, the usage qualification authentication unit transmits the usage from the transmission unit. Whether or not the user is eligible to use the service is determined based on the identification information of the person and the information stored in the authentication database. Further, since the information regarding the position of the user terminal is included in the position authentication terminal which is fixed at a predetermined position and can communicate with the user terminal, the information regarding the position of the user terminal is unique to the position authentication terminal close to the user terminal. , Information about the position can be obtained without the user terminal performing positioning.

Preferably, (i) the information regarding the position of the used terminal is the information regarding the position of the position authentication terminal stored in advance in the position authentication terminal . By doing so, the information regarding the position of the terminal to be used is given in advance, so that subsequent falsification can be prevented.

Preferably, (j) the information regarding the position of the user terminal is the position authentication terminal identification information uniquely given to the position authentication terminal in advance, and (k) the available position database is authenticated by the user. It is characterized in that information about a possible position is stored as a combination of the user's identification information and the position authentication terminal identification information. By doing so, the information regarding the position of the terminal to be used is given in advance, so that subsequent falsification can be prevented.

Claims (5)

A transmitter that transmits information about the location of the user terminal and user identification information,
An available location database that stores information about locations that users can authenticate for each user,
An authentication database that stores information about user qualifications for each user,
A position authentication unit that determines whether or not the user is in a preset available position of a service based on the information regarding the position of the user terminal transmitted from the transmission unit and the information stored in the available position database. When,
When the location authentication unit determines that the user is in the available position, the user's service is based on the user's identification information transmitted from the transmission unit and the information stored in the authentication database. The usage qualification authentication department that determines whether or not there is a usage qualification,
An authentication system using location information, characterized by having. The authentication database stores information about the user's usage qualification for each of the plurality of services for each user.
The usage qualification authentication unit determines whether or not the user has the usage qualification for each of the plurality of services.
The authentication system using the location information according to claim 1. The usage qualification authentication unit is characterized by having a service authentication information transmission unit that transmits information for making the user available for each of the servers that provide each of the plurality of services. An authentication system using the location information described in Item 2. The information regarding the position of the user terminal is the position information obtained by positioning the position of the user terminal.
An authentication system using the location information according to any one of claims 1 to 3. The information regarding the position of the user terminal is the position-fixed terminal identification information uniquely given in advance to the position-fixed terminal installed in the position-fixed position with which the user terminal can communicate.
The available location database stores information about a location that can be authenticated by the user as a combination of the user's identification information and the location-fixed terminal identification information.
An authentication system using the location information according to any one of claims 1 to 3.

Images