JP3670613B2 - User authentication method using browser phone mail, user authentication server, user authentication method of authentication server, user authentication program of authentication server, and recording medium recording the program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a browser phone mail authentication method for performing user authentication by mail using a browser phone and an arbitrary terminal, an authentication server, an authentication method in the authentication server, an authentication server authentication program, and a program therefor The present invention relates to a recording medium on which is recorded.
[0002]
[Prior art]
Conventionally, when a user purchases a product, ticket, etc. from a plurality of stores such as online shopping, (1) a method of authenticating with a member ID (IDentification) and a password issued by a server associated with each store has been adopted. As the number of stores increases, it becomes complicated for members to manage the member IDs and passwords of individual stores. For example, a method of performing authentication of a plurality of stores at once (for example, Microsoft's NET Passport), (2 On the other hand, a method using an IC card or biometric information (fingerprint, eye glow, etc.) to identify a member has been proposed.
[0003]
[Problems to be solved by the invention]
(1) Since password authentication does not require a special device, it is versatile. However, since a password is a simple character string, there is a risk of spoofing by a malicious third party such as sneaking or forgetting a user. . In addition, the ID and password must be stored for each site, and the password must be updated regularly. Recently, a service that collects user IDs and passwords and can log in to each store site with a single ID and password has appeared, but conversely, once that ID and password are leaked, This means logging in to the store site, and there was a security problem. In addition, there is a one-time password as an applied technology, but it is necessary to have a token for generating a disposable password, and it takes time to input a different password every time, and there is a problem in convenience.
[0004]
(2) The IC card authentication is highly convenient because it is only necessary to insert the IC card into the reader, and the security level is also high due to the authentication by the physical medium. However, it is desirable that online shopping be available to as many users as possible, but IC card authentication requires an IC card reader on the user's terminal, and currently such PCs (Personal Computers) Very few. Therefore, there was a problem in terms of versatility. The same can be said for biometric authentication, but the biometric method has a problem of false authentication in addition to the above problems.
[0005]
[Means for Solving the Problems]
In order to solve the above problems, the present invention uses a mobile phone having an Internet access function to identify a user (browser phone: a mobile phone having a simple browser that can be connected to the web and browse a home page) The store can be accessed safely from a general-purpose terminal such as a PC. Like PCs, browser phones (mobile phone terminals) are widely used. The current mobile phone system has a high security level, and it is very difficult to forge a terminal. Moreover, since it is always carried and carried, it has the characteristic that a user is easily aware of loss or theft. The browser phone has an ID (individual identification number) that uniquely identifies the individual. When accessing the store server directly from the browser phone, it is possible to authenticate using this individual identification number, but the user can comfortably act such as selecting a product due to restrictions such as the screen size of the browser phone It is not always possible.
The present invention is a function that outputs an individual identification number of a browser phone by a browser phone carried by a user and a general PC that can access the Internet installed in a place such as a home, workplace or Internet coffee shop, Using a mail reception function and an access function to an WWW site on the Internet of an existing PC, user authentication can be performed safely in a simple manner.
[0006]
DETAILED DESCRIPTION OF THE INVENTION
(Example 1)
FIG. 1 is a diagram showing a schematic configuration / authentication procedure of an e-mail authentication system according to a first embodiment of the present invention.
The authentication system by mail is composed of a plurality of arbitrary terminals (PC) X: 2 and browser phones B: 5 used by the user 1, a plurality of store servers S: 3, and an authentication server A: 4. An arbitrary terminal X, a plurality of store servers S, and an authentication server A are connected via a communication line, and the browser phone B and the authentication server A are connected via a wireless line.
[0007]
In the following, user authentication procedures S1 to S9 of the authentication system by mail in FIG. 1 will be described. However, an arbitrary terminal is abbreviated as X, a store server as S, an authentication server as A, and a browser phone as B.
X assumes a general PC and does not require any additional dedicated hardware such as an IC card reader. A only determines whether or not the user is the person (identity confirmation), and whether or not the user can log in to S is determined by S itself with reference to the member DB (Data Base) in S And S is a browser phone mail address as a user ID, and the browser phone DB in A contains a browser phone mail address and an individual identification number or an identification number of an IC card to be inserted or both (hereinafter simply referred to as individual identification). It is assumed that (numbered) is registered (stored) in advance. The member DB 12 holds a list of member browser phone mail addresses (that is, user membership).
[0008]
S1: The user accesses S from X. S asks A for a session ID.
S2: A issues a session ID and sends it to S. S displays a mail address input screen (login screen) including a session ID as shown in FIG.
S3: The user inputs B's mail address in the form of FIG. 2, and presses the OK button.
S4: A session ID and a mail address are transmitted from X to A via S.
S5: S displays for X such as “Currently authentication of session ID: 12345 is in progress”.
S6: A sends a confirmation mail as shown in FIG. At this time, the combination of the session ID and the mail address is temporarily stored in the temporary DB.
S7: The user confirms whether the session ID displayed in X (FIG. 2: login screen) and the confirmation mail (FIG. 3) is the same, and clicks the confirmation mail link in FIG. B transmits B's individual identification number to A.
S8: When A receives the individual identification number, it knows the session ID from the link that received it, and extracts the mail address corresponding to the session ID from the temporary DB. Further, the individual identification number corresponding to the mail address is extracted from the browser phone DB. If the individual identification information obtained in this way matches the individual identification information transmitted from B, it is assumed that the identity has been confirmed. For S, “session ID: 12345, mail address: (B mail address) A message including the meaning of “end identity verification” is transmitted. Thereafter, the used link and temporary DB (a set of session ID and mail address) are deleted.
S9: S checks whether the user has a membership by referring to the mail address from the member DB, and permits X to log in.
[0009]
FIG. 4 shows a configuration diagram of the authentication server A: 4 according to the first embodiment.
The authentication server A includes a session ID issuing unit 4-1, a mail address / session ID reception / confirmation mail transmission unit 4-2, a person confirmation unit 4-3, a browser phone DB 4-5, and a temporary DB 4-4.
The session ID issuing unit 4-1 issues a session ID in response to a session ID request from the store server S. E-mail address and session ID reception / confirmation The e-mail transmission unit 4-2 receives the e-mail address / session ID from any terminal X via the store server S, stores it in the temporary DB 4-4, and confirms it with the browser phone B send mail. The browser phone DB 4-5 registers a set of the browser phone mail address and the individual identification number in advance. The identity verification unit 4-3 retrieves the individual identification number received from the browser phone B and the email address corresponding to the session ID from the received link from the temporary DB, and further retrieves the individual identification number corresponding to the email address from the browser phone DB. If it matches, the identity confirmation end message is transmitted to the store server S as the identity confirmation is completed.
[0010]
(Example 2)
In the second embodiment, by using a temporary password as compared to the first embodiment, the security level can be improved because the temporary password is authenticated only between the authentication server A and the browser phone B.
FIG. 5 is a diagram illustrating a schematic configuration / authentication procedure of the mail authentication system according to the second embodiment of the present invention.
The authentication system is composed of an arbitrary terminal (PC) X: 2 and a browser phone B: 5 used by the user 1, a plurality of store servers S: 3, and an authentication server A: 4, and a plurality of arbitrary terminals X The plurality of store servers S and the authentication server A are connected via a communication line, and the browser phone B and the authentication server A are connected via a wireless line.
Hereinafter, authentication procedures S1 to S11 of the authentication system of FIG. 5 will be described. However, an arbitrary terminal is abbreviated as X, a store server as S, an authentication server as A, and a browser phone as B.
X assumes a general PC and does not require any additional dedicated hardware such as an IC card reader.
A determines only whether or not the user is the person (identity confirmation), and determines whether or not the user can log in to S by referring to the member DB in S. Also, S is assumed that the browser phone mail address is a user ID, and the browser phone mail address and the individual identification number are registered in advance in the browser phone DB in A.
[0011]
S1: The user accesses S from X. S asks A for a session ID and password.
S2: A issues a session ID and a password for temporary use and sends it to S. S displays a mail address input screen (login screen) including a session ID and a temporary password as shown in FIG.
S3: The user inputs B's mail address in the form of FIG. 6 and presses the OK button.
S4: A mail address and a session ID are transmitted from X to A via S.
S5: S displays for X such as “Currently authentication of session ID: 12345 is in progress”.
S6: A transmits a confirmation mail including the session ID as shown in FIG. At this time, the combination of the session ID, password, and e-mail address is temporarily stored in the temporary DB.
S7: The user confirms whether the session ID displayed in X (login screen) and the confirmation mail is the same, and logs in by clicking the confirmation mail link shown in FIG.
S8: A displays a password input screen including the session ID as shown in FIG. 8 on B and deletes the above link.
S9: When the user inputs the password displayed on X (login screen) in the form of FIG. 8 and presses the OK button, B transmits a session ID, an individual identification number, and a password to A.
S10: A inquires the browser phone DB for the received individual identification number, retrieves the corresponding e-mail address, and inquires to the temporary DB whether the combination of this e-mail address, password and session ID is correct. As a result of confirmation, a message including the meaning of “session ID: 12345, e-mail address: (B's e-mail address) identity verification end” is sent to S. Thereafter, the used link and temporary DB (a set of session ID, password, and mail address) are deleted in the same manner as a one-time URL (Uniform Resource Locator).
S11: S checks whether the user has a membership from the member DB, and permits login to X.
[0012]
FIG. 9 shows a configuration diagram of the authentication server A: 4 according to the second embodiment.
The authentication server A is composed of a session ID / temporary password issuing unit 4-11, a mail address / session ID reception / confirmation mail sending unit 4-12, an identity verification unit 4-13, a temporary DB 4-14, and a browser phone DB 4-15. Is done.
The session ID / temporary password issuing unit 4-11 issues a session ID and a temporary password in response to the session ID and password request of the store server S. The mail address / session ID reception / confirmation mail transmission unit 4-12 receives a mail address / session ID from an arbitrary terminal X via the store server S, and temporarily stores a set of the mail address / session ID / password in the DB4- 14 and send a confirmation email containing the session ID to browser phone B. The browser phone DB 4-15 registers the mail address and individual identification number of the browser phone B in advance. The identity verification unit 4-13 transmits a password input screen to the browser phone B in response to the login of the browser phone B, receives the session ID, the individual identification number, and the password from the browser phone B, and receives the individual identification number from the browser phone DB. To retrieve the corresponding e-mail address, inquires of the temporary DB whether the combination of the e-mail address, the session ID, and the password is correct. Send.
The store server and authentication server used in the mail authentication system of the present invention can be composed of a computer having a CPU, memory, etc., an operation terminal, and a recording medium. The recording medium is a machine-readable recording medium such as a CD-ROM, a magnetic disk device, or a semiconductor memory. The control program recorded on the recording medium is read by the computer, and each configuration in the above-described embodiment on the computer. Realize the element.
[0013]
【The invention's effect】
The present invention provides a function for outputting an individual identification number of a browser phone by a browser phone carried by the user and a general-purpose PC that can access the Internet installed in a place such as a home, workplace or Internet coffee shop, User authentication and the access function to the WWW site on the Internet of an existing PC, user authentication can be performed safely with a simple method.
[Brief description of the drawings]
FIG. 1 is a diagram showing a schematic configuration / authentication procedure of an authentication system according to a first embodiment.
FIG. 2 is a diagram illustrating an example of a login screen of a store server S displayed on an arbitrary terminal X according to the first embodiment.
FIG. 3 is a view showing an example of a confirmation mail displayed on the browser phone B according to the first embodiment.
FIG. 4 is a configuration diagram of an authentication server A according to the first embodiment.
FIG. 5 is a diagram showing a schematic configuration / authentication procedure of an authentication system according to a second embodiment;
FIG. 6 is a diagram showing an example of a login screen of the store server S displayed on an arbitrary terminal X according to the second embodiment.
FIG. 7 is a diagram showing an example of a confirmation mail displayed on the browser phone B according to the second embodiment.
FIG. 8 is a diagram showing an example of a password input screen displayed on the browser phone B according to the second embodiment.
FIG. 9 is a configuration diagram of an authentication server A according to the second embodiment.
[Explanation of symbols]
1 User 2 Any terminal X
3 store server S
4 Authentication server A
4-1 ... Session ID issuing unit, 4-2, 4-12 ... Email address / session ID reception / confirmation email sending unit, 4-3, 4-13 ... Identity verification unit, 4-4 , 4-14 ... temporary DB, 4-5, 4-15 browser phone DB, 4-11 ... session ID / temporary password issuing unit,
5 Browser phone B

Claims (12)

An arbitrary terminal used by the user, a browser phone, a store server, and an authentication server provided with a browser phone DB that holds a set of a mail address and an individual identification number of the browser phone in advance are connected via a communication line,
An arbitrary terminal establishes a session with the authentication server via the store server, receives a session ID, and transmits a session ID and a browser phone mail address;
The authentication server stores a pair of a session ID and a browser phone email address, and sends a confirmation email including the session ID to the browser phone;
The browser phone transmits a session ID received by an arbitrary terminal and an individual identification number based on the user's confirmation of the session ID included in the confirmation email to the authentication server;
If the received individual identification number matches the individual identification number of the combination of the browser phone mail address and the individual identification number held in the browser phone DB based on the combination of the session ID and the browser phone mail address, the authentication server And a step of transmitting an identity confirmation message to the store server as having been confirmed. In the user authentication method by mail of the browser phone according to claim 1,
A merchant server includes a step of receiving an identity confirmation message, checking a pre-registered membership, and permitting login to an arbitrary terminal. A browser phone DB that holds a set of the email address and individual identification number of the browser phone used by the user is provided,
A means for issuing and transmitting a session ID for access from any terminal;
Means for receiving a session ID and browser phone mail address from an arbitrary terminal, and storing a set of the session ID and browser phone mail address in a temporary DB;
Means for sending a confirmation email containing the session ID to the browser phone;
Means for receiving the individual identification number of the browser phone based on the user's confirmation of matching between the session ID issued to any terminal and the session ID included in the confirmation email;
Based on the individual identification number received from the browser phone and the email address corresponding to the session ID extracted from the temporary DB, if the individual identification number corresponding to the email address of the browser phone DB matches, the identity is confirmed. And a means for transmitting a message to a store server. Issuing and sending a session ID for access from any terminal; and
Receiving a session ID and a browser phone mail address from an arbitrary terminal, and storing the set in a temporary DB;
Sending a confirmation email containing the session ID to the browser phone;
Receiving an individual identification number of the browser phone based on a user's match confirmation between the session ID issued to any terminal and the session ID included in the confirmation email;
Based on the individual identification number received from the browser phone and the mail address corresponding to the session ID fetched from the temporary DB, it corresponds to the browser phone DB mail address that holds in advance a set of the browser phone mail address and the individual identification number. A user authentication method using a browser phone mail in an authentication server, comprising: a step of transmitting an identity confirmation message to a store server as an identity confirmation if the individual identification numbers match. Processing to issue and send a session ID for access from any terminal,
A process of receiving the session ID and browser phone mail address from an arbitrary terminal, and storing this set in a temporary DB;
Processing to send a confirmation email containing the session ID to the browser phone;
A process of receiving an individual identification number based on a user's match confirmation between a session ID issued to an arbitrary terminal and a session ID included in a confirmation email;
Based on the individual identification number received from the browser phone and the mail address corresponding to the session ID fetched from the temporary DB, it corresponds to the browser phone DB mail address that holds in advance a set of the browser phone mail address and the individual identification number. A user authentication program by mail of a browser phone in an authentication server that causes a computer to execute a process of transmitting an identity confirmation message to a store server as a result of confirming the identity of the user if the individual identification numbers match. Processing to issue and send a session ID for access from any terminal,
Processing to receive the session ID and browser phone mail address from any terminal and save it in a temporary DB;
Processing to send a confirmation email containing the session ID to the browser phone;
A process of receiving an individual identification number based on a user's match confirmation between a session ID issued to an arbitrary terminal and a session ID included in a confirmation email;
Based on the individual identification number received from the browser phone and the mail address corresponding to the session ID fetched from the temporary DB, it corresponds to the browser phone DB mail address that holds in advance a set of the browser phone mail address and the individual identification number. A recording medium in which a user authentication program by a browser phone mail is recorded in an authentication server that causes a computer to execute a process of transmitting an identity confirmation message to a store server as having been confirmed if the individual identification numbers match. An arbitrary terminal used by the user, a browser phone, a store server, and an authentication server provided with a browser phone DB that holds a set of a mail address and an individual identification number of the browser phone in advance are connected via a communication line,
An arbitrary terminal establishes a session with the authentication server via the store server, receives a session ID and a password, and transmits a session ID and a browser phone mail address;
The authentication server stores a pair of a session ID, a password, and an email address in a temporary DB, and sends a confirmation email including the session ID to the browser phone.
The browser phone logs in to the authentication server based on the user's confirmation of matching between the session ID issued to any terminal and the session ID included in the confirmation email;
The authentication server makes a password input request to the browser phone;
The browser phone transmits a session ID, an individual identification number, and a password to the authentication server;
The authentication server queries the browser phone DB for the received individual identification number, retrieves the corresponding email address, and queries the temporary DB whether the combination of this email address, password, and session ID is correct. And a step of transmitting an identity confirmation message to the store server. In the user authentication method by the mail of the browser phone of Claim 7,
The store server includes a step of checking whether the user has a membership using the member DB and permitting login to an arbitrary terminal. A browser phone DB that holds a set of the email address and individual identification number of the browser phone used by the user is provided,
A means for issuing and sending a session ID and password for access from any terminal,
Means for receiving a browser phone mail address and session ID from an arbitrary terminal, and storing a set of the session ID, password, and mail address in a temporary DB;
Means for sending a confirmation email containing the session ID to the browser phone;
Means for permitting browser phone login based on the user's match confirmation between the session ID issued to any terminal and the session ID included in the confirmation email;
A means for requesting the browser phone to input a password;
Means for receiving the session ID, individual identification number and password from the browser phone;
Inquire the browser phone DB for the received individual identification number, retrieve the corresponding email address, and inquire to the temporary DB whether the combination of this email address, password and session ID is correct. And a means for transmitting an identity confirmation message to the store server. Issuing and sending a session ID and password for access from any terminal;
Receiving a browser phone mail address and session ID from an arbitrary terminal, and storing a set of the session ID, password, and mail address in a temporary DB;
Sending a confirmation email containing the session ID to the browser phone;
Allowing browser phone login based on the user's match confirmation between the session ID issued to any terminal and the session ID included in the confirmation email;
Requesting the browser phone to enter a password;
Receiving a session ID, an individual identification number and a password from a browser phone;
Inquire the browser phone DB for the received individual identification number, retrieve the corresponding email address, and inquire to the temporary DB whether the combination of this email address, password and session ID is correct. And a step of transmitting an identity confirmation end message to the store server. A user authentication method using a browser phone mail in an authentication server, comprising: Processing to issue and send a session ID and password for access from any terminal,
A process of receiving the browser phone mail address and session ID from any terminal, and storing the session ID, password, and mail address pair in a temporary DB;
Processing to send a confirmation email containing the session ID to the browser phone;
Processing to allow browser phone login based on the user's match confirmation between the session ID issued to any terminal and the session ID included in the confirmation email;
A process for requesting password input to the browser phone;
Processing to receive the session ID, individual identification number and password from the browser phone;
Inquire the browser phone DB for the received individual identification number, retrieve the corresponding email address, and inquire to the temporary DB whether the combination of this email address, password and session ID is correct. As a user authentication program by browser phone mail in an authentication server for causing a computer to execute a process of transmitting an identity confirmation message to a store server. Processing to issue and send a session ID and password for access from any terminal,
A process of receiving a browser phone mail address and session ID from an arbitrary terminal, and storing a session ID, password, and mail address pair in a temporary DB;
Processing to send a confirmation email containing the session ID to the browser phone;
Processing to allow browser phone login based on the user's match confirmation between the session ID issued to any terminal and the session ID included in the confirmation email;
A process for requesting password input to the browser phone;
Processing to receive the session ID, individual identification number and password from the browser phone;
Inquire the browser phone DB for the received individual identification number, retrieve the corresponding email address, and inquire to the temporary DB whether the combination of this email address, password and session ID is correct. As a recording medium on which is recorded a user authentication program by a browser phone mail in an authentication server for causing a computer to execute processing for transmitting an identity confirmation message to a store server.

Images