JP4018573B2 - Authentication system and communication terminal - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an authentication system that performs authentication between a communication terminal connected to a communication network and a user who uses the communication terminal.
[0002]
[Prior art]
The specifications of the so-called third generation mobile communication system are defined by a standardization organization such as 3GPP (3rd Generation Partnership Project). In this third generation mobile communication system, a removable USIM (Universal Subscriber Identity Module) card including identification information for the mobile communication network to perform subscriber identification is inserted into a communication terminal receiving service. When receiving authentication by the mobile communication network, the communication terminal reads identification information from the USIM card and notifies the mobile communication network. The mobile communication network authenticates the communication terminal using the notified identification information, and provides the service to the communication terminal when the authentication is successful (see, for example, Non-Patent Document 1).
[0003]
[Non-Patent Document 1]
Takeshi Hattori, Masanobu Fujioka, “Wireless Broadband Textbook”, IDC Japan, June 10, 2002, p. 450-456
[0004]
[Problems to be solved by the invention]
However, in the above-described conventional authentication method, the mobile communication network only specifies a communication terminal, and does not specify any user who uses the communication terminal. For this reason, when a mobile communication network provides an appropriate service according to an individual user, or when a user receives a service while changing the communication terminal used by the user, the communication terminal to which the service is provided is appropriately switched. It has been difficult to provide advanced services in consideration of users, such as ensuring convenience.
[0005]
Therefore, an object of the present application is to provide an authentication system and a communication terminal that can provide an advanced service in consideration of a user.
[0006]
[Means for Solving the Problems]
  In order to solve the above problems, the present inventionAccording toIn the authentication system that authenticates the communication terminal and the user who uses the communication terminal, terminal identification information notified from the communication terminalAnd terminal identification information held in advanceCommunication terminal authentication means for authenticating the communication terminal based onA communication terminal using user authentication means for authenticating a user based on the input user identification information and pre-stored user identification information, and registering the user as a user using the communication terminal in the case of successful authentication;
  The user is registeredA user who uses the communication terminal based on the user identification information notified from the communication terminalUser registered asAuthenticatenetworkUser authentication means, the communication terminal authentication means, andnetworkA communication terminal that manages the communication terminal and a user who uses the communication terminal when the authentication by the user authentication unit is successful; and a user management unit.
[0007]
  In addition, the present inventionAccording to,the aboveThe authentication system includes service providing means for providing a service corresponding to the user to the communication terminal.
[0008]
  In addition, the present inventionAccording to,the aboveThe authentication system includes a communication terminal related information management unit that manages information related to the communication terminal, and a user related information management unit that manages information related to the user.
[0009]
  In addition, the present inventionAccording to,the aboveIn the authentication system, the user identification information is notified from the communication terminal when the authentication of the user is successful in the communication terminal.
[0010]
  In addition, the present inventionAccording to,the aboveIn the authentication system, when the user can use a plurality of communication terminals, the communication terminal and the user management unit associate and manage the user and the use states of the plurality of mobile terminals.
[0011]
  In addition, the present inventionAccording to,the aboveThe authentication system includes an authentication requesting unit that requests the switching destination communication terminal to authenticate the user when the communication terminal used by the user is switched.
[0012]
  In addition, the present inventionAccording to,the aboveIn the authentication system,The communication terminal used by the user was switchedIn case,Switching sourceAuthentication state transition requesting means for requesting to shift the authentication state of the user in the communication terminal from authenticated to unauthenticated is provided.
[0013]
  In addition, the present inventionAccording toIn a communication terminal that receives authentication by an authentication system configured in a communication network,The authentication system authenticates the communication terminal based on the terminal identification information notified from the communication terminal and the terminal identification information held in advance, and adds the user identification information notified from the communication terminal to which the user is registered. The user who is registered as a user who uses the communication terminal is authenticated, and the communication terminal and the user who is registered as a user who uses the communication terminal are successfully authenticated. Manage and associate users with devices,Terminal identification information management means for managing terminal identification information corresponding to the own apparatus, and terminal identification for notifying the authentication system of terminal identification information corresponding to the own apparatus, which is managed by the terminal identification information management means Information notification means, user identification information management means for managing user identification information corresponding to a user who can use the device, user identification information input by the user, and user identification managed by the user identification information management means The user is authenticated against the information.If the authentication is successful, the communication terminal is used to register the user as the user who uses the communication terminal.User authentication means, andUse of communication terminalUser identification information notifying means for notifying the authentication system of user identification information corresponding to the user when the user authentication is successful by the user authentication means.
[0014]
  In addition, the present inventionAccording to,the aboveIn the communication terminal,Use of communication terminalUser authentication meansOthers using other communication terminalsUserTo the communication terminalWhen switched, the authentication systemotherWhen user authentication is requested, the user is authenticated.
[0015]
  In addition, the present inventionAccording to,the aboveIn the communication terminal,The user to use was switched to another communication terminalIn this case, an authentication state transition unit is provided for shifting the authentication state of the user by the user authentication unit from authenticated to unauthenticated.
[0016]
According to the present invention, the authentication system not only authenticates the communication terminal but also authenticates the user who uses the communication terminal, and further manages the communication terminal and the user who uses the communication terminal in association with each other. Therefore, the authentication system can recognize which user is using which communication terminal, and can provide an advanced service in consideration of the user.
[0017]
Further, according to the present invention, when the communication terminal performs user authentication and the communication terminal used by the user is switched, the authentication system requests user authentication to the switching destination communication terminal. The switching destination communication terminal authenticates the user in response to this request. Therefore, the user can use the switching destination communication terminal and can continuously receive the service.
[0018]
Further, according to the present invention, when the communication terminal performs user authentication and a predetermined condition is satisfied, the user authentication state at the communication terminal is shifted from authenticated to unauthenticated. Therefore, when the communication terminal being used by the user is switched, the authentication state of the user remains authenticated in the switching source communication terminal, so that the switching source communication terminal is not misused. can do.
[0019]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0020]
FIG. 1 is a diagram illustrating a configuration example of a mobile communication system according to an embodiment of the present invention. In the mobile communication system shown in the figure, the mobile communication network 10 includes a network terminal authentication device 40, a terminal profile storage device 50, a mobility management device 60, a terminal use user management device 70, a user profile storage device 80, and a network user authentication device 90. And a service providing device 95, and these devices constitute an authentication system. The mobile communication network 10 authenticates a movable communication terminal such as a mobile phone (here, communication terminals 20 and 30) and also authenticates a user who uses the communication terminal (here, user 1). Further, the communication terminals 20 and 30 authenticate the user (here, the user 1).
[0021]
The network terminal authentication device 40 in the mobile communication network 10 authenticates the communication terminal. The terminal profile storage device 50 manages information (terminal profile information) related to the communication terminal such as the function of the communication terminal, the screen size, and the memory amount. The network user authentication device 90 authenticates the user. The user profile management device 80 manages user-related information (user profile information) such as user preferences and personal information. The terminal use user management device 70 manages users who can use the communication terminal and users who are using the communication terminal. The service providing device 95 provides services corresponding to the user, such as a seamless service and a user data storage service, to the communication terminal. The movement management device 60 performs position management accompanying the movement of the communication terminal, routing management to the communication terminal 20, paging management, and the like.
[0022]
The communication terminal 20 includes a terminal identification device 200 that manages terminal identification information that is information for the mobile communication network 10 to identify the communication terminal 20, a user identification device 210 that manages users who can use the communication terminal 20, Service communication function 250 that provides data communication such as telephone call, web access, mail transmission / reception, etc., control communication function 260 that provides communication for network control such as authentication, location registration, and paging acceptance, mail editing, schedule book editing, address A service function 270 that provides user interface functions such as book editing and photography, and a user authentication function 280 that authenticates a user who uses the communication terminal 20 are provided. The communication terminal 30 has a configuration equivalent to that of the communication terminal 20.
[0023]
Next, information held by each device in the mobile communication network 10 shown in FIG. 1 and each device and each function in the communication terminals 20 and 30 will be described. FIG. 2 is a diagram illustrating information held by each device in the mobile communication network 10 and each device and function in the communication terminals 20 and 30.
[0024]
The network terminal authentication device 40 in the mobile communication network 10 includes terminal identification information, which is information for identifying a communication terminal, and data (authentication data) used for authentication of the communication terminal specified by the terminal identification information. Holding. In FIG. 2, IMSI (International Mobile Subscriber Identity) is used as terminal identification information, and an encryption key (Cipher Key) is used as authentication data. The terminal profile storage device 50 stores and manages terminal identification information and terminal profile information that is information related to the communication terminal specified by the terminal identification information. In FIG. 2, IMSI is used as terminal identification information.
[0025]
The network user authentication device 90 holds user identification information, which is information for identifying a user, and data (authentication data) used for user authentication specified by the user identification information. In FIG. 2, MSN (Mobile Subscriber Number) is used as user identification information, and an encryption key and verification data using a user's physical characteristics are used as authentication data. The user profile storage device 80 stores and manages user identification information and user profile information that is information related to the user specified by the user identification information. In FIG. 2, MSN is used as user identification information.
[0026]
The terminal user management device 70 can use the terminal identification information, the user identification information of the user who is using the communication terminal specified by the terminal identification information, and the communication terminal specified by the terminal identification information. It holds user identification information of users who are not using it. In FIG. 2, IMSI is used as terminal identification information, and MSN is used as user identification information.
[0027]
The service providing device 95 holds user identification information and user data corresponding to the user specified by the user identification information, and also holds data of a service to be provided. In FIG. 2, IMSI is used as terminal identification information.
[0028]
On the other hand, the terminal identification device 200 in the communication terminal 20 holds terminal identification information of the terminal itself and authentication data. In FIG. 2, IMSI is used as terminal identification information, and an encryption key is used as authentication data. The user identification device 210 holds user identification information and authentication data. In FIG. 2, MSN is used as user identification information, and an encryption key and verification data using physical characteristics of the user are used as authentication data.
[0029]
The user authentication function 280 holds user identification information of an authenticated user. In FIG. 2, MSN is used as user identification information. The service function 270 holds user identification information, user profile information that is information related to the user specified by the user identification information, and user data. In FIG. 2, MSN is used as user identification information. Further, the service function 270 holds terminal profile information that is information about the terminal itself.
[0030]
Next, the operation of the mobile communication system according to this embodiment will be described. First, the operation when the mobile communication network 10 authenticates the communication terminal 20 will be described with reference to the sequence diagram of FIG.
[0031]
When the communication terminal 20 is turned on, the control communication function 260 in the communication terminal 20 reads the terminal identification information of the communication terminal 20 held by the terminal identification device 200 (step 101). When the control communication function 260 succeeds in reading the terminal identification information, the control communication function 260 transmits the terminal identification information to the network terminal authentication device 40 in the mobile communication network 10 (step 102).
[0032]
The network terminal authentication device 40 authenticates the communication terminal 20 based on the received terminal identification information. When the authentication is successful, the network terminal authentication device 40 activates the mobility management device 60 in order to continue communication even if the communication terminal 20 moves (step 103). Next, the network terminal authentication device 40 instructs the control communication function 260 in the communication terminal 20 to transmit the user identification information of the user 1 (step 104).
[0033]
In response to this instruction, the control communication function 260 in the communication terminal 20 reads the user identification information of the user 1 held by the user identification device 210 (step 105). Further, the control communication function 260 transmits the read user identification information to the network terminal authentication device 40 in the mobile communication network 10 (step 106).
[0034]
The network terminal authentication device 40 in the mobile communication network 10 transfers the received user identification information to the terminal use user management device 70 (step 107). The terminal user management apparatus 70 registers the user 1 as a user who can use the communication terminal 20 by registering the transferred user identification information (step 108). Note that the communication terminal 20 may directly transmit user identification information to the terminal user management device 70 and accumulate the user identification information received by the terminal user management device 70.
[0035]
After transferring the user identification information to the terminal user management device 70, the network terminal authentication device 40 instructs the control communication function 260 in the communication terminal 20 to transmit the terminal profile information of the communication terminal 20. (Step 109).
[0036]
In response to this instruction, the control communication function 260 in the communication terminal 20 reads terminal profile information held by the service function 270 (step 110). Further, the control communication function 260 transmits the read terminal profile information to the network terminal authentication device 40 in the mobile communication network 10 (step 111).
[0037]
The network terminal authentication device 40 in the mobile communication network 10 transfers the received terminal profile information to the terminal profile storage device 50 (step 112). The terminal profile storage device 50 registers the transferred terminal profile information (step 113). Here, when the terminal profile information of the communication terminal 20 is already registered in the terminal profile storage device 50, the communication terminal 20 manages the difference information from the previous registration time, and only the difference information is stored in the terminal profile storage device. 50 may be transmitted. Further, the communication terminal 20 may transmit the terminal profile information directly to the terminal profile storage device 50 without going through the network terminal authentication device 40 when transmitting the terminal profile information.
[0038]
Next, the operation when the communication terminal 20 authenticates the user 1 will be described with reference to the sequence diagram of FIG. The user authentication function 280 in the communication terminal 20 reads the user identification information held by the user identification device 210 and is in a state where it is possible to specify a user who can use the communication terminal 20 (step 201). ). In this state, the user 1 inputs user identification information to the communication terminal 20 in order to use the communication terminal 20. The user authentication function 280 authenticates the user 1 by collating the input user identification information with the user identification information read from the user identification device 210. The user identification information here may be information of an ID password method, or may be biometric information using a user's fingerprint, a characteristic pattern of glow, or the like. In the case of an ID password, user identification information is input from a keypad. On the other hand, in the case of biometric information, a device capable of reading the biometric information is used (step 202).
[0039]
When the authentication is successful, the user authentication function 280 registers the user 1 as the user who is using the communication terminal 20 by registering the user identification information of the user 1 (step 203). Further, the user authentication function 280 activates the service function 270 to enable provision of user interface functions such as mail editing, schedule book editing, address book editing, and photography (step 204). The service function 270 displays personal information such as the age and sex of the user 1, presence information indicating the current situation, preference information indicating how to use the service provided by the mobile communication network 10, and the like. 1 as user profile information (step 205). Here, when the user profile information of the user 1 is already registered in the service function 270, the service function 270 manages the difference information from the previous registration time by the user 1, and registers only the difference information. Also good.
[0040]
Next, the operation when the mobile communication network 10 authenticates the user 1 will be described with reference to the sequence diagram of FIG. The communication terminal 20 is in a state of being authenticated by the network terminal authentication device 40 in the mobile communication network 10 through the terminal authentication process shown in the sequence diagram of FIG. 3 in order to communicate with the mobile communication network 10. . Further, it is assumed that the communication terminal 20 is in a state of authenticating the user 1 through the user authentication process by the user authentication function 280 shown in the sequence diagram of FIG.
[0041]
In this state, the user 1 inputs user identification information to the user identification device 210 in the communication terminal 20. The user identification information here may be information of an ID password method, or may be biometric information using a user's fingerprint, a characteristic pattern of glow, or the like. In the case of an ID password, user identification information is input from a keypad. On the other hand, in the case of biometric information, a device capable of reading the biometric information is used (step 301). The user identification device 210 transfers the user identification information of the user 1 input by the user 1 to the control communication function 260 (step 302). The control communication function 260 transmits the transferred user identification information of the user 1 to the network user authentication device 90 in the mobile communication network 10 (step 303).
[0042]
The network user authentication device 90 in the mobile communication network 10 authenticates the user 1 by collating the received user identification information of the user 1 with the user identification information held in advance by the network user authentication device 90 (step 304). . If the authentication is successful, the network user authentication device 90 transfers the received user identification information to the terminal user management device 70 (step 305). The terminal user management apparatus 70 registers the user 1 as a user who is using the communication terminal 20 by registering the transferred user identification information (step 306).
[0043]
The network user authentication device 90 activates the service communication function 250 in the communication terminal 20 after transferring the user identification information to the terminal user management device 70 (step 307). The service function 270 that has undergone the user authentication process shown in the sequence diagram of FIG. 3 can use the activated service communication function 250. Thereby, the user 1 can use services provided by the mobile communication network 10 such as telephone calls, web access, and mail transmission / reception. Next, the network user authentication device 90 in the mobile communication network 10 instructs the service communication function 250 in the communication terminal 20 to transmit the user profile information of the user 1 (step 308).
[0044]
In response to this instruction, the service communication function 250 in the communication terminal 20 reads the user profile information of the user 1 held by the service function 270 (step 309). Further, the service communication function 250 transmits the read user profile information of the user 1 to the network user authentication device 90 in the mobile communication network 1-0 (step 310). The network user authentication device 90 in the mobile communication network 10 transfers the received user profile information of the user 1 to the user profile storage device 80 (step 311). The user profile storage device 80 stores and manages the transferred user profile information of the user 1 (step 312). Here, when the user profile information of the user 1 is already stored in the user profile storage device 80, the communication terminal 20 manages the difference information from the previous registration time, and only the difference information is stored in the user profile storage device 80. You may make it transmit to. Further, the communication terminal 20 may transmit the user profile information directly to the user profile storage device 80 without going through the network user authentication device 90 when transmitting the user profile information.
[0045]
After transferring the user profile information to the user profile storage device 80, the network user authentication device 90 can request the service providing device 95 to transmit user data (step 313). When this request is made, the service providing apparatus 95 transmits user data generated by the user 1 such as a telephone directory, mail transmission / reception history, and web access history to the service communication function 250 in the communication terminal 20 (step 314). ). The service communication function in the communication terminal 20 transfers the received user data to the service function 270 (step 315). The service function 270 stores the transferred user data (step 316). As a result, user data is available in the communication terminal 30.
[0046]
The network user authentication device 90 in the authentication of the user 1 by the mobile communication network 10 shown in the sequence diagram of FIG. 5 and the user authentication function 280 in the authentication of the user 1 by the communication terminal 20 shown in the sequence diagram of FIG. There is no need to be. Accordingly, it is possible to provide completely different methods for authenticating the user 1 by the user authentication function 280 and the network user authentication device 90 and the accuracy of authentication.
[0047]
However, as another embodiment, the user authentication function 280 and the network user authentication device 90 can authenticate the user 1 and the authentication accuracy can be made exactly the same. In this case, since the user authentication function 280 and the network user authentication apparatus 90 can authenticate the user 1 based on the same user identification information, the user 1 can input the user identification information once. it can. Hereinafter, the operation when the mobile communication network 10 and the communication terminal 20 authenticate the user 1 based on one user identification information will be described with reference to the sequence diagram of FIG. 6.
[0048]
The user authentication function 280 in the communication terminal 20 reads the user identification information held by the user identification device 210 and is in a state where it is possible to specify a user who can use the communication terminal 20 (step 401). ). In this state, the user 1 inputs user identification information to the communication terminal 20 in order to use the communication terminal 20. The user authentication function 280 authenticates the user 1 by collating the input user identification information with the user identification information read from the user identification device 210. The user identification information here may be information of an ID password method, or may be biometric information using a user's fingerprint, a characteristic pattern of glow, or the like. In the case of an ID password, user identification information is input from a keypad. On the other hand, in the case of biometric information, a device capable of reading the biometric information is used (step 402).
[0049]
When the authentication is successful, the user authentication function 280 registers the user 1 as the user who is using the communication terminal 20 by registering the user identification information of the user 1 (step 403). Further, the user authentication function 280 activates the service function 270 to enable provision of user interface functions such as mail editing, schedule book editing, address book editing, and photography (step 404). The service function 270 displays personal information such as the age and sex of the user 1, presence information indicating the current situation, preference information indicating how to use the service provided by the mobile communication network 10, and the like. 1 as user profile information (step 405). Here, when the user profile information of the user 1 is already registered in the service function 270, the service function 270 manages the difference information from the previous registration time by the user 1, and registers only the difference information. Also good.
[0050]
Next, the user authentication function 280 transfers the user identification information of the user 1 input by the user 1 to the control communication function 260 (step 406). The control communication function 260 transmits the transferred user identification information of the user 1 to the network user authentication device 90 in the mobile communication network 10 (step 407).
[0051]
The network user authentication device 90 in the mobile communication network 10 authenticates the user 1 by comparing the received user identification information of the user 1 with the user identification information held in advance by the network user authentication device 90 (step 408). . If the authentication is successful, the network user authentication device 90 transfers the received user identification information to the terminal-use user management device 70 (step 409). The terminal user management apparatus 70 registers the user 1 as a user who is using the communication terminal 20 by registering the transferred user identification information (step 410).
[0052]
The network user authentication device 90 activates the service communication function 250 in the communication terminal 20 after transferring the user identification information to the terminal use user management device 70 (step 411). The service function 270 that has undergone the user authentication process can use the activated service communication function 250. Thereby, the user 1 can use services provided by the mobile communication network 10 such as telephone calls, web access, and mail transmission / reception. Next, the network user authentication device 90 in the mobile communication network 10 instructs the service communication function 250 in the communication terminal 20 to transmit the user profile information of the user 1 (step 412).
[0053]
In response to this instruction, the service communication function 250 in the communication terminal 20 reads the user profile information of the user 1 held by the service function 270 (step 413). Further, the service communication function 250 transmits the read user profile information of the user 1 to the network user authentication device 90 in the mobile communication network 1-0 (step 414). The network user authentication device 90 in the mobile communication network 10 transfers the received user profile information of the user 1 to the user profile storage device 80 (step 415). The user profile storage device 80 stores and manages the transferred user profile information of the user 1 (step 416). Here, when the user profile information of the user 1 is already stored in the user profile storage device 80, the communication terminal 20 manages the difference information from the previous registration time, and only the difference information is stored in the user profile storage device 80. You may make it transmit to. Further, the communication terminal 20 may transmit the user profile information directly to the user profile storage device 80 without going through the network user authentication device 90 when transmitting the user profile information.
[0054]
After transferring the user profile information to the user profile storage device 80, the network user authentication device 90 can request the service providing device 95 to transmit user data (step 417). When this request is made, the service providing apparatus 95 transmits user data generated by the user 1 such as a telephone directory, mail transmission / reception history, and web access history to the service communication function 250 in the communication terminal 20 (step 418). ). The service communication function in the communication terminal 20 transfers the received user data to the service function 270 (step 419). The service function 270 stores the transferred user data (step 420). As a result, user data is available in the communication terminal 30.
[0055]
Incidentally, the terminal authentication by the mobile communication network 10 shown in the sequence diagram of FIG. 3 and the user authentication by the communication terminal 20 shown in the sequence diagram of FIG. 4 can be performed in any order. For example, when the terminal identification device 200 in the communication terminal 20 is detachable, when the terminal identification device 200 is not attached to the communication terminal 20, or between the mobile communication network 10 and the communication terminal 20 due to a radio interruption. 3 cannot be established, the terminal authentication by the mobile communication network 10 shown in the sequence diagram of FIG. 3 cannot be performed. Therefore, in the user authentication by the mobile communication network 10 shown in the sequence diagram of FIG. The network user authentication device 90 cannot perform user authentication. However, user authentication by the communication terminal 20 shown in the sequence diagram of FIG. 4 is possible, and the user authentication function 280 in the communication terminal 20 can authenticate the user 1. Here, when the network user authentication device 90 in the mobile communication network 10 is able to authenticate the user 1 such as when the terminal identification device 200 is attached to the communication terminal 20 or the wireless disconnection is restored, the communication terminal It is also possible to implement a form in which authentication information is exchanged between the user authentication function 280 in the network 20 and the network user authentication device 90, and the mobile communication network 10 authenticates the user 1. Hereinafter, the operation when the mobile communication network 10 authenticates the user 1 when the radio interruption is recovered will be described with reference to the sequence diagram of FIG.
[0056]
When the communication terminal 20 is powered on, the control communication function 260 in the communication terminal 20 reads the terminal identification information of the communication terminal 20 held by the terminal identification device 200 (step 501). It is assumed that the user authentication function 280 reads the user identification information held by the user identification device 210 and can identify a user who can use the communication terminal 20 (step 502). In this state, the user 1 inputs user identification information to the communication terminal 20 in order to use the communication terminal 20. The user authentication function 280 authenticates the user 1 by collating the input user identification information with the user identification information read from the user identification device 210. The user identification information here may be information of an ID password method, or may be biometric information using a user's fingerprint, a characteristic pattern of glow, or the like. In the case of an ID password, user identification information is input from a keypad. On the other hand, in the case of biometric information, a device capable of reading the biometric information is used (step 503).
[0057]
When the authentication is successful, the user authentication function 280 registers the user 1 as the user who is using the communication terminal 20 by registering the user identification information of the user 1 (step 504). Further, the user authentication function 280 activates the service function 270 to enable provision of user interface functions such as mail editing, schedule book editing, address book editing, and photography (step 505). The service function 270 displays personal information such as the age and sex of the user 1, presence information indicating the current situation, preference information indicating how to use the service provided by the mobile communication network 10, and the like. 1 as user profile information (step 506). Here, when the user profile information of the user 1 is already registered in the service function 270, the service function 270 manages the difference information from the previous registration time by the user 1, and registers only the difference information. Also good.
[0058]
Here, it is assumed that the radio interruption between the mobile communication network 10 and the communication terminal 20 has been recovered. In this case, the control communication function 260 in the communication terminal 20 transmits the terminal identification information read from the terminal identification device 200 to the network terminal authentication device 40 in the mobile communication network 10 (step 507).
[0059]
The network terminal authentication device 40 authenticates the communication terminal 20 based on the received terminal identification information. When the authentication is successful, the network terminal authentication device 40 activates the mobility management device 60 in order to continue communication even if the communication terminal 20 moves (step 508). Next, the network terminal authentication device 40 instructs the control communication function 260 in the communication terminal 20 to transmit the user identification information of the user 1 (step 509).
[0060]
In response to this instruction, the control communication function 260 in the communication terminal 20 reads the user identification information of the user 1 held by the user identification device 210 (step 510). Further, the control communication function 260 transmits the read user identification information to the network terminal authentication device 40 in the mobile communication network 10 (step 511).
[0061]
The network terminal authentication device 40 in the mobile communication network 10 transfers the received user identification information to the terminal use user management device 70 (step 512). The terminal use user management apparatus 70 registers the user 1 as a user who can use the communication terminal 20 by registering the transferred user identification information (step 513). Note that the communication terminal 20 may directly transmit user identification information to the terminal user management device 70 and accumulate the user identification information received by the terminal user management device 70.
[0062]
After transferring the user identification information to the terminal user management device 70, the network terminal authentication device 40 instructs the control communication function 260 in the communication terminal 20 to transmit the terminal profile information of the communication terminal 20. (Step 514).
[0063]
In response to this instruction, the control communication function 260 in the communication terminal 20 reads the terminal profile information held by the service function 270 (step 515). Further, the control communication function 260 transmits the read terminal profile information to the network terminal authentication device 40 in the mobile communication network 10 (step 516).
[0064]
The network terminal authentication device 40 in the mobile communication network 10 transfers the received terminal profile information to the terminal profile storage device 50 (step 517). The terminal profile storage device 50 registers the transferred terminal profile information (step 518). Here, when the terminal profile information of the communication terminal 20 is already registered in the terminal profile storage device 50, the communication terminal 20 manages the difference information from the previous registration time, and only the difference information is stored in the terminal profile storage device. 50 may be transmitted. Further, the communication terminal 20 may transmit the terminal profile information directly to the terminal profile storage device 50 without going through the network terminal authentication device 40 when transmitting the terminal profile information.
[0065]
The control communication function 260 in the communication terminal 20 transmits the terminal profile information to the network terminal authentication device 40 in the mobile communication network 10, and then determines whether there is a user who is using the communication terminal 20 to the user authentication function 280. An inquiry is made (step 519). When there is a user who uses the communication terminal 20 (here, referred to as user 1), the control communication function 260 transmits the user identification information of the user 1 to the network user authentication device 90 in the mobile communication network 10 ( Step 520).
[0066]
The network user authentication device 90 in the mobile communication network 10 authenticates the user 1 by comparing the received user identification information of the user 1 with the user identification information held in advance by the network user authentication device 90 (step 521). . If the authentication is successful, the network user authentication device 90 transfers the received user identification information to the terminal-use user management device 70 (step 522). The terminal user management apparatus 70 registers the user 1 as a user who is using the communication terminal 20 by registering the transferred user identification information (step 523).
[0067]
The network user authentication device 90 activates the service communication function 250 in the communication terminal 20 after transferring the user identification information to the terminal use user management device 70 (step 524). The service function 270 that has undergone the user authentication process can use the activated service communication function 250. Thereby, the user 1 can use services provided by the mobile communication network 10 such as telephone calls, web access, and mail transmission / reception. Next, the network user authentication device 90 in the mobile communication network 10 instructs the service communication function 250 in the communication terminal 20 to transmit the user profile information of the user 1 (step 525).
[0068]
In response to this instruction, the service communication function 250 in the communication terminal 20 reads the user profile information of the user 1 held by the service function 270 (step 526). Further, the service communication function 250 transmits the read user profile information of the user 1 to the network user authentication device 90 in the mobile communication network 1-0 (step 527). The network user authentication device 90 in the mobile communication network 10 transfers the received user profile information of the user 1 to the user profile storage device 80 (step 528). The user profile storage device 80 stores and manages the transferred user profile information of the user 1 (step 529). Here, when the user profile information of the user 1 is already stored in the user profile storage device 80, the communication terminal 20 manages the difference information from the previous registration time, and only the difference information is stored in the user profile storage device 80. You may make it transmit to. Further, the communication terminal 20 may transmit the user profile information directly to the user profile storage device 80 without going through the network user authentication device 90 when transmitting the user profile information.
[0069]
After transferring the user profile information to the user profile storage device 80, the network user authentication device 90 can request the service providing device 95 to transmit user data (step 530). When this request is made, the service providing apparatus 95 transmits user data generated by the user 1 such as a telephone directory, mail transmission / reception history, and web access history to the service communication function 250 in the communication terminal 20 (step 531). ). The service communication function in the communication terminal 20 transfers the received user data to the service function 270 (step 532). The service function 270 stores the transferred user data (step 533). As a result, user data is available in the communication terminal 30.
[0070]
Next, with reference to the sequence diagram of FIG. 8, an operation when user authentication is taken over when the communication terminal 20 or the like used by the user 1 is switched will be described.
[0071]
It is assumed that the mobile communication network 10 has finished the authentication of the communication terminal 20 and the user 1, and the communication terminal 20 has finished the authentication of the user 1. In addition, it is assumed that the user identification device 310 in the communication terminal 30 holds the user identification information of the user 1, and the mobile communication network 10 has finished the authentication of the communication terminal 30. Furthermore, the service providing device 95 in the mobile communication network 10 determines whether or not the communication terminal used by the user 1 needs to be switched from the communication terminal 20 to the communication terminal 30. It is assumed that processing for notifying the user authentication device 90 of the switching request can be performed.
[0072]
In such a state, when the service providing apparatus 95 in the mobile communication network 10 determines that the communication terminal used by the user 1 needs to be switched from the communication terminal 20 to the communication terminal 30, the service providing apparatus 95 notifies the network user authentication apparatus 90. On the other hand, a request for switching the communication terminal being used by the user 1 from the communication terminal 20 to the communication terminal 30 is notified (step 601). Upon receiving this request, the network user authentication device 90 confirms that the user 1 has been authenticated (step 602), makes an inquiry to the terminal user management device 70 (step 603), and the user 1 communicates with the communication terminal. 20 is checked (step 604). Further, the network user authentication device 90 makes an inquiry to the terminal use user management device 70 (step 605), and confirms whether or not the user 1 can use the communication terminal 30.
[0073]
Next, the network user authentication device 90 causes the user 1 to be authenticated in the communication terminal 30 so that the user 1 can use the communication terminal 30. At this time, the network user authentication device 90 notifies the control communication function 360 in the communication terminal 30 of a use state setting request for the user 1 (step 606). This usage state setting request includes, for example, user identification information of the user 1.
[0074]
The control communication function 360 in the communication terminal 30 transfers the received usage state setting request for the user 1 to the user authentication function 380 (step 607). The user authentication function 380 registers the user 1 as a user who can use the communication terminal 30 in response to the transferred use state setting request for the user 1 (step 608). For example, when the user identification information of the user 1 is included in the use state setting request, the user authentication function 380 holds the identification information of the user 1 as a user who can use the communication terminal 30. 1 is registered. Thereby, in the communication terminal 30, the user 1 is authenticated.
[0075]
Further, the user authentication function 380 transfers a notification (registration completion notification) indicating that the registration of the user 1 is completed to the control communication function 350 (step 609). The control communication function 350 transmits the transferred registration completion notification to the network user authentication device 90 in the mobile communication network 10 (step 610).
[0076]
Upon receiving the registration completion notification, the network user authentication device 90 in the mobile communication network 10 causes the service function 370 in the communication terminal 30 to hold the user data of the user 1 held in the service function 270 in the communication terminal 20. Therefore, the user data of the user 1 is read from the service function 270 in the communication terminal 20 (steps 611 to 614). The read user data of the user 1 is temporarily held by the service providing apparatus 95. Thereafter, the network user authentication device 90 reads the user data of the user 1 held by the service providing device 95 and transmits it to the service notification function 350 in the communication terminal 30 (step 615).
[0077]
The service notification function 350 in the communication terminal 30 transfers the received user data of the user 1 to the service function 370 (step 616). The service function 370 registers the transferred user data of the user 1 in association with the user profile information of the user 1 (step 617).
[0078]
Further, the network user authentication device 90 requests the terminal use user management device 70 to change the use state of the communication terminal 20 related to the user 1 during use (step 618). In response to this request, the terminal-use user management device 70 changes the use state of the communication terminal 30 related to the user 1 during use (step 619).
[0079]
When the above-described series of procedures ends, the network user authentication device 90 transfers an end notification to the service providing device 95 (step 620). When the end notification is transferred, the service providing device 95 transfers a notification for changing the communication terminal 20 from a state in which the user 1 is used to an unused state to the network user authentication device 90 (step 621). Upon receiving this notification, the network user authentication device 90 transmits a deletion request for the user data of the user 1 to the service communication function 250 in the communication terminal 20 (step 622). The service communication function 250 in the communication terminal 20 transfers the received user data deletion request of the user 1 to the service function 270 (step 623). In response to this request, the service function 270 in the communication terminal 20 deletes the user data of the user 1 that it holds (step 624).
[0080]
Furthermore, the network user authentication device 90 in the mobile communication network 10 issues a request (authentication state change request) to change the authentication state for the user 1 from authenticated to unauthenticated to the service communication function 250 in the communication terminal 20. Transmit (step 625). The service communication function 250 in the communication terminal 20 transfers an authentication status change request to the user authentication function 280 (step 626). In response to this authentication status change request, the user authentication function 280 changes the authentication status of the user 1 from authenticated to unauthenticated, for example, by deleting the held user identification information of the user 1 (step 627). ).
[0081]
Further, the network user authentication device 90 in the mobile communication network 10 sends a request for changing the usage state of the communication terminal 20 related to the user 1 from being used to being available to the terminal user management device 70 (step 628). . In response to this request, the terminal user management apparatus 70 changes the usage state of the communication terminal 20 related to the user 1 from being used to being available (unused) (step 629).
[0082]
In the above-described embodiment, the communication terminal 20 changes the authentication state of the user 1 from authenticated to unauthenticated in response to a request from the service providing apparatus 95 in the mobile communication network 10. When a predetermined time has passed since the start of the user 1 or when an instruction is given by an operation by the user 1, the authentication state of the user 1 may be changed from authenticated to unauthenticated.
[0083]
When user profile information and terminal profile information are frequently updated, user profile information and terminal profile information are exchanged between the mobile communication network 10 and the communication terminal 20. Thus, the mobile communication network 10 and the communication terminal 20 can hold the latest user profile information and terminal profile information.
[0084]
As described above, in the present embodiment, the mobile communication network 10 not only authenticates the communication terminal 20 etc., but also authenticates the user 1 who uses the communication terminal 20 etc. The user 1 who uses the communication terminal 20 or the like is associated and managed. Therefore, the mobile communication network 10 can recognize which user is using which communication terminal, and can provide an advanced service in consideration of the user.
[0085]
Specifically, user authentication is not limited to the advancement of functions as a terminal use permission or the use of an end-to-end service between a web browser built in a terminal such as the communication terminal 20 and a web server. It can also be used to enhance control within the network 10. For example, the mobile management function is enabled by terminal authentication, and services such as calls and mails can be used by user authentication. Further, the communication terminal 20 or the like that is not used by the user 1 transmits its location information to the mobile communication network 10. By notifying to, it becomes possible to quickly switch the service between the communication terminals 20 and the like.
[0086]
In addition, when the communication terminal 20 or the like performs user authentication and the communication terminal 20 or the like used by the user 1 is switched, the user communication terminal 20 or the like is switched from the mobile communication network 10 to the switching destination communication terminal 20 or the like. Authentication is requested, and the switching destination communication terminal 20 or the like authenticates the user 1 in response to this request. Therefore, the user 1 can use the switching destination communication terminal 20 and the like, and can continuously receive the service.
[0087]
Further, when the communication terminal 20 or the like performs user authentication and there is a request from the service providing apparatus 95, the authentication state of the user 1 in the communication terminal 20 or the like is shifted from authenticated to unauthenticated. . Therefore, when the communication terminal 20 or the like being used by the user 1 is switched, the authentication state of the user 1 remains authenticated in the switching source communication terminal 20 or the like. Can be prevented from being abused.
[0088]
In the above-described embodiment, the network terminal authentication device 40 in the mobile communication network 10 corresponds to the communication terminal authentication means, the network user authentication device 90 corresponds to the user authentication means, and the terminal user management device 70 is the communication terminal. And user management means. The service providing apparatus 95 corresponds to service providing means, authentication requesting means, and authentication state transition requesting means, the terminal profile management apparatus 50 corresponds to communication terminal related information management means, and the user profile management apparatus 80 manages user related information. Corresponds to the means.
[0089]
Also, the terminal identification devices 200 and 300 in the communication terminals 20 and 30 correspond to the terminal identification information management means, the control communication functions 260 and 360 correspond to the terminal identification information notification means and the user identification information notification means, and the user identification device 210 and 310 correspond to user identification information management means, and user authentication functions 280 and 380 correspond to user authentication means and authentication state transition means.
[0090]
【The invention's effect】
According to the present invention, it is possible to provide an advanced service considering the user.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating a configuration example of a mobile communication system according to an embodiment.
FIG. 2 is a diagram illustrating information held by each device in the mobile communication network, and each device and function in the communication terminal.
FIG. 3 is a sequence diagram showing an operation when a mobile communication network authenticates a communication terminal.
FIG. 4 is a sequence diagram showing an operation when a communication terminal authenticates a user.
FIG. 5 is a sequence diagram showing an operation when a mobile communication network authenticates a user.
FIG. 6 is a sequence diagram showing an operation when a mobile communication network and a communication terminal authenticate a user based on one user identification information.
FIG. 7 is a sequence diagram showing an operation when a mobile communication network authenticates a user when a radio interruption is restored.
FIG. 8 is a sequence diagram showing an operation when user authentication is taken over when a communication terminal used by a user is switched.
[Explanation of symbols]
10 Mobile communication network
20, 30 Communication terminal
40 Network terminal authentication device
50 Terminal profile storage device
60 Mobility management device
70 Terminal User Management Device
80 User profile storage device
90 Network user authentication device
95 Service providing equipment
200, 300 terminal identification device
210, 310 User identification device
250, 350 Service communication function
260, 360 Control communication function
270, 370 service function
280, 380 User authentication function

Claims (10)

In an authentication system that authenticates a communication terminal and a user who uses the communication terminal,
Communication terminal authentication means for authenticating the communication terminal based on the terminal identification information notified from the communication terminal and the terminal identification information held in advance ;
A communication terminal using user authentication means for authenticating a user based on the input user identification information and pre-stored user identification information, and registering the user as a user using the communication terminal in the case of successful authentication;
Based on the user identification information which the user is notified from the communication terminal registered, a network user authentication means for authenticating a user registered as a user who uses the communication terminal,
A communication terminal and a user management unit for managing the communication terminal and a user using the communication terminal in association with each other when authentication by the communication terminal authentication unit and the network user authentication unit is successful;
An authentication system comprising: The authentication system according to claim 1,
An authentication system comprising service providing means for providing a service corresponding to the user to the communication terminal. The authentication system according to claim 2,
Communication terminal related information management means for managing information related to the communication terminal;
User-related information management means for managing information related to the user;
An authentication system comprising: The authentication system according to any one of claims 1 to 3,
The user identification information is an authentication system notified from the communication terminal when the authentication of the user is successful in the communication terminal. The authentication system according to any one of claims 1 to 4,
The communication terminal and user management means, when the user can use a plurality of communication terminals, is an authentication system that manages the user and the usage states of the plurality of mobile terminals in association with each other. The authentication system according to any one of claims 1 to 5 ,
An authentication system comprising authentication request means for requesting authentication of the user to a switching destination communication terminal when the communication terminal used by the user is switched. The authentication system according to claim 6 ,
An authentication system comprising authentication state transition requesting means for requesting that the authentication state of the user in the switching source communication terminal be shifted from authenticated to unauthenticated when the communication terminal used by the user is switched . In a communication terminal that receives authentication by an authentication system configured in a communication network,
The authentication system authenticates the communication terminal based on the terminal identification information notified from the communication terminal and the terminal identification information held in advance, and adds the user identification information notified from the communication terminal to which the user is registered. The user who is registered as a user who uses the communication terminal is authenticated, and the communication terminal and the user who is registered as a user who uses the communication terminal are successfully authenticated. Manage and associate users with devices,
Terminal identification information management means for managing terminal identification information corresponding to the own device;
Terminal identification information notifying means for notifying terminal authentication information corresponding to the own apparatus, managed by the terminal identification information managing means, to the authentication system;
User identification information management means for managing user identification information corresponding to a user who can use the device;
By matching the user identification information to which the user identification information input by the user and is managed by the user identification information management unit, have rows authentication of the user, in the case of successful authentication, utilizing the communication terminal user Communication terminal using user authentication means for registering the user as :
User identification information notifying means for notifying the authentication system of user identification information corresponding to the user when the user authentication is successful by the communication terminal using user authentication means;
A communication terminal comprising: The communication terminal according to claim 8,
The communication terminal use user authentication means is configured to request authentication of the other user from the authentication system when a communication terminal used by another user using another communication terminal is switched to the own communication terminal. A communication terminal for authenticating the user. In the communication terminal according to claim 8 or 9,
A communication terminal provided with an authentication state shift means for shifting the authentication state of the user by the user authentication means from authenticated to unauthenticated when a user to be used is switched to another communication terminal.

Images