JP4271491B2 - Communication method and authentication apparatus - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a communication method and an authentication apparatus, and more particularly to a communication method and an authentication apparatus that can authenticate a dedicated terminal as its own dedicated terminal using a one-time password and connect the dedicated terminal to a predetermined information terminal.
[0002]
[Prior art]
Conventionally, in rental offices and remote offices, it has been necessary to jointly use a dedicated terminal such as a personal computer or the like at that location, or bring in a dedicated terminal and use it.
[0003]
However, when bringing in a dedicated terminal and using it, individual setting items such as network settings can be dedicated to you and customization of the usage environment can be realized, but it is necessary to carry the dedicated terminal itself. It was inconvenient.
[0004]
On the other hand, when jointly using a dedicated terminal, change the network connection before using it to connect remotely to your company's network or to connect to the Internet. Because you are forced to make various settings for your email software, Japanese dictionaries, etc. are also shared for Japanese input, which is inefficient and inconvenient, and safety when saving files to the hard disk Always had to pay attention to the user himself.
[0005]
As a method for solving such a problem, there is a shared computer utilization method described in Patent Document 1. With this shared computer usage method, when a user uses a dedicated terminal, it becomes possible to continue using the environment that he had previously used with another dedicated terminal, and dedicated terminals are installed at multiple locations. Even in the case where the installation location is different, it is possible to continue using the environment that was previously used by another dedicated terminal.
[0006]
In other words, in the shared computer usage method described in Patent Document 1, a personal information terminal such as a personal computer that backs up the usage environment is separate from a dedicated terminal that restores the usage environment, and is installed in different locations. Even if it is, it is possible to restore the previous use environment without any inconvenience.
[0007]
By the way, when restoring the usage environment of an information terminal to a dedicated terminal used by an unspecified number of users, the dedicated terminal is used in the same manner as its own information terminal. Needs to be restored safely, that is, it is necessary to perform authentication to permit the dedicated terminal to access its own information terminal.
[0008]
For this reason, after inputting the user's password or ID into the dedicated terminal, or after inserting the IC card into the card reader / writer of the dedicated terminal and reading the user ID stored in the IC card with the card / reader, Authenticates by comparing the password or user ID entered from the dedicated terminal with the password or user ID registered in the authentication server, and if authenticated, gives permission to access the dedicated terminal to its own information terminal. By distributing the environment of the information terminal to the dedicated terminal, the use environment can be safely restored for the dedicated terminal.
[0009]
However, when the password or ID is input to the dedicated terminal in this way, the password or ID may be forgotten. On the other hand, when the IC card is used, the IC card may be stolen. The terminal cannot be used safely and reliably.
[0010]
As a method for solving such a problem, for example, there is a communication method using a password shown in Patent Document 2. In Patent Document 2, the personal password and address of a user who can use the information system are registered in the server, and when the user requests a one-time password from the server using the personal password on the dedicated mobile terminal, the server is dedicated After confirming that the access is using the registered personal password from the mobile terminal, issue a one-time password, then call the dedicated mobile terminal from the server and enter the one-time password on the display screen of the dedicated mobile terminal. By displaying, the dedicated portable terminal uses the one-time password to connect the dedicated terminal to the information system including information.
[0011]
Since the one-time password can be acquired as character information when connecting to the information system, there is no fear that the third-party may know the one-time password. For this reason, if a one-time password is acquired by the technique shown in Patent Document 2 and authentication is performed based on the one-time password, safety when using another personal computer can be ensured.
[0012]
[Patent Document 1]
JP 2001-34580 A
[Patent Document 2]
JP 2002-352102 A
[0013]
[Problems to be solved by the invention]
However, although the one shown in Patent Document 2 acquires a one-time password as character information, such character information is a service contracted in advance by the user (for example, an i-mode (registered trademark) service provided by NTT DoCoMo). Etc.) and was not versatile.
[0014]
SUMMARY OF THE INVENTION An object of the present invention is to provide a communication method and an authentication device that can authenticate easily and securely when a dedicated terminal is used as a self-terminal and connect the dedicated terminal to an information terminal.
[0015]
[Means for Solving the Problems]
A communication system to which the communication method of the present invention is applied includes an authentication device in which mobile phone information of a mobile phone is registered, and a dedicated terminal connected to the authentication device via a data line network. The authentication device compares the mobile phone information (originating ID) transmitted from the mobile phone with the mobile phone information registered in the authentication device, and generates a one-time password based on a random value when the two match. Then, the one-time password is transmitted to the mobile phone by an audio signal. The dedicated terminal has a microphone for inputting an audio signal. When the audio signal is input to the microphone, the dedicated terminal transmits a one-time password and dedicated terminal information of the dedicated terminal to the authentication device. When the authentication device compares the one-time password transmitted from the dedicated terminal with the one-time password notified to the mobile phone, and the two match, the authentication device designates the dedicated terminal corresponding to the dedicated terminal information via the data circuit network as predetermined information. Connect to the terminal.
[0016]
In that case, a one-time password consisting of a voice signal is obtained using a mobile phone that is always carried around, the voice signal is transmitted from the mobile phone to a dedicated terminal, and the dedicated terminal is connected to a predetermined information terminal via a data line network. Therefore, it is not necessary to obtain a one-time password by contracting with a specific service such as i-mode, and versatility can be provided when obtaining a one-time password. As a result, when the dedicated terminal is used as its own terminal, authentication can be performed easily and safely, and the dedicated terminal can be connected to the information terminal. In addition, since the one-time password is not fixed, it is possible to reliably prevent the one-time password from being leaked to a third party.
[0017]
In the embodiment of the present invention, the predetermined information terminal connected to the dedicated terminal has a server that encrypts and stores at least the user's personal computer environment, and the information terminal decrypts the personal computer environment stored in the server. .
[0018]
In that case, it is possible to prevent the user's personal computer environment from being leaked to a third party.
[0019]
In another embodiment of the present invention, the dedicated terminal is composed of a vending machine, and the authentication terminal compares the one-time password transmitted from the dedicated terminal with the one-time password notified to the mobile phone and If they match, the sale of the product is permitted to the dedicated terminal corresponding to the dedicated terminal information, and the product information is transmitted to the information terminal.
[0020]
In that case, it is possible to purchase a product from a vending machine without carrying around money, and it is possible to reliably charge by notifying the information terminal of product information (product name, fee).
[0021]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0022]
(First embodiment)
FIG. 1 is a diagram showing a communication system according to a first embodiment to which a communication method of the present invention is applied.
[0023]
First, referring to FIG. 1, this communication system is constructed from a dedicated terminal 1, a CTI device (authentication device) 2, and an information terminal 3, and the mobile phone 4 authenticates the dedicated terminal 1 as a self terminal.
[0024]
The mobile phone 4 is connected to the CTI device 2 from the mobile network 5 via the PSTN (public network) 6, and the CTI device 2 can be connected to the information terminal 3.
[0025]
The dedicated terminal 1 is connected to a broadband gateway (hereinafter simply referred to as BBGW) 9 via the Internet network (data communication network) 8, and the BBGW 9 is connected to the information terminal 3.
[0026]
As shown in FIG. 2A, the CTI device 2 includes a memory 21, an authentication unit 22, a one-time password generation unit 23, and a PB signal conversion unit 24, and is connected to the mobile network 5 via the PSTN 6. When connected to the information terminal 3 and the CTI device 2 is notified of the calling ID (phone number (mobile phone information) of the mobile phone 4) from the mobile phone 4, the CTI device 2 stores the calling ID in the memory 21. ing.
[0027]
The information terminal 3 includes, for example, a user PC 10 and a user PC server (server) 11 installed in the user's company, and the user PC server 11 includes information on the environment and file information of the user PC that owns the mobile phone 4. The user PC environment 11a and the user PC environment PC environment of other user PCs are stored. That is, the information terminal 3 constructs a shared PC system, and exchanges data with the dedicated terminal 1 via the Internet network 8.
[0028]
On the other hand, when the calling ID is transmitted by the PB signal from the mobile phone 4 through the mobile network 5 and the PSTN 6, the CTI device 2 compares the calling ID with the calling ID registered in the memory 21 by the authentication unit 22. If they match, the one-time password generation unit 23 generates a one-time password using a random number, converts the one-time password into a PB signal by the PB signal conversion unit 24, and transmits the PB signal to the mobile phone 4. The PB signal is composed of a combination of PB sounds such as “12453” and is repeatedly transmitted while the mobile network 5 is connected to the mobile phone 4. Note that the voice signal is not limited to the PB signal, but may be a modem signal or voice guidance.
[0029]
As shown in FIG. 2B, the dedicated terminal 1 includes a personal computer, a microphone 31, a liquid crystal display screen 32, a keyboard 33, a control unit 34 for executing control as a personal computer, a hard disk 35, and the Internet. A communication control unit 36 is connected to the network 8 and executes a predetermined communication protocol. A PB signal from the mobile phone 4 is input to the dedicated terminal 1 from the microphone 31. When the control unit 34 detects that the PB signal has been normally input from the microphone 31, the control unit 34 displays the message “Password is normally input” on the liquid crystal display screen 32 to notify the user. Note that this notification may be performed by outputting a voice saying that the password has been input normally from a speaker (not shown). When the one-time password is normally input, the control unit 34 transmits the terminal ID stored in the hard disk 35 and the input one-time password to the CTI device 2 via the Internet network 8. .
[0030]
The CTI device 2 compares the one-time password input from the dedicated terminal 1 by the authentication unit 22 with the one-time password generated by the one-time password generation unit 23, and when they match, the terminal ID (IP address or the like) ) To search for the corresponding dedicated terminal 1 on the Internet network 8 and connect the user PC 10 to the dedicated terminal 1 via the Internet network 8.
[0031]
The user PC 10 identifies the dedicated terminal 1 based on the calling ID, downloads the user PC environment 11 a corresponding to the calling ID of the user PC server 11, and transfers the screen image of the personal computer 10 to the dedicated terminal 1 via the Internet network 8. It is supposed to be delivered. Further, the keyboard and mouse information of the dedicated terminal 1 is transmitted to the user PC 10. That is, the dedicated terminal 1 has a function of remote screen control software.
[0032]
The dedicated terminal 1 creates, updates, and deletes files with the user PC 10 via the Internet network 8. When the use of the dedicated terminal 1 is terminated, the user PC 10 stores the file information and the user environment in the user PC environment 11a.
[0033]
The user PC 10 is provided with an encryption / decryption unit, and when the user PC environment 11a is uploaded to the user PC server 11, it is encrypted with a key and stored in the user PC server 11 or encrypted from the user PC server 11. The distributed user PC environment 11a may be decrypted by the user PC 10.
[0034]
Further, as shown in FIG. 3, the dedicated terminal 1 itself may have the function of the user PC 10.
[0035]
Next, the communication method of this embodiment will be described based on the sequence diagram of FIG.
[0036]
First, a call is made from the mobile phone 4 to the CTI device 2, and the calling ID, which is the phone number of the mobile phone 4, is registered in the registration means of the CTI device 2 (step 101). Next, when the user receives the screen image of the user PC 10 at the dedicated terminal 1 installed in an Internet cafe, a rental office, or the like, the CTI device 2 is transmitted from the mobile phone 4 owned by the user via the mobile network 5 and the PSTN 6. Make a call.
[0037]
When an incoming call is received from the mobile phone 4, the CTI device 2 compares the calling ID with the calling ID stored in the memory 21 by the authentication unit 22. If the two match, the one-time password generating unit 23 generates a one-time password. The one-time password is generated based on the random number value, converted into a PB signal by the PB signal conversion unit 24, and notified to the mobile phone 4 (step 103).
[0038]
The user inputs the one-time password output from the mobile phone 4 to the microphone 31 of the dedicated terminal 1 (step 104). At this time, since the CTI device 2 repeatedly transmits the PB signal, when the BP signal is normally input to the dedicated terminal 1, a message “Password is normally input” is displayed on the liquid crystal display screen 32. (Step 105) When the user sees this display, the user goes off-hook the cellular phone 4.
[0039]
When the one-time password is normally input to the microphone 31 of the dedicated terminal 1, the one-time password is temporarily stored in the control unit 34 and the terminal ID (IP address or the like) stored in the hard disk 35 is read out. The terminal ID and the temporarily stored one-time password are transmitted to the CTI apparatus 2 via the Internet network 8 (step 106).
[0040]
The CTI device 2 compares the one-time password input from the dedicated terminal 1 by the authentication unit 22 with the one-time password generated by the one-time password generation unit 23, and when they match, the terminal ID (IP address or the like) ) To search for the corresponding dedicated terminal 1 on the Internet network 8 and transmit the connection permission signal and the terminal ID to the user PC 10 and transmit the connection permission signal to the dedicated terminal 1 corresponding to the terminal ID ( Step 108), the user PC 10 is connected to the dedicated terminal 1 via the Internet 8 (Step 109).
[0041]
The user PC 10 identifies the dedicated terminal 1 by the terminal ID, reads the user PC environment 11a corresponding to the calling ID of the user PC server 11, and distributes the screen image to the dedicated terminal 1 via the Internet network 8 (step 110). . At this time, since the keyboard and mouse information of the dedicated terminal 1 is transmitted to the user PC 10, the dedicated terminal 1 creates, updates, and deletes a file with the user PC 10 via the Internet network 8 (step 111). When the use of the dedicated terminal 1 is terminated, the user PC 10 stores the file information and the user environment in the user PC environment 11a.
[0042]
As described above, in the present embodiment, a one-time password composed of a BP signal is obtained using the mobile phone 4 that is always carried, and the PB signal is input from the mobile phone 4 to the microphone 31 of the dedicated terminal 1 and then the dedicated terminal. When the terminal ID and the one-time password are transmitted from 1 to the CTI device 2 and user authentication is performed by the CTI device 2, the dedicated terminal 1 is connected to the information terminal 3 via the Internet network 8, so that the i-mode or the like is specified. This makes it unnecessary to acquire a one-time password by contracting with the service, and can provide versatility when acquiring a one-time password. As a result, when the dedicated terminal 1 is used as a self terminal, authentication can be performed easily and safely, and the dedicated terminal 1 can be connected to the information terminal 3.
[0043]
In addition, the PTI signal is repeatedly transmitted from the CTI device 2 to the mobile phone 4, and when the PB signal is normally input to the microphone 31 of the dedicated terminal 1, the liquid crystal display screen 32 notifies the PTI signal. In addition to being able to input to the dedicated terminal 1 reliably, the user can know that the PB signal has been normally input to the dedicated terminal 1, and after entering the PB signal, the mobile phone 4 is off-hooked and the call charge is charged. It can be prevented from becoming bulky.
[0044]
In addition, since the CTI device 2 generates the one-time password based on the random value every time it receives the mobile terminal information from the mobile phone 4, it prevents the one-time password from being fixed. It is possible to reliably prevent leakage to the three parties.
[0045]
If the user PC environment 11a is encrypted and decrypted, and uploaded and downloaded to the personal computer PC 10, it is possible to prevent the user's personal computer environment 11a from being leaked to a third party.
[0046]
(Second Embodiment)
FIG. 5 is a diagram showing a configuration of a communication system according to the second embodiment. In the present embodiment, the same components as those in the first embodiment are denoted by the same reference numerals and description thereof is omitted.
[0047]
In the present embodiment, as shown in FIG. 5, the information terminal 41 is a terminal that distributes video content, and the information terminal 41 and the video distribution server 42 and a plurality of videos, for example, videos such as movies, promotional videos, and television programs. A video content server 43 for storing content, and the video distribution server 42 selects an arbitrary video from the video content server 43 in response to a request from the dedicated terminal 1 and distributes it to the dedicated terminal 1. Yes. Regarding the communication sequence, only the screen image distribution process is changed to the video distribution process, and the other sequences are the same as those in the first embodiment, and thus the description thereof is omitted.
[0048]
In the present embodiment, a one-time password consisting of a BP signal is acquired using a mobile phone 4 that is always carried, the PB signal is input from the mobile phone 4 to the microphone 31 of the dedicated terminal 1, and the CTI device 2 is transmitted from the dedicated terminal 1. When the terminal ID is transmitted to the user and the user authentication is performed by the CTI device 2, the dedicated terminal 1 is connected to the video distribution server 42 via the Internet network 8, and the keyboard 33 is operated to display the video via the video distribution server 42. Since the desired video stored in the content server 43 can be distributed, it is not necessary to obtain a one-time password by contracting with a specific service such as i-mode, and it is versatile when obtaining a one-time password. Can be made.
[0049]
Note that the information terminal 41 is not a terminal that distributes such video, but may be one that distributes music, or may distribute product information, travel information, or the like. In short, it is only necessary to be able to connect to various information providing terminals existing on the network.
[0050]
(Third embodiment)
FIG. 6 is a diagram showing a configuration of a communication system according to the third exemplary embodiment of the present invention. In the present embodiment, the same components as those in the first embodiment are denoted by the same reference numerals and description thereof is omitted.
[0051]
In this embodiment, as shown in FIGS. 6 and 7, a dedicated terminal is configured by a vending machine (for example, a drinking water vending machine) 51, and an information terminal is a product management terminal 61 that manages the vending machine 51. It is composed.
[0052]
As shown in FIG. 7 (a), the vending machine 51 detects a request for taking out an arbitrary drinking water by a microphone 52, and an actuator 53 for moving the drinking water to an outlet, A control unit 54 that controls the entire vending machine 51, a communication control unit 55 that is connected to the Internet 8 and executes a predetermined communication protocol, a memory 56, and the like are provided.
[0053]
Further, as shown in FIG. 7B, the product management terminal 61 includes a management unit 62 that performs product management, a charging unit 63 that performs charging processing, a user management unit 64 that performs user management, and a communication control unit 65. Etc.
[0054]
Next, the communication method of this embodiment will be described based on the sequence diagram of FIG.
[0055]
First, a call is made from the mobile phone 4 to the CTI device 2, and the calling ID, which is the phone number of the mobile phone 4, is registered in the memory 21 of the CTI device 2 (step 201). Next, when the user uses the vending machine 51, the CTI device 2 is called from the mobile phone 4 owned by the user via the mobile network 5 and the PSTN 6 (step 202).
[0056]
When the CTI device 2 receives an incoming call from the mobile phone 4, the authentication unit 22 compares the caller ID with the caller ID stored in the memory 21. Is generated based on the random number value, and the one-time password is converted by the PB signal converter 24 and notified to the mobile phone 4 (step 203).
[0057]
The user inputs the one-time password output from the mobile phone 4 to the microphone 52 of the vending machine 51 (step 204). At this time, since the CTI device 2 repeatedly transmits the PB signal, when the BP signal is normally input to the microphone 52 of the vending machine 51, a voice saying “Password is normally input” is output by a speaker (not shown). Since the notification is performed, the user goes off-hook the mobile phone 4 after recognizing the voice notification.
[0058]
When the one-time password is normally input to the microphone 52 of the vending machine 51, the one-time password is temporarily stored in the control unit 54 and the terminal ID (IP address or the like) stored in the memory 56 is read out. The terminal ID and the temporarily stored one-time password are transmitted to the CTI device 2 via the Internet network 8 (step 206).
[0059]
The CTI device 2 compares the one-time password input from the vending machine 51 by the authentication unit 22 with the one-time password generated by the one-time password generation unit 23, and when they match, the terminal ID (IP address) And the like, and a connection permission signal is transmitted from the authentication unit 22 to the corresponding vending machine 51 and the product management terminal 61 (step 207). After transmitting the terminal ID of the vending machine 51 and the connection permission signal to the merchandise management terminal 61 (step 208), the vending machine 51 is connected to the merchandise management terminal 61 via the Internet network 8. Next, a sale permission signal is transmitted from the merchandise management terminal 61 to the vending machine 51 (step 209).
[0060]
When a predetermined product is purchased from the vending machine 51 by the user, the control unit 54 of the vending machine 51 transmits product information (product name, fee) to the product management terminal 61 (step 210). The merchandise management terminal 61 searches the merchandise information transmitted from the vending machine 51 from the merchandise information stored in the management section 62, and charges the merchandise by the charging section 63. Next, by assigning billing information to the calling ID transmitted from the CTI device 2 by the user management unit 64, the purchase price of the product of the mobile phone 4 is managed and an invoice is issued.
[0061]
As described above, in the present embodiment, a one-time password consisting of a BP signal is acquired using the mobile phone 4 that is always carried around, and the PB signal is input from the mobile phone 4 to the microphone 52 of the vending machine 51 to automatically When the terminal ID and the one-time password are transmitted from the vending machine 51 to the CTI device 2 and the user authentication is performed by the CTI device 2, the vending machine 51 is connected to the product management terminal 61 via the Internet network 8. It is not necessary to obtain a one-time password by contracting with a specific service such as a mode, and versatility can be obtained when obtaining a one-time password. In addition to this, it is possible to purchase a product from the vending machine 51 without carrying money, and to notify the product management terminal 61 of the product information, so that charging can be performed reliably.
[0062]
【The invention's effect】
As described above, according to the present invention, there is provided a communication system and a communication method capable of easily and safely authenticating when a dedicated terminal is used as a self terminal and connecting the dedicated terminal to the information terminal. be able to.
[Brief description of the drawings]
FIG. 1 is a configuration diagram of a communication system according to a first embodiment to which the present invention is applied.
2 is a configuration diagram of a CTI device 2 and a dedicated terminal 1 in FIG.
FIG. 3 is a configuration diagram of a communication system according to a modification of the first embodiment.
FIG. 4 is a sequence diagram illustrating an operation of the communication system according to the first embodiment.
FIG. 5 is a configuration diagram of a communication system according to a second embodiment to which the present invention is applied.
FIG. 6 is a configuration diagram of a communication system according to a third embodiment to which the present invention is applied.
7 is a configuration diagram of the dedicated terminal 1 and the merchandise management terminal 61 in FIG. 6. FIG.
FIG. 8 is a sequence diagram illustrating an operation of the communication system according to the third embodiment.
[Explanation of symbols]
1 Dedicated terminal
2 CTI equipment
3 Information terminals
4 Mobile phones
5 Cellular network
6 PSTN
8 Internet network
9 BBGW
10 User PC
11 User PC server
11a User PC environment
21 memory
22 Authentication Department
23 One-time password generator
24 PB signal converter
31 microphone
32 LCD display screen
33 keyboard
34 Control unit
35 hard disk
36 Communication control unit
41 Information terminal
42 Video distribution server
43 Video content server
51 vending machines
52 microphone
53 Actuator
54 Control unit
55 Communication control unit
56 memory
61 Product management terminal
62 Management Department
63 Billing Department
64 User Management Department
65 Communication control unit
101-111, 201-210 steps

Claims (4)

If the mobile phone information of the mobile phone is registered and the mobile phone information transmitted from the mobile phone is compared with the mobile phone information registered in the authentication device. After generating the password, send the one-time password to the mobile phone by voice signal,
Then, the mobile phone audio signal of one-time password received by the voice output, when the audio output is input to the microphone of the dedicated terminal, the dedicated terminal is the one-time password and the dedicated terminal to the authentication device Send dedicated device information for
When the authentication device compares the one-time password transmitted from the dedicated terminal with the one-time password notified to the mobile phone, and the two match, the dedicated terminal is added to the information terminal of the user specified by the mobile phone information communication method characterized by sending information to connect the dedicated terminal corresponding to the dedicated terminal information via the data network to the information terminal of the user.   The predetermined information terminal connected to the dedicated terminal includes a server that encrypts and stores at least a user's personal computer environment, and the information terminal decrypts the personal computer environment stored in the server. Communication method.   The dedicated terminal is composed of a vending machine, and the authentication device compares the one-time password transmitted from the dedicated terminal with the one-time password notified to the mobile phone, and if both match, the dedicated terminal The communication method according to claim 1, wherein the dedicated terminal corresponding to the information is allowed to sell the product and the product information is transmitted to the information terminal. A memory for storing mobile phone information notified from the mobile phone;
A one-time password generator,
When an incoming call is received from a mobile phone, the mobile phone information of the mobile phone is compared with the mobile phone information stored in the memory, and if the two match, a one-time password is generated by the one-time password generator. , the one-time password and notifies to the mobile phone by voice signals, receives the one-time password and the terminal ID information from the dedicated terminal, the one-time password compared with the generated one-time password, a matching, portable An authentication apparatus comprising: an authentication unit that transmits the terminal ID information to a user information terminal specified by telephone information and connects a dedicated terminal corresponding to the terminal ID information to the user information terminal via a data line network.

Images