JP4302732B2 - Login authentication system for network cameras - Google Patents

Description

  The present invention relates to a login authentication system when logging into a network camera.

  A network camera (hereinafter referred to as a network camera) connected to a computer network such as the Internet can view images captured by the network camera on a computer terminal or the like via a network while being away from the network camera. It is a very useful system and is used in various fields.

  Since such a network camera is connected to the network, security measures are provided to prevent unauthorized viewing by a third party. Generally, an ID preset by the network camera is provided. The password is entered from a computer terminal, and the images cannot be viewed unless they match. A conceptual diagram of log-in authentication to a conventional network camera is shown in FIG. Patent Document 1 discloses a conventional login to a network camera.

  In recent years, network cameras have shown signs of widespread use due to their convenience. For example, when monitoring is performed by a network camera, it is necessary to view images from a plurality of network cameras at the same time. Must log in to multiple network cameras. In particular, in the method as shown in Patent Document 1, since IDs and passwords must be input to all network cameras that are desired to be browsed, it is necessary to log in to a large number of network cameras. However, the burden on the login is very large.

  In a technical field other than logging in to a network camera in order to reduce such a burden of login, for example, in a technical field in which a computer terminal logs in to a plurality of systems, the following Patent Documents 2 to 4 and Non-Patent Document 1 A technique called single sign-on is used.

JP 2004-104671 A JP 2004-70757 A JP 2002-271367 A Japanese Patent Laid-Open No. 2005-5777 Hayashi Shigeno, “User Authentication Model in a System Combining WWW and Distributed Objects”, Proc. Of the 57th Annual Conference of Information Processing Society of Japan, 3rd volume, Information Processing Society of Japan, October 5, 1998, p . 505-506

  Conventional single sign-on is used in personal computers that can communicate with the outside of a computer terminal via a network and can also write data to the memory from outside, as described in the above-mentioned patent document. It is assumed that Therefore, when data cannot be written to the memory from the outside, the conventional single sign-on cannot be used.

  The network camera can transmit the captured image data to an external computer terminal, and can store and save it. However, due to the characteristics of the product, the data is stored in the memory according to the original standard of the manufacturer that manufactures the network camera, and the network is excluded except for authentication by ID and password to the network camera. No data is received from the outside of the camera and stored or stored in the memory of the network camera. This is because network cameras are often used for security, remote monitoring, etc., and considering the security, it is considered that one of the factors is to avoid cracking.

  That is, when a network camera can write data into its memory from outside via a network like a personal computer, the network camera itself is cracked by a malicious third party, and the necessary security and remote monitoring functions are provided. The fact that the possibility of being unable to be fulfilled cannot be denied is considered to be one factor of the inability to write to the memory from the outside.

  In addition, as described above, network cameras store data in the memory according to each manufacturer's own standard, so even if data can be transmitted from the outside, it is not clear where in the memory the data will be stored. However, the processing using the data cannot be substantially functioned.

  In view of the special circumstances of the network camera as described above, single sign-on for the network camera is not performed or assumed at present. Therefore, for monitoring by a network camera, even if there is a significant burden in logging in to a plurality of network cameras, it cannot be solved.

  Therefore, the present inventor has invented the login authentication system for the network camera of the present invention in order to solve such a problem. That is, since the conventional network camera could not write to the memory from the outside via the network, the network camera has a processing function for receiving the session ID generated by a predetermined authentication server and storing it in the memory in advance. In addition, for this network camera, the authentication server generates and transmits a session ID to the network camera, and the authentication server further transmits the session ID to the user, thereby enabling easy login to the network camera. .

  As a result, even with network cameras from different manufacturers, the session ID can be received and stored on a common platform, so even if each manufacturer stores data in its own memory, the authentication server Processing can be executed without being caught by it.

  In such a network camera, not any data is received from the outside, but data (including instructions) related to the session ID is received only from a predetermined authentication server. As a result, it is possible to prevent the security of the network camera from being unnecessarily lowered.

  A first invention is a network camera login authentication system for logging in from a user terminal used by a user to a network camera having a function of receiving and storing a session ID from an authentication server, wherein the authentication server Generates a session ID for the user terminal to access the network camera, transmits the session ID to the network camera, and sends the session ID and the IP address of the network camera to the user terminal. The network camera stores the session ID received from the authentication server, collates the session ID received from the user terminal with the stored session ID, and if they match, the captured image is To the user terminal via That is a login authentication system to the network camera.

  Conventional network cameras could not write to the memory from outside via the network. However, as in the present invention, a processing function for receiving a session ID generated by a predetermined authentication server and storing the session ID in a memory thereof is provided in advance in the network camera. The session ID is generated and transmitted, and the authentication server further transmits the session ID to the user, thereby enabling easy login to the network camera.

  The above-described invention can also be configured as follows. That is, a login authentication system for a network camera for logging in from a user terminal used by a user to a network camera having a function of receiving and storing a session ID from an authentication server, wherein the authentication server includes the user User information storage means for storing at least an ID as to whether or not to permit access from a terminal, a password, and an identifier of a network camera that can be browsed with the ID, an identifier of the network camera, an IP address, an ID, and a password A camera authentication information storage means for storing at least, an ID and a password received from the user terminal, a login request receiving means for checking the ID and password stored in the user information storage means, and a session for generating the session ID ID generating means and the user terminal The network camera identifier that can be browsed by the ID received from is extracted from the user information storage means, and the IP address, ID, and password of the network camera are extracted from the camera authentication information storage means based on the extracted network camera identifier. Camera-side session ID transmission means for extracting and accessing the network camera having the IP address with the ID and password, and transmitting and storing the generated session ID when logging in to the network camera; The identifier of the network camera that can be browsed by the ID received from the user terminal is extracted from the user information storage means, and the IP address of the network camera is extracted from the camera authentication information storage means based on the extracted identifier of the network camera. And a user-side session ID transmission means for transmitting the generated session ID and the extracted IP address to the user terminal, and the network camera uses the network camera ID and password. The ID / password storage means to be stored and the network camera ID and password are received from the authentication server, and the ID and password stored in the ID / password storage means are collated. Login confirmation means for permitting access; session ID reception means for receiving the session ID received from the authentication server and storing the session ID in the session ID storage means; session ID received from the user terminal; and session ID storage means Match the stored session ID and match In some cases, the log-in authentication system for a network camera includes session ID verification means for permitting the user terminal to transmit an image captured by the network camera.

  For example, when processing such as changing the imaging direction of the network camera or changing the magnification is performed, it is necessary to transmit an instruction from the user terminal to the network camera so that the CGI that performs the processing is started by the network camera. There is also a network camera. In the case of such a network camera, a session ID is required for each CGI that realizes the function. Therefore, it is required to have a system configuration that does not increase the session ID as much as possible.

  In such a case, the system can be configured as follows. That is, a login authentication system for a network camera for logging in from a user terminal used by a user to a network camera having a function of receiving and storing a session ID from an authentication server, wherein the authentication server includes the user A terminal generates a session ID for accessing the network camera, transmits the session ID to the network camera, and transmits the session ID and the IP address of the network camera to the user terminal, The network camera stores the session ID received from the authentication server, collates the session ID received from the user terminal with the stored session ID, and if they match, the session ID is sent to the user terminal. Session ID file including A session ID included in the session ID file and an instruction to execute a function executed by the network camera from the user terminal, and a session ID of the session ID file and the stored session The network camera login authentication system executes a function based on an execution instruction from the user terminal when the ID matches.

  The above-described invention can also be configured as follows. That is, a login authentication system for a network camera for logging in from a user terminal used by a user to a network camera having a function of receiving and storing a session ID from an authentication server, wherein the authentication server includes the user User information storage means for storing at least an ID as to whether or not to permit access from a terminal, a password, and an identifier of a network camera that can be browsed with the ID, an identifier of the network camera, an IP address, an ID, and a password A camera authentication information storage means for storing at least, an ID and a password received from the user terminal, a login request receiving means for checking the ID and password stored in the user information storage means, and a session for generating the session ID ID generating means and the user terminal The network camera identifier that can be browsed by the ID received from is extracted from the user information storage means, and the IP address, ID, and password of the network camera are extracted from the camera authentication information storage means based on the extracted network camera identifier. Camera-side session ID transmission means for extracting and accessing the network camera having the IP address with the ID and password, and transmitting and storing the generated session ID when logging in to the network camera; The identifier of the network camera that can be browsed by the ID received from the user terminal is extracted from the user information storage means, and the IP address of the network camera is extracted from the camera authentication information storage means based on the extracted identifier of the network camera. And a user-side session ID transmission means for transmitting the generated session ID and the extracted IP address to the user terminal, and the network camera uses the network camera ID and password. The ID / password storage means to be stored and the network camera ID and password are received from the authentication server, and the ID and password stored in the ID / password storage means are collated. Login confirmation means for permitting access; session ID reception means for receiving the session ID received from the authentication server and storing the session ID in the session ID storage means; session ID received from the user terminal; and session ID storage means Match the stored session ID and match In this case, a session ID verification unit that transmits a request for generating a session ID file including the session ID to the user terminal, a session ID included in the session ID file, and an execution instruction for a function executed by the network camera When the session ID of the session ID file matches the stored session ID, an execution function determination unit that issues a permission to execute a function according to an execution instruction from the user terminal; , Having a login authentication system for a network camera.

  In this way, when the session ID is written in the session ID file and any instruction is transmitted to the network camera, the session ID is used from the user terminal to the network camera by using the session ID. Even in the case of access, the user can use the network camera in the same manner as the access to the conventional network camera without any awareness.

  The following configurations may be added to the above-described inventions. That is, when the authentication server receives access to the authentication server from the user terminal, after the authentication with the ID and password is completed, the one-time password is generated and registered in advance to the user's e-mail address. A network that transmits and accepts the input of the one-time password from the user terminal, compares the generated one-time password and the received one-time password, and generates the session ID if they match This is a login authentication system for a camera.

  In addition to each of the above-described inventions, the network camera stores in advance an authentication server that transmits the session ID to the network camera, and does not accept access from other than the previously stored authentication server. It can also be a login authentication system.

  With such a configuration, the security of the login authentication system for the network camera can be improved.

  According to the present invention, it is possible to realize single sign-on to a network camera, which cannot be realized by conventional single sign-on. In particular, such a single sign-on can be realized by providing the network camera with a function of receiving a session ID from a specific authentication server and storing it in a storage device such as a memory. Even if data can be written to the storage device such as the memory of the network camera from the outside, it is possible to prevent the security from being accidentally lowered by limiting the writable authentication servers.

  Since such single sign-on can be used for a network camera, even when a user views images of a plurality of network cameras, the authentication server ID and password can be used without logging in to each network camera. You can log in to and browse images from each network camera. In addition, since a third party who tries to gain unauthorized access to the network camera does not know the session ID generated by the authentication server, the network camera cannot be accessed and the network camera ID and password must be entered. The same security as before is also ensured.

  In addition, when logging in to the authentication server from the user terminal, in addition to authentication by ID and password, a one-time password is sent to the user's e-mail address registered in advance in the authentication server, and the one-time password is input Therefore, even if a third party illegally acquires an ID and a password, the one-time password cannot be acquired. Therefore, only the user registered in advance with the authentication server can access the network camera, and the security can be further enhanced.

FIG. 1 is a system configuration diagram showing an example of a system configuration of the present invention.
FIG. 2 is a flowchart showing an example of a processing process of the present invention.
FIG. 3 is a flowchart showing an example of a processing process of the present invention.
FIG. 4 is a diagram showing the concept of conventional login authentication to a network camera.
FIG. 5 is a diagram showing a concept of login authentication to a network camera of the present invention.
[FIG. 6] An example of a screen for inputting an ID and a password for logging in to the authentication server.
FIG. 7 is an example of error notification.
FIG. 8 is an example of a conceptual diagram of user information storage means.
FIG. 9 is an example of a conceptual diagram of camera authentication information storage means.
FIG. 10 is an example of a conceptual diagram of camera authentication information storage means when an IP address is updated.
[FIG. 11] An example of an HTML tag transmitted from the authentication server to the user terminal.
[FIG. 12] An example of a network camera ID and password input request screen.
FIG. 13 shows an example of a one-time password input screen.
FIG. 14 is a system configuration diagram showing an example of a system configuration of Example 3.
FIG. 15 is an example of URL parameters transmitted from the authentication server to the network camera.
FIG. 16 is a diagram illustrating an example of a processing process according to the second embodiment.
FIG. 17 is an example of a request for generating a cookie.
FIG. 18 is a diagram schematically showing the process of Example 2.
FIG. 19 is a system configuration diagram showing an example of a system configuration of Embodiment 2.

Explanation of symbols

1: Login authentication system 2: Authentication server 3: Network camera 4: User terminal 5: Login request reception means 6: User information storage means 7: One-time password generation means 8: One-time password transmission means 9: One-time password verification means 10: Camera authentication information storage means 11: Session ID generation means 12: Camera side session ID transmission means 13: User side session ID transmission means 14: Login confirmation means 15: ID / password storage means 16: Session ID reception means 17: Session ID collation means 18: session ID storage means 19: network 20: IP address acquisition means 21: IP address management server 22: execution function determination means

  An example of the system configuration of the network camera login authentication system 1 of the present invention is shown in the system configuration diagram of FIG.

  A network camera login authentication system 1 includes a network camera 3, an authentication server 2, and a user terminal 4.

  The user terminal 4 is a computer terminal used by a user who wishes to view an image captured by the network camera 3, and uses the session ID received from the authentication server 2 and the IP address of the network camera 3 to connect to the network camera 3. A computer terminal for logging in. Note that the description of “IP address” in this specification may be identification information in the network 19 and is not limited to being expressed in numbers, but may be characters or numbers such as a domain name (URL). This includes everything by symbols and symbols. The “session ID” may be anything as long as it is information for identifying the session.

  The authentication server 2 has a function of generating a session ID, transmitting it to the network camera 3, and transmitting the generated session ID and camera authentication information (described later) to the user terminal 4. Yes. Here, any session ID may be used, but the authentication server 2 may generate a random number (including not only numbers but also alphanumeric characters and symbols) and use it as the session ID.

  The authentication server 2 includes a login request receiving unit 5, a user information storage unit 6, a one-time password generation unit 7, a one-time password transmission unit 8, a one-time password collation unit 9, a camera authentication information storage unit 10, and a session ID generation unit 11. And a camera-side session ID transmission unit 12 and a user-side session ID transmission unit 13.

  The network camera 3 is a network camera 3 that transmits a captured image to the user terminal 4 via the network 19, and receives a session ID from the authentication server 2, and a storage device (preferably an internal storage such as a memory). When the access request is received from the user terminal 4, the session ID is received from the user terminal 4, and the session ID stored in the storage device is verified. If the session IDs match, the user terminal 4 is permitted to transmit the captured image, and the network camera 3 image is transmitted to the user terminal 4. If they do not match, a request for inputting the ID and password of the network camera 3 is transmitted to the user terminal 4. The network camera 3 includes a login confirmation unit 14, an ID / password storage unit 15, a session ID reception unit 16, a session ID storage unit 18, and a session ID verification unit 17. If the session IDs do not match, the network camera 3 sends an access rejection response (error notification) to the user terminal 4 instead of sending an ID and password input request as described above. The processing can be terminated.

  The login request accepting unit 5 of the authentication server 2 is a unit that receives a login request, ID, and password from the user terminal 4 to the authentication server 2 and collates the ID and password stored in the user information storage unit 6. If they match, login is permitted and the process proceeds to one-time password processing.

  If the ID stored in the user information storage unit 6 does not match the password stored in the login request receiving unit 5, an error notification is transmitted to the user terminal 4. An example of error notification in this case is shown in FIG.

  The user information storage means 6 includes an ID indicating whether or not to permit access from the user terminal 4 to the authentication server 2, a password, an identifier of the network camera 3 accessible by the ID, an e-mail address of the ID (user), and A means for storing a one-time password issued to a user. FIG. 8 shows a conceptual diagram of the user information storage means 6.

  The one-time password generating unit 7 generates a one-time password for the ID (user) and stores it in the user information storage unit 6 when the login request accepting unit 5 matches the authentication by the ID and the password. It is. The one-time password is a temporary password that is changed every time it is accessed, and is composed of letters, numbers, symbols, and the like.

  The one-time password transmission means 8 sends an e-mail via the network 19 to the e-mail address of the ID (user) stored in the user information storage means 6 with the one-time password generated by the one-time password generation means 7. It is a means to transmit by.

  The one-time password verification means 9 is a means for verifying the one-time password received from the user terminal 4 and the one-time password stored in the user information storage means 6. If they match, a session ID generation request is passed to the session ID generation means 11. If they do not match, a message that prompts the user to input and transmit the one-time password again is transmitted to the user terminal 4.

  The camera authentication information storage means 10 is a means for storing the identifier of the network camera 3, its IP address, the ID of the network camera 3, and the password. FIG. 9 shows a conceptual diagram of the camera authentication information storage means 10.

  The session ID generation unit 11 is a unit that generates a session ID when receiving a session ID generation request from the one-time password generation unit 7. Any session ID may be used, but the authentication server 2 may generate a random number (including not only numbers but also uppercase alphanumeric characters, lowercase alphanumeric characters, symbols, etc.) and use it as the session ID. In particular, the session ID is preferably unique.

  The camera-side session ID transmission unit 12 extracts the network camera 3 accessible by the ID from the user information storage unit 6, and further stores the IP address, ID and password of the (their) network camera 3 in the camera authentication information storage. Extract from means 10. The network camera 3 having the IP address is accessed, logged in with an ID and a password, and the session ID generated by the session ID generating unit 11 is transmitted to the network camera 3. An example of a URL parameter when the camera-side session ID transmission unit 12 transmits a session ID to the network camera 3 is shown in FIG. Here, the part indicated by “viewer: password” is a user account of the network camera that can access the URL on the right, and the part indicated by “cgi-bin / live.cgi” is accessed by the generated session ID. This is a permitted path. If this path is CGI for transmitting an image captured by the network camera 3 to the user terminal 4, the network camera 3 can see the image.

  The login to the network camera 3 by ID and password for transmitting the session ID can be processed by the servlet, and after logging in (or at the time of login), the session ID is transmitted to the network camera 3. To do. Further, when the transmitted session ID is normally received and stored by the network camera 3, the camera-side session ID transmission unit 12 receives a notification of “OK” from the network camera 3.

  When the user-side session ID transmission unit 13 receives the “OK” notification from the network camera 3 by the camera-side session ID transmission unit 12, the user-side session ID transmission unit 13 extracts the network camera 3 accessible by the ID (user) from the user information storage unit 6. Then, the IP address of the network camera 3 is extracted from the camera authentication information storage means 10. The IP address of the network camera 3 that can be accessed with the ID and the session ID generated by the session ID generating unit 11 are transmitted to the user terminal 4. For example, by transmitting an HTML tag including a session ID and an IP address to the user terminal 4, the user terminal 4 accesses the network camera 3 using the session ID and the IP address included in the HTML tag, Images can be viewed. FIG. 11 shows an example of an HTML tag. In the case of FIG. 11, the session ID is “123” for the network camera 3 that is “http: // xxxxxxxx /”.

  The login confirmation unit 14 of the network camera 3 is a unit that receives the ID and password of the network camera 3 from the authentication server 2 and collates the ID and password stored in the ID / password storage unit 15. At this time, the login confirmation means 14 determines whether or not the authentication server 2 is registered in advance by confirming the IP address of the authentication server 2, and accesses from other than the registered authentication server 2. You may comprise so that it may not be received. This is because the IP address of the authentication server 2 that can be accessed in advance is stored in the storage device of the network camera 3, and when the authentication server 2 accesses the network camera 3, the IP address is stored in the storage device. This can be determined by checking with the IP address of the accessible authentication server 2.

  The session ID receiving unit 16 is a unit that receives the session ID generated by the authentication server 2 and stores it in the session ID storage unit 18. In addition, when the session ID can be normally received and stored, the “OK” notification is transmitted to the authentication server 2.

  The session ID collating unit 17 is a unit that receives the session ID from the user terminal 4 and collates with the session ID stored in the session ID storage unit 18. If the session IDs match, the network camera 3 gives permission to transmit the captured image to the user terminal 4. With this permission, the network camera 3 transmits the captured image to the user terminal 4 via the network 19. If the session IDs do not match, the network camera 3 transmits a request for inputting the ID and password of the network camera 3 to the user terminal 4. This input request screen is shown in FIG.

  The session ID storage means 18 is a predetermined storage area of the storage device (preferably an internal storage device such as a memory) of the network camera 3 and stores the session ID received from the authentication server 2 in the storage area. is there.

  The ID / password storage means 15 is a predetermined storage area of a storage device (preferably an internal storage device such as a memory) of the network camera 3 and stores an ID and a password for accessing the network camera 3. Means. For example, in the example shown in FIG. 9, the ID of the network camera A is “A”, the password is “1”, the ID of the network camera B is “B”, and the password is stored as “2”. Yes.

  The session ID storage means 18 and the ID / password storage means 15 may store each storage area in the same storage device (memory or the like) or may be stored in different storage devices.

  Next, an example of a processing process of the network camera login authentication system 1 will be described with reference to the flowcharts of FIGS. 2 and 3 and the system configuration diagram of FIG.

  A user who wishes to view an image captured by the network camera 3 accesses the authentication server 2 from the user terminal 4 via the network 19 by a predetermined method such as inputting the IP address of the authentication server 2. . When accessed, the login request accepting means 5 of the authentication server 2 transmits an ID / password input screen to the user terminal 4. This input screen is shown in FIG.

  The user terminal 4 transmits the login request to the authentication server 2 by inputting the ID and password from this input screen and pressing the “login” button. The login request receiving means 5 of the authentication server 2 receives a login request, ID, and password for the authentication server 2 from the user terminal 4 (S100). Assume that the ID input by the user is “11111” and the password is “aaaaaa”.

  The login request accepting unit 5 collates whether or not the ID and password received from the user terminal 4 match the ID and password stored in the user information storage unit 6 (S110). In this embodiment, since the ID is “11111” and the password is “aaaaaa”, the ID and the password match. This shifts to one-time password processing.

  If the ID stored in the user information storage unit 6 by the login request receiving unit 5 and the password do not match, an error notification (FIG. 7) is transmitted to the user terminal 4 (S120), and the login request is received again.

  After successful login from the user terminal 4 to the authentication server 2, the one-time password generation unit 7 receives a generation request from the user terminal 4 by a predetermined operation, or the login request reception unit 5 successfully logs in and generates a one-time password generation request. Is received, a one-time password for the ID (user) is generated and stored in the user information storage means 6 (S130). The generated one-time password is transmitted by electronic mail via the network 19 based on the electronic mail address of the ID (user) stored in the user information storage means 6 by the one-time password transmission means 8 (S130).

  The user who has received the one-time password at the user terminal 4 transmits the one-time password to the authentication server 2 by inputting the one-time password from a predetermined input screen (FIG. 13) (S150). The one-time password verification unit 9 that has received this one-time password verifies whether the one-time password matches the one-time password stored in the user information storage unit 6 (S160). If they match, a session ID generation request is passed to the session ID generation means 11. If they do not match, an instruction is sent again to the user terminal 4 to input the one-time password.

  When a session ID generation request is received from the one-time password verification unit 9, the network camera 3 accessible by the ID (user) is extracted from the user information storage unit 6, and the IP address, ID, and password of the network camera 3 are extracted. Is extracted from the camera authentication information storage means 10 (S170). Then, the session ID generation unit 11 generates a session ID (S180). In addition, the session ID generated by the session ID generation unit 11 is transmitted to the network camera 3 accessible by the ID (S190).

  Any session ID may be used, but the authentication server 2 may generate a random number (including not only numbers but also uppercase alphanumeric characters, lowercase alphanumeric characters, symbols, etc.) and use it as the session ID. The session ID may be changed for each network camera 3 that can be accessed with the ID, or may be the same session ID. For example, in the above example, since four network cameras 3 (network camera A, network camera B, network camera C, and network camera D) can be accessed, four session IDs are generated by the session ID generation unit 11 and each network camera is generated. One session ID may be assigned to 3 and transmitted, or one session ID may be generated by the session ID generating unit 11 and the same session ID may be transmitted to the four network cameras 3.

  The network camera 3 that transmits the session ID has information (network camera A, network camera B, network camera C, network camera D) of the network camera 3 that can be accessed by the ID (user) stored in the user information storage unit 6. ) To extract the IP address, ID, and password of each network camera 3 from the camera authentication information storage means 10, thereby accessing the network camera 3 having the IP address and logging in with the ID and password. The session ID is transmitted.

  That is, the camera-side session ID transmission unit 12 receives the IP address “219.101.248.240”, the ID “A”, the password “1”, and the IP address of the network camera B from the camera authentication information storage unit 10. “219.101.248.241”, ID “B” and password “2”, IP address “219.1011.2248.242” of network camera C, ID “C” and password “3”, and network camera D Since the IP address “219.101.248.243”, the ID “D”, and the password “4” are extracted, an authentication server is accessed by accessing based on each IP address and transmitting the ID and password. 2 logs into each network camera 3 and transmits a session ID.

  Upon receiving access from the authentication server 2, the log-in confirmation unit 14 of each network camera 3 receives the ID and password, and collates the ID and password stored in the ID / password storage unit 15. Network camera A has ID “A” and password “1”, network camera B has ID “B” and password “2”, network camera C has ID “C” and password “3”, and network camera D has ID “D”. And password “4” are collated.

  If they match, the session ID receiving means 16 receives the session ID from the authentication server 2 and stores it in the session ID storage means 18 (S200). If they do not match, an error notification is transmitted to the authentication server 2. At this time, an effective time of the session ID may be set and stored in the session ID storage unit 18 together.

  If the session ID is successfully received and stored, the session ID receiving unit 16 transmits a notification of “OK” to the authentication server 2.

  When the session ID transmitted to the network camera 3 is normally received and stored by the network camera 3, the camera-side session ID transmission unit 12 of the authentication server 2 receives a “OK” notification from the network camera 3.

  When the camera side session ID transmission unit 12 receives the “OK” notification from the network camera 3, the user side session ID transmission unit 13 extracts the network camera 3 accessible by the ID (user) from the user information storage unit 6. Then, the IP address of the network camera 3 is extracted from the camera authentication information storage means 10. Then, the user-side session ID transmission unit 13 transmits the session ID generated by the session ID generation unit 11 and the IP address of the network camera 3 accessible by the ID to the user terminal 4 (S210). For example, an HTML tag as shown in FIG. 11 is transmitted to the user terminal 4.

  For example, in the above-described example, when the authentication server 2 receives the “OK” notification from the four network cameras 3 (network camera A, network camera B, network camera C, and network camera D), the user-side session ID transmission unit 13 , Session ID and IP address of these network cameras 3 (network camera A, network camera B, network camera C, network camera D) (IP address “219.1011.2248.240” of network camera A, network camera B IP address “219.101.248.241, IP address“ 219.101.248.242 ”of network camera C, IP address“ 219.101.248.243 ”of network camera D) to user terminal 4 To trust. If the session ID is different for each network camera 3, the IP address of the network camera 3 and the session ID for the network camera 3 may be transmitted in association with each other, and the session ID is common to each network camera 3. Transmits one session ID and each IP address.

  Upon receiving the session ID and the IP address from the authentication server 2, the user terminal 4 accesses the network camera 3 based on the IP address (S220) and transmits the session ID. In the case of the example in FIG. 11, “http: //xxxxxxxx/axis-cgi/session.cgi? Sessoidid = 123” is transmitted.

  In the above example, since the user terminal 4 accesses the four network cameras 3, that is, the network camera A, the network camera B, the network camera C, and the network camera D, the IP of each network camera 3 received from the authentication server 2. Access to address. That is, the IP address “219.101.248.240” of the network camera A, the IP address “219.101.248.241” of the network camera B, the IP address “219.101.248.242” of the network camera C, The IP address “219.101.248.243” of the network camera D is accessed, and the session ID received from the authentication server 2 is transmitted to each network camera 3 via the network 19.

  At this time, if the user terminal 4 receives a different session ID for each network camera 3, the user terminal 4 transmits a session ID corresponding to the network camera 3, and in the case of a common session ID, each network camera 3. For example, the same session ID may be transmitted.

  The session ID collation unit 17 of each network camera 3 receives the session ID from the user terminal 4 and collates with the session ID received from the authentication server 2 stored in the session ID storage unit 18 (S230).

  When the session ID received from the user terminal 4 matches the session ID stored in the session ID storage unit 18, the network camera 3 transmits the captured image to the user terminal 4 via the network 19. (S240).

  If the session IDs do not match, the session ID collating unit 17 transmits a request for inputting the ID and password of the network camera 3 to the user terminal 4 (S250). This input request screen is shown in FIG. If the session IDs do not match in S230, the network camera 3 transmits an access rejection response (error notification) to the user terminal 4 instead of transmitting an ID and password input request as described above. Thus, the processing can be configured to end.

  When this screen is received by the user terminal 4, the user inputs the ID and password of the network camera 3 on the screen and transmits them to the network camera 3. The login confirmation unit 14 of the network camera 3 receives the ID and password, and the login confirmation unit 14 confirms whether the ID and password match the ID and password stored in the ID / password storage unit 15 (S260). If they match, the captured image is transmitted to the user terminal 4 via the network 19 (S240). If they do not match, an ID and password input request screen is transmitted to the user terminal 4 again (S250).

  By taking the system configuration and processing process as described above, it is possible to realize single sign-on to the network camera 3 that could not be realized by conventional single sign-on. In particular, such a single sign-on can be realized by providing the network camera 3 with a function of receiving a session ID from a specific authentication server 2 and storing it in a storage device such as a memory. Even if data can be written to the storage device such as the memory of the network camera 3 from the outside, if the writable authentication server 2 is limited, the security can be prevented from being unnecessarily lowered.

  Since such single sign-on can be used for the network camera 3, even when the user views images of the plurality of network cameras 3, the ID of the authentication server 2 can be set without logging in to each of the network cameras 3. It is possible to log in to the authentication server 2 with a password and browse images of each network camera 3. Further, since a third party who tries to gain unauthorized access to the network camera 3 does not know the session ID generated by the authentication server 2, the third party cannot access the network camera 3 and is required to input the ID and password of the network camera 3. Alternatively, since access is denied, the same security as in the prior art is ensured.

  Furthermore, when logging in to the authentication server 2 from the user terminal 4, in addition to authentication by ID and password, a one-time password is transmitted to the user's e-mail address registered in the authentication server 2 in advance. Since the user is required to input a password, even if a third party illegally acquires an ID and a password, the one-time password cannot be acquired. Therefore, only the user registered in advance in the authentication server 2 can access the network camera 3 and the security can be further enhanced.

  In the first embodiment, for example, when processing such as changing the imaging direction of the network camera 3 or changing the magnification is performed, the network camera 3 is switched from the user terminal 4 so as to activate the CGI that performs the processing. There is also a network camera 3 that needs to send an instruction to. In the case of such a network camera 3, a session ID is required for each CGI that realizes the function.

  Therefore, for example, after logging in to the network camera 3 from the user terminal 4 and viewing the captured image, if it is desired to change the imaging direction of the network camera 3, activate the CGI that changes the imaging direction. The authentication server 2 must generate a session ID to be transmitted to the network camera 3 and the user terminal 4 from the authentication server 2, and the session ID must be transmitted from the user terminal 4 to the network camera 3 again. .

  On the other hand, it is often desirable to change the imaging direction or magnification of the network camera 3 at any time. Then, the authentication server 2 must generate a session ID by the processing from S100 to S230 and transmit the session ID to the network camera 3 and the user terminal 4 as described above, and the processing load is large. . Further, the storage capacity of the network camera 3 is limited, and the session ID cannot be stored indefinitely. For example, when the network camera 3 receives access from 100 user terminals 4 at the same time, the session ID for each user terminal 4 is stored, and the session ID is assigned to the network camera 3 every time the imaging direction or magnification of the network camera 3 is changed. Must be remembered. This also puts pressure on the storage capacity of the network camera 3.

  Therefore, in this embodiment, a case will be described in which the above-described problem is solved by using a cookie in addition to the processing of the first embodiment. An example of the processing process in this case is shown in FIG. The flowchart of FIG. 16 is a processing process following the processing after S190 in FIG. Since the processing from S100 to S260 is the same as that of the first embodiment, the description thereof is omitted.

  In the network camera 3 of the second embodiment, in addition to the functions of the first embodiment, the session ID stored in the session ID storage unit 18 is checked based on the session ID in the cookie received from the user terminal 4. The validity of the session ID is determined. If the session ID is valid, the function instructed by the user terminal 4 (for example, the image captured by the network camera 3 is transmitted to the user terminal 4, the imaging direction of the network camera 3 is moved, the magnification The execution function determining means 22 is provided for giving permission to the network camera 3 to perform various functions such as changing the function. An example of the system configuration in this case is shown in FIG.

  In S230, the session ID is transmitted from the user terminal 4 to the network camera 3 (S220). If the session ID matching means 17 matches the session ID, the user terminal 4 logs in to the network camera 3 (S230). ). After logging in, the session ID matching unit 17 of the network camera 3 transmits a request for generating a cookie to the user terminal 4 (S270). For example, a request as shown in FIG. 17 is set in the HTTP response header and transmitted to the user terminal 4. In FIG. 17, it is a request | requirement which produces | generates cookie containing "123" as session ID.

  The user terminal 4 that has received the request for generating a cookie from the network camera 3 generates a cookie including the session ID in the user terminal 4 (S280). When the user terminal 4 accesses the network camera 3 again using this cookie, the execution function determination unit 22 of the network camera 3 stores the session ID stored in the cookie and the session ID storage unit 18. The validity of the session ID is determined by collating with the ID (S290). If the session ID is valid, the execution function determination unit 22 transmits the function requested from the user terminal 4 to the network camera 3 (for example, the image captured by the network camera 3 is transmitted to the user terminal 4 and the imaging direction of the network camera 3 is set. The network camera 3 is given permission to execute functions such as moving and changing the magnification (S300). As a result, the network camera 3 transmits the captured image to the user terminal 4 or changes its imaging direction and magnification.

  In the processing for performing various execution functions in the network camera 3 thereafter, the network camera 3 is accessed using this cookie, and the network camera 3 receives the instruction of the function executed in the network camera 3 and the session ID included in the cookie. 3 to send. Similarly to the above, the execution function determination means 22 determines the validity of this session ID, and if it is valid, gives the network camera 3 permission to execute the instruction to the network camera 3 received from the user terminal 4, and sends it to the network camera 3. Execute with camera 3.

  For example, when an instruction is first received by the user terminal 4 to receive an image currently captured by the network camera 3, and the user tries to change the imaging direction of the network camera 3 to the right side, the user performs a predetermined operation on the user terminal 4. By performing the operation, an instruction to change the imaging direction of the network camera 3 to the right side is transmitted to the network camera 3. At this time, the user terminal 4 also transmits the session ID included in the cookie. The network camera 3 that has received them determines the validity of the received session ID, and if it is valid, permits the execution of the function of changing the imaging direction of the network camera 3 to the right side and executes the processing ( That is, the imaging direction is changed to the right side).

  Next, when the user wants to further increase the magnification of the network camera 3, the user transmits a command to enlarge the magnification of the network camera 3 to the network camera 3 by performing a predetermined operation on the user terminal 4. At this time, the user terminal 4 also transmits the session ID included in the cookie. The network camera 3 that has received them determines the validity of the received session ID, and if it is valid, the network camera 3 is permitted to execute the function of enlarging the magnification of the network camera 3 and executes the processing (that is, the camera's process). Magnify and change the magnification).

  Such processing is schematically shown in FIG.

  By using the cookie in this way, it is not necessary for the authentication server 2 to generate a session ID each time the process of the network camera 3 is executed, and the session ID described in the cookie may be transmitted to the network camera 3. Accordingly, a plurality of processes of the network camera 3 can be realized only by the session ID used at the time of the first login without providing a session ID for each process. Therefore, it is not necessary to reduce the burden on the authentication server 2 and increase the capacity of the storage device of the network camera 3. A plurality of functions can be realized by the network camera 3 with one session ID.

  In the above description, a case has been described in which the network camera 3 transmits a request for generating a cookie to the user terminal 4 and the user terminal 4 generates the cookie, thereby realizing these processes. However, the present invention is limited to the cookie. It is not something. In other words, any file in which a session ID is written (hereinafter referred to as a “session ID file”) may be used, and the file is not limited to a cookie (of course, the session ID file includes a cookie).

  In the first and second embodiments, the IP address of the network camera 3 is a fixed address, but the IP address of the network camera 3 may be a dynamic IP address. The second embodiment will explain this case. An example of the system configuration in this case is shown in FIG.

  The network camera login authentication system 1 is further provided with an IP address management server 21. The IP address management server 21 stores the IP address of each network camera 3, and the IP address of the network camera 3 is a line. When the IP address is changed due to disconnection or reconnection, the IP address is transmitted to the authentication server 2. The IP address management server 21 may check the IP address of the network camera 3 directly and periodically with respect to the network camera 3 or notify the network camera 3 when the IP address of the network camera 3 is changed. You may receive from.

  The authentication server 2 further includes an IP address acquisition unit 20 in addition to the system configuration of the first or second embodiment. The IP address acquisition unit 20 receives from the IP address management server 21 a notification that the IP address of the network camera 3 has been changed and a new IP address, and updates the IP address of the network camera 3 in the camera authentication information storage unit 10. It is means to do.

  For example, when the IP address of the network camera A is changed from “219.101.248.240” to “219.1011.2248.245”, the IP address management server 21 sends the authentication address of the network camera A to the authentication server 2. A notification that the IP address has been changed and a new IP address “219.101.248.245” are transmitted.

  When the IP address acquisition unit 20 of the authentication server 2 receives the notification that the IP address of the network camera A has been changed and the new IP address “219.101.248.245” from the IP address management server 21, the camera authentication information storage The IP address of the network camera A stored in the means 10 is updated from “219.101.248.240” to “219.101.248.245” and stored. FIG. 10 shows a conceptual diagram of the camera authentication information storage unit 10 when the camera authentication information storage unit 10 of FIG. 9 is updated.

  By configuring as described above, even if the network camera 3 is not a fixed IP address but a dynamic IP address, the authentication server 2 always stores the latest IP address of the network camera 3. Access from the user terminal 4 is possible.

  Each means in the present invention is only logically distinguished in function, and may be physically or practically the same area. Each means of the authentication server 2 and the network camera 3 of the present invention is realized on an arithmetic device such as a CPU, and each storage means is realized on a storage device such as a memory or a hard disk. Various methods such as a database and a data file can be used as a storage method in the storage means.

  According to the present invention, it is possible to realize single sign-on to the network camera 3 that could not be realized by conventional single sign-on. In particular, such a single sign-on can be realized by providing the network camera 3 with a function of receiving a session ID from a specific authentication server 2 and storing it in a storage device such as a memory. Even if data can be written to the storage device such as the memory of the network camera 3 from the outside, it is possible to prevent the security from being unnecessarily lowered by limiting the writable authentication server 2.

  Since such single sign-on can be used for the network camera 3, even when the user views images of the plurality of network cameras 3, the ID of the authentication server 2 can be set without logging in to each of the network cameras 3. It is possible to log in to the authentication server 2 with a password and browse images of each network camera 3. In addition, since a third party who tries to gain unauthorized access to the network camera 3 does not know the session ID generated by the authentication server 2, the third party cannot access the network camera 3 and is required to input the network camera 3 ID and password. Therefore, the same security as the conventional one is secured.

  Furthermore, when logging in to the authentication server 2 from the user terminal 4, in addition to authentication by ID and password, a one-time password is transmitted to the user's e-mail address registered in the authentication server 2 in advance. Since the user is required to input a password, even if a third party illegally acquires an ID and a password, the one-time password cannot be acquired. Therefore, only the user registered in advance in the authentication server 2 can access the network camera 3 and the security can be further enhanced.

Claims (18)

A network camera login authentication system for logging in from a user terminal used by a user to a network camera having a function of receiving and storing a session ID from an authentication server,
The authentication server is
The user terminal generates a session ID for accessing the network camera, transmits the session ID to the network camera, and transmits the session ID and the IP address of the network camera to the user terminal. ,
The network camera
The session ID received from the authentication server is stored, the session ID received from the user terminal is compared with the stored session ID, and if they match, the captured image is transmitted to the user terminal via the network. To
A login authentication system for network cameras. A network camera login authentication system for logging in from a user terminal used by a user to a network camera having a function of receiving and storing a session ID from an authentication server,
The authentication server is
The user terminal generates a session ID for accessing the network camera, transmits the session ID to the network camera, and transmits the session ID and the IP address of the network camera to the user terminal. ,
The network camera
The session ID received from the authentication server is stored, the session ID received from the user terminal is compared with the stored session ID, and if they match, the session ID including the session ID for the user terminal A request for generating a file is transmitted, a session ID included in the session ID file and an instruction to execute a function executed by the network camera are received from the user terminal, and the session ID of the session ID file and the stored session are received. If the ID matches, execute the function according to the execution instruction from the user terminal,
A login authentication system for network cameras. The authentication server is
When access to the authentication server is received from the user terminal, after authentication by ID and password is completed, a one-time password is generated and transmitted to the user's pre-registered email address, from the user terminal Receiving the input of the one-time password, checking the generated one-time password and the received one-time password, and generating the session ID if they match,
The log-in authentication system for the network camera according to claim 1 or 2, characterized in that: The network camera
An authentication server that transmits the session ID to the network camera is stored in advance, and access from other than the previously stored authentication server is not accepted.
The login authentication system for a network camera according to any one of claims 1 to 3, wherein A network camera login authentication system for logging in from a user terminal used by a user to a network camera having a function of receiving and storing a session ID from an authentication server,
The authentication server is
User information storage means for storing at least an ID as to whether or not to permit access from the user terminal, a password, and an identifier of a network camera that can be browsed with the ID;
Camera authentication information storage means for storing at least the identifier of the network camera, its IP address, ID and password;
A login request receiving means for receiving an ID and a password from the user terminal and collating the ID and password stored in the user information storage means;
Session ID generation means for generating the session ID;
The network camera identifier that can be browsed by the ID received from the user terminal is extracted from the user information storage means, and the IP address and ID of the network camera are extracted from the camera authentication information storage means based on the extracted network camera identifier. Camera-side session ID transmission that extracts the password, accesses the network camera having the IP address with the ID and password, and transmits and stores the generated session ID when logging in to the network camera Means,
The network camera identifier that can be browsed by the ID received from the user terminal is extracted from the user information storage means, and the IP address of the network camera is extracted from the camera authentication information storage means based on the extracted network camera identifier. And a user-side session ID transmitting means for transmitting the generated session ID and the extracted IP address to the user terminal,
The network camera
ID / password storage means for storing the ID and password of the network camera;
A login confirmation unit that receives the ID and password of the network camera from the authentication server, collates the ID and password stored in the ID / password storage unit, and permits access from the authentication server if they match;
Session ID receiving means for receiving the session ID received from the authentication server and storing it in a session ID storage means;
A session that verifies the session ID received from the user terminal and the session ID stored in the session ID storage means, and gives a permission to transmit an image captured by the network camera to the user terminal if they match. ID collating means,
A login authentication system for network cameras. A network camera login authentication system for logging in from a user terminal used by a user to a network camera having a function of receiving and storing a session ID from an authentication server,
The authentication server is
User information storage means for storing at least an ID as to whether or not to permit access from the user terminal, a password, and an identifier of a network camera that can be browsed with the ID;
Camera authentication information storage means for storing at least the identifier of the network camera, its IP address, ID and password;
A login request receiving means for receiving an ID and a password from the user terminal and collating the ID and password stored in the user information storage means;
Session ID generation means for generating the session ID;
The network camera identifier that can be browsed by the ID received from the user terminal is extracted from the user information storage means, and the IP address and ID of the network camera are extracted from the camera authentication information storage means based on the extracted network camera identifier. Camera-side session ID transmission that extracts the password, accesses the network camera having the IP address with the ID and password, and transmits and stores the generated session ID when logging in to the network camera Means,
The network camera identifier that can be browsed by the ID received from the user terminal is extracted from the user information storage means, and the IP address of the network camera is extracted from the camera authentication information storage means based on the extracted network camera identifier. And a user-side session ID transmitting means for transmitting the generated session ID and the extracted IP address to the user terminal,
The network camera
ID / password storage means for storing the ID and password of the network camera;
A login confirmation unit that receives the ID and password of the network camera from the authentication server, collates the ID and password stored in the ID / password storage unit, and permits access from the authentication server if they match;
Session ID receiving means for receiving the session ID received from the authentication server and storing it in a session ID storage means;
The session ID received from the user terminal is compared with the session ID stored in the session ID storage means, and if they match, a request to generate a session ID file including the session ID is transmitted to the user terminal. Session ID verification means for
When a session ID included in the session ID file and an instruction to execute a function executed by the network camera are received from the user terminal, and the session ID of the session ID file matches the stored session ID, Execution function determination means for issuing a permission to execute a function according to an execution instruction from the user terminal,
A login authentication system for network cameras. The authentication server is
The user information storage means further stores an email address and a one-time password of the user having the ID,
One-time password generation means for generating a one-time password after login authentication at the login request reception means, and storing the one-time password in the user information storage means;
One-time password transmission means for transmitting the generated one-time password by e-mail based on the e-mail address of the user of the ID stored in the user information storage means;
One-time time when receiving the input of the one-time password from the user terminal and passing the generation request for generating the session ID to the session ID generation means when it matches the one-time password stored in the user information storage means Password verification means;
The network camera login authentication system according to claim 5 or 6, further comprising: The network camera
An IP address of an authentication server that can access the network camera is registered in advance in the network camera,
The login confirmation means further includes:
After checking by the ID and password, the IP address of the authentication server that has accessed the network camera is checked against the IP address registered in advance in the network camera. Allow access from the authentication server,
8. The log-in authentication system for a network camera according to any one of claims 5 to 7. The session ID generating means
Generating a number of session IDs corresponding to the number of network cameras viewable by the ID;
7. The log-in authentication system for a network camera according to claim 5 or 6, The authentication server further includes:
It is possible to send and receive data to and from an IP address management server that stores the IP address of the network camera,
The IP address management server receives a notification that the IP address of the network camera has been changed and a new IP address from the IP address management server, and stores the IP address of the network camera in which the IP address is changed to be stored in the camera authentication information storage unit. IP address acquisition means for updating with the received new IP address;
10. The log-in authentication system for a network camera according to claim 5, further comprising: A network that stores the session ID received from the authentication server, collates the session ID received from the user terminal with the stored session ID, and transmits the captured image to the user terminal via the network if they match An authentication server used for logging into the camera,
The authentication server is
User information storage means for storing at least an ID as to whether or not to permit access from the user terminal, a password, and an identifier of a network camera that can be browsed with the ID;
Camera authentication information storage means for storing at least the identifier of the network camera, its IP address, ID and password;
A login request receiving means for receiving an ID and a password from the user terminal and collating the ID and password stored in the user information storage means;
Session ID generation means for generating the session ID;
The network camera identifier that can be browsed by the ID received from the user terminal is extracted from the user information storage means, and the IP address and ID of the network camera are extracted from the camera authentication information storage means based on the extracted network camera identifier. Camera-side session ID transmission that extracts the password, accesses the network camera having the IP address with the ID and password, and transmits and stores the generated session ID when logging in to the network camera Means,
The network camera identifier that can be browsed by the ID received from the user terminal is extracted from the user information storage means, and the IP address of the network camera is extracted from the camera authentication information storage means based on the extracted network camera identifier. A user-side session ID transmission means for transmitting the generated session ID and the extracted IP address to the user terminal;
An authentication server characterized by comprising: The authentication server is
The user information storage means further stores an email address and a one-time password of the user having the ID,
One-time password generation means for generating a one-time password after login authentication at the login request reception means, and storing the one-time password in the user information storage means;
One-time password transmission means for transmitting the generated one-time password by e-mail based on the e-mail address of the user of the ID stored in the user information storage means;
One-time time when receiving the input of the one-time password from the user terminal and passing the generation request for generating the session ID to the session ID generation means when it matches the one-time password stored in the user information storage means Password verification means;
The authentication server according to claim 11, further comprising: The session ID generating means
Generating a number of session IDs corresponding to the number of network cameras viewable by the ID;
The authentication server according to claim 11 or 12, characterized in that: The authentication server further includes:
It is possible to send and receive data to and from an IP address management server that stores the IP address of the network camera,
The IP address management server receives a notification that the IP address of the network camera has been changed and a new IP address from the IP address management server, and stores the IP address of the network camera in which the IP address is changed to be stored in the camera authentication information storage unit. IP address acquisition means for updating with the received new IP address;
The authentication server according to claim 11, comprising: Generates a session ID indicating whether or not to allow access from a user terminal to a network camera having a function of receiving and storing a session ID from an authentication server, and transmits the session ID to the network camera, and the session ID And a network camera that accepts login using the authentication server that transmits the IP address of the network camera to the user terminal,
The network camera
ID / password storage means for storing the ID and password of the network camera;
Login confirmation means for receiving the ID and password of the network camera from the authentication server, checking the ID and password stored in the ID / password storage means, and permitting access from the authentication server if they match. ,
Session ID receiving means for receiving a session ID from the authentication server outside the network camera and storing it in a session ID storage means;
Session ID received from the user terminal is compared with the session ID stored in the session ID storage means, and if they match, a session ID that gives permission to the user terminal to transmit an image captured by a network camera Matching means;
A network camera characterized by comprising: Generates a session ID indicating whether or not to allow access from a user terminal to a network camera having a function of receiving and storing a session ID from an authentication server, and transmits the session ID to the network camera, and the session ID And a network camera that accepts login using the authentication server that transmits the IP address of the network camera to the user terminal,
The network camera
ID / password storage means for storing the ID and password of the network camera;
Login confirmation means for receiving the ID and password of the network camera from the authentication server, checking the ID and password stored in the ID / password storage means, and permitting access from the authentication server if they match. ,
Session ID receiving means for receiving a session ID from the authentication server outside the network camera and storing it in a session ID storage means;
The session ID received from the user terminal is compared with the session ID stored in the session ID storage means, and if they match, a request to generate a session ID file including the session ID is transmitted to the user terminal. Session ID verification means for
When a session ID included in the session ID file and an instruction to execute a function executed by the network camera are received from the user terminal, and the session ID of the session ID file matches the stored session ID, An execution function determination means for giving permission to execute a function according to an execution instruction from the user terminal;
A network camera characterized by comprising: The network camera
An IP address of an authentication server that can access the network camera is registered in advance in the network camera,
The login confirmation means further includes:
After checking by the ID and password, the IP address of the authentication server that has accessed the network camera is checked against the IP address registered in advance in the network camera. Allow access from the authentication server,
The network camera according to claim 15 or 16, characterized in that: The network camera further includes:
When the session ID receiving unit stores the session ID in the session ID storage unit, the session ID receiving unit adds and stores an expiration date of the session ID,
The session ID verification means includes:
When verifying the session ID received from the user terminal, the session ID stored in the session ID storage means is compared with whether it is within the expiration date, and if the session ID matches and is within the expiration date Giving permission to the user terminal to transmit an image captured by a network camera;
The network camera according to any one of claims 15 to 17, characterized in that:

Images