JP4313425B1 - Process execution device, application program, and download server device - Google Patents

Abstract

An application program that requires authentication by an authentication server cannot be executed if it cannot be authenticated due to a communication error.
When a communication error occurs in communication for obtaining authentication from an authentication server, authentication result history information stored in a memory is read, an authentication request is transmitted to the authentication server, and as a result, authentication is successful. If it is determined that a reply has been made, the process is executed assuming that the authentication process has been successful.
[Selection] Figure 10

Description

  The present invention relates to a process execution device that executes processing by obtaining authentication obtained from a server, an application program, and a download server that holds an application program in a downloadable manner.

  With the development of communication technology and computer mounting technology, it has become possible to connect not only a personal computer but also a mobile phone terminal as a terminal device to a server device via the Internet. Also, in order to download an application program to a terminal device and execute it safely, it is common to run an application program whose operation is described in machine code (virtual machine code) that can be interpreted and executed by the virtual machine in the virtual machine (For example, refer to Patent Document 1). For example, a mobile phone terminal is connected to a web server via a communication network such as the Internet, and an application program for playing a game whose operation is described in a virtual machine code is downloaded from the web server and operated on the virtual machine. Can enjoy the game.

  Such application programs are classified into those that can be used for a fee and those that can be used for free. In the case of a charge, it is usual to register the mobile phone terminal identification information, user identification information, etc. as member information etc. in the authentication server in order to perform billing processing. Each time the application program is executed or every time a predetermined period (for example, one month), the application program is authenticated by an authentication server via the Internet and exchanged for billing processing. Can be used. Also, even application programs that can be used free of charge often require similar authentication in order to shift to a fee after a certain period of time has passed, or to perform a version upgrade notification.

JP 2003-114837 A

  However, when receiving authentication by the authentication server as to whether or not a member is registered every predetermined period (for example, one month), using the clock function of the mobile phone terminal, for example, one month from the date and time when the previous authentication was successful However, if the user keeps setting so that the date and time of the mobile phone terminal does not pass for one month, fraud such as continuing to use without receiving the next authentication becomes possible. End up.

  In order to deal with such a fraud, it is conceivable that the authentication server authenticates each time the application program is executed. However, this case has the following problems. In other words, the frequency of communication increases when authentication by the authentication server is performed each time the application program is executed. However, even today, when communication technology has been developed, it is difficult to completely eliminate a communication failure (communication error) with the authentication server due to a trouble such as a communication line. For this reason, there is a problem that the application program as described above cannot be operated due to a communication error. Especially in the case of mobile phone terminals, communication is not possible if the radio wave from the base station is weak or does not reach inside the building or between subway stations. In reality, there are many cases where operation is not possible.

  In addition, when communication is not possible due to the inability to receive radio waves from the base station, if the application program can be operated without authentication, the application program can be used illegally by creating a state where communication cannot be performed intentionally. There is also a problem of being done.

  As one aspect of the present invention, a transmitting unit that transmits a request for authentication processing to determine whether or not to succeed to an authentication server connected via a network, and a receiving unit that receives a result of the authentication processing A process selection unit that selects a process to be performed later depending on whether the authentication process at the authentication server is successful, a storage unit that stores authentication result history information indicating a history of the result of the authentication process, and transmission of an authentication request Error detection unit that detects whether or not a communication error has occurred when receiving the result of authentication processing, and in response to detection of a communication error by the error detection unit, or no communication error was detected by the error detection unit In this case, an authentication result history update unit that updates the authentication result history information according to the received authentication processing result, and that a communication error has been detected, and authentication processing is performed on the authentication result history information. If it contains any information indicating that sometimes successful provides a processing execution apparatus, comprising an authentication control unit that performs a process it was considered successful result of the authentication process.

  According to this process execution device, if an error occurs during communication with the authentication server and communication cannot be performed, even if the authentication process cannot actually be received, the past authentication process has been successful. Since it is determined that the authentication processing is successful, normal processing can be performed. Further, by limiting the range of past authentication processing to, for example, the previous authentication processing, it is possible to prevent the processing execution device from being used illegally even if a situation where communication is impossible is intentionally created.

  Further, as another embodiment of the present invention, an authentication process request for determining whether or not the authentication is successful is transmitted to an authentication server connected via a network, and the result of the authentication process is received. An application program for causing a computer to select a process to be performed later depending on whether or not the authentication process in the authentication server is successful, and stores authentication result history information indicating a history of the result of the authentication process Detected whether or not a communication error occurred when sending an authentication request and receiving the result of the authentication process, and was received in response to the detection of a communication error or if no communication error was detected The authentication result history information is updated according to the result of the authentication process, and it is detected that a communication error has occurred, and the authentication result history information includes information indicating that the authentication process has been successful. If it is provides an application program for executing the performing the process was considered successful authentication processing result to the computer.

  When this application program is executed on a computer, an error occurs during communication with the authentication server, and communication cannot be performed. Since it is determined that the authentication process is successful, normal processing can be performed. Further, by limiting the range of past authentication processing to, for example, the previous authentication processing, it is possible to prevent an application program from being used illegally even if a situation where communication is impossible is intentionally created.

  Further, as another embodiment of the present invention, an authentication process request for determining whether or not the authentication is successful is transmitted to an authentication server connected via a network, and the result of the authentication process is received. An application program for causing a computer to select a process to be performed later depending on whether or not the authentication process in the authentication server is successful, and stores authentication result history information indicating a history of the result of the authentication process Detected whether or not a communication error occurred when sending an authentication request and receiving the result of the authentication process, and was received in response to the detection of a communication error or if no communication error was detected The authentication result history information is updated according to the result of the authentication process, and it is detected that a communication error has occurred, and the authentication result history information includes information indicating that the authentication process has been successful. If it is provides a download server apparatus having a storage unit that can store downloaded application program, the to the mobile terminal for executing that performs processing was considered successful authentication processing result to the computer.

  According to this download server device, an error occurs during communication with the authentication server, and communication cannot be performed. An application program that is determined to have been successfully authenticated can be downloaded to a terminal device such as a portable terminal.

  According to the present invention, since an error occurs during communication with the authentication server and communication cannot be performed, the authentication process can be performed if the past authentication process has succeeded even if the authentication process cannot be actually received. Therefore, normal processing can be performed. In addition, by limiting the range of past authentication processing to, for example, the previous authentication processing, even if a situation where communication is impossible is intentionally created, it is possible to prevent unauthorized use of a processing execution device, application program, etc. be able to.

  Hereinafter, the best mode for carrying out the present invention will be described in several embodiments with reference to the drawings. In addition, this invention is not limited at all by these description, In the range which does not deviate from the summary, it can implement in a various aspect.

(Outline of the present invention)
FIG. 1 is a diagram showing an outline of the present invention. That is, it is a figure explaining the structure of the system which concerns on one Embodiment of this invention, and the flow of operation in the terminal device which is an example of the component of the system.

  1A to 1D, a system 100 according to an embodiment of the present invention includes a terminal device 103 capable of communicating with a base station 102 connected to a first communication network 101, and a first communication. A download server 107 connected to a second communication network 106 connected to the network 101 via a gateway (GW) 105 and an authentication server 110 are provided. Note that the download server 107 and the authentication server 110 may be realized by an integrated server device. Further, the first communication network 101 and the second communication network 106 may be the same, and the GW 105 may not be explicitly specified. Further, although the terminal device 103 is described as a mobile phone which is a kind of portable terminal in FIG. 1, any electronic device having a communication function (for example, a personal computer, a household appliance, etc.) can be used for communication. The function can be wireless or wired.

  The first communication network 101 is, for example, a communication network operated by a mobile phone company (carrier). The base station 102 is connected to the first communication network, and can communicate with the terminal device 103 by wireless communication. Alternatively, the first communication network 101 is for an Internet service provider (ISP) to provide a communication service to its contractor, or for an organization such as a general company or a university to operate for the benefit of its members. In this case, the base station can be rephrased as an access point. Hereinafter, for convenience of explanation, description will be made using a base station and a mobile terminal, but the present invention is not limited to the case where a base station and a mobile terminal that perform wireless communication are used.

  The second communication network 106 is mainly assumed to be a wide-area communication network such as the Internet. Of course, the network need not be an open network such as the Internet, and may be a closed network. The GW 105 includes a router that relays communication between the first communication network 101 and the second communication network 106.

  The download server 107 stores an application program (hereinafter sometimes abbreviated as “application” or “application”) 109 in the storage unit 108 so that it can be downloaded to the terminal device 103. The application 109 is a program described in machine (native) code of the terminal device 103 or a machine code of a virtual machine operable on the terminal device 103, and can be executed. Alternatively, it may be content data such as reproducible music data or video data. In the case of content data, the reproduction program corresponds to a virtual machine. When the download server 107 receives download request information from the terminal device 103, the download server 107 returns the application 109 to the terminal device 103 as a reply, and the mobile terminal executes or reproduces the application 109. (Hereinafter referred to as “use”).

  The authentication server 110 has a database (DB) 111. In the system 100, it is assumed that the application downloaded from the download server 107 to the terminal device 103 needs to be authenticated by the authentication server 110 in order to be executed by the terminal device 103. This authentication target is assumed to be the terminal device 103 or the user of the terminal device 103. Information for this authentication (abbreviated as “authentication information”) is registered in the DB 111. The authentication information includes a terminal serial number for identifying the terminal device 103 (or may be referred to as individual identification information or a subscriber ID). Alternatively, user identification information for identifying the user of the terminal device 103 may be included. Further, a password may be combined. Further, it may be a public key paired with a secret key stored in a secure state in a tamper-resistant area of the terminal device 103 or a public key certificate in PKI (Public Key Infrastructure).

  In addition, the authentication information is not stored in the terminal device 103 and then transmitted to the authentication server 110, but is generated by the authentication server 110 like cookie information, registered in the DB 111, and sent to the terminal device 103. It may be transmitted and stored in the terminal device 103.

  Authentication processing by the authentication server 110 is performed when the use of the application 109 in the terminal device 103 is started or during the use. In addition, the authentication process is performed every time use is performed. Alternatively, the authentication process is performed at an arbitrary timing, such as when a predetermined time has elapsed since the previous authentication process, or when a predetermined date or time has elapsed each time the number of uses reaches a predetermined number. It may be performed any number of times.

  Registration of authentication information in the DB 111 of the authentication server 110 is mainly assumed to be performed by operating a browser or the like in the terminal device 103 and communicating with the authentication server 110. Registration may be performed by communication from another terminal device 103. Registration of authentication information may be performed before the application 109 is downloaded from the download server 107 to the terminal device 103. Alternatively, the authentication information is registered when the application 109 downloaded to the terminal device 103 is activated for the first time, the communication between the application 109 and the authentication server 110 is performed, and it is detected that the authentication information is not registered in the DB 111. It may be done at the time.

  FIG. 1A illustrates a non-volatile storage area of the terminal device 103 by designating the application 109 using a URL or the like to the download server 107 using a browser or the like in the terminal device 103 and transmitting a download request. The status stored in (for example, flash memory) is shown. In FIG. 1A, while the terminal device 103 receives the application 109 from the download server 107 for downloading, a display to that effect is displayed on the display unit 104. Further, this display may be as illustrated in FIG. When the download is completed, the application 109 downloaded and stored in the terminal device 103 may be arranged under the control of the application manager of the terminal device 103 or the like. An application manager is a type of program that performs operations such as starting and ending an application. Arranging an application under the control of the application manager means that the path of the application 109 is stored in a storage area accessible by the application manager. The path of the application 109 refers to the location of a file or directory that stores the application 109 in a file system that is realized using the nonvolatile storage area of the terminal device 103.

  Note that downloading the application 109 from the download server 107 is one method for introducing the application 109 into the terminal device 103. As another method, for example, the application 109 may be written to a memory card using a personal computer or the like, the memory card is attached to the terminal device 103, and the application 109 is read from the memory card. Alternatively, the terminal device 103 may be connected to a personal computer using a USB (Universal Serial Bus) cable, and the application 109 may be received from the personal computer via the USB cable. Alternatively, the application 109 is not necessarily introduced from the outside of the terminal device 103. The application 109 may be already installed at the time of manufacture in the factory or at the time of shipment, and may be activated without a special operation such as downloading by the user of the terminal device 103. .

  FIG. 1B shows a situation in which the application 109 is activated in the terminal device 103 using an application manager or the like and its execution is started.

  FIG. 1C shows the situation in which the application 109 registers the authentication information in the DB 111 of the authentication server 110 or that the authentication information is registered in the DB 111 of the authentication server 110 in FIG. Indicates the situation. A non-volatile storage area of the terminal device 103 is assigned an area for storing unique information for each application (for example, sometimes referred to as a scratchpad), and the application 109 is activated. Each time the data stored in the area is read, it is determined whether the authentication information is registered in the DB 111 of the authentication server 110. Alternatively, the authentication information is authenticated depending on whether or not the cookie information transmitted from the authentication server 110 is registered by reading the data stored in the storage area that can be accessed in common as the cookie information is normally stored. It is determined whether it is registered in the DB 111 of the server 110.

  That is, it is confirmed that the authentication information is registered in the DB 111 of the authentication server 110. When this confirmation is made, as will be described later with reference to FIG. 1D, an authentication process in which a result of success or failure is returned in response to the authentication request from the mobile terminal 103 is sent to the authentication server 110. Can be executed. When the authentication information is registered in the authentication server 110, the mobile terminal 103 transmits an authentication request to the authentication server 110, and thereafter performs the authentication depending on whether or not the authentication process is successful. Select a process.

  If the application 109 determines that the authentication information is not registered in the DB 111 of the authentication server 110, the application 109 communicates with the authentication server 110 and performs processing for registering the authentication information in the DB 111 of the authentication server 110. At this time, the application 109 reads the terminal serial number from the storage area of the terminal device 103 or displays it on the display unit 104 to prompt the user to input user identification information. Then, communication with the authentication server 110 is performed, and if a reply indicating that the authentication information 112 is registered in the DB 111 or a reply indicating that the authentication information is already registered is obtained, information unique to the application 109 is stored. Data indicating that the authentication information is registered is stored in an area or the like. Thereafter, the application 109 performs a normal operation. Note that whether or not the authentication information has been registered does not need to be performed immediately after the application 109 is activated, and can be performed at an arbitrary time.

  FIG. 1D shows the case where the application 109 reads data stored in an area for storing information unique to the application 109 and determines that the authentication information is registered in the DB 111 of the authentication server 110. A situation in which an authentication request is transmitted to the server 110 to request execution of authentication processing is shown. For example, the application 109 reads the terminal serial number and transmits it to the authentication server 110 together with an authentication request. The authentication server 110 searches the DB 111 and returns whether or not the terminal serial number is registered. If registered, the result of the authentication process is successful, and if not registered, the result of the authentication process is failed, and a success or failure is returned. If a reply indicating that the terminal serial number is registered in the DB 111 is obtained, the application 109 assumes that authentication has been received and continues the subsequent processing. If a reply indicating that the terminal serial number is not registered in the DB 111 is obtained, it is assumed that the authentication has not been received, and the processing performed before the authentication processing is requested is interrupted or the execution of the application 109 is terminated. Or perform processing for authentication failure.

  If the public key or public key certificate of the terminal device 103 is registered as the authentication information in the DB 111 of the authentication server 110, challenge-and-response type authentication processing can be performed. As an example, the authentication server 110 generates a random number or the like and transmits it to the terminal device 103. The terminal device 103 encrypts the received random number or the like with the secret key and transmits it to the authentication server 110. It decrypts with the public key and public key certificate registered in, performs the authentication process based on whether or not the first random number is obtained, and returns the result. In the following description, it is assumed that the authentication server 110 determines the result of the authentication process based on whether or not information transmitted from the terminal device 103 is registered in the DB 111 of the authentication server 110. The use of response type authentication processing is not excluded from the technical scope of the present invention.

  FIG. 2 is a sequence diagram illustrating a process of communication between the terminal device 103, the download server 107, and the authentication server 110. In step S <b> 201, an application download request is transmitted from the terminal device 103 to the download server 107. In step S202, the application 109 is returned from the download server 107 to the terminal device 103 in response to the download request. Thereafter, the terminal device 103 performs decompression processing or the like on the application 109 as necessary, stores it in the nonvolatile storage area, and arranges it under the control of the application manager or the like. As described above, communication with the download server 107 is not indispensable in steps S201 and S202, and is received from a personal computer and placed under the control of an application manager or the like, or has already been shipped when the terminal device 103 is shipped. It may be installed and placed under the control of an application manager or the like.

  Then, the application 109 is started in the terminal device 103 and execution is started. At that time, the application 109 determines whether the authentication information is registered in the DB 111 of the authentication server 110 by reading data such as a storage area unique to the application 109. In response to the determination, if it is not confirmed in step S203 that the authentication information is registered in the DB 111 of the authentication server 110, an authentication registration request, which is a request for registering the authentication information, is transmitted to the authentication server 110, and authentication is performed. If it is confirmed that the information is registered in the DB 111 of the authentication server 110, an authentication request is transmitted to the authentication server 110 to perform authentication processing. In step S204, an authentication registration request or an authentication request result is received. Then, depending on the result, the subsequent processing is selected, or interruption, stop, or termination is selected. Of course, the authentication registration request and the authentication request do not need to be transmitted every time the application 109 is activated. In the following, the authentication process means a process mainly performed by the authentication server 110, and if simply described as authentication, it means a process mainly performed by the terminal device 103.

  Here, there is a case where communication between the application 109 and the authentication server 110 becomes an error and a reply to the authentication request cannot be obtained. For example, when the communication function of the terminal device 103 is broken, when communication between the terminal device 103 and the base station 102 is not possible, a failure occurs in the first communication network 101, the GW 105, or the second communication network 106. If there is a failure in the authentication server 110, a reply to the authentication request cannot be obtained. In such a case, within the application 109, an error when establishing a connection for communication with the authentication server 110, an error when transmitting a terminal serial number to the authentication server 110, and a reply from the authentication server 110 are predetermined. Timeout due to not being obtained within this time, error when receiving a reply, error due to the received data not being in a predetermined format, and the like occur, and are detected as communication errors. Specifically, a system call for communication, a return value abnormality such as a library function using these system calls, or an exception occurs and is detected as a communication error.

  One of the features of the present invention is that even if a communication error occurs, if there is a successful authentication process performed in the past within a predetermined range, the returned authentication result is successful. In other words, the operation of the application 109 can be continued.

(Embodiment 1)
(Configuration of terminal device)
FIG. 3 is a functional block diagram illustrating a hardware configuration of a terminal device that implements the processing execution device. The terminal device 300 includes a CPU (Central Processing Unit) 301, a RAM (Random Access Memory) 302, a nonvolatile storage unit 303, a communication I / F (Interface) 304, and an operation unit 305, which are connected by a bus 307. And a display unit 306.

  The CPU 301 is a circuit that executes machine code and executes a program. Further, an interrupt signal generated by the communication I / F 304, the operation unit 305, the display unit 306, and the like is acquired and processing corresponding to the interrupt signal is performed. The RAM 302 is a memory configured by a DRAM (Dynamic Random Access Memory) or the like, and stores a program executed by the CPU 301. Further, it is possible to store data referred to by the program. The non-volatile storage unit 303 is a storage unit that can retain stored information even when the mobile terminal 300 is turned off. For example, the read-only memory element such as a ROM (Read Only Memory) or a rewritable memory element such as a flash memory is used. The communication I / F 304 is an interface for the mobile terminal 300 to communicate with the outside. Includes network adapters according to the communication method. The operation unit 305 is a unit that detects an operation such as a button by a user of the mobile terminal and generates information indicating the operation. For example, data indicating which button is pressed and which part of the screen having a touch panel function is touched is generated as event information. The generated data can be acquired by an application program via an operating system described later. The display unit 306 is a unit for displaying on a display configured using a liquid crystal element, an organic EL element, or the like.

  When the portable terminal 300 is powered on, the boot process is performed by the CPU 301, the operating system stored in the nonvolatile storage unit 303 is expanded in the RAM 302, and the operating system is executed.

  FIG. 4 is a schematic diagram showing a state in which an operating system is executed and a program is operating under the management of the operating system. An operating system 402 operates in a logical layer above the hardware 401. As a result, a program operating under the management of the operating system can control the hardware 401 and receive data from the hardware 401 via the operating system 402. Examples of programs that operate under the management of the operating system 402 include a virtual machine 403 and a browser. The virtual machine 403 is a program that executes a virtual machine code, and executes a program described in the virtual machine code. In general, a program written in virtual machine code executed by a virtual machine is often referred to as an “application”. By operating the virtual machine 403, it is possible to operate applications having the same description even if the hardware 401 is different. The application may be written in native code, and may operate under the management of the operating system 402 without going through the virtual machine 403.

(Configuration of download server and authentication server)
FIG. 5 is a functional block diagram illustrating a hardware configuration of a server device that implements the download server 107 and the authentication server 110. The server device 500 includes a CPU 501, a RAM 502, a communication I / F 503, and a nonvolatile storage unit 504 connected via a bus 505. Note that the CPU 501, RAM 502, communication I / F 503, nonvolatile storage unit 504, and bus 505 need not be the same as those corresponding to those of the mobile terminal 300. In general, a server device 500 has a higher performance than that used in the terminal device 300. For example, a hard disk device is generally used as the nonvolatile storage unit 504 at present, and a storage capacity larger than the storage capacity of the nonvolatile storage unit 303 of the terminal device 300 is often used. In many cases, the CPU 501 has a higher processing speed than the CPU 301 and the RAM 502 has an access speed higher than that of the RAM 502.

  When the power of the server device 500 is turned on, the boot process by the CPU 501 is performed, the operating system stored in the nonvolatile storage unit 504 is expanded in the RAM 502, and the operating system is executed. Thereafter, various server programs and the like are executed under the management of the operating system.

  FIG. 6 is a schematic diagram showing a state in which an operating system is executed and various programs are executed under the management of the operating system. As in FIG. 4, the operating system 602 operates in a logical layer above the hardware 601, and a program that operates under the management of the operating system controls the hardware 601 and the hardware 601 via the operating system 602. Receive data from. Programs that operate under the management of the operating system 602 are classified into a server program 603 that communicates with the outside and a local program 604 that does not communicate with the outside. The server program 603 is, for example, a program that realizes the function of a web server, and the local program 604 is a database management system.

(About download processing)
FIG. 7 is a flowchart for explaining the flow of processing in which the terminal device 103 downloads the application 109 from the download server 107. In the terminal device 103, for example, the browser 405 is operated to communicate with the server program 603 that realizes the function of the WEB server running on the download server 107, and the display unit 306 displays a web page for downloading the application 109. To do. When the CPU 301 detects that a button for downloading has been pressed by an interruption from the operation unit 305, the process of the flowchart shown in FIG. 7 is executed by the CPU 301 as part of the function of the browser 405 or the like.

  In step S701, a download session start process is performed. For example, a communication session for downloading is established with the server program 603. In step S702, a file for storing the downloaded application is created in a file system realized by the nonvolatile storage unit 303, and the file is opened in a write mode or the like. In step S703, a download request is transmitted to the server program 603 using the established communication session. As shown later in FIG. 8, since the application is transmitted from the download server 107, the data transmitted from the download server 107 is stored in a predetermined RAM 302 such as a buffer in the loop formed by steps S704, S705, and S706. Reading to the storage area and writing to the file opened in step S702 is repeated until EOF (End Of File) is detected when reading data. When EOF is detected, the process proceeds to step S707, the file opened in step S702 is closed, and in step S708, the communication session established in S701 is terminated. After that, the data read by downloading is checked for damage, and if necessary, the data written in the file is decompressed, and the downloaded application is placed under the control of the application manager. .

  FIG. 14A shows an example of display on the display until the download session is started and the session is ended. That is, “Communicating ...” indicating that communication with the download server is being performed is displayed.

  FIG. 8 illustrates a processing flow in which the download server 107 causes the terminal device 103 to download the application 109. This process is executed by the CPU 501 as a part of the function of the server program 603 that realizes the function of the web server, for example.

  In step S801, the process waits until a download request is received. For example, when a LISTEN system call is executed and some data becomes receivable, the receivable data is acquired and it is determined whether it is a download request. If it is determined that the request is a download request, the process proceeds to step S802, and the file in which the application 109 is stored is opened in the read mode. Thereafter, in the loop formed by steps S803, S804, and S805, reading the data of the opened file into the area of the RAM 502 used as a buffer and transmitting the read data via the communication I / F 503. Repeat until all file data is read and EOF is detected. If an EOF is detected, the file is closed in step S806, and a session termination process is performed in step S807.

(About application execution)
FIG. 9 is a flowchart for explaining the flow of processing for executing the application 109 downloaded to the terminal device 103. When a predetermined button or the like is operated on the terminal device 103 and an application manager or the like is instructed to start the application 109, the processing of the flowchart shown in FIG. 9 is started by the CPU 301 as a function of the application manager or the like. In step S <b> 901, the application 109 stored in the nonvolatile storage unit 303 is loaded into the RAM 302. Thereafter, in step S902, the virtual machine 403 is instructed to start the operation of the application 109, or the CPU 301 is instructed via the operating system 402. Thereby, the application 109 is executed.

  FIG. 10 shows a functional block diagram of an apparatus (process execution apparatus) that is realized by executing the application 109 as an integrated unit with the hardware of the terminal apparatus 103 and executes predetermined processing. The apparatus 1000 realized by executing the application includes a main processing unit 1001, an authentication information storage unit 1002, an authentication result history update unit 1003, a communication unit 1004, and an authentication control unit 1005. These units are realized as modules including class and instance methods or functions (functions) and procedures (procedures) for performing the functions of the respective units described below.

  The main processing unit 1001 is a unit that performs the original processing of the application 109. The “original process” is a process for providing a function realized as the entire application 109. For example, if the application 109 is a program for playing a game, an operation of a button or the like by the user of the terminal device 103 is detected, and the screen display is changed in response to the detection, so that a series of games is given to the user. This is the original process. If the application 109 is content reproduction software, the original processing is to read information representing content such as music or video and reproduce the content. In one embodiment of the present invention, in the original process, the control is transferred to the authentication control unit 1005, the authentication process is requested to the authentication server 110, and the result of the returned authentication process is determined depending on whether the result is successful. A process selection process for selecting a process to be performed is included. For example, if the result of the authentication process is successful, a selection is made to continue the process before transferring control to the authentication control unit 1005. If the result of the authentication process is not successful, the process before transferring control to the authentication control unit 1005 is performed. Suspend processing. Therefore, it can be said that the main processing unit 1001 includes a process selection unit that performs a process selection process.

  If the application 109 is a program, its entry point is usually set inside the main processing unit 1001. That is, when the execution of the application 109 is started, an internal address of the main processing unit 1001 is set in a program counter that is one of registers included in the virtual machine 403 and the CPU 301. Of course, the entry point can be set to an arbitrary address as required.

  The authentication information storage unit 1002 stores the authentication result history information 1007 so that it can be read and updated. Further, in addition to the authentication result history information 1007, registered information 1006 may be stored as shown in FIG. The authentication information storage unit 1002 secures a certain area in a memory such as the non-volatile storage unit 303 and the RAM 302, stores registered information 1006 and authentication result history information 1007 in the area, and stores the registration stored as such. This is realized as a module for accessing the completed information 1006 and the authentication result history information 1007.

  The registered information 1006 is information indicating whether authentication information is registered in the authentication server 110. For example, if the value is 0, it is not registered, and if it is a value other than 0, for example, 1, it indicates that authentication information is registered. Further, the registered information 1006 may be information that requests the authentication server 110 to register authentication information and is returned. Specifically, the authentication information requested to be registered or information obtained by encrypting information obtained from the authentication information by a predetermined calculation using the secret key of the authentication server 110 may be used. As described above, by storing the registered information 1006 in the authentication information storage unit 1002, it is determined whether the authentication information is already registered in the authentication server 110 without actually communicating with the authentication server 110. Can do. Furthermore, if the information encrypted with the secret key of the authentication server 110 is used as registered information, it becomes difficult to forge the registered information 1006 and it is difficult to perform fraud. It can be judged whether or not it is registered.

  By storing the registered information 1006 in the authentication information storage unit, if the authentication information is not registered in the authentication server 110, the result of the authentication process is determined to be successful without sending a request for executing the authentication process. You can detect what is wrong. As a result, useless communication can be suppressed. Further, depending on whether authentication information is registered, it is possible to select a process to be performed thereafter.

  The authentication result history information 1007 is information indicating whether or not the authentication process has been successfully requested by requesting the authentication server 110 after the authentication information is registered in the authentication server 110. An example of the authentication result history information 1007 is information representing an authentication result history (for example, a log) obtained by requesting the authentication server 110 for authentication processing. Here, the authentication result is information including authentication status information in addition to whether or not an error has occurred in communication with the authentication server 110. Authentication status information is information sent back as a result of authentication processing, which is a determination made by the authentication server in response to an authentication request to the authentication server. Whether authentication processing at the authentication server succeeded or failed Information indicating The authentication result history information 1007 may represent all the authentication results performed after the authentication information is registered in the authentication server 110. Alternatively, the authentication result may be expressed a predetermined number of times after the authentication information is registered in the authentication server 110. For example, the authentication result history information 1007 may be information indicating only a predetermined number of results among recent authentication requests. More specifically, it may be information indicating an authentication result of only one authentication request made last time.

  As will be described later, the authentication result history information 1007 is a numerical value (for example, an integer value) stored in the authentication information storage unit 1002 as a predetermined value if the authentication status information is obtained and the authentication process is successful. It may be. In this case, when communication with the authentication server 110 results in an error or authentication processing fails, a predetermined number (for example, 1) is reduced and stored in the authentication information storage unit 1002. It may be. If the authentication result history information 1007 read from the authentication information storage unit 1002 is within a predetermined value range (for example, larger), the authentication process is requested from the authentication server 110 and the authentication process is successful. It may be judged that there is.

  When the registered information 1006 is stored, it is cleared and initialized when the application 109 is downloaded to the terminal device 103. Alternatively, it may be included in the application 109 as initialized data. Further, when the registered information 1006 is shared by a plurality of applications and read or updated, the registered information 1006 is initially cleared by being downloaded to the terminal device 103 and executed first among the plurality of applications. It becomes. Similarly, the authentication result history information 1007 may be cleared and initialized.

  Here, “clear and initialize the registered information 1006” means that the registered information 1006 is information indicating that the authentication information is not registered in the authentication server 110.

  Further, “clearing and initializing the authentication result history information 1007” means that the information included in the authentication result history information 1007 does not include information indicating the success of the authentication process. For example, when the authentication result history information 1007 includes an authentication result obtained as a result of a request for authentication processing in the past, all of the included authentication results are rewritten with information indicating that the authentication result is not successful.

  The authentication result history update unit 1003 is a unit that updates the authentication result history information 1007 stored in the authentication information storage unit 1002 according to the authentication result. That is, the authentication result history update unit 1003 determines whether the authentication result is returned in response to the occurrence of a communication error, or if no communication error occurs, in response to the authentication processing result returned and received in response to the transmission of the authentication request. The history information 1007 is updated. For example, a value indicating that a communication error has occurred and a value indicating the result of the authentication process are overwritten in the authentication result history information 1007 stored in the authentication information storage unit 1002 or stored in the authentication information storage unit 1002. If the authentication result history information 1007 includes a predetermined number of authentication results that have been performed in the past, the authentication result that was most recently performed is deleted, and a communication error occurs. A value indicating the occurrence or a value indicating the result of the authentication process is added. Alternatively, updating may be performed by performing state transition. Alternatively, if the authentication result history information 1007 is a numerical value, as described above, the authentication result history information 1007 is set to a predetermined numerical value when the authentication process is successful, and if communication fails, the numerical value falls within the predetermined value range. It may be determined whether or not there is.

  The communication unit 1004 performs communication processing with the authentication server 110. The communication process performed by the communication unit 1004 is divided into transmitting an authentication information registration request to the authentication server 110 if necessary, transmitting an authentication request to the authentication server 110, and receiving the transmitted result. It is done. When the registration request is transmitted, the authentication control unit 1005 determines which of the registration request and the authentication request is transmitted and the result is received. Therefore, the communication unit 1004 receives at least an authentication request to the authentication server 110 via the network, and if the authentication server 110 receives the authentication request, whether the authentication processing result is successful. And a reception unit that receives the authentication status information transmitted from the authentication server 110 as a result.

  Making an authentication information registration request to the authentication server 110 means registering authentication information in the DB 111 of the authentication server 110 as described with reference to FIG. For example, the communication unit 1004 reads the terminal serial number and the like, and transmits the terminal serial number and the like to the authentication server 110 together with a request for registering in the DB 111, and the communication unit 1004 receives a notification of the registration result.

  Making an authentication request to the authentication server 110 refers to authentication status information which is a notification of the authentication result by making an inquiry of the authentication information to the authentication server 110 as described with reference to FIG. Is to receive. For example, the communication unit 1004 reads out the terminal serial number and the like, transmits it to the authentication server 110 together with a request for checking whether or not the terminal serial number is registered in the DB 111, and the communication unit 1004 sends a notification of the result to the authentication status. Receive as information.

  The authentication result includes not only the result of checking whether the terminal serial number or the like that has been received and inquired from the authentication server 110 is registered in the DB 111 but also the establishment of a communication session with the authentication server 110. In addition, when data is transmitted or received, information on the presence or absence of a communication error and the type of error may be included. Therefore, it can be said that the communication unit 1004 includes at least an error detection unit that detects whether or not a communication error has occurred when the transmission of the authentication request by the transmission unit and the reception of the authentication processing result by the reception unit are performed.

  The authentication control unit 1005 reads the authentication result history information 1007 stored in the authentication information storage unit 1002 and, if necessary, the registered information 1006. Then, the communication unit 1004 is operated to cause the authentication server 110 to transmit an authentication information authentication request or a registration request if necessary, and the authentication result history information update unit 1003 updates the authentication result history information 1007. In addition, when execution control is passed from the main processing unit 1001 by a method call or the like, the authentication control unit 1005 returns an authentication result indicating whether the authentication is successful (whether authentication is OK) or not to the main processing unit 1001. Thereby, the main processing unit 1001 can select a subsequent process. If necessary, the execution of the application may be interrupted or terminated depending on the authentication result. Of the authentication control processing performed by the authentication control unit 1005, the communication unit 1004 transmits an authentication request to the authentication server 110, and the update of the information related to authentication stored in the authentication information storage unit 1002 is performed as an authentication result history. Performed by the update unit 1003.

  Here, if the authentication result received from the communication unit 1004 indicates an error, the authentication control unit 1005 determines that the authentication result is successful if the authentication result history information 1007 includes information indicating the success of the authentication process. Assuming that authentication OK is returned to the main processing unit 1001, and if not included, the authentication result is regarded as failure, and authentication NG is returned to the main processing unit 1001. Note that the fact that the authentication result history information 1007 includes information indicating the success of the authentication process includes not only the case where it is explicitly included, but also the fact that it is substantially included. Explicitly included is, for example, a case where a history of authentication results performed in the past is held as it is, and an authentication result for each authentication performed in the past is held. In addition, the fact that each authentication result of authentication performed in the past cannot be derived as being substantially included, for example, if there is a successful authentication performed in the past, TRUE, Otherwise, this is the case where a flag that takes the value of FALSE is used. A counter or the like may be used instead of the flag.

  FIG. 11 shows an example of a flowchart of processing by the application 109 after the operation of the application 109 is started. In step S1101, the operation of the main processing unit 1001 is started, and data and variables necessary for the operation of the application 109 are initialized. For example, if the application 109 is a game program, the stage identifier and points acquired in the previous execution are read from the nonvolatile storage unit 303 and placed in the memory space allocated to the application 109. In step S1102, a method for operating the authentication control unit 1005 is called from the main processing unit 1001, and authentication control processing by the authentication control unit 1005 is performed. The processing result is returned as a return value of a method or the like, and it is determined in step S1103 as to whether or not the authentication is successful. If the authentication is successful, the process proceeds to step S1104. In other words, after returning from the method call described above, the subsequent processing of the main processing unit 1001 is performed. If the authentication fails without success, the processing of the application 109 is terminated.

  The flowchart shown in FIG. 11 is merely an example of processing by the application 109, and authentication control processing does not necessarily have to be performed after initialization. After initialization, after performing the main process to some extent, for example, when proceeding to the next stage such as a game, authentication control processing may be performed. Further, if the authentication is not successful, the function of the application 109 is restricted such that the processing of the application 109 is not ended, the stage of the next game or the like is not advanced, or the reproduction quality is not higher than a predetermined quality. It may be like this.

  FIG. 14B shows an example of display on the display until the application 109 is loaded into the memory and starts operating. Under the display of “Starting ...”, the progress of loading into the memory and the progress of initialization are displayed.

  12 and 13 are flowcharts illustrating the flow of processing in the authentication control unit 1005. That is, FIG. 12 is a flowchart for explaining in detail the processing in step S1102 of FIG. FIGS. 13A and 13B are flowcharts illustrating in detail the processing in step S1220 in FIG.

  When a method or the like for operating the authentication control unit 1005 is called, the process of the flowchart illustrated in FIG. 12 starts. In step S <b> 1201, the communication unit 1004 reads registered information from the authentication information storage unit 1002 and determines whether the authentication information is unregistered in the authentication server 110. If not registered, the process proceeds to step S1202, and if registered, the process proceeds to step S1209.

  In step S1202, the communication unit 1004 is operated to perform a process of transmitting a registration request for registering authentication information to the authentication server 110. In the subsequent step S1203, it is determined whether or not a communication error has occurred during the transmission in step S1202. For example, a communication connection with the authentication server 110 can be established, a request can be transmitted using the communication connection, and if TCP (Transmission Control Protocol) is used, it is determined whether or not an ACK has been received. If a registration request can be transmitted without a communication error, the process proceeds to step S1204. If a communication error has occurred and a registration request cannot be transmitted, the process proceeds to step S1208.

  In step S <b> 1204, processing for transmitting authentication information to the authentication server 110 is performed in order to register the authentication information in the authentication server 110. In a succeeding step S1205, it is determined whether or not a reply that the registration of the authentication information is completed is obtained. If registration has been completed, the process proceeds to step S1206. If a reply indicating that registration of authentication information has been completed is not obtained, the process proceeds to step S1208.

  In step S1206, the authentication control unit 1005 stores registered information 1006 indicating that the authentication information is registered in the authentication server 110 in the authentication information storage unit 1002. In the subsequent step S1207, an authentication OK response is sent to the main processing unit 1001.

  If it is determined in step S1203 that a communication error has occurred and the authentication information registration request has not been transmitted, or if a reply indicating that registration has been completed is not obtained in step S1205, as described above. The process proceeds to step S1208. In step S1208, the main processing unit 1001 is replied to the effect that registration is not OK and authentication is not possible. Alternatively, the authentication control unit 1005 may interrupt, stop, or terminate the execution of the application 109. Further, the entire terminal device may be locked so that it cannot be operated.

  In step S1207, it is described that the authentication OK response is performed. However, another response (for example, “registration OK”) indicating that the registration is performed for the first time may be performed. Accordingly, the main processing unit 1001 can select to display a welcome message or the like as a subsequent process in response to the first registration.

  If it is determined in step S1201 that the authentication information is registered in the authentication server 110, the process proceeds to step S1209 as described above. In step S1209, processing for transmitting an authentication request to the authentication server 110 is performed. In subsequent step S12010, it is determined whether or not a communication error has occurred during the transmission in step S1209. For example, if a communication connection with the authentication server 110 can be established, a request can be transmitted using the communication connection, and if TCP is used, it is determined whether or not an ACK has been received. If an authentication request can be transmitted without a communication error, the process proceeds to step S1211. If a communication error occurs and an authentication request cannot be transmitted, the process proceeds to step S1220.

  In step S <b> 1211, processing for transmitting authentication information to the authentication server 110 is performed. For example, the terminal serial number is read and transmitted. In the subsequent step S1212, it is determined in the same manner as in step S1210 whether or not a communication error has occurred during the transmission in step S1211. If authentication information can be transmitted without a communication error, the process proceeds to step S1213. If a communication error occurs and authentication information cannot be transmitted, the process proceeds to step S1220.

  In step S1213, a process for receiving authentication status information from the authentication server 110 is performed. In a succeeding step S1214, it is determined whether or not the authentication status information has been received without causing a communication error. In this determination, in addition to whether or not the data can be received without a communication error, it is also determined whether or not the received data is in a predetermined format. For example, if the authentication status information is defined to be returned as 1-byte information indicating 0 or 1, communication is performed even when data other than 0 or 1 is received or information of 2 bytes or more is received. Judge that an error has occurred. If it is determined that the authentication status information has been received without any communication error, the process proceeds to step S1215, and if not, the process proceeds to step S1220.

  In step S1215, the received data is analyzed and compared with a predetermined value to obtain an authentication result. For example, if the received data is equal to 1 byte representing 0, the fact that the authentication has succeeded is acquired, and if the received data is equal to other values (for example, 1 byte representing 1), the fact that the authentication has failed is obtained.

  In step S1216, the authentication result history update unit 1003 is operated, and the authentication result history information 1007 using the authentication status information that is the authentication result acquired in step S1215 or a code (numerical value or character information) corresponding to the authentication status information. Update. Examples of information stored in the authentication result history information 1007 include 1 and FFH (hexadecimal number) when authentication is successful, and 0 and 00H (hexadecimal number) when authentication fails. In addition, character information including character expressions such as “OK” when the authentication is successful and “NG” when the authentication is unsuccessful may be used.

  In step S1217, the authentication status information that is the authentication result acquired in step S1215 is determined. If the authentication process is successful, the process proceeds to step S1218, an authentication OK response is returned, and the authentication process has failed. For example, the process proceeds to step S1219, and authentication NG is returned.

  If it is determined in steps S1210, S1212, and S1214 that a communication error has occurred, the process proceeds to step S1220 as described above, and processing is performed when a communication error (error in transmission / reception with the authentication server 110) has occurred. An example of a flowchart of the process is shown in FIG.

  In step S1301, the authentication control unit 1005 reads the authentication result history information 1007 from the authentication information storage unit 1002. In subsequent step S1302, the authentication result history information 1007 is examined to determine whether or not it is indicated that the authentication has been successful. For example, if the authentication result history information 1007 includes the latest predetermined number of authentication results among authentication processes performed in the past, the predetermined number of authentication results are at least once or more. Determine if authentication has ever been successful. If the authentication has succeeded even once, the process proceeds to step S1303. If it is not shown that the authentication has succeeded once, the process proceeds to step S1304.

  In step S1303, an authentication OK response is prepared. For example, a value representing authentication OK is stored in the variable. On the other hand, in step S1304, it is prepared to return an authentication NG. After steps S1303 and S1304, the process proceeds to step S1305.

  In step S1305, the authentication result history information 1007 is updated. In this case, the authentication result history information 1007 is updated using the fact that a communication error has occurred. For example, in the case where the latest two authentication results (that is, immediately before and before) are represented by the authentication result history information 1007 in the authentication processing performed in the past, for example, the previous authentication is successful, When the previous authentication is unsuccessful, the authentication result history information 1007 is expressed as {immediately: success, before that: failure}. Therefore, the updated authentication result history information 1007 is {immediately before: error, before: success}. It becomes. Thereafter, in step S1306, authentication OK or authentication NG is returned.

  FIG. 13B shows a flowchart of the processing in step S1220 when the authentication result history information 1007 is a numerical value such as an integer value. If the authentication result history information 1007 is a numerical value, in step S1216, if the authentication is successful, the first predetermined numerical value (for example, 2) is stored as the authentication result history information 1007, and the authentication fails. Then, the second predetermined numerical value (for example, 1) is subtracted from the stored authentication result history information 1007 and stored again, and the third predetermined numerical value (for example, 0) is further stored. As a result, the authentication result history information 1007 is updated.

  In step S1307, authentication result history information 1007 is read out as in step S1301. In step S1308, it is determined whether or not the read authentication result history information 1007 is within a predetermined range (for example, whether it is a positive numerical value). If the read authentication result history information 1007 is within the predetermined range, the process proceeds to step S1309, and preparation is made to return an authentication OK as in step S1303. If the read authentication result history information 1007 is not within the predetermined range (for example, if it is a numerical value equal to or less than 0), the process proceeds to step S1310, and authentication NG is returned as in step S1304. Make preparations.

  After steps S1309 and S1310, the process proceeds to step S1311 and the authentication result history information 1007 is updated. In the case of FIG. 13B, the other numerical value described above is subtracted from the authentication result history information 1007 read out in step S1307 and stored. Thereafter, in step S1312, a reply is made in the same manner as in step S1306.

  For example, as described above, the first predetermined numerical value is 2, the second predetermined numerical value is 1, and the determined range is a positive numerical range. It is assumed that 1) authentication processing succeeds, (2) authentication processing succeeds, (3) communication error, and (4) communication error. By the success of the authentication process (1), 2 is stored as the authentication result history information 1007 in step S1216. Similarly, 2 is stored as the authentication result history information 1007 by the success of the authentication process (2). When the processing of the flowchart of FIG. 13B is executed due to the occurrence of the communication error of (3), an authentication OK is returned and 1 is stored as the authentication result history information 1007. When the processing of the flowchart of FIG. 13B is executed due to the occurrence of the communication error (4), the authentication OK is returned again, and 0 is stored as the authentication result history information 1007. If, after that, a communication error occurs again and the processing of the flowchart of FIG. 13B is executed, the authentication result history information 1007 read out in step S1307 becomes 0 and is not a positive numerical value, so authentication NG is returned. Will be.

  Thus, if the first predetermined numerical value is 2, the second predetermined numerical value is 1, and the predetermined range is a positive numerical value range, after successful authentication, Even if two consecutive communication errors occur, the application process is continued as authentication OK, and when the error occurs three consecutive times, the authentication process is NG and the application process is not continued. The first predetermined numerical value, the second predetermined numerical value, and the determined range can be arbitrarily determined.

  14C, 14D, and 14E show steps S1303 and S1304 in the case where the authentication result history information 1007 indicates only the authentication result of the previous authentication among the authentications performed in the past. The example of a display on a display when is executed is shown. If the authentication result in the previous authentication indicated by the authentication result history information 1007 indicates that the authentication has been successful, and if step S1303 has been executed, this indicates that the authentication has been successful this time. . This is because the authentication of this time was not possible to communicate with the authentication server, so it is unclear whether the authentication process was successful, but the previous authentication process was successful. However, it is indicated by the phrase “content can be used only once” that the application cannot be continuously executed unless the next authentication process is successful.

  Also, the authentication result in the authentication immediately before indicated by the authentication result history information 1007 indicates that the authentication was not successful (authentication processing failed or communication error), and step S1304 was executed. For example, this time, it is considered that the authentication has failed, and the display of FIG. This is because it was not possible to communicate with the authentication server in this authentication, so it is unclear whether the authentication process was successful, and the previous authentication process was not successful. If a communication connection has been established but ACK or the like cannot be received from the authentication server and a communication error due to timeout has been detected, the display shown in FIG.

  If the registered information 1006 is not stored, the execution of steps S1201 to S1207 is not essential.

(Authentication server database)
FIG. 15 shows an example of the structure of the DB 111 of the authentication server 107. FIG. 15A is an example of a table that associates a member ID with its password information, for example. The member ID column stores a terminal serial number, user identification information, and the like, and the password information stores the password itself used in the authentication process and information obtained by processing the password with a one-way function. It is not necessary to prepare two columns, a member ID column and a password information column. The member ID is sufficiently long bit information, and different mobile terminals or users may use the same member ID. If not, only the member ID may be stored. Also, the password information column is not essential when the public key or public key certificate is stored in the member ID column.

  FIG. 15B is an example of a table that associates a registration date and a withdrawal date with a member ID. The registration date is the date when the authentication information is registered in the authentication server 107, and the withdrawal date is the date when a request for deleting the authentication information is transmitted from the mobile terminal or the user. If there is a request to delete the authentication information, the member ID may be deleted from the table. However, by recording the registration date and the withdrawal date, the authentication information is only recorded before and after the date that becomes the basis of accounting. It is possible to prevent the billing from escaping in a deleted state. Note that “NULL” is stored on the withdrawal date means that a request for deleting the authentication information is not transmitted.

  FIG. 15C is an example of a table that associates a billing method with a member ID. For example, credit cards, bank account withdrawals, and the like are stored in the payment method column, and credit card numbers, bank account numbers, and the like are stored in separate tables.

(Authentication server processing)
FIG. 16 is a flowchart illustrating the processing flow of the authentication server 110. If there are two types of requests to the authentication server 110, that is, an authentication request and an authentication information registration request, it is determined in step S1601 whether an authentication request has been received. If an authentication request is received, the process proceeds to step S1602, and if it is not an authentication request but an authentication information registration request, the process proceeds to step S1606. Note that it is not necessary for one authentication server to receive both the authentication request and the registration request, and the authentication server that receives the authentication request may be different from the authentication server that receives the registration request. Similarly, the terminal device that transmits the authentication request may be different from the terminal device that transmits the registration request.

  In step S1602, authentication information is received and authentication processing is performed. For example, it is determined whether or not the authentication process is successful based on whether or not the terminal serial number and the user identification information included in the authentication information are registered in the table of FIG. In the subsequent step S1603, if the authentication process is successful, the process proceeds to step S1604, and authentication status information indicating that the authentication process is successful is returned. If the authentication process is not successful, the process proceeds to step S1605. Returns authentication status information indicating that the authentication process has failed.

  If an authentication information registration request is received, authentication information to be registered is received in step S1606. In subsequent step S1607, registration processing in the DB 111 is performed. For example, member IDs are registered in the table shown in FIG. In step S1608, registration completion is returned.

(Embodiment 2)
As a second embodiment of the present invention, another example of the data structure of the authentication result history information 1007 stored in the authentication information storage unit 1002 will be described.

  FIG. 17 shows an example in which the authentication result history information 1007 represents the authentication result only once. The storage area 1701 of the authentication information storage unit 1002 stores the date and time (2008/08 / 01-18: 52) when the last authentication was performed and “success” as the authentication result at that time. . In step S1301 of FIG. 13, the data stored in the storage area 1701 is read, and in step S1302, it is determined whether success is stored as an authentication result. In step S1216 of FIG. 12, the authentication result acquired in step S1215 and the date and time are stored in the storage area 1701. In step S1305 of FIG. 13, the storage area 1701 stores the fact that a communication error has occurred and the date and time.

  As described above, the storage area can be saved by storing the authentication result just once. Further, by storing the date and time when authentication is performed, for example, it is possible to detect that the date and time set in the timer of the portable terminal or the like has been illegally operated. For example, if the date and time stored in the storage area 1701 is later than the date and time set in the timer or the like of the portable terminal, it is determined that fraud has been performed, and the application 109 is selected to be terminated. be able to. If such fraud detection is not performed, it is not necessary to store the date and time of authentication in the storage area 1701 or the like.

  In the present embodiment, the storage area 1701 may store any of authentication process success, authentication process failure, and communication error as an authentication result. In this case, when the processing of the flowchart of FIG. 13B is used, for example, the first predetermined numerical value is 1, the second predetermined numerical value is 1, and a predetermined range is set. The same authentication result is returned as when is in the range of positive numbers.

(Embodiment 3)
As Embodiment 3 of the present invention, a description will be given of an embodiment in which, when communication with the authentication server 110 is not possible, if communication is possible, the communication is performed with the authentication server 110 and an authentication request is transmitted. To do.

  FIG. 18 shows a functional block diagram of a device realized by executing the application 109 according to the present embodiment integrally with the hardware of the terminal device 103, and shows the function of the device according to the first and second embodiments. Furthermore, a callback processing unit 1801 is provided in the block diagram.

  The callback processing unit 1801 is a unit that performs specified processing when a predetermined condition is satisfied. In the present embodiment, the situation in which the predetermined condition is satisfied includes that the communication state has become good and that an incoming mail has been received and that communication is actually possible.

  Operating systems and virtual machines monitor which of the predetermined conditions are met. When a certain condition is satisfied, it is possible to provide a function of generating an event and notifying an application operating in the management of the operating system or the virtual machine. Therefore, in the present embodiment, the callback processing unit 1801 acquires the event notified as such and executes a callback set according to the type of the event.

  FIG. 19 shows a data structure processed by the callback processing unit 1801. In FIG. 19, “Event 1”, “Event 2”, and “Event 3” indicate the types of events, and nodes 1902, 1903, and 1904 linked to the list structure indicate callbacks associated with the event 1. Yes.

  FIG. 20 is a flowchart for explaining the processing of the callback processing unit 1801. In step S2001, an event occurs and waits for notification. When an event occurs, the process proceeds to step S2002, and a callback list corresponding to the notified event is acquired. In step S2003, callbacks in the callback list are executed in order.

  In the present embodiment, when performing the process shown in FIG. 21 when performing step S1220 in FIG. 12 in which it is detected that communication with the authentication server 110 is not possible, the callback is performed when the communication status becomes good or actually It is added to the list of events to be notified when it is detected that communication is possible. That is, in step S2101, an authentication request is transmitted. In the following step S2102, it is determined whether or not transmission is possible. If transmission is successful, the process proceeds to step S2103, and if transmission is an error, the process proceeds to step S2110.

  In step S2103, authentication information is transmitted. In step S2104, it is determined whether or not the transmission is successful. If the transmission is successful, the process proceeds to step S2105. If the transmission results in an error, the process proceeds to step S2110.

  In step S2105, the authentication status is received. In step S2106, it is determined whether or not the authentication status has been received. If so, the process proceeds to step S2107. If a reception error occurs, the process proceeds to step S2110.

  In step S2107, an authentication result is acquired. In step S2108, if the authentication is successful, the process proceeds to step S2109, and if the authentication fails, the process proceeds to step S2110.

  In step S2109, the authentication result history information is updated to add an authentication result history indicating that the authentication was successful.

  In step S2110, since a transmission / reception error has occurred and authentication has not succeeded, the callback is set again.

  As in this embodiment, when a transmission / reception error occurs and authentication is not successful, by setting a callback and performing authentication again, it is assumed that a transmission / reception error has occurred and the authentication process has been successful. If the authentication process succeeds while letting the user use the application or the content, the application can be used or the content can be used in the same state as if there was no transmission / reception error. .

It is a figure which shows the outline | summary of one Embodiment of this invention. It is a sequence diagram explaining the process of communication in one Embodiment of this invention. It is a functional block diagram which shows the hardware constitutions of the portable terminal which concerns on one Embodiment of this invention. It is a schematic diagram which shows a mode that the program is operate | moving under management of an operating system in the portable terminal which concerns on one Embodiment of this invention. It is a functional block diagram of the server apparatus which concerns on one Embodiment of this invention. In the server apparatus concerning one Embodiment of this invention, it is a schematic diagram which shows a mode that the program is operating under management of an operating system. It is a flowchart of the process which the terminal device which concerns on one Embodiment of this invention downloads an application from a download server apparatus. It is a flowchart of the process in which the download server apparatus which concerns on one Embodiment of this invention downloads an application to a terminal device. It is a flowchart of the process of execution of the application downloaded to the portable terminal which concerns on one Embodiment of this invention. It is a functional block diagram of the process execution apparatus which concerns on one Embodiment of this invention. It is a flowchart of the process of the application which concerns on one Embodiment of this invention. It is a flowchart explaining the flow of a process in the authentication control part which concerns on one Embodiment of this invention. It is a flowchart explaining the flow of a process in the authentication control part which concerns on one Embodiment of this invention. It is an example figure of a display of a display of a portable terminal concerning one embodiment of the present invention. It is an example of the structure of the database of the authentication server which concerns on one Embodiment of this invention. It is a flowchart explaining the flow of a process of the authentication server which concerns on one Embodiment of this invention. It is an example of the data structure which stores the authentication result historical information which concerns on one Embodiment of this invention. It is a functional block diagram of the process execution apparatus which concerns on one Embodiment of this invention. It is an example figure of the data structure which the callback process part concerning one Embodiment of this invention processes. It is a flowchart explaining the process of the callback process part which concerns on one Embodiment of this invention. It is a flowchart of the callback process which concerns on one Embodiment of this invention.

Explanation of symbols

1000 running application 1001 main processing unit 1002 authentication information storage unit 1003 authentication result history update unit 1004 communication unit 1005 authentication control unit

Claims (3)

A transmitting unit that transmits the authentication request via the network to an authentication server that executes an authentication process in which it is determined whether or not the authentication request is successful in response to the authentication request received via the network;
A receiving unit that receives a result of the authentication process from the authentication server via the network ;
A process selection unit that selects the first process if the result of the authentication process received by the reception unit is successful , and selects the second process if the result is failure ;
An error detection unit for detecting the presence or absence of a communication error when performing the transmission of the authentication request by the transmission unit and the reception of the result of the authentication process by the reception unit;
A storage unit for storing authentication result history information including a predetermined number of the history of the result of the authentication process received by the receiving unit and the history of the communication error detected by the error detection unit ;
When the communication error is detected by the error detection unit, the authentication result history information is updated to include a history indicating the communication error, and the communication error is not detected by the error detection unit. Is an authentication result history update unit that updates the authentication result history information so as to include a history indicating the result of the authentication process received by the receiving unit;
If the error detection unit detects that the communication error has occurred and the authentication result history information already includes a history indicating the success of the authentication process, the process selection unit selects the first process. An authentication control unit
A processing execution apparatus comprising: Using the communication interface, the authentication request is transmitted to an authentication server that executes an authentication process in which whether or not the authentication request received via the network is successful is determined. Receive the results,
It received the result of the authentication process has selects a first processing if successful, an application program for executing the selecting a second processing if failed computer,
The presence or absence of a communication error when sending the authentication request and receiving the result of the authentication process is detected by comparing the return value of a system call for communication ,
When storing the authentication result history information including a predetermined number of the received history of the authentication processing results and the detected communication error history in the memory, the authentication result history information stored in the memory is read, When a communication error is detected , the authentication result history information is updated to include a history indicating the communication error. When the communication error is not detected , a history indicating the received authentication processing result is updated. Update the authentication result history information to include it , store it in the memory ,
An application for causing a computer to execute the selection of the first process when the occurrence of the communication error is detected and the authentication result history information already includes a history indicating the success of the authentication process. program.   The download server apparatus which has a memory | storage part which memorize | stores the application program of Claim 2 so that download to a portable terminal is possible.