JP4566322B2 - User authentication system - Google Patents

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to user authentication in a service system that provides a service using a network such as the Internet, and more particularly to prevention of unauthorized use.
[0002]
[Prior art]
FIG. 1 shows a conventional user authentication system using the Internet. The user terminal 2 is a mobile phone or a personal computer that can use the Internet. The user terminal 2 is connected to the conversion device 4 via the telephone network 14, and the conversion device 4 is connected to the Internet 6. A user authentication device 8 and a service providing device 10 are connected to the Internet 6, and the user authentication device 8 and the service providing device 10 are connected via a LAN 16.
[0003]
When the user terminal 2 uses the service of the service providing apparatus 10, it is necessary to perform user authentication as a precondition. For this reason, the user terminal 2 first transmits an identifier for specifying the user terminal 2 to the conversion device 4. Upon receiving the request, the conversion device 4 distributes the IP address to the user terminal 2 in order to uniquely identify the user terminal on the network, and an authentication key obtained by adding the IP address to the transmitted identifier. Protocol conversion from the telephone network to the Internet. Then, the conversion device 4 transmits the authentication key to the user authentication device 8 via the Internet 6. The user authentication device 8 that has received the authentication key performs user authentication, and the service providing device 10 provides the service to the user terminal 2 after the authentication is completed. That is, the user authentication device 8 rejects user authentication unless the authentication key sent from the user terminal 2 is authentic, and permits service use if the authentication key is authentic.
[0004]
Here, there are various types of user terminals with different specifications, such as mobile phones and personal computers that can be used on the Internet. Therefore, as a result of considering the case where the same information is accessed from such various user terminals, it is considered preferable that the user authentication apparatus handles all accesses via the Internet.
[0005]
On the other hand, when the user terminal is a personal computer, a password or ID is generally used as an authentication key. However, in the case of a mobile phone that can be used on the Internet, it is uniquely identified by a telephone number to simplify the operation of the user. May be used.
[0006]
[Problems to be solved by the invention]
However, the conventional user authentication system has the following problems.
[0007]
Compared with passwords and IDs sent by personal computers as authentication keys, subscriber IDs that are uniquely identified by phone numbers sent by mobile phones that can use the Internet as authentication keys are on the Internet as variables that are relatively easy to forge. Therefore, there is a concern that a malicious user impersonates a legitimate mobile phone user and illegally uses it.
[0008]
That is, a malicious user who has acquired the subscriber ID flowing through the Internet 6 in FIG. 1 using an unauthorized use terminal 12 (such as a personal computer equipped with an unauthorized program) operates the unauthorized use terminal 12 to carry out a regular mobile phone. If the user is impersonated as a telephone user and accesses the user authentication device 8 to receive service, the authorized user may suffer unexpected damage. In particular, when the service is charged, there is a problem that there is a concern that a user who has been illegally used must pay the fee even though the service is not provided.
[0009]
In addition, such a problem is based on the fact that unlike a mobile phone that can use the Internet, a personal computer or the like may allow an unauthorized user to change the program of the personal computer. Is.
[0010]
Such a situation is an anxiety factor for users of mobile phones that can use the Internet, and the development of systems that are expected to increase in the future and that receive services using the Internet through mobile phones. Concern as a factor to hinder.
[0011]
An object of this invention is to provide the user authentication system which can prevent unauthorized use in view of the above problems.
[0012]
[Means for Solving the Problems and Effects of the Invention]
(1) The user authentication system of the present invention is
Terminal device,
An identification information adding device connected to the terminal device via a dedicated line;
An identification information selection transmission device connected to the identification information addition device via a communication path;
A user authentication device connected to the identification information adding device via a dedicated line and also connected to the identification information selecting / transmitting device via a dedicated line;
A user authentication system comprising:
The terminal device
User information transmission means for transmitting user information to the identification information adding device,
The identification information adding device
Identification information adding means for adding identification information to user information transmitted from the terminal device;
A user identification information transmitting unit via a communication path for transmitting the user identification information obtained by the identification information adding unit to the identification information selection transmitting device via the communication path;
A dedicated line user identification information transmitting means for transmitting the user identification information to a user authentication device via a dedicated line;
The identification information selection transmission device
User identification information including identification information added by the identification information adding apparatus is not transmitted to the user authentication apparatus, but user identification information including identification information other than the identification information is transmitted to the user authentication apparatus. Comprising information selection transmission means,
User authentication device
User authentication means for receiving user identification information transmitted from the identification information adding device or the identification information selecting / transmitting device via a dedicated line and performing user authentication;
It is characterized by having.
[0013]
As a result, even if a malicious user who has illegally obtained user identification information flowing through a communication channel attempts to receive user authentication by impersonating a legitimate terminal device user, Will not be.
[0014]
This is because the user identification information transmitted by the malicious user is transmitted to the communication path via a different route from the identification information adding apparatus according to the present invention, and therefore is not transmitted via the dedicated line. Furthermore, since the identification information included in the illegally acquired user identification information is the same as the identification information added by the identification information adding device in the present invention, the identification information selection transmitting device uses the user identification information. This is because it is not transmitted to the user authentication device.
[0015]
Then, the user identification information flowing on one of the dedicated lines is not acquired by a third party and is safely transmitted to the user authentication device. Therefore, unauthorized use due to impersonation can be prevented.
[0016]
In addition, since the same information is not transmitted from the communication path and the dedicated line to the user authentication device, there is no inconvenience on the system such as collision of user identification information.
[0017]
Furthermore, even if the user identification information can be easily counterfeited, unauthorized use can be prevented. Therefore, the user identification information can be simple, but the operation of the user of the terminal device can be simplified. At the same time, a highly reliable system can be constructed.
[0018]
In addition, since it is only necessary to provide the conventional user authentication system with a dedicated line and an identification information selection / transmission device, the configuration is simple and unauthorized use can be prevented at low cost.
[0019]
(2) The identification information adding device of the present invention further includes:
A transmission via selection means for selecting whether to transmit user identification information to an identification information selection transmission device via a communication path or to a user authentication device via a dedicated line;
It is characterized by having.
[0020]
Thereby, when transmitting user identification information to a user authentication apparatus via a dedicated line, the safety of user identification information is ensured more reliably. In other words, when user identification information flows on a communication path, there is a possibility that a third party may obtain the information illegally. There is no.
[0021]
(3) The identification information selection transmission device of the user authentication system of the present invention is:
A storage unit storing identification information added by the identification information adding device;
With
The identification information selection transmission means selects the user identification information to be transmitted to the user authentication device and the user identification information not to be transmitted by referring to the storage unit.
[0022]
Therefore, when a user terminal with various specifications is newly added or is no longer used, when the identification information selection transmission device sets or updates user identification information that is not transmitted to the user authentication device, it is stored. This can be handled only by setting or updating the storage contents of the identification information in the section.
[0023]
(4) The user authentication system of the present invention
When the identification information added by the identification information addition device is updated,
The identification information adding device further includes:
The update identification information transmitting means for transmitting the updated identification information to the identification information selection transmission device via a dedicated line,
The identification information selection transmission device further includes:
Selective transmission identification information updating means for performing update of the storage unit based on the transmitted update identification information;
It is characterized by having.
[0024]
Therefore, not only when the identification information selection transmission device does not transmit user identification information to the user authentication device, but also when various items with different terminal device specifications are newly added or reduced. The storage contents of the storage unit can be updated easily and quickly.
[0025]
In addition, since the updated user identification information is transmitted to the identification information selecting / transmitting apparatus only through the dedicated line, the safety of the information is ensured. In other words, when the updated identification information flows on the communication path, the third party who acquired it may change the update information, etc., and the system may not function properly. There is no such danger according to the present invention.
[0026]
(5) The identification information in the user authentication system of the present invention is an IP address.
[0027]
Here, the IP address is added to the user information by the identification information adding device and is represented by a number that can be easily managed and understood by the computer. The standard is unified, the data of the identification information can be easily updated, the storage capacity can be reduced, and the processing of the identification information selection / transmission means can be speeded up.
[0028]
(6) Definition of terms
In this invention,
The “terminal device” is a device that receives service provision and can be connected to a network such as the Internet. In the embodiment, the user terminal of the mobile phone 20 and the personal computer 21 in FIG. 2 corresponds to this.
[0029]
"Communication channel" means a device that communicates with two or more devices, whether wireless or wired, and is not only open like the Internet but also closed like a LAN It is a concept that includes. In the embodiment, the Internet 26 in FIG. 2 corresponds to this.
[0030]
"Dedicated line" refers to a device for communicating with two or more devices regardless of whether it is wireless or wired, but it is limited to only a closed line and does not include those that are open like the Internet. It means a telephone network, a LAN, etc. in a line where the two points for information communication are closed. In the embodiment, this corresponds to the telephone networks 22 and 27, the dedicated line 34, and the LAN 36 shown in FIG.
[0031]
“User information” is an identifier transmitted from the terminal device to identify the user of the terminal device, and refers to a telephone number, ID, password, digital certificate, and the like. In the embodiment, this corresponds to the telephone number in step S1 of FIG.
[0032]
“Identification information” is information added to an identifier such as a telephone number transmitted from a terminal device, and refers to an address for uniquely identifying a user terminal on a network. In the embodiment, this corresponds to the IP address in step S3 in FIG.
[0033]
The “identification information adding device” corresponds to the conversion devices 23 and 24 in FIG. 2 in the embodiment.
[0034]
“User identification information” is information in which an address for uniquely identifying a user terminal on a network is given to an identifier transmitted from the terminal apparatus to identify a user of the terminal device. Say. In the embodiment, this corresponds to the authentication key in step S5 in FIG.
[0035]
The “identification information selection / transmission device” corresponds to the IP address filtering device 28 of FIG. 2 in the embodiment.
[0036]
The “transmission selection means” corresponds to the router 29 in FIG. 2 in the embodiment.
[0037]
The “storage unit storing the identification information added by the identification information adding device” corresponds to the IP address filtering table of FIG. 7 in the embodiment.
[0038]
DETAILED DESCRIPTION OF THE INVENTION
(1) Configuration of embodiment of user authentication system
An embodiment of a user authentication system according to the present invention will be described with reference to the drawings. FIG. 2 shows the configuration of a user authentication system according to an embodiment of the present invention. The mobile phone 20 and the personal computer 21 are user terminals. The cellular phone 20 is connected to the conversion device 24 via the telephone network 22, and the personal computer 21 is connected to the conversion device 23 via the telephone network 27. The mobile phone 20 can use the Internet, and the personal computer 21 can use the Internet by dial-up connection or regular connection using a normal telephone. That is, the mobile phone 20 can be connected to the Internet 26 via the conversion device 24, and the personal computer 21 can be connected to the Internet 26 via the conversion device 23. Note that the conversion device 24 is provided with a router 29 for selecting either the dedicated line 34 or the Internet 26.
On the other hand, the IP address filtering device 28, the user authentication device 30, and the service providing device 32 that perform user authentication and the like are installed in the management center 38, and each device is a LAN 36 in the management center 38. Are connected to each other by. The IP address filtering device 28 is also connected to the Internet 26, and the LAN 36 is connected to a dedicated line 34.
[0039]
The conversion devices 23 and 24 are generally operated by a telephone carrier.
Moreover, it is preferable that the management center 38 is operated by a highly public organization such as a telecommunications carrier or an authorized contractor.
[0040]
(2) Hardware configuration of personal computer 21 and the like
FIG. 3 shows a hardware configuration of the personal computer 21. The personal computer 21 includes a memory 40, a display 42, a communication circuit 44, a keyboard / mouse 46, a CPU 48, a hard disk (recording device) 50, and a CD-ROM drive 52. The hard disk 50 stores an operating system (such as Microsoft Windows 98) and a browser program for browsing the web. This browser program is installed from the CD-ROM 54 via the CD-ROM drive 52. The communication circuit 44 is a circuit for connecting to the Internet 26.
[0041]
The conversion devices 23 and 24, the user authentication device 30, and the service providing device 32 have the same hardware configuration as that shown in FIG. However, in the conversion devices 23 and 24, an IP address and a protocol conversion program are recorded on the hard disk. In the user authentication device 30, a user authentication program is recorded on the hard disk. The service providing web server program for providing the service is recorded on the hard disk.
[0042]
(3) Hardware configuration of the IP address filtering device 28
FIG. 4 shows a hardware configuration of the IP address filtering device 28. The IP address filtering device 28 includes a display panel 90, a memory 92, a communication circuit 94, a switch 96, and a CPU 98. The communication circuit 94 is a circuit for connecting to the Internet 26.
[0043]
(4) Configuration of mobile phone 20
FIG. 5 shows a block diagram of the mobile phone 20. As input / output devices, a liquid crystal display 62, a numeric keypad / switch 64, a microphone 66, a speaker (for calling) 68, and a speaker (for ringing tone) 70 are provided. The voice encoding circuit 74 is a circuit for encoding the voice from the microphone 66 for transmission, decoding the received voice signal, and outputting it from the speaker 68. The micro browser 72 is a program recorded in the recording device, and is used for browsing data from the service providing web. The wireless communication circuit 76 is a circuit for transmitting or receiving voice and data by wireless communication. The serial data communication circuit 78 is a circuit for communicating with an external personal computer 84. The memory 80 stores the user's own telephone number, telephone directory, and the like. The control circuit 86 controls these circuits. The battery 82 supplies power to each unit.
[0044]
(5) Processing when receiving user authentication from the mobile phone 20
FIG. 6 shows processing when user authentication is received from the mobile phone 20 as a user terminal. This process is a precondition when the user terminal receives a service provided from the service providing apparatus 32.
[0045]
First, the user operates the mobile phone 20 to connect to the conversion device 24, and transmits a connection request to the user authentication device 30 and a telephone number that is an identifier for user authentication (step S1). In response to this, the converter 24 permits connection (step S2), assigns an IP address to the telephone number (step S3), and distributes the IP address to the mobile phone 20 (step S4).
Here, the conversion device 24 pools IP addresses to be distributed to the mobile phone 20 in the hard disk in advance, and is free from the pooled IP address every time there is a connection request from the mobile phone 20. Select and distribute things.
[0046]
Then, the telephone number as the identifier is converted into a subscriber ID (step S5), and protocol conversion from the telephone network to the Internet protocol is performed (step S6). Here, the subscriber ID is an identifier that is assigned by the communication carrier so as to be uniquely associated with the telephone number of the user. Then, the subscriber ID and the IP address as the authentication key are transmitted to the user authentication device 30 via the dedicated line 34 and the LAN 36 (step S7).
[0047]
At this time, the conversion device 24 does not transmit the authentication key to the Internet 26. This is due to the router 29 provided in the conversion device 24. That is, if the destination IP address included in the connection request in step S1 is the address of the user authentication device 30 or the service providing device 32, the router 29 selects only the dedicated line 34 through the transmission of the authentication key. Depends on the setting.
[0048]
Therefore, the authentication key transmitted from the mobile phone 20 is transmitted only to the user authentication device 30 via the dedicated line 34 (step S7), and user authentication is performed (step S11).
[0049]
(6) About prevention of unauthorized use by impersonation
Next, it will be described that the configuration of this embodiment can prevent unauthorized use due to impersonation of a mobile phone user.
[0050]
Here, unauthorized use due to impersonation of a mobile phone user can be performed on the Internet 26 when the user of the mobile phone 20 to be properly authenticated by the user uses an Internet service other than this system. The authentication key to be transmitted is obtained by a malicious user operating the unauthorized use terminal 25 such as a personal computer. That is, a malicious user who operates the unauthorized use terminal 25 acquires and decodes the subscriber ID and the IP address as an authentication key flowing on the Internet 26 by an unauthorized program in the unauthorized use terminal 25. Then, an unauthorized program such as a personal computer accesses the conversion device 23 as if the acquired subscriber ID and IP address were the source, and the IP address originally assigned from the conversion device 23 is This is done by illegally entering the Internet as a different IP address.
[0051]
However, even when an attempt is made to receive provision of a service through unauthorized use of such impersonation, the authentication key is not transmitted to the user authentication device 30.
[0052]
This is due to the configuration of the IP address filtering device 28 described below.
[0053]
The IP address filtering device 28 performs filtering in response to the transmitted authentication key. This is performed with reference to the IP address filtering table illustrated in FIG. 7 stored in the memory 92 of the IP address filtering device 28.
[0054]
In the IP address filtering table of FIG. 7, the column of the IP address of the transmission source when the action of Reject (prohibition) is recorded, this IP address is the same as the IP address pooled by the conversion device 24. It is. When the authentication key is transmitted from the Internet 26, this Reject (prohibited) action is used if the authentication key includes the same IP address as that recorded in the column. The operation of not transmitting to is performed. For example, in the IP address filtering table of FIG. 7, if the source IP address in the authentication key is 192.168.1.5, the authentication key is not transmitted to the user authentication device 30. On the other hand, if the source IP address in the authentication key is 193.100.1.1, the authentication key is transmitted to the user authentication device 30.
[0055]
As a result, even if an authentication key is transmitted by impersonation of impersonation to a mobile phone user by a personal computer or the like, the conversion device 23 that receives it transmits the authentication key to the user authentication device 30 via the Internet 26 only. Since the authentication key includes the IP address originally recorded in the IP address filtering table and assigned to the mobile phone 20, the IP address filtering device 28 that has received the authentication key transmits the authentication key. The key is not transmitted to the user authentication device (step S9). That is, user authentication is not performed.
[0056]
(7) Effects of this embodiment
As described above, according to the present embodiment, it is possible to prevent unauthorized use of impersonation of a mobile phone user by a personal computer or the like.
[0057]
Further, since the same information is not transmitted from the Internet 26 and the dedicated line 34 to the user authentication device 30, there is no inconvenience on the system such as IP packet collision.
[0058]
Furthermore, even if the information sent for user authentication is a subscriber ID or IP address, even if it is relatively easy to forge, it will not be used illegally. There is no need for transmission and the like, so that the operation of the user can be simplified and a highly reliable system can be constructed.
[0059]
Since the conventional user authentication system only needs to be provided with a dedicated line and an IP address filtering device, the configuration is simple and unauthorized use can be prevented at low cost.
[0060]
Furthermore, when the dedicated line 34 is selected as being routed by the router 29 provided in the conversion device 24, the security of the authentication key is more reliably ensured. In other words, when the authentication key flows on the Internet 26, there is a possibility that a third party may obtain the authentication key illegally. There is no sex.
[0061]
In addition, when the dedicated line 34 is selected as a route and user authentication is performed, the dedicated line 34 in the management center 38 is used as a route for transmitting information to the mobile phone 20 after the user authentication is completed. Is normal. In such a case, there is a possibility that a load is applied to the communication traffic of the dedicated line 34. In order to distribute the load, the following configuration may be employed.
[0062]
For example, when the user authentication device 30 or the service providing device 32 is controlled by a CPU or the like, a certain limit value is set for the information transmission amount transmitted by the user authentication device 30 and the information transmission amount exceeds the limit value. By selecting the Internet 26 via information transmission, the load of communication traffic on the dedicated line 34 can be distributed.
Although not shown in this embodiment, by providing a plurality of routers that relay the LAN 36 in the management center 38, the dedicated line 34, and the Internet 26, the routers can exchange delay times and the like with each other. The load of communication traffic on the dedicated line 34 can be distributed by selecting which of the dedicated line 34 and the Internet 26 is optimal as a route for transmitting information to the telephone 20. Thereby, even when the number of users of the mobile phone 20 increases, the system can be operated quickly and stably.
[0063]
In addition, since the IP address filtering device 28 includes an IP address filtering table, the IP address filtering device 28 transmits to the user authentication device 30 when mobile phones with various specifications are newly added or are not used. When setting or updating the authentication key that is not to be performed, it is possible to respond only by updating the stored contents of the IP address filtering table.
[0064]
Here, the IP address is pre-pooled in the conversion device 24 and is represented by a number that can be easily managed and understood by the computer, so the standard of the content stored in the IP address filtering device 28 is unified. Thus, it is easy to update the storage contents of the IP address filtering table, the storage capacity can be reduced, and the filtering process of the IP address filtering device can be speeded up.
[0065]
Although the IP address filtering table in the present embodiment records the column of the IP address of the sender that is rejected, the present invention is not limited to this. For example, a column for instructing an action of Accept (send), a column for a destination IP address, and a column for a target service (TCP port number) may be recorded together in this table. In this case, the IP address assigned to the service providing web in the user authentication device 30 or the service providing device 32 is displayed in the destination IP address column, and the target service column is http The type of service such as mail or mail can be recorded.
[0066]
In the present embodiment, the case where the router 29 is provided in the conversion device 24 has been described. However, the present system can be implemented even when the router is not provided. This is because, in this case, the conversion device 24 transmits the authentication key not only via the dedicated line 34 but also via the Internet 26. However, the IP address filtering device 28 that receives the authentication key via the Internet 26 is as described above. In addition, the authentication key including the IP address assigned by the conversion device 24 is not transmitted to the user authentication device 30, and as a result, the same effect as that of the above-described embodiment is obtained.
[0067]
(8) Processing when receiving user authentication from the personal computer 21
In the configuration in which the personal computer 21 receives user authentication, as shown in FIG. 2, the conversion device 23 connected to the personal computer 21 is connected only to the Internet 26, and unlike the case of the mobile phone 20, the dedicated line 34. No authentication key is sent via.
[0068]
Further, an ID and a password are often required as an identifier for user authentication. This is because a personal computer is usually provided with a keyboard, so that a user can easily input an ID and a password, but user authentication is performed more reliably.
[0069]
In the process when receiving user authentication from the personal computer 21, the conversion device 23 receives the authentication key, as in the case where the user terminal is a mobile phone, and grants a connection permission and an IP address for the authentication key, and personal IP address distribution to the computer 21 is performed. The authentication key is converted into a protocol and transmitted to the IP address filtering device 28 via the Internet 26. At this time, since the IP address is not the same as that included in the IP address filtering table, the IP address is transmitted to the user authentication apparatus 30 via the LAN 36. That is, in the IP address filtering table in the IP address filtering device, the IP address pooled in the conversion device 24 is recorded, and the IP address pooled in one conversion device 23 is recorded. This is because the authentication key originating from the personal computer is not subject to the operation of not transmitting (prohibited) by the IP address filtering device 28.
[0070]
As described above, in the present embodiment, when the mobile phone 20 is a user terminal, unauthorized use due to impersonation is prevented by transmitting an authentication key or the like via the dedicated line 34. When 21 is a user terminal, the authentication key is not transmitted via the dedicated line 34. This is because, as described above, in the case of a mobile phone, an authentication key transmitted for user authentication is relatively easy to forge like a subscriber ID or IP address. Therefore, the embodiment is not limited to this. For example, even in the case of other terminal devices that are likely to be used illegally by impersonation due to the fact that the authentication key used is easy to forge, the user authentication is received from the mobile phone 20 in this embodiment. Unauthorized use can be prevented by adopting a configuration similar to that in the case.
[0071]
(9) Processing when updating the recorded contents of the IP address filtering table of the IP address filtering device 28
FIG. 8 shows a process when the recorded contents of the IP address filtering table of the IP address filtering device 28 are updated. When the telephone number transmitted from the mobile phone 20 is updated such that the IP address assigned by the conversion device 24 is increased or decreased, the IP address pooled by the conversion device 24 is updated ( Step S50). Then, the updated IP address data is transmitted to the IP address filtering device 28 via the dedicated line 34 and the LAN 36 by the hard disk program of the conversion device 24 (step S51), and the updated IP address data is received. The IP address filtering device 28 updates the contents of the IP address filtering table (step S52).
[0072]
Therefore, not only when the authentication key that the IP address filtering device 28 does not transmit to the user authentication device 30 is newly set, but also when various items with different mobile phone specifications are newly added or reduced, The contents stored in the IP address filtering table can be updated easily and quickly.
[0073]
Further, since the updated IP address data is transmitted to the IP address filtering device 28 only through the dedicated line 34 and the LAN 36, the safety of the data is ensured. That is, when the updated IP address flows on the Internet 26, the third party who has acquired the IP address operates the unauthorized use terminal 25 to change the data, etc. However, according to the present embodiment, there is no such danger.
[Brief description of the drawings]
FIG. 1 is a diagram showing a conventional user authentication system.
FIG. 2 is a diagram illustrating a user authentication system according to an embodiment of the present invention.
FIG. 3 is a diagram illustrating a hardware configuration of a personal computer as a user terminal.
FIG. 4 is a diagram illustrating a hardware configuration of an IP address filtering device.
FIG. 5 is a block diagram of a mobile phone as a user terminal.
FIG. 6 is a diagram showing processing when receiving user authentication.
FIG. 7 is a diagram showing the contents of an IP address filtering table.
FIG. 8 is a diagram showing processing when updating the recorded contents of the IP address filtering table of the IP address filtering device.
[Explanation of symbols]
20 ... Mobile phone
21 ... Personal computer
23, 24 ... Conversion device
28 ... IP address filtering device
30: User authentication device
32. Service providing device
38 ... Management Center
29 ... Router
22 ... Telephone network
26 ... Internet
34 ... Dedicated line
36 ... LAN
25 ... Unauthorized terminal

Claims (8)

Terminal device,
An identification information adding device connected to the terminal device via a dedicated line;
An identification information selection transmission device connected to the identification information addition device via a communication path;
A user authentication device connected to the identification information adding device via a dedicated line and also connected to the identification information selecting / transmitting device via a dedicated line;
A user authentication system comprising:
The terminal device
User information transmission means for transmitting user information to the identification information adding device,
The identification information adding device
Identification information adding means for adding identification information to user information transmitted from the terminal device;
A user identification information transmitting unit via a communication path for transmitting the user identification information obtained by the identification information adding unit to the identification information selection transmitting device via the communication path;
A dedicated line user identification information transmitting means for transmitting the user identification information to the user authentication device via a dedicated line;
The identification information selection transmission device
User identification information including identification information added by the identification information adding apparatus is not transmitted to the user authentication apparatus, but user identification information including identification information other than the identification information is transmitted to the user authentication apparatus. Comprising information selection transmission means,
User authentication device
User authentication means for receiving user identification information transmitted from the identification information adding device or the identification information selecting / transmitting device via a dedicated line and performing user authentication;
A user authentication system comprising: The identification information adding device according to claim 1, further comprising:
A transmission via selection means for selecting whether to transmit user identification information to an identification information selection transmission device via a communication path or to a user authentication device via a dedicated line;
Characterized by comprising. In the identification information selection transmission device connected to the identification information adding device via a communication path and connected to the user authentication device via a dedicated line,
User identification information including identification information added by the identification information adding apparatus is not transmitted to the user authentication apparatus, but user identification information including identification information other than the identification information is transmitted to the user authentication apparatus. Information selection transmission means,
An identification information selecting / transmitting apparatus comprising: In the identification information selection transmission device according to any one of claims 1 to 3,
A storage unit storing identification information added by the identification information adding device;
With
The identification information selection transmission means selects user identification information to be transmitted to the user authentication device and user identification information not to be transmitted by referring to the storage unit. In the user authentication system of claim 4,
When the identification information added by the identification information addition device is updated,
The identification information adding device further includes:
The update identification information transmitting means for transmitting the updated identification information to the identification information selection transmission device via a dedicated line,
The identification information selection transmission device further includes:
Selective transmission identification information updating means for performing update of the storage unit based on the transmitted update identification information;
A user authentication system comprising: In the user authentication system according to any one of claims 1 to 5,
A user authentication system, wherein an identification information selection transmission device and a user authentication device are configured as an integrated device. In Claims 1-6,
The identification information is an IP address. A user authentication method for authenticating a user of a terminal device by a user authentication device connected to the terminal device,
When the terminal device receives user authentication,
Add identification information to the user information from the terminal device and send it to the user authentication device via the communication path or dedicated line,
The user information having the identification information sent via the communication path is not sent to the user authentication device, and the user information sent via the dedicated line is sent to the user authentication device,
A user authentication device is a user authentication method for performing user authentication based on the user information sent via a dedicated line.

Images