JP4976470B2 - Authentication server, authentication system, and authentication method - Google Patents

Description

  The present invention relates to an authentication server, an authentication system, and an authentication method capable of logging in to a website without inputting a user ID and password using a mobile terminal.

  When a user uses a general information terminal or website provided with an authentication system, an input of an authentication request including a user ID such as an account and a password is accepted, and the request and a pre-registered user ID and The use of the password is determined by checking the password set. When the use is permitted, the user can use a terminal or a website on which information and settings related to the user are reflected.

  With such an authentication method, there is a possibility that the user forgets his / her ID or password or that information is hacked. When user authentication is performed on a plurality of websites linked to each other, such as a website for a personal computer and a website for a mobile terminal linked to the website, a user ID and a password are input at each terminal. It is necessary and the operation becomes complicated.

  There is a communication system described in Patent Document 1 below regarding a method of avoiding input of a user ID and a password. In this system, first, a terminal device receives information specifying a device to be remotely operated, adds customer information of the terminal device to the specified information, and transmits the information to the server device. Subsequently, the server device extracts device control information corresponding to the specific information based on the customer information, and transmits the control information to the terminal device. This makes it possible to control the device using the terminal device without inputting a user ID or password.

JP 2003-102078 A

  I would like to introduce the technique of the above-mentioned patent document 1 to the control of the website as described above. However, even if information specifying the device or customer information is sent to the web server, the web server must grasp the page that the user is browsing or identify the connection between the server and the terminal. I can't. Therefore, even if user authentication is performed, there is a problem in that a web page after login that maintains continuity with the web page before login cannot be displayed to the user.

  SUMMARY An advantage of some aspects of the invention is that it provides an authentication server, an authentication system, and an authentication method that enable a user to log into a website safely and easily.

The authentication system of the present invention includes an authentication server, a communication terminal, and a mobile terminal, and the authentication server transmits a connection ID for identifying a network connection with the communication terminal to the communication terminal, and the mobile terminal. Acquires a server-side storage unit that stores an identifier to be identified, an identifier stored in a mobile terminal or another information processing apparatus, and a connection ID that is transmitted by the first transmission unit and transferred from the communication terminal to the mobile terminal. The authentication means for determining whether or not the identifier read from the server-side storage means and the identifier acquired by the acquisition means match, and the authentication means determines that the identifiers match. Control information generating means for generating control information processed by at least one of the terminal and the mobile terminal based on the connection ID acquired by the acquiring means; The control information generated by, with a second transmission means for transmitting at least one of the communication terminal and a mobile terminal, the identifier is a subscriber identifier for specifying a subscriber of the portable terminal, a communication terminal, the The first receiving means for receiving the connection ID transmitted by the one transmitting means, the transferring means for transferring the connection ID received by the first receiving means to the portable terminal, and the control information transmitted by the second transmitting means are received. A second receiving means for receiving the connection ID transferred by the transferring means; a portable storage means for storing a subscriber identifier; and a third receiving means for receiving the connection ID. A third transmitting means for transmitting the connection ID and the subscriber identifier read from the portable storage means to the authentication server, and a fourth receiving means for receiving the control information transmitted by the second transmitting means. Acquisition means acquires the transmitted connection ID and the subscriber identifier by a third transmission means.

  An authentication method of the present invention is an authentication method executed by an authentication system including an authentication server, a communication terminal, and a mobile terminal, and the authentication server assigns a connection ID for identifying a network connection with the communication terminal to the communication terminal. A first transmission step for transmission, a first reception step for the communication terminal to receive the connection ID transmitted in the first transmission step, and a communication terminal for transferring the connection ID received in the first reception step to the portable terminal A transfer step, a second reception step in which the mobile terminal receives the connection ID transferred in the transfer step, a read-out from the storage means of the mobile terminal, the connection ID received in the second reception step by the mobile terminal A second transmission step of transmitting a subscriber identifier for identifying the subscriber of the mobile terminal to the authentication server; and the authentication server includes a second transmission step. The acquisition step of acquiring the connection ID and the subscriber identifier transmitted in the authentication step matches the subscriber identifier read by the authentication server from the storage means of the authentication server and the subscriber identifier acquired in the acquisition step. An authentication step for determining whether or not, and when the authentication server determines that the subscriber identifiers match in the authentication step, obtains control information to be processed in at least one of the communication terminal and the portable terminal in the acquisition step A generation step that is generated based on the connection ID, a third transmission step in which the authentication server transmits the control information generated in the generation step to at least one of the communication terminal and the portable terminal, and the communication terminal and the portable terminal. A third receiving step in which at least one receives the control information transmitted in the third transmitting step; Characterized in that it comprises a.

  According to such an invention, the connection ID indicating the connection between the communication terminal and the authentication server is transmitted to the mobile terminal via the communication terminal, and the subscriber identifier necessary for authentication is transmitted from the mobile terminal to the connection ID. And sent to the authentication server. Then, in the authentication server, an authentication process using the subscriber identifier is executed, and control information is generated. Accordingly, authentication can be realized without requiring the user to input a user ID and a password. Further, since the control information is generated and transmitted based on the connection ID, it is possible to provide the communication terminal or the mobile terminal with the control information that maintains continuity with the connection before authentication. As a result, the user can log into the website safely and easily.

The authentication system of the present invention includes an authentication server, a communication terminal, a mobile terminal, and a conversion server, and the authentication server transmits a connection ID for identifying a network connection with the communication terminal to the communication terminal; Server-side storage means for storing an identifier for identifying the portable terminal, an identifier stored in the portable terminal or other information processing apparatus, and a connection ID transmitted from the communication terminal to the portable terminal by the first transmission means The authentication means for determining whether or not the identifier read from the server-side storage means and the identifier acquired by the acquisition means match, and the authentication means determines that the identifiers match And control information generating means for generating control information processed by at least one of the communication terminal and the portable terminal based on the connection ID acquired by the acquiring means, The control information generated by the information generating means, and second transmission means for transmitting at least one of the communication terminal and a mobile terminal, comprising a, identifier, another different from the subscriber identifier that identifies the subscriber of the mobile terminal A first receiving means for receiving the connection ID transmitted by the first transmitting means, a transfer means for transferring the connection ID received by the first receiving means to the portable terminal, and a second transmission. Second receiving means for receiving control information transmitted by the means, third receiving means for receiving the connection ID transferred by the transferring means, and portable storage means for storing the subscriber identifier And the third transmission means for transmitting the connection ID received by the third reception means and the subscriber identifier read from the portable storage means to the conversion server, and the control information transmitted by the second transmission means A fourth receiving means for receiving, a conversion server receiving a connection ID and a subscriber identifier transmitted by the third transmitting means, and a subscriber identifier received by the fifth receiving means. Conversion means for converting to another identifier; fourth transmission means for transmitting the connection ID received by the fifth receiving means and another identifier converted by the conversion means to the authentication server; The connection ID and another identifier transmitted by the fourth transmission unit are acquired.

  An authentication method of the present invention is an authentication method executed by an authentication system including an authentication server, a communication terminal, a portable terminal, and a conversion server, wherein the authentication server assigns a connection ID for identifying a network connection with the communication terminal. A first transmitting step for transmitting to the communication terminal; a first receiving step for receiving the connection ID transmitted in the first transmitting step; and a communication terminal carrying the connection ID received in the first receiving step. A transfer step of transferring to the terminal; a second reception step in which the portable terminal receives the connection ID transferred in the transfer step; a connection ID received by the portable terminal in the second reception step; and storage of the portable terminal A second transmission step of transmitting to the conversion server a subscriber identifier that identifies the subscriber of the mobile terminal read from the means; A third receiving step for receiving the connection ID and the subscriber identifier transmitted in the second transmitting step; and the conversion server determines the subscriber identifier received in the third receiving step as another identifier different from the subscriber identifier. A conversion step of converting to the authentication server, a third transmission step in which the conversion server transmits the connection ID received in the third reception step and another identifier converted in the conversion step to the authentication server; 3. The acquisition step of acquiring the connection ID and another identifier transmitted in the transmission step, the other identifier read out from the storage means of the authentication server by the authentication server, and the other identifier acquired in the acquisition step match The authentication step for determining whether or not to perform the authentication and the authentication server determines that another identifier matches in the authentication step In addition, a generation step of generating control information processed in at least one of the communication terminal and the mobile terminal based on the connection ID acquired in the acquisition step, and an authentication server generates the control information generated in the generation step. A fourth transmission step for transmitting to at least one of the communication terminal and the portable terminal; and a fourth reception step for receiving at least one of the communication terminal and the portable terminal for the control information transmitted in the fourth transmission step. Features.

  According to such an invention, the connection ID indicating the connection between the communication terminal and the authentication server is transmitted to the mobile terminal via the communication terminal, and the subscriber identifier necessary for authentication is transmitted from the mobile terminal to the connection ID. First, it is sent to the conversion server. Subsequently, in the conversion server, the subscriber identifier is converted into another identifier different from the personal information such as the subscriber identifier and other subscriber information, and the converted identifier is sent to the authentication server together with the connection ID. Then, in the authentication server, an authentication process using the converted identifier is executed, and control information is generated. Accordingly, authentication can be realized without requiring the user to input a user ID and a password. Further, since the control information is generated and transmitted based on the connection ID, it is possible to provide the communication terminal or the mobile terminal with the control information that maintains continuity with the connection before authentication. Furthermore, by not providing a subscriber identifier corresponding to personal information to the authentication server, the range in which the personal information spreads can be suppressed to a narrow range. As a result, the user can log into the website safely and easily.

In the authentication system of the present invention, the authentication server further includes a web page generation unit that generates a web page in which the connection ID is embedded, and the first transmission unit transmits the web page generated by the web page generation unit. Is preferred.

  In this case, since the connection ID is embedded in the web page before the authentication process and sent to the communication terminal, the communication procedure can be simplified as compared with the case where the connection ID itself is transmitted separately.

  According to such an authentication server, an authentication system, and an authentication method, control is performed without requiring the user to input a user ID, a password, etc., and continuity with the connection before authentication is maintained. Is provided to the communication terminal or the portable terminal, the user can log into the website safely and easily.

It is a block diagram which shows the function structure of the authentication system which concerns on 1st Embodiment. It is a figure which shows the hardware constitutions of the authentication server shown in FIG. It is a figure which shows the hardware constitutions of the portable terminal shown in FIG. It is a sequence diagram which shows operation | movement of the authentication system shown in FIG. It is a block diagram which shows the function structure of the authentication system which concerns on 2nd Embodiment. It is a sequence diagram which shows operation | movement of the authentication system shown in FIG.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the description of the drawings, the same or equivalent elements are denoted by the same reference numerals, and redundant description is omitted.

(First embodiment)
First, the function and configuration of the authentication system 1 according to the first embodiment will be described with reference to FIGS. FIG. 1 is a block diagram showing a functional configuration of the authentication system 1. FIG. 2 is a diagram illustrating a hardware configuration of the authentication server 10. FIG. 3 is a diagram illustrating a hardware configuration of the mobile terminal 30.

  The authentication system 1 includes an authentication server 10, a personal computer (PC) 20, and a portable terminal 30. It is assumed that the PC 20 and the mobile terminal 30 are managed by the same user. These devices can communicate with each other via a predetermined network (not shown). As the network, for example, a network including a mobile communication network, the Internet, an intranet, and the like can be considered, but the configuration of the network is arbitrary.

  The authentication server 10 is a computer that performs user authentication and provides predetermined information to the PC 20 or the portable terminal 30. As shown in FIG. 1, the authentication server 10 includes, as functional components, a network interface (transmission unit, acquisition unit) 11, a web function unit (web page generation unit) 12, a connection ID management unit 13, an authentication unit (server Side storage means, authentication means) 14 and a control information generation unit (control information generation means) 15.

  As shown in FIG. 2, the authentication server 10 includes a CPU 101 that executes an operating system, application programs, and the like, a main storage unit 102 that includes a ROM and a RAM, an auxiliary storage unit 103 that includes a hard disk, and the like. The communication control unit 104 includes a network card, the input unit 105 such as a keyboard, a mouse, and a touch panel, and the output unit 106 such as a touch panel and a speaker. Each function of the authentication server 10 shown in FIG. 1 reads predetermined software on the CPU 101 and the main storage unit 102, operates the communication control unit 104 under the control of the CPU 101, and operates the main storage unit 102 and the auxiliary storage unit. This is realized by reading and writing data at 103. Databases and data necessary for processing are stored in the main storage unit 102 and the auxiliary storage unit 103.

  Returning to FIG. 1, the network interface 11 is a part that transmits and receives data to and from the PC 20 or the portable terminal 30 via the network.

  First, the network interface 11 receives a web page request from the PC 20 and outputs it to the web function unit 12. Here, the web page request is a signal transmitted from the PC 20 to the authentication server 10 in order to obtain a predetermined web page. Thereafter, when the web page generated in response to the web page request is input from the web function unit 12, the network interface 11 transmits the web page to the PC 20.

  Further, the network interface 11 receives the connection ID and the subscriber identifier from the portable terminal 30 and outputs the connection ID to the control information generation unit 15 and the subscriber identifier to the authentication unit 14. Although the connection ID and the subscriber identifier will be described in detail later, the connection ID received here is one that has been issued by the authentication server 10 and returned via the PC 20 and the portable terminal 30. Thereafter, the network interface 11 transmits the control information generated by the control information generation unit 15 to at least one of the PC 20 and the portable terminal 30.

  The web function unit 12 is a part that provides a web page to the PC 20. When a web page request is input, the web function unit 12 pays out a connection ID for identifying a connection between the authentication server 10 and the PC 20 started at the request timing, and outputs the connection ID to the connection ID management unit 13. . The web function unit 12 outputs a web page in which the connection ID is embedded to the network interface 11. The web page output here is, for example, a login screen displayed before the user of the PC 20 and the mobile terminal 30 logs in. The web page may be generated by the web function unit 12 or may be generated by another web server (not shown) and sent to the authentication server 10.

  The connection ID management unit 13 is a part that stores the connection ID input from the web function unit 12.

  The authentication unit 14 is a part that authenticates the user. For this purpose, the authentication unit 14 includes a database in which a list of subscriber identifiers is stored in advance, and performs authentication by comparing the entered subscriber identifier with the subscriber identifier in the database. If both identifiers match, authentication succeeds, and if they do not match, authentication fails. The authentication unit 14 transmits the input subscriber identifier to the control information generation unit 15 when the authentication is successful, and notifies the portable terminal 30 via the network interface 11 when the authentication fails. Send.

  The control information generation unit 15 is a part that generates information (control information) for controlling at least one of the PC 20 and the mobile terminal 30. When a subscriber identifier is input from the authentication unit 14 and a connection ID is input from the network interface 11, the control information generation unit 15 first reads the connection ID from the connection ID management unit 13 and compares the two connection IDs. To do. If both connection IDs match, the control information generation unit 15 generates control information based on the connection ID and the subscriber identifier.

  The content of the control information generated here is not limited at all. For example, as one of the control information, there is a web page after login (after authentication) that is a screen following the login screen and displayed on at least one of the PC 20 and the mobile terminal 30. When the control information is a web page, the generated web page is transmitted from the network interface 11 via the web function unit 12. Another example of the control information is control information for a program that is executed by at least one of the PC 20 and the portable terminal 30. In this case, the generated control information is directly output to the network interface 11 and transmitted from there.

  Next, the PC 20 will be described. The PC 20 is a communication terminal having a web browser function and the like, and includes a network interface (reception unit) 21, a connection ID transmission unit (transfer unit) 22, and an execution unit 23 as functional components. The hardware configuration of the PC 20 is the same as that of the authentication server 10 shown in FIG. 2, and the authentication server also shows how each function of the PC 20 shown in FIG. 1 is executed using hardware resources. 10 is the same as that described above.

  The network interface 21 is a part that transmits and receives data to and from the authentication server 10 via the network. Specifically, the network interface 21 transmits a web page request to the authentication server 10 based on an input instruction of a user of the PC 20 or an instruction of a predetermined application program, and is sent from the authentication server 10 in response to the request. Receive incoming web pages. Subsequently, the network interface 21 outputs the received web page to the execution unit 23 and outputs the received connection ID to the connection ID transmission unit 22.

  The connection ID transmission unit 22 is a part that transmits (transfers) the input connection ID to the portable terminal 30. The connection ID transmission method is arbitrary. For example, the connection ID transmission unit 22 may transmit the input connection ID as it is by predetermined wireless communication, or may be transmitted after being embedded in an audio signal or an image (moving image or still image) signal. Alternatively, the connection ID transmission unit 22 may convert the connection ID into a barcode and display the barcode on the screen of the PC 20. When the barcode is displayed, the mobile terminal 30 needs to actively acquire the connection ID as will be described later. Moreover, the connection ID transmission part 22 may transmit URL of the website which the portable terminal 30 is going to access with connection ID. The connection ID transmission method may be determined by the PC 20 or the authentication server 10.

  The execution unit 23 is a part that executes predetermined processing based on the control information received from the authentication server 10. For example, if the control information is a web page, the execution unit 23 updates the screen on the web browser using the web page. If the control information is for an application program running on the portable terminal 30, the execution unit 23 controls the operation of the program using the control information.

  Next, the mobile terminal 30 will be described. The mobile terminal 30 is a mobile communication terminal having a call function, an e-mail function, a web browser function, etc., and as a functional component, a subscriber identifier storage unit (portable side storage unit) 31, a connection ID acquisition unit (reception unit) 32, A network interface (reception unit, transmission unit) 33 and an execution unit 34 are provided.

  As shown in FIG. 3, the portable terminal 30 includes a CPU 301 that executes an operating system, application programs, and the like, a main storage unit 302 that includes a ROM and a RAM, and an auxiliary storage unit that includes a memory and the like. 303, a communication control unit 304 that performs data communication, a display unit 305 including a liquid crystal monitor, and an operation unit 306 including input keys. Each function of the portable terminal 30 shown in FIG. 1 reads a predetermined program on the CPU 301 and the main storage unit 302 and operates the communication control unit 304, the display unit 305, and the operation unit 306 under the control of the CPU 301. This is realized by reading or writing data to the main storage unit 302 or the auxiliary storage unit 303. Databases and data necessary for processing are stored in the main storage unit 302 and the auxiliary storage unit 303.

  The subscriber identifier storage unit 31 is a part that stores a subscriber identifier that identifies the mobile terminal. The subscriber identifier is given when the user purchases the mobile terminal 30 and is written in the subscriber identifier storage unit 31. Examples of the subscriber identifier include a mobile subscriber number (MSN).

  The connection ID acquisition unit 32 is a part that acquires a connection ID from the PC 20. The connection ID acquisition unit 32 has an acquisition function according to the transmission method of the connection ID transmission unit 22 of the PC 20. That is, if the connection ID transmission unit 22 transmits the connection ID as it is by predetermined wireless communication, the connection ID acquisition unit 32 receives the connection ID according to the communication method. When the connection ID transmission unit 22 embeds a connection ID in an audio signal or an image signal and transmits the connection ID, the connection ID acquisition unit 32 receives and extracts the connection ID using a corresponding decoding function of the watermark algorithm. When the connection ID transmission unit 22 displays the connection ID with a barcode, the connection ID acquisition unit 32 acquires the connection ID using a barcode reading function (camera) and a decoding function. The connection ID acquisition unit 32 outputs the acquired connection ID to the network interface 33.

  The network interface 33 is a part that transmits and receives data to and from the authentication server 10 via the network. Specifically, when the connection ID is input, the network interface 33 reads the subscriber identifier from the subscriber identifier storage unit 31 and transmits the connection ID and the subscriber identifier to the authentication server 10. Further, the network interface 33 receives control information sent from the authentication server 10 and outputs it to the execution unit 34.

  The execution unit 34 is a part that executes predetermined processing based on the control information received from the authentication server 10. For example, if the control information is a web page, the execution unit 34 updates the screen on the web browser using the web page. If the control information is for an application program running on the portable terminal 30, the execution unit 34 controls the operation of the program using the control information.

  Next, the operation of the authentication system 1 shown in FIG. 1 will be described using FIG. 4 and the authentication method according to the present embodiment will be described. FIG. 4 is a sequence diagram showing the operation of the authentication system 1.

  Below, it demonstrates on the assumption that the subscriber identifier allocated at the time of contract of the portable terminal 30 is memorize | stored in the subscriber identifier memory | storage part 31 (step S100). First, the PC 20 transmits a web page request to the authentication server 1 (step S101).

  Subsequently, the authentication server 10 starts a connection with the PC 20 based on the request, and pays out a connection ID for the connection (step S102). Then, the authentication server 10 transmits the web page in which the connection ID is embedded to the PC 20 (step S103, first transmission step).

  Subsequently, the connection ID received by the PC 20 is transmitted to the portable terminal 30 (step S104, transfer step). The connection ID transmission method is arbitrary as described above.

  Subsequently, when the mobile terminal 30 receives the connection ID, the subscriber identifier is read (step S105), and the connection ID and the subscriber identifier are transmitted to the authentication server 10 (step S106, second transmission step).

  Subsequently, an authentication process is executed by comparing the subscriber identifier received by the authentication server 10 with a subscriber identifier held in advance (step S107, authentication step). Control information is generated based on the identifier and the terminal ID (step S108, generation step). Then, the authentication server 10 transmits the control information to at least one of the PC 20 and the portable terminal 30 (steps S109 and S110, third transmission step).

  When receiving the control information, the PC 20 executes a process based on the information (step S111). Similarly, when the mobile terminal 30 receives the control information, the mobile terminal 30 executes a process based on the information (step S111).

  As described above, according to the first embodiment, the connection ID indicating the connection between the PC 20 and the authentication server 10 is transmitted to the portable terminal 30 via the PC 20 and is necessary for authentication from the portable terminal 30. A new subscriber identifier is sent to the authentication server 10 together with the connection ID. Then, in the authentication server 10, an authentication process using a subscriber identifier is executed, and control information is generated. Accordingly, authentication can be realized without requiring the user to input a user ID and a password. Further, since control information is generated and transmitted based on the connection ID, control information that maintains continuity with the connection before authentication can be provided to the PC 20 or the portable terminal 30. As a result, the user can log into the website safely and easily.

  Further, since the connection ID is embedded in the web page before the authentication process and sent to the PC 20, the communication procedure can be simplified as compared with the case where the connection ID itself is transmitted separately.

(Second Embodiment)
Next, the function and configuration of the authentication system 2 according to the second embodiment will be described with reference to FIG. FIG. 5 is a block diagram showing functions and configuration of the authentication system 2 according to the second embodiment.

  As shown in FIG. 5, the authentication system 2 includes a conversion server 70 in addition to the authentication server 40, the PC 50, and the mobile terminal 60. Conversion server 70 can communicate with authentication server 40 and portable terminal 60 via a network (not shown). Below, a different point from 1st Embodiment is demonstrated in detail, and description is abbreviate | omitted about the same point.

  First, the PC 50 will be described. The PC 50 includes a network interface (reception unit) 51, a connection ID transmission unit (transfer unit) 52, and an execution unit 53 as functional components. The functions of the network interface 51, the connection ID transmission unit 52, and the execution unit 53 are the same as those of the network interface 21, the connection ID transmission unit 22, and the execution unit 23 in the first embodiment, respectively.

  Next, the mobile terminal 60 will be described. The portable terminal 60 includes a subscriber identifier storage unit (portable storage unit) 61, a connection ID acquisition unit (reception unit) 62, a network interface (reception unit, transmission unit) 63, and an execution unit 64 as functional components. I have. The functions of the subscriber identifier storage unit 61, the connection ID acquisition unit 62, and the execution unit 64 are the same as those of the subscriber identifier storage unit 31, the connection ID acquisition unit 32, and the execution unit 34 in the first embodiment, respectively. is there. On the other hand, the network interface 63 differs from the network interface 33 in the first embodiment in the following points.

  The network interface 63 is a part that transmits / receives data to / from the authentication server 40 or the conversion server 70 via the network. Specifically, the network interface 63 transmits the connection ID received from the PC 50 and the read subscriber identifier to the conversion server 70 instead of the authentication server 40. On the other hand, for reception of control information, the network interface 63 performs the same processing as the network interface 33.

  Next, the conversion server 70 will be described. The conversion server 70 is a computer that sends another identifier to the authentication server 40 instead of the subscriber identifier received from the mobile terminal 60. The conversion server 70 includes a network interface (reception unit, transmission unit) 71 and an identifier conversion unit (conversion unit) 72 as functional components. The hardware configuration of the conversion server 70 is the same as that of the authentication server 10 shown in FIG. 2, and how each function of the conversion server 70 shown in FIG. 5 is executed using hardware resources. This is the same as that described for the authentication server 10.

  The network interface 71 is a part that transmits / receives data to / from the portable terminal 60 or the authentication server 40 via the network. The network interface 71 receives the connection ID and the subscriber identifier from the portable terminal 60, and outputs the connection ID to the identifier conversion unit 72. Thereafter, the network interface 71 transmits the converted identifier input from the identifier converting unit 72 and the held connection ID to the authentication server 40.

  The identifier conversion unit 72 is a part that converts the input subscriber identifier into another identifier (converted identifier) that does not correspond to the user's personal information. The converted identifier is identification information different from information that can specify the attributes of the mobile terminal and its user, such as a subscriber identifier, and is, for example, a UID (user ID). The identifier conversion unit 72 includes a database that stores a correspondence relationship between the subscriber identifier and the converted identifier, and extracts the converted identifier with reference to the database. Then, the identifier conversion unit 72 outputs the converted identifier to the network interface 71.

  Next, the authentication server 40 will be described. The authentication server 40 includes a network interface (transmission unit, acquisition unit) 41, a web function unit (web page generation unit) 42, a connection ID management unit 43, and an authentication unit (server side storage unit, authentication unit) as functional components. ) 44 and a control information generation unit (control information generation means) 45.

  The network interface 41 is a part that transmits / receives data to / from the PC 50, the portable terminal 60, or the conversion server 70 via the network. Here, communication with the conversion server 70 not included in the first embodiment will be described.

  The network interface 41 receives the connection ID and the converted identifier from the conversion server 70, and outputs the connection ID to the control information generating unit 45 and the converted identifier to the authenticating unit 44, respectively. Thereafter, the network interface 41 transmits the control information generated by the control information generation unit 45 to at least one of the PC 50 and the portable terminal 60.

  The function of the web function unit 42 is the same as that of the web function unit 12 in the first embodiment. The function of the connection ID management unit 43 is the same as that of the connection ID management unit 13 in the first embodiment.

  The authentication unit 44 is a part that authenticates the user. For this purpose, the authentication unit 44 includes a database in which a list of converted identifiers is stored in advance, and performs authentication by comparing the input converted identifier with the converted identifier in the database. If the two converted identifiers match, authentication succeeds, and if they do not match, authentication fails. The authentication unit 44 transmits the input converted identifier to the control information generation unit 45 when the authentication is successful, and notifies the portable terminal 60 via the network interface 41 when the authentication fails. Send.

  The control information generating unit 45 is a part that generates information (control information) for controlling at least one of the PC 50 and the portable terminal 60. When the converted identifier is input from the authentication unit 44 and the connection ID is input from the network interface 41, the control information generation unit 45 first reads the connection ID from the connection ID management unit 43 and compares the two connection IDs. To do. If both connection IDs match, the control information generation unit 45 generates control information based on the connection ID and the converted identifier. The contents of the generated control information and the control information transmission method are the same as those in the first embodiment.

  Next, the operation of the authentication system 2 shown in FIG. 5 will be described using FIG. 6 and the authentication method according to the present embodiment will be described. FIG. 6 is a sequence diagram showing the operation of the authentication system 2.

  Below, it demonstrates on the assumption that the subscriber identifier allocated at the time of contract of the portable terminal 60 is memorize | stored in the subscriber identifier memory | storage part 61 (step S200). First, the processes in steps S201 to S205 in FIG. 6 are the same as the processes in steps S101 to S105 in FIG. In subsequent step S206, the portable terminal 60 transmits the connection ID and the subscriber identifier to the conversion server 70 instead of the authentication server 40 (second transmission step).

  Subsequently, the conversion server 70 converts the subscriber identifier into another identifier not corresponding to the user's personal information (step S207, conversion step), and transmits the connection ID and the converted identifier to the authentication server 40 (step S208, Third transmission step).

  Subsequently, an authentication process is executed by comparing the converted identifier received by the authentication server 40 with the converted identifier held in advance (step S209, authentication step). Control information is generated based on the identifier and the terminal ID (step S210, generation step). The processing of steps S211 to S214 performed thereafter is the same as the processing of steps S109 to S112 in FIG.

  As described above, according to the second embodiment, the same effect as that of the first embodiment can be obtained, and the range in which the personal information is expanded by not providing the authentication server 40 with the subscriber identifier corresponding to the personal information. Can be kept within a narrow range. As a result, the user can log into the website safely and easily.

  The present invention has been described in detail based on the embodiments. However, the present invention is not limited to the above embodiment. The present invention can be variously modified without departing from the gist thereof.

  In the above embodiments, the PCs 20 and 50 are illustrated as communication terminals, but the type of communication terminal is not limited, and the present invention may be applied to any information processing terminal. Further, the specific types of the mobile terminals 30 and 60 in the above embodiments are not limited, and the present invention may be applied to any terminal such as a mobile phone or a personal digital assistant (PDA).

  DESCRIPTION OF SYMBOLS 1, 2 ... Authentication system 10, 40 ... Authentication server 11, 41 ... Network interface (transmission means, acquisition means) 12, 42 ... Web function part (web page generation means), 13, 43 ... Connection ID Management unit 14, 44 ... Authentication unit (server-side storage unit, authentication unit), 15, 45 ... Control information generation unit (control information generation unit), 20, 50 ... PC (communication terminal), 21, 51 ... Network Interface (reception unit), 22, 52 ... Connection ID transmission unit (transfer unit), 23, 53 ... Execution unit, 30, 60 ... Mobile terminal, 31, 61 ... Subscriber identifier storage unit (mobile side storage unit), 32, 62 ... connection ID acquisition unit (reception unit), 33, 63 ... network interface (reception unit, transmission unit), 34, 64 ... execution unit, 70 ... conversion server, 71 ... network interface Tafeisu (receiving means, transmitting means), 72 ... identifier conversion unit (conversion means).

Claims (5)

An authentication server , a communication terminal, and a portable terminal;
The authentication server is
First transmission means for transmitting a connection ID for identifying a network connection with the communication terminal to the communication terminal;
Server-side storage means for storing an identifier for identifying the portable terminal;
Obtaining means for obtaining the identifier stored in the portable terminal or other information processing apparatus and the connection ID transmitted from the communication terminal to the portable terminal, transmitted by the first transmission means;
Authentication means for determining whether or not the identifier read from the server-side storage means matches the identifier acquired by the acquisition means;
Control information for generating control information processed by at least one of the communication terminal and the portable terminal based on the connection ID acquired by the acquisition unit when the authentication unit determines that the identifiers match. Generating means;
Second transmission means for transmitting control information generated by the control information generation means to at least one of the communication terminal and the portable terminal;
With
The identifier is a subscriber identifier that identifies a subscriber of the mobile terminal;
The communication terminal is
First receiving means for receiving the connection ID transmitted by the first transmitting means;
Transfer means for transferring the connection ID received by the first receiving means to the portable terminal;
Second receiving means for receiving control information transmitted by the second transmitting means;
With
The mobile terminal is
Third receiving means for receiving the connection ID transferred by the transferring means;
Portable storage means for storing the subscriber identifier;
Third transmitting means for transmitting the connection ID received by the third receiving means and the subscriber identifier read from the portable storage means to the authentication server;
Fourth receiving means for receiving the control information transmitted by the second transmitting means;
With
The acquisition unit acquires the connection ID and the subscriber identifier transmitted by the third transmission unit;
Authentication system. An authentication server , a communication terminal , a mobile terminal, and a conversion server;
The authentication server is
First transmission means for transmitting a connection ID for identifying a network connection with the communication terminal to the communication terminal;
Server-side storage means for storing an identifier for identifying the portable terminal;
Obtaining means for obtaining the identifier stored in the portable terminal or other information processing apparatus and the connection ID transmitted from the communication terminal to the portable terminal, transmitted by the first transmission means;
Authentication means for determining whether or not the identifier read from the server-side storage means matches the identifier acquired by the acquisition means;
Control information for generating control information to be processed by at least one of the communication terminal and the portable terminal based on the connection ID acquired by the acquisition unit when the authentication unit determines that the identifiers match. Generating means;
Second transmission means for transmitting control information generated by the control information generation means to at least one of the communication terminal and the portable terminal;
With
The identifier is a different identifier from a subscriber identifier that identifies a subscriber of the mobile terminal;
The communication terminal is
First receiving means for receiving the connection ID transmitted by the first transmitting means;
Transfer means for transferring the connection ID received by the first receiving means to the portable terminal;
Second receiving means for receiving control information transmitted by the second transmitting means;
With
The mobile terminal is
Third receiving means for receiving the connection ID transferred by the transferring means;
Portable storage means for storing the subscriber identifier;
Third transmitting means for transmitting the connection ID received by the third receiving means and the subscriber identifier read from the portable storage means to the conversion server;
Fourth receiving means for receiving the control information transmitted by the second transmitting means;
With
The conversion server is
Fifth receiving means for receiving the connection ID and the subscriber identifier transmitted by the third transmitting means;
Converting means for converting the subscriber identifier received by the fifth receiving means into the other identifier;
Fourth transmission means for transmitting the connection ID received by the fifth reception means and another identifier converted by the conversion means to the authentication server;
With
The acquisition means acquires the connection ID and another identifier transmitted by the fourth transmission means;
Authentication system. The authentication server further comprises web page generation means for generating a web page in which the connection ID is embedded,
The first transmission means transmits the web page generated by the web page generation means;
The authentication system according to claim 1 or 2 . An authentication method executed by an authentication system including an authentication server, a communication terminal, and a mobile terminal,
A first transmission step in which the authentication server transmits a connection ID for identifying a network connection with the communication terminal to the communication terminal;
A first receiving step in which the communication terminal receives the connection ID transmitted in the first transmitting step;
A transfer step in which the communication terminal transfers the connection ID received in the first reception step to the mobile terminal;
A second receiving step in which the portable terminal receives the connection ID transferred in the transferring step;
The mobile terminal transmits to the authentication server the connection ID received in the second receiving step and the subscriber identifier that identifies the subscriber of the mobile terminal read from the storage means of the mobile terminal. Sending step;
An acquisition step in which the authentication server acquires a connection ID and a subscriber identifier transmitted in the second transmission step;
An authentication step in which the authentication server determines whether or not the subscriber identifier read from the storage means of the authentication server matches the subscriber identifier acquired in the acquisition step;
When the authentication server determines that the subscriber identifiers match in the authentication step, the control information processed in at least one of the communication terminal and the mobile terminal is obtained as the connection ID acquired in the acquisition step. A generation step for generating based on
A third transmission step in which the authentication server transmits the control information generated in the generation step to at least one of the communication terminal and the portable terminal;
A third receiving step in which at least one of the communication terminal and the portable terminal receives the control information transmitted in the third transmitting step;
An authentication method comprising: An authentication method executed by an authentication system including an authentication server, a communication terminal, a mobile terminal, and a conversion server,
A first transmission step in which the authentication server transmits a connection ID for identifying a network connection with the communication terminal to the communication terminal;
A first receiving step in which the communication terminal receives the connection ID transmitted in the first transmitting step;
A transfer step in which the communication terminal transfers the connection ID received in the first reception step to the mobile terminal;
A second receiving step in which the portable terminal receives the connection ID transferred in the transferring step;
The mobile terminal transmits to the conversion server the connection ID received in the second receiving step and the subscriber identifier for identifying the subscriber of the mobile terminal read from the storage means of the mobile terminal. Sending step;
A third receiving step in which the conversion server receives the connection ID and the subscriber identifier transmitted in the second transmitting step;
A conversion step in which the conversion server converts the subscriber identifier received in the third reception step into another identifier different from the subscriber identifier;
A third transmission step in which the conversion server transmits the connection ID received in the third reception step and another identifier converted in the conversion step to the authentication server;
An acquisition step in which the authentication server acquires the connection ID and another identifier transmitted in the third transmission step;
An authentication step in which the authentication server determines whether the another identifier read from the storage means of the authentication server matches another identifier acquired in the acquisition step;
When the authentication server determines that the different identifiers match in the authentication step, the control information processed in at least one of the communication terminal and the mobile terminal is obtained as the connection ID acquired in the acquisition step. A generation step for generating based on
A fourth transmission step in which the authentication server transmits the control information generated in the generation step to at least one of the communication terminal and the portable terminal;
A fourth receiving step in which at least one of the communication terminal and the portable terminal receives the control information transmitted in the fourth transmitting step;
An authentication method comprising:

Images