JP5042269B2 - Personal authentication apparatus and method - Google Patents

Description

  The present invention relates to a personal authentication apparatus and method.

  2. Description of the Related Art Conventionally, in transactions on the Internet, it is common to perform identity authentication as to whether or not a user is the identity of the user by using an ID and a password for identifying the user. The user ID and password input for personal authentication are transmitted to a server or the like that manages the user ID and password via a large number of computers constituting the Internet by network communication technology. The server or the like that has received the authentication authenticates the identity, and notifies the other party of the result.

  In this way, on the Internet via a large number of computers, it is possible to steal a user's ID and password in a communication path and impersonate the user himself using the stolen ID and password. The invention of Patent Document 1 is known as an invention that prevents such fraud and authenticates the user himself / herself.

  The user authentication server disclosed in Patent Document 1 includes a storage unit that stores a user authentication code and a confirmation code transmission destination in association with each other, receives an authentication code transmitted from the user terminal, and receives the received authentication The first authentication is performed by comparing the code with the authentication code stored in the storage means, and when the first authentication is successful, the predetermined confirmation code is notified to the corresponding confirmation code transmission destination, A second authentication is performed by receiving a reply code as a response to the confirmation code notification and collating the received reply code with the confirmed confirmation code.

JP 2002-251375 A

  However, providing the second authentication as in the invention of Patent Document 1 in order to ensure the personal authentication is effective in the case of a special transaction or contract, etc. It is cumbersome and impractical to authenticate the person. In order to ensure identity authentication and protect the system, frequently changing passwords and using different passwords for each device is managed so that passwords that change frequently and passwords for each device are not forgotten. It must be hard.

  Therefore, there is a need for an apparatus and method that can authenticate each terminal securely and easily.

  An object of this invention is to provide the apparatus and method which can authenticate each terminal reliably and simply, without using a password.

  The present invention provides the following solutions.

  (1) An authentication management server that performs personal authentication for a user terminal, the terminal identification information of the user terminal, the mobile identification information of the user portable terminal, the URL of the authentication page, and the authentication page Authentication management storage means for storing the access permission status and the terminal identification received with the login request in response to receiving the login request with the terminal identification information from the terminal of the user. Login acceptance means for enabling access to the access status of the authentication page associated with the information, and the authentication information made accessible by the login acceptance means, the mobile identification information from the user's mobile terminal A user authentication unit for performing user authentication of the user in response to an accompanying access; and the user authentication unit Authentication management server, characterized in that it comprises an authentication completion notification means notifies the terminal of the user that it has completed the authentication.

  According to the configuration of (1), the authentication management server according to the present invention includes the terminal identification information of the user terminal, the mobile identification information of the user portable terminal, the URL of the authentication page, and the access to the authentication page. Corresponding to the terminal identification information received along with the login request in response to the reception of the login request accompanied by the terminal identification information from the user's terminal. The access permission status of the attached authentication page is made accessible, and the user authentication is performed in response to the access to the accessible authentication page from the user's mobile terminal with the mobile identification information. The user terminal is notified that the personal authentication has been completed.

  That is, the authentication management server according to the present invention makes it possible to access the authentication page in response to receiving a login request accompanied by terminal identification information from the user's terminal, and the authentication page can be carried from the user's portable terminal. In response to an access with identification information, the user is authenticated and notified to the user terminal. Therefore, the authentication management server according to the present invention has access to the authentication page that can be accessed in response to the login request with the terminal identification information from the user's terminal, from the user's mobile terminal, Since the user authentication is performed, the user authentication can be reliably and easily performed for each terminal by using the portable terminal that is always carried by the user without using a password.

  (2) The authentication management storage unit further stores the user identification information of the user in association with the terminal identification information, and the login reception unit issues a login request accompanied by the user identification information from the user terminal. (1) The access status of the authentication page associated with the terminal identification information associated with the user identification information is made accessible in response to the acceptance. Authentication management server.

  According to the configuration of (2), the authentication management storage means of the authentication management server described in (1) further stores the user identification information of the user in association with the terminal identification information, and the login reception means is the user terminal. In response to accepting a login request accompanied by user identification information, the access permission status of the authentication page associated with the terminal identification information associated with the user identification information is made accessible.

  In other words, the authentication management server described in (1) performs authentication associated with the terminal identification information associated with the user identification information in response to receiving a login request accompanied by the user identification information from the user terminal. Make the page accessible. Therefore, the authentication management server according to the present invention has access to the authentication page that can be accessed in response to a login request accompanied by user identification information from the user's terminal, from the user's mobile terminal, Since user authentication is performed, it is possible to easily perform user authentication for each terminal without using a password, with a mobile terminal that is always carried by the user, and more reliably by confirming the user with the user identification information. it can.

  (3) The authentication management server according to (1) or (2), wherein the authentication management storage unit stores different authentication pages for each terminal identification information of the user terminal. .

  According to the configuration of (3), the authentication management server described in (1) or (2) stores different authentication pages for each terminal identification information of the user's terminal. That is, the authentication management server according to the present invention sets an authentication page that can be accessed in response to a login request from a user terminal as a different authentication page for each user terminal. Therefore, the authentication management server according to the present invention does not use a password, it is easy for a mobile terminal that a user always carries, and more securely by a different authentication page for each terminal of the user. Authentication can be performed.

  (4) Access status management means for making the access status of the authentication page that can be accessed inaccessible with a lapse of a predetermined time since acceptance of the login request is further provided (1) The authentication management server according to any one of (3) to (3).

  According to the configuration of (4), the authentication management server according to any one of (1) to (3) sets an access permission status of the authentication page that can be accessed after a predetermined time has passed since the reception of the login request. Inaccessible. In other words, the authentication management server according to the present invention makes the authentication page accessible according to the login request from the user's terminal inaccessible as a predetermined time elapses from the reception of the login request. Therefore, the authentication management server according to the present invention authenticates each user without using a password, easily by a mobile terminal that is always carried by the user, and more reliably by time management of the authentication page. be able to.

  (5) Authentication management storage means for storing the terminal identification information of the user terminal, the mobile identification information of the user portable terminal, the URL of the authentication page, and the accessibility status of the authentication page in association with each other. A device that authenticates the user's terminal, and that has received the login request with the terminal identification information from the user's terminal, the terminal identification received with the login request The access status of the authentication page associated with the information is made accessible, and the authentication page made accessible is accessed with the mobile identification information from the user's mobile terminal Accordingly, the step of authenticating the user and communicating the completion of the authentication to the user terminal. Method characterized by comprising the steps of, a.

  According to the configuration of (5), the method according to the present invention includes the terminal identification information of the user terminal, the portable identification information of the user portable terminal, the URL of the authentication page, and the accessibility status of the authentication page. And a device comprising an authentication management storage means for storing the information in association with each other, and a method of authenticating the user's terminal, in response to receiving a login request with terminal identification information from the user's terminal, The access permission status of the authentication page associated with the terminal identification information received with the login request is made accessible, and the access to the authentication page made accessible is accompanied by the mobile identification information from the user's mobile terminal. In response to this, the user authentication is performed, and the user terminal is notified that the user authentication has been completed. Therefore, the method according to the present invention can authenticate each terminal securely and easily by a portable terminal that is always carried by the user without using a password.

  ADVANTAGE OF THE INVENTION According to this invention, the apparatus and method which can authenticate each terminal reliably and simply by the portable terminal which a user always carries without using a password can be provided.

It is a block diagram which shows the characteristic of the authentication management server 10 which concerns on one Embodiment of this invention. It is a block diagram which shows the function of the authentication management server 10 which concerns on one Embodiment of this invention. It is a figure which shows an example of the hardware constitutions of the authentication management server 10 which concerns on one Embodiment of this invention. It is a figure which shows authentication management DB21 of the authentication management server 10 which concerns on one Embodiment of this invention. It is a flowchart which shows the process of the authentication management server 10 which concerns on one Embodiment of this invention. It is a figure which shows the example which the user's terminal 50 and the user's portable terminal 60 display under the authentication management server 10 which concerns on one Embodiment of this invention. It is a figure which shows the example displayed following FIG.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram showing features of an authentication management server 10 according to an embodiment of the present invention. The authentication management server 10 includes an authentication management DB 21 as an authentication management storage unit, a login reception unit 11 as a login reception unit, a personal authentication unit 12 as a personal authentication unit, and an authentication completion notification unit 13 as an authentication completion notification unit. ing.

  The authentication management DB 21 stores the terminal identification information of the user terminal 50, the mobile identification information of the user portable terminal 60, the URL of the authentication page, and the accessibility status of the authentication page in association with each other ( (See FIG. 4 described later).

  Here, the terminal identification information of the user's terminal 50 is identification information unique to the terminal, and includes, for example, a terminal manufacturing number and terminal address information. The terminal identification information is information used for managing the state between the authentication management server 10 (web server) and the terminal side (web browser), and is stored in the terminal side (web browser). It may be a cookie. The mobile identification information of the user's mobile terminal 60 is identification information unique to the mobile terminal, and includes, for example, a manufacturing number of the mobile terminal, address information of the mobile terminal, and the like.

  The authentication page is, for example, a web page on the Internet, and a URL (Uniform Resource Locator) indicates the location. The access permission status of the authentication page is a status indicating whether or not access to the authentication page is possible. When the status is accessible, the authentication page accepts user access. The URL of the authentication page is notified to the user in advance.

  The authentication management DB 21 may be created by the authentication management server 10 or may be created in another system. For example, the authentication management server 10 associates the URL of the authentication page with the terminal identification information and the portable identification information received when registering the user terminal 50 and the portable terminal 60.

  In response to receiving a login request accompanied by terminal identification information from the user's terminal 50, the login accepting unit 11 accesses an authentication page access status corresponding to the terminal identification information received along with the login request. Is accessible. That is, the login reception unit 11 receives terminal identification information, and makes it possible to access an authentication page associated with the received terminal identification information based on the authentication management DB 21.

  The personal authentication unit 12 authenticates the user according to the fact that the authentication page that the login reception unit 11 can access has been accessed from the user's mobile terminal 60 with mobile identification information. That is, the personal authentication unit 12 searches the authentication management DB 21 in response to access to the authentication page accompanied by the mobile identification information, and whether or not the authentication page associated with the searched mobile identification information is accessible. When the status is accessible, the user is authenticated.

  The authentication completion notification unit 13 notifies the user terminal 50 that the personal authentication unit 12 has completed the personal authentication. That is, the authentication completion notifying unit 13 notifies the completion of the personal authentication based on the communication information when the login request is accepted, and the user terminal 50 that has received the notification permits the user to log in, for example. .

  FIG. 2 is a block diagram illustrating functions of the authentication management server 10 according to an embodiment of the present invention. The authentication management server 10 further includes an access permission status management unit 14 as an access permission status management unit in addition to the configuration of FIG. 1, and the authentication management DB 21 further stores user identification information, which is different for each terminal identification information. Memorize the page.

  The authentication management DB 21 further stores the user identification information of the user in association with the terminal identification information. The user identification information is identification information for identifying a user, and includes, for example, a user ID input by the user at the time of user registration.

  When the authentication management DB 21 further stores the user identification information of the user in association with the terminal identification information, the login reception unit 11 responds to the reception of the login request with the user identification information from the user terminal 50. Thus, the access permission status of the authentication page associated with the terminal identification information associated with the user identification information is made accessible. That is, the login reception unit 11 receives user identification information, acquires terminal identification information associated with the received user identification information based on the authentication management DB 21, and authentication authentication associated with the acquired terminal identification information. Make the page accessible. For example, the login receiving unit 11 can make the authentication of the user more reliable by making the authentication page associated with the user identification information and the terminal identification information accessible.

  The authentication management DB 21 can store different authentication pages for each terminal identification information of the user terminal 50. For example, the login reception unit 11 can perform individual authentication for each user terminal 50 by making it possible to separately access different authentication pages associated with each terminal identification information.

  The access enable / disable status management unit 14 sets the access enable / disable status of the authentication page that can be accessed to be inaccessible as a predetermined time elapses from the reception of the login request. For example, the access permission status management unit 14 decreases the predetermined time set when the login receiving unit 11 can access the authentication page for each hour, and the reduced predetermined time becomes, for example, 0. The access status of the authentication page is made inaccessible. The personal authentication unit 12 searches the authentication management DB 21 in response to an access accompanied by mobile identification information from the user's mobile terminal 60 on the authentication page accessible by the login receiving unit 11. When the access permission status of the authentication page associated with the mobile identification information is not accessible, it is determined that the access is made after a predetermined time, and the user authentication is not performed. The personal authentication can be made more reliable.

  FIG. 3 is a diagram illustrating an example of a hardware configuration of the authentication management server 10 according to an embodiment of the present invention.

  The authentication management server 10 includes a central processing unit (CPU) 1010 (a plurality of CPUs such as CPU_A 1012 may be added in a multiprocessor configuration) constituting a control unit 1000, a bus line 1005, a communication I / F 1040, a main memory 1050, A BIOS (Basic Input Output System) 1060, an I / O controller 1070, a hard disk 1074, an optical disk drive 1076, a semiconductor memory 1078, a display device 1080, and an input device 1090 are provided.

  The control unit 1000 is a part that controls the authentication management server 10 in an integrated manner. By appropriately reading and executing various programs stored in the hard disk 1074, the control unit 1000 cooperates with the hardware described above, and performs various types according to the present invention. The function is realized.

  The communication I / F 1040 is a network adapter that enables the authentication management server 10 to be connected to another server, the user terminal 50, the portable terminal 60, and the like via a dedicated network or a public network. The communication I / F 1040 may include a modem, a cable modem, and an Ethernet (registered trademark) adapter.

  The BIOS 1060 stores a boot program executed by the CPU 1010 when the authentication management server 10 is activated, a program depending on the hardware of the authentication management server 10, and the like.

  Storage means such as a hard disk 1074, optical disk drive 1076, and semiconductor memory 1078 can be connected to the I / O controller 1070.

  The hard disk 1074 stores a program for the authentication management server 10 to execute the functions of the present invention, and stores a database such as the authentication management DB 21.

  As the optical disk drive 1076, for example, a DVD-ROM drive, a CD-ROM drive, or a DVD-RAM drive can be used. In this case, the optical disk 1077 corresponding to each drive is used. A program or data may be read from the optical disk 1077 by the optical disk drive 1076 and provided to the main memory 1050 or the hard disk 1074 via the I / O controller 1070.

  The program provided to the authentication management server 10 is provided by being stored in a recording medium such as the hard disk 1074, the optical disk 1077, or a memory card. This program may be installed in the authentication management server 10 and executed by being read from the recording medium via the I / O controller 1070 or downloaded via the communication I / F 1040.

  The display device 1080 displays a screen of a calculation processing result by the authentication management server 10 and includes a display device such as a cathode ray tube display device or a liquid crystal display device.

  The input device 1090 accepts input to the authentication management server 10 and includes a keyboard and a mouse.

  FIG. 4 is a diagram showing the authentication management DB 21 of the authentication management server 10 according to an embodiment of the present invention. The authentication management DB 21 is associated with the terminal ID as the terminal identification information, the mobile ID as the mobile identification information, the URL of the authentication page, the access permission status, the user ID as the user identification information, and the access flag. , And the accessible time. Here, the access flag is turned ON when there is an access from the portable terminal 60 of the user when the access permission status is accessible. The accessible time is a time for accepting an access from the user's portable terminal 60, and is set when the accessible status is made accessible.

  FIG. 5 is a flowchart showing processing of the authentication management server 10 according to an embodiment of the present invention. Note that this process starts upon receiving a program start command, executes the program, and ends.

  In step S <b> 101, the CPU 1010 accepts a login request with a terminal ID from the user terminal 50. More specifically, the CPU 1010 receives login request data with a terminal ID from the user terminal 50. Thereafter, the CPU 1010 advances the processing to step S102.

  In step S102, the CPU 1010 makes the access permission / prohibition status of the authentication page accessible. More specifically, the CPU 1010 sets the accessible status of the authentication page associated with the received terminal ID based on the authentication management DB 21 as accessible (for example, the status is ON), and the accessible time (for example, 5 minutes) is set, and an authentication page, which is an authentication web page, is activated. Thereafter, the CPU 1010 advances the processing to step S103. The activated authentication page accepts access from the user's portable terminal 60. Then, the activated authentication page turns on an access flag indicating that the user has accessed when the access permission status associated with the received mobile ID is accessible based on the authentication management DB 21. .

  In step S103, the CPU 1010 determines whether the authentication page has been accessed. More specifically, the CPU 1010 determines, based on the authentication management DB 21, whether or not the access flag corresponding to the access permission status of the authentication page that can be accessed is turned ON by the authentication page. If this determination is YES, the process moves to a step S104, and if NO, the process moves to a step S105.

  In step S104, the CPU 1010 notifies the completion of personal authentication. More specifically, the CPU 1010 transmits authentication completion data indicating completion of personal authentication to the address of the user's terminal 50 acquired based on the terminal ID. Thereafter, the CPU 1010 shifts the processing to step S101.

  In step S105, the CPU 1010 determines whether a predetermined time has elapsed. More specifically, the CPU 1010 determines whether the accessible time has become -1. If the determination is YES, the process proceeds to step S106. If the determination is NO, the set accessible time is decreased for each time, and then the process proceeds to step S103.

  In step S106, the CPU 1010 disables the access permission / prohibition status of the authentication page. More specifically, the CPU 1010 sets the access status of the authentication page corresponding to the accessible time that is −1 based on the authentication management DB 21 as inaccessible (for example, the status is OFF), and the authentication page. End. Thereafter, the CPU 1010 shifts the processing to step S101.

  FIG. 6 is a diagram illustrating an example displayed on the user terminal 50 and the user portable terminal 60 under the authentication management server 10 according to the embodiment of the present invention.

  The display example of FIG. 6 (1) is a display example showing an example of displaying a login on the display device 51 of the user terminal 50. FIG. 6A shows that a message prompting the user to log in is displayed in the input field 101, the user ID is input, and the input user ID is displayed.

  The display example of FIG. 6B is a display example showing an example of displaying the progress of login. In FIG. 6B, after the input user ID is displayed in the input field 101, a message prompting access to an authentication page for performing personal authentication is displayed in the message field 102, and a time display is displayed. A column 201 indicates that a time during which the authentication page can be accessed is displayed. The display in the time display column 201 shown in FIG. 6 (2) decreases with the passage of time. For example, when it becomes 0, it indicates that the authentication page cannot be accessed.

  FIG. 7 is a diagram illustrating an example of display following FIG.

  FIG. 7A is a diagram illustrating the display device 61 of the user's mobile terminal 60. The display example of FIG. 7A is a display example showing an example of accessing the authentication page from the user's portable terminal 60. FIG. 7A shows that a list of accessible web pages is displayed in the display field 301, and the authentication page 311 of the user terminal A is selected and highlighted.

  FIG. 7 (2) is a diagram showing that the personal authentication is completed and the user has logged in as a result of the user's mobile terminal 60 accessing the authentication page of the user's terminal A, for example. The display example of FIG. 7B is a display example in which the terminal 50 that is the user's terminal A that has received the notification that the personal authentication has been completed receives the user's login and displays a start screen.

  According to the present embodiment, the authentication management server 10 obtains the terminal ID of the user's terminal 50, the mobile ID of the user's mobile terminal 60, the URL of the authentication page, and the accessibility status of the authentication page. An authentication management DB 21 is provided which stores the information in association with each other, and in response to receiving a login request with a terminal ID from the user's terminal 50, an authentication page associated with the terminal ID received with the login request. The user's personal authentication is performed and the personal authentication is completed in response to the fact that the access enabled / disabled status is accessible and the authentication page that can be accessed is accessed with the mobile ID from the mobile terminal 60 of the user. To the user terminal. Therefore, the authentication management server 10 receives the user's mobile terminal 60 to access the authentication page that can be accessed in response to the login request with the terminal ID from the user's terminal 50. Since the personal authentication is performed, the personal authentication can be performed for each terminal surely and easily by the mobile terminal 60 that is always carried by the user without using a password.

  Further, the authentication management DB 21 stores the user ID of the user in association with the terminal ID, and the authentication management server 10 stores the user ID in response to receiving a login request with the user ID from the user terminal 50. The access permission status of the authentication page associated with the associated terminal ID is made accessible. Therefore, the authentication management server 10 can easily authenticate each terminal by using the portable terminal 60 that is always carried by the user without using a password, and more reliably by confirming the identity by the user ID. it can.

  Further, the authentication management server 10 stores different authentication pages for each terminal ID of the user terminal 50. Therefore, the authentication management server 10 can easily authenticate each terminal without using a password, more easily by the mobile terminal 60 that the user always carries, and more reliably by an authentication page that is different for each user terminal. It can be carried out.

  Further, the authentication management server 10 sets the access permission status of the authentication page that can be accessed to be inaccessible as a predetermined time elapses from the reception of the login request. Therefore, the authentication management server 10 can easily authenticate each terminal without using a password, easily by the mobile terminal 60 that is always carried by the user, and more reliably by the time management of the authentication page. it can.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. The effects described in the embodiments of the present invention are only the most preferable effects resulting from the present invention, and the effects of the present invention are limited to those described in the embodiments of the present invention. is not.

DESCRIPTION OF SYMBOLS 10 Authentication management server 11 Login reception part 12 Personal authentication part 13 Authentication completion notification part 14 Access permission status management part 21 Authentication management DB

Claims (5)

An authentication management server for authenticating a user's terminal,
Authentication management storage means for storing the terminal identification information of the user terminal, the mobile identification information of the mobile terminal of the user, the URL of the authentication page, and the accessibility status of the authentication page in association with each other;
In response to receiving a login request with the terminal identification information from the user terminal, the access status of the authentication page associated with the terminal identification information received with the login request is accessible. Login acceptance means to
In response to the access with the mobile identification information from the mobile terminal of the user to the authentication page that is accessible by the log-in reception unit, the personal authentication unit that authenticates the user,
Authentication completion notifying means for notifying the user terminal that the user authentication means has completed the user authentication;
An authentication management server comprising: The authentication management storage means further stores the user identification information of the user in association with the terminal identification information,
In response to receiving a login request accompanied by the user identification information from the terminal of the user, the login accepting unit is configured to correspond to the authentication page associated with the terminal identification information associated with the user identification information. The authentication management server according to claim 1, wherein the access permission status is accessible.   The authentication management server according to claim 1 or 2, wherein the authentication management storage unit stores different authentication pages for each terminal identification information of the user terminal.   2. The access permission status management means for making the access permission status of the authentication page accessible to be inaccessible with a lapse of a predetermined time from acceptance of the login request. Item 4. The authentication management server according to any one of Items 3 to 4. An apparatus comprising authentication management storage means for storing terminal identification information of a user's terminal, portable identification information of the user's mobile terminal, URL of an authentication page, and accessibility status of the authentication page in association with each other Is a method of authenticating the user's terminal,
In response to receiving a login request with the terminal identification information from the user terminal, the access status of the authentication page associated with the terminal identification information received with the login request is accessible. And steps to
Performing authentication of the user in response to the access with the mobile identification information from the mobile terminal of the user to the authentication page that is accessible;
Notifying the terminal of the user that the personal authentication has been completed;
A method comprising the steps of:

Images