JP5629563B2 - Service provision permission apparatus, service provision permission method, and program - Google Patents

Description

  The present invention relates to a service provision permission device, a service provision permission method, and a program.

  Some devices authenticate a user by using a user ID, a password, and registered line information (identifier, IP address, etc.) and permit service provision.

  Patent Document 1 describes an application service system that prevents unauthorized access to an AP server (application server) and improves the security level in an application service system that involves a SIP (Session Initiation Protocol) session. This application service system performs line authentication by determining whether the combination of the line identifier of the line that has received the session establishment request and the identifier of the communication resource included in the session establishment request exists in the line authentication database. Then, a session between the terminal and the AP server is started.

JP 2009-116785 A

  However, in the application service system described in Patent Document 1, the use of the service is permitted only for access from a pre-registered line only. In addition, when authenticating a user based only on the user ID and password, the security level is lower than when authenticating the user based on the user ID, password, and registered line information (identifier, IP address, etc.). There was a problem.

  The present invention has been made in view of the circumstances as described above, and provides a service that can authenticate a user for access from a line other than a pre-registered line and can improve security. It is an object to provide a permitting device, a service provision permitting method, and a program.

In order to achieve the above object, a service provision permission device according to a first aspect of the present invention includes:
Communicates via a network to a user terminal, a mobile communication terminal, and a connection location information storage device that stores the IP address of the user terminal in association with connection location information that can identify the connection location of the user terminal A service providing permission device connected in a possible manner,
Identification information registration means for registering user identification information indicating a user and mobile communication terminal identification information indicating the mobile communication terminal possessed by the user in association with each other;
Identification information receiving means for receiving the user identification information and the IP address of the user terminal transmitted from the user terminal via the network after the provision of a predetermined service is requested from the user terminal;
Registration determination means for determining whether or not the user identification information received by the identification information receiving means is registered in the identification information registration means;
When it is determined by the registration determining means that the user identification information is registered, the connection position information storage device corresponding to the IP address received by the identification information receiving means is connected to the connection position information storage device via the network. Connection position information acquisition means acquired from:
Identification information detecting means for detecting the mobile communication terminal identification information corresponding to the user identification information received by the identification information receiving means from the identification information registration means;
Current position information for acquiring the current position information that can identify the current position of the mobile communication terminal from the mobile communication terminal indicated by the mobile communication terminal identification information detected by the identification information detecting means via the network Information acquisition means;
Based on the connection position information acquired by the connection position information acquisition means and the current position information acquired by the current position information acquisition means, a separation distance between the user terminal and the mobile communication terminal is less than a predetermined threshold value By determining whether or not the user terminal is being used by the user indicated by the user identification information received by the identification information receiving means; and
By said user recognition unit, wherein the user terminal, when it has been determined that used by said user to said user identification information indicates, and a service providing permission means for permitting the provision of the predetermined service to the user terminal ,
Before SL user recognition unit, the user identification the user terminal using different thresholds for each user indicated by the information, whether it is being used by the user indicated by the user identification information received by said identification information reception unit To determine,
It is characterized by that .

  In addition to determining whether or not the separation distance between the user terminal and the mobile communication terminal is less than a predetermined threshold, the user determination unit is configured to acquire the current position acquired by the current position information acquisition unit. A user indicated by the user identification information received by the identification information receiving means by the user terminal by determining whether or not the current position of the mobile communication terminal specified by the information is within a predetermined area It may be determined whether or not it is used.

The identification information receiving means includes payment information receiving means for receiving payment information indicating the content of a payment transaction performed by the user,
The service provision permission unit, when the user determination unit determines that the user terminal is being used by the user indicated by the user identification information, the payment information received by the payment information reception unit via the network In addition, payment information transmission means for transmitting to a payment server that is communicably connected may be provided.

In order to achieve the above object, a service provision permission method according to a second aspect of the present invention includes:
Communicates via a network to a user terminal, a mobile communication terminal, and a connection location information storage device that stores the IP address of the user terminal in association with connection location information that can identify the connection location of the user terminal A service provision permission method by a service provision permission device connected in a possible manner,
An identification information registration step of registering user identification information indicating a user and mobile communication terminal identification information indicating the mobile communication terminal possessed by the user in association with each other;
An identification information receiving step for receiving the user identification information transmitted from the user terminal via the network and the IP address of the user terminal after the provision of a predetermined service is requested from the user terminal;
A registration determination step for determining whether or not the user identification information received in the identification information reception step is registered in the identification information registration step;
If it is determined that the user identification information is registered in the registration determination step, the connection position information storage device corresponding to the IP address received in the identification information reception step is transmitted via the network. Connection position information acquisition step acquired from
An identification information detection step of detecting the mobile communication terminal identification information corresponding to the user identification information received by the identification information reception step from the identification information registration step;
Current position information for acquiring the current position information for identifying the current position of the mobile communication terminal from the mobile communication terminal indicated by the mobile communication terminal identification information detected by the identification information detection step via the network An information acquisition step;
Based on the connection position information acquired by the connection position information acquisition step and the current position information acquired by the current position information acquisition step, a separation distance between the user terminal and the mobile communication terminal is less than a predetermined threshold A user determination step of determining whether or not the user terminal is being used by a user indicated by the user identification information received by the identification information reception step;
By said user determining step, said user terminal, when it has been determined that used by said user to said user identification information indicates, and a service providing permission step of permitting the provision of the predetermined service to the user terminal ,
In the user determining step, it is determined whether or not the user terminal is being used by the user indicated by the user identification information received in the identification information receiving step by using a different threshold for each user indicated by the user identification information. To
And wherein a call.

In order to achieve the above object, a program according to the third aspect of the present invention provides:
Communicates via a network to a user terminal, a mobile communication terminal, and a connection location information storage device that stores the IP address of the user terminal in association with connection location information that can identify the connection location of the user terminal A computer connected to
Identification information registration means for registering user identification information indicating a user and mobile communication terminal identification information indicating the mobile communication terminal possessed by the user in association with each other;
Identification information receiving means for receiving the user identification information and the IP address of the user terminal transmitted from the user terminal via the network after the provision of a predetermined service is requested from the user terminal;
Registration determination means for determining whether or not the user identification information received by the identification information receiving means is registered in the identification information registration means;
When it is determined by the registration determining means that the user identification information is registered, the connection position information storage device corresponding to the IP address received by the identification information receiving means is connected to the connection position information storage device via the network. Connection position information acquisition means acquired from
Identification information detection means for detecting the mobile communication terminal identification information corresponding to the user identification information received by the identification information receiving means from the identification information registration means;
Current position information for acquiring the current position information that can identify the current position of the mobile communication terminal from the mobile communication terminal indicated by the mobile communication terminal identification information detected by the identification information detecting means via the network Information acquisition means,
Based on the connection position information acquired by the connection position information acquisition means and the current position information acquired by the current position information acquisition means, a separation distance between the user terminal and the mobile communication terminal is less than a predetermined threshold value User determining means for determining whether or not the user terminal is being used by the user indicated by the user identification information received by the identification information receiving means,
When the user determining unit determines that the user terminal is being used by the user indicated by the user identification information, the user determining unit functions as a service providing permission unit that permits the user terminal to provide the predetermined service. ,
The user discriminating unit discriminates whether or not the user terminal is being used by the user indicated by the user identification information received by the identification information receiving unit, using a different threshold for each user indicated by the user identification information. To
And wherein a call.

  According to the present invention, it is possible to authenticate a user even for access from a line other than a pre-registered line, and improve security.

It is a block diagram which shows the structural example of the service provision permission system which concerns on Embodiment 1 of this invention. It is a figure which shows an example of user authentication information. It is a figure which shows an example of operation | movement of the service provision permission system which concerns on Embodiment 1 of this invention. It is a flowchart which shows an example of operation | movement of the service provision permission process which concerns on Embodiment 1 of this invention. It is a block diagram which shows the structural example of the service provision permission system which concerns on Embodiment 2 of this invention. It is a figure which shows an example of operation | movement of the service provision permission system which concerns on Embodiment 2 of this invention. It is a flowchart which shows an example of the operation | movement of the payment process which concerns on Embodiment 2 of this invention. It is a block diagram which shows an example of the hardware constitutions of the service provision permission apparatus which concerns on embodiment of this invention.

  In the present invention, user identification information includes, for example, a user ID, a password, and the like, and is configured from information that uniquely identifies a user. The terminal identification information includes, for example, an IP address, a MAC address, and the like, and is configured from information that uniquely identifies a user terminal. The current position information of the mobile communication terminal includes, for example, information indicating the position of the mobile communication terminal held by the user, information indicating the position of the user holding the mobile terminal, and the like. Furthermore, the connection position information includes, for example, information indicating the position of the line termination device connected to the user terminal so as to be communicable, information indicating the position of the user terminal, etc., and information indicating the connection position between the user terminal and the line Consists of

(Embodiment 1)
A service provision permission system 101 provided with a service provision permission device 11 according to the present embodiment will be described with reference to FIG. In the present embodiment, an example in which the present invention is applied to a content providing site is shown.

  The service provision permission system 101 includes a site management server 1, a client 2, a GPS (Global Positioning System) terminal 3, an NGN (Next Generation Network) management server 4, an NGN 5, and a mobile communication network 6. Is done. In FIG. 1, the client 2 and the GPS terminal 3 are shown as one representative, but actually, a plurality of clients 2 are connected to the NGN 5, and a plurality of GPS terminals 3 are connected to the mobile communication network 6. Note that the mobile communication network 6 may be integrated with the NGN 5.

  The site management server 1 includes a service provision permission device 11, service content 12, and a transmission / reception unit 13.

  The service provision permission device 11 includes user authentication information 112 and a user authentication unit 111, a connection position acquisition unit 113, a user position acquisition unit 114, and a determination unit 115 as functional units provided by a program described later.

  The user authentication unit 111 receives the user ID, password, and IP address of the client 2 that the user has input to the client 2 from the client 2 via the NGN 5. The user authentication unit 111 determines whether the user is a registered user. Whether or not the user is a registered user is determined by reading user authentication information 112 described later and determining whether or not the received user ID and password are registered in the user authentication information 112.

  When the user authentication unit 111 determines that the received user ID and password are registered in the user authentication information 112, the received IP address of the client 2 is sent to the connection location acquisition unit 113, and the received user ID is sent to the user location. The data is transmitted to the acquisition unit 114 and the determination unit 115. On the other hand, if the user authentication unit 111 determines that the received user ID and password are not registered in the user authentication information 112, the authentication unit 111 transmits authentication failure information indicating that the authentication has failed to the transmission / reception unit 13 to be described later. Is prohibited.

  As shown in FIG. 2, the user authentication information 112 is information indicating a user ID, a password, an effective area, and the like for each user (registered user) registered in the content providing site.

  “User ID” of the user authentication information 112 is information for identifying a registered user. “Password” is a password for login. The “user ID” and “password” may be set by a registered user, or may be automatically given by the site management server 1.

  The “effective area” is an area that is set in advance and that can provide a service by user authentication. Service provision is permitted only when the registered user is within this effective area.

  “Effective distance” indicates a distance from a registered user position to a connection position between the client 2 and the line that is set in advance and enables service provision by user authentication. Service provision is permitted only when the distance from the position of the registered user to the connection position is less than the effective distance.

  The “effective area” and “effective distance” may be set by the registered user, or may be automatically set by the site management server 1 from the registered user's address, action range, and the like.

  The “GPS terminal” is information (for example, an individual identification number or a communication address) for identifying the GPS terminal 3 owned by the registered user, and is set by the registered user.

  The connection position acquisition unit 113 in FIG. 1 requests the connection position information 41 indicating the connection position between the client 2 and the line to the NGN management server 4 via the NGN 5. Then, the connection position acquisition unit 113 acquires connection position information 41 corresponding to the IP address of the client 2 received from the user authentication unit 111 from the connection position information DB of the NGN management server 4 described later. The connection position acquisition unit 113 transmits the acquired connection position information 41 to the determination unit 115.

  The user position acquisition unit 114 refers to the user authentication information 112 and specifies the GPS terminal 3 corresponding to the user ID received from the user authentication unit 111. The user position acquisition unit 114 requests GPS information for specifying the position of the user from the specified GPS terminal 3 via the mobile communication network 6. Then, the user position acquisition unit 114 receives GPS information from the GPS terminal 3 and sends the received GPS information to the determination unit 115.

  The determination unit 115 refers to the user authentication information 112 and identifies an effective area and an effective distance corresponding to the user ID received from the user authentication unit 111.

  Further, the determination unit 115 specifies the current position of the user based on the GPS information received from the user position acquisition unit 114, and determines whether or not the current position is within the specified effective area.

  When the determination unit 115 determines that the current position is within the effective area, the determination unit 115 determines that the position indicated by the connection position information 41 received from the connection position acquisition unit 113 and the GPS information received from the user position acquisition unit 114 are the same. Based on the indicated position, the distance from the user position to the connection position between the client 2 and the line is calculated. Then, the determination unit 115 determines whether or not the calculated distance is less than the effective distance specified from the user authentication information 112.

  When the determination unit 115 determines that the calculated distance is less than the effective distance, the determination unit 115 determines that the client 2 is used by the user himself / herself indicated by the user ID. Then, the determination unit 115 transmits authentication success information indicating that the authentication has been successful to the transmission / reception unit 13 and permits the provision of the service. The service is provided by transmitting predetermined content read from the service content 12 to the client 2 by the transmission / reception unit 13.

  On the other hand, when the determination unit 115 determines that the current position is not within the effective area, or when the determination unit 115 determines that the calculated distance is greater than or equal to the effective distance, the determination unit 115 indicates that the authentication has failed. The authentication failure information shown is transmitted to the transmission / reception unit 13, and the provision of the service is prohibited.

  The service content 12 is a folder, file, or the like that constitutes a so-called website. The service content 12 includes, for example, a login screen for the user to log in, a login success screen indicating that the login has been successful, a login failure screen indicating that the login has failed, and a service screen indicating the content provided by the website. The image file which comprises the screen displayed on the website, an audio file, an html file, etc. are included.

  The transmission / reception unit 13 receives an HTTP request input by the user from the client 2 via the NGN 5. If the service content 12 corresponding to the received HTTP request requires user authentication, the transmission / reception unit 13 reads the service content 12 on the login screen and transmits it to the client 2 via the NGN 5.

  Further, when receiving the authentication success information from the determination unit 115 of the service provision permission device 11, the transmission / reception unit 13 reads the service content 12 corresponding to the HTTP request input by the user, and transmits it to the client 2 via the NGN 5. On the other hand, when the transmission / reception unit 13 receives the authentication failure information from the user authentication unit 111 or the determination unit 115 of the service provision permission device 11, the transmission / reception unit 13 reads the service content 12 on the login failure screen and transmits the service content 12 to the client 2 via the NGN 5.

  The client 2 is composed of a communicable terminal such as a general-purpose computer and is connected to the site management server 1 via the NGN 5. The client 2 is a terminal for accessing a content providing site in the site management server 1. The client 2 transmits an HTTP request to the site management server 1 in order to acquire the service content 12 of the content providing site in accordance with a user instruction.

  The GPS terminal 3 is a communicable mobile communication terminal equipped with a GPS function such as a mobile phone, and is connected to the site management server 1 via a mobile communication network. In response to the inquiry from the site management server 1, the GPS terminal 3 transmits GPS information specifying the current position of the GPS terminal 3 (user's current position) to the site management server 1.

  The NGN management server 4 holds connection position information 41 indicating a connection position between each client 2 connected to the NGN 5 and the line.

  The NGN 5 connects the NGN management server 4, the client 2, and the site management server 1 so that they can communicate with each other.

  The mobile communication network 6 connects the GPS terminal 3 and the site management server 1 so that they can communicate with each other.

  Next, an operation of the service provision permission system 101 including the service provision permission device 11 according to the present embodiment will be described with reference to FIG.

  In the service provision permission system 101, information is transmitted / received mainly between the site management server 1 and the client 2 via the NGN 5. Information is transmitted and received between the site management server 1 and the NGN management server 4 via the NGN 5. Further, information is transmitted and received between the site management server 1 and the GPS terminal 3 owned by the user via the mobile communication network 6.

  The URL (Uniform Resource Locator) of the login screen of the content providing site is input to the client 2 by the user. At this time, the URL may be directly input from a keyboard or the like, or may be input by clicking a button or link on the content providing site. The client 2 transmits the input URL as an HTTP request to the site management server 1 via the NGN 5 (step A1).

  The site management server 1 acquires the service content 12 on the login screen corresponding to the received HTTP request from the service content 12. The site management server 1 transmits the service content 12 of the acquired login screen to the client 2 as an HTTP response (step A2).

  The client 2 displays a login screen for the received HTTP response and prompts the user to input a user ID and password (step A3).

  When the user ID and password are input by the user, the client 2 transmits the input user ID and password together with the HTTP request to the site management server 1 via the NGN 5 (step A4). In addition to these, the client 2 also transmits the IP address of the client 2 to the site management server 1.

  The site management server 1 refers to the user authentication information 112 and determines whether or not the received user ID and password are registered in the user authentication information 112 (step A5).

  When it is determined that the received user ID or password is not registered in the user authentication information 112 (step A5; NO), the site management server 1 reads the service content 12 on the login failure screen and displays the client as an HTTP response. 2 (step A6).

  The client 2 displays a login failure screen of the received HTTP response and ends this operation (step A7).

  When it is determined that the received user ID or password is registered in the user authentication information 112 (step A5; YES), the site management server 1 uses the connection location information 41 corresponding to the IP address received from the client 2. And request to the NGN management server 4 (step A8).

  In response to the request from the site management server 1, the NGN management server 4 transmits connection location information 41 corresponding to the IP address to the site management server 1 (step A9).

  The site management server 1 refers to the user authentication information 112 and identifies the GPS terminal corresponding to the received user ID. Then, the site management server 1 requests GPS information from the identified GPS terminal 3 (step A10).

  In response to this request, the GPS terminal 3 transmits GPS information specifying the current position of the GPS terminal 3 (user's current position) to the site management server 1 (step A11).

  Next, the site management server 1 refers to the user authentication information 112 and identifies an effective area corresponding to the received user ID. The site management server 1 determines whether or not the current position of the user is within the specified effective area based on the received GPS information (step A12).

  When it determines with it not being in an effective area (step A12; NO), the site management server 1 reads the service content 12 of a login failure screen, and transmits to the client 2 as an HTTP response (step A13).

  The client 2 displays a login failure screen of the received HTTP response and ends this operation (step A14).

  When it determines with it being in an effective area (step A12; YES), the site management server 1 is based on the acquired connection position information and GPS information, and the distance of the connection position of the client 2 and a line | wire, and a user's position Is calculated (step A15). Then, the site management server 1 refers to the user authentication information 112 and determines whether or not the distance between the connection position and the user position is less than the effective distance (step A16).

  When it determines with it being beyond an effective distance (step A16; NO), the site management server 1 reads the service content 12 of a login failure screen, and transmits to the client 2 as an HTTP response (step A17). The client 2 displays a login failure screen of the received HTTP response and ends this operation (step A18).

  When the distance is less than the effective distance (step A16; YES), the site management server 1 permits the provision of the service on the assumption that the user authentication is successful, and the service content 12 on the service screen corresponding to the HTTP request received from the client 2 Is read. Then, the site management server 1 transmits the service content 12 of the read service screen to the client 2 as an HTTP response (step A19). The client 2 displays a service screen of the received HTTP response (Step A20).

  The above is the operation for permitting or prohibiting the provision of the service by the service provision permission system 101.

  Subsequently, the operation of the service provision permission apparatus 11 according to the present embodiment will be described with reference to FIG. The user authentication process by the service provision permission device 11 is started in response to a request for service provision by the user.

  The user authentication unit 111 acquires the user ID and password input by the user and the IP address of the client 2 from the client 2 via the NGN 5 (step S11).

  The user authentication unit 111 reads the user authentication information 112 of FIG. 2 and determines whether or not the acquired user ID and password are registered in the user authentication information 112 (step S12). When it is determined that the acquired user ID and password are not registered in the user authentication information 112 (step S12; NO), the user authentication unit 111 sends authentication failure information indicating that user authentication has failed to the transmission / reception unit 13. Send and finish the process. As a result, the provision of the service is prohibited (step S20).

  When it is determined that the acquired user ID and password are registered in the user authentication information 112 (step S12; YES), the user authentication unit 111 acquires the IP address of the client 2 in the connection position acquisition unit 113 and acquires the user position. The user ID is transmitted to unit 114 and determination unit 115, respectively.

  The connection location acquisition unit 113 inquires of the NGN management server 4 about connection location information 41 corresponding to the received IP address of the client 2. The connection location acquisition unit 113 acquires the connection location information 41 corresponding to the IP address of the client 2 from the NGN management server 4 (step S13), and transmits the acquired connection location information to the determination unit 115.

  The user position acquisition unit 114 reads the user authentication information 112 and specifies the GPS terminal 3 corresponding to the user ID received from the user authentication unit 111. Subsequently, the user position acquisition unit 114 inquires of the specified GPS terminal 3 about GPS information. The user position acquisition unit 114 acquires GPS information from the GPS terminal 3 (step S14), and transmits the acquired GPS information to the determination unit 115.

  The determination unit 115 reads the user authentication information 112 of FIG. 2 and identifies “effective area” and “effective distance” corresponding to the user ID received from the user authentication unit 111 (step S15).

  The determination unit 115 specifies the current position of the user based on the GPS information received from the user position acquisition unit 114, and determines whether or not the user exists in the effective area (step S16). When it determines with a user not existing in an effective area (step S16; NO), the determination part 115 transmits the authentication failure information which shows that user authentication failed to the transmission / reception part 13 (step S20), and performs a process. finish. This prohibits the provision of services.

  When it is determined that the user exists in the effective area (step S16; YES), the determination unit 115 determines the client from the current position of the user based on the GPS information acquired by the user position acquisition unit 114 and the received connection position information 41. The distance to the connection position between 2 and the line is calculated (step S17).

  Subsequently, the determination unit 115 compares the distance calculated in step S17 with the “effective distance” specified in step S18, and determines whether the calculated distance is less than the effective distance (step S18).

  When it determines with the calculated distance being more than an effective distance (step S18; NO), the determination part 115 transmits the authentication failure information which shows having failed in user authentication to the transmission / reception part 13 (step S20), and a process Exit. This prohibits the provision of services.

  When it determines with the calculated distance being less than an effective distance (step S18; YES), the determination part 115 transmits the authentication success information which shows that user authentication was successful to the transmission / reception part 13, and complete | finishes a process. Thereby, the provision of the service is permitted (step S19).

  Thus, according to the present invention, it is possible to access from a line other than the lines registered in advance. Furthermore, since access cannot be made from a location exceeding the effective distance from the current location of the user, security can be improved.

(Modification)
In the above embodiment, the determination unit 115 determines whether or not the user exists in the effective area, and further determines whether or not the distance from the user position to the connection position between the client 2 and the line is less than the effective distance. Although the example which determines is shown, it is not necessarily limited to this. The determination unit 115 does not need to determine whether or not the user exists in the effective area by determining whether or not the connection position between the client 2 and the line is less than the effective distance from the user's position.

  Moreover, in the said embodiment, the transmission / reception part 13, the user authentication part 111 of the service provision permission apparatus 11, the connection position acquisition part 113, and the user position acquisition part 114 show the example which receives information from the exterior of the site management server 1. However, it is not necessarily limited to this. Only the transmission / reception unit 13 receives information from outside the site management server 1, and the user authentication unit 111, the connection position acquisition unit 113, and the user position acquisition unit 114 of the service provision permission device 11 receive information from the transmission / reception unit 13. Also good. Further, the service provision permission device 11 may include the transmission / reception unit 13.

(Embodiment 2)
In the first embodiment, an example in which the service provision permission device 11 is applied to a content providing site has been shown. In the second embodiment, an example in which the present invention is applied to an online payment service will be described.

  As shown in FIG. 5, the service provision permission system 102 according to the second embodiment communicates with the settlement center 8, the settlement center 8, and the site management server 1 in addition to the service provision permission system 101 according to the first embodiment. It further includes a payment network 7 that can be connected.

  The settlement center 8 is, for example, a credit card company server.

  The user authentication information 112 of the service provision permission device 11 according to the present embodiment is information on a registered user who can perform a payment procedure at an online payment site. Items constituting the user authentication information 112 are the same as those in the first embodiment. The user authentication unit 111 receives the user ID and password, payment information, and the IP address of the client 2 input by the user from the client 2 via the NGN 5. When the determination unit 115 determines that the user is in a predetermined area and the distance from the user position to the connection position between the client 2 and the line is within a predetermined range, the determination unit 115 transmits the payment information to the transmission / reception unit 13. Send to.

  When receiving the payment information from the determination unit 115 of the service provision permission device 11, the transmission / reception unit 13 transmits the payment information to the payment center 8 via the payment network 7. At the same time, the transmission / reception unit 13 reads the service content 12 on the successful payment screen and transmits it to the client 2 via the NGN 5. Further, when receiving the authentication failure information from the user authentication unit 111 or the determination unit 115 of the service provision permission device 11, the transmission / reception unit 13 reads the service content 12 on the payment failure screen and transmits it to the client 2 via the NGN 5.

  Other configurations are the same as those of the first embodiment.

  The operation of the service provision permission system 102 according to the present embodiment will be described below with reference to FIG.

  In the service provision permission system 102, in addition to the operation of the service provision permission system 101 in the first embodiment, information is transmitted from the site management server 1 to the settlement center 8 via the settlement network 7.

  First, the URL of the payment screen of the online payment site is input to the client 2 by the user. At this time, the URL may be input directly from the keyboard, or may be input by clicking an online payment site button or link. The client 2 transmits the input URL as an HTTP request to the site management server 1 via the NGN 5 (step B1). In response to the received HTTP request, the site management server 1 reads the service content 12 on the settlement screen and transmits it to the client 2 as an HTTP response (step B2).

  The client 2 displays a settlement screen for the received HTTP response (step B3). A user ID, password, and payment information are input to the payment screen displayed on the client 2. The client 2 transmits the input user ID, password, and settlement information to the site management server 1 via the NGN 5 together with the HTTP request (step B4). At this time, the client 2 also transmits the IP address to the site management server 1. At this time, the client 2 also transmits the IP address to the site management server 1.

The operation from step B5 to step B16 in FIG. 6 is the same as the operation from step A6 to step A16 in FIG.
When the service provision is prohibited, the site management server 1 reads the service content 12 on the payment failure screen and transmits it as an HTTP response to the client 2 (steps B6, B13, etc.). The client 2 displays a settlement failure screen for the received HTTP response (steps B7, B14, etc.).

  When it is determined in step B16 that the distance from the user position to the connection position between the client 2 and the line is less than the effective distance (step B16; Yes), the site management server 1 acquires the settlement information acquired from the client 2 Is transmitted to the settlement center 8 (step B19). Further, the site management server 1 reads the service content 12 on the payment success screen and transmits it to the client 2 as an HTTP response (step B20). The client 2 displays a successful payment screen for the received HTTP response (step B21).

  Below, with reference to FIG. 7, operation | movement of the service provision permission apparatus 11 which concerns on this Embodiment is demonstrated. The service provision permission process according to the present embodiment is started in response to a request for provision of a payment processing service by the user.

  First, the user authentication unit 111 acquires the user ID and password, payment information, and the IP address of the client 2 input by the user from the client 2 via the NGN 5 (step S31). The user authentication unit 111 determines whether or not the user is a registered user who can perform a settlement procedure, based on whether or not the acquired user ID and password are registered in the user authentication information 112 (step S32). When it determines with not being a registered user (step S32; NO), the user authentication part 111 transmits the authentication failure information which shows that user authentication failed to the transmission / reception part 13 (step S40), and complete | finishes a process.

  If the user is a registered user (step S32; YES), the connection location acquisition unit 113 inquires of the NGN management server 4 about the connection location information 41 corresponding to the IP address of the client 2 acquired by the user authentication unit 111. The connection location acquisition unit 113 acquires connection location information 41 corresponding to the IP address of the client 2 from the NGN management server 4 (step S33).

  On the other hand, the user position acquisition unit 114 specifies the GPS terminal 3 possessed by the user from the user authentication information 112 as in the first embodiment, and inquires the GPS terminal 3 about the GPS information. The user position acquisition unit 114 acquires the GPS information of the client 2 from the GPS terminal 3 (step S34).

  The determination unit 115 refers to the user authentication information 112 as in the first embodiment, and specifies an effective area and an effective distance corresponding to the user ID (step S35). The determination unit 115 determines whether or not the user exists in the effective area based on the GPS information acquired by the user position acquisition unit 114 (step S36). If it is determined that the user is not in the effective area (step S36; NO), the determination unit 115 transmits authentication failure information indicating that user authentication has failed to the transmission / reception unit 13 (step S40), and ends the process. To do.

  When it is determined that the user exists in the effective area (step S36; YES), the determination unit 115 refers to the effective distance of the user authentication information 112 and acquires the connection position information 41 and the user position acquired by the connection position acquisition unit 113. Based on the GPS information acquired by the unit 114, the distance from the position of the user to the connection position between the client 2 and the line is calculated (step S37).

  Then, the determination unit 115 determines whether or not the calculated distance is less than the effective distance (step S38). When it is determined that the distance from the user position to the connection position is greater than or equal to the effective distance (step S38; NO), the determination unit 115 transmits authentication failure information indicating that user authentication has failed to the transmission / reception unit 13. (Step S40), the process is terminated.

  When it is determined that the distance from the user position to the connection position is less than the effective distance (step S38; YES), the determination unit 115 transmits the settlement information to the transmission / reception unit 13 as the user authentication is successful ( Step S39) and the process is terminated.

  As described above, according to the present invention, access can be made not only from a line registered in advance by the user but also from a different line. Furthermore, since it cannot be accessed from a location that is more than an effective distance from the current location of the user, it can also be applied to a system that requires high security such as online payment.

(Modification)
In the above embodiment, the example in which the user authentication unit 111 receives the payment information input by the user has been described, but the present invention is not necessarily limited thereto. The transmission / reception unit 13 may receive the payment information input by the user. In this case, when the determination unit 115 determines that the user is in a predetermined area and the client 2 is within a predetermined range from the user's position, the determination unit 115 transmits and receives authentication success information indicating that the authentication is successful. 13 to send. When receiving the authentication success information from the determination unit 115, the transmission / reception unit 13 transmits the temporarily stored payment information to the payment center 8 via the payment network 7.

  Moreover, although the example which transmits the received payment information to the payment center 8 via the transmission / reception part 13 was shown in the said embodiment, this is an example. When provision of the service is permitted, the user authentication unit 111 may directly transmit the received payment information to the payment center 8.

  Below, an example of the hardware configuration of the service provision permission apparatus 11 is demonstrated using FIG. As illustrated in FIG. 8, the service provision permission device 11 includes a control unit 91, a main storage unit 92, an external storage unit 93, and a transmission / reception unit 96. The main storage unit 92, the external storage unit 93, and the transmission / reception unit 96 are all connected to the control unit 91 via the internal bus 90.

  The control unit 91 includes a CPU (Central Processing Unit) and the like, and in accordance with a control program 99 stored in the external storage unit 93, the user authentication unit 111, the line position special-purpose unit 113, and the user position acquisition of the service provision permission device 11 Processing in each functional unit of the unit 114 and the determination unit 115 is executed.

  The main storage unit 92 is composed of a RAM (Random-Access Memory) or the like, loads a control program 99 stored in the external storage unit 93, and is used as a work area of the control unit 91.

  The external storage unit 93 includes a nonvolatile memory such as a flash memory, a hard disk, a DVD-RAM (Digital Versatile Disc Random Access Memory), and a DVD-RW (Digital Versatile Disc Rewriteable). The external storage unit 93 stores a program for causing the control unit 91 to perform processing of the service provision permission device 11 and user authentication information 112 in advance.

  The transmission / reception unit 96 includes a network termination device or a wireless communication device connected to the network, and a serial interface or a LAN (Local Area Network) interface connected to them. The transmission / reception unit 96 performs transmission / reception with the client 2, the NGN management server 4, and the GPS terminal 3.

  The function unit of the user authentication unit 111, the connection position acquisition unit 113, the user position acquisition unit 114, and the determination unit 115 in the service provision permission device 11 illustrated in FIG. 1 or 5 includes the control program 99, the control unit 91, and the main memory. The unit 92, the external storage unit 93, and the transmission / reception unit 96 are used as resources.

  In addition, the hardware configuration and the flowchart described above are merely examples, and can be arbitrarily changed and modified.

  A central part that performs control processing including the control unit 91, the main storage unit 92, the external storage unit 93, the internal bus 90, and the like can be realized by using a normal computer system without using a dedicated system. . For example, a computer program for executing the above operation is stored and distributed in a computer-readable recording medium (flexible disk, CD-ROM, DVD-ROM, etc.), and the computer program is installed in the computer. Thus, the service provision permission device 11 that executes the above-described processing may be configured. Alternatively, the service provision permission device 11 may be configured by storing the computer program in a storage device included in a server device on a communication network such as the Internet, and downloading it by a normal computer system.

  Further, when the function of the service provision permission device 11 is realized by sharing an OS (operating system) and an application program, or by cooperation between the OS and the application program, only the application program portion is stored in a recording medium or a storage device. It may be stored.

  It is also possible to superimpose a computer program on a carrier wave and distribute it via a communication network. For example, the computer program may be posted on a bulletin board (BBS: Bulletin Board System) on a communication network, and the computer program distributed via the network. The computer program may be started and executed in the same manner as other application programs under the control of the OS, so that the above-described processing may be executed.

1 Site management server
2 clients
3 GPS terminal
4 NGN management server
5 NGN
6 Mobile communication network
7 Payment network
8 Settlement center
11 Service provision permission device
12 Service content
13 Transceiver
90 Internal bus
91 Control unit
92 Main memory
93 External storage
96 transceiver
99 Control program 101, 102 Service provision permission system
111 User authentication part
112 User authentication information
113 Connection position acquisition unit
114 User position acquisition unit
115 judgment part

Claims (4)

Communicates via a network to a user terminal, a mobile communication terminal, and a connection location information storage device that stores the IP address of the user terminal in association with connection location information that can identify the connection location of the user terminal A service providing permission device connected in a possible manner,
Identification information registration means for registering user identification information indicating a user and mobile communication terminal identification information indicating the mobile communication terminal possessed by the user in association with each other;
Identification information receiving means for receiving the user identification information and the IP address of the user terminal transmitted from the user terminal via the network after the provision of a predetermined service is requested from the user terminal;
Registration determination means for determining whether or not the user identification information received by the identification information receiving means is registered in the identification information registration means;
When it is determined by the registration determining means that the user identification information is registered, the connection position information storage device corresponding to the IP address received by the identification information receiving means is connected to the connection position information storage device via the network. Connection position information acquisition means acquired from:
Identification information detecting means for detecting the mobile communication terminal identification information corresponding to the user identification information received by the identification information receiving means from the identification information registration means;
Current position information for acquiring the current position information that can identify the current position of the mobile communication terminal from the mobile communication terminal indicated by the mobile communication terminal identification information detected by the identification information detecting means via the network Information acquisition means;
Based on the connection position information acquired by the connection position information acquisition means and the current position information acquired by the current position information acquisition means, a separation distance between the user terminal and the mobile communication terminal is less than a predetermined threshold value By determining whether or not the user terminal is being used by the user indicated by the user identification information received by the identification information receiving means; and
By said user recognition unit, wherein the user terminal, when it has been determined that used by said user to said user identification information indicates, and a service providing permission means for permitting the provision of the predetermined service to the user terminal ,
The user discriminating unit discriminates whether or not the user terminal is being used by the user indicated by the user identification information received by the identification information receiving unit, using a different threshold for each user indicated by the user identification information. To
Service providing permission and wherein a call. In addition to determining whether or not the separation distance between the user terminal and the mobile communication terminal is less than a predetermined threshold, the user determination means is based on the current position information acquired by the current position information acquisition means. By determining whether or not the current position of the specified mobile communication terminal is within a predetermined area, the user terminal is used by the user indicated by the user identification information received by the identification information receiving means To determine whether or not
The service provision permission apparatus according to claim 1, wherein: Communicates via a network to a user terminal, a mobile communication terminal, and a connection location information storage device that stores the IP address of the user terminal in association with connection location information that can identify the connection location of the user terminal A service provision permission method by a service provision permission device connected in a possible manner,
An identification information registration step of registering user identification information indicating a user and mobile communication terminal identification information indicating the mobile communication terminal possessed by the user in association with each other;
An identification information receiving step for receiving the user identification information transmitted from the user terminal via the network and the IP address of the user terminal after the provision of a predetermined service is requested from the user terminal;
A registration determination step for determining whether or not the user identification information received in the identification information reception step is registered in the identification information registration step;
If it is determined that the user identification information is registered in the registration determination step, the connection position information storage device corresponding to the IP address received in the identification information reception step is transmitted via the network. Connection position information acquisition step acquired from
An identification information detection step of detecting the mobile communication terminal identification information corresponding to the user identification information received by the identification information reception step from the identification information registration step;
Current position information for acquiring the current position information for identifying the current position of the mobile communication terminal from the mobile communication terminal indicated by the mobile communication terminal identification information detected by the identification information detection step via the network An information acquisition step;
Based on the connection position information acquired by the connection position information acquisition step and the current position information acquired by the current position information acquisition step, a separation distance between the user terminal and the mobile communication terminal is less than a predetermined threshold A user determination step of determining whether or not the user terminal is being used by a user indicated by the user identification information received by the identification information reception step;
By said user determining step, said user terminal, when it has been determined that used by said user to said user identification information indicates, and a service providing permission step of permitting the provision of the predetermined service to the user terminal ,
In the user determining step, it is determined whether or not the user terminal is being used by the user indicated by the user identification information received in the identification information receiving step by using a different threshold for each user indicated by the user identification information. To
Service provides permission wherein a call. Communicates via a network to a user terminal, a mobile communication terminal, and a connection location information storage device that stores the IP address of the user terminal in association with connection location information that can identify the connection location of the user terminal A computer connected to
Identification information registration means for registering user identification information indicating a user and mobile communication terminal identification information indicating the mobile communication terminal possessed by the user in association with each other;
Identification information receiving means for receiving the user identification information and the IP address of the user terminal transmitted from the user terminal via the network after the provision of a predetermined service is requested from the user terminal;
Registration determination means for determining whether or not the user identification information received by the identification information receiving means is registered in the identification information registration means;
When it is determined by the registration determining means that the user identification information is registered, the connection position information storage device corresponding to the IP address received by the identification information receiving means is connected to the connection position information storage device via the network. Connection position information acquisition means acquired from
Identification information detection means for detecting the mobile communication terminal identification information corresponding to the user identification information received by the identification information receiving means from the identification information registration means;
Current position information for acquiring the current position information that can identify the current position of the mobile communication terminal from the mobile communication terminal indicated by the mobile communication terminal identification information detected by the identification information detecting means via the network Information acquisition means,
Based on the connection position information acquired by the connection position information acquisition means and the current position information acquired by the current position information acquisition means, a separation distance between the user terminal and the mobile communication terminal is less than a predetermined threshold value User determining means for determining whether or not the user terminal is being used by the user indicated by the user identification information received by the identification information receiving means,
When the user determining unit determines that the user terminal is being used by the user indicated by the user identification information, the user determining unit functions as a service providing permission unit that permits the user terminal to provide the predetermined service. ,
The user discriminating unit discriminates whether or not the user terminal is being used by the user indicated by the user identification information received by the identification information receiving unit, using a different threshold for each user indicated by the user identification information. To
Program which is characterized a call.

Images