JP5694047B2 - Authentication device, user terminal, authentication method, and program - Google Patents

Description

  The present invention relates to an authentication technique for confirming the identity of a user when applying for a service such as an IP phone.

  In recent years, Internet-based IP telephone services have become widespread. In the IP telephone service, an application for IP telephone can be installed in a user terminal, and a call can be made with another terminal via the Internet by the function of the application.

  Further, through a gateway on the network, a call between the user terminal and a general telephone (fixed telephone, mobile phone, etc.) is possible.

  In such a service, a service application is made to a service provider so that the user terminal can execute IP telephone communication. Thereby, allocation / setting of various setting information for IP telephone communication is performed.

JP 2002-207929 A

  In the service provider that provides the service as described above, it is important to confirm the identity of the service user when accepting a new service application.

  For example, it is conceivable to accept user information (address, name, etc.) of a mobile terminal (smartphone, etc.) used as the above user terminal at the time of application, but with the information as it is, the user information is actually a service It is difficult to determine whether the information is for the user who uses the password, and it is difficult to confirm the identity with this method.

  On the other hand, it may be possible to verify the identity by receiving an ID card at the time of application or sending an application confirmation document by mail, etc. At the same time, there is a problem that it is impossible to immediately respond to an application from a user.

  The present invention has been made in view of the above points, and provides a technique that enables simple and quick confirmation of a user identity with high certainty when providing a service such as a network service. Objective.

  In order to solve the above-described problem, the present invention is an authentication device that is connected to a user terminal via a network and authenticates the user of the user terminal, from the user terminal to the user's telephone number and Means for receiving a confirmation number input by the user, means for making a call with the received telephone number as a destination, and establishing a telephone line with the destination of the telephone number; Means for receiving number information input at the destination via the telephone line, comparing the number information with the confirmation number, and determining that the authentication is successful if they are the same. It is comprised as an authentication apparatus characterized by the above.

  The user terminal is a terminal for receiving a predetermined communication service, and the setting information necessary for the user terminal to receive the predetermined communication service when the authentication device determines that the authentication is successful. It is good also as a means to transmit to the said user terminal.

  Further, the user terminal is a terminal for performing IP telephone communication, and when the authentication device determines that the authentication is successful, the user terminal as setting information necessary for the user terminal to perform IP telephone communication. A means for transmitting the SIP communication information to the user terminal may be further provided.

  A mobile phone terminal that is the destination of the telephone number may be used as the user terminal, in which case the telephone number is the mobile phone number of the mobile phone terminal.

  The present invention may be configured as an authentication method executed by the authentication device. Moreover, you may comprise this invention as a program for functioning as each means in the said authentication apparatus.

  Further, the present invention provides a user terminal connected to the authentication device, the means for transmitting the telephone number of the user and a confirmation number input by the user to the authentication device, and the authentication A means for transmitting a confirmation request for confirming whether or not the authentication has succeeded to the authentication device, and when receiving information from the authentication device indicating that the authentication has been successful by the confirmation request, And a means for requesting the setting information and storing the setting information received from the authentication device in a storage means.

  Moreover, this invention can also be comprised as a program for functioning a computer as each means in the said user terminal.

  It is possible to easily and quickly confirm the user identity with high certainty when providing a service such as a network service.

It is a figure which shows the example of the whole structure of the system in embodiment of this invention. It is a functional block diagram of the setting / authentication apparatus 20 in embodiment of this invention. It is a functional lineblock diagram of user terminal 10 in an embodiment of the invention. FIG. 10 is a sequence diagram for explaining an incoming call authentication / automatic setting operation in the embodiment of the present invention.

  Embodiments of the present invention will be described below with reference to the drawings. In this embodiment, as an example, the incoming call authentication method according to the present invention is used to confirm the identity of a user at the time of application for use of an IP telephone service using a mobile terminal such as a smartphone. The present invention is not limited to this and can be applied to various other services.

(System configuration)
FIG. 1 shows an overall configuration diagram of a system according to the present embodiment. As shown in FIG. 1, the system according to the present embodiment is configured by connecting the Internet 1 and the telephone network 2 via the GW 3, and the user terminal 10 and the setting / authentication device 20 are connected to the Internet 1. Yes. The telephone network 2 is, for example, a PSTN, a cellular phone network, a VoIP communication network provided by a carrier, or the like, and may be a network in which these networks are interconnected.

  As user terminal 10 in this embodiment, a portable terminal (smart phone etc.) provided with a cellular phone function is assumed. The user terminal 10 is connected to the Internet 1 via a wireless communication network 4 (a mobile phone network, a wireless LAN network, etc.), another terminal 30 connected to the Internet 1, a telephone 5 connected to the telephone network 2, etc. And IP phone communication.

  In order to enable the IP telephone communication as described above, it is necessary to set the SIP communication information and the like on the user terminal 10 and the network side (GW 3 or the like).

  The setting / authentication device 20 is a device that performs identity verification (authentication) of the user when setting the SIP communication information, automatic setting of SIP communication information for the user terminal 10, and the like. In FIG. 1, the setting / authentication device 20 is shown as being connected only to the Internet 1, but the setting / authentication device 20 is connected to the telephone number of the user terminal 10 (in this embodiment, a mobile phone). Number), and can perform telephone communication with the user terminal 10.

  FIG. 2 shows a functional configuration diagram of the setting / authentication apparatus 20. As shown in FIG. 2, the setting / authentication apparatus 20 includes an application reception function unit 21, an incoming call authentication function unit 22, a setting information allocation function unit 23, a terminal automatic setting function unit 24, a status management function unit 25, and an information storage unit 26. Is provided.

  The application reception function unit 21 receives information necessary for application from the user terminal 10 and stores it in the information storage unit 26. Information necessary for the application is, for example, the user name, address, telephone number, credit card number, and the like.

  The incoming call authentication function unit 22 receives an incoming call authentication request including a telephone number used for incoming call authentication and a confirmation number (referred to as a “PIN code”) from the user terminal 10 and makes a call to the telephone number. And a PB signal input by the user through the telephone line established by the call, and receiving the PB signal from the user terminal 10, recognizing the number information from the PB signal, and comparing it with the PIN code for authentication. Has the function to perform.

  The setting information assignment function unit 23 stores IP phone number candidates in the storage means, and has a function of assigning an IP phone number corresponding to the user terminal 10 of the user who has been successfully authenticated. The user terminal 10 also has a function of assigning SIP communication information necessary for performing IP telephone communication. The assigned information is stored in the information storage unit 26 for each user (that is, for each user terminal).

  The terminal automatic setting function unit 24 has a function of transmitting initial setting information (SIP communication information) necessary for IP telephone communication to the user terminal 10 and causing the user terminal 10 to set SIP communication information. The SIP communication information is information necessary for the user terminal 10 to perform SIP telephone communication with other terminals and telephones by SIP. The nickname, SIP-ID, password, GW3 address, etc. corresponding to the user terminal 10 It is information including. Note that the IP telephone number of the user terminal 10 assigned by the setting information assignment function unit 23 and the SIP communication information are set in association with each other on the network side (GW 3 or the like). In addition, although the IP phone number is not set in the user terminal 10 as information used for communication, the IP phone number can be displayed on the display to notify the user.

  The status management function unit 25 is a function unit that manages the progress (status) of a series of application procedures. If an incoming call authentication NG or an incoming call authentication waiting time is exceeded, the application procedure is interrupted, and the user terminal 10 again. Has a function of performing control such as requesting input of authentication information (telephone number, PIN code, etc.).

  The information storage unit 26 is a functional unit that stores application information, a telephone number for IP phone, setting information, and the like for each user (for each user terminal), and constitutes a database system.

  The setting / authentication device 20 may be configured as one device (computer), or may be configured by connecting to a network as a different device (computer) for each functional unit or for each of a plurality of functional units. For example, the application reception function unit 21 can be configured as one device, and the other functional units can be configured as another device. Even if the setting / authentication device 20 is configured by a plurality of computers, the setting / authentication device 20 can be referred to as the setting / authentication device 20 as a whole.

  The setting / authentication apparatus 20 can be realized by causing one or a plurality of computers to execute a program describing the processing content described in the present embodiment. That is, the function of each unit of the setting / authentication device 20 is a program corresponding to processing executed by each unit using hardware resources such as a CPU and a memory built in the computer constituting the setting / authentication device 20. It is possible to implement by executing. In addition, the program is a computer-readable recording medium such as FD (Floppy (registered trademark) Disk), MO (Magneto-Optical disk), ROM (Read Only Memory), memory card, CD (Compact Disk)- ROM, DVD (Digital Versatile Disk) -ROM, BD (Blu-ray Disk) -ROM, CD-R, CD-RW, DVD-R, DVD-RW, BD-R, BD-RE, HDD, removable disk, etc. It can be recorded and stored or distributed. It is also possible to provide the program through a network such as the Internet or electronic mail.

  FIG. 3 shows a functional configuration diagram of the user terminal 10 according to the present embodiment (assuming a portable terminal such as a smartphone in the present embodiment). The user terminal 10 includes an application unit 100 and a telephone function unit 200. Note that the user terminal 10 includes a wireless communication function, and the application unit 100 and the telephone function unit 200 perform wireless communication using the wireless communication function.

  The application unit 100 is a functional unit realized by an application program installed in the user terminal 10, and includes an application information input / transmission function unit 101, an incoming call authentication control function unit 102, and an automatic setting function unit 103.

  Although the user terminal 10 also has a function for performing IP telephone communication, FIG. 3 mainly shows functions related to incoming call authentication and automatic setting related to the present invention, and does not show an IP telephone communication function. The IP telephone communication function may be provided in the application unit 100 or may be provided as an application different from the application unit 100.

  The application information input / transmission function unit 101 displays a GUI for allowing the user to input application information (user name, address, telephone number, credit card number, etc.) on the display of the user terminal 10, and the application input by the user. It is a functional unit that receives information and transmits the input application information to the setting / authentication apparatus 20.

  The incoming call authentication control function unit 102 displays on the display of the user terminal 10 a GUI for allowing the user to input a telephone number and PIN code for incoming call authentication, and receives the telephone number and PIN code for incoming call input from the user. A function for transmitting an incoming authentication request including “” to the setting / authentication device 20, making a confirmation request (polling) to the setting / authentication device 20 for confirming the incoming authentication status, and obtaining a confirmation result from the setting / authentication device 20 It has a function.

  When the authentication is OK, the automatic setting function unit 103 receives the SIP communication information necessary for the IP telephone communication from the setting / authentication apparatus 20 and stores it in the storage unit of the user terminal 10 so that it can be used for the IP telephone communication. It is a functional part. That is, it is a functional unit that automatically sets SIP communication information.

  The telephone function unit 200 is a functional unit that is assigned a telephone number (in this embodiment, this is a telephone number for incoming call authentication), and makes and receives calls and calls using the telephone number. In the present embodiment, the telephone number is a mobile phone number. The telephone function unit 200 generally includes a PB (push button) input function unit 201 used when inputting a telephone number.

  The application unit 100 of the user terminal 10 can be realized by causing a computer (configuration including a CPU and a memory) to execute a program describing the processing content described in the present embodiment. In addition, the program is a computer-readable recording medium such as FD (Floppy (registered trademark) Disk), MO (Magneto-Optical disk), ROM (Read Only Memory), memory card, CD (Compact Disk)- ROM, DVD (Digital Versatile Disk) -ROM, BD (Blu-ray Disk) -ROM, CD-R, CD-RW, DVD-R, DVD-RW, BD-R, BD-RE, HDD, removable disk, etc. It can be recorded and stored or distributed. It is also possible to provide the program through a network such as the Internet or electronic mail.

(System operation)
Next, an example of incoming call authentication and automatic setting processing executed between the user terminal 10 and the setting / authentication apparatus 20 will be described with reference to the sequence diagram of FIG. Below, the example at the time of the service application for performing IP telephone communication by the user terminal 10 is demonstrated.

  The user of the user terminal 10 inputs application information using a GUI displayed by the application information input / transmission function unit 101 of the application unit 100, and the application information input / transmission function unit 101 sets the input application information. -It transmits to the authentication apparatus 20 (step 1).

  In the setting / authentication apparatus 20, the application reception function unit 21 receives the application information, and stores the application information in the information storage unit 26 (step 2). The application reception function unit 21 notifies the status management function unit 25 that the status of the user is “provisional application completed” (step 3). Upon receiving the notification, the status management function unit 25 associates with the application information (including identification information that can identify the user terminal 10) of the user stored in the information storage unit 26 as status information “provisional application completed”, for example. Is recorded. Alternatively, separately from the user application information, the identification information of the user terminal 10 and information indicating “provisional application completion” may be stored in the storage unit as status information. The identification information of the user terminal 10 here may be input as application information, or may be information (such as the address of the user terminal 10) that is automatically added when the application information is transmitted. .

  Subsequently, the incoming call authentication control function unit 102 in the application unit 100 of the user terminal 10 displays a GUI for inputting the telephone number of the user terminal 10 (that is, the telephone number of the telephone function unit 200) and the PIN code. An incoming call authentication request including the telephone number and PIN code input by the user is transmitted to the setting / authentication device 20 (step 4).

  When the application information 100 includes a phone number for incoming call authentication in the application information, the application unit 100 keeps the telephone number input as the application information, and allows only the PIN code to be input when an incoming call authentication is requested. An incoming call authentication request including the stored telephone number and the input PIN code may be transmitted to the setting / authentication device 20.

  Further, the incoming call authentication control function unit 102 automatically acquires the telephone number of the user terminal 10 from the predetermined storage means of the user terminal 10 without using the telephone number input by the user as the telephone number for incoming call authentication. Then, the telephone number may be transmitted to the setting / authentication apparatus 20 as a telephone number for incoming call authentication.

  In the setting / authentication apparatus 20, when the incoming call authentication function unit 22 receives the telephone number and the PIN code, the PIN code is held in the storage means and a call is made to the telephone number (step 5). When the telephone function unit 200 of the user terminal 10 that is the destination of the call rings a ringing tone notifying the user of the incoming call and the user answers (answers the call), the telephone function unit 200 of the user terminal 10 is set and authenticated. A telephone line (this can also be called an authentication communication line) is established between the devices 20 (step 6).

  At this time, the setting / authentication device 20 may send a guidance message prompting the user to enter a PIN code with a push button to the telephone function unit 200 of the user terminal 10 via the telephone line.

  When the user of the user terminal 10 inputs the same PIN code as the PIN code input in step 4 from the PB input function unit 201, the incoming call authentication function unit in the setting / authentication apparatus 20 generates a PB signal corresponding to the input PIN code. 22 (step 7).

  The incoming call authentication function unit 22 identifies number information (numerical string) from the received PB signal, compares the number information with the PIN code received in step 4, and determines whether they are the same (step) 8). After receiving the PB signal as the PIN code, the authentication communication line may be disconnected.

  As a result of the determination, if the number information and the PIN code are the same, the incoming call authentication function unit 22 determines that the authentication is successful and completes the application. That is, FIG. 4 shows the case of successful authentication, and the incoming call authentication function unit 22 notifies the status management function unit 25 that the status of the user terminal 10 is “application completed” (step 9). ), The status management function unit 25 records in the information storage unit 26 that the status of the user terminal 10 is “application completed”.

  Then, the status management function unit 25 that has recognized “application completed” sends a setting information allocation processing request for the telephone number and the like for the user terminal 10 to the setting information allocation function unit 23 (step 10). The setting information assignment function unit 23 assigns an IP telephone number (for example, 050 number) and SIP communication information to the user terminal 10 and stores them in the information storage unit 26 (step 11).

  On the other hand, the incoming call authentication control function unit 102 in the application unit 100 of the user terminal 10 applies to the setting / authentication device 20 at regular time intervals after step 4 until, for example, a status of “application completed” is obtained. The status confirmation request is transmitted (step 12). This confirmation request includes identification information of the user terminal 10. Instead of making a confirmation request at regular time intervals as described above, a confirmation request may be transmitted using a user operation as a trigger (when a specific button is pressed or the like). Further, for example, when the user terminal 10 has a specification in which the application does not operate during the telephone communication by the telephone function unit 200, the telephone line is disconnected (disconnected by an operation on the user terminal 10, or When the application unit 100 starts re-operation after being disconnected from the setting / authentication device 20 (when the application is redisplayed), the incoming call authentication control function unit 102 may make a confirmation request.

  The status management function unit 25 in the setting / authentication device 20 that has received the confirmation request acquires the status corresponding to the user terminal 10 from the information storage unit 26, and returns the status to the user terminal 10 (step 13).

  If the received status is “application completed”, the incoming call authentication control unit 102 in the user terminal 10 stops transmitting the confirmation request and notifies the automatic setting function unit 103 of “application completed” (step 14). . Upon receiving the notification, the automatic setting function unit 103 determines that the SIP communication information can be set, displays a GUI (setting request button or the like) as an operation trigger by the user on the display, and performs an operation (setting request from the user). When the button is pressed, a setting information request (including identification information of the user terminal 10) is transmitted to the setting / authentication apparatus 20 (step 15). Note that the setting information request may be transmitted to the setting / authentication apparatus 20 when the “application completion” is grasped without performing the setting request button or the like.

  In the setting / authentication apparatus 20 that has received the setting information request, the terminal automatic setting function unit 24 acquires SIP communication information as setting information corresponding to the user terminal 10 from the information storage unit 26, and stores the SIP communication information. It transmits to the user terminal 10 (step 16). In the user terminal 10 that has received the SIP communication information, the automatic setting function unit 103 stores the SIP communication information in the storage means so that it can be used for IP telephone communication (step 17).

  In addition, although the telephone number for IP telephone and the SIP communication information of the user terminal 10 are set to the network side, any method may be used. For example, it may be set automatically at the same timing as the information setting for the user terminal 10 or may be manually set by the network administrator.

  In step 8, when the number information and the PIN code do not match and the incoming call authentication function unit 22 determines that the incoming call authentication is NG, the status management function unit 25 is notified of the status indicating “incoming call authentication NG”, The status management function unit 2 records the status indicating “incoming authentication NG” in the information storage unit 26 as the status of the user terminal 10, and returns to the stage before step 4, for example, to re-enter the telephone number and PIN code. The process requested to the user terminal 10 is performed, and the process from step 4 is re-executed. Further, after step 5 or 6, even when a PB signal is not received within a certain time, “incoming authentication NG” is similarly performed, and a process of requesting the user terminal 10 to re-enter a telephone number and a PIN code is performed.

  In the example described so far, the user terminal 10 used for the IP telephone communication includes the application unit 100 for authentication control and setting and the telephone function unit 200 for executing the incoming authentication, and sets the telephone number for incoming authentication. Although the telephone number of the user terminal 10 is used, the telephone number for incoming call authentication may not be the telephone number of the user terminal 10. For example, the telephone number for incoming call authentication may be a telephone number of a telephone different from the user terminal 10 (this is also the telephone number of the user of the user terminal 10). In this case, a call for incoming call authentication from the setting / authentication device 20 is made to the other telephone set, and if a correct PIN code (PB signal) is input from the telephone set, it is determined that the authentication is OK. In this form, a terminal that does not include the telephone function unit 200 can be used as a user terminal used for IP telephone communication.

(Effect of embodiment)
As described above, in this embodiment, incoming call authentication is used to confirm the identity of the user of the user terminal used to receive the service. Since the telephone number for incoming call authentication is the telephone number of the telephone line that the user has already contracted after confirming the identity at the time of contracting, from the destination of the telephone number (the contracting user of the telephone number) When the same number information as the confirmation number input by the user is returned, it can be estimated that the user of the user terminal is the same as the telephone number contract user. Therefore, this incoming call authentication method makes it possible to confirm the identity of the user with high certainty.

  Further, in the present embodiment, it is possible to conceal SIP communication information so that it cannot be diverted by automatically executing initial setting of SIP communication information for the user terminal when using the service.

  The present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims.

1 Internet 2 Telephone network 3 GW
4 Wireless Communication Network 5 Telephone 10, 30 User Terminal 20 Setting / Authentication Device 21 Application Accepting Function Unit 22 Incoming Authentication Function Unit
23 Setting information allocation function unit 24 Terminal automatic setting function unit 25 Status management function unit 26 Information storage unit 100 Application unit 101 Application information input / transmission function unit 102 Incoming authentication control function unit 103 Automatic setting function unit 200 Telephone function unit 201 PB input Functional part

Claims (6)

An authentication device connected to a user terminal via a network and authenticating a user of the user terminal with a predetermined confirmation number ,
Means for making a call with the telephone number of the user for authentication as a call destination and establishing a call line with the callee of the telephone number;
Means for receiving number information transmitted from the destination via the telephone line, and comparing the number information with the predetermined confirmation number;
When the number information and the predetermined confirmation number are the same, SIP communication information and IP telephone number are assigned to the user terminal as setting information necessary for the user terminal to perform IP telephone communication. An authentication device comprising: means for storing in an information storage unit .   The authentication apparatus according to claim 1, wherein the user terminal is a mobile phone terminal that is a destination of the phone number, and the phone number is a mobile phone number of the mobile phone terminal. An authentication method that is connected to a user terminal via a network and that is executed by an authentication device that authenticates a user of the user terminal with a predetermined confirmation number ,
Making a call with the user's telephone number for authentication as a callee and establishing a call line with the callee's callee;
A step of receiving said number information transmitted from said destination via a telephone line, comparing the with the number information given confirmation number,
When the number information and the predetermined confirmation number are the same, SIP communication information and IP telephone number are assigned to the user terminal as setting information necessary for the user terminal to perform IP telephone communication. And a step of storing in the information storage unit . The program for functioning a computer as each means in the authentication apparatus of Claim 1 or 2 . The user terminal connected to the authentication device according to claim 1 or 2 ,
Means for transmitting the telephone number of the user and the predetermined confirmation number input by the user to the authentication device;
Means for transmitting a confirmation request for confirming whether or not the authentication is successful to the authentication device;
When information indicating that the authentication is successful is received from the authentication device by the confirmation request, the setting information is requested from the authentication device, and the setting information received from the authentication device is stored in a storage unit. Means to
A user terminal comprising: The program for functioning a computer as each means in the user terminal of Claim 5 .

Images