JP5960181B2 - Network authentication method for securely verifying user identification information using user location information - Google Patents

Description

  The present invention relates to network identification authentication, and more particularly to a network authentication method for securely verifying user identification information.

  Currently, various Internet transactions are becoming increasingly popular. In order to secure these Internet transactions, user identification is essential.

  However, as the number of Internet users and Internet crime continues to increase and crime technology is constantly evolving, for example, Internet content providers (ICPs) need to provide each user with an identity authentication device.

  For this reason, the cost of customer service for personalization, distribution and troubleshooting cannot be ignored. Furthermore, it is very inconvenient for the user to have different identity authentication devices for different ICPs. In addition to intercepting and stealing user IDs and passwords, hackers also attempt to manipulate transaction data. Therefore, the ICP is frequently forced to change the hardware equipment, resulting in additional costs.

  Prior art in the related technical field is disclosed in US Patent Application Publication No. 2011/0239274.

US Patent Application Publication No. 2011/0239274

  Accordingly, an object of the present invention is to provide a network authentication method for safely verifying user identification information, which overcomes the problems of the prior art described above.

  According to an aspect of the present invention, a network authentication method executed by a network authentication system for securely verifying user identification information is provided. The network authentication system includes a user terminal operated by the user, a content providing server, a verification server, and a portable personal electronic device carried by the user. The user terminal, the content providing server, and the verification server are connected to a communication network. The portable personal electronic device can be connected to the user terminal via the communication network and / or near field communication.

  In the network authentication method, a) When correct user login data including a user identifier is received from the user terminal via the communication network, the content providing server includes the user identifier via the communication network. A) transmitting a verification request to the verification server; b) after receiving the verification request from the content providing server, the verification server further includes the user terminal and the portable device via the communication network. In response to the verification request, b) receiving hardware identification data and position information associated with a personal electronic device, and c) in response to the verification request, the verification server acquires the hardware identification data acquired in step b). Reference hardware corresponding to the user identifier stored in advance in the verification server Whether the user terminal and the portable personal electronic device are close to each other based on the position information, and determining whether the data matches another data or is a subset of the reference hardware identification data Steps c) and d) detecting that the match or the hardware identification data is a subset of reference hardware identification data, and that the user terminal and the portable personal electronic device are in close proximity to each other If it is determined that the verification information is present, the verification server includes a step d) of transmitting a verification response indicating successful authentication of the identification information of the user to the content providing server via the communication network.

  According to another aspect of the present invention, there is provided a network authentication method executed by a network authentication system for securely verifying user identification information. The network authentication system includes a user terminal operated by the user, a content providing server, a verification server, and a portable personal communication device by the user. The user terminal, the content providing server, the verification server, and the portable personal communication device are connected to a communication network.

  The network authentication method includes: a) receiving correct user login data including a user identifier and first location data corresponding to a geographical location of the user terminal from the user terminal via the communication network; The content providing server sends a first request for second location data corresponding to a current geographical location of the portable personal communication device including the user identifier via the communication network. Steps a) and b) when receiving the first request from the content providing server, the verification server further receives the first request from the portable personal communication device via the communication network. Steps b) and c) for receiving hardware identification data and second position data associated with a portable personal communication device. Whether the hardware identification data acquired in step b) matches the reference hardware identification data corresponding to the user identifier stored in the verification server in advance or is a subset of the reference hardware identification data And if the match or the hardware identification data is a subset of the reference hardware identification data, the step c) of sending the second location data to the content providing server; and d) from the verification server Upon receiving the second position data, the content providing server, based on the first position data received in step a) and the second position data transmitted in step c), the user terminal and Determine whether the portable personal communication devices are close to each other; If the user terminal and the portable personal communication device is determined to be close to each other, including, as step d) determining the authentication success of the identification information of the user.

1 is a schematic block diagram illustrating a network authentication system configured to perform a first preferred embodiment of a network authentication method according to the present invention. It is a flowchart showing 1st preferable embodiment. It is a flowchart of the 1st process between step S23 and step S24 of 1st preferable embodiment. It is a flowchart of the 2nd process between step S23 and step S24 of 1st preferable embodiment. It is a flowchart of the 3rd process between step S23 and step S24 of 1st preferred embodiment. It is a schematic block diagram showing the 1st modification of a network authentication system. It is a flowchart of the 4th process between step S23 and step S24 of 1st preferred embodiment performed by the 1st modification of the network authentication system of FIG. It is a schematic block diagram showing the 2nd modification of a network authentication system. It is a flowchart of the 5th process between step S23 and step S24 of 1st preferred embodiment performed by the 2nd modification of the network authentication system of FIG. FIG. 5 is a schematic block diagram illustrating another network authentication system configured to perform the second preferred embodiment of the network authentication method according to the present invention. It is a flowchart showing 2nd preferable embodiment.

  Other features and advantages of the present invention will become apparent in the preferred embodiments described in detail below with reference to the drawings.

  Before describing the present invention in detail, it should be noted that like elements are designated by like reference numerals throughout the disclosure.

  Please refer to FIG. According to the present invention, a network authentication system is used to perform the first preferred embodiment of the network authentication method for securely verifying the identification information of the user 5.

  The network authentication system includes a user terminal 1 operated by a user 5 such as a personal computer or a notebook computer, a content providing server 2 such as an Internet content provider (ICP) server, a verification server 3, and a mobile phone carried by the user 5. Type personal electronic equipment 4.

  The user terminal 1, the content providing server 2, and the verification server 3 are connected to a communication network 100 such as the Internet.

  The portable personal electronic device 4 can be connected to the communication network 100 and / or connected to the user terminal 1 at a short distance (for example, see FIG. 6).

  In this embodiment, when the identification information of the user 5 is correctly authenticated by the network authentication system, the user 5 is permitted to access the data providing server 2 using the user terminal 1.

  FIG. 2 is a flowchart of a first preferred embodiment of a network authentication method representing a procedure in which the identification information of the user 5 is verified.

  The first preferred embodiment of the network authentication method includes the following steps.

In step S <b> 21, the user 5 inputs user login data using a user input interface (not shown) of the user terminal 1 on the website provided by the content providing server 2.
Then, the user login data is transmitted from the user terminal 1 to the content providing server 2 via the communication network 100.

In step S22, when the user login data is received from the user terminal 1, the content providing server 2 checks whether the user login data is correct.
If it is correct, the process proceeds to step S23. Otherwise, the content providing server 2 transmits an error message for display on a display device (not shown) of the user terminal 1 to the user terminal 1 (step S20).

  In step S <b> 23, the content providing server 2 transmits a verification request including the user identifier to the verification server 3 via the communication network 100.

  In the present embodiment, it is assumed that the verification server 3 is a third party designated by the content providing server 2 in order to execute authentication of identification information.

  In step S24, after receiving the verification request from the content providing server 2, the verification server 3 further receives hardware identification data and position information associated with the user terminal 1 and the portable personal electronic device 4.

  For example, as shown in FIG. 1, the user terminal 1 includes a global positioning system (GPS) module 11 and stores a first scan program 12 in advance.

  The portable personal electronic device 4 may be a smartphone or a tablet computer that includes the GPS module 41 and stores the second scan program 42 in advance (but is not limited thereto).

  In this example, two different network addresses (for example, IP addresses) are respectively assigned to the user terminal 1 and the portable personal electronic device 4.

  FIG. 3 shows a first process executed between step S23 and step S24, and represents a procedure in which hardware identification data and position information are provided to the verification server 3.

  The first process includes the following steps.

  After transmitting the verification request to the verification server 3 in step S31, the content providing server 2 further sends the first and second data requests to the user terminal 1 and the portable type via the communication network 100, respectively. Send to personal electronic device 4.

In step S32 , in response to the first data request from the content providing server 2, the user terminal 1 uses the GPS module to obtain the first position data corresponding to the geographical position of the user terminal 1. 11 is used to perform GPS positioning, to obtain a first combination of identification codes of a plurality of predetermined hardware components of the user terminal 1, and to execute the first scan program 12, and the communication network 100 Then, the first combination of the first position data and the identification code is transmitted to the verification server 3.
Since the generation of the first combination of identification codes by the execution of the first scan program 12 is known to those skilled in the art, it will be simplified and will not be described in detail.

  In step S <b> 33, the portable personal electronic device 4 responds to the second request from the content providing server 2, and the second position data corresponding to the current geographical position of the portable personal electronic device 4. To obtain a second combination of identification codes of a plurality of predetermined hardware components of the portable personal electronic device 4, using the GPS module 41 to perform GPS positioning. The scan program is executed, and the second combination of the second position data and the identification code is transmitted to the verification server 3 via the communication network 100.

Therefore, the first combination of identification codes from the user terminal 1 and the second combination of identification codes from the portable personal electronic device 4 are received by the verification server 3 in step S24 in cooperation. Hardware identification data.
The first position data from the user terminal 1 and the second position data from the portable personal electronic device 4 cooperate to form the position information received by the verification server 3 in step S24. .

  FIG. 4 shows a second process executed between step S23 and step S24, and represents a procedure in which hardware identification data and position information are provided to the verification server 3.

  The second process includes the following steps.

  In step S <b> 41, the content providing server 2 transmits a first data request to the user terminal 1 via the communication network 100.

  In step S <b> 42, in response to receiving the verification request from the content providing server 2, the verification server 3 transmits a second data request to the portable personal electronic device 4 via the communication network 100.

  In step S43, as in step S32 of FIG. 3, the first combination of identification codes and the first position data generated by the user terminal 1 are transmitted from the user terminal 1 to the verification server 3 via the communication network 100. Sent to.

  In step S44, as in step S33 of FIG. 3, the second combination of identification codes and the second position data generated by the portable personal electronic device 4 via the communication network 100 are the portable personal Is transmitted from the electronic device 4 to the verification server 3.

  FIG. 5 shows a third process executed between step S23 and step S24, and represents a procedure in which hardware identification data and position information are provided to the verification server 3.

  The third process includes the following steps.

  In step S51, the first data request is transmitted from the content providing server 2 to the user terminal 1 as in step S41 of FIG.

In step S52, as in step S43 of FIG. 4, the first combination of identification codes and the first position data generated by the user terminal 1 are transmitted from the user terminal 1 to the verification server 3 via the communication network 100. Sent to.
However, unlike the first process and the second process, the portable personal electronic device 4 periodically performs GPS positioning to acquire the second position data, and acquires the second combination of the identification codes. Therefore, the scan program 42 is automatically executed, and the second combination of the second position data and the identification code is periodically transmitted to the verification server 3.
In short, the step S53 of the third process includes the periodic generation of the second combination of the second position data and the identification code by the portable personal electronic device 4, and the transmission to the periodic verification server 3. Including.

In this case, the first combination of identification codes from the user terminal 1 and the second combination of identification codes received immediately before by the verification server 3 in step S24 after the verification server 3 receives the verification request cooperate. Thus, hardware identification data is configured.
The first position data from the user terminal 1 and the second position data received immediately before by the verification server 3 in step S24 cooperate to constitute position information.

Referring to FIG. 6, a first modification of the network authentication system is shown.
Unlike the network authentication system of FIG. 1, the user terminal 1 includes a short-range wireless communication interface 13 and stores a first scan program in advance.

The portable personal electronic device 4 cannot be connected to the communication network 100.
The portable personal electronic device 4 includes a short-range wireless communication interface 43 and stores a second scan program 42 in advance.
The short-range wireless communication interfaces 13 and 43 may use NFC (Near Field Communication), Bluetooth (registered trademark), or Wi-Fi technology.

  FIG. 7 shows a fourth process executed between step S23 and step S24, and represents a procedure in which hardware identification data and position information are provided to the verification server 3.

  The fourth process includes the following steps.

In step S <b> 71, the first data request is transmitted from the content providing server 2 to the user terminal 1 as in step S <b> 51 of FIG. 5.
In step S72, in response to the first data request from the content providing server 2, the user terminal 1 executes the first scan program 12 in order to obtain the first combination of identification codes.

Portable personal electronic device 4, close to the user terminal 1, the short-range wireless communications link with the user terminal 1 via near field communication interface 13,4 3 is established, the user terminal 1, short-range wireless communication link The second data request is transmitted to the portable personal electronic device 4 via.

In step S73, in response to the second data request from the user terminal 1, the portable personal electronic device 4 executes the second scan program 42 in order to obtain the second combination of identification codes. The second combination of identification codes is transmitted to the user terminal 1 via the short-range wireless communication link.
In this case, the second combination of identification codes functions as identification data associated with the portable personal electronic device 4.

In step S <b> 74, the user terminal 1 transmits, via the communication network 100, hardware identification data (that is, identification data) including the first combination of identification codes and the second combination of identification codes, and the user terminal 1. And the position information which shows that the portable personal electronic device 4 shares the same network address (namely, the network address allocated to the user terminal 1) is transmitted to the verification server 3.
Then, the hardware identification data and the position information are acquired by the verification server 3.

Referring to FIG. 8, a second modification of the network authentication system is shown.
Unlike the network authentication system of FIG. 6, the portable personal electronic device 4 may be an electronic card, and stores one identification code uniquely corresponding to the portable personal electronic device 4 (electronic card) in advance.

  The short-range wireless communication interfaces 13 and 43 may use an RFID (Radio Frequency IDentification) technology.

  FIG. 9 shows a fifth process executed between step S23 and step S24, and represents a procedure in which hardware identification data and position information are provided to the verification server 3.

  The fifth process includes the following steps.

  In step S91, the first data request is transmitted from the content providing server 2 to the user terminal 1 as in step S71 of FIG.

  In step S92, as in step S72 of FIG. 7, a first combination of identification codes is generated by the user terminal 1, and the second data request is transmitted from the user terminal 1 to the portable type using short-range wireless communication. It is transmitted to the personal electronic device 4.

  In step S93, in response to the second data request from the user terminal 1, the portable personal electronic device 4 uses the short-distance wireless communication to transmit one identification code functioning as identification data to the user terminal. Send to 1.

In step S94, the user terminal 1 transmits, via the communication network 100, hardware identification data (that is, identification data) including the first combination of identification codes and one identification code, and the user terminal 1 and the portable type. Position information indicating that the personal electronic devices 4 are close to each other is transmitted.
Then, the hardware identification data and the position information are acquired by the verification server 3.

Returning to FIGS. 1 and 2, after step S24, the process proceeds to step S25. In step S25, in response to the verification request, the verification server 3 stores the hardware identification data acquired by the verification server 3 in advance in the verification server 3 and corresponds to the user hardware (ie, user ID). It is determined whether or not it matches with the identification data 31.
If the hardware identification data, determines that the reference hardware identification data 31 match or as a subset of that, the process proceeds to step S26. Otherwise, the process proceeds to step S28.

  During the registration process before authentication, the user terminal 1 and the portable personal electronic device 4 provided by the same owner are registered in the content providing server 2, and the user terminal 1 and the portable personal electronic device 4 are It should be noted that the first scan program 12 and the second scan program 42 (FIGS. 1 and 6) or one identification code (FIG. 8) are read, respectively.

  Thereafter, the first and second scan programs 12 and 42 are respectively executed by the user terminal 1 and the portable personal electronic device 4, and the hardware component identification code of the user terminal 1 and the portable personal electronic An identification code of the hardware component of the device 4 is obtained, and they work together to form reference hardware identification data 31 corresponding to the user identifier of the owner.

  As another method, the first and second scan programs 12 and 42 obtain the identification code of the predetermined hardware component of the user terminal 1 and the identification code of the predetermined hardware component of the portable personal electronic device 4. Then, the reference hardware identification data 31 may be configured in cooperation.

  Alternatively, the identification code associated with the user terminal 1 obtained by the execution of the first scan program 12 and the identification code read into the portable personal electronic device 4 cooperate with each other as the user identifier of the owner. Corresponding reference hardware identification data 31 may be configured.

  The reference hardware identification data 31 is stored in the verification server 3 for authentication purposes.

  Therefore, if it is determined in step S25 that the hardware identification data is a subset of the reference hardware identification data 31 (or an exact match in the case of another method), the user terminal 1 operated by the user 5, and The portable personal electronic devices 4 carried by the user 5 belong to the same owner.

  In step S <b> 26, the verification server 3 determines whether the user terminal 1 and the portable personal electronic device 4 are close to each other based on the position information.

  For example, the first position data generated in the sub-steps S32, S43, and S53 of FIGS. 3, 4, and 5 is the first position data generated in the sub-steps S33, S44, and S53 of FIGS. When the position information transmitted in the sub-step S74 in FIG. 7 indicates that the user terminal 1 and the portable personal electronic device 4 share the same network address, When the location information transmitted in the sub-step indicates that the user terminal 1 and the portable personal electronic device 4 are close to each other, the verification server 3 determines that the user terminal 1 and the portable personal electronic device 4 are It determines with approaching, and progresses to step S27. Otherwise, the process proceeds to step S28.

  When a positive determination is made in step S25, and when the user terminal 1 and the portable personal electronic device 4 are close to each other (step S26), the user 5 takes the user terminal 1 and the portable personal electronic device 4 It should be noted that it is approved as the owner of

  In step S <b> 27, the verification server 3 transmits a verification response indicating successful authentication of the identification information of the user 5 to the content providing server 2 via the communication network 100. Therefore, the user 5 is permitted to access data to the content providing server.

  In step S <b> 28, the verification server 3 transmits a verification response indicating the authentication failure of the identification information of the user 5 to the content providing server 2 via the communication network. Therefore, the user 5 is denied data access to the content providing server 2.

  Referring to FIG. 10, in order to execute the second preferred embodiment of the network authentication method for securely verifying the identification information of the user 5 according to the present invention, a modification of the network authentication system of FIG. Another network authentication system is utilized.

  Unlike the network authentication system of FIG. 1, the user terminal 1 ′ of the network authentication system of FIG. 10 is a POS (Point Of Sale) terminal or an ATM (Automated Teller Machine) (but not limited thereto). First position data 14 corresponding to the geographical position of 'is stored in advance.

  The portable personal electronic device 4 ′ is a portable personal communication device 4 ′, and may be a smartphone or a tablet computer (however, it is not limited thereto).

  The portable personal communication device 4 'includes a GPS module 41 and stores a scan program 42' in advance.

  In the present embodiment, when the authentication of the identification information of the user 5 is successful by the network authentication system of FIG. 10, the user 5 is permitted to access the content providing server 2.

  FIG. 11 is a flowchart of a second preferred embodiment of the network authentication method representing a procedure in which the identification information of the user 5 is verified.

  The second preferred embodiment of the network authentication method includes the following steps.

  In step S <b> 10, the user 5 inputs user login data on the website provided by the content providing server 2 using a user input interface (not shown) of the user terminal 1 ′.

  Then, the user terminal 1 ′ transmits user login data and first location data to the content providing server 2 via the communication network 100.

  In the present embodiment, the user login data includes a user ID that functions as a user identifier and a password.

In step S11, when the user login data and the first position data are received from the user terminal 1 ′, the content providing server 2 checks whether the user login data is correct.
If it is correct, the process proceeds to step S12. Otherwise, the content providing server 2 transmits an error message to the user terminal 1 ′ for display on a display device (not shown) of the user terminal 1 ′ (step S9).

  In step S <b> 12, the content providing server 2 transmits a first request including the user identifier to the verification server 3 via the communication network 100.

  In the present embodiment, the verification server 3 is assumed to be a third party designated by the content providing server 2 in order to execute authentication of hardware identification information.

  In step S13, after receiving the first request from the content providing server 2, the verification server 3 further passes from the portable personal communication device 4 ′ to the portable personal communication device 4 ′ via the communication network 100. The hardware identification data and the position information associated with are received.

  As an example, in response to the first request from the content providing server 2, the verification server 3 carries the second request for the hardware identification data and the second location data via the communication network 100. Type personal communication device 4 '.

  Then, in response to the second request from the verification server 3, the portable personal communication device 4 ′ obtains the second position data corresponding to the current geographical position of the portable personal communication device 4 ′. In order to generate a GPS program, in order to obtain a combination of identification codes of a plurality of predetermined hardware components (not shown) of the portable personal communication device 4 ′ functioning as hardware identification data, a scan program 42 ′ Then, the second position data and the hardware identification data are transmitted to the verification server 3 via the communication network 100.

As another example, the portable personal communication device 4 ′ performs GPS positioning so as to periodically acquire the second position data, and automatically acquires a combination of identification codes that function as hardware identification data. Then, the scan program 42 ′ is executed, and the second position data and hardware identification data are periodically transmitted to the verification server 3 via the communication network 100.
Therefore, the verification server 3 periodically receives the hardware identification data and the second position data.

In step S14, the verification server 3, the hardware identification data acquired by the verification server, whether the reference hardware identification data 31 match or its subset of which corresponds to the user identifier stored in advance in the validation server 3 judge. If the determination result is affirmative, the process proceeds to step S15. Otherwise, the process proceeds to step S18.

  In step S <b> 15, the verification server 3 transmits the second position data to the content providing server 2. When the portable personal communication device 4 ′ periodically transmits the hardware identification data and the second location data, the verification request is received immediately before by the verification server 3 in step S13 after receiving the first request from the content providing server 2. It should be noted that the second position data is transmitted to the content providing server 2.

  In step S16, the content providing server 2 determines whether or not the user terminal 1 'and the portable personal communication device 4' are close to each other based on the first position data and the second position data.

When the content providing server 2 detects that the first position data matches the second position data, the content providing server 2 indicates that the user terminal 1 ′ and the portable personal communication device 4 ′ are close to each other. It is determined that
At this time, the content providing server 2 considers that the identification information of the user 5 is correctly authenticated (step S17).
Therefore, the user 5 is permitted data access to the content providing server 2 using the user terminal 1 ′.
Otherwise, the process proceeds to step S19.

  In step S18, when the hardware identification data is not detected as a subset of the reference hardware identification data 31, the verification server 3 transmits a verification failure response to the content providing server 2.

In step S19, in response to the verification failure response from the verification server 3 in step S18, or when it is determined in step S16 that the user terminal 1 ′ is not close to the portable personal communication device 4 ′, the content providing server 2 assumes that the authentication of the identification information of the user 5 has failed.
Therefore, the user 5 is denied data access to the content providing server 2.

  In short, the network authentication method of the present invention uses verification of hardware identification information and location verification of the user terminals 1, 1 ′ and portable personal electronic devices 4, 4 ′. Therefore, it is relatively difficult for a hacker to steal the hardware information and the position information associated with the user terminals 1, 1 ′ and the portable personal electronic devices 4, 4 ′ at the same time. Thereby, the safe verification of the identification information of the user 5 is ensured. Furthermore, the user's own smartphone or tablet computer can be used as the portable personal electronic device 4, 4 ′ without requiring an additional identity authentication device. Therefore, the cost of identity authentication in the content providing server 2 can be reduced.

  Although the invention has been described in connection with the most practical and preferred embodiments, it is not intended that the invention be limited to the disclosed embodiments, but to be encompassed within the spirit and scope of the broadest interpretation. It should be understood that changes and equivalent modifications are intended to be included.

Claims (14)

A network authentication method executed by a network authentication system for securely verifying user identification information, wherein the network authentication system includes a user terminal operated by the user, a content providing server, a verification server, and the user The user terminal, the content providing server, and the verification server are connected to a communication network, and the portable personal electronic device is connected to the communication network, and / or Or in a network authentication method that is connectable to the user terminal via short-range wireless communication,
a) Upon receiving correct user login data including a user identifier from the user terminal via the communication network, the content providing server sends a verification request including the user identifier to the verification via the communication network. A) sending to the server;
b) After receiving the verification request from the content providing server, the verification server further receives hardware identification data and location information associated with the user terminal and the portable personal electronic device via the communication network. Receiving step b);
c) In response to the verification request, the verification server matches the hardware identification data acquired in step b) with reference hardware identification data corresponding to the user identifier stored in the verification server in advance. A step c for determining whether the user terminal and the portable personal electronic device are close to each other based on the position information )When,
d) detecting that the hardware identification data is a subset of matching or its and the reference hardware identification data, and if it is determined that the user terminal and the portable personal electronic devices are close to each other The verification server transmits a verification response indicating successful authentication of the identification information of the user to the content providing server via the communication network; d)
A network authentication method comprising: In the network authentication method, wherein the portable personal electronic device is connected to the communication network, and two different network addresses are assigned to the user terminal and the portable personal electronic device, respectively.
Between step a) and step b),
e) the content providing server transmitting a first data request to the user terminal via the communication network; e);
f) In response to a first data request from the content providing server, the user terminal performs GPS positioning to obtain first position data corresponding to a geographical position of the user terminal, and Executing a first scan program preinstalled to obtain a first combination of identification codes of a plurality of predetermined hardware components of the user terminal, and via the communication network, the first position data and Transmitting the first combination of identification codes to the verification server f);
g) The portable personal electronic device performs GPS positioning to obtain second position data corresponding to the current geographical position of the portable personal electronic device, and the portable personal electronic device A second scan program pre-installed to obtain a second combination of identification codes of a plurality of predetermined hardware components, and the second location data and the identification code via the communication network G) transmitting the second combination of to the verification server;
Including
The first combination of identification codes transmitted in step f) and the second combination of identification codes transmitted in step g) are cooperatively received by the verification server in step b). The first location data transmitted in step f) and the second location data transmitted in step g) cooperate to form hardware identification data and in step b) the verification server The network authentication method according to claim 1, wherein the location information received by the server is configured. In step e), the content providing server further transmits a second data request to the portable personal electronic device via the communication network,
In step g), the portable personal electronic device performs GPS positioning and executes a second scan program in response to receiving a second data request from the content providing server. The network authentication method according to claim 2. Before step g)
f ′) In response to receiving the verification request from the content providing server, the verification server transmits a second data request to the portable personal electronic device via the communication network f ′. )
In step g), the portable personal electronic device performs GPS positioning and executes the second scan program in response to receiving the second data request from the verification server. The network authentication method according to claim 2. In step g), the portable personal electronic device periodically performs GPS positioning to obtain the second position data and automatically obtains the second combination of identification codes. Executing a second scan program, periodically transmitting the second combination of the second position data and the identification code to the verification server;
The first combination of identification codes transmitted in step f) and the second combination of identification codes transmitted immediately to the verification server in step g) after the verification server receives the verification request Collaborate to form hardware identification data and immediately before the verification server in step g) after the first location data transmitted in step f) and the verification server receives the verification request. The network authentication method according to claim 2, wherein the second location data transmitted to the network cooperates to constitute the location information.   In step c), when the first position data matches the second position data, the verification server determines that the user terminal and the portable personal electronic device are close to each other. The network authentication method according to claim 2, wherein: In the network authentication method in which the portable personal electronic device can be connected to the user terminal via short-range wireless communication,
Between step a) and step b),
h) the content providing server transmits a first data request to the user terminal via the communication network; h);
i) In response to the first data request from the content providing server, the user terminal obtains a first combination of identification codes of a predetermined plurality of hardware components of the user terminal. When the installed first scan program is executed and a short-range wireless communication link is established with the portable personal electronic device, a second data request is sent to the portable type via the short-range wireless communication link. Sending to a personal electronic device i);
j) In response to the second data request from the user terminal, the portable personal electronic device transmits identification data associated with the portable personal electronic device via the short-range wireless communication link. Sending to the user terminal j);
k) the user terminal transmitting the hardware identification data including the first combination of identification codes and the identification data and the location information to the verification server via the communication network k);
The network authentication method according to claim 1, further comprising:   In step j), the portable personal electronic device is preinstalled with a second preinstalled second device to obtain a second combination of identification codes of a predetermined plurality of hardware components of the portable personal electronic device. 8. The network authentication method according to claim 7, wherein a scan program is executed, and the second combination of identification codes functions as the identification data.   In step c), if the location information indicates that the user terminal and the portable personal electronic device share the same network address, the verification server determines that the user terminal and the portable personal electronic device The network authentication method according to claim 8, wherein the network authentication methods are determined to be close to each other. The portable personal electronic device is an electronic card;
In step j), the identification data is an identification code uniquely corresponding to the electronic card stored in advance in the electronic card,
8. The network authentication method according to claim 7, wherein, in step k), the location information indicates that the user terminal and the portable personal electronic device are close to each other. A network authentication method executed by a network authentication system for securely verifying user identification information, wherein the network authentication system includes a user terminal operated by the user, a content providing server, a verification server, and the user In the network authentication method in which the user terminal, the content providing server, the verification server, and the portable personal communication device are connected to a communication network.
a) Upon receiving correct user login data including a user identifier and first location data corresponding to the geographical location of the user terminal from the user terminal via the communication network, the content providing server Via the communication network, a first request for second location data corresponding to the current geographical location of the portable personal communication device including the user identifier is transmitted to the verification server. Step a) and
b) Upon receiving the first request from the content providing server, the verification server further includes hardware associated with the portable personal communication device from the portable personal communication device via the communication network. Receiving the identification data and the second position data b);
c) The verification server matches the hardware identification data acquired in step b) with the reference hardware identification data corresponding to the user identifier stored in advance in the verification server, or a subset of the reference hardware identification data It determines whether it is the case hardware identification data is a subset of matching or its and the reference hardware identification data, the second position data, the step c) to be transmitted to the content providing server,
d) Upon receiving the second position data from the verification server, the content providing server adds the first position data received in step a) and the second position data transmitted in step c). And determining whether the user terminal and the portable personal communication device are close to each other, and when determining that the user terminal and the portable personal communication device are close to each other, A step d) of determining successful authentication of the identification information;
A network authentication method comprising: Between step a) and step b),
e) In response to the first request from the content providing server, the verification server sends a second request for the hardware identification data and the second location data via the communication network. E) to the portable personal communication device; and
f) In response to the second request from the verification server, the portable personal communication device receives the second location data corresponding to a current geographical location of the portable personal communication device. In order to obtain a combination of identification codes of a plurality of predetermined hardware components of the portable personal communication device that performs GPS positioning to generate and functions as the hardware identification data, the portable personal communication device F) executing the scan program pre-installed in the network and transmitting the second position data and the hardware identification data to the verification server via the communication network;
The network authentication method according to claim 11, further comprising: Furthermore,
g) The portable personal communication device periodically performs GPS positioning in order to generate the second position data, and the portable personal communication device functions as the hardware identification data. In order to obtain a combination of identification codes of hardware components, a second scan program pre-installed in the portable personal communication device is automatically executed, and the second scan program is periodically executed via the communication network. Transmitting the location data and the hardware identification data to the verification server g),
In step c), after receiving the first request from the content providing server, the second location data received immediately before by the verification server in step b) is transmitted to the content providing server. The network authentication method according to claim 11. In step d), the content providing server determines that the user terminal and the portable personal communication device are close to each other when the first position data matches the second position data. The network authentication method according to claim 11.

Images