JP6846962B2 - Authentication system - Google Patents

Description

The present invention relates to an authentication system in which authentication for permitting operation of a device to be operated by a communication terminal is performed through the intervention of a relay server.

In recent years, a system has been proposed in which home appliances and home appliances in the home are operated from outside by using a communication network. In such a system, in order to prevent access from an unintended third party, only an authenticated user (user terminal) can operate the device.

In the authentication system according to Patent Document 1, the host device shifts to the standby state when the user first performs a standby start operation on the host device (gas appliance). Next, the guest device (smartphone) gives an authentication request to the host device. When the host device receives the authentication request, it prompts the user to perform an operation to establish the authentication, and the user executes the authentication determination operation to establish the authentication.

In the authentication system according to Patent Document 2, the authentication procedure required for operating the operated device (hot water supply device or air conditioner) by the communication terminal (smartphone) through the external network is performed via the relay server. In the authentication procedure, when the communication terminal communicates with the operated device via the relay server, the position information of the communication terminal is transmitted to the relay server, and the sent position information is included in the permission range information for permitting relay. If not, the relay server does not perform the authentication procedure for this communication terminal. As a result, it is possible to reduce the possibility of erroneously giving authentication to an unspecified communication terminal without requiring a special operation by the user at the time of authentication.

Japanese Unexamined Patent Publication No. 2015-132947 Japanese Unexamined Patent Publication No. 2015-162235

In the authentication system according to Patent Document 1, the user directly brings the guest device and performs the authentication procedure at the place where the host device is installed. In order to finally establish this authentication, the user needs to perform an operation for establishing the authentication for the host device, so that the security is highly robust. However, it is necessary for the user to bring the guest device to the installation location of the host device and operate the host device for authentication. For this reason, authentication between distant places, for example, authentication for operating a water heater in a parent's house by a guest device carried by a child living away from the parent's house becomes difficult. In order to avoid such a problem, it is preferable to perform the authentication procedure through a relay server on the remote communication network as in the authentication system according to Patent Document 2. However, the authentication system according to Patent Document 2 is inconvenient because the authentication cannot be established unless the communication terminal requesting the authentication exists in a predetermined specific place.
In view of such circumstances, an object of the present invention is to provide an authentication system capable of performing an authentication procedure for enabling an operation of an operated device by a communication terminal from an arbitrary place far away from the operated device. That is.

A feature of the present invention for achieving the above object is an authentication system in which authentication for permitting operation of a device to be operated by a communication terminal is performed through the intervention of a relay server.
The communication terminal includes an authentication request unit that transmits an authentication request including an authentication code for the device to be operated to the relay server.
The relay server is based on the terminal registration information storage unit that stores the registration information of the communication terminal, the authentication code included in the authentication request, and the authentication code recorded in the relay server. The authentication request determination unit for determining the validity of the authentication request and the authentication request transfer unit for transferring the authentication request deemed valid by the authentication request determination unit to the operated device are provided.
A request approval unit in which the operated device performs an approval procedure by a user of the operated device for the authentication request transferred from the authentication request transfer unit, and an authentication that permits the authentication request approved by the request approval unit. Equipped with a permit section
The operated device outputs the authentication code and transmits the authentication code to the relay server in order to record the output authentication code in the relay server, and the authentication request transfer unit performs the authentication request transfer unit. The point is to invalidate the authentication request received after a predetermined time from the reception of the authentication code .
The phrase "operation of the device to be operated" in the present invention includes not only manipulating the operation of the device to be operated but also obtaining operation information of the device to be operated. Therefore, in the present invention, the communication terminal may be used only for remote control of the device to be operated, may be used only for obtaining operation information in the device to be operated, or may be used for both of them. You may.

According to this feature configuration, if the user of the communication terminal registers the communication terminal in the relay server, the authentication procedure required to operate the operated device installed in a distant place can be performed anytime and anywhere. But you can do it. Then, in this authentication procedure, the user of the communication terminal first contacts the user of the operated device in which the operated device is installed, and receives the authentication code of the operated device by telephone, e-mail, or the like. deep. This received authentication code is input to the communication terminal when performing the authentication procedure. The communication terminal transmits an authentication request including the authentication code to the relay server. When the relay server considers that the authentication code included in the authentication request, the authentication code recorded in the relay server, and the authentication request are valid based on the authentication code, the relay server determines the authentication request. Transfer to the device to be operated. When the received authentication request is approved by the operated device user, the operated device permits the authentication request and authenticates the communication terminal. This enables remote control of the device to be operated by the communication terminal. As described above, in the authentication system according to the present invention, although the authentication procedure for operating the operated device installed at a distant place can be performed anytime and anywhere, the communication terminal is registered in the relay server. Security robustness is ensured by the procedure, the validity check of the authentication request using the authentication code on the relay server, and the approval procedure on the operated device side for the authentication request.

In addition, according to this feature configuration, a limit is set for the time from when the operated device outputs the authentication code to when the authentication request from the communication terminal is actually received through the intervention of the relay server. Can be enhanced.

A feature of the present invention for achieving the above object is an authentication system in which authentication for permitting operation of a device to be operated by a communication terminal is performed through the intervention of a relay server.
The communication terminal includes an authentication request unit that transmits an authentication request including an authentication code for the device to be operated to the relay server.
The relay server is based on the terminal registration information storage unit that stores the registration information of the communication terminal, the authentication code included in the authentication request, and the authentication code recorded in the relay server. The authentication request determination unit for determining the validity of the authentication request and the authentication request transfer unit for transferring the authentication request deemed valid by the authentication request determination unit to the operated device are provided.
A request approval unit in which the operated device performs an approval procedure by a user of the operated device for the authentication request transferred from the authentication request transfer unit, and an authentication that permits the authentication request approved by the request approval unit. Equipped with a permit section
The authentication code is recorded in the relay server in advance, and the operated device transmits an authentication standby status notification message to the relay server when the authentication code is output based on a request from the user of the communication device. , the authentication request transfer unit is that of nullifying the authentication request received from the reception of the authentication waiting state notice sentence in a predetermined time after.
The phrase "operation of the device to be operated" in the present invention includes not only manipulating the operation of the device to be operated but also obtaining operation information of the device to be operated. Therefore, in the present invention, the communication terminal may be used only for remote control of the device to be operated, may be used only for obtaining operation information in the device to be operated, or may be used for both of them. You may.

According to this feature configuration, if the user of the communication terminal registers the communication terminal in the relay server, the authentication procedure required to operate the operated device installed in a distant place can be performed anytime and anywhere. But you can do it. Then, in this authentication procedure, the user of the communication terminal first contacts the user of the operated device in which the operated device is installed, and receives the authentication code of the operated device by telephone, e-mail, or the like. deep. This received authentication code is input to the communication terminal when performing the authentication procedure. The communication terminal transmits an authentication request including the authentication code to the relay server. When the relay server considers that the authentication code included in the authentication request, the authentication code recorded in the relay server, and the authentication request are valid based on the authentication code, the relay server determines the authentication request. Transfer to the device to be operated. When the received authentication request is approved by the operated device user, the operated device permits the authentication request and authenticates the communication terminal. This enables remote control of the device to be operated by the communication terminal. As described above, in the authentication system according to the present invention, although the authentication procedure for operating the operated device installed at a distant place can be performed anytime and anywhere, the communication terminal is registered in the relay server. Security robustness is ensured by the procedure, the validity check of the authentication request using the authentication code on the relay server, and the approval procedure on the operated device side for the authentication request.
Further , according to this feature configuration, the operated device gives the relay server an authentication standby status notification message indicating that the authentication code notified to the user of the communication terminal has been output. As a result, the relay server waits for the authentication request for the device to be operated to be transmitted from the communication terminal, and if the waiting time is within a predetermined time, it is included in the authentication code and the authentication request recorded in advance. Compare the authentication codes that are available, and if they are different, invalidate the authentication request. Moreover, its latency to disable the authentication request exceeds a predetermined time. As a result, security can be enhanced.
As yet another characteristic configuration, the authentication request transfer unit uses at least a part of the registration information of the communication terminal stored in the terminal registration information storage unit as authentication request attribute information in the operated device together with the authentication request. It is also preferable that the device to be operated is configured to transfer and notify the authentication request attribute information by a visual method, an auditory method, or both methods.
According to this feature configuration, when the relay server sends an authentication request from the communication terminal to the operated device, at least a part of the registration information of the communication terminal requesting the authentication, for example, the name of the registrant or the nickname. , Address, face photo, etc. are attached, so that the user of the operated device can confirm the user who wants remote control of the operated device through such information, and can enhance security. ..
A feature of the present invention for achieving the above object is an authentication system in which authentication for permitting operation of a device to be operated by a communication terminal is performed through the intervention of a relay server.
The communication terminal includes an authentication request unit that transmits an authentication request including an authentication code for the device to be operated to the relay server.
The relay server is based on the terminal registration information storage unit that stores the registration information of the communication terminal, the authentication code included in the authentication request, and the authentication code recorded in the relay server. The authentication request determination unit for determining the validity of the authentication request and the authentication request transfer unit for transferring the authentication request deemed valid by the authentication request determination unit to the operated device are provided.
A request approval unit in which the operated device performs an approval procedure by a user of the operated device for the authentication request transferred from the authentication request transfer unit, and an authentication that permits the authentication request approved by the request approval unit. Equipped with a permit section
The authentication request transfer unit transfers at least a part of the registration information of the communication terminal stored in the terminal registration information storage unit as authentication request attribute information to the operated device together with the authentication request, and
The device to be operated is to notify the authentication request attribute information by a visual method, an auditory method, or both methods.
The phrase "operation of the device to be operated" in the present invention includes not only manipulating the operation of the device to be operated but also obtaining operation information of the device to be operated. Therefore, in the present invention, the communication terminal may be used only for remote control of the device to be operated, may be used only for obtaining operation information in the device to be operated, or may be used for both of them. You may.
According to this feature configuration, if the user of the communication terminal registers the communication terminal in the relay server, the authentication procedure required to operate the operated device installed in a distant place can be performed anytime and anywhere. But you can do it. Then, in this authentication procedure, the user of the communication terminal first contacts the user of the operated device in which the operated device is installed, and receives the authentication code of the operated device by telephone, e-mail, or the like. deep. This received authentication code is input to the communication terminal when performing the authentication procedure. The communication terminal transmits an authentication request including the authentication code to the relay server. When the relay server considers that the authentication code included in the authentication request, the authentication code recorded in the relay server, and the authentication request are valid based on the authentication code, the relay server determines the authentication request. Transfer to the device to be operated. When the received authentication request is approved by the operated device user, the operated device permits the authentication request and authenticates the communication terminal. This enables remote control of the device to be operated by the communication terminal. As described above, in the authentication system according to the present invention, although the authentication procedure for operating the operated device installed at a distant place can be performed anytime and anywhere, the communication terminal is registered in the relay server. Security robustness is ensured by the procedure, the validity check of the authentication request using the authentication code on the relay server, and the approval procedure on the operated device side for the authentication request.
Further, according to this feature configuration, when the relay server sends an authentication request from the communication terminal to the operated device, at least a part of the registration information of the communication terminal requesting the authentication, for example, the name of the registrant. , Nickname, address, face photo, etc. are attached, so that the user of the operated device can confirm the user who wants to remotely control the operated device through such information, and enhance the security. Can be done.

Further, as another feature configuration, the operated device is provided with an operation device directly operated by the user, and the request approval unit approves the authentication request based on the operation of the operation device. Is also suitable.

According to this feature configuration, as the final condition for permitting authentication to the communication terminal, it is set that the user of the operated device operates the operating device by his / her own will, so that the security can be further enhanced. ..

Further, it is also preferable that the authentication code is a one-time password generated by the operated device or a MAC address given to the operated device. The algorithm for generating one-time passwords is well known, and despite its ease of implementation, it also provides high security robustness. In addition, the MAC address is the only code that is always given to a device that has an external network communication function, is less likely to be decrypted, and can be easily checked through the display device of the device to be operated. In addition, the MAC address is often stamped or affixed to a part of the device to be operated, and its use is easy.

It is a schematic diagram of an authentication system. It is a functional block diagram of an authentication system. It is a data flow chart which shows the data flow in an authentication system. It is a data flow chart which shows the data flow in another embodiment of an authentication system.

Hereinafter, one embodiment of the authentication system according to the present invention will be described with reference to the drawings. As shown in FIG. 1, the authentication system includes a communication terminal 2 carried by user A, an operated device 4 installed at user B's house, and a relay server 6 installed at a management company of the operated device 4. It consists of two components. In the example of FIG. 1, the communication terminal 2 is a smartphone and the operated device 4 is a water heater. The communication terminal 2, the relay server 6, and the device to be operated 4 can transmit data via a communication network.

In this embodiment, the user B is an elderly person, and the user A pays attention to the daily life of the user B, but is active in a place far away from the user B's house. The device 4 to be operated is a net operation type, and can be remotely controlled by a communication terminal 2 or a personal computer via a communication network such as the Internet or a public data line.

The user A accesses the operated device 4 installed in the user B's house from a place far away from the user B's house by using the communication terminal 2, and checks the usage status of the operated device 4. , Adjust the temperature set value, and turn the power on / off. In order for the remote control of the operated device 4 to be safely performed by the communication terminal 2 using the communication network, the communication terminal 2 must be properly authenticated by the operated device 4. Here, authentication (pairing) between the communication terminal 2 and the operated device 4 is finally established through the communication network by the authentication procedure mediated by the relay server 6.

The configuration of the authentication system according to the present embodiment will be described with reference to FIG. The communication terminal 2 is a smartphone, and includes a communication unit 21, a touch panel 22, and an authentication request unit 23 as functional units particularly related to the present invention. The communication unit 21 can be connected to a communication network such as a data transmission line or a public telephone line, and has a data transmission / reception function and a call function. The touch panel 22 is used for inputting an operation command, inputting data to be transmitted, displaying received data, and the like. The authentication request unit 23 generates an authentication request requesting authentication (pairing with the operated device 4) in the operated device 4 via the relay server 6 and transmits the authentication request to the relay server 6.

This authentication request includes an authentication code for the device to be operated 4. In this embodiment, the authentication code is a one-time password (OTP) output from the device to be operated 4. Therefore, the user A who handles the communication terminal 2 needs to contact the user B and receive the one-time password output from the operated device 4 before making the authentication request. If you want to use a unique code such as the MAC address of the device 4 to be operated instead of the one-time password as the authentication code, if you obtain it in advance, you will be contacted and received by user B each time you request authentication. No need.

The authentication request unit 23 prompts the user A to input the one-time password as the authentication code of the operated device 4 obtained from the user B, and generates an authentication request including the input one-time password. The generated authentication request is transmitted to the relay server 6 through the communication network. The authentication request also includes a user ID and the like that identify the user A.

The relay server 6 is configured as a Web server in this embodiment, and includes a communication unit 61 connected to a communication network and a terminal registration information storage unit 62 as a database unit as functional units particularly related to the present invention. The application unit includes an authentication request determination unit 63 and an authentication request transfer unit 64.

The relay server 6 is installed in the management center of the device to be operated 4. The relay server also manages the customer of the device 4 to be operated. In order for the user A to authenticate the operated device 4 through the relay server 6, it is necessary to perform a registration procedure for using the relay server 6 in advance. In this registration procedure, user personal information such as the name and address of user A and information such as the telephone number, email address, and MAC address of the communication terminal 2 used by user A are given to the relay server 6. The relay server 6 stores the given information as registration information in the terminal registration information storage unit 62. When the registration procedure is completed, the registrant ID of the user A is given, so that the communication terminal 2 can access the relay server 6 with this registrant ID.

In this embodiment, the authentication request determination unit 63 determines the validity of the authentication request sent from the communication terminal 2 by the one-time password sent directly from the operated device 4 and the one included in the authentication request. Judgment is based on the time password. Therefore, since the operated device 4 sends the one-time password to the relay server 6 when the one-time password is output, the relay server 6 records the received one-time password in the memory. If the one-time password recorded in this memory matches the one-time password contained in the authentication request, the authentication request is considered valid.

If the MAC address of the operated device 4 or the identification code unique to the operated device 4 is used as the authentication code instead of the one-time password, such an authentication code is recorded in the relay server 6 in advance. It is possible to do so, and it is not necessary to transmit the authentication code from the operated device 4 to the relay server 6.

Further, in this embodiment, since the one-time password has a time limit, if a predetermined time has elapsed from the output time of the one-time password or the time when the one-time password is received, the authentication request determination unit 63 Invalidates the authentication request including the one-time password.

The authentication request transfer unit 64 transfers the authentication request deemed valid by the authentication request determination unit 63 to the operated device 4. The name of the user A included in the registration information of the communication terminal 2 stored in the terminal registration information storage unit 62 is attached as the authentication request attribute information to the authentication request transferred to the operated device 4.

In this embodiment, the device 4 to be operated, which is a water heater, includes a remote controller 4A, a water heater main body 4B, and a hot water supply control unit 40. The remote controller 4A is installed indoors in the user B's house, and the water heater main body 4B is installed outdoors. The hot water supply control unit 40 is attached to the water heater main body, and is connected to various operating devices of the water heater main body 4B by a control line. The remote controller 4A is wirelessly or wiredly connected to the hot water supply control unit 40, and controls the operation of the water heater main body 4B by giving a command to the hot water supply control unit 40. Further, detection signals from various sensors for detecting the state of the water heater main body 4B are also input to the remote control device 4A, and the remote control device 4A can grasp the state of the water heater main body 4B.

The remote controller 4A includes a communication unit 41, an operation device 42, a request approval unit 43, and an authentication permission unit 44. The communication unit 41 is connected to the communication network through a wireless router device installed in the user B's house, and can exchange data with the communication terminal 2 and the relay server 6. Of course, the communication unit 41 may be provided with a router function.

The operation device 42 includes a touch panel on which software buttons are constructed, and hardware buttons arranged around the touch panel. The remote control device 4A creates a graphic user interface through a touch panel. In this embodiment, the remote controller 4A is provided with a one-time password generation function, and an OTP button for outputting the one-time password is constructed by a software button. When the user B operates the OTP button, the one-time password is output and displayed on the touch panel, and the one-time password is transmitted to the relay server 6 together with the output time. At this point, the operated device 4 is in the authentication standby state, waiting for the authentication request transferred from the relay server 6.

The request approval unit 43 performs an approval procedure for the authentication request of the communication terminal 2 transferred from the authentication request transfer unit 64 of the relay server 6. In this embodiment, in order to approve the authentication request in this approval procedure, the user B, who is the user of the operated device 4, needs to press the authentication approval button displayed on the touch panel of the operating device 42. At that time, the request approval unit 43 performs voice notification (buzzer or artificial voice) notifying the user B that the approval request has been received at the timing of receiving the authentication request, and displays a message to that effect on the touch panel. .. Since the name of user A is attached as the authentication request attribute information to the authentication request transferred from the authentication request transfer unit 64, the name of user A requesting authentication can be included in this message. .. As a result, the user B can know who is requesting the authentication.

When the user B approves the authentication request by pressing the authentication approval button, the authentication permission unit 44 approves the authentication request, whereby access from the communication terminal 2 is permitted. Based on the operation command from the authenticated communication terminal 2, the hot water supply control unit 40 sends information indicating the operating state of the water heater main body 4B to the communication terminal 2. Further, the hot water supply control unit 40 controls the operation of the water heater main body 4B based on the operation command from the communication terminal 2. That is, the operated device 4 is remotely controlled by the communication terminal 2 at a remote location through the communication network.

The fact that the authentication request has been approved by the authentication authorization unit 44 is also transmitted to the relay server 6. In addition, if a time limit (prescription) is set for this authentication, the permitted date and time is added to the authentication, and after the predetermined date and time elapses, the authentication becomes invalid, so that the user A , You have to go through the certification procedure again.

An example of the authentication process in the authentication system configured as described above will be described with reference to FIG. First, as an initial process, the user A performs a registration procedure on the relay server 6 as a user who desires remote control of the device 4 to be operated. The registration information given by the user A in this registration procedure is stored in the terminal registration information storage unit 62. (# 01)

When the user A wants to operate the operated device 4 installed in the user B's house through the communication network, the communication terminal 2 of the user A must first be authenticated by the operated device 4. You must obtain the verification code required for this verification procedure. In this embodiment, since the authentication code is a one-time password, the user A contacts the user B by telephone or e-mail and requests the user B to obtain the one-time password. User B operates the operation device 42 of the device to be operated 4 to output a one-time password. Since the output one-time password is displayed on the touch panel, the user A is notified of it. Further, the operated device 4 transmits the output one-time password to the relay server 6, and when the one-time password is output, the device 4 is in the authentication standby state. (# 02)

The user A transmits an authentication request including the one-time password obtained from the user B to the relay server 6. If the one-time password included in the sent authentication request and the one-time password sent from the operated device 4 which is the authentication destination of the authentication request match, the relay server 6 requests this authentication. Is determined to be valid. When it is determined that the authentication request is valid, the registration information of the user A who sent the authentication request is further extracted, and the user name (and address if necessary) included in the registration information is the authentication request attribute information. Is added to the authentication request and transferred to the operated device 4 at the user B's home. If the valid time of the one-time password has passed at the time of checking this authentication request, the authentication request becomes invalid. (# 03)

Based on the authentication request transferred from the relay server 6, the operated device 4 notifies the registrant name of the user A by a visual method or an auditory method. When the user B permits the remote control by the user A, that is, when the user B approves the remote control, the user B directly presses the authentication approval button. This allows the authentication request. This authentication permission is also sent to the relay server 6. Further, if there is data (access data) necessary for the communication terminal 2 to access the device to be operated 4, it is transmitted to the communication terminal 2 via the relay server 6. (# 04)
After that, the user A can remotely control the operated device 4 at the user B's house through the communication network until the set authentication expiration date. (# 05)

Further, with reference to FIG. 4, an example different from the authentication process of FIG. 3 will be described. Here, as the authentication code, an authentication code that uniquely defines the device to be operated 4 such as a MAC address (simply abbreviated as MAC in FIG. 4) is used. Since the relay server manages the operated device 4, the MAC address of each operated device 4 is also recorded in the relay server 6.

As an initial process of this authentication process, the user A performs a registration procedure on the relay server 6 as a user who desires remote control of the device 4 to be operated. The registration information given by the user A in this registration procedure is stored in the terminal registration information storage unit 62. (# 11)

When the user A wants to operate the operated device 4 installed in the user B's house through the communication network, the communication terminal 2 of the user A must first be authenticated by the operated device 4. A MAC address is required here for this authentication procedure. Therefore, the user A contacts the user B by telephone or e-mail and requests the acquisition of the MAC address. User B operates the operation device 42 of the device to be operated 4 to output the MAC address (displayed on the touch panel). User B notifies user A of the output MAC address. The device 4 to be operated shifts to the authentication standby state by using the output of the MAC address as a trigger, and transmits an authentication standby status notification message to the relay server 6 in order to notify the relay server 6 that the transition to the authentication standby state has occurred. .. Instead of using the output of the MAC address as a trigger for the transition to the authentication standby state, the user B may press the button for transitioning to the authentication standby state displayed on the touch panel as a trigger. In any case, at this stage, the operated device 4 is in the authentication standby state. (# 12)

User A transmits an authentication request including the MAC address obtained from User B to the relay server 6. The relay server 6 reads the operated device 4 which is the authentication destination of the authentication request from the recording unit of the relay server 6, and if the read MAC address matches the MAC address included in the sent authentication request. , This authentication request is determined to be valid. When it is determined that the authentication request is valid, the registration information of the user A who sent the authentication request is further extracted, and the user name (and address if necessary) included in the registration information is the authentication request attribute information. Is added to the authentication request and transferred to the operated device 4 at the user B's home. If the elapsed time from the time when the authentication standby status notification text (abbreviated as standby notification in FIG. 4) is received at the time of checking this authentication request has passed the valid time, the authentication request becomes invalid. (# 13)

Based on the authentication request transferred from the relay server 6, the operated device 4 notifies the registrant name of the user A by a visual method or an auditory method. When the user B permits the remote control by the user A, that is, when the user B approves the remote control, the user B directly presses the authentication approval button. This allows the authentication request. This authentication permission is also sent to the relay server 6. Further, if there is data (access data) necessary for the communication terminal 2 to access the device to be operated 4, it is transmitted to the communication terminal 2 via the relay server 6. (# 14)
After that, the user A can remotely control the operated device 4 at the user B's house through the communication network until the set authentication expiration date. (# 15)

When the communication terminal 2 is authenticated by the operated device 4, the operated device 4 can be directly accessed from the communication terminal 2 and the operated device 4 can be operated by the communication terminal 2 (# 05 and FIG. 4 in FIG. 3). See # 15). However, if the relay server 6 or other management server constantly manages the operating state of the operated device 4, and further, the operation control such as ON / OFF of the operated device 4 is possible, the communication terminal 2 However, instead of directly accessing the operated device 4, the relay server 6 or another management server may be accessed to operate the operated device 4.

[Another Embodiment]
(1) In the above-described embodiment, the device 4 to be operated is assumed to be a water heater or an air conditioner, but the present invention can be applied to various other household network devices such as refrigerators, televisions, and cooking devices. Authentication system is applicable.
(2) In the above-described embodiment, the communication terminal 2 is a smartphone, but it may be a computer such as a tablet computer or a laptop computer, and further, a control unit of the operated device similar to the operated device 4. May be used as the communication terminal 2.
(3) In the above-described embodiment, the registrant name (user A's name) is notified by the operated device 4 in order for the user B to confirm the user A requesting the authentication, but the security is further enhanced. Therefore, a portrait may be used.
(4) In the above-described embodiment, in order for the user A to obtain an authentication code such as a one-time password from the user B, a telephone or an e-mail is used between the user A and the user B. Instead of this, a configuration may be adopted in which the user A obtains the authentication code from the user B via the relay server 6. In that example, first, the user A accesses the relay server 6 and applies to obtain the authentication code from the user B. Upon receiving the application, the relay server 6 requests the user B to send the authentication code and receives the authentication code, or receives the authentication code directly from the remote controller device 4A of the user B and notifies the user A of the authentication code.

The configuration disclosed in the above embodiment (including another embodiment, the same shall apply hereinafter) can be applied in combination with the configuration disclosed in other embodiments as long as there is no contradiction. , The embodiments disclosed in the present specification are examples, and the embodiments of the present invention are not limited thereto, and can be appropriately modified without departing from the object of the present invention.

The present invention can be applied to a device to be operated that can be remotely controlled through a communication network.

2: Communication terminal 21: Communication unit 22: Touch panel 23: Authentication request unit 4: Operated device 4A: Remote control device 4B: Water heater body 40: Hot water supply control unit 41: Communication unit 42: Operation device (touch panel, button)
43: Request approval unit 44: Authentication permission unit 6: Relay server 61: Communication unit 62: Terminal registration information storage unit 63: Authentication request judgment unit 64: Authentication request transfer unit

Claims (6)

It is an authentication system that performs authentication to allow the operation of the operated device by the communication terminal through the intervention of a relay server.
The communication terminal includes an authentication request unit that transmits an authentication request including an authentication code for the device to be operated to the relay server.
The relay server is based on the terminal registration information storage unit that stores the registration information of the communication terminal, the authentication code included in the authentication request, and the authentication code recorded in the relay server. The authentication request determination unit for determining the validity of the authentication request and the authentication request transfer unit for transferring the authentication request deemed valid by the authentication request determination unit to the operated device are provided.
A request approval unit in which the operated device performs an approval procedure by a user of the operated device for the authentication request transferred from the authentication request transfer unit, and an authentication that permits the authentication request approved by the request approval unit. Equipped with a permit section
The operated device outputs the authentication code and transmits the authentication code to the relay server in order to record the output authentication code in the relay server, and the authentication request transfer unit performs the authentication request transfer unit. An authentication system that invalidates the authentication request received after a predetermined time from the receipt of the authentication code. It is an authentication system that performs authentication to allow the operation of the operated device by the communication terminal through the intervention of a relay server.
The communication terminal includes an authentication request unit that transmits an authentication request including an authentication code for the device to be operated to the relay server.
The relay server is based on the terminal registration information storage unit that stores the registration information of the communication terminal, the authentication code included in the authentication request, and the authentication code recorded in the relay server. The authentication request determination unit for determining the validity of the authentication request and the authentication request transfer unit for transferring the authentication request deemed valid by the authentication request determination unit to the operated device are provided.
A request approval unit in which the operated device performs an approval procedure by a user of the operated device for the authentication request transferred from the authentication request transfer unit, and an authentication that permits the authentication request approved by the request approval unit. Equipped with a permit section
The authentication code is recorded in the relay server in advance, the operated device transmits an authentication standby status notification message to the relay server when the authentication code is output, and the authentication request transfer unit performs the authentication. An authentication system that invalidates the authentication request received after a predetermined time from the reception of the standby status notification message. The authentication request transfer unit transfers at least a part of the registration information of the communication terminal stored in the terminal registration information storage unit as authentication request attribute information to the operated device together with the authentication request, and
The authentication system according to claim 1 or 2 , wherein the operated device notifies the authentication request attribute information by a visual method, an auditory method, or both methods. It is an authentication system that performs authentication to allow the operation of the operated device by the communication terminal through the intervention of a relay server.
The communication terminal includes an authentication request unit that transmits an authentication request including an authentication code for the device to be operated to the relay server.
The relay server is based on the terminal registration information storage unit that stores the registration information of the communication terminal, the authentication code included in the authentication request, and the authentication code recorded in the relay server. The authentication request determination unit for determining the validity of the authentication request and the authentication request transfer unit for transferring the authentication request deemed valid by the authentication request determination unit to the operated device are provided.
A request approval unit in which the operated device performs an approval procedure by a user of the operated device for the authentication request transferred from the authentication request transfer unit, and an authentication that permits the authentication request approved by the request approval unit. Equipped with a permit section
The authentication request transfer unit transfers at least a part of the registration information of the communication terminal stored in the terminal registration information storage unit as authentication request attribute information to the operated device together with the authentication request, and
The operated device is an authentication system that notifies the authentication request attribute information by a visual method, an auditory method, or both methods. The operated device is provided with an operating device that is directly operated by the user, and the request approval unit approves the authentication request based on the operation of the operating device. The authentication system described in the section. The authentication system according to any one of claims 1 to 5, wherein the authentication code is a one-time password generated by the operated device or a MAC address given to the operated device.

Images