JP7232366B1 - Information processing device, information processing system and information processing method - Google Patents

Abstract

Kind Code: A1 A balance between security and usability for an information terminal to use a message service such as RCS is provided.
An authentication device (1) includes an authentication request receiving unit (121) for receiving an authentication request from an information terminal, an authentication unit (123) for authenticating the information terminal, and a first expiration date on condition that the information terminal is successfully authenticated. an authentication token generating unit 124 that stores the first authentication token associated with the information terminal in the storage unit; an authentication token transmitting unit 125 that transmits the first authentication token to the information terminal; 126, wherein the authentication token generator generates a second authentication token associated with a second expiration date that comes after the first expiration date, provided that the extension request is received within the first expiration date. is stored in the storage unit, and the authentication token transmission unit transmits the second authentication token to the information terminal.
[Selection drawing] Fig. 2

Description

The present invention relates to an information processing device, an information processing system, and an information processing method for authenticating an information terminal.

Patent Document 1 describes a system that enables an information terminal to perform message transmission and reception using RCS (Rich Communication Services) by initial registration with an IMS (IP Multimedia Subsystem) network. there is Initial registration can be performed, for example, by the information terminal receiving an SMS (Short Message Service) message sent by the system.

Special Table No. 2016-532352

If the RCS can be used permanently after the initial registration of the information terminal, there is a possibility that the RCS account will be misappropriated by a third party other than the user at the time of initial registration, and security may be lowered. . On the other hand, if an information terminal performs initial registration every time it uses the RCS in order to improve security, usability will be degraded.

The present invention has been made in view of these points, and it is an object of the present invention to balance security and usability for information terminals to use message services such as RCS.

An information processing apparatus according to a first aspect of the present invention comprises an authentication request receiving unit for receiving an authentication request including line identification information assigned to the information terminal for use of a communication line from an information terminal; an authentication unit that authenticates the information terminal using at least one of the line identification information and terminal identification information that can identify the information terminal in response to the reception of the authentication request by the reception unit; an authentication token generating unit that stores a first authentication token associated with a first expiration date in a storage unit on condition that the authentication of the information terminal by the unit is successful; and transmitting the first authentication token to the information terminal. and an extension request receiving unit that receives an extension request including the first authentication token from the information terminal, wherein the authentication token generating unit is configured such that the extension request receiving unit receives the first The storage unit stores a second authentication token associated with a second expiration date that comes later than the first expiration date on condition that the extension request is received within the expiration date, and the authentication token transmission unit transmits the second authentication token to the information terminal.

The authentication token generation unit stores the first expiration date and the first authentication token in association with each other in a storage unit. The second authentication token may be stored in the storage unit on condition that the extension request is received within the first validity period associated with the first authentication token included in the.

The authentication token generation unit stores the first expiration date, the line identification information, and the first authentication token in association with each other in the storage unit. The extension request including the first authentication token and the line identification information is received, and the authentication token generation unit stores the line identification information included in the extension request in the storage unit. 1 match the line identification information associated with the authentication token, and the extension request receiving unit stores the extension request within the first validity period associated with the first authentication token included in the extension request in the storage unit; The second authentication token may be stored in the storage section on condition that an extension request is received.

The authentication unit may authenticate the information terminal by an authentication method corresponding to the terminal identification information among a plurality of authentication methods.

The information processing device further has a determination unit that determines whether or not a telecommunications carrier that provides the communication line is a specific telecommunications carrier based on the terminal identification information, and the authentication unit communication that provides the communication line by authenticating the information terminal using the terminal identification information on condition that the determination unit determines that the communication service provider that provides the communication line is the specific communication service provider The information terminal may be authenticated using the line identification information on condition that the determination unit determines that the business operator is not the specific communication business operator.

The authentication unit re-authenticates the information terminal on condition that the extension request reception unit receives the extension request within the first expiration date, and the authentication token generation unit receives the information from the authentication unit. The second authentication token may be stored in the storage unit on condition that the terminal has been successfully authenticated.

The authentication token generation unit may not store the second authentication token in the storage unit when re-authentication of the information terminal by the authentication unit is unsuccessful.

The authentication token transmission unit does not transmit the second authentication token to the information terminal and the information terminal transmits and receives messages on condition that the re-authentication of the information terminal by the authentication unit has not succeeded. control information for disabling transmission and reception of the message in the application may be transmitted to the information terminal.

An information processing system according to a second aspect of the present invention includes an information processing device and an information terminal capable of communicating with the information processing device. an authentication request receiving unit for receiving an authentication request including line identification information assigned to use the information terminal; and an authentication unit that authenticates the information terminal using at least one of terminal identification information that can identify the information terminal, and the information terminal is successfully authenticated by the authentication unit. Associated with the first expiration date An authentication token generation unit that stores a first authentication token in a storage unit; an authentication token transmission unit that transmits the first authentication token to the information terminal; and receives an extension request including the first authentication token from the information terminal. an extension request receiving unit for transmitting the authentication request to the information processing device; and receiving the first authentication token in response to the authentication request from the information processing device. an authentication token receiving unit that receives an authentication token; and an extension request transmitting unit that transmits the extension request to the information processing device on condition that a predetermined period of time has elapsed since the authentication token receiving unit received the first authentication token. , wherein the authentication token generation unit generates a second expiration date that comes later than the first expiration date on condition that the extension request receiving unit receives the extension request within the first expiration date. The storage unit stores a second authentication token associated with the second authentication token, the authentication token transmission unit transmits the second authentication token to the information terminal, and the authentication token reception unit transmits the second authentication token from the information processing device. 2 Receive an authentication token.

The extension request transmission unit transmits information indicating whether or not the SIM for using the communication line connected to the information terminal has been changed together with the extension request, and the authentication token generation unit transmits the information Even if the second authentication token is stored in the storage unit on condition that the SIM has not been changed in the terminal and the extension request reception unit has received the extension request within the first expiration date. good.

The information terminal further includes a message transmitting/receiving unit for transmitting/receiving the message in an application for transmitting/receiving the message using the line identification information on condition that the message is within the first expiration date or the second expiration date. may have.

An information processing method according to a third aspect of the present invention includes the step of receiving, from an information terminal, an authentication request including line identification information assigned for the information terminal to use a communication line, executed by a processor; a step of authenticating the information terminal using at least one of the line identification information and terminal identification information capable of identifying the information terminal in response to receiving the authentication request in the step of receiving an authentication request; , storing in a storage unit a first authentication token associated with a first expiration date on condition that the information terminal is successfully authenticated in the authenticating step; and transmitting the first authentication token to the information terminal. on the condition that the extension request is received within the first validity period in the step of transmitting, the step of receiving an extension request including the first authentication token from the information terminal, and the step of receiving the extension request , storing in the storage unit a second authentication token associated with a second expiration date that comes later than the first expiration date; and transmitting the second authentication token to the information terminal. .

An information processing apparatus according to a fourth aspect of the present invention comprises an authentication request receiving unit for receiving an authentication request including line identification information assigned to the information terminal for use of a communication line from an information terminal; an authentication unit that authenticates the information terminal using at least one of the line identification information and terminal identification information that can identify the information terminal in response to the reception of the authentication request by the reception unit; an authentication token generating unit that stores a first authentication token associated with a first expiration date in a storage unit on condition that the authentication of the information terminal by the unit is successful; and transmitting the first authentication token to the information terminal. and an authentication token transmission unit that transmits the first authentication token, and the authentication token generation unit determines that a predetermined period of time has passed since the authentication token transmission unit transmitted the first authentication token, and the date and time when the predetermined period of time has passed is the Stores in the storage unit a second authentication token associated with a second expiration date that comes after the first expiration date on condition that it is within the first expiration date, and the authentication token transmission unit stores the Sending a second authentication token to the information terminal.

ADVANTAGE OF THE INVENTION According to this invention, it is effective in the ability to balance security and usability for an information terminal to use message services, such as RCS.

1 is a schematic diagram of an information processing system according to an embodiment; FIG. 3 is a block diagram of an authentication device included in the information processing system according to the embodiment; FIG. 3 is a block diagram of a user terminal included in the information processing system according to the embodiment; FIG. FIG. 4 is a schematic diagram for explaining processing for issuing an authentication token; FIG. 4 is a schematic diagram of an exemplary authentication token; FIG. 11 is a schematic diagram for explaining processing for extending the expiration date of an authentication token; 4 is a sequence diagram of an information processing method executed by the information processing system according to the embodiment; FIG.

[Overview of information processing system S]
FIG. 1 is a schematic diagram of an information processing system S according to this embodiment. An information processing system S includes an authentication device 1 and a user terminal 2 . The information processing system S may include multiple user terminals 2 . The information processing system S may include devices such as other servers and terminals.

The authentication device 1 is a computer that authenticates the user terminal 2 to use the message service. The message service is a service that allows messages to be sent and received between the authenticated user terminal 2 and other devices, such as RCS. The authentication device 1 performs wireless or wired communication with the user terminal 2 .

The user terminal 2 is an information terminal associated with a user, such as a personal computer, smart phone, tablet terminal, or the like. The user terminal 2 has a display unit such as a liquid crystal display that displays information, and an operation unit such as a touch panel that receives user operations. The user terminal 2 transmits and receives messages using the message service on condition that it has been authenticated by the authentication device 1 .

The outline of the processing executed by the information processing system S according to this embodiment will be described below. The user terminal 2 transmits an authentication request including line identification information (hereinafter referred to as line ID) assigned for the user terminal 2 to use the communication line to the authentication device 1 . A line ID is, for example, a telephone number.

The authentication device 1 receives an authentication request from the user terminal 2 . Upon receiving the authentication request, the authentication device 1 authenticates the user terminal 2 using at least one of the line ID and terminal identification information (hereinafter referred to as terminal ID) that can identify the user terminal 2 . The terminal ID is the IP address of the user terminal 2, for example. The authentication device 1 transmits an authentication token to the user terminal 2 on condition that the user terminal 2 has been successfully authenticated. An authentication token is associated with a predetermined expiration date.

The user terminal 2 receives an authentication token corresponding to the authentication request from the authentication device 1 . The user terminal 2 transmits and receives messages in an application for transmitting and receiving messages using the message service, provided that the validity period associated with the received authentication token is still valid. The user terminal 2 transmits an extension request including the authentication token to the authentication device 1 after a period of time corresponding to the predetermined update interval has passed after receiving the authentication token.

The authentication device 1 receives the extension request from the user terminal 2 . The authentication device 1 transmits the authentication token with the extended validity period to the user terminal 2 on condition that the extension request is received within the validity period associated with the authentication token.

As described above, the authentication device 1 transmits an authentication token for using the message service to the user terminal 2 on the condition that the authentication of the user terminal 2 is successful, and furthermore, the expiration date of the authentication token is set at predetermined update intervals. Extend. As a result, the authentication device 1 can maintain security by periodically extending the expiration date of the authentication token without performing initial registration each time the user terminal 2 uses the message service. A balance can be struck between security and usability for using message services.

[Configuration of information processing system S]
2 and 3 are block diagrams of the authentication device 1 and the user terminal 2 included in the information processing system S according to this embodiment. In FIGS. 2 and 3, arrows indicate main data flows, and data flows other than those shown in FIGS. 2 and 3 may exist. In FIGS. 2 and 3, each block does not show the configuration in units of hardware (apparatus), but the configuration in units of functions. As such, the blocks shown in FIGS. 2 and 3 may be implemented within a single device, or may be implemented separately within multiple devices. Data exchange between blocks may be performed via any means such as a data bus, network, or portable storage medium.

The authentication device 1 has a storage unit 11 and a control unit 12 . The authentication device 1 may be configured by connecting two or more physically separated devices by wire or wirelessly. Also, the authentication device 1 may be configured by a cloud that is a collection of computer resources.

The storage unit 11 of the authentication device 1 is a storage medium including a ROM (Read Only Memory), a RAM (Random Access Memory), a hard disk drive, and the like. The storage unit 11 stores programs executed by the control unit 12 in advance. The storage unit 11 may be provided outside the authentication device 1, in which case data may be exchanged with the control unit 12 via a network.

The control unit 12 of the authentication device 1 has an authentication request reception unit 121 , a determination unit 122 , an authentication unit 123 , an authentication token generation unit 124 , an authentication token transmission unit 125 and an extension request reception unit 126 . The control unit 12 is a processor such as a CPU (Central Processing Unit), for example, and by executing a program stored in the storage unit 11, an authentication request receiving unit 121, a determining unit 122, an authenticating unit 123, an authentication token generating unit 124 , an authentication token transmitter 125 and an extension request receiver 126 . At least part of the functions of the controller 12 may be performed by an electrical circuit. Moreover, at least part of the functions of the control unit 12 may be realized by the control unit 12 executing a program executed via a network.

The user terminal 2 has a storage section 21 and a control section 22 . The storage unit 21 of the user terminal 2 is a storage medium including ROM, RAM, hard disk drive, and the like. The storage unit 21 stores programs executed by the control unit 22 in advance. The storage unit 21 may be provided outside the user terminal 2, in which case data may be exchanged with the control unit 22 via a network.

The control unit 22 of the user terminal 2 has an authentication request transmission unit 221 , an authentication token reception unit 222 , a message transmission/reception unit 223 and an extension request transmission unit 224 . The control unit 22 is, for example, a processor such as a CPU, and executes programs stored in the storage unit 21 to operate as an authentication request transmission unit 221, an authentication token reception unit 222, a message transmission/reception unit 223, and an extension request transmission unit 224. Function. At least part of the functions of the controller 22 may be performed by an electrical circuit. Moreover, at least part of the functions of the control unit 22 may be realized by the control unit 22 executing a program executed via a network.

Processing executed by the information processing system S will be described in detail below. FIG. 4 is a schematic diagram for explaining the process of issuing an authentication token. In the user terminal 2, the authentication request transmission unit 221 detects, for example, when an application for transmitting and receiving messages using the message service is activated for the first time, or when the user performs an operation for initial registration of the message service. In response, the user terminal 2 transmits an authentication request including the line ID assigned to use the communication line to the authentication device 1 (a1). The line ID is, for example, a telephone number or an IMSI (International Mobile Subscriber Identity).

In the authentication device 1 , the authentication request receiving section 121 receives the authentication request from the user terminal 2 . Further, the authentication request receiving unit 121 acquires terminal identification information (hereinafter referred to as terminal ID) that can identify the user terminal 2 that is the transmission source of the received authentication request. The terminal ID is, for example, an IP (Internet Protocol) address.

Based on the terminal ID acquired by the authentication request receiving unit 121, the determination unit 122 determines whether or not the carrier that provides the communication line used by the user terminal 2 is a specific carrier. The storage unit 11 stores, for example, terminal IDs of user terminals 2 that use a specific carrier (for example, MNO: Mobile Network Operator) in advance. If the terminal ID acquired by the authentication request receiving unit 121 is stored in the storage unit 11, the determining unit 122 determines that the telecommunications carrier that provides the communication line used by the user terminal 2 is a specific telecommunications carrier. If the terminal ID acquired by the authentication request receiving unit 121 is not stored in the storage unit 11, the carrier that provides the communication line used by the user terminal 2 is not a specific carrier (for example, MVNO; Mobile Virtual Network Operator).

The determining unit 122 determines whether or not the telecommunications carrier that provides the communication line used by the user terminal 2 is a specific telecommunications carrier by any other method, not limited to the specific method shown here. good too. When the same operator provides two different communication services, the first communication service provided by the operator (for example, the communication service as an MNO) is a specific telecommunication operator, and the operator provides it A second communication service (for example, a communication service as an MVNO) may be an external carrier.

Note that when the communication carrier that provides the communication line used by the user terminal 2 is an MVNO, the user terminal 2 transmits an authentication request to the authentication device 1 managed by the MNO affiliated with the MVNO. Therefore, when the determination unit 122 of the authentication device 1 determines that the carrier used by the user terminal 2 is not a specific carrier (MNO), the carrier used by the user terminal 2 is the MVNO. is determined.

When the authentication request receiving unit 121 receives the authentication request, the authentication unit 123 authenticates the user terminal 2 using at least one of the line ID and the terminal ID (a2). The authentication unit 123 authenticates the user terminal 2 by, for example, one of a plurality of authentication methods corresponding to the terminal ID.

The multiple authentication schemes include, for example, a first authentication scheme that authenticates the user terminal 2 using the terminal ID and a second authentication scheme that authenticates the user terminal 2 using the line ID. The authentication unit 123 uses the terminal ID on the condition that the determination unit 122 determines that the communication carrier that provides the communication line based on the terminal ID is a specific communication carrier (for example, MNO). The user terminal 2 is authenticated by the first authentication method for authenticating 2.

As the first authentication method, the authentication unit 123 determines that the authentication has succeeded, for example, when the terminal ID is stored in the storage unit 11, and otherwise determines that the authentication has not succeeded. Note that when the determining unit 122 determines that the telecommunications carrier that provides the communication line is a specific telecommunications carrier according to the fact that the terminal ID is stored in the storage unit 11, the authenticating unit 123 stores It may be determined that the authentication has succeeded without re-determining whether or not the terminal ID is stored in the unit 11 .

On the other hand, on the condition that the determination unit 122 determines that the telecommunications carrier that provides the communication line is not a specific telecommunications carrier based on the terminal ID, the authentication unit 123 receives the authentication request received by the authentication request reception unit 121. The user terminal 2 is authenticated by the second authentication method that authenticates the user terminal 2 using the included line ID.

As a second authentication method, the authentication unit 123 authenticates the user terminal 2 by transmitting authentication information with the line ID as the destination, for example. Authentication information is, for example, a character string generated randomly or according to a predetermined rule. The authentication information is sent, for example, by SMS addressed to the telephone number, which is the line ID.

The user terminal 2 receives authentication information from the authentication device 1 and transmits the received authentication information to the authentication device 1 . The user terminal 2 automatically transmits the received authentication information to the authentication device 1 or transmits it to the authentication device 1 according to the user's operation.

In the authentication device 1, the authentication unit 123 receives the authentication information from the user terminal 2, and if the received authentication information matches the transmitted authentication information, or if the received authentication information and the transmitted authentication information are pre-defined If it has a predetermined relationship, determine that the authentication was successful; otherwise, determine that the authentication was not successful.

In this way, the authentication unit 123 switches the authentication method depending on whether the telecommunications carrier that provides the communication line is a specific telecommunications carrier or not. can be authenticated.

The authentication unit 123 is not limited to the specific method shown here, and may authenticate the user terminal 2 by other methods. The authentication unit 123 authenticates the user terminal by a predetermined authentication method (for example, the first authentication method or the second authentication method described above) regardless of whether the telecommunications carrier that provides the communication line is a specific telecommunications carrier or not. 2 may be authenticated. In this case, the authentication device 1 does not have to have the determination unit 122 .

If the authentication of the user terminal 2 by the authentication unit 123 is not successful, the authentication token generation unit 124 ends the processing without performing subsequent processing. On condition that the authentication unit 123 has successfully authenticated the user terminal 2, the authentication token generation unit 124 generates a first authentication token (a3).

FIG. 5 is a schematic diagram of an exemplary authentication token. The authentication token generation unit 124 generates, for example, a character string generated randomly or according to a predetermined rule as an authentication token. An authentication token is associated with a predetermined expiration date, a predetermined update interval, and a start date and time. The validity period is the period during which the validity of the authentication token is maintained, and is 730 days in the example of FIG. The update interval is the interval at which the user terminal 2 makes an extension request, which will be described later, and is one week in the example of FIG. The start date and time is the starting date and time of the validity period, such as the generation date and time of the authentication token.

An authentication token before the expiration date is extended in response to an extension request, which will be described later, is defined as a first authentication token, and the expiration date of the first authentication token is defined as a first expiration date. The authentication token generation unit 124 causes the storage unit 11 to store information (for example, the config file in FIG. 5) that associates the generated first authentication token, the first expiration date, the update interval, and the start date and time. . Further, the authentication token generation unit 124 causes the storage unit 11 to store the first authentication token, the first expiration date, the update interval, and the start date and time in the storage unit 11 in association with the line ID included in the authentication request received by the authentication request reception unit 121. good too.

Returning to FIG. 4, the authentication token transmission unit 125 provides information (for example, the config file) to the user terminal 2 (a4).

In the user terminal 2, the authentication token reception unit 222 receives the first authentication token generated in response to the authentication request transmitted by the authentication request transmission unit 221 from the authentication device 1, the first expiration date, the update interval, the start The information associated with the date and time is received and stored in the storage unit 21 .

The message transmitting/receiving unit 223 sends and receives the message using the message service on the condition that the date and time when the message is to be transmitted/received is within the first validity period associated with the first authentication token received by the authentication token receiving unit 222. Send and receive messages in an application for sending and receiving The message service is a service for the user terminal 2 to send and receive messages using the line ID, and is RCS, for example.

On the other hand, when the first expiration date associated with the first authentication token received by the authentication token receiving unit 222 has passed, the message transmitting/receiving unit 223 receives the message in the application for transmitting/receiving the message using the message service. , and the authentication request transmitting unit 221 transmits the above-described authentication request to the authentication device 1 again.

FIG. 6 is a schematic diagram for explaining the process of extending the expiration date of the authentication token. In the user terminal 2, the extension request transmission unit 224 determines whether or not a period corresponding to the update interval associated with the first authentication token has passed since the authentication token reception unit 222 received the first authentication token. (b1). If the extension request transmission unit 224 determines that the period corresponding to the update interval has not passed since the authentication token reception unit 222 received the first authentication token, the extension request transmission unit 224 determines whether the period corresponding to the update interval has passed. repeatedly determine whether

The extension request transmission unit 224 receives the first authentication received by the authentication token reception unit 222 on the condition that the period corresponding to the update interval has elapsed since the authentication token reception unit 222 received the first authentication token. An extension request including the token is sent to the authentication device 1 (b2). The extension request may include the line ID in addition to the first authentication token.

The extension request transmission unit 224 may also determine whether or not the SIM (Subscriber Identity Module) for using the communication line connected to the user terminal 2 has been changed. The extension request transmission unit 224 transmits SIM change information indicating whether or not the SIM has been changed together with the extension request.

In the authentication device 1 , the extension request reception unit 126 receives the extension request from the user terminal 2 . Further, the extension request receiving unit 126 may receive the SIM change information together with the extension request from the user terminal 2 .

The authentication unit 123 determines whether an authentication token that matches the first authentication token included in the extension request received by the extension request receiving unit 126 is stored in the storage unit 11 (b3). Further, the authentication unit 123 may determine whether or not the line ID included in the extension request together with the first authentication token matches the line ID associated with the first authentication token in the storage unit 11 .

If authentication unit 123 determines that storage unit 11 stores an authentication token that matches the first authentication token included in the extension request received by extension request reception unit 126, authentication unit 123 stores the first authentication token in storage unit 11. Acquire the associated expiration date (first expiration date) and start date and time. Authentication unit 123 determines whether the date and time when extension request receiving unit 126 receives the extension request is within the first expiration date (that is, whether it is included in the period from the start date and time to the first expiration date). judge.

If the authentication unit 123 determines that an authentication token that matches the first authentication token included in the extension request received by the extension request reception unit 126 is not stored in the storage unit 11, or if the extension request reception unit 126 receives the extension request If it is determined that the received date and time is not within the first expiration date, the process is terminated without performing subsequent processes.

Authentication unit 123 determines that the date and time at which extension request reception unit 126 received the extension request is within the first expiration date, that is, that extension request reception unit 126 has received the extension request within the first expiration date. As a condition, the user terminal 2 is re-authenticated (b4). For example, in the same manner as a2 in FIG. to re-authenticate.

The authentication token generation unit 124 receives the extension request before the first expiration date, provided that the extension request reception unit 126 has received the extension request within the first expiration date, and that the authentication unit 123 has successfully re-authenticated the user terminal 2. A second authentication token associated with a second expiry date coming later is generated (b5). The authentication token generation unit 124 generates the second authentication token by, for example, the same method as a3 in FIG. On the other hand, if the date and time when the extension request reception unit 126 received the extension request is not within the first expiration date, or if the authentication unit 123 has not successfully re-authenticated the user terminal 2, the authentication token generation unit 124 2 Do not generate an authentication token.

The authentication token generation unit 124 deletes or invalidates information including the first authentication token in the storage unit 11, and associates the generated second authentication token with the second expiration date, update interval, and start date and time. The information obtained (for example, the config file in FIG. 5) is stored in the storage unit 11 . Further, the authentication token generating unit 124 causes the storage unit 11 to store the second authentication token, the second expiration date, the update interval, and the start date and time in association with the line ID included in the extension request received by the extension request receiving unit 126. good too.

The second expiration date is, for example, the same value as the first expiration date (730 days in the example of FIG. 5), and the start date and time is, for example, the date and time when the second authentication token is generated. As a result, since the second expiration date comes after the first expiration date, the expiration date of the authentication token of the user terminal 2 is extended.

Further, the authentication token generating unit 124 does not require re-authentication of the user terminal 2 by the authenticating unit 123 as a condition, but can generate the second authentication token under the condition that the extension request receiving unit 126 has received the extension request within the first expiration date. may be generated. In this case, the authentication unit 123 does not re-authenticate the user terminal 2 in response to the extension request reception unit 126 receiving the extension request. As a result, the authentication device 1 can reduce the processing and communication load for re-authentication of the user terminal 2 .

Further, the authentication token generation unit 124 confirms that the line ID included in the extension request matches the line ID associated with the first authentication token in the storage unit 11, and that the extension request reception unit 126 received the extension request within the first expiration date. A second authentication token may be generated contingent upon receiving the extension request. As a result, when the first authentication token included in the extension request coincidentally matches the authentication token of the user terminal 2 that is not the transmission source of the extension request, the authentication device 1 uses the authentication token of the user terminal 2 that is the transmission source of the extension request. It is possible to prevent extending the expiration date of

Further, the authentication token generation unit 124 determines that the SIM change information received by the extension request reception unit 126 indicates that the SIM has not been changed, and that the extension request reception unit 126 has issued the extension request within the first expiration date. A second authentication token may be generated on the condition that it is received. As a result, when there is a possibility that the user using the user terminal 2 or the communication line used by the user terminal 2 is changed due to the change of the SIM connected to the user terminal 2, the authentication device 1 Security can be improved by not extending the validity period of the authentication token.

The authentication token transmission unit 125 transmits information (for example, the config file in FIG. 5) that associates the second authentication token generated by the authentication token generation unit 124, the second expiration date, the update interval, and the start date and time. , to the user terminal 2 (b6).

In the user terminal 2, the authentication token reception unit 222 receives the second authentication token generated in response to the extension request transmitted by the extension request transmission unit 224 from the authentication device 1, the second expiration date, the update interval, the start The information associated with the date and time is received and stored in the storage unit 21 , and the information including the first authentication token is deleted or invalidated in the storage unit 21 .

The message transmitting/receiving unit 223 sends and receives the message using the message service on the condition that the date and time when the message is to be transmitted/received is within the second expiration date associated with the second authentication token received by the authentication token receiving unit 222. Send and receive messages in an application for sending and receiving

On the other hand, when the second expiration date associated with the second authentication token received by the authentication token receiving unit 222 has passed, the message transmitting/receiving unit 223 receives the message in the application for transmitting/receiving the message using the message service. , and the authentication request transmitting unit 221 transmits the above-described authentication request to the authentication device 1 again.

Further, the extension request transmission unit 224 determines whether or not the period corresponding to the update interval has passed for the second authentication token as well as the first authentication token, and determines that the period corresponding to the update interval has passed. On this condition, an extension request is transmitted to the authentication device 1.

In the authentication device 1, the authentication token transmission unit 125 does not transmit the second authentication token to the user terminal 2 when a predetermined condition is satisfied, and transmits a message in an application for transmitting and receiving messages using a message service. Control information for disabling transmission/reception may be transmitted to the user terminal 2 .

For example, the authentication token transmission unit 125 may transmit control information to the user terminal 2 on condition that the re-authentication of the user terminal 2 by the authentication unit 123 has not succeeded. For example, the authentication token transmission unit 125 transmits the control information to the user on condition that an authentication token that matches the first authentication token included in the extension request received by the extension request reception unit 126 is not stored in the storage unit 11 . You may transmit to the terminal 2. Further, the authentication token transmission unit 125 may transmit the control information to the user terminal 2, for example, on condition that the date and time when the extension request reception unit 126 receives the extension request is not within the first expiration date. Also, the authentication token transmission unit 125 may transmit the control information to the user terminal 2, for example, on condition that the SIM change information received by the extension request reception unit 126 indicates that the SIM has been changed.

When the user terminal 2 receives control information for disabling message transmission/reception from the authentication device 1, the message transmission/reception unit 223 does not transmit/receive the message in the application for transmitting/receiving the message using the message service, The authentication request transmission unit 221 transmits the above authentication request to the authentication device 1 again. As a result, the authentication device 1 can cause the user terminal 2 to perform the initial registration of the message service again when there is a possibility that a large change has occurred in the user terminal 2, thereby improving security.

[Sequence of information processing method]
FIG. 7 is a sequence diagram of the information processing method executed by the information processing system S according to this embodiment. In the user terminal 2, the authentication request transmission unit 221 transmits an authentication request including the line ID assigned for the user terminal 2 to use the communication line to the authentication device 1 (S11).

In the authentication device 1 , the authentication request receiving section 121 receives the authentication request from the user terminal 2 . The authentication request receiving unit 121 also acquires a terminal ID that can identify the user terminal 2 that is the source of the received authentication request.

When the authentication request receiving unit 121 receives the authentication request, the authentication unit 123 authenticates the user terminal 2 using at least one of the line ID and the terminal ID (S12). The authentication unit 123 authenticates the user terminal 2 by, for example, one of a plurality of authentication methods corresponding to the terminal ID. If the authentication of the user terminal 2 by the authentication unit 123 is not successful, the authentication token generation unit 124 terminates the process without generating the first authentication token.

On condition that the authentication unit 123 has successfully authenticated the user terminal 2, the authentication token generation unit 124 generates a first authentication token (S13). The authentication token generation unit 124 causes the storage unit 11 to store information that associates the generated first authentication token, the first expiration date, the update interval, and the start date and time. The authentication token transmission unit 125 transmits information that associates the first authentication token generated by the authentication token generation unit 124, the first expiration date, the update interval, and the start date and time to the user terminal 2 (S14). .

In the user terminal 2, the authentication token reception unit 222 receives the first authentication token generated in response to the authentication request transmitted by the authentication request transmission unit 221 from the authentication device 1, the first expiration date, the update interval, the start The information associated with the date and time is received and stored in the storage unit 21 . The message transmitting/receiving unit 223 sends and receives the message using the message service on the condition that the date and time when the message is to be transmitted/received is within the first validity period associated with the first authentication token received by the authentication token receiving unit 222. Send and receive messages in an application for sending and receiving

The extension request transmission unit 224 determines whether or not a period corresponding to the update interval associated with the first authentication token has passed since the authentication token reception unit 222 received the first authentication token. When the extension request transmission unit 224 determines that the period corresponding to the update interval has not elapsed since the authentication token reception unit 222 received the first authentication token (NO in S15), the extension request transmission unit 224 extends the period corresponding to the update interval. It is repeatedly determined whether or not has elapsed.

Extension request transmission unit 224 determines that a period corresponding to the update interval has elapsed since authentication token reception unit 222 received the first authentication token (YES in S15), and extension request transmission unit 224 extends authentication token reception unit 222 to An extension request including the received first authentication token is transmitted to the authentication device 1 (S16).

In the authentication device 1 , the extension request reception unit 126 receives the extension request from the user terminal 2 . The authentication unit 123 determines whether an authentication token that matches the first authentication token included in the extension request received by the extension request receiving unit 126 is stored in the storage unit 11 (S17). If the authentication unit 123 determines that the storage unit 11 stores an authentication token that matches the first authentication token included in the extension request received by the extension request reception unit 126, the extension request reception unit 126 transmits the extension request. It is determined whether or not the received date and time is within the first validity period associated with the first authentication token in the storage unit 11 .

Authentication unit 123 determines that the date and time at which extension request reception unit 126 received the extension request is within the first expiration date, that is, that extension request reception unit 126 has received the extension request within the first expiration date. As a condition, the user terminal 2 is re-authenticated (S18).

If the date and time when the extension request receiving unit 126 received the extension request is not within the first expiration date, or if the authentication unit 123 has not successfully re-authenticated the user terminal 2, the authentication token generating unit 124 performs the second authentication. End processing without generating a token.

The authentication token generation unit 124 receives the extension request before the first expiration date, provided that the extension request reception unit 126 has received the extension request within the first expiration date, and that the authentication unit 123 has successfully re-authenticated the user terminal 2. A second authentication token associated with a second expiry date coming later is generated (S19). The authentication token generation unit 124 deletes or invalidates information including the first authentication token in the storage unit 11, and associates the generated second authentication token with the second expiration date, update interval, and start date and time. The obtained information is stored in the storage unit 11 .

The authentication token transmission unit 125 transmits information that associates the second authentication token generated by the authentication token generation unit 124, the second expiration date, the update interval, and the start date and time to the user terminal 2 (S20). .

In the user terminal 2, the authentication token reception unit 222 receives the second authentication token generated in response to the extension request transmitted by the extension request transmission unit 224 from the authentication device 1, the second expiration date, the update interval, the start The information associated with the date and time is received and stored in the storage unit 21 , and the information including the first authentication token is deleted or invalidated in the storage unit 21 . The message transmitting/receiving unit 223 sends and receives the message using the message service on the condition that the date and time when the message is to be transmitted/received is within the second expiration date associated with the second authentication token received by the authentication token receiving unit 222. Send and receive messages in an application for sending and receiving

[Effect of this embodiment]
In the information processing system S according to the present embodiment, the authentication device 1 transmits an authentication token for using the message service to the user terminal 2 on condition that the authentication device 1 has successfully authenticated the user terminal 2, and further Extend the validity period of the authentication token every given refresh interval. As a result, the authentication device 1 can maintain security by periodically extending the expiration date of the authentication token without performing initial registration each time the user terminal 2 uses the message service. A balance can be struck between security and usability for using message services.

[Modification]
In the information processing system S according to the present modification, instead of the user terminal 2 transmitting an extension request, the authentication device 1 determines whether or not the period corresponding to the update interval has passed, thereby obtaining the authentication token. Extend the expiration date. In the following, different parts from the above-described embodiment will be mainly described.

In the authentication device 1, the authentication token generation unit 124 determines whether or not a period corresponding to the update interval associated with the first authentication token has passed since the authentication token transmission unit 125 transmitted the first authentication token. do. If the authentication token generation unit 124 determines that the period corresponding to the update interval has not elapsed since the authentication token transmission unit 125 transmitted the first authentication token, the authentication token generation unit 124 determines whether the period corresponding to the update interval has elapsed. repeatedly determine whether

The authentication token generation unit 124 determines that a period corresponding to the update interval has elapsed since the authentication token transmission unit 125 transmitted the first authentication token, and the date and time when the period corresponding to the update interval has elapsed is the first validity period. A second authentication token is generated and stored in the storage unit 11 on the condition that it is within the time limit.

The authentication token transmission unit 125 transmits to the user terminal 2 information that associates the second authentication token generated by the authentication token generation unit 124, the second expiration date, the update interval, and the start date and time.

In the user terminal 2, the authentication token reception unit 222 receives information that associates the second authentication token, the second expiration date, the update interval, and the start date and time from the authentication device 1, and stores the information in the storage unit 21. Also, the information including the first authentication token is deleted or invalidated in the storage unit 21 .

According to the information processing system S according to this modification, the user terminal 2 does not need to transmit the extension request to the authentication device 1, so the communication load for transmitting and receiving the extension request can be reduced.

The present invention makes it possible to contribute to Goal 9 of the Sustainable Development Goals (SDGs) led by the United Nations, "Industry and technological innovation."

Although the present invention has been described above using the embodiments, the technical scope of the present invention is not limited to the scope described in the above embodiments, and various modifications and changes are possible within the scope of the gist thereof. be. For example, all or part of the device can be functionally or physically distributed and integrated in arbitrary units. In addition, new embodiments resulting from arbitrary combinations of multiple embodiments are also included in the embodiments of the present invention. The effect of the new embodiment caused by the combination has the effect of the original embodiment.

The processors of the authentication device 1 and the user terminal 2 are the subject of each step (process) included in the information processing method shown in FIG. That is, the processors of the authentication device 1 and the user terminal 2 execute the information processing method shown in FIG. 7 by executing a program for executing the information processing method shown in FIG. Some steps included in the information processing method shown in FIG. 7 may be omitted, the order between steps may be changed, and a plurality of steps may be performed in parallel.

S information processing system 1 authentication device 11 storage unit 12 control unit 121 authentication request reception unit 122 determination unit 123 authentication unit 124 authentication token generation unit 125 authentication token transmission unit 126 extension request reception unit 2 user terminal 21 storage unit 22 control unit 221 authentication Request transmission unit 222 Authentication token reception unit 223 Message transmission/reception unit 224 Extension request transmission unit

Claims (10)

an authentication request receiving unit that receives from an information terminal an authentication request including line identification information assigned for the information terminal to use a communication line;
an authentication unit that authenticates the information terminal using at least one of the line identification information and terminal identification information that can identify the information terminal in response to the authentication request receiving unit receiving the authentication request; ,
an authentication token generation unit that stores in a storage unit a first authentication token associated with a first expiration date and an update interval on condition that the information terminal is successfully authenticated by the authentication unit;
an authentication token transmission unit that transmits the first authentication token to the information terminal;
an extension request receiving unit that receives an extension request including the first authentication token transmitted from the information terminal in response to the elapse of a period corresponding to the update interval;
has
The authentication unit re-authenticates the information terminal on condition that the extension request reception unit has received the extension request within the first expiration date,
The authentication token generation unit stores a second authentication token associated with a second expiration date that comes after the first expiration date on condition that the authentication unit successfully re-authenticates the information terminal. store in the department,
The authentication token transmission unit transmits the second authentication token to the information terminal on condition that the authentication unit successfully re-authenticates the information terminal,
The authentication token transmission unit does not transmit the second authentication token to the information terminal and the information terminal transmits and receives messages on condition that the re-authentication of the information terminal by the authentication unit has not succeeded. sending control information to the information terminal for disabling transmission and reception of the message within the first expiration date in the application of
Information processing equipment. The authentication token generation unit stores the first expiration date and the first authentication token in association with each other in a storage unit;
On the condition that the extension request receiving unit receives the extension request within the first validity period associated with the first authentication token included in the extension request in the storage unit, the authentication token generation unit storing a second authentication token in the storage unit;
The information processing device according to claim 1 . The authentication token generation unit stores the first expiration date, the line identification information, and the first authentication token in association with each other in the storage unit;
the extension request receiving unit receives the extension request including the first authentication token and the line identification information from the information terminal;
The authentication token generation unit determines that the line identification information included in the extension request matches the line identification information associated with the first authentication token included in the extension request in the storage unit, and the extension request The second authentication token is stored in the storage unit on condition that the receiving unit receives the extension request within the first validity period associated with the first authentication token included in the extension request in the storage unit. let
The information processing apparatus according to claim 2. The authentication unit authenticates the information terminal with an authentication method corresponding to the terminal identification information, among a plurality of authentication methods.
The information processing apparatus according to any one of claims 1 to 3. further comprising a determination unit that determines whether a telecommunications carrier that provides the communication line is a specific telecommunications carrier based on the terminal identification information;
The authentication unit authenticates the information terminal using the terminal identification information on condition that the determination unit determines that the telecommunications carrier that provides the communication line is the specific telecommunications carrier, and Authenticating the information terminal using the line identification information on the condition that the determination unit determines that the telecommunications carrier that provides the communication line is not the specific telecommunications carrier;
The information processing apparatus according to claim 4. The authentication token generation unit does not store the second authentication token in the storage unit when re-authentication of the information terminal by the authentication unit is unsuccessful.
The information processing device according to claim 1 . an information processing device;
an information terminal capable of communicating with the information processing device;
including
The information processing device is
an authentication request receiving unit for receiving an authentication request including line identification information assigned for the information terminal to use a communication line from the information terminal;
an authentication unit that authenticates the information terminal using at least one of the line identification information and terminal identification information that can identify the information terminal in response to the authentication request receiving unit receiving the authentication request; ,
an authentication token generation unit that stores in a storage unit a first authentication token associated with a first expiration date and an update interval on condition that the information terminal is successfully authenticated by the authentication unit;
an authentication token transmission unit that transmits the first authentication token to the information terminal;
an extension request receiving unit that receives an extension request including the first authentication token transmitted from the information terminal in response to the elapse of a period corresponding to the update interval;
has
The information terminal is
an authentication request transmission unit that transmits the authentication request to the information processing device;
an authentication token receiving unit that receives the first authentication token in response to the authentication request from the information processing device;
an extension request transmission unit configured to transmit the extension request to the information processing device on condition that the period has elapsed since the authentication token reception unit received the first authentication token;
has
The authentication unit re-authenticates the information terminal on condition that the extension request reception unit has received the extension request within the first expiration date,
The authentication token generation unit stores a second authentication token associated with a second expiration date that comes after the first expiration date on condition that the authentication unit successfully re-authenticates the information terminal. store in the department,
The authentication token transmission unit transmits the second authentication token to the information terminal on condition that the authentication unit successfully re-authenticates the information terminal,
The authentication token transmission unit does not transmit the second authentication token to the information terminal and the information terminal transmits and receives messages on condition that the re-authentication of the information terminal by the authentication unit has not succeeded. sending control information to the information terminal for disabling transmission and reception of the message within the first expiration date in the application of
The authentication token receiving unit receives the second authentication token from the information processing device.
Information processing system. The extension request transmission unit transmits information indicating whether or not the SIM for using the communication line connected to the information terminal has been changed together with the extension request,
The authentication token generation unit generates the second authentication token on condition that the SIM has not been changed in the information terminal and the extension request reception unit has received the extension request within the first expiration date. is stored in the storage unit,
The information processing system according to claim 7 . The information terminal further includes a message transmitting/receiving unit for transmitting/receiving the message in an application for transmitting/receiving the message using the line identification information on condition that the message is within the first expiration date or the second expiration date. have
The information processing system according to claim 7 or 8 . the processor executes
receiving from an information terminal an authentication request including line identification information assigned for the information terminal to use a communication line;
the step of authenticating the information terminal using at least one of the line identification information and terminal identification information capable of identifying the information terminal in response to receiving the authentication request in the step of receiving the authentication request; and,
a step of storing, in a storage unit, a first authentication token associated with a first expiration date and an update interval on condition that the information terminal is successfully authenticated in the step of authenticating;
transmitting the first authentication token to the information terminal;
receiving from the information terminal an extension request including the first authentication token transmitted in response to the elapse of a period corresponding to the update interval;
a step of re-authenticating the information terminal on condition that the extension request is received within the first validity period in the step of receiving the extension request;
storing in the storage unit a second authentication token associated with a second expiration date that comes after the first expiration date on condition that the re-authentication of the information terminal is successful in the re-authentication step; and,
a step of transmitting the second authentication token to the information terminal on condition that the re-authentication of the information terminal is successful in the re-authentication step ;
On the condition that the re-authentication of the information terminal is not successful in the re-authentication step, the second authentication token is not transmitted to the information terminal, and the application for the information terminal to transmit and receive messages is the first a step of transmitting control information to the information terminal for disabling transmission and reception of the message within one validity period;
An information processing method comprising:

Images