WO2011074500A1

WO2011074500A1 - Mobile proxy authentication system and mobile proxy authentication method

Info

Publication number: WO2011074500A1
Application number: PCT/JP2010/072285
Authority: WO
Inventors: 淳松村; 利幸尾間
Original assignee: ＢｉｚＭｏｂｉｌｅ株式会社
Priority date: 2009-12-15
Filing date: 2010-12-10
Publication date: 2011-06-23
Also published as: JP5655246B2; JPWO2011074500A1

Abstract

In order to authenticate an information processing terminal (1) connected to a communication network (5) using a mobile terminal (2), provided is a mobile proxy authentication system which authenticates a user in the information processing terminal (1) connected to the communication network (5) using the mobile terminal (2) which the user carries. Said mobile proxy authentication system comprises an authentication interface unit (110) which accepts an input of authentication information in the information processing terminal (1), a confirmation request unit (305) which acquires the authentication information inputted in the authentication interface unit (110) and makes a confirmation request to the mobile terminal (2) on the basis of the authentication information, a confirmation operation unit (207) which requests the user to perform a confirmation operation in response to the confirmation request and sends approval data to the confirmation request unit (305) in response to the confirmation operation by the user in the mobile terminal (2), an external authentication processing unit (306) which performs authentication processing on the basis of the approval data, and an authentication result sending unit (303) which sends the result of authentication by the external authentication processing unit (306) to the communication network.

Description

Mobile authentication agent system and mobile authentication agent method

The present invention relates to a mobile authentication agent system and a mobile authentication agent method for authenticating an information processing terminal connected to a communication network using a mobile terminal.

Recently, the use of electronic payments and electronic money on the network is increasing rapidly. In such network transactions, how to ensure security is an important issue, and strict identity authentication is performed to prevent unauthorized connection by anyone other than the authorized user. There is a need.

Here, conventionally, there has been proposed an authentication system that allows a user to use a network resource from a terminal after confirming the legitimacy of the user (for example, Patent Document 1). In the authentication system disclosed in Patent Document 1, a mobile terminal identifier and ID of a mobile terminal registered in advance are used as authentication targets, and a user performs an authentication procedure from the mobile terminal, whereby a temporary password (one-time password) is obtained. And then connect to the server using the temporary password from another communication terminal such as a PC. Thus, by using a mobile terminal different from the communication terminal that uses the service, it is possible to provide a user with a secure service.

Japanese Patent Laid-Open No. 2004-240637

However, in the above-described method, first, an ID is input from a mobile terminal to obtain a one-time password, and then authentication is completed by inputting the ID and one-time password from another communication terminal. On the other hand, there is a problem that the input operation is required twice and the operation is complicated.

Further, in the authentication system disclosed in Patent Document 1, the one-time password is not transmitted on the user's own mobile terminal side, so that the person who owns the mobile terminal that receives the one-time password and the PC The person who logs in from other communication terminals must be the same person.

For this reason, there is a problem that the invention disclosed in Patent Document 1 cannot be applied to a service system in which the owner of the mobile terminal and the person receiving the service are different. For example, when a victim of a crime such as a bank transfer fraud tries to perform a transfer operation from an ATM, the victim himself can proceed with the transfer operation because the one-time password is the mobile terminal of an elderly person who performs the transfer operation. For example, when the victim is an elderly person, the guardian cannot monitor the transfer process remotely, and such a crime cannot be prevented.

Therefore, the present invention solves the above-described problems, and when performing authentication of an information processing terminal connected to a communication network, the mobile terminal can be used for simple and safe authentication. In addition, an object of the present invention is to provide a mobile authentication agent system and a mobile authentication agent method that can achieve a variety of services.

In order to solve the above-mentioned problems, the present invention is a mobile authentication agency system that authenticates a user at an arbitrary information processing terminal connected to a communication network using a mobile terminal carried by the user. An authentication interface unit that accepts input of authentication information on the processing terminal, and a confirmation request that is arranged on the communication network, acquires the authentication information input in the interface unit, and makes a confirmation request to the mobile terminal based on the authentication information And a mobile terminal, arranged on a communication network, a confirmation operation unit that requests a confirmation operation from a user in response to a confirmation request, and returns approval data to the confirmation request unit in response to the confirmation operation by the user. The authentication processing unit that obtains the approval data and executes the authentication process based on the approval data, and the authentication processing unit The authentication result, and transmits on the communication network with an authentication result transmitting unit.

Further, the present invention is a mobile authentication agent method for authenticating a user in an arbitrary information processing terminal connected to a communication network using a mobile terminal carried by the user,
(1) On the information processing terminal, an authentication information input step for inputting authentication information through the authentication interface unit;
(2) A confirmation requesting step for obtaining authentication information input in the interface unit in a confirmation requesting unit installed on the communication network and making a confirmation request to the mobile terminal based on the authentication information;
(3) In the mobile terminal, in response to the confirmation request, a confirmation operation step of requesting a confirmation operation to the user and returning approval data to the confirmation request unit in response to the confirmation operation by the user;
(4) In an authentication processing unit arranged on the communication network, an authentication processing step of acquiring approval data and executing authentication processing based on the approval data;
(5) An authentication result transmission step of transmitting the authentication result in the authentication processing step on the communication network.

According to the present invention, when the authentication information is input to an information processing terminal for receiving a service such as a dedicated device having a PC, an ATM, or a card reader, the confirmation request unit on the communication network You can request a confirmation operation for the mobile terminal owned by the user himself / herself and obtain the approval of the user himself / herself (or the user's guardian, etc.) for authentication processing, improving security and ensuring safety. Authentication can be performed.

In the present invention, when a user receives a service via a communication network, an input operation on the information processing terminal and a confirmation operation on the mobile terminal are performed. This input operation is an operation for inputting the telephone number of the mobile terminal that requests confirmation for receiving the service. On the other hand, since the confirmation operation is an operation for returning availability of the confirmation request, the user can If an input operation is performed on the above, the next operation is authenticated only by a confirmation operation, so that the user input procedure can be simplified and the service can be received.

According to the present invention, the confirmation request can be transmitted to the authentication target user who is operating the information processing terminal as well as to the mobile terminal possessed by another user, and the authentication by the confirmation operation at that time The result can be sent to an authentication server on the service provider side. For example, when the user to be authenticated is a child or an elderly person, the remittance service is used by an information processing terminal such as an ATM. Even when trying to do so, since the confirmation request is notified to the user's guardian, it is possible to determine whether or not the transfer process can be performed on the guardian side, and it is possible to prevent a procedure for a transfer fraud or the like. As described above, the present invention can be applied to a service system that prevents wire fraud and the like, and can provide a variety of services.

In the above invention, an authentication information type determination unit that determines whether a mobile terminal identifier that identifies a predetermined mobile terminal is included in the authentication information that is arranged on the communication network and is input to the authentication interface unit The confirmation request unit preferably makes a confirmation request to the mobile terminal when the authentication information type determination unit determines that the mobile terminal identifier is included.

In this case, the authentication information type determination unit on the information processing terminal side determines whether the input authentication information is a mobile phone number or a normal ID and password, and notifies the authentication information according to the determination result. Since the destination can be changed, the system according to the present invention can be introduced in combination with a security system in which the same ID and password are input as in the prior art. In addition, according to the present invention as described above, it is possible to easily add an authentication process having an identity verification phase based on a confirmation request only by adding a function of determining a mobile terminal identifier to an interface in an existing authentication system. Thus, the present invention can be introduced with a simple capital investment.

In the above invention, the mobile terminal has a position information acquisition unit that measures the current position of the own device, and the confirmation operation unit determines the current position of the own device measured by the position information acquisition unit with respect to the approval data. Approval data is sent back to the confirmation requesting unit, and the authentication processing unit has map information that describes the range for which authentication is permitted. It is preferable to determine whether the position belongs to a predetermined range. In this case, in addition to the user authentication information and approval data, the user can authenticate with reference to the map information about the location information of the mobile terminal that the user has, based on the location of the mobile terminal that performs the confirmation process, More reliable approval data can be acquired, and the security of the authentication system using the mobile terminal can be increased.

In the above invention, the authentication interface unit has a form identifier for identifying the authentication interface unit, the authentication interface unit has a function of adding its own form identifier to the authentication information, and the authentication result transmission unit A database that stores the identifier and a destination address that identifies the authentication processing unit that performs normal authentication processing through the authentication interface unit; the authentication result transmission unit acquires the form identifier of the authentication interface unit; It is preferable to transmit the authentication result toward the destination address obtained by collating the database based on the form identifier.

In this case, since the form identifier of the authentication interface unit is associated with the destination address that specifies the authentication processing unit, the authentication processing unit that is the transmission destination of the authentication result can be specified. By transmitting the authentication result using the key to the authentication processing unit, the authentication processing unit can perform an authentication procedure using the authentication result. Therefore, once the input operation is performed in the information processing terminal, the authentication information associated with the authentication process can be used, and the operation for inputting the authentication information again can be omitted, and the security can be further strengthened. .

In the above invention, the service providing unit that performs the user authentication as the normal authentication process based on the authentication information input through the authentication interface unit, and provides the service when the authentication of the normal authentication process is successful, and the service providing unit side An external confirmation request unit that transmits the confirmation request to the mobile terminal as an external confirmation request based on the authentication information input in the normal authentication process. The authentication result transmission unit transmits an authentication result based on the approval data as an external authentication result to the service providing unit, and the service providing unit transmits the external authentication result transmitted from the authentication result transmitting unit, the authentication result of the normal authentication process, and It is preferable to determine whether to provide the service based on the above.

In this case, even if the normal authentication procedure for inputting the ID and password to the information processing terminal is performed, a confirmation operation is requested to the mobile terminal through the confirmation requesting unit, and whether or not the authentication is permitted is determined. Therefore, the diversity of services can be improved and the security can be improved. Specifically, for example, even when a child or elderly person who is a user makes a transfer by ATM, an external confirmation request is notified to the guardian of the user who is the external confirmation request destination. It is possible to determine whether or not the transfer operation can be performed on the person side, and crime can be prevented.

In the above invention, the service providing unit has an approval function for executing an approval process by a financial institution, the external confirmation requesting unit has an external confirmation list of a user who requires an external confirmation request, and the approval function is an approval function. In the process, it is preferable to have a limit change function for checking the external confirmation list of the user and switching the limit of the amount related to the approval process based on the external confirmation list. In this case, by introducing the present invention, it is possible to reduce the incidence of incidents and accidents, so list the users of the present invention and increase the limit of the approval process for the listed users For example, a service for switching the limit amount can be introduced, so that the convenience and safety of the user can be improved, and the approval process for the financial institution can be made smooth.

As described above, according to the present invention, an information processing terminal connected to a communication network is used for electronic commerce by a personal computer on the Internet, financial approval by an ATM, a dedicated device equipped with a card reader, or the like. When authenticating the user, using the mobile terminal used by the user or the guardian of the user, it is possible to authenticate simply and safely by performing identity verification and approval by the guardian, etc. Diversification of services can be achieved by improving the flexibility of security services.

It is a conceptual diagram which shows the whole structure of the authentication agency system which concerns on 1st Embodiment. It is explanatory drawing which shows the outline | summary of the authentication agency service which concerns on 1st Embodiment. It is a block diagram which shows the internal structure of the information processing terminal which comprises the authentication agency system which concerns on 1st Embodiment, an authentication agency server, a mobile terminal, and this authentication server. It is explanatory drawing which shows the data structure of the table data T1 which concerns on 1st Embodiment. It is a flowchart figure at the time of applying the authentication agency system which concerns on 1st Embodiment to the login service of online shopping. It is explanatory drawing which shows the display screen (login screen) of the mobile terminal which concerns on 1st Embodiment. It is a flowchart figure at the time of applying the authentication agency system which concerns on 1st Embodiment to merchandise sales service. It is explanatory drawing which shows the display screen (payment confirmation screen) of the mobile terminal which concerns on 1st Embodiment. It is a flowchart figure at the time of applying the authentication agency system which concerns on 1st Embodiment to a delivery delivery service. It is explanatory drawing which shows the display screen (reception confirmation screen) of the mobile terminal which concerns on 1st Embodiment. It is a flowchart figure at the time of applying the authentication agency system which concerns on 1st Embodiment to ATM service. It is explanatory drawing which shows the display screen (illegal payment prevention screen) of the mobile terminal which concerns on 1st Embodiment. It is a flowchart figure at the time of applying the authentication agency system which concerns on 1st Embodiment to the credit approval service in a store. It is explanatory drawing which shows the display screen (payment confirmation screen) of the mobile terminal which concerns on 1st Embodiment. It is a conceptual diagram which shows the whole structure of the authentication agency system which concerns on 2nd Embodiment. It is a block diagram which shows the internal structure of the information processing terminal which comprises the authentication agency service which concerns on 2nd Embodiment, a mobile terminal, a decision part, and an authentication server.

[First Embodiment]
(Overall configuration of authentication agency system)
Hereinafter, a first embodiment of an authentication agent system according to the present invention will be described in detail with reference to the accompanying drawings. FIG. 1 is a conceptual diagram showing the overall configuration of the authentication proxy system according to the present embodiment, and FIG. 2 is an explanatory diagram showing an overview of the authentication proxy service according to the present embodiment.

As shown in FIG. 1, the authentication agent system is an arbitrary information processing terminal connected to a communication network 5 by performing identity verification and procedure approval using a mobile terminal 2 carried by a user who receives a service. 1 (1a to 1f) is a system that performs or supports user authentication. In this embodiment, on the communication network 5, the information processing terminals 1 (1a to 1f), the service providing server 4, and the authentication proxy server 3, a wireless base station 6, and a mobile terminal 2 capable of wireless communication through the wireless base station 6 or the communication satellite 7.

The communication network 5 is an IP network using a communication protocol TCP / IP such as the Internet, and has various communication lines (public lines such as telephone lines, ISDN lines, ADSL lines, optical lines, private lines, wireless communication networks). It is a distributed communication network constructed by connecting to each other. This communication network 5 includes a LAN such as an intranet (in-house network) or a home network based on 10BASE-T, 100BASE-TX, or the like.

The information processing terminal 1 (1a to 1f) is a user terminal having an arithmetic processing function by a CPU and a communication processing function by a communication interface. For example, the information processing terminal 1 (1a to 1f) has functions of a general-purpose computer such as a personal computer, an ATM, and a card reader. It can be realized by a specialized dedicated device, and includes a mobile computer, a PDA (Personal Digital Assistance), a mobile phone, and the like. In this embodiment, 1a is a general-purpose computer such as a personal computer, 1b is a portable information terminal such as a mobile phone or PDA, 1c is an ATM terminal connected to the

dedicated line

51, and 1d to 1f are For example, it is a dedicated device that is installed in a store such as a restaurant or a convenience store and has a card reader function connected to the dedicated line 51.

The dedicated line 51 is a dedicated communication line that directly connects the server 4 and terminals 1c to 1f such as ATM, and fixed length data such as an ATM (Asynchronous Transfer Mode) line is transferred by an asynchronous transfer mode or frame relay. Includes lines to send and receive.

In addition, an ATM terminal is an automatic teller machine that can be used for depositing, depositing, and transferring money using a card or bankbook. A card reader is a contact-type or non-contact type device that reads information from a card such as a credit card or cash card. The contact-type device includes a card or a magnetic card mounted with an IC chip or the like. There are an insertion type device 1d to be inserted into a slot, a cash register device 1e having a function of reading a magnetic part by sliding a card, and the non-contact type device has a short-distance communication inside an IC chip mounted card. For example, there is a reader / writer device 1f that has an antenna for transmitting and receiving data using weak radio waves.

The information processing terminals 1a to 1f are provided with a browser function for accessing the Internet, which is the communication network 5, and transmitting / receiving data, or an interactive operation function using a dedicated program. The browser function is an application software that can be executed on a general-purpose computer or PDA to view web pages. Download HTML (HyperText Markup Language) files, image files, music files, etc. from the Internet, analyze the layout, and so on. Display / play. According to this browser function, a user transmits data to the service providing server 4 using a form which is a GUI, or operates application software described in JavaScript, Flash, Java (registered trademark), or the like. It is also possible. In addition, the interactive operation function is a dedicated program executed in a dedicated device such as ATM, and accepts screen display and input operations to the user through a touch panel, etc. Data is transmitted to and received from the device (for example, the service providing server 4).

As shown in FIG. 2, these browser function and interactive operation function display the login form 111a on the information processing terminals 1a to 1f when the user receives a service, and accept the input of authentication information by the user operation. . Here, the authentication information includes a mobile phone number as a mobile terminal identifier in addition to an ID and a password.

In the present embodiment, the information processing terminal 1 determines whether or not the authentication information input through the browser function or the interactive operation function includes a mobile terminal identifier that identifies the mobile terminal 2. When the mobile terminal identifier is included, the mobile terminal identifier is transmitted as authentication information data D1 to the authentication agent server 3, while when the input authentication information does not include the mobile terminal identifier, The authentication information is transmitted to the service providing server 4 as normal authentication information data D2.

The mobile terminal 2 is a portable telephone that can be communicated through wireless communication, and a relay point such as a base station and a portable telephone communicate wirelessly to move communication services such as telephone calls and data communications. Can be received while. Examples of the communication system of the mobile terminal 2 include an FDMA system, a TDMA system, a CDMA system, a W-CDMA system, a PHS (Personal Handyphone System) system, and the like. Further, the mobile terminal 2 is equipped with functions such as a digital camera function, an application software execution function, or a GPS function, and also functions as a personal digital assistant (PDA).

In this embodiment, the mobile terminal 2 receives the confirmation request data D3 from the authentication proxy server 3, requests the user for a confirmation operation, and authenticates the approval data D4 according to the confirmation operation by the user. It has a function of returning to the proxy server 3. Here, the user who uses the mobile terminal 2 may be the person who is to be authenticated who performs the authentication process in the information processing terminal 1, or may be a guardian of the person to be authenticated. The reception of the confirmation request data D3, the input of the confirmation operation, and the transmission of the approval data D4 can be performed by a dedicated module or operation button provided in the mobile terminal 2, and the above browser function is moved. Information may be displayed and user operations may be input through a GUI provided in the terminal 2 and configured with a browser function.

Note that the information processing terminal 1b and the mobile terminal 2 perform transmission and reception of radio signals through the radio base station 6 to perform a call and data communication. Here, the radio base station 6 is connected to the communication network 5 through the gateway device 8, establishes a radio communication connection between the mobile terminal 2 and the radio base station 6, and performs communication and data communication by the mobile terminal 2. Is a device that provides The radio base station 6 may be, for example, a small-scale femtocell base station called a femtocell that covers a narrow area with a radius of about 10 m. In this case, the wireless base station 6 is connected to an HSS (Home Subscriber Server) on the network through a communication network 5 such as an optical network as a backbone, a public network such as ADSL, or an IP network (not shown). ). The HSS is a server that manages in which cell each mobile terminal is located, and functions as a location information acquisition unit.

Specifically, the HSS receives the location registration request transmitted from the mobile terminal 2 together with the base station identification information assigned to the femtocell base station, and specifies the location of the mobile terminal 2. This location registration request is transmitted from the mobile terminal 2 to a femtocell base station that manages a cell that is newly located when the cell that is located is switched due to a user's movement, The base station identification information assigned to the femtocell base station is transmitted to the HSS together with the location registration request, and the location of the user can be grasped in real time in the HSS.

The service providing server 4 is a general communication server that is distributed on the communication network 5, and in a document system such as WWW (World Wide Web), HTML (HyperText Markup Language) files, image files, music files, etc. A server computer that transmits information or software having the function thereof, stores information such as HTML documents and images, and responds to requests from applications such as a Web browser executed on the information processing terminal 1 (Web page) is distributed.

In particular, in the present embodiment, the service providing server 4 is an organization that executes processing related to a service in response to an instruction from the authentication proxy server 3. Specifically, the service providing server 4 receives the normal authentication information data D2 transmitted from the information processing terminal 1 or the authentication result data D5 transmitted from the authentication proxy server 3, so that the service providing server 4 Perform this authentication process and start providing services to users. As this service, for example, if the service provider is a server that distributes digital contents such as e-mail and images / videos, it is distribution of e-mail attached with the digital contents, presentation of a web page, etc. If the service providing server 4 is a server that performs financial approval, it is possible to present a web page for the financial approval, accept payment processing, or the like.

The authentication proxy server 3 is a server device that is arranged on the communication network 5 and manages the authentication proxy for the user. The authentication proxy server 3 is connected to the service providing server 4 via the communication network 5. In cooperation with the service providing server 4, or in addition to the normal authentication process in the service providing server 4, processing related to the authentication proxy is executed.

That is, the way of cooperation with the authentication proxy server 3 differs depending on the business condition of the service provided by the service providing server 4 and the level of security in the service providing server 4, and for example, the following patterns can be supported. .

(A) The service providing server 4 itself does not have an authentication system, and entrusts the entire authentication process to the authentication agent server 3, and the service providing server 4 itself accepts only the authentication result received from the authentication agent server 3. Manage access from users based.

(B) The service providing server 4 itself has a normal authentication system, and when normal authentication information such as an ID and a password is input, the service providing server 4 executes the normal authentication process and is input. If the authentication information is the phone number of the portable terminal, the authentication processing in the authentication proxy server 3 is performed in advance, and the service providing server 4 itself normally uses the authentication result in the authentication proxy server 3 Execute authentication process and manage access from users based on double authentication result.

(C) The service providing server 4 itself also has a normal authentication system. Usually, the service providing server 4 itself performs normal authentication processing using an ID and a password, and the input authentication information is that of a specific user. If there is, the authentication proxy server 3 is requested to perform authentication processing, and the access from the user is managed based on the authentication result of the service providing server 4 itself and the authentication result of the authentication proxy server 3.

Further, in the present embodiment, the authentication proxy server 3 sends the mobile terminal 2 to the mobile terminal 2 based on the authentication information data D1 transmitted from the information processing terminal 1 or the external confirmation request data D6 transmitted from the service providing server 4. In addition, it has a function of making a confirmation request for confirmation of the authentication operation and executing an approval process based on the approval data D4 returned from the mobile terminal 2.

(Internal structure of each device)
Next, the internal structure of each device constituting the above-described authentication proxy system will be described. FIG. 3 is a block diagram showing the internal configuration of the information processing terminal 1, the authentication proxy server 3, the mobile terminal 2, and the service providing server 4 constituting the authentication proxy system according to the present embodiment, and FIG. It is explanatory drawing which shows an example of the confirmation request | requirement displayed on the display of the mobile terminal 2 which concerns on a form. The “module” used in the description refers to a functional unit that is configured by hardware such as an apparatus or a device, software having the function, or a combination thereof, and achieves a predetermined operation. .

(1) Information processing terminal 1
As shown in FIG. 3, the information processing terminal 1 includes a communication interface 101 as a communication module, an authentication interface unit 110 as a user interface module, and a control unit 120 as a service execution module that provides a service. I have.

The communication interface 101 is a communication interface that transmits various data such as authentication information and receives various data such as authentication permission data and content data. Each data received by the communication interface 101 is input to the control unit 120.

The authentication interface unit 110 is a module that accepts input of authentication information based on a user operation on the information processing terminal 1, and includes an output interface 115, a display screen 111, an operation device interface 113, and an operation signal detection unit 112. I have.

The output interface 115 is a module that outputs video and audio output signals from the display screen 111 and speakers. The display screen 111 is a display device such as a liquid crystal display, for example, and can display Web information and the like through a login form 111a generated by a Web application or the like.

The operation device interface 113 is a module to which an operation / input device such as a mouse, a keyboard, or a reader / writer is connected, and receives an input signal based on a user operation such as an operation button or a touch panel, and information read by the reader / writer. With this operation device, the user can input a keyword for displaying a Web page, input authentication information such as an ID, password, and telephone number, or authentication information such as a credit card.

The operation signal detection unit 112 is a module that acquires an operation signal from an operation device based on a user operation. In particular, in the present embodiment, the operation signal detection unit 112 detects authentication information input by a user operation as data, and transmits this authentication information data to the form identifier addition unit 114.

The form identifier adding unit 114 acquires a form identifier set to specify an authentication interface unit that is a target of user operation, and adds the acquired form identifier to authentication information input through the operation device interface 113. It is a module to do. The form identifier is a URL of a Web page displayed on the browser or an identifier given to an input form in the Web page, and is extracted from the Web page when the Web page is read by the browser function. . Further, as the form identifier, for example, when the information processing terminal 1 is an ATM-like device, it is an identifier for identifying a series of transaction operations (transactions) by the user, and a reference number such as a transaction number is used. It may be used.

The authentication interface unit 110 can output video and audio through the output interface 115, and an operation signal from an operation device such as a mouse or a keyboard is input as a user operation through the operation device interface 113. The display screen 111 displays a Web page and allows user operations such as clicking on the Web page and inputting characters, and accepts input of authentication information.

The control unit 120 is an arithmetic processing unit such as a CPU, and each function module is virtually constructed by executing various programs on the control unit 120. In the present embodiment, an application execution unit 123, a content acquisition unit 121, and an execution process determination unit 122 are constructed in the control unit 120 by executing a predetermined program.

The content acquisition unit 121 is a module that receives content data such as HTML from the service providing server 4 through the communication network 5. The content data downloaded by the content acquisition unit 121 is video / audio by the application execution unit 123. The signal is converted into a signal and output from the display screen 111 or the speaker through the output interface 115.

The execution process determination unit 122 is a module that determines whether or not a condition related to the execution of content data is satisfied and restricts execution of the application by the application execution unit 123. In the present embodiment, the condition determined by the execution process determination unit 122 is an authentication result transmitted from the service providing server 4, and the execution of the application is regulated based on the authentication result.

The application execution unit 123 is a module that executes applications such as a general OS, browser software, and media viewing application, and includes an output signal generation unit 126, an authentication information type determination unit 125, and a connection destination selection unit 124. Yes.

The output signal generation unit 126 converts the application execution result by the application execution unit 123 and the content data acquired by the content acquisition unit 121 into a video signal and an audio signal, and generates the signal that can be output by the display screen 111 or the speaker. It is a module to do. Further, since the application execution unit 123 also controls the GUI, the output signal generation unit 126 generates graphics necessary for displaying the GUI, and the generated graphics are displayed on the display screen 111 through the output I / F 115. Is displayed.

The authentication information type determination unit 125 is configured with a script embedded in HTML describing a Web page, a module of a dedicated program, or the like. The authentication information input to the authentication interface unit 110 is used as a predetermined mobile terminal. 2 is a module that determines whether or not a mobile terminal identifier that specifies 2 is included. Specifically, the mobile terminal identifier in the present embodiment is a telephone number that identifies the mobile terminal that performs the confirmation operation, and the authentication information type determination unit 125 includes the number of characters, the type, and the format of the character string that the user inputs with the operation device. When the input authentication information is a character string of only 11 digits and includes “090” or “080” at the beginning, the input authentication information is used as a mobile terminal identifier. The character string of the other format is determined to be a normal authentication ID or password. The determination result by the authentication information type determination unit 125 is input to the connection destination selection unit 124.

The connection destination selection unit 124 is a module that determines a connection destination via the communication network 5 in accordance with the type of authentication information input to the authentication interface unit 110. In this embodiment, the connection destination selection unit 124 determines the authentication information type. When the determination result in the unit 125 is acquired and the determination result indicates that the mobile terminal identifier is included in the authentication information input by the user, the connection destination is the authentication proxy server 3, and the determination result is included in the authentication information. If the mobile terminal identifier is not included, the connection destination is the service providing server 4.

The control unit 120 includes a memory (not shown), a cache memory, and the like. The cache memory is, for example, a volatile memory device, and temporarily stores downloaded content data. In addition, the memory is a storage device for writing and storing (main storage) content data when the user downloads the content data and obtains authentication permission, and is realized by a non-volatile memory device, hard disk, etc. can do. The memory may be fixedly incorporated in the information processing terminal, or may be a removable device such as a memory card, or a storage device connected by a USB cable or the like.
(2) Authentication proxy server 3
The authentication proxy server 3 can be composed of a single server device and a plurality of types of server groups such as a Web server and a database server. In this embodiment, the communication proxy server 302, the external authentication unit 304, and the confirmation request Unit 305, external authentication database 301, log history storage unit 307, and authentication result transmission unit 303.

The communication interface 302 is a module that transmits and receives various data as packet data through an IP network such as the communication network 5. In this embodiment, the communication interface 302 is connected to the information processing terminal 1 or the service providing server 4 via the communication interface 302. Authentication information data is received, and authentication permission data is transmitted to the service providing server 4. Further, the communication interface 302 is connected to the radio base station 6 through the communication network 5 and the public network, and can transmit and receive various data to and from the mobile terminal 2 through the radio base station 6. In the embodiment, confirmation request data is transmitted to the mobile terminal 2, and approval data is received from the mobile terminal 2.

The external authentication database 301 is a database device that stores table data T1 and the like in which a telephone number that is a mobile terminal identifier is associated with a form identifier of the information processing terminal 1, an ID that is user information, a password, and a destination address. In accordance with an instruction from the external authentication unit 304, predetermined data is retrieved and output. In this embodiment, the table data T1 is a relational database in which a plurality of table data and relations are mutually formed as shown in FIG. 4, and information on services scheduled to be used by the user in the customer master table T10 related to registered users. The registration service data T11 and the card information table T12 related to the credit card used by the user are related by the relation.

In the customer master table T10, a registered ID unique to each registered member is assigned as a member registration ID for the authentication agency service. Using this registration ID as an index, customer information, a mobile phone number for identity verification, Alternatively, the mobile phone number of the manager (proceeding minors, elderly guardians, etc.) when the procedure is approved is recorded. In the registered service data T11, the URL of the server that is the access destination is registered in advance for each service used by the user as a destination address. Each destination address includes the form ID that is recognized as the access source, and the login time. Necessary user ID, password, and other necessary authentication information are recorded. The destination address is data such as a URL that identifies the service providing server 4 (this authentication processing unit) that performs normal authentication processing. Further, the card information table T12 is data for providing a card folder service, and a plurality of credit cards that can be used by each user are registered, and the user can set a credit card to be used for each service or make a payment. Any credit card can be selected for each procedure.

With these relational structures, in the table data T1, a mobile phone number is linked to one registered user ID (member registration ID for the authentication agency service), and further, it is necessary for login for each service that the user plans to use. User ID, password, destination address, and form identifier. As a result, in the present embodiment, a plurality of services can be associated with the telephone number of one mobile phone, and the external authentication database 301 can be stored by specifying the destination address unique to each service in the information processing terminal 1. By searching, it is possible to identify on the authentication surrogate server 3 side which service providing server provides the authentication process.

The log history storage unit 307 is a storage device that accumulates approval data transmitted from the mobile terminal 2 as log data together with authentication information. Specifically, when the authentication result is output to the authentication result transmission unit 303 by the external authentication unit 304, the same information as the authentication result output to the authentication result transmission unit 303 is also stored in the log history storage unit 307. Duplicated and output, and stored as a history (log) of authentication results in chronological order.

The external authentication unit 304 is a module that confirms whether or not to approve the authentication process to the user through the mobile terminal 2 based on the authentication information received by the communication interface 302. In this embodiment, the external authentication unit 304 A request unit 305 and an external authentication processing unit 306 are provided.

The confirmation request unit 305 obtains authentication information from the information processing terminal 1, makes a confirmation request to the mobile terminal 2 based on the authentication information, and obtains approval data by a user confirmation operation according to the confirmation request. It is a module. Here, the authentication information received by the confirmation request unit 305 includes the telephone number of the mobile terminal 2 transmitted from the information processing terminal 1 and the external confirmation request (user ID, etc.) transmitted from the service providing server 4. It is.

Specifically, the confirmation request unit 305, when the mobile terminal identifier (telephone number) is included in the authentication information input in the authentication interface unit 110 of the information processing terminal 1, the mobile terminal identifier included in the authentication information. Referring to the external authentication database 301 based on the above, the name of the customer who owns the mobile terminal and the service content of the confirmation request are acquired to generate confirmation request data. The confirmation request unit 305 transmits the confirmation request data to the mobile terminal 2 having a destination address corresponding to the mobile terminal identifier, and receives the approval data transmitted from the mobile terminal 2.

The external authentication processing unit 306 is a module that acquires the approval data transmitted from the mobile terminal 2 and performs proxy processing (external authentication) based on the approval data. Judge whether or not to do.

In addition, the external authentication processing unit 306 has a map database 308 in which map information describing a range in which authentication is permitted is stored, and the mobile terminal 2 refers to the map information in the map database 308 during the authentication process. It has a function of collating with the position information data acquired from the mobile terminal 2 to determine whether or not the current position of the mobile terminal 2 is within a predetermined range.

Further, the external authentication processing unit 306 generates authentication result data by collating the external authentication database 301. Here, the authentication result data is data including the acquired approval data, the user ID and password that are information necessary for normal authentication, and the form identifier included in the acquired authentication information. This authentication result data is transmitted to the service providing server 4 according to the destination address.

The authentication result transmission unit 303 is a module that transmits the authentication result data from the external authentication processing unit 306 to the service providing server 4 via the communication network 5. Specifically, the authentication result transmission unit 303 acquires the form identifier or the destination address of the authentication interface unit 110, collates the external authentication database 301 based on the form identifier or the destination address, and obtains the user ID or password that is the authentication result. , Sent as authentication result data to the destination address. In the present embodiment, the authentication result transmission unit 303 also has a function of transmitting an authentication result based on the approval data to the service providing server 4 as external authentication result data.

(3) Mobile terminal 2
The mobile terminal 2 is an information processing terminal having a communication function such as a mobile telephone or a PDA, and includes an input interface 201, an output interface 202, a position information acquisition unit, together with modules necessary for general wireless communication. 203, a control unit 204, and a wireless interface 206.

The wireless interface 206 has a function of executing wireless communication using a mobile communication protocol for performing a call and wireless communication using a data communication protocol such as a wireless LAN. As a function for this data communication, there is a transmission / reception device conforming to IEEE 802.11b for performing wireless LAN connection, and an ESSID that matches the wireless base station 6 is assigned to receive authentication by this system. The data communication function of the wireless interface 206 can be realized by a wireless LAN adapter or the like when the mobile terminal 2 is a mobile computer or a PDA.

The input interface 201 is a device that inputs user operations such as operation buttons, a touch panel, and a jog dial, and the output interface 202 is a device that outputs video and sound, such as a display and a speaker. In this embodiment, as shown in FIG. 6 and the like, the input interface 201 and the output interface 202 display a GUI based on the confirmation request data on the display screen 202a, and whether the user approves with an operation button or the like through this GUI. Confirm whether or not.

The position information acquisition unit 203 is a module that measures the current position of the own device. For example, the position information acquisition unit 203 calculates the coordinates of the current position based on the GPS signal from the communication satellite 7, and the base station identifier of the radio base station 6 From the radio wave condition such as the signal strength from the base station, the mobile terminal 2 itself can acquire the location information of the own device. In addition, the location information acquisition unit 203 detects access points installed in the vicinity, inquires the location of the access point from the AP database installed on the communication network, and predicts the current location of the own device. A function may be provided.

The connection processing unit 205 is a module for connecting to the wireless base station 6 via wireless communication, and an identifier (telephone number, IP address, user ID) for identifying the own device is a wireless base to be connected. Transmit to the station 6 for authentication.

The control unit 204 is an arithmetic processing unit such as a CPU, and is a module that virtually constructs each functional module by executing various programs on the control unit 204. In the present embodiment, the control unit 204 The confirmation operation unit 207 is constructed.

The confirmation operation unit 207 is a module that requests a confirmation operation from the user in response to the confirmation request, and returns approval data to the authentication proxy server 3 in accordance with the confirmation operation by the user. Specifically, the confirmation operation unit 207 displays a confirmation request screen on the display of the output interface 202 according to the confirmation request data transmitted from the confirmation request unit 305. Then, a confirmation operation signal from the input interface 201 is acquired, approval data is generated based on the signal, and the approval data is returned to the confirmation request unit 305.

The confirmation operation unit 207 also has a function of adding the current position of the own device measured by the position information acquisition unit 203 to the approval data and returning the approval data to the confirmation request unit 305.

(4) Service providing server 4
The service providing server 4 is a server device for performing various services, and may be a single device or a plurality of server device groups. The service providing server 4 needs to perform an authentication process when providing the service, and the authentication process is performed by an original authentication system, or is entirely delegated to the authentication proxy server 3 or is independently performed. Various forms can be employed, for example, the normal authentication (main authentication process) by the authentication system and the temporary authentication process by the authentication proxy server 3 are used in combination. In the present embodiment, the normal authentication using an original authentication system and the external authentication processing by the authentication proxy server 3 are used in combination. Specifically, the service providing server 4 includes a communication interface 402, a content transmission unit 404, a main authentication unit 403, a main authentication database 401, and an approval unit 408.

The communication interface 402 is a module that transmits and receives various data as packets via the communication network 5. In this embodiment, authentication information is received from the information processing terminal 1 via the communication interface 402, and the authentication proxy server 3 receives the authentication information. While receiving the authentication result, an external confirmation request is transmitted to the authentication proxy server 3. The communication interface 402 is not limited to communication via the IP network. For example, transmission and reception of fixed-length frame data through the dedicated line 51 to the ATM 1c and the dedicated devices 1d to 1f to which the reader / writer is connected. It also supports data communication by.

The authentication database 401 is a database device that stores table data T2 for storing personal information, authentication information, and settlement information regarding each user. The authentication database 401 also stores an external confirmation list in which a mobile terminal identifier (mobile phone number) for making an external confirmation request in the external authentication process is associated with each user.

The authentication unit 403 is a module that performs authentication processing based on normal authentication information from the information processing terminal 1 and external authentication processing by the authentication proxy server 3 and provides services when these authentication processing is successful. An external confirmation request unit 406 and a main authentication processing unit 407 are provided.

The external confirmation request unit 406 is a module that transmits external confirmation request data to the confirmation request unit 305 of the authentication proxy server 3 based on the authentication information input in the normal authentication process. Here, the normal authentication process is a general authentication process, in which the user ID and password input by the user to the authentication interface unit 110 are directly acquired by the service providing server 4, and based on these user ID and password, This is a process for authenticating whether or not the accessor is the principal. The external confirmation request data is data for requesting execution of a confirmation request to the mobile terminal 2 in the authentication proxy server 3.

Specifically, when acquiring the authentication information input in the normal authentication process, the external confirmation request unit 406 identifies the user from the user ID included in the acquired authentication information, and the authentication database The external confirmation list 401 is collated to determine whether or not the user is a user requiring an external confirmation request. When the user is a user who requires external authentication, external confirmation request data in which the mobile terminal identifier is associated with the form identifier is generated based on the external confirmation list, and this confirmation request data is transmitted to the authentication proxy server 3.

The authentication processing unit 407 is a computer that verifies the legitimacy of an accessor or software having a function thereof, acquires authentication information or an authentication result through the communication network 5, and collates the authentication database 401. This is a module for confirming whether the accessor has the right and whether the accessor is the principal.

In particular, in the present embodiment, the authentication processing unit 407 transmits a normal authentication process for authenticating a user based on an ID and a password, which are authentication information data input through the authentication interface unit 110, and an authentication result transmission unit 303. Based on the authentication processing for authenticating the user based on the authentication result data including the approved data, the external authentication result data including the approval data transmitted from the authentication result transmitting unit 303, and the authentication result of the normal authentication processing Thus, it has three functions: a function for executing external authentication processing for determining whether or not to provide a service.

The approval unit 408 is a module that executes an approval process by a financial institution. In this embodiment, the approval unit 408 collates a user's external confirmation list from the authentication database 401 during the approval process, and based on the external confirmation list. Thus, a limit changing unit 409 for switching the limit of the amount related to the approval process is provided.

The limit amount changing unit 409 has an external confirmation list that is a list of users who require an external confirmation request, and when making a decision, collates the external confirmation list and switches the limit amount of the amount related to the decision processing. In recent years, in order to minimize the damage caused by unintentional transfer procedures due to bank transfer fraud, etc., there is often a limit for the transfer procedures by ATM. This limit setting is effective in minimizing the damage caused by crime, but it does not allow a high transfer even for legitimate purposes, and hinders smooth financial procedures. It has also been pointed out. As will be described later, according to the authentication agency service according to the present embodiment, it is possible to provide a service for preventing a transfer fraud in ATM or the like. Since there is a low possibility of damage caused by fraud, etc., only the user of the service will switch the limit of approval processing to a high amount, giving priority to the smoothness of financial procedures.

The content transmission unit 404 is a module that distributes display information (Web data) that is content information, moving image data, music data, and the like to the information processing terminal 1, and stores information such as HTML documents and images. In accordance with the authentication process from the authentication unit 403, predetermined data is transmitted. Here, the content transmission unit 404 refers to the form identifier included in the authentication information, and transmits the content information to the target information processing terminal 1.

(Authentication agent method)
By operating the mobile authentication proxy system having the above configuration, the mobile authentication proxy method of the present invention can be implemented. FIG. 5 is a flowchart showing the operation of the mobile authentication proxy system according to the present embodiment.

(1) Login authentication at a website Here, for example, when the present invention is applied to user authentication when a user logs in to a membership website in online shopping using a general-purpose computer such as a personal computer. Will be described as an example.

As shown in FIG. 5, first, the user accesses the service providing server 4 on the Internet by using browser software or the like that is activated and executed on the information processing terminal 1 such as a personal computer, and on the browser. A Web site provided by the service providing server 4 is accessed. As a result, a login form 111 a as shown in FIG. 6 is displayed on the display screen 111 of the information processing terminal 1.

The user inputs authentication information to the login form 111a through the authentication interface unit 110 (S101). Here, the authentication information input by the user is a user ID and password that are normal authentication information, or a mobile phone number that is a mobile terminal identifier. In this embodiment, the user has already registered a membership for the Web site, the user ID and password of the Web site are set, and the database 301 is also sent to the authentication proxy server 3. In addition, after identifying the service provided by the service providing server 4, the user ID and password are registered in association with the user's mobile phone number with the URL of the service providing server 4 as the destination address. .

In response to the user's input operation, the authentication information type determination unit 125 of the information processing terminal 1 includes the mobile phone number that identifies the mobile terminal 2 in the information input to the authentication interface unit 110. It is determined whether or not (S102). Specifically, the authentication information type determination unit 125 analyzes the input character string, and if the character string is [090-xxx-xxx-xxx] or the like, includes the mobile terminal identifier. If the character string is a combination of other characters and numbers, it is determined that the mobile terminal identifier is not included. The data input to the authentication interface unit 110 is input to the connection destination selection unit 124.

When the connection destination selection unit 124 determines that the telephone number is not included in the authentication information (“N” in S102), the connection destination selection unit 124 determines the transmission destination to the service providing server 4 and transmits the authentication information. Then, the authentication unit 403 on the service providing server 4 side receives the authentication information (S103), and performs a normal authentication process based on the authentication information (S112). If the authentication process in step S112 is valid, authentication is permitted (S113), and the authentication permission data is input to the execution process determination unit 122 of the information processing terminal 1 through the communication network 5 to complete the authentication procedure ( S114). As a result of the success of this authentication procedure, the user can receive services from the service providing server 4 on the Web site.

On the other hand, if the authentication information includes a telephone number in step S102 (“Y” in S102), the connection destination selection unit 124 determines the transmission destination as the authentication proxy server 3, and the input mobile phone Send the number as authentication information. At this time, the connection destination selection unit 124 transmits, as authentication information, the form identifier of the login form 111a and the URL (destination address) of the service providing server 4 that is the login destination, together with the input mobile phone number. To do.

Then, the external authentication unit 304 on the authentication proxy server 3 side acquires the authentication information (including the mobile phone number, form identifier, and destination address) (S104), and collates the external authentication database 301 based on the authentication information (S104). S105). Specifically, after identifying the user based on the mobile phone number, a confirmation request is made to the mobile terminal 2 corresponding to the movement identifier included in the authentication information (S106).

The mobile terminal 2 receives the confirmation request data from the authentication proxy server 3 (S107), displays the GUI according to the confirmation request on the output interface 202, and requests a confirmation operation from the user. In response to this, the user performs a confirmation operation through the input interface 201 (S108). The user performs an operation of approving the procedure if the confirmation request is valid, and performs an operation of rejecting the approval when the confirmation request is not memorized. Information on the confirmation operation input in response to the confirmation operation by the user is input to the confirmation operation unit 207. The confirmation operation unit 207 generates approval data from this information, and uses the approval data as the confirmation request unit of the authentication proxy server 3. It returns to 305 (S109). As the approval data, a message to that effect is transmitted when the user confirms that the confirmation request is valid, and a message to that effect is transmitted when the approval is rejected. At this time, the confirmation operation unit 207 adds the current position and the current time of the own device measured by the position information acquisition unit 203 to the approval data regardless of whether approval is possible.

The confirmation request unit 305 of the authentication proxy server 3 acquires the approval data from the mobile terminal 2 (S110), and the external authentication processing unit 306 executes an authentication process based on the approval data. Specifically, when the user approves the confirmation request, authentication result data including a user ID and password registered in advance in the database is generated, and this authentication result data is sent from the authentication result transmission unit 303. The data is transmitted to the authentication processing unit 407 of the service providing server 4 through the communication network 5 (S111).

On the other hand, when the user rejects the approval, the ID and password are not transmitted, and a notification that the approval is rejected is transmitted to the service providing server 4. In addition, as a process when this user refuses approval, in addition to notifying the service providing server 4 to that effect, the procedure in the information processing terminal 1 is forcibly terminated, or the procedure operation in the information processing terminal 1 is provisionally performed. Various measures are conceivable, such as executing emergency processing for unauthorized access on the service providing server 4 side.

Next, the authentication processing unit 407 receives the authentication result data, performs the authentication process for determining whether or not to provide the service from the user ID and password included in the authentication result data (S112), and if the authentication information is valid. Then, access permission is given to the user (S113), and the authentication permission data is input to the execution process determination unit 122 of the information processing terminal 1 through the communication network 5, and the authentication procedure is completed (S114).

In this way, when the present invention is applied to login authentication on a website, in addition to the normal authentication process uniquely performed by the website, the authentication proxy server 3 performs identity verification of the person having the mobile terminal. And the security of the authentication process when accessing the service can be improved.

(2) Mobile Financial Approval Service Next, the case where the present invention is applied to mobile financial approval will be described. Here, for example, when a salesperson such as an automobile sales sells a product, the present invention can support processing such as input of authentication information such as a credit card at the time of payment by a customer, and identity verification. FIG. 7 is a flowchart illustrating the case where the mobile authentication agency system and method of the present invention is applied to a financial approval service.

This financial approval service uses a mobile information processing terminal 1 used by a salesperson when a user (purchaser) who purchases a product from a salesperson who sells the product uses a credit card for approval. In this service, the sales representative inputs the purchaser's mobile phone number as authentication information, and the purchase operation of the purchaser's mobile terminal is requested. After confirming the identity, the service is completed. Also in this embodiment, the user who is the purchaser enters the authentication proxy server 3 with his / her mobile phone number and credit card authentication information (card number, user name, expiration date, other security information). Are registered in advance.

As shown in FIG. 7, first, a user purchases a car as a product from a sales person in charge of car sales (S201). When the user (purchaser) selects bank transfer or credit card payment as the purchase method, the sales representative accesses the service providing server 4 which is an approval server by using his / her information processing terminal 1 and Visit the customer approval page for. Then, the authentication interface unit 110 is displayed with an approval input screen for an approval page (S202), and the purchaser is requested to input the mobile phone number on the settlement screen (S203). In this case, the sales representative requests the purchaser to input the mobile phone number. However, the sales representative may input the mobile phone number after hearing from the purchaser. In addition, the information processing terminal 1 of the sales staff may be provided with a camera function having a barcode reader or an image analysis function so as to read a pre-coded telephone number.

The purchaser inputs his own telephone number on the input screen for approval (S204). The authentication information that is the input mobile phone number is transmitted to the authentication proxy server 3, and the confirmation requesting unit 305 queries the external authentication database 301 based on the authentication information (S205), and searches for the card information of the purchaser. At the same time, confirmation request data is generated and a confirmation request is transmitted to the purchaser's mobile terminal 2 (S206).

The mobile terminal 2 owned by the purchaser receives the confirmation request data from the authentication proxy server 3 (S207), displays the confirmation request information on the display screen 202a of the mobile terminal 2 in response to the confirmation request, and Request confirmation. Here, as shown in FIG. 8 (a), the confirmation request information confirms whether or not the product price can be paid or transferred to a specific credit card company or a financial institution such as a bank. Display information to be displayed. Then, the purchaser performs a confirmation operation on the confirmation request in the mobile terminal 2 through the input interface 201 (S208).

At this time, if the purchaser has registered a plurality of credit cards, a card folder screen as shown in FIG. 8B may be displayed so that an arbitrary card can be selected. In this case, the authentication information of the selected credit card is read from the table data T12 and transmitted to the service providing server 4. In addition, when the mobile terminal 2 operates in response to the confirmation request, the user (purchaser) is requested to input the minimum necessary security information (for example, the last four digits of the credit number or the security code on the back of the card). May be requested.

Information on the confirmation operation input in response to the confirmation operation by the user is input to the confirmation operation unit 207. The confirmation operation unit 207 generates this information as approval data, and this approval data is used as the confirmation request unit of the authentication proxy server 3. It returns to 305 (S209). As the approval data, a message to that effect is transmitted when the user confirms that the confirmation request is valid, and a message to that effect is transmitted when the approval is rejected. At this time, the confirmation operation unit 207 adds the current position and the current time of the own device measured by the position information acquisition unit 203 to the approval data regardless of whether approval is possible.

The confirmation request unit 305 of the authentication proxy server 3 acquires the approval data from the mobile terminal 2 (S210), and the external authentication processing unit 306 executes an authentication process based on the approval data (S211). Specifically, when the user approves the confirmation request, authentication result data including the card information and bank account information selected by the user is generated, and the authentication result data is transmitted from the authentication result transmission unit 303 to the communication network. 5 is transmitted to the authentication processing unit 407 of the service providing server 4 (S212). On the other hand, when the user rejects the approval, the card information is not transmitted, and a notification that the approval is rejected is transmitted to the service providing server 4.

Next, the authentication processing unit 407 receives the authentication result data, performs the authentication process for determining whether or not to provide the service from the user ID and password included in the authentication result data (S213), and if the authentication information is valid. Then, access permission is given to the user (S214), and the authentication permission data is input to the financial institution through the communication network 5, and the approval process is completed (S214).

As described above, by applying the mobile authentication agency system and method to the financial approval service, the user can complete the approval only by inputting the telephone number of the mobile terminal 2 when inputting the authentication information. Therefore, the approval can be completed without the knowledge of the bank card ID and password and the credit card number being known to others.

(3) Delivery / Reception Service A delivery / reception service to which the mobile authentication agency system and method of the present invention as described above is applied will be described below. FIG. 9 is a flowchart illustrating the case where the mobile authentication proxy system and method of the present invention are applied to a delivery receiving service. In this delivery receipt service, when a user who purchases a product through mail order or the like asks the delivery company to deliver the product, the delivery company confirms the identity of the user and delivers the product. Request confirmation from the user. In this embodiment as well, the user who is the purchaser enters the authentication agent server 3 with his / her mobile phone number, transaction number and credit card authentication information (card number, user name, valid It is assumed that the time limit and other security information are registered in advance.

As shown in FIG. 9, when a user first purchases a product on an Internet website or the like (S301, S302) and selects delivery to home as a product receiving method, the seller side passes through a delivery company. The product is shipped (S303). The delivery company that has received the request delivers the product to the user's home that is the delivery destination (S304, S305). Then, when delivering the merchandise to the delivery recipient, the information processing terminal 1 owned by the delivery company is requested to input a mobile phone number for identity verification as identity verification processing (S306). In this case, the delivery company requests the recipient to input the mobile phone number. However, the delivery company itself may input it after hearing from the recipient. In addition, the information processing terminal 1 of the delivery company is provided with a camera function including a barcode reader and an image analysis function, and a barcode or QR code in which a telephone number is coded is described in the delivery slip of the delivery item. You may make it read the telephone number etc. which were encoded with the barcode reader.

Then, the user who is the recipient inputs the telephone number owned by the user on the input screen displayed on the information processing terminal 1 (S307). The authentication information that is the input mobile phone number is transmitted to the authentication proxy server 3, and the confirmation requesting unit 305 queries the external authentication database 301 based on the authentication information (S308), and searches for the card information of the purchaser. At the same time, confirmation request data is generated and a confirmation request is transmitted to the recipient's mobile terminal 2 (S309).

The mobile terminal 2 owned by the recipient user receives the confirmation request data (S310), the confirmation request information as shown in FIG. 10 is displayed on the display screen 202a, and a confirmation operation is requested from the user. To do. The user confirms the content of the confirmation request displayed on the display screen 202a of the mobile terminal 2 through the input interface 201, and performs a confirmation operation on the confirmation request (S311). At this time, when a payment procedure is required at the time of receiving a delivery item such as cash on delivery, the card folder screen may be accessed, an arbitrary card may be selected, and the payment procedure may be performed simultaneously. In this case, the authentication information of the selected credit card is read out and transmitted to the service providing server 4. In addition, when the mobile terminal 2 operates in response to the confirmation request, the user (purchaser) is requested to input the minimum necessary security information (for example, the last four digits of the credit number or the security code on the back of the card). May be requested.

Information on the confirmation operation input in response to the confirmation operation by the user is input to the confirmation operation unit 207. The confirmation operation unit 207 generates approval data based on the information on the confirmation operation, and uses the approval data as an authentication agent. It returns to the confirmation request unit 305 of the server 3 (S312). As the approval data, a message to that effect is transmitted when the user confirms that the confirmation request is valid, and a message to that effect is transmitted when the approval is rejected. At this time, the confirmation operation unit 207 adds the current position and the current time of the own device measured by the position information acquisition unit 203 to the approval data regardless of whether approval is possible.

The confirmation request unit 305 of the authentication proxy server 3 acquires the approval data from the mobile terminal 2 (S313), and the external authentication processing unit 306 executes an authentication process based on the approval data (S314). Specifically, when the user approves the confirmation request, authentication result data including a user ID and password is generated, and this authentication result data is transmitted from the authentication result transmission unit 303 to the service providing server via the communication network 5. 4 to the main authentication processing unit 407 (S315). The authentication processing unit 407 receives the authentication result data and presents to the delivery person that the recipient has approved. On the other hand, when the user rejects the approval, a notification that the approval is rejected is transmitted to the service providing server 4. This approval may be rejected because the entered mobile phone number is incorrect or false, and a confirmation request is sent to a third-party mobile terminal that is not there. The information indicating that the approval has been rejected is presented to the information processing terminal 1 of the delivery person.

Next, the authentication processing unit 407 receives the authentication result data, and determines whether or not to deliver the product in response to the service availability notification included in the authentication result data (S316). Specifically, if the authentication information is valid, the authentication permission data is input to the information processing terminal 1 of the delivery company through the communication network 5, the identity verification by the delivery company is completed (S317), and the user selects the product. Can receive.

In this way, by applying the mobile authentication agency system and method to the delivery receipt service, it is possible to confirm that the recipient is the same person as the recipient at the time of receipt. The delivery of the product is prevented, and the delivery agent can deliver the product to the user himself even if the user is not acquainted.

(Tampering prevention service at ATM)
Next, an unauthorized operation prevention service to which the mobile authentication agent system and method of the present invention is applied will be described below. FIG. 11 is a flowchart illustrating a case where the mobile authentication agent system and method of the present invention is applied to an unauthorized operation prevention service in ATM. This unauthorized operation prevention service in ATM is used when a user who owns a cash card of a financial institution such as a bank is an elderly person or a child, and when the user makes a transfer of money at the ATM, the guardian of the user This is a service that makes a request for confirmation to prevent so-called wire fraud. Here, it is assumed that the user is an elderly person and the user is listed on the external confirmation list as a user requiring external authentication.

As shown in FIG. 11, first, a user reads a cash card and inputs a password, which is authentication information, in accordance with a normal operation in order to perform a transfer process or the like in an ATM machine such as a bank (S401). Here, the connection destination selection unit 124 transmits the authentication information to the service providing server 4 that the bank uniquely has, and the external confirmation request unit 406 of the authentication unit 403 converts the input authentication information into the normal authentication. Obtained as information (S402).

The external confirmation request unit 406 collates the external confirmation list of the user who requires the external confirmation request from the authentication database 401 (S403), and the mobile terminal 2 owned by the guardian associated with the normal authentication information. A mobile phone number is searched (S404). Then, the mobile terminal identifier (guardian's mobile phone number) associated with the normal authentication information and the form identifier are generated as external confirmation request data in the external confirmation list, and the external confirmation request data is transmitted to the authentication proxy server 3. (S405).

The confirmation request unit 305 of the authentication proxy server 3 receives the external confirmation request data (S407), generates confirmation request data, and transmits the confirmation request data to the guardian's mobile terminal 2 (S407). . In the mobile terminal 2 on the guardian side, the confirmation request data is received and a confirmation screen as shown in FIG. 12 is displayed, and the guardian confirms whether or not to approve the confirmation request information. This is performed (S408). Here, in addition to the amount of money to be withdrawn or transferred, the position information of the ATM machine can be displayed in the confirmation information, and the guardian can determine the confirmation operation including this information.

When the guardian performs a confirmation operation, the confirmation operation unit 207 generates approval data based on the confirmation operation, and returns the approval data to the confirmation request unit 305 of the authentication proxy server 3 (S409). As the approval data, a message to that effect is transmitted when the user confirms that the confirmation request is valid, and a message to that effect is transmitted when the approval is rejected. At this time, the confirmation operation unit 207 adds the current position and the current time of the own device measured by the position information acquisition unit 203 to the approval data regardless of whether approval is possible.

The confirmation request unit 305 of the authentication proxy server 3 acquires the approval data from the mobile terminal 2 (S410), and the external authentication processing unit 306 executes the authentication process based on the approval data (S411). Specifically, when the guardian approves the confirmation request, external authentication result data for notifying that is generated. Then, the external authentication result data is transmitted from the authentication result transmitting unit 303 to the main authentication processing unit 407 of the service providing server 4 through the communication network 5 (S412). On the other hand, when the guardian rejects the approval, a notification that the approval is rejected is transmitted to the service providing server 4.

Next, the authentication processing unit 407 receives the authentication result data (S413), and performs the authentication process for determining whether to provide the service based on the external authentication result including the approval data and the authentication result of the normal authentication process. Do. If the authentication information is valid, authentication is permitted (S414), and the authentication permission data is input to the ATM via the communication network 5 to enable the ATM machine procedure (S415). On the other hand, if the administrator's confirmation operation is data that is not approved, the transaction of the ATM machine ends.

In this way, by applying the mobile authentication agency system and method to the ATM service, the user's administrator can confirm the execution of the ATM processing and can prevent a transfer fraud and the like. .

(4) Credit financial approval service
Next, a description will be given of a case where the present invention is applied to credit financial approval applying the mobile authentication agency system and method of the present invention. Here, for example, when a user receives a service or purchases a product at a store such as a restaurant or a shop and makes a card approval using a credit card, the user enters a password and confirms the identity. Processing can be supported by the present invention. FIG. 13 is a flowchart when the authentication agency system according to the present embodiment is applied to a credit approval service in a store, and FIG. 14 shows a display screen (payment confirmation screen) of the mobile terminal according to the present embodiment. It is explanatory drawing.

This credit approval service is for exclusive use with a reader / writer installed in a store when a user who sells the product or purchases a product and makes a payment with a credit card at a store that provides the service. By reading the credit card information with the devices 1d to 1f, a confirmation operation is required for the purchaser's mobile terminal. By confirming the identity, the input process such as password or signature is not performed, and the approval is made. It is a service to be completed.

More specifically, as shown in FIG. 13, first, a user purchases a product or receives a service at a store (S501). When the user (purchaser) selects credit card payment as the purchase method, the user presents the credit card (S502), and the store salesperson reads the information on the credit card using a dedicated reading device ( S503). The read credit card authentication information is transmitted to the financial institution which is the service providing server 4 (S504).

Here, when acquiring the authentication information read from the credit card (S505), the external confirmation requesting unit 406 identifies the user from the credit card number included in the acquired authentication information, The external confirmation list in the authentication database 401 is collated (S506), and it is determined whether or not the user is a user who requires an external confirmation request (S507). When the user does not require external authentication (“N” in S507), a password input request message is displayed on the display screen 111 of the store-side reading device, and the user is requested to input the password. (S508). The user inputs his / her password, and this password is transmitted to the authentication processing unit 407. Next, the authentication processing unit 407 receives the password and performs the authentication process for determining whether to provide the service from the credit card number and the password (S519). If the authentication information is valid, the user is permitted access. Is made (S520), and the approval process is completed (S521).

On the other hand, if the user is a user who requires external authentication (“Y” in S507), external confirmation request data in which the mobile terminal identifier is associated with the form identifier is generated based on the external confirmation list, and this confirmation request data is generated. Is transmitted to the authentication proxy server 3 (S509).

The confirmation request unit 305 receives the confirmation request data (S510), queries the external authentication database 301 based on the authentication information, searches the purchaser's card information, generates confirmation request data, and moves the purchaser. A confirmation request is transmitted to the terminal 2 (S511).

The mobile terminal 2 owned by the purchaser receives the confirmation request data from the authentication proxy server 3 (S512), displays confirmation request information on the display screen 202a of the mobile terminal 2 in response to the confirmation request, and Request confirmation. Here, as shown in FIG. 14, the confirmation request information is display information for confirming whether or not the payment process for the commodity price can be executed with respect to a financial institution of a specific credit card company, for example. Then, the purchaser performs a confirmation operation on the confirmation request in the mobile terminal 2 through the input interface 201 (S513).

Information on the confirmation operation input in response to the confirmation operation by the user is input to the confirmation operation unit 207. The confirmation operation unit 207 generates this information as approval data, and this approval data is used as the confirmation request unit of the authentication proxy server 3. It returns to 305 (S514). As the approval data, a message to that effect is transmitted when the user confirms that the confirmation request is valid, and a message to that effect is transmitted when the approval is rejected. At this time, the confirmation operation unit 207 adds the current position and the current time of the own device measured by the position information acquisition unit 203 to the approval data regardless of whether approval is possible.

The confirmation request unit 305 of the authentication proxy server 3 acquires the approval data from the mobile terminal 2 (S515), and the external authentication processing unit 306 executes the authentication process based on the approval data (S516). Specifically, when the user approves the confirmation request, authentication result data including a credit card ID and password is generated, and this authentication result data is transmitted from the authentication result transmission unit 303 through the communication network 5. This is transmitted to the authentication processing unit 407 of the service providing server 4 (S517). On the other hand, when the user rejects the approval, the card information is not transmitted, and a notification that the approval is rejected is transmitted to the service providing server 4.

Next, the authentication processing unit 407 receives the authentication result data, performs the authentication process for determining whether or not to provide the service from the user ID and password included in the authentication result data (S519), and if the authentication information is valid. Then, access permission is given to the user (S520), and the authentication permission data is input to the financial institution through the communication network 5, and the approval process is completed (S521).

At this time, the result of the payment process is transmitted to the information processing terminal 1, and the information processing terminal 1 receives the result of the payment process (S522), and displays on the display screen 111 of the information processing terminal 1 according to the result of the payment process. The result of the settlement process is displayed (S523). As a result of this settlement process, a message input by the user is valid and the approval is completed. When the approval is completed, the password is invalid. When the approval is completed, the user receives a product (S524).

As described above, by applying the mobile authentication agency system and method to the credit approval service, the user does not need to input a password, and the approval can be completed only by the confirmation operation by the mobile terminal 2. In the approval process, the approval can be completed without any other person knowing the password of the credit card.

(Function and effect)
According to the present embodiment, when the authentication operation is performed on the information processing terminal 1, the confirmation request unit 305 notifies the mobile terminal 2 owned by the user himself / herself whether authentication is permitted or not. Since the user himself / herself can determine whether or not authentication is possible, security can be improved and safe authentication can be performed.

In addition, according to the present embodiment, if an operation of inputting a mobile phone number or the like to receive a service with respect to the information processing terminal 1 is performed, the next operation is authenticated only by a confirmation operation. It is possible to receive services by simplifying.

Furthermore, according to the present embodiment, since the confirmation request can be transmitted from the authentication result transmission unit 303 to any mobile terminal, for example, a user who inputs authentication information in the information processing terminal 1 and the mobile terminal The present invention can be used even when the user who performs the confirmation operation in step 2 is not the same person. For example, even if a child or elderly person who is a user makes a transfer by ATM as in the above-described embodiment, a confirmation request is notified to the guardian of the user, so the withdrawal process is performed on the guardian side. It is possible to decide whether or not it is possible and prevent excessive deductions. Thereby, the diversity of service can be aimed at, such as being able to respond to the service system which prevents a transfer fraud etc.

Further, in the present embodiment, it is determined whether or not the mobile terminal identifier that identifies the predetermined mobile terminal 2 is included in the authentication information that is arranged on the communication network 5 and input to the authentication interface unit 110. The authentication information type determination unit 125, and the confirmation request unit 305 makes a confirmation request to the mobile terminal 2 when the authentication information type determination unit 125 determines that the mobile terminal identifier is included. Since the notification destination of the authentication information can be changed according to the determination result of the authentication information type determination unit 125, the system according to the present invention can be used in combination with a security system that inputs an ID and password similar to the conventional one. it can.

Further, in the present embodiment, the mobile terminal 2 has a position information acquisition unit 203 that measures the current position of the own device, and the confirmation operation unit 207 includes the current position of the own device measured by the position information acquisition unit 203. The position is added to the approval data, and the approval data is returned to the confirmation request unit 305. The external authentication processing unit 306 has map information describing a range in which the authentication is permitted. Since it is determined whether or not the current location of the mobile terminal falls within a predetermined range, authentication is performed by linking the location information of the mobile terminal held by the user in addition to the user authentication information and approval data. Since it is possible to control whether or not authentication for service provision is possible, the security of the authentication system using the mobile terminal can be increased.

Furthermore, in the present embodiment, the authentication interface unit 110 of the information terminal terminal 1 has a function of adding its own form identifier to the authentication information. Therefore, the authentication proxy server 3 acquires the form identifier of the authentication interface unit 110. The authentication result can be transmitted to the destination address obtained by collating the external authentication database 301 based on the form identifier. As a result, according to the present embodiment, the authentication processing unit 407 that is the transmission destination of the authentication result can be specified. If the authentication processing is performed once in the information processing terminal 1, the authentication processing is associated with the authentication processing. Using the authentication information, the authentication procedure for other Web services can be omitted, and the user can simply perform authentication.

Further, in the present embodiment, as in the bank ATM described above, the user authentication is performed as a normal authentication process by an authentication system unique to ATM, and when the authentication of the normal authentication process is successful, a confirmation request to the mobile terminal 2 is further requested. Is transmitted to the authentication proxy server 3 as an external confirmation request, and an approval procedure through the mobile terminal 2 can be requested.

Thereby, according to this embodiment, in bank ATM etc., the decision | availability of service provision is determined based on the external authentication result transmitted from the authentication agency server 3, and the authentication result of an original normal authentication process. Yes, even if the operator of the information processing terminal 1 is, for example, a child or an elderly person, since the external confirmation request is notified to the guardian who is the external confirmation request destination, Can prevent unintentional transfers. Thereby, the diversity of service can be aimed at, such as being able to respond to the service system which prevents a transfer fraud etc.

Furthermore, in the present embodiment, when the service providing server 4 has an approval unit 408 that executes an approval process by a financial institution, an external confirmation list of a user who requires an external confirmation request is provided, and the limit change unit 409 In the approval process, the approval unit 408 collates the user's external confirmation list, and switches the limit amount for the approval process based on the external confirmation list. Since the rate of incidents and accidents can be reduced by introducing the authentication agency service according to this embodiment, users of this service are listed on the external confirmation list. The change unit 409 can switch the limit amount, for example, by increasing the limit amount of the approval process, thereby improving the convenience and safety of the user and smoothing the approval process for the financial institution.

In the present embodiment, as in the credit settlement described above, a normal credit settlement process using a credit card at a store also performs a confirmation request to the mobile terminal 2 as an external confirmation request, whereby a password or signature The input process such as the above can be omitted, and in the approval process, the credit card password is not known to others and the approval can be completed.

[Second Embodiment]
Next, a second embodiment of the present invention will be described. In the first embodiment, the confirmation request process is executed by the authentication proxy server and the authentication process is executed by the service providing server. However, in the present embodiment, the confirmation request process and the authentication process are executed by the authentication proxy server. An example will be described. FIG. 15 is a conceptual diagram showing the overall configuration of the authentication agent system according to the present embodiment. In the present embodiment, the same components as those in the first embodiment described above are denoted by the same reference numerals, and the functions and the like are the same unless otherwise specified, and the description thereof is omitted.

(Overall configuration of authentication agency system)
As shown in FIG. 15, in the present embodiment, on the communication network 5, the information processing terminal 1 (1a to 1f), the authentication proxy server 3 that performs the authentication proxy process and the main authentication process, the radio base station 6, The mobile terminal 2 capable of wireless communication through the wireless base station 6 or the communication satellite 7 is provided. In particular, in this embodiment, the authentication proxy server 3 is connected with an approval unit 500 that executes a settlement process. ing.

In this embodiment, the information processing terminal 1 (1a to 1f) is a user terminal having a calculation processing function by a CPU and a communication processing function by a communication interface. For example, a general-purpose computer such as a personal computer, an ATM, This is a dedicated device that specializes functions such as a reader / writer. In the present embodiment, the dedicated devices 1d to 1f provided with ATM (1c) and a reader / writer are connected to the communication network 5.

The authentication proxy server 3 is a server device that is arranged on the communication network 5 and centrally manages the authentication proxy for the user, and executes processing related to normal authentication and authentication proxy. Also in this embodiment, the authentication proxy server 3 can be composed of a plurality of types of server groups such as a Web server and a database server in addition to a single server device.

(Internal structure of each device)
Next, the internal structure of each device constituting the above-described authentication proxy system will be described. FIG. 16 is a block diagram illustrating an internal configuration of an information processing terminal, a mobile terminal, an approval unit, and an authentication server that constitute an authentication proxy service according to the present embodiment.

(1) Information processing terminal 1
The information processing terminal 1 includes a form identifier adding unit 114, an application execution unit 123, a content acquisition unit 121, and an execution process determination unit 122.

The form identifier adding unit 114 acquires a form identifier set to specify an authentication interface unit that is a target of user operation, and adds the acquired form identifier to authentication information input through the operation device interface 113. Authentication information to which the form identifier is added is transmitted to the application execution unit 123.

The application execution unit 123 is a module that executes an application such as a general OS, browser software, or a media viewing application. In this embodiment, the application execution unit 123 is transmitted from the authentication interface 110 as shown in FIG. The authentication information is distributed to the authentication proxy server 3 via the communication interface 101 without determining the type of the authentication information.

The content acquisition unit 121 is a module that receives content data such as HTML from the authentication proxy server 3 through the communication network 5, and the content data downloaded by the content acquisition unit 121 is video / audio by the application execution unit 123. The signal is converted into a signal and output from the display screen 111 or the speaker through the output interface 115.

The execution process determination unit 122 is a module that determines whether or not a condition related to the execution of content data is satisfied and restricts execution of the application by the application execution unit 123. In the present embodiment, the condition determined by the execution process determination unit 122 is an authentication result transmitted from the authentication proxy server 3, and the execution of the application is restricted based on the authentication result.

(2) Authentication proxy server 3
The authentication proxy server 3 includes an authentication unit 312, an authentication database 310, an authentication information type determination unit 315, a connection destination selection unit 316, a content transmission unit 309, and a log history storage unit 307.

The authentication information type determination unit 315 is a module that determines whether or not the authentication information transmitted from the information processing terminal 1 includes a mobile terminal identifier that identifies a predetermined mobile terminal 2. Specifically, the mobile terminal identifier in the present embodiment is a telephone number that identifies the mobile terminal that performs the confirmation operation, and the authentication information type determination unit 315 includes the number of characters, the type, and the format of the character string input by the user on the operation device. And the input authentication information is a character string of only 11 digits and includes "090" or "080" at the beginning, the input authentication information is set as a mobile terminal identifier. The character string of the other format is determined to be a normal authentication ID or password. The determination result by the authentication information type determination unit 315 is input to the connection destination selection unit 316.

The connection destination selection unit 316 is a module that determines a connection destination according to the type of received authentication information. In this embodiment, the connection destination selection unit 316 acquires the determination result in the authentication information type determination unit 315, and the determination result is When the mobile terminal identifier is included in the authentication information input by the user, the connection destination is the confirmation request unit 313, and when the determination result indicates that the mobile terminal identifier is not included in the authentication information The connection destination is an authentication processing unit 314.

The authentication unit 312 performs an authentication process based on normal authentication information from the information processing terminal 1 and a confirmation request to the mobile terminal 2 and an authentication process based on approval data by a user confirmation operation corresponding to the confirmation request. A module that provides a service when these authentication processes are successful, and includes a confirmation request unit 313 and an authentication processing unit 314.

The confirmation request unit 313 obtains authentication information from the information processing terminal 1, makes a confirmation request to the mobile terminal 2 based on the authentication information, and obtains approval data by a user confirmation operation corresponding to the confirmation request. It is a module.

Specifically, the confirmation request unit 313 refers to the authentication database 310 based on the mobile terminal identifier included in the authentication information transmitted from the connection destination selection unit 316, and confirms the name of the customer who owns the mobile terminal, the confirmation request Acquire the service contents of and generate confirmation request data. Then, the confirmation request unit 313 transmits the confirmation request data to the mobile terminal 2 having a destination address corresponding to the mobile terminal identifier. Further, the confirmation request unit 313 generates confirmation request data in response to the confirmation request transmitted from the authentication processing unit 314, and sends the confirmation request data to the mobile terminal 2 having the destination address corresponding to the mobile terminal identifier. Send confirmation request data.

The authentication processing unit 314 is a computer that verifies the legitimacy of an accessor or software having a function thereof. The authentication processing unit 314 acquires authentication information or approval data through the communication network 5, and accesses the authentication database 310 by checking the authentication database 310. This module confirms whether the user has the right and whether the accessor is the person himself / herself.

In particular, in the present embodiment, the authentication unit 312 is input to the authentication unit 312 through the authentication interface unit 110 and the normal authentication process for authenticating the user based on the ID and password that are the authentication information data input through the authentication interface unit 110. Based on the mobile terminal identifier that is authentication information data, the mobile terminal 2 is requested for approval data, and based on this approval data, an authentication process for authenticating the user, and the approval data transmitted from the mobile terminal 2 And a function of executing a double authentication process for determining whether or not to provide a service based on the authentication result of the normal authentication process.

Here, the normal authentication process refers to acquiring the user ID and password input by the user to the authentication interface unit 110, checking the authentication database 310 based on these user ID and password, and whether or not the accessor is the principal. This is a process of authenticating. The authentication process based on the approval data is a process for acquiring the approval data generated by the confirmation operation according to the confirmation request data and authenticating whether or not the access is the person based on the approval data. is there.

Furthermore, the double authentication process is a process for executing a normal authentication process and an authentication process based on the approval data. Specifically, in the double authentication process, when the authentication processing unit 314 acquires the authentication information input in the normal authentication process, the user is identified from the user ID included in the acquired authentication information, and the user Then, the confirmation list in the authentication database 310 is collated to determine whether or not the user is a user requiring a confirmation request. When the user is a user who needs a confirmation request, confirmation request data in which the mobile terminal identifier is associated with the form identifier is generated based on the confirmation list, and the confirmation request data is transmitted to the confirmation request unit 313. The confirmation request unit 313 makes a confirmation request to the mobile terminal 2 based on the confirmation request data, and the authentication processing unit 314 receives approval data for the confirmation request. The confirmation request unit 313 executes authentication processing based on the approval data transmitted from the mobile terminal 2 and also performs normal authentication processing based on the user ID and password.

The authentication database 310 includes table data T1 in which the form identifier of the information processing terminal 1 and the user information ID, password, and destination address are associated with a telephone number that is a mobile terminal identifier, personal information about each user, authentication The database device stores table data T2 and the like for storing information and settlement information, and searches for and outputs predetermined data in accordance with an instruction from the authentication unit 312. Also in the present embodiment, the table data T1 is a relational database in which a plurality of table data and relations are mutually formed as shown in FIG. 4, and the service scheduled to be used by the user in the customer master table T10 related to registered users. The registration service data T11, which is information on the credit card, and the card information table T12 related to the credit card used by the user are related by a relation.

The content transmission unit 309 is a module that distributes display information (Web data) that is content information, moving image data, music data, and the like to the information processing terminal 1, accumulates information such as HTML documents and images, and performs authentication. Predetermined data is transmitted according to the authentication process from the unit 312. Here, the content transmission unit 309 refers to the form identifier included in the authentication information, and transmits the content information to the target information processing terminal 1.

The log history storage unit 307 is a storage device that accumulates approval data transmitted from the mobile terminal 2 as log data together with authentication information. Specifically, when the authentication process is executed by the authentication unit 312, the same information as the authentication result output to the content transmission unit 309 is copied and output to the log history storage unit 307, and the authentication result history (Log) is stored in chronological order.

(3) Approval Unit The approval unit 500 is a general server device that can be accessed from the authentication unit 312 of the authentication proxy server 3, and has a function of executing an approval process by a financial institution. In the present embodiment, the approval unit 500 collates a user confirmation list from the authentication database 310 during the approval process performed by the authentication unit 312, and changes the limit amount for switching the amount limit for the approval process based on the confirmation list. Part 501. The limit amount changing unit 501 has a confirmation list that is a list of users requiring a confirmation request. When making a decision, the limit amount changing unit 501 checks the confirmation list and switches a limit amount for the decision process.

(Action / Effect)
According to such an embodiment, the authentication information type is determined on the authentication proxy server 3 side, and the information processing terminal 1 transmits the authentication information type to the authentication proxy server 3 side without determining the type of authentication information input. Since the authentication result is returned, the processing in the information processing terminal 1 can be reduced, and the apparatus can be reduced in size and weight.

Also, since the authentication request server 3 executes the confirmation request process and the main authentication process, it is possible to unify the apparatuses that execute the authentication process, thereby reducing the number of parts and collecting information.

D1 ... Authentication information data D2 ... Normal authentication information data D3 ... Confirmation request data D4 ... Authorization data D5 ... Authentication result data D6 ... External confirmation request data T1, T2 ... Table data 1 (1a to 1f) ... Information processing terminal 2 ... Movement Terminal 3 ... Authentication proxy server 4 ... Service providing server 5 ... Communication network 6 ... Wireless base station 7 ... Communication satellite 8 ... Gateway device 51 ... Dedicated line 101 ... Communication interface 110 ... Authentication interface unit 111 ... Display screen 111a ... Login form DESCRIPTION OF SYMBOLS 112 ... Operation signal detection part 113 ... Operation device interface 114 ... Form identifier addition part 115 ... Output interface 120 ... Control part 121 ... Content acquisition part 122 ... Execution process determination part 123 ... Application execution part 124 ... Connection destination selection part 12 ... Authentication information type determination unit 126 ... Output signal generation unit 201 ... Input interface 202 ... Output interface 202a ... Display screen 203 ... Position information acquisition unit 204 ... Control unit 205 ... Connection processing unit 206 ... Wireless interface 207 ... Confirmation operation unit 301 ... External authentication database 302 ... Communication interface 303 ... Authentication result transmission unit 304 ... External authentication unit 305 ... Confirmation request unit 306 ... External authentication processing unit 307 ... Log history storage unit 308 ... Map database 309 ... Content transmission unit 310 ... Authentication database 312 ... Authentication unit 313 ... Confirmation request unit 314 ... Authentication processing unit 315 ... Authentication information type determination unit 316 ... Connection destination selection unit 401 ... Real authentication database 402 ... Communication interface 403 ... Real authentication unit 404 ... Content transmission unit 406 ... Outside Confirmation request unit 407 ... this authentication processing unit 408 ... decision-making unit 409 ... limit change section 500 ... decision-making unit 501 ... limit change unit

Claims

A mobile authentication agent system that performs authentication of a user in an arbitrary information processing terminal connected to a communication network using a mobile terminal carried by the user,
An authentication interface unit that accepts input of authentication information on the information processing terminal;
A confirmation request unit that is arranged on the communication network and obtains authentication information input in the interface unit, and that makes a confirmation request to the mobile terminal based on the authentication information;
In the mobile terminal, in response to the confirmation request, a confirmation operation unit that requests a confirmation operation from the user, and in response to the confirmation operation by the user, a confirmation operation unit that returns approval data to the confirmation request unit;
An authentication processing unit that is arranged on the communication network, acquires the approval data, and executes an authentication process based on the approval data;
A mobile authentication proxy system comprising: an authentication result transmission unit configured to transmit an authentication result by the authentication processing unit to the communication network.
(Identify phone number)
An authentication information type determination unit that determines whether or not a mobile terminal identifier that identifies a predetermined mobile terminal is included in the authentication information that is arranged on the communication network and is input to the authentication interface unit; Has
The mobile authentication agency according to claim 1, wherein the confirmation request unit makes a confirmation request to the mobile terminal when the authentication information type determination unit determines that the mobile terminal identifier is included. system.
(Add location information)
The mobile terminal has a position information acquisition unit that measures the current position of the mobile terminal,
The confirmation operation unit adds the current position of the own device measured by the position information acquisition unit to the approval data, and returns the approval data to the confirmation request unit.
The authentication processing unit has map information describing a range in which authentication is permitted, and refers to the map information during the authentication process to determine whether the current position of the mobile terminal belongs within a predetermined range. The mobile authentication agent system according to claim 1, wherein the mobile authentication agent system according to claim 1 is determined.
(Notification destination of authentication result)
The authentication interface unit is set with a form identifier that identifies the authentication interface unit, and the authentication interface unit has a function of adding its own form identifier to the authentication information,
The authentication result transmission unit includes a database that associates and stores the form identifier and a destination address that identifies the authentication processing unit that performs normal authentication processing through the authentication interface unit,
The authentication result transmitting unit acquires a form identifier of the authentication interface unit, and transmits the authentication result toward a destination address obtained by collating the database based on the form identifier. The mobile authentication agency system according to any one of claims 1 to 3.
(Oreo Restper: Request for external confirmation from ATM)
A service providing unit that performs user authentication as a normal authentication process based on authentication information input through the authentication interface unit, and provides a service when the authentication of the normal authentication process is successful;
External confirmation that is provided on the service providing unit side and that transmits the confirmation request to the mobile terminal as an external confirmation request to the confirmation requesting unit based on the authentication information input in the normal authentication process. And a request unit,
The authentication result transmitting unit transmits an authentication result based on the approval data as an external authentication result to the service providing unit,
The service providing unit determines whether or not to provide the service based on the external authentication result transmitted from the authentication result transmitting unit and an authentication result of the normal authentication process. 4. The mobile authentication agency system according to any one of 4 above.
(Oreo Restper benefits)
The service providing unit has an approval function for executing an approval process by a financial institution,
The external confirmation request unit has an external confirmation list of users who require the external confirmation request,
The approval function includes a limit amount changing function for checking an external confirmation list of the user at the time of approval processing, and switching a limit amount of the amount related to the approval process based on the external confirmation list. Item 6. The mobile authentication agent system according to Item 5.
A mobile authentication agent method for authenticating a user in an arbitrary information processing terminal connected to a communication network using a mobile terminal carried by the user,
On the information processing terminal, an authentication information input step for inputting authentication information through an authentication interface unit;
The authentication request input in the interface unit is obtained in a confirmation request unit installed on the communication network, and based on the authentication information, a confirmation request step for making a confirmation request to the mobile terminal,
In the mobile terminal, in response to the confirmation request, a confirmation operation step for requesting a confirmation operation to the user, and in response to the confirmation operation by the user, a confirmation operation step of returning approval data to the confirmation request unit;
In an authentication processing unit arranged on the communication network, an authentication processing step of acquiring the approval data and executing an authentication process based on the approval data;
An authentication result transmitting step of transmitting an authentication result in the authentication processing step on the communication network.
In the authentication information input step, it is determined whether or not the authentication information input to the authentication interface unit includes a mobile terminal identifier that identifies a predetermined mobile terminal, and in the confirmation request step, 8. The mobile authentication proxy method according to claim 7, wherein when it is determined that the authentication information includes a mobile terminal identifier, a confirmation request is sent to the mobile terminal.
The mobile terminal has a position information acquisition unit that measures the current position of the mobile terminal,
In the confirmation operation step, the current position of the own device measured by the position information acquisition unit is added to the approval data, and the approval data is returned to the confirmation request unit.
In the authentication processing step, it is determined whether or not the current position of the mobile terminal belongs to a predetermined range with reference to map information describing a range in which authentication is permitted in the authentication processing. The mobile authentication proxy method according to claim 7 or 8.
The authentication interface unit is set with a form identifier that identifies the authentication interface unit, and the authentication interface unit has a function of adding its own form identifier to the authentication information,
In the authentication result transmission step,
Collating a database that stores the form identifier in association with a destination address that identifies the authentication processing unit that performs normal authentication processing through the authentication interface unit;
The form of the authentication interface unit is acquired, and the authentication result is transmitted to a destination address obtained by collating the database based on the form identifier. The mobile authentication agent method described in the above.
(Oreo Restper: Request for external confirmation from ATM)
Instead of the confirmation request step, a normal authentication step of performing user authentication as a normal authentication process based on authentication information input through the authentication interface unit;
Based on the authentication information input in the normal authentication process, further comprising an external confirmation request step for transmitting the confirmation request to the mobile terminal as an external confirmation request to the confirmation request unit.
In the authentication result transmission step, an authentication result based on the approval data is transmitted as an external authentication result to a service providing unit that provides a service when the authentication of the normal authentication process is successful. The determination as to whether or not to provide the service is made based on the external authentication result transmitted from the authentication result transmitting unit and the authentication result of the normal authentication process. Mobile authentication agent method.
(Oreo Restper benefits)
The service providing unit has an approval function for executing an approval process by a financial institution,
The approval function is a limit change function for checking an external confirmation list of a user who requires the external confirmation request and switching a limit amount of the amount related to the approval process based on the external confirmation list at the time of the approval process. The mobile authentication proxy method according to claim 11, further comprising: