JP2007293811A - Proxy authentication system, proxy authentication method, and authentication device used therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce the burden on a user when a service requiring authentication is used. <P>SOLUTION: A proxy authentication system comprises a gateway (authentication apparatus) 10 connecting a LAN (first network) to the Internet (second network) 40, and an authentication server 20 on the Internet 40. The gateway 10 stores user authentication information required for authentication, and has a function of generating first authentication information based on the user authentication information. The authentication server 20 has a function of requesting the first authentication information to be generated at the gateway 10 upon an authentication request from a service providing server 30, verifying the first authentication information generated, and generating second authentication information if the first authentication information is legitimate. The service providing server 30 receives and verifies the second authentication information, and provides services to a user terminal 50 if the second authentication information is legitimate. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an authentication procedure when using a service requiring authentication on the Internet, for example, and more particularly to a proxy authentication system and method for performing an authentication procedure on behalf of a user terminal.

When the server authenticates the user, an authentication means that can be easily and surely performed by the user instead of the combination of the user ID and the password is required. As one of such means, for the server to be authenticated, It is effective that the user terminal presents user authentication information stored in advance and the server performs user authentication (client authentication) with reference to the user authentication information.
In this case, for example, when the user has a large number of user terminals, the user authentication information needs to be set for each user terminal, and when the user authentication information is updated, the user authentication information is updated for each user terminal. There is a problem that the burden on the user is large in these respects.

On the other hand, when setting user authentication information for each user terminal, the user authentication information must be stored in each user terminal, which is a factor that increases manufacturing costs in information home appliances such as digital televisions and digital video recorders. Become. Further, if the user terminal does not have a function for storing and setting user authentication information and the user terminal software cannot be updated, authentication based on the user authentication information cannot be performed.
For such a problem, for example, Patent Document 1 proposes a system that performs an authentication procedure in order to reduce the burden of the authentication procedure of the user or the user terminal.

In Patent Document 1, an access control system having an agent authentication unit and an agent service processing unit for each server is connected to a user terminal and a server, and the agent authentication unit receives an agent authentication request from the user terminal and issues an agent authentication certificate Each agent service processing unit receives a service use request from the user terminal, and if the agent authentication certificate attached to the use request is valid, obtains a server authentication certificate from the server or has been obtained before In this case, the server authentication certificate is taken out and a service use request is made to the server together with the server authentication certificate, and the authentication procedure for the plurality of servers of the user terminal is performed on behalf.
JP 2002-324049 A

However, the access control system described in Patent Document 1 described above has an agent service processing unit for each server in the system. For example, when a server is added, the server corresponds to the server. The agent service processing unit must be set, and if the server is changed, the agent service processing unit must be changed accordingly, which places a burden on the user. It was a cumbersome task.
An object of the present invention is to provide a proxy authentication system and method that can greatly reduce the burden on the user when using a service that requires authentication, for example, on the Internet from a user terminal in a closed network. .

  According to the first configuration of the present invention, an authentication procedure when using a service that requires authentication provided by a service providing server on the second network from a user terminal in the first network is substituted for the user terminal. The proxy authentication system is configured by an authentication device that connects the first network and the second network, and an authentication server on the second network, and the authentication device stores user authentication information necessary for authentication. And a function of generating first authentication information based on the user authentication information, wherein the authentication server requests generation of the first authentication information in the authentication device by an authentication request from the service providing server, and generation thereof The first authentication information is verified, and if it is valid, it has a function of generating the second authentication information, and the service providing server obtains the second authentication information. Only to verify, it is configured to provide a service to the user terminal if legitimate.

  According to the second configuration of the present invention, an authentication procedure when using a service that requires authentication provided by a service providing server on the second network from a user terminal in the first network is substituted for the user terminal. The proxy authentication system is configured by an authentication device that connects the first network and the second network, and an authentication server on the second network, and the authentication device is based on connection state information with the user terminal. The authentication server has a function of generating the first authentication information, and the authentication server requests generation of the first authentication information in the authentication apparatus by an authentication request from the service providing server, and the generated first authentication information is If verified, it is assumed to have a function of generating second authentication information, and the service providing server receives and verifies the second authentication information. It is configured to provide a service to The terminal.

  The first proxy authentication method according to the present invention comprises an authentication device for connecting the first network and the second network, and an authentication server on the second network, from a user terminal in the first network. A method for performing, instead of a user terminal, an authentication procedure when using a service requiring authentication provided by a service providing server on a second network, wherein the service providing server receives a service provision request from the user terminal Then, an authentication request is transmitted to the authentication server. When the authentication server receives the authentication request, the authentication server transmits a first authentication information generation request to the authentication device. When the authentication device receives the first authentication information generation request, the authentication server stores in advance The first authentication information is generated based on the user authentication information being transmitted, and the generated first authentication information is transmitted to the authentication server. When the certificate information is received, the first authentication information is verified. If it is valid, the second authentication information is generated, and the generated second authentication information is transmitted to the service providing server. When the second authentication information is received, the second authentication information is verified, and if it is valid, the service is provided to the user terminal.

  Furthermore, the second proxy authentication method according to the present invention comprises an authentication device for connecting the first network and the second network, and an authentication server on the second network, from a user terminal in the first network. A method for performing, instead of a user terminal, an authentication procedure when using a service requiring authentication provided by a service providing server on a second network, wherein the service providing server receives a service provision request from the user terminal Then, an authentication request is transmitted to the authentication server. When the authentication server receives the authentication request, the authentication server transmits a first authentication information generation request to the authentication device. When the authentication device receives the first authentication information generation request, the user terminal The first authentication information is generated on the basis of the connection state information to the server, and the generated first authentication information is transmitted to the authentication server. The authentication server When the information is received, the first authentication information is verified. If it is valid, the second authentication information is generated, and the generated second authentication information is transmitted to the service providing server. When the second authentication information is received, the second authentication information is verified, and if it is valid, the service is provided to the user terminal.

According to the present invention, since user authentication information of user terminals is stored in the authentication apparatus in a lump, the user does not need to manage user authentication information at each user terminal, improving user operability, and user authentication. Maintenance at the time of information update can be improved, and the burden on the user can be greatly reduced. In particular, information home appliances such as digital televisions and digital video recorders do not have a sufficient input interface, resulting in great user benefits.
In addition, since it is not necessary to manage user authentication information at the user terminal, each user terminal does not require high security specifications, which can contribute to cost reduction of the user terminal.
Further, instead of a configuration in which the authentication device stores user authentication information and generates first authentication information effective for the authentication server based on the user authentication information, the first authentication device stores first authentication information based on connection state information with the user terminal. If it is set as the structure which produces | generates this authentication information, the input operation | work of personal information, such as a user name and a password, from a user terminal of a user can be made unnecessary.

Embodiments of the present invention will be described below with reference to the drawings.
<Embodiment 1>
FIG. 1 shows the configuration of Embodiment 1 of a proxy authentication system according to the present invention. In this embodiment, the first network is a LAN (not shown), and the second network is the Internet 40. A gateway (home gateway) 10 is used as an authentication device for connecting the first network (LAN) and the second network (Internet 40). An authentication server 20 and a service providing server (a server that provides a service that requires authentication) 30 exist on the Internet 40. The LAN is, for example, a home LAN, and a plurality of user terminals 50-1, 50-2, 50-3,... Are connected to the LAN. These user terminals 50 are, for example, information home appliances and PCs (personal computers). The authentication server 20 is a server owned by an authentication provider that provides a single sign-on service, and the service providing server 30 is a server of a service provider that receives a service providing request from the user terminal 50 and provides a service. In the single sign-on service according to the present invention, the user always receives user authentication from the authentication server 20 when the service providing server 30 uses the service. The service providing server 30 provides a service to the user based on the user authentication result received from the authentication server 20. Further, even when there are a plurality of service providing servers 30 (when the service providing servers 30-1, 30-2, 30-3,... Are connected to the Internet 40), the user is always in the authentication server 20. Each service providing server can be used by receiving authentication. For example, an Internet service provider (ISP) is also used as the authentication provider. In FIG. 1, reference numeral 12 denotes a calculation unit in the gateway 10, and 13 denotes a storage unit.

FIG. 2 is a sequence diagram showing a procedure of a proxy authentication procedure executed by the proxy authentication system shown in FIG. 1, and the procedure will be described below with reference to FIG.
(1) The user requests the service providing server 30 to provide a service using the user terminal 50. The service provision request is transmitted from the user terminal 50 to the service provision server 30 (S101).
(2) Upon receiving the service provision request, the service provision server 30 generates an identifier 51 that identifies the user terminal 50 that has requested the service provision (S102). The identifier 51 is generated based on additional information (for example, IP address) that can identify the user terminal 50.
(3) The service providing server 30 transmits an authentication request to the authentication server 20 so that the authentication server 20 performs user authentication necessary for service provision (S103). At this time, the identifier 51 is also transmitted and notified to the authentication server 20.
(4) Upon receiving the authentication request, the authentication server 20 generates an identifier 31 that identifies the service providing server 30 that has made the authentication request (S104). The identifier 31 is generated based on additional information (for example, IP address) that can identify the service providing server 30.
(5) The authentication server 20 transmits a first authentication information generation request to the gateway 10 so that the gateway 10 generates first authentication information necessary for user authentication (S105). At this time, the identifiers 31 and 51 are also transmitted and notified to the gateway 10.

(6) The gateway 10 that has received the first authentication information generation request generates an identifier 21 that identifies the authentication server 20 that has made the first authentication information generation request (S106). The identifier 21 is generated based on additional information (for example, an IP address) that can identify the authentication server 20.
(7) Based on the user authentication information stored in advance in the storage unit 13, the gateway 10 generates first authentication information of a valid user in the authentication server 20 in the calculation unit 12 (S 107). The first authentication information is transmitted to the authentication server 20 based on the identifier 21 (S108). At this time, identifiers 31 and 51 are also transmitted.
(8) Upon receiving the first authentication information, the authentication server 20 verifies the first authentication information (S109). When the validity of the first authentication information can be confirmed, the authentication server 20 generates second authentication information valid for the service providing server 30 (S110), and the generated second authentication information is identified by the identifier 31. Is transmitted to the service providing server 30 (S111). At this time, the identifier 51 is also transmitted.
(9) Upon receiving the second authentication information, the service providing server 30 verifies the second authentication information (S112), and if the validity is confirmed, the service providing server 30 provides the service to the user terminal 50 based on the identifier 51. Provide (S113).

<Embodiment 2>
FIG. 3 shows a configuration of a second embodiment of the proxy authentication system according to the present invention. In this embodiment, the gateway 10 of the first embodiment includes a dedicated user authentication information storage means 14 for storing user authentication information. The user authentication information is not stored in the storage unit 13 of the gateway 10, but is stored in the user authentication information storage unit 14 of this independent function. The user authentication information storage unit 14 is, for example, an IC chip.
FIG. 4 shows the procedure of the proxy authentication procedure of the second embodiment. Compared with the procedure of the first embodiment shown in FIG. 2, the user authentication information storage means is generated after the identifier 21 is generated in the gateway 10 (S106). A step (S121) of reading user authentication information from 14 is added.

<Embodiment 3>
FIG. 5 shows the configuration of a third embodiment of the proxy authentication system according to the present invention. In this embodiment, the user authentication information storage means 14 in the second embodiment shown in FIG. It is assumed that the first authentication information is generated by the calculation unit 15. The user authentication information storage means 14 is, for example, an IC chip with a built-in CPU.
FIG. 6 shows the procedure of the proxy authentication procedure of the third embodiment. In this embodiment, the gateway 10 sends the first authentication information to the user authentication information storage means 14 after the identifier 21 is generated (S106). Request to generate (S131). The user authentication information storage unit 14 generates first authentication information in the computing unit 15 based on the user authentication information stored in advance (S132), and further generates an electronic signature in this example to generate the first authentication information. (S133).

The user authentication information storage unit 14 transmits the generated first authentication information and electronic signature to the gateway 10 (S134), and the gateway 10 uses the received first authentication information and electronic signature based on the identifier 21 as an authentication server 20. Send to. The authentication server 20 verifies the electronic signature and the first authentication information (S136), and if the validity is confirmed, generates the second authentication information (S110).
In this embodiment, steps S131 to S136 described above are executed in place of steps S107 to 109 in the first embodiment shown in FIG.

<Embodiment 4>
In the configuration of the first embodiment, the request information of the user terminal (client terminal) and the response information of the server are combined with the information distribution of the request and response between the user terminal 50, the service providing server 30, and the authentication server 20 in the configuration of the first embodiment. FIG. 7 shows the procedure of the proxy authentication procedure, which will be described below with reference to FIG.

(1) The user requests the service providing server 30 to provide a service using the user terminal 50. The service provision request is transmitted from the user terminal 50 to the service provision server 30 (S101).
(2) Upon receiving the service provision request, the service provision server 30 responds so that user authentication necessary for service provision is performed by the authentication server 20 (S141). At this time, the service providing server 30 transmits an identifier 31 that identifies the service providing server 30 and an identifier 21 that identifies the authentication server 20 to the user terminal 50.
(3) The user terminal 50 accesses the authentication server 20 using the identifier 21 and transmits an authentication request. At this time, the user terminal 50 transmits the identifier 31 to the authentication server 20.
(4) Upon receiving the authentication request, the authentication server 20 responds to generate the first authentication information necessary for user authentication in the gateway 10 (S142). At this time, the authentication server 20 transmits the identifiers 21 and 31 and the identifier 11 for specifying the gateway 10 to the user terminal 50.
(5) The user terminal 50 accesses the gateway 10 using the identifier 11 and transmits a first authentication information generation request. At this time, the user terminal 50 transmits identifiers 21 and 31 to the gateway 10.

(6) The gateway 10 that has received the first authentication information generation request generates first authentication information in the arithmetic unit 12 based on the user authentication information stored in advance in the storage unit 13 (S107), and the user terminal 50 responds to transmit the first authentication information to the authentication server 20 (S143). At this time, the gateway 10 transmits the identifiers 21 and 31 to the user terminal 50.
(7) The user terminal 50 accesses the authentication server 20 using the identifier 21 and transmits the first authentication information. At this time, the user terminal 50 transmits the identifier 31 to the authentication server 20.
(8) The authentication server 20 that has received the first authentication information verifies the first authentication information (S109). If the validity is confirmed, the authentication server 20 generates second authentication information (S110), and the user terminal 50, the second authentication information is transmitted to the service providing server 30 (S144). At this time, the authentication server 20 transmits the identifier 31 to the user terminal 50.
(9) The user terminal 50 accesses the service providing server 30 using the identifier 31 and transmits the second authentication information.
(10) Upon receiving the second authentication information, the service providing server 30 verifies the second authentication information (S112), and if the validity is confirmed, provides the service to the user terminal 50 (S113).

  In this embodiment, the address information of the authentication server 20 is pre-registered in the service providing server 30, and the address information of the gateway 10 is pre-registered in the authentication server 20, so that the service providing server 30 responds to the authentication request (S141). The identifier 21 can be given to the user terminal 50, and the authentication server 20 can give the identifier 11 to the user terminal 50 in the first authentication information generation request (S142).

<Embodiment 5>
As in the fourth embodiment with respect to the first embodiment, the fifth embodiment uses a request / response protocol in the configuration of the second embodiment, and FIG. 8 shows the procedure of the proxy authentication procedure.
As shown in FIG. 8, in this embodiment, in contrast to the procedure of the embodiment 4 shown in FIG. 7, the step of reading the user authentication information from the user authentication information storage means 14 after the first authentication information generation request (S142). (S121) is added.

<Embodiment 6>
As in the fourth embodiment with respect to the first embodiment, the sixth embodiment uses a request / response protocol in the configuration of the third embodiment, and FIG. 9 shows the procedure of the proxy authentication procedure.
As shown in FIG. 9, in this embodiment, first authentication information generation (S107), first authentication information transmission (S143), and first authentication information verification (S109) in the procedure of the fourth embodiment shown in FIG. Instead, steps S131 to S134, S145, and S136 are executed. That is, the gateway 10 that has received the first authentication information generation request (S142) requests the user authentication information storage unit 14 to generate the first authentication information (S131). Based on the stored user authentication information, first authentication information is generated in the computing unit 15 (S132), and an electronic signature is further generated and added to the first authentication information (S133).

The user authentication information storage unit 14 transmits the generated first authentication information and electronic signature to the gateway 10 (S134), and the gateway 10 transmits the first authentication information and electronic signature to the authentication server 20 to the user terminal 50. To respond (S145). At this time, the gateway 10 transmits the identifiers 21 and 31 to the user terminal 50.
The user terminal 50 accesses the authentication server 20 using the identifier 21 and transmits the first authentication information and the electronic signature. At this time, the user terminal 50 transmits the identifier 31 to the authentication server 20. The authentication server 20 verifies the electronic signature and the first authentication information (S136).

<Embodiment 7>
In the seventh embodiment, when the gateway 10 generates the first authentication information, the user is asked through the user terminal 50 whether or not the first authentication information can be generated. FIG. 10 shows the procedure. It is a thing. FIG. 10 shows only the main parts when applied to the procedure of the first embodiment shown in FIG.
In this embodiment, the gateway 10 that has received the first authentication information generation request (S105) from the authentication server 20 asks the user terminal 50 whether the first authentication information can be generated (S151). The first authentication information generation possibility, that is, the user authentication information of the gateway 10 is used to inquire whether the user authentication to the service providing server 30 is possible (S152). Only when the user 60 approves the authentication through the user terminal 50 (S153, S154), the gateway 10 generates the first authentication information (S107) and transmits it to the authentication server 20 (S108).

<Embodiment 8>
In the eighth embodiment, when the gateway 10 reads the user authentication information from the storage unit 13, the user 10 is requested to input a PIN (Personal Identification Number), and FIG. 11 shows the procedure. Is. FIG. 11 shows only the main part when applied to the procedure of the first embodiment shown in FIG.
In this embodiment, the gateway 10 that has received the first authentication information generation request (S105) from the authentication server 20 reads the user authentication information for generating the first authentication information from the storage unit 13, and A PIN input is requested (S161). The user terminal 50 notifies the user 60 that the PIN input is necessary to perform the user authentication to the service providing server 30 using the user authentication information of the gateway 10, and requests the user 60 to enter the PIN ( S162). When the user 60 inputs a PIN from the user terminal 50 (S163) and the PIN is transmitted to the gateway 10 (S164), the gateway 10 collates the PIN (S165), and reads the user authentication information after the collation. To generate first authentication information (S107).

<Embodiment 9>
In the ninth embodiment, when the gateway 10 reads the user authentication information from the user authentication information storage unit 14, the PIN is requested from the user 60 as in the eighth embodiment, and FIG. Is shown. FIG. 12 shows only the main part when applied to the procedure of the second embodiment shown in FIG.
In this form, when the gateway 10 reads the user authentication information for generating the first authentication information from the user authentication information storage unit 14, steps S161 to 165 are executed as in the case of the eighth embodiment described above.

<Embodiment 10>
In the tenth embodiment, when the user authentication information storage unit 14 having a calculation function receives a first authentication information generation request from the gateway 10, the user 60 is requested to input a PIN. The procedure is shown. FIG. 13 shows only the main part when applied to the procedure of the third embodiment shown in FIG.
In this embodiment, when the gateway 10 makes a first authentication information generation request to the user authentication information storage unit 14 (S131), the user authentication information storage unit 14 requests the gateway 10 to input a PIN (S171). As a result, as in the case of the eighth embodiment shown in FIG. 11, steps S161 to 164 are executed, and the gateway 10 that has received the PIN transmits the PIN to the user authentication information storage unit 14 (S172). The user authentication information storage unit 14 collates the PIN (S173), and after the collation, reads the user authentication information and generates first authentication information (S132).

For example, when an https server is mounted on the IC chip constituting the user authentication information storage unit 14, the user terminal 50 can be securely communicated, that is, the user authentication information storage unit 14 has a server function. The procedure is as follows.
In this case, when the gateway 10 makes a first authentication information generation request to the user authentication information storage unit 14 and transmits the identifier 51 of the user terminal 50 (S131 ′), the user authentication information storage unit 14 A PIN input is requested (S171 ′). As a result, as in the case of the eighth embodiment shown in FIG. 11, steps S162 to S163 are executed, and further the transmission of the PIN from the user terminal 50 to the user authentication information storage means 14 is executed (S164 ′). The user authentication information storage unit 14 that has received the PIN collates the PIN (S173). After the collation, the user authentication information is read to generate first authentication information (S132).
In the above, various embodiments have been described in which the first network is a LAN, the second network is the Internet 40, and the gateway 10 is used as an authentication device that connects the first network and the second network. In this embodiment, user authentication information necessary for authentication is stored in the storage unit 13 of the gateway 10 or in the dedicated user authentication information storage means 14 of the gateway 10 and is managed collectively. Simple and reliable user authentication can be realized without accumulating user authentication information in the terminal 50, and thus the burden on the user can be greatly reduced.

As shown in the second embodiment, a dedicated user authentication information storage unit 14 for storing user authentication information is provided in the gateway 10, and the user authentication information storage unit 14 is configured by an IC chip having excellent tamper resistance. Inadvertent browsing of the user authentication information by a third party can be prevented.
Similarly, as shown in the third embodiment, the gateway 10 is provided with the user authentication information storage means 14 having a calculation function, and the user authentication information storage means 14 is configured by a CPU built-in IC chip having excellent tamper resistance. For example, it is possible to prevent user authentication information and electronic signature key information from being inadvertently viewed or falsified by a third party, and from being copied from the outside.

On the other hand, the user authentication information storage unit 14 of the second and third embodiments can be removed from the gateway 10. In this case, the gateway 10 includes an interface for the user authentication information storage unit 14, and the user authentication information storage unit 14 includes an interface corresponding to the interface.
Such removable user authentication information storage means 14 is, for example, an IC card or a CPU built-in IC card, and the user inserts an IC card in advance or starts a service use of the service providing server 30 or a non-contact IC card. The user authentication information storage means (IC card) 14 and the gateway 10 are linked with each other.
When the user tries to start using the service of the service providing server 30 without linking the user authentication information storage unit 14 with the gateway 10, a warning such as “the user authentication information storage unit is not linked” is given to the gateway. 10 may notify the user directly or through the user terminal 50. The timing of this notification is, for example, when reading the user authentication information (S121) in the procedure of the second embodiment shown in FIG. 4, and when generating the first authentication information (S132) in the procedure of the third embodiment shown in FIG. Is done.

The removable user authentication information storage means 14 is not limited to an IC card, and for example, a mobile phone with a built-in IC chip or the like can be used. The mobile phone is linked to the gateway 10 by being connected to or placed over the gateway 10. .
As illustrated in the seventh embodiment, when the gateway 10 generates the first authentication information, if the user is asked whether the generation is possible, the gateway 10 confirms the user's intention and then the first authentication information is generated. Authentication information can be generated. Note that the procedure for inquiring whether or not the first authentication information can be generated in the seventh embodiment is not limited to the first embodiment but can be applied to the procedures in the second to sixth embodiments.

  As shown in the eighth to tenth embodiments, when user authentication information is read, if the user is requested to enter a PIN, use of the user authentication information by a third party can be prevented. The procedures for requesting the PIN input of the eighth to tenth embodiments can be applied to the procedures of the fourth to sixth embodiments, respectively, and whether or not the user can generate the first authentication information as shown in the seventh embodiment. The procedure for requesting the PIN input may be executed after the procedure for asking. Instead of requesting the user to enter a PIN, the user may be prompted to enter a user name and password.

By the way, when the user terminal 50 is used by a plurality of users, a plurality of storage areas are provided in the storage unit 13 of the gateway 10 or when the dedicated user authentication information storage unit 14 is provided. The user authentication information of a plurality of users is stored. The user selects user authentication information to be used in advance when starting service use of the service providing server 30. Alternatively, user authentication information may be selected as follows.
In the first and fourth embodiments, at the time of first authentication information generation (S107), the user is asked for user authentication information that the gateway 10 uses via the user terminal 50.
In the second and fifth embodiments, when user authentication information is read (S121), the gateway 10 asks the user for user authentication information to be used via the user terminal 50.
In the third and sixth embodiments, when the first authentication information is generated (S132), the user authentication information storage unit 14 asks the user for user authentication information to be used through the gateway 10 and the user terminal 50. In this case, for example, the user authentication information storage unit 14 may ask the user through the gateway 10, or the user authentication information storage unit 14 may ask the user.

The user authentication information is selected by the following method, for example.
-Select a user or enter a user name.
・ Enter your PIN.
・ Enter the user name and password.
As described above, even when a plurality of user terminals 50 are used by a plurality of users, by collecting user authentication information necessary for authentication in the gateway 10, the authentication procedure is simplified and the convenience of the user is improved. Figured.

By the way, when the user terminal 50 accesses the service providing server 30 or the authentication server 20, the IP address shown for each is the gateway 10 if the gateway 10 has a NAT (Network Address Translation) function. IP address.
Therefore, for example, in the first to third embodiments, the authentication server 20 can obtain the IP address of the gateway 10 to which the first authentication information generation request (S105) should be performed using the identifier 51 of the user terminal 50. In Embodiments 4 to 6, the authentication server 20 can make a first authentication information generation request (S142) to the gateway 10 based on the IP address of the user terminal 50 that made the authentication request (S141) to the authentication server 20. . That is, since the authentication server 20 can find the gateway 10 based on the information provided by the user terminal 50, it is not particularly necessary to pre-register the address information of the gateway 10.
In the fourth to sixth embodiments, if HTTP (HyperText Transfer Protocol) is used as a request / response protocol, when the user terminal 50 requests a service that requires user authentication of the service providing server 30 using a web browser, The proxy authentication procedure can be received, and it is not necessary to install a dedicated application or function in the user terminal 50.

  The authentication device that connects the first network and the second network and generates the first authentication information effective for the authentication server 20 is not limited to the gateway 10 described above, and for example, a mobile phone or a network connection server is used. You can also Hereinafter, a mode in which a mobile phone or a network connection server is used as an authentication device, and a mode in which an authentication terminal is arranged on the first network for the purpose of authentication only (first authentication information generation only) will be described.

<Embodiment 11>
FIG. 14 shows the configuration of an eleventh embodiment of a proxy authentication system according to the present invention using a mobile phone as an authentication device. In this embodiment, the first network is a closed network (not shown), and the second network The network is defined as a mobile communication network 70 and the Internet 40, and a mobile phone 10 ′ is used as an authentication device for connecting the first network and the second network. The mobile communication network 70 and the Internet 40 are connected by a gateway 75, and the authentication server 20 and the service providing server 30 exist on the mobile communication network 70 or the Internet 40.
In this embodiment, the mobile phone 10 ′ is connected to the user terminal 50 by USB or Bluetooth, and the mobile phone 10 ′ is authenticated when the user terminal 50 receives the service of the service providing server 30 on the Internet 40 via the mobile communication network 70. Functions as a device. In other words, in this embodiment, the mobile phone 10 'behaves as a router or gateway for the user terminal 50 to perform IP communication with each server on the Internet 40 or the mobile communication network 70, and a server program that functions as an authentication device is Java (for example) Registered trademark) 2 Micro Edition It is assumed that it is installed and installed using MIDP2.0. In FIG. 14, 12 ′ indicates a calculation unit in the mobile phone 10 ′, and 13 ′ indicates a storage unit.
Assuming that the proxy authentication procedure executed by the proxy authentication system shown in FIG. 14 uses, for example, a request / response protocol, in the procedure of the fourth embodiment shown in FIG. Will be replaced with.

<Embodiment 12>
FIG. 15 shows the configuration of a twelfth embodiment of a proxy authentication system according to the present invention using a network connection server as an authentication device. In this embodiment, a network is used instead of the gateway 10 having the configuration of the first embodiment shown in FIG. A connection server 10 '' is used. In FIG. 15, 12 ″ indicates a calculation unit in the network connection server 10 ″, and 13 ″ indicates a storage unit.
The network connection server 10 ″ is a server that connects a user connection network (not shown) such as a fixed telephone line, a mobile telephone line, an optical cable network, and a public wireless LAN line provided by an Internet connection provider to the Internet 40. For example, it is a RADIUS server, and a plurality of user terminals 50-1, 50-2, 50-3,...
If the proxy authentication procedure executed by the proxy authentication system shown in FIG. 15 uses, for example, a request / response protocol, as in the case of the eleventh embodiment, the fourth embodiment shown in FIG. In this procedure, the gateway 10 is replaced with the network connection server 10 ″.

  As shown in the eleventh and twelfth embodiments, when the mobile phone 10 ′ or the network connection server 10 ″ is used as the authentication device, the first authentication information is generated based on the connection state information with the user terminal 50. In other words, when the mobile phone 10 ′ or the network connection server 10 ″ has a function of generating the first authentication information based on the connection state information with the user terminal 50, the first authentication information is Storage and management of user authentication information for generation is not required in the cellular phone 10 ′ and the network connection server 10 ″. In this case, it is not necessary to input personal information such as a user name and password from the user terminal 50 by the user. The connection state information is, for example, an IP address (global IP address), and a session ID issued as necessary when the mobile phone 10 ′ or the network connection server 10 ″ authenticates the user terminal 50.

<Embodiment 13>
FIG. 16 shows the configuration of a thirteenth embodiment of the proxy authentication system according to the present invention. In this embodiment, an authentication terminal 90 exists on the LAN (first network), and the authentication terminal 90 is connected via a broadband router 80. The authentication server 20 and the service providing server 30 on the Internet (second network) 40 are connected. The authentication terminal 90 is, for example, a mobile phone having a wireless LAN connection function. In FIG. 16, reference numeral 91 denotes a calculation unit in the authentication terminal 90, and 92 denotes a storage unit.
If the proxy authentication procedure executed by the proxy authentication system shown in FIG. 16 uses, for example, a request / response protocol, the gateway 10 is connected to the authentication terminal 90 in the procedure of the fourth embodiment shown in FIG. It will be replaced.
When a wireless LAN-compatible mobile phone is used as the authentication terminal 90, a program that functions as an authentication device capable of HTTP access via the wireless LAN is implemented using, for example, Java (registered trademark) 2 Micro Edition MIDP2.0. And install it.

When the authentication terminal 90 is connected to the LAN, a private IP address for identifying each terminal in the LAN is assigned from the broadband router 80. When a program that functions as an authentication device is activated on the authentication terminal 90, first, the private IP address assigned to the authentication terminal 90 is notified to the authentication server 20 on the Internet 40. The IP address of the authentication server 20 is stored in the authentication terminal 90 in advance.
The authentication server 20 receives an address notification from the authentication terminal 90 via the LAN, the broadband router 80, and the Internet 40. In general, when a terminal device in a LAN connected to the Internet via a broadband router accesses a server on the Internet, the source IP address is a global IP address assigned to the broadband router. Therefore, the authentication server 20 associates and stores a set of the global IP address of the broadband router 80 used as the source IP address and the private IP address of the authentication terminal 90 notified from the authentication terminal 90.

  Here, in this embodiment, when the authentication server 20 transmits the first authentication information generation request to the authentication terminal 90 in step S142 (see FIG. 7), the authentication stored in association with the source IP address (global IP address). The HTTP access is redirected to the private IP address of the terminal 90.

The figure which shows the structure of Embodiment 1 of the proxy authentication system by this invention. The figure which shows the sequence of Embodiment 1 of the proxy authentication method by this invention. The figure which shows the structure of Embodiment 2 of the proxy authentication system by this invention. The figure which shows the sequence of Embodiment 2 of the proxy authentication method by this invention. The figure which shows the structure of Embodiment 3 of the proxy authentication system by this invention. The figure which shows the sequence of Embodiment 3 of the proxy authentication method by this invention. The figure which shows the sequence of Embodiment 4 of the proxy authentication method by this invention. The figure which shows the sequence of Embodiment 5 of the proxy authentication method by this invention. The figure which shows the sequence of Embodiment 6 of the proxy authentication method by this invention. The figure which shows the principal part sequence of Embodiment 7 of the proxy authentication method by this invention. The figure which shows the principal part sequence of Embodiment 8 of the proxy authentication method by this invention. The figure which shows the principal part sequence of Embodiment 9 of the proxy authentication method by this invention. The figure which shows the principal part sequence of Embodiment 10 of the proxy authentication method by this invention. The figure which shows the structure of Embodiment 11 of the proxy authentication system by this invention. The figure which shows the structure of Embodiment 12 of the proxy authentication system by this invention. The figure which shows the structure of Embodiment 13 of the proxy authentication system by this invention.

Claims (19)

A system that performs an authentication procedure on behalf of a user terminal when using a service that requires authentication provided by a service providing server on a second network from a user terminal in a first network,
An authentication device that connects the first network and the second network, and an authentication server on the second network;
The authentication device stores user authentication information necessary for the authentication, and has a function of generating first authentication information based on the user authentication information,
The authentication server requests generation of the first authentication information in the authentication device by an authentication request from the service providing server, and verifies the generated first authentication information, and if it is valid, It has a function to generate authentication information,
The service providing server is configured to receive and verify the second authentication information and to provide a service to the user terminal if it is valid. In the proxy authentication system according to claim 1,
The proxy authentication system, wherein the authentication device has a dedicated user authentication information storage means for storing the user authentication information. In the proxy authentication system according to claim 2,
The proxy authentication system characterized in that the user authentication information storage means has a calculation function for generating the first authentication information, generating an electronic signature, and adding it to the first authentication information. In the proxy authentication system according to claim 2 or 3,
A proxy authentication system, wherein the user authentication information storage means is removable from the authentication device. A system that performs an authentication procedure on behalf of a user terminal when using a service that requires authentication provided by a service providing server on a second network from a user terminal in a first network,
An authentication device that connects the first network and the second network, and an authentication server on the second network;
The authentication device has a function of generating first authentication information based on connection state information with the user terminal,
The authentication server requests generation of the first authentication information in the authentication device by an authentication request from the service providing server, and verifies the generated first authentication information, and if it is valid, It has a function to generate authentication information,
The service providing server is configured to receive and verify the second authentication information and to provide a service to the user terminal if it is valid. A system that performs an authentication procedure on behalf of a user terminal when using a service that requires authentication provided by a service providing server on a second network from a user terminal in a first network,
An authentication terminal on the first network, an authentication server on the second network, and a network connection device that connects the first network and the second network,
The authentication terminal stores user authentication information necessary for the authentication, and has a function of generating first authentication information based on the user authentication information,
The authentication server requests generation of the first authentication information in the authentication terminal by an authentication request from the service providing server, and verifies the generated first authentication information, and if it is valid, It has a function to generate authentication information,
The service providing server is configured to receive and verify the second authentication information and to provide a service to the user terminal if it is valid. An authentication device comprising an authentication device for connecting the first network and the second network and an authentication server on the second network, provided by a service providing server on the second network from a user terminal in the first network On behalf of the user terminal when using a service that requires a service,
When the service providing server receives the service providing request from the user terminal, the service providing server transmits an authentication request to the authentication server,
Upon receiving the authentication request, the authentication server transmits a first authentication information generation request to the authentication device,
Upon receiving the first authentication information generation request, the authentication device generates first authentication information based on user authentication information stored in advance, and sends the generated first authentication information to the authentication server. Send
Upon receiving the first authentication information, the authentication server verifies the first authentication information, and if valid, generates second authentication information, and uses the generated second authentication information as the service providing server. To
The service providing server, when receiving the second authentication information, verifies the second authentication information and, if valid, provides the service to the user terminal. The proxy authentication method according to claim 7,
The authentication apparatus includes a user authentication information storage unit, and reads the user authentication information from the user authentication information storage unit to generate the first authentication information. The proxy authentication method according to claim 7,
A proxy authentication method, wherein the authentication device includes a user authentication information storage unit having a calculation function, and requests the user authentication information storage unit to generate the first authentication information. An authentication device comprising an authentication device for connecting the first network and the second network and an authentication server on the second network, provided by a service providing server on the second network from a user terminal in the first network On behalf of the user terminal when using a service that requires a service,
When the service providing server receives the service providing request from the user terminal, the service providing server transmits an authentication request to the authentication server,
Upon receiving the authentication request, the authentication server transmits a first authentication information generation request to the authentication device,
Upon receiving the first authentication information generation request, the authentication device generates first authentication information based on connection state information with the user terminal, and sends the generated first authentication information to the authentication server. Send
Upon receiving the first authentication information, the authentication server verifies the first authentication information, and if valid, generates second authentication information, and uses the generated second authentication information as the service providing server. To
The service providing server, when receiving the second authentication information, verifies the second authentication information and, if valid, provides the service to the user terminal. The proxy authentication method according to claim 7 or 10,
When the authentication device receives the first authentication information generation request, the authentication device asks the user through the user terminal whether the generation is possible or not, and generates the first authentication information upon receiving user approval. Proxy authentication method. The proxy authentication method according to claim 7 or 10,
Upon receiving the first authentication information generation request, the authentication device requests the user to input a PIN or a user name and password via the user terminal, and collates the input PIN or user name and password. A proxy authentication method for generating the first authentication information. The proxy authentication method according to claim 9, wherein
When the user authentication information storage unit receives a request for generating the first authentication information from the authentication device, the user authentication information storage means requests the user to input a PIN or a user name and password via the authentication device and the user terminal. A proxy authentication method, wherein the first authentication information is generated by collating the entered PIN or user name and password. A network connection device that connects the first network and the second network, an authentication terminal on the first network, and an authentication server on the second network, and a second terminal from a user terminal in the first network A method for performing an authentication procedure on behalf of a user terminal when using a service requiring authentication provided by a service providing server on a network,
When the service providing server receives the service providing request from the user terminal, the service providing server transmits an authentication request to the authentication server,
Upon receiving the authentication request, the authentication server transmits a first authentication information generation request to the authentication terminal,
Upon receiving the first authentication information generation request, the authentication terminal generates first authentication information based on user authentication information stored in advance, and sends the generated first authentication information to the authentication server. Send
Upon receiving the first authentication information, the authentication server verifies the first authentication information, and if valid, generates second authentication information, and uses the generated second authentication information as the service providing server. To
The service providing server, when receiving the second authentication information, verifies the second authentication information and, if valid, provides the service to the user terminal. An authentication device for connecting a first network and a second network,
Means for storing user authentication information necessary for user authentication of a user terminal in the first network;
An authentication apparatus comprising: means for generating authentication information necessary for the user terminal to receive user authentication at an authentication server on the second network based on the user authentication information. An authentication device for connecting a first network and a second network,
Means for generating authentication information necessary for the user terminal to receive user authentication at an authentication server on the second network based on connection state information with the user terminal in the first network; An authentication apparatus characterized by that. The authentication device according to claim 15, wherein
An authentication apparatus, wherein the first network is a LAN, the second network is the Internet, and the authentication apparatus is configured by a gateway. The authentication device according to claim 15 or 16,
An authentication apparatus, wherein the first network is a closed network, the second network is a mobile communication network and the Internet, and the authentication apparatus is constituted by a mobile phone. The authentication device according to claim 15 or 16,
An authentication apparatus, wherein the first network is a user connection network, the second network is the Internet, and the authentication apparatus is configured by a network connection server.

Images