JP6319485B2 - Terminal device, information processing method, information processing program - Google Patents

Description

  The present invention relates to a terminal device that makes an authentication request to a server, and particularly to a terminal device, an information processing method, and an information processing program that use position information for authentication.

  Conventionally, an authentication system has been disclosed in which a server authenticates a portable information terminal based on position information received from the portable information terminal and provides an online commerce service to the portable information terminal on the condition that the authentication result is positive. Has been. The owner of the portable information terminal can use the online commerce service without performing a complicated operation such as entering a password by registering, for example, a home or work place as an area where the authentication result is positive. . On the other hand, even if the mobile information terminal is lost or stolen by a third party, it can be carried from the server as long as the mobile information terminal is located in an area where the authentication result is negative. Since the password transmission is requested to the information terminal, it is possible to avoid the online commerce service from being abused. (For example, see Patent Document 1)

JP 2002-232955 A

  However, in the technique disclosed in Patent Document 1, when the portable information terminal acquires position information from, for example, a GPS (Global Positioning System) satellite, the position is Information cannot be acquired, and the server cannot perform authentication based on the location information. For this reason, user convenience may be impaired.

  The present invention has been made in view of such circumstances, and an object of the present invention is to provide a technique for performing authentication based on position information even when the terminal apparatus cannot acquire its own position information.

In order to solve the above problems, the present invention provides the following apparatus, method, and program.
(1) A first acquisition unit that acquires first position information indicating its own position information, a second acquisition unit that acquires position information of a plurality of other devices, and a plurality of units acquired by the second acquisition unit When the first acquisition unit acquires the first position information, the calculation unit that calculates the second position information based on the position information of the first position information is selected, and the first acquisition unit selects the first position information. A control unit that selects second location information and creates an authentication request including the selected location information when the information is not acquired, and the second acquisition unit includes each of the plurality of other devices. The position information of the plurality of other devices is acquired, and the calculation unit is configured to obtain the second acquisition unit according to a value related to the number of relays in a communication path with each of the plurality of other devices. Weighting each of the plurality of position information acquired in step 2 Calculated to the terminal apparatus according to claim Rukoto.
(2) A first acquisition unit that acquires first position information indicating its own position information, a second acquisition unit that acquires position information of a plurality of other devices, and a plurality of units acquired by the second acquisition unit When the first acquisition unit acquires the first position information, the calculation unit that calculates the second position information based on the position information of the first position information is selected, and the first acquisition unit selects the first position information. A control unit that selects second location information and creates an authentication request including the selected location information when the information is not acquired, and the control unit has the selected location information as the first location information. A terminal device characterized by further including location type information indicating whether it is location information or second location information in an authentication request.
(3) An information processing method executed by a computer, a first acquisition step of acquiring first position information indicating its own position information, and a second acquisition step of acquiring position information of a plurality of other devices, respectively. And calculating the second position information based on the plurality of position information acquired in the second acquisition step, and selecting the first position information when the first position information is acquired in the first acquisition step. And, if the first location information is not obtained by the first obtaining step, the control step for selecting the second location information and generating an authentication request including the selected location information, and In the second acquisition step, communication with each of the plurality of other devices is performed to acquire position information of the plurality of other devices, and the calculation step is performed with each of the plurality of other devices. Depending on the value of the number of relays in the signal path, the second weighted for a plurality of position information respectively obtained by the obtaining step, calculating a second position information, an information processing method, characterized in that.
(4) An information processing method executed by a computer, a first acquisition step of acquiring first position information indicating its own position information, and a second acquisition step of acquiring position information of a plurality of other devices, respectively. And calculating the second position information based on the plurality of position information acquired in the second acquisition step, and selecting the first position information when the first position information is acquired in the first acquisition step. And, if the first location information is not obtained by the first obtaining step, the control step for selecting the second location information and generating an authentication request including the selected location information, and The control step further includes location type information indicating whether the selected location information is first location information or second location information in an authentication request. .
(5) The computer is acquired by a first acquisition unit that acquires first position information indicating its own position information, a second acquisition unit that acquires position information of a plurality of other devices, and the second acquisition unit. A calculation unit that calculates second position information based on a plurality of pieces of position information. When the first acquisition unit acquires first position information, the first acquisition unit selects and outputs the first position information. When the position information is not acquired, the second acquisition unit selects the second position information and functions as a control unit that generates and outputs an authentication request including the selected position information. Communication with each of the plurality of devices to obtain position information of the plurality of other devices, the calculation unit according to a value related to the number of relays in the communication path with each of the plurality of other devices, For each of the plurality of position information acquired by the second acquisition unit And weighted to calculate the second position information, the information processing program characterized by.
(6) The computer is acquired by a first acquisition unit that acquires first position information indicating its own position information, a second acquisition unit that acquires position information of a plurality of other devices, and the second acquisition unit. A calculation unit that calculates second position information based on a plurality of pieces of position information. When the first acquisition unit acquires first position information, the first acquisition unit selects and outputs the first position information. When the position information is not acquired, the control unit selects the second position information and functions as a control unit that generates and outputs an authentication request including the selected position information. An information processing program characterized by further including, in the authentication request, location type information indicating whether the location information is first location information or second location information.

  The present invention can perform authentication based on position information even when the terminal device cannot acquire its own position information.

It is a structural example of the authentication system based on Example 1 of this invention. It is the figure which showed the structure of the terminal device based on the Example of this invention. It is the figure which showed the flow of the process based on Example 1 of this invention. It is the figure which showed the structure of the authentication server based on the Example of this invention. It is an example of a structure of the authentication system based on Example 2 of this invention. It is the figure which showed the flow of the process based on Example 2 of this invention. It is the figure which showed the sequence based on Example 2 of this invention. It is the figure which showed the flow of the process based on the modification of Example 2 of this invention.

Example 1
Before describing the present invention specifically, an outline will be given first.

  FIG. 1 is a diagram illustrating a configuration of an authentication system according to the first embodiment of the present invention. The authentication system according to the embodiment of the present invention includes an authentication server 10, a terminal device 20, a GPS function-equipped device 30, and a router 40.

  The terminal device 20 is connected to the same LAN (Local Area Network) 50 as the device 30 with a GPS function. The LAN 50 is connected to the Internet via the router 40. The terminal device 20 acquires its current location information by receiving radio waves from GPS satellites, and transmits an authentication request including this location information to the authentication server 10 connected to the Internet via the LAN 50. Further, when the terminal device 20 cannot receive the GPS satellite radio wave and cannot acquire its current position information, the terminal device 20 requests the other device connected to the LAN 50 to transmit the current position information of the device. . When the GPS function-equipped device 30 receives the current location information transmission request and can acquire its current location information by receiving radio waves of GPS satellites, etc., the device 30 with the GPS function receives its current location information. Send. When receiving the current location information from another device, the terminal device 20 transmits an authentication request including the received location information to the authentication server 10 via the LAN 50.

  When the authentication server 10 accepts the authentication request from the terminal device 20, whether or not the location based on the location information included in the authentication request is within the area where the authentication result stored in advance in the authentication server 10 is allowed. If it is entered, the authentication result is accepted.

  Other devices connected to the same LAN 50 as the LAN 50 to which the terminal device 20 is connected are more likely to be physically located closer to the terminal device 20 than devices connected to different networks. . Also, since LANs are generally used in the same premises (in the same building, etc.), the position between devices connected in the same LAN is generally limited to the range of the premises such as buildings. . Therefore, if the size of the area that allows the authentication result stored in advance by the authentication server 10 is set as an area that assumes this local area, the position information acquired by the terminal device 20 from the device 30 with the GPS function is obtained. The authentication request including the authentication result is permitted in the authentication server 10. The authentication server 10 permits the terminal device 20 that has accepted the authentication result to thereafter provide a predetermined service.

  As described above, even when the terminal device 20 cannot receive the GPS satellite radio wave and cannot acquire the current position information, authentication based on the position information can be performed.

  The terminal device 20 can also be used as the device 30 with GPS function. For example, a plurality of terminal devices 20 may be connected to the LAN 50, and one terminal device 20 may be configured to acquire current position information from another terminal device 20.

  FIG. 2 shows a configuration of the terminal device 20 according to the first embodiment of the present invention. The terminal device 20 includes a GPS radio wave receiver 21, a first location information acquisition unit 22, a network communication unit 23, a second location information acquisition unit 24, an authentication request unit 25, and a control unit 26. The terminal device 20 is, for example, a smartphone, a mobile phone, a notebook computer, a desktop computer, or the like, but is not limited thereto, and the shape and size thereof are not limited.

  The GPS radio wave receiving unit 21 is connected to a GPS satellite antenna and outputs a GPS satellite signal received by the GPS satellite antenna.

  The first position information acquisition unit 22 acquires its current position information (latitude, longitude, etc.) based on a GPS satellite signal input from the GPS radio wave reception unit 21 in response to a request for current position information from the control unit 26. . The acquired current position information is output to the control unit 26. The current position information of the terminal device 20 may be acquired using information different from the GPS satellite signal. For example, the current position information may be acquired using information related to a wireless LAN access point, or the current position information may be acquired using information related to a mobile phone or a base station of a commercial wireless system. In such a case, the GPS radio wave receiver 21 can be omitted. Similarly, the device 30 with a GPS function may acquire position information using information other than GPS.

  The network communication unit 23 is connected to the LAN 50 and enables IP network communication between the terminal device 20 and other devices connected to the LAN 50. In addition, when communicating with the authentication server 10, the network communication part 23 may be used and another communication means (not shown) may be used.

  The second location information acquisition unit 24 receives the request for the current location information from the control unit 26 as an opportunity for all other devices connected to the LAN 50 via the network communication unit 23 to store the current location information of the device. Request transmission. A request for all the other devices connected to the LAN 50 may use a known technique such as a broadcast communication technique. At this time, it is desirable to limit the transmission range to the network segment to which the terminal device 20 is connected using local broadcast (limited broadcast) or the like. A set work segment may be a transmission target. In addition, when another network segment is included in the transmission target, only the network segment corresponding to a predetermined number of hops or less may be targeted. Further, when the terminal device 20 has information such as the IP address of the GPS function-equipped device 30 connected to the LAN 50 in advance, the device 30 with the GPS function is individually (unicast) without using broadcast. Alternatively, a request for transmission of current position information may be made. The second position information acquisition unit 24 acquires the current position information transmitted from another device corresponding to the request for transmission of the current position information via the network communication unit 23. The second position information acquisition unit 24 outputs the acquired current position information to the control unit 26.

  The authentication request unit 25 inputs current position information from the control unit 26. Further, when the current position information is input, the authentication request unit 25 makes an authentication request including the current position information to the authentication server 10 via the network communication unit 23.

  The control unit 26 receives an authentication request from the user from an operation unit (not shown). Upon receiving an authentication request from the user, the control unit 26 requests the first information acquisition unit 22 for current position information. When the current position information cannot be acquired from the first information acquisition unit 22, the current position information is requested to the second information acquisition unit 24. The control unit 26 outputs the current position information acquired from the first information acquisition unit 22 or the second information acquisition unit 24 to the authentication request unit 25.

  The authentication request unit 25 and the control unit 26 are integrally configured as an authentication request unit 25, and the operations of the authentication request unit 25 and the control unit 26 described above and later will be performed as the authentication request unit 25. Also good.

  The operation of the terminal device 20 having the above configuration will be described.

  FIG. 3 is a flowchart illustrating the flow of processing by the terminal device 20 according to the present embodiment.

  The control unit 26 receives an authentication request instruction from the user (S10). When receiving the authentication request, the control unit 26 requests the first information acquisition unit 22 for the current position information (S11). When the first information acquisition unit 22 is requested for the current position information, the first information acquisition unit 22 can acquire the current position information based on the GPS satellite signal input from the GPS radio wave reception unit 21. (Yes in S12). If the current position information cannot be acquired because the GPS radio wave cannot be received indoors or the like, the position information is not output to the control unit 26 (No in S12).

  In the case of Yes in step S12, the control unit 26 includes the current location information acquired in step S12 in the authentication request via the authentication request unit 25 and the network communication unit 23, and transmits the authentication request to the authentication server 10 (S17). .

  In the case of No in step S12, the control unit 26 requests current position information from the second information acquisition unit 24 (S13). When requested for the current location information, the second information acquisition unit 24 requests the other device connected to the LAN 50 to transmit the current location information of the device via the network communication unit 23. When the current position information is received from the device 30 with GPS function (another device) that has received the request, the acquired position information is output to the control unit 26 (Yes in S14). If there is no device connected to the LAN 50, or all other devices connected to the LAN 50 cannot receive the current location information because they do not respond to a request for transmission of the current location information. The position information is not output to the control unit 26 (No in S14).

  In the case of Yes in step S14, the control unit 26 includes the current position information acquired in step S14 in the authentication request via the authentication request unit 25 and the network communication unit 23, and transmits the authentication request to the authentication server 10 (S16). .

  In the case of No in step S14, the control unit 26 transmits an authentication request not including position information to the authentication server 10 (S15). In this case, some information indicating that the position information is unknown may be included in the position information, or no information related to the position information may be included in the authentication request.

  Note that the second information acquisition unit 24 sends a request for transmission of the current position information of the device to another device connected to the LAN 50 before the predetermined time elapses. Only when the current position information is received, the acquired position information may be output to the control unit 26 (Yes in S14). This is based on the assumption that the time required for transmission / reception with another device has a corresponding relationship with the physical distance between the terminal device 20 and the other device. This is because the position information is not used on the assumption that the physical distance from the apparatus is a predetermined distance or more. Further, the number of hops from the terminal device 20 to another device that has transmitted the position information is measured, and the acquired position information is output to the control unit 26 only when the number of hops is equal to or less than the predetermined number (Yes in S14). You may do it. When current position information is received from a plurality of other devices, only the first received current position information is output to the control unit 26 (Yes in S14). Or, when the current position information is received from a plurality of other devices, a plurality of representative values (average value, median value, mode value, quartile value, etc.) of the received current position information are calculated. One current position information may be derived based on the current position information and output to the control unit 26. Furthermore, when current location information is received from a plurality of other devices, each current location information is weighted using the time required for transmission / reception with other devices and the number of hops with other devices. Current position information may be derived. For example, the smaller the time required for transmission / reception and the number of hops, the larger the weight coefficient of the corresponding current position information may be weighted and averaged to derive one current position information.

  FIG. 4 shows the configuration of the authentication server 10 according to the first embodiment of the present invention. The authentication server 10 includes a network communication unit 11, a storage unit 12, and a control unit 13.

  The network communication unit 11 is connected to a communication line, and enables IP network communication between the authentication server 10 and another device connected to the communication line.

  The storage unit 12 stores in advance area information used when determining whether or not an authentication request is possible. The contents of the area information are set assuming an area where the terminal device to be authenticated is used normally by the administrator of the authentication server.

  The control unit 13 accepts an authentication request including location information via the network communication unit 11. When the control unit 13 receives the authentication request including the position information, the control unit 13 determines whether a position based on the position information is included in the area stored in the storage unit 12, and if included, the authentication is performed. The result is allowed, and if it is not included, the authentication result is not allowed. Further, if the location information of the authentication request is unknown or if the location information is not included in the authentication request, the authentication result is disabled. If the authentication result based on the position information becomes impossible, authentication may be performed using another authentication means such as password authentication or biometric authentication.

  When the terminal device 20 transmits an authentication request to the authentication server 10, the current position information included in the authentication request is the position information of the terminal device 20 itself (corresponding to S17), or the position of another device. Information (position type information) that can be identified as information (corresponding to S16) may be included in the authentication request. The authentication server 10 may further perform an authentication process using the location type information when the location type information is included in the authentication request. For example, when the location information is the terminal device 20 itself, the user using the terminal device 20 can use all kinds of services, and when the location information is other device, some services are available. You may apply usage restrictions such as only being available. Further, when the position type information is the position information of the terminal device 20 itself, the service including the service that requires the system administrator authority is provided. When the position type information is the position information of another apparatus, the system administrator authority is provided. It is also possible to provide only services that can be executed with end user authority. In other words, the authentication result is subdivided into three or more levels, multiple types (multiple levels) “permitted” and “not permitted” are set, and one of a plurality of types “permitted” is selected according to the position type information. It may be selected and used as an authentication result. Furthermore, the time information required for acquiring the position information from another device may be included in the authentication request, and the operation of the authentication server 10 may be changed accordingly.

In the configuration of the terminal device 20, the first position information acquisition unit 22 may be omitted. In that case, steps S11, S12, and S17 may be omitted in the flowchart of FIG. 3, and step S13 may be executed after step S10. With such a configuration, more various devices can be used as the terminal device 20.
(Example 2)
Next, Example 2 will be described. The second embodiment also relates to an authentication system using position information as in the first embodiment. Hereinafter, a description will be given centering on differences from the first embodiment.

  FIG. 5 is a diagram illustrating the configuration of the authentication system according to the second embodiment of the present invention. The router 40 provides a function as a proxy server (relay device) in addition to a routing function. When an authentication request is transmitted from the terminal devices 20 a and 20 b connected to the LAN 50 to the authentication server 10, the authentication request is transmitted via the router 40. When the router 40 transmits this authentication request to the authentication server 10, the router 40 rewrites the transmission source IP address in the header of the IP packet including the authentication request with the IP address of the router 40. Therefore, when the authentication server 10 receives an authentication request from any terminal device 20 connected to the LAN 50, the transmission source IP address is the IP address of the router 40. As described above, each device connected to the LAN 50 has a high probability of being physically located. Based on this characteristic, the authentication server 10 determines that the authentication request having the same transmission source IP address is transmitted from any one of the terminal devices 20 that are physically close to each other.

  As in the first embodiment, the authentication server 10 performs authentication based on the position information included in the authentication request. However, if the authentication result is acceptable, the source IP address is stored. After that, when the authentication request is accepted, if the location information included in the authentication request is unknown and the location information is not included in the authentication request, the source IP address stored in the previously stored source IP If it is the same as the address, the authentication result is acceptable. This is a response assuming that the terminal device 20 that has transmitted the authentication request cannot acquire its current location information for some reason.

  As described above, even when the terminal device 20 cannot receive GPS radio waves by itself and cannot acquire current position information, authentication based on the position information can be performed.

  The configuration and procedure of the terminal device 20 according to the second embodiment of the present invention can be the same as those in the first embodiment. Note that the second information acquisition unit 24 may be omitted. In this case, the processes in steps S13, S14, and S16 in FIG. 3 are not performed, and if No in step S12, the process proceeds to step S15. Further, as described above, the authentication request unit 25 and the control unit 26 may be integrally configured, and for example, the authentication request unit 25 may be configured to perform each process of steps S10, S12, S15, and S17. .

  The configuration of the authentication server 10 according to the second embodiment of the present invention is the same as that of the first embodiment and is as shown in FIG. The storage unit 12 stores source IP address information in addition to area information in addition to the description in the first embodiment. The storage unit 12 may be divided into a first storage unit that stores area information and a second storage unit that stores transmission source IP address information. The control unit 13 stores, in addition to the location information described in the first embodiment, a transmission source IP address (hereinafter referred to as a transmission source IP address of the authentication request) described in the header of the IP packet including the received authentication request. 12 is stored. The control unit 13 reads the transmission source IP address stored in the storage unit 12. Furthermore, the control unit 13 has a time counting function, and when a predetermined time (for example, 8 hours) has elapsed since the transmission source IP address is stored in the storage unit 12, the transmission source IP stored in the storage unit 12 is stored. The address may be deleted.

  FIG. 6 is a flowchart illustrating a processing procedure performed by the authentication server 10. At the start of this flowchart, the storage unit 12 does not store an authenticated IP address. Further, the control unit 13 does not measure the time for the predetermined time described above.

  The control unit 13 accepts the authentication request via the network communication unit 11 (S20). The control unit 13 determines whether or not position information is included in the authentication request (S21). If Yes in step S21, the process proceeds to step S22. If No, the process proceeds to step S25. The control unit 13 determines whether a position based on the position information included in the authentication request is included in the area stored in the storage unit 12 (S22). In the case of Yes in step S22, the control unit 13 stores the transmission source IP address of the accepted authentication request in the storage unit 12 as an authenticated IP address (registered IP address) and starts timing for each authenticated IP address. (S23). After step 23, the control unit 13 accepts the accepted authentication request result (S24). If No in step S22, the accepted authentication request result is disabled (S28). In addition, the control unit 13 determines whether there is an authenticated IP address whose measured time (elapsed time from the time of registration in the storage unit 12) is equal to or longer than a predetermined time (for example, 8 hours) (S25). In the case of Yes in step S25, the control unit 13 deletes the authenticated IP address whose elapsed time is equal to or longer than the predetermined time from the storage unit 12 (S26). After step S26 and in the case of No in step S25, it is determined whether or not the transmission source IP address of the accepted authentication request matches the authenticated IP address stored in the storage unit 12 (S27). In the case of Yes in S27, the control unit 13 permits the accepted authentication request result (S24). In the case of No in S27, the control unit 13 disables the accepted authentication request result (S28). After steps 24 and 28, the process returns to step S20.

  Note that in step S23, instead of starting timing for each authenticated IP address, the authenticated IP address is associated with information (registration date and time) indicating the time when it is registered in the storage unit 12. May be stored. In that case, in step S25, a difference (elapsed time) between the current date and time and each registered date and time stored in the storage unit 12 is calculated, and there is an authenticated IP address whose elapsed time is equal to or longer than a predetermined time. Or not.

  Further, not only binary determination that the result of the authentication request is acceptable but also possible, the authentication result of three or more stages may be output. For example, in determining whether two IP addresses match in step S27, it is possible to use the elapsed time of the authenticated IP address to determine that authentication for a wider range of services is possible as the elapsed time is shorter. Good. For example, if the elapsed time is less than 1 hour, all services including use of services that require administrator authority are permitted. If the elapsed time is 1 hour or more and less than 4 hours, the administrator authority is Only services that can be used with general user authority excluding necessary services are permitted, and when the elapsed time is 4 hours or more and less than 8 hours, it can be used with guest user authority more limited than general user authority. Processing such as permitting use of only the service may be performed.

  Also in the present embodiment, when the terminal device 20 transmits an authentication request to the authentication server 10, the current position information included in the authentication request is the position information of the terminal device 20 itself, or other device's Information (position type information) that can be identified as position information may be included in the authentication request. Then, the authentication server 10 may further perform authentication processing using the position type information. Specifically, first, the authentication result is subdivided into three or more levels, and multiple types (multiple levels) “OK” and “NO” are set. In step S22, when the position information is within the area, one of a plurality of types “permitted” is selected according to the position type information, and the result is used as an authentication result. In step S23, the authenticated IP address and the location type information included in the authentication request are associated with each other and stored in the storage unit 12. In step S27, an authenticated IP address that matches the source IP address of the accepted authentication request is specified, position type information corresponding to the specified IP address is acquired, and an authentication result is determined accordingly. That is, if there is an authenticated IP address that matches the source IP address of the accepted authentication request, one of a plurality of types of “permitted” is selected according to the location type information corresponding to the authenticated IP address. Select it as the authentication result.

  As shown in FIG. 5, the second embodiment in which the terminal device 20a capable of receiving GPS satellite radio waves and the terminal device 20b not receiving GPS satellite radio waves due to poor reception environment are connected to the LAN 50. An example of the sequence will be described below.

  FIG. 7 is an example of a sequence diagram when an authentication request is transmitted from the terminal devices 20 a and 20 b to the authentication server 10.

  The terminal device 20a acquires its current position information by receiving radio waves from the GPS satellite, includes the position information in the authentication request, and transmits the authentication request to the authentication server 10. The IP address (for example, 192.168.1.1) of the terminal device 20a is set as the source IP address of this authentication request. The authentication request transmitted from the terminal device 20a to the authentication server 10 is temporarily received by the router 40 (S71). Upon receiving this authentication request, the router 40 sets the source IP address of this authentication request to the IP address (for example, 123.4.5.6) of the router 40, and transmits this authentication request to the authentication server 10 (S72). Upon receiving this authentication request, the authentication server 10 determines whether or not the area stored in the storage unit 12 includes a position based on the position information included in the authentication request, as described above. If it is, the transmission source IP address of the authentication request is stored as an authenticated IP address in the storage unit 12 (S73), and the authentication result is permitted (S74).

  The terminal device 20b transmits the authentication request to the authentication server 10 after the terminal device 20a transmits the authentication request. Since the terminal device 20b cannot receive the radio wave of the GPS satellite and cannot acquire its current position information, the terminal apparatus 20b does not include the position information (refer to S15 in FIG. 3) and transmits an authentication request (S75). The IP address (for example, 192.168.1.2) of the terminal device 20b is set as the source IP address of this authentication request. As in S72, when receiving the authentication request, the router 40 sets the source IP address of the authentication request to the IP address (for example, 123.4.5.6) of the router 40, and transmits the authentication request to the authentication server 10. (S76). When the authentication server 10 receives this authentication request, there is no location information included in the authentication request. Therefore, the authentication result is not accepted based on the location information, and the authentication stored in the transmission source IP address and the storage unit 12 is performed. It is determined whether or not the IP addresses that have already been matched (S77). In the above description, the determination of whether or not the time measured in step S22 of FIG. 6 is equal to or longer than a predetermined time (for example, 8 hours) is Yes, and the description is omitted.

  In the above description, the router 40 has a function as a proxy server. However, the router 40 may be configured not to have a proxy server function. In that case, the source IP address of the IP packet corresponding to the authentication request received by the server 10 is the IP address of the terminal device 20. Accordingly, in the example shown in FIG. 7, the source IP addresses corresponding to the terminal devices 20a and 20b are different from each other. In order to cope with this, instead of determining whether or not the source IP address of the accepted authentication request matches the authenticated IP address stored in the storage unit 12 in step S27, the control unit 13 It is determined whether a predetermined part of the IP address matches. For example, in the IPv4 32-bit address, the upper 24 bits may be set as a predetermined part, and it may be determined whether or not the part matches. The processing is based on the assumption that the IP addresses of the terminal devices that are physically close to each other have a high probability that the upper bits match. If the predetermined portion is the entire IP address (32 bits of IPv4), the processing is the same as the above-described complete matching process.

  Further, the predetermined portion described above may be changed according to the registered IP address stored in the storage unit 12 and the source IP address of the accepted authentication request. Specifically, in the initial setting, the upper N1 bits (for example, N1 = 24) of the IPv4 address are set as the predetermined portion. When it is confirmed that the registered IP address stored in the storage unit 12 has an IP address that matches the transmission source IP address of the accepted authentication request and the upper N2 bits (N2> N1), this predetermined address The portion may be changed to upper N2 bits. For example, when it is confirmed that there is a registered IP address that completely matches the transmission source IP address of the accepted authentication request (N2 = 32), the predetermined portion may be set to the upper 32 bits. By performing such processing, even if it is unclear whether or not the terminal device 20 connects to the authentication server 10 via a proxy server, more appropriate authentication processing can be flexibly performed.

  Moreover, the following can be considered as a modification of Example 2.

The storage unit 12 stores location information associated with the transmission source IP address in addition to the area information and the transmission source IP address.

  FIG. 8 is a flowchart showing a processing procedure by the authentication server 10 in this modification. Steps having the same step numbers as the step numbers included in FIG.

  If Yes in step S21, the control unit 13 stores the received IP address of the authentication request in association with the location information included in the authentication request in the storage unit 12 (S31). In the case of No in step S21, the control unit 13 determines whether or not an IP address that matches the transmission source IP address of the accepted authentication request is stored in the storage unit 12 (S32). If No in step S32, the process proceeds to step S28. If Yes in step S32, the location information associated with the IP address that matches the source IP address of the accepted authentication request is substituted as the location information of the accepted authentication request (S33). In this case, in step S <b> 22, based on the position information substituted in step 33, it is determined whether or not it is included in the area stored in the storage unit 12.

  This modification is effective when the area information stored in the storage unit 12 is changed from the outside after the process of step S31 is performed once or more. For example, (1) the authentication server receives an authentication request including location information that is not included in the area stored in the storage unit 12, and the IP address and location information are stored in the storage unit 12 (S31), and the authentication result Becomes impossible. Next, (2) the area information stored in the storage unit 12 is changed from the outside, and the position information (1) is included in the area. Next, (3) when the authentication request source IP address is the same as the IP address of (1) and an authentication request that does not include location information is accepted, steps S32 and S33 of this modification example , S22 enables the authentication result (S24). On the other hand, in the case of the processing according to the flowchart of FIG. 6 of the second embodiment, the IP address is not stored in the storage unit 12 in the authentication request of (1), so the authentication request of (3) becomes No in step S27. The authentication result is disabled (S28). Also in this modified example, as described above, information (registration date and time) indicating the point in time when the authenticated IP address is registered in the storage unit 12 may be stored in the storage unit 12. Specifically, in step S31, the control unit 13 may store the received IP address of the authentication request, the position information included in the authentication request, and the registration date and time in the storage unit 12.

  Also in this modified example, as described above, after including the position type information in the authentication request transmitted from the terminal device 20, the authentication server 10 further performs an authentication process using the position type information. You may do it. Specifically, in step S31, the IP address, the position information, and the position type information are associated with each other and stored in the storage unit 12. In step S33, referring to the storage unit 12, the location information and location type information associated with the IP address that matches the source IP address of the accepted authentication request are acquired. In step S22, when the position information is within the area, the position type information is further used to select one of a plurality of types of “permitted” to obtain an authentication result.

  In addition, in step S32 of this modification, instead of determining whether or not the transmission source IP address of the accepted authentication request matches the authenticated IP address stored in the storage unit 12, a predetermined part of both IP addresses It may be determined whether or not. For example, the upper 24 bits of the IPv4 32-bit address may be set as a predetermined part, and it may be determined whether or not the part matches. Also in this modified example, as described above, the predetermined portion described above may be changed according to the registered IP address stored in the storage unit 12 and the source IP address of the accepted authentication request.

  In addition, when there are a plurality of IP addresses that match the predetermined part, the authentication result may be determined according to the number of pieces of position information corresponding to the respective IP addresses in the area. For example, if there are five IP addresses that match the predetermined part, the authentication result is acceptable if the position information of a predetermined number (for example, three) or more among the five pieces of position information corresponding to them is in the area. And Alternatively, if there is even one out of the area, the authentication result may be disabled. In addition, when there are a plurality of IP addresses that match the predetermined part, representative values (average values such as latitude and longitude, median value, mode value, quartile value, etc.) of a plurality of position information corresponding to them are displayed. It may be calculated to determine whether the representative value is within the area.

  Further, as described above, the elapsed time from the time when the authenticated IP address is registered in the storage unit 12 is calculated, and when there are a plurality of IP addresses that match the predetermined part, the IP address with the shortest elapsed time is calculated. You may make it use the positional information corresponding to.

  In the above, it demonstrated based on the Example of this invention. This embodiment is an exemplification, and it will be understood by those skilled in the art that various modifications can be made to combinations of the respective components and processing processes, and such modifications are also within the scope of the present invention. is there.

  The configuration described with reference to FIGS. 2 and 4 can be realized in terms of hardware by a CPU, memory, or other LSI of an arbitrary computer, and can be realized in terms of software by a program loaded in the memory. However, here, functional blocks that are realized by their cooperation are depicted. Accordingly, those skilled in the art will understand that these functional blocks are realized in various forms by hardware only, software only, or a combination thereof.

DESCRIPTION OF SYMBOLS 10 Authentication server 11 Network communication part 12 Storage part 13 Control part 20 Terminal device 21 GPS radio wave receiving part 22 1st positional information acquisition part 23 Network communication part 24 2nd positional information acquisition part 25 Authentication request part 26 Control part 30 With GPS function Device 40 Router 50 LAN

Claims (8)

A first acquisition unit that acquires first position information indicating its own position information;
A second acquisition unit that acquires position information of a plurality of other devices,
A calculation unit that calculates second position information based on a plurality of pieces of position information acquired by the second acquisition unit;
When the first acquisition unit acquires the first position information, the first position information is selected. When the first acquisition unit does not acquire the first position information, the second position information is selected, and the selection is performed. A control unit for creating an authentication request including the location information,
Equipped with a,
The second acquisition unit communicates with each of the plurality of other devices to acquire position information of the plurality of other devices,
The calculation unit weights each of the plurality of pieces of position information acquired by the second acquisition unit according to a value relating to the number of relays in a communication path with each of the plurality of other devices, and outputs second position information The terminal device characterized by calculating . The calculation unit increases the weighting coefficient for each of the plurality of pieces of position information acquired by the second acquisition unit as the value related to the number of relays in the communication path with each of the plurality of other devices decreases. Calculate information,
The terminal device according to claim 1. A first acquisition unit that acquires first position information indicating its own position information;
A second acquisition unit that acquires position information of a plurality of other devices,
A calculation unit that calculates second position information based on a plurality of pieces of position information acquired by the second acquisition unit;
When the first acquisition unit acquires the first position information, the first position information is selected. When the first acquisition unit does not acquire the first position information, the second position information is selected, and the selection is performed. A control unit for creating an authentication request including the location information,
With
The control unit further includes location type information indicating whether the selected location information is first location information or second location information in an authentication request;
End terminal device you wherein a. The calculation unit calculates a representative value or a weighted average value of a plurality of pieces of position information acquired by the second acquisition unit, and sets the calculated value as second position information .
The terminal device according to claim 3. An information processing method executed by a computer,
  A first acquisition step of acquiring first position information indicating its own position information;
  A second acquisition step of respectively acquiring position information of a plurality of other devices;
  A calculation step of calculating second position information based on the plurality of position information acquired in the second acquisition step;
  When the first position information is acquired by the first acquisition step, the first position information is selected and output. When the first position information is not acquired by the first acquisition step, the second position information is selected, A control step of generating and generating an authentication request including the selected location information;
  Including
  The second acquisition step performs communication with each of the plurality of other devices to acquire position information of the plurality of other devices,
  The calculation step weights each of the plurality of pieces of position information acquired in the second acquisition step according to a value relating to the number of relays in a communication path with each of the plurality of other devices, and second position information To calculate,
  An information processing method characterized by the above.    An information processing method executed by a computer,
  A first acquisition step of acquiring first position information indicating its own position information;
  A second acquisition step of respectively acquiring position information of a plurality of other devices;
  A calculation step of calculating second position information based on the plurality of position information acquired in the second acquisition step;
  When the first position information is acquired by the first acquisition step, the first position information is selected and output. When the first position information is not acquired by the first acquisition step, the second position information is selected, A control step of generating and generating an authentication request including the selected location information;
  Including
  The control step further includes location type information indicating whether the selected location information is first location information or second location information in an authentication request;
  An information processing method characterized by the above. The computer,
A first acquisition unit that acquires first position information indicating its own position information;
A second acquisition unit for acquiring position information of a plurality of other devices,
A calculation unit that calculates second position information based on a plurality of pieces of position information acquired by the second acquisition unit;
When the first acquisition unit acquires the first position information, the first position information is selected and output. When the first acquisition unit does not acquire the first position information, the second position information is selected. A control unit that generates and outputs an authentication request including the selected location information;
Function as
The second acquisition unit communicates with each of the plurality of other devices to acquire position information of the plurality of other devices,
The calculation unit weights each of the plurality of pieces of position information acquired by the second acquisition unit according to a value relating to the number of relays in a communication path with each of the plurality of other devices, and outputs second position information To calculate,
An information processing program characterized by that. Computer
A first acquisition unit that acquires first position information indicating its own position information;
A second acquisition unit for acquiring position information of a plurality of other devices,
A calculation unit that calculates second position information based on a plurality of pieces of position information acquired by the second acquisition unit;
When the first acquisition unit acquires the first position information, the first position information is selected and output. When the first acquisition unit does not acquire the first position information, the second position information is selected. A control unit that generates and outputs an authentication request including the selected location information;
To function as,
The control unit further includes location type information indicating whether the selected location information is first location information or second location information in an authentication request;
An information processing program characterized by that.

Images