JP2002007345A - User authenticating method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a user authenticating method, by which a high security level is secured by authenticating both a user, who performs access, and his/her portable communication terminal while relating them to each other. SOLUTION: The user authenticating method for authenticating a user, who requests a session with the non-disclosed area of the Intranet while using the portable communication terminal, is provided with a process for authenticating first authentication information inputted by the user, who accesses the disclosed area, process for issuing and preserving a session identifier for authenticating the session between the authenticated user and the disclosed area, process for transmitting the URL, which is provided by adding the session identifier, of a disclosed area to authenticate the session identifier to the portable communication terminal of the user, and process for authenticating the session between the user and the non-disclosed area by performing the authentication by inquiring the session identifier contained in the URL provided from the portable communication terminal, which accesses the disclosed area again.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a user authentication method for authenticating a user who requests a session with a computer or a private area of an intranet using a portable communication terminal, and more particularly, to a user authentication method using a portable telephone via the Internet. User authentication method for a session with a server on a company intranet.

[0002]

2. Description of the Related Art In a general network system, a network user has a user identifier and a password, and when a network administrator authenticates them, a session with a private area of the network is permitted. You. 2. Description of the Related Art Today, various mobile communication terminals have become widespread, and a method of using them to access a specific network via the Internet has been provided. For example, i-mode provided by NTT DoCoMo, Inc., and EZwe provided by the DDI group
A system has been constructed in which a mobile phone or a mobile terminal capable of using the service b is distributed to users of a corporate network, and the users can access a server on a corporate intranet using the mobile phone or mobile terminal. With this system,
When information is needed, the user can access the intranet server and extract necessary information.

[0003]

However, in the conventional network system, it is possible to authenticate an individual who has accessed the network using the portable communication terminal from the user identifier and the password. It was unknown whether it was the user's own. In other words, there was no guarantee that the person accessing the server on the network was a legitimate user. This is because there is a possibility that a user identifier and a password for performing personal authentication of a user are stolen by some means and used to invade a network server. Therefore, in the case of a network using the above-described mobile communication terminal as a client,
There is a problem that a person who has illegally obtained the user identifier and the password can enter the network if he or she has a mobile communication terminal. Leakage of a user identifier and a password is possible, and there is a need for a security system that protects against the leakage, that is, a security system in which personal authentication of a user is not performed using only the user identifier and the password.

SUMMARY OF THE INVENTION The present invention has been made in view of the above-mentioned problems, and an object of the present invention is to provide a system for accessing a network via the Internet using a portable communication terminal, in which the accessing user and the portable communication terminal are connected. An object of the present invention is to provide a user authentication method in which a high security level is ensured by performing authentication in association with each other.

[0005]

A first feature of a user authentication method according to the present invention for achieving the above object is to provide a portable communication terminal as described in claim 1 of the claims. A user authentication method for authenticating a user who makes a session request through a communication path inside a computer or a closed area of an intranet using the user who has accessed the inside of the computer or the open area of the intranet. A first authentication step of authenticating the input first authentication information, a session identifier issuing step of issuing a session identifier for authenticating a session between the authenticated user and the private area, and storing the session identifier in a database; , Wherein said session identifier obtained by adding said session identifier is authenticated. A URL transmitting step for transmitting the rear of URL in the portable communication terminal of said user, said U provided from the mobile communication terminal re-access to said open area
The second authentication information comprising the session identifier included in the RL is queried in the database to authenticate the second authentication information, whereby the session between the user and the closed area is authenticated. And the authentication step.

A second characteristic configuration of the user authentication method according to the present invention for achieving the above object is, in addition to the first characteristic configuration, described in claim 2 of the claims. In a case where the user who has received the URL by the URL transmission step accesses the public area at least once and the second authentication step is performed at least once, the first authentication is performed before each of the second authentication steps. The point is that the process is performed. Once user authentication has been performed, if a session with the closed area is desired again, user authentication can be started from the second authentication step. Therefore, the second authentication step may be performed a plurality of times. In this case,
Prior to each second authentication step, a first authentication step is performed.

[0007] A third characteristic configuration of the user authentication method according to the present invention for achieving the above object is the same as the first or second characteristic configuration, as described in claim 3 of the claims. In addition, the first authentication information is a user identifier and a password unique to the user.

[0008] A fourth characteristic configuration of the user authentication method according to the present invention for achieving the above object is as described in claim 4 of the claims. In addition to the characteristic configuration, the session identifier has an expiration date.

The operation and effect will be described below. According to the first characteristic configuration of the user authentication method according to the present invention, when a user accesses via a communication path, and the user is authenticated as a valid user, the mobile phone carried by the user is Return a response to the communication terminal, requesting the user to re-access using the mobile communication terminal,
By performing further authentication, not only input information such as a user identifier and a password from the user, but also a high-security level authentication method including two-step authentication of authenticating the user's mobile communication terminal can be implemented. In other words, even if the user knows the user-specific information that is required to be input in the first authentication step, if the user does not access from the mobile communication terminal of the user himself, the user may enter the inside of the computer or the private area of the intranet. Can not. As a result, even if the user identifier and the password are leaked, the inside of the computer or the closed area of the intranet is not intruded from the outside.

[0010] The private area inside the computer is a file or application stored in a storage device of the computer, for example, which is set with a password and can be accessed only by an authorized person. Is a file or application that has no password set and can be accessed freely. The storage device of the computer may be built in the computer or connected to the outside of the computer. The non-public area of the intranet is, for example, a storage device such as a server or database connected to each other to which a password is set and which can be accessed only by an authorized person, and the public area is set with a password and the like. Storage devices such as servers or databases connected to each other that can be freely accessed.

According to the second characteristic configuration of the user authentication method according to the present invention, the first authentication step does not require the input of the password, and the step of requesting the input of the user identifier and the password before the second authentication step is performed. It is possible to do the first
The authentication process can be simplified. Even in this case, since the user identifier has been entered in the first authentication step, it is possible to search for the e-mail address therefrom, and the same operation and effect as the above-mentioned third characteristic configuration can be obtained. Obtainable. Further, when a user who has already received the URL attempts to authenticate the session identifier, the user can proceed to the second authentication step immediately after performing the first authentication step.

According to the third characteristic configuration of the user authentication method according to the present invention, since the first authentication information is the user identifier and the password unique to the user, the first authentication of the accessing user is performed by the first authentication information. be able to. Further, since it is possible to search for the e-mail address of the user's mobile communication terminal using the input user identifier, an e-mail requesting re-access is sent to the user's mobile communication terminal, and the re-access from the mobile communication terminal is performed. By performing the access, the object of authenticating the mobile communication terminal can also be achieved.

[0013] According to the fourth feature of the user authentication method according to the present invention, since the session identifier has an expiration date, when a person who attempts to intrude attempts to obtain the session identifier, the user is given a key to find the session identifier. The time taken is short and it is virtually impossible to obtain a session identifier illegally. As a result, it is possible to provide a user authentication method in which the security level is maintained at a constant level even after a lapse of time.

[0014]

FIG. 1 is a diagram showing a system configuration of a network comprising a portable communication terminal 1, an Internet network 2, and an intranet 3. As shown in FIG. As the mobile communication terminal 1, a mobile phone or a mobile information terminal capable of using a service such as i-mode or EZweb is used. The intranet 3 is connected to the Internet 2 via a firewall 4,
It is composed of a public area 5 that is freely accessible to the outside and an in-house LAN (local area network) 6 that is a private area that can be accessed only by a person who has been authenticated. In addition to the intranet server 9, a server such as a database server 7 for managing a database 8 storing employee schedules and the like, and a terminal device 10 are installed on the LAN 6. Also, in the public area 5,
Various contents that can be used by the mobile communication terminal 1 as described above are placed, and the mobile communication terminal 1 uses the LAN 6
A portable application server 11 in which schedule management software or the like for accessing the above data is installed is arranged. Only the user of the mobile communication terminal 1 that has been authenticated in the open area 5 can hold a session with a server or terminal device in the LAN 6 that is a closed area via the mobile application server 11. Although an intranet configured by a plurality of computers or servers is illustrated in the figure, they may be stand-alone computers. In this case, the public area and the private area are arbitrarily set in a storage area of a storage device included in the computer.

Next, a user authentication method according to the present invention for authenticating a user who has made a session request using the portable communication terminal 1 will be described. A user authentication method for authenticating a user who makes a session request with the inside of a computer or a closed area of an intranet via a communication path using a portable communication terminal is input by a user who has accessed the inside of the computer or the open area of the intranet. A first authentication step of authenticating the obtained first authentication information, a session identifier issuing step of issuing a session identifier for authenticating a session between the authenticated user and the private area, and storing the session identifier in a database; URL transmission step of transmitting the URL of the public area where session identifier authentication is performed to the portable communication terminal of the user, the URL being provided from the portable communication terminal that has re-accessed the public area. The second authentication information including the session identifier is stored in the database. In that query, it authenticates the second authentication information, including thereby a second authentication step of sessions between the user and the private area is authenticated.

Referring to the drawings, a process of viewing a user's own schedule stored in a LAN database from the portable communication terminal 1 using the user authentication method of the present invention will be described below. In the following embodiment, the mobile communication terminal 1
However, the present invention is not limited to this.

<First Embodiment> A first authentication step of the user authentication method according to the present invention will be described with reference to FIG. 2 and FIG. Here, FIG. 2A is a conceptual view of the present process in which the system configuration diagram shown in FIG. 1 is partially simplified and shown, and FIG. 2B shows one display screen of the mobile phone 1. Things. In step 100, the user uses the mobile communication terminal 1 to access the mobile application server 11 located in the public area 5, that is, the homepage that is the entrance to the network. Next, the portable application server 11 causes the portable communication terminal 1 to display an input screen for requesting the user to enter a user ID (UserID) and a password (PassWD) (FIG. 2).
(B)). In step 102, after the user inputs a user ID and a password and presses a login button, the input information is transmitted to the portable application server 11. In step 104, the portable application server 1
1 performs an operation of querying the user ID and the password in a database (not shown) of the portable application server 11 itself. If the entered information is correct, the user is authenticated and the process proceeds to step 106. If there is no information corresponding to the input information, the user is not authenticated, and a message that "user ID and password are incorrect" is displayed on portable communication terminal 1 (step 108).

Referring to FIGS. 3 and 4, the session identifier issuing step and the URL of the user authentication method according to the present invention will be described.
The transmitting step or the session identifier transmitting step will be described. Here, FIG. 4A is a conceptual diagram of the present process, which is a partially simplified view of the system configuration diagram shown in FIG. 1, and FIG. 4B shows one display screen of the mobile communication terminal 1. It was done. When the user is authenticated in the first authentication step, the database of the LAN is not immediately available, but the database 8 of the LAN 6 in the private area cannot be used unless the mobile communication terminal 1 is authenticated. . In order to authenticate the mobile communication terminal 1, ie,
In order to confirm that the previous user has accessed using his / her own mobile communication terminal 1, authentication of a session identifier (session ID) must be performed. The authentication of the mobile communication terminal 1 is performed by the session I as described below.
It is determined whether D has been correctly exchanged between the user's own portable communication terminal 1 and the portable application server 11.

First, in step 106, the user I of the user
An electronic mail address corresponding to D in a one-to-one manner is searched for and obtained from a database provided in the portable application server 11. However, when the user ID and the e-mail address are the same, or when the user ID and the user name of the e-mail address are the same, it is not necessary to perform the search. Next, in a session identifier issuing step (step 110), a session ID is issued using a random number. The session ID is, for example, “Skey =
3671594837 ". Here, it is assumed that the random number of the session ID has a certain expiration date in order to enhance security. As a result, the expiration date is also set for the session identifier. The session ID is stored in a database arranged in the portable application server 11 together with the user ID, and is used in a subsequent session identifier authentication step.
Next, in step 112, a URL of the public area 5 in which the session identifier is authenticated, which is obtained by adding the session identifier, is created. In step 114, an e-mail describing the URL is sent to the mobile communication terminal 1. By doing so, the URL to be accessed by the user to authenticate the mobile communication terminal 1 is transmitted. When the URL is transmitted, a message as shown in FIG. 4B is displayed to urge the user to proceed to step 116.

The access step and the second authentication step of the user authentication method according to the present invention will be described with reference to FIGS. Here, FIG. 5A is a conceptual diagram of the present process in which the system configuration diagram shown in FIG. 1 is partially simplified and shown.
FIGS. 5B and 5C show one display screen of the mobile phone 1. In step 116, the user who has received the electronic mail in which the URL is described on his / her own portable communication terminal 1 accesses the URL. As shown in FIG. 5B, since the URL is described in the e-mail, the user operates the mobile communication terminal 1 and easily receives the URL.
RL can be connected. Since the URL is the URL of the public area 5 where the second authentication process for authenticating the session ID is performed, the second authentication process is started immediately after connection. In step 118, first, session I
Check if the expiration date of D has passed. This is because the random number portion of the session ID is given an expiration date for security reasons so that the random number cannot be used after a predetermined time has elapsed. If the expiration date has passed, a display for notifying that “the expiration date has passed” is performed on the mobile communication terminal 1 in step 122. If the expiration date has not expired, the session ID is queried in step 120 with the session ID stored in the database of the portable application server 11.
If the session ID is correct, authenticate it and perform step 1
Proceeding to 24, if it is an incorrect session ID, the process proceeds to step 126 without performing authentication, and the portable communication terminal 1 displays "illegal access".

By the authentication of the session ID, not only the authentication of the user but also the user's own mobile communication terminal 1 has been authenticated. As a result, the user can read the database 8 of the LAN 6 in the closed area. The use is permitted and the content can be displayed (step 124). However, access to the private area is performed only through the portable application server 11, and the user directly accesses the private area database 8
No access to etc. FIG. 5C is a view showing a display screen of the main menu of the scheduler. If the user operates according to the screen display, the user obtains necessary information from the database 8 or the like via the portable application server 11. Can be.

If it is desired to use the database 8 of the LAN 6 in the private area again within the period in which the session ID is still valid after the user authentication has been performed, the second step starting at step 116 is performed. The authentication method can be started from the authentication process.

In the above embodiment, both the user ID and the password are input on the homepage which is the entrance of the network in the first authentication step. However, as shown in the modification of FIG. 6, only the user ID is input in the first authentication step. type in,
It is also possible to make a modification so that the user ID and the password are input in the first authentication step separately arranged before the second authentication step. Steps 100 to 118 and step 122 in FIG. 6 are the same as the steps described with reference to FIG. However, in step 102, only the user ID is input. Next, in step 120, the portable application server 11 requests the user to enter a user ID and a password. The user ID and password entered by the user in step 124 are queried in a database provided in the portable application server 11 in step 126. If the inquiry shows that the user is a valid user, the process proceeds to step 128. On the other hand, if the entered user ID and password do not match the database, the process proceeds to step 130, where the portable application server 11 notifies the user that the user ID and password are incorrect, and notifies the portable communication terminal 1 Is displayed. Step 128
Then, the session identifier is queried in a database provided in the portable application server 11. As a result of the inquiry, if the combination of the input user ID and session ID is correct, the user is authenticated as a valid user, and the user is permitted to use the database 8 of the LAN 6 (step 132). . When it is determined that the user is an unauthorized user, the portable application server 11 notifies the user of “illegal access” and displays it on the mobile communication terminal 1.

If it is desired to use the database 8 of the LAN 6 in the closed area again within the period in which the session ID is still valid after the user authentication has been performed, the second step starting at step 116 is performed. User authentication can be started from the authentication process.

<Second Embodiment> In the first embodiment, the user has to operate the portable communication terminal 1 every time the portable communication terminal 1 accesses the portable application server 11, but in the second embodiment, The following describes a user authentication method in which the user operates the mobile communication terminal 1 only once. The feature of the present embodiment is that the second access from the user to the portable application server 11 is automatically performed by a program stored in the portable communication terminal 1.

In this embodiment, distribution of a program from the portable application server 11 to the portable communication terminal 1
It can be broadly divided into user authentication. <Program Distribution> If the portable communication terminal 1 does not store a JAVA (registered trademark) program for implementing the second embodiment, as shown in FIG.
The program A is obtained from the portable application server 11 on the network. For the session of receiving the distribution of the program from the portable application server 11, user authentication must be performed, and the user authentication described in the first embodiment can be used for the user authentication. The JAVA program is distributed to the authenticated user. At that time, the portable application server 1
1 issues terminal identification information, and this terminal information is taken into the JAVA program and distributed. That is, the distributed program is a program dedicated to the portable communication terminal 1 that has received the distribution. Here, the terminal information is a character string issued by the portable application server 11 for each program distribution request.

When a user receives a program transmitted from the LAN to the portable communication terminal 1, the program is transmitted via the ordinary Internet network 2, but the user's portable communication terminal 1 and portable application server 11 communicate with each other. When the device is in a close position, it is possible to use a communication technology such as Bluetooth or infrared communication, and to receive the program using a removable medium such as a small memory.

<User Authentication> A user authentication method using a portable communication terminal storing a program will be described below with reference to FIG. The user who accesses the public area 5 of the network in step 300 is requested to input a user ID and a password (step 302). Step 30
In step 4, the portable application server 11 refers to the database for the input user ID and password, and if the user is a valid user, authenticates the user.
Proceed to. If the user is an unauthorized user, the process proceeds to step 308, and a message that "the user ID and password are incorrect" is displayed on the mobile communication terminal 1. Next, in step 306, an e-mail address corresponding to the user ID of the authenticated user on a one-to-one basis is searched and acquired in a database provided in the portable application server 11. Next, in step 310,
A session ID is issued using a random number. Here, it is assumed that the random number of the session ID has a certain expiration date in order to increase the security level. As a result, the expiration date is also set for the session identifier. Further, the session ID is also stored in a database arranged in the portable application server 11, and is stored in a later session I.
Used in the process of authenticating D. Next, in step 312, a URL of the public area 5 in which the session identifier is authenticated, which is obtained by adding the session identifier, is created. In step 314, an e-mail describing the URL is sent to the mobile communication terminal 1. By doing so, the URL to be accessed by the user to authenticate the mobile communication terminal 1 is transmitted to the mobile communication terminal 1.

Upon receiving the electronic mail in which the URL is described, the portable communication terminal 1 automatically accesses the URL in step 316 by the JAVA program. When accessing the portable application server 11, JA
The terminal information unique to the mobile communication terminal 1 captured in the process of distributing the VA program is automatically transmitted to the mobile application server 11. Since the URL accessed by the mobile communication terminal 1 is the URL of the public area 5 where the authentication of the session ID is performed, the authentication process is started immediately after connection to the URL. It is checked whether the deadline has passed. If the expiration date has passed, a display for notifying that “the expiration date has passed” is performed on the mobile communication terminal 1 in step 324. If the expiration date has not passed, the combination of the terminal information and the session ID transmitted at the same time as the access is referred to the combination of the terminal information and the session ID stored in the database of the portable application server 11. If it is correct, the session ID is authenticated. By the authentication of the session ID, not only the authentication of the user but also the user's own mobile communication terminal 1 is authenticated. As a result, the user is permitted to use the database 8 of the LAN 6 (step 326), various contents can be used similarly to the first embodiment. If the terminal information and the session ID are not correct, the process proceeds to step 328, and the user is notified by the display of the portable communication terminal 1 that "the access is unauthorized".

Next, a modification of the user authentication method according to the second embodiment will be described with reference to FIG. The feature of this modification is that the session ID is encrypted and included in the e-mail and transmitted to the user's mobile communication terminal 1.
The second embodiment described with reference to FIG. 8 and the modification shown in FIG. 9 are the same up to step 310. In this modification, after the step of issuing a session identifier (step 310), the session identifier is encrypted using the terminal information of the portable application server 11 as a key, and a URL including the encrypted session ID is encrypted. Is performed (step 312 ′), and then in step 314 ′,
An e-mail describing the URL including the encrypted session ID is transmitted to the user's mobile communication terminal 1. The portable communication terminal 1 sends the encrypted session identifier
5, the JAVA program is automatically executed to extract the encrypted session ID from the e-mail (step 315), and the encrypted session ID is decrypted based on the terminal information (step 315). 317). Next, in step 319, the decrypted session ID is
L, and the JAVA program automatically accesses the public area 5 in which the user authentication indicated by the URL is performed. Thereafter, steps 320 to 328 are performed in the same manner as in the second embodiment.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram of a network.

FIG. 2 is a diagram showing one step of a user authentication method;
(A) is a simplified system configuration diagram, and (b) is a display screen diagram of the mobile communication terminal.

FIG. 3 is a flowchart illustrating a first embodiment of the user authentication method.

FIG. 4 is a diagram showing one step of a user authentication method;
(A) is a simplified system configuration diagram, and (b) is a display screen diagram of the mobile communication terminal.

FIG. 5 is a diagram showing one step of a user authentication method;
(A) is a simplified system configuration diagram, and (b) and (c) are display screen diagrams of the mobile communication terminal.

FIG. 6 is a flowchart illustrating a modification of the first embodiment of the user authentication method.

FIG. 7 is a flowchart showing a program distribution process.

FIG. 8 is a flowchart illustrating a second embodiment of the user authentication method.

FIG. 9 is a flowchart showing a modification of the second embodiment of the user authentication method.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Mobile communication terminal 2 Internet network 3 Intranet 4 Firewall 5 Public area 6 LAN 7 Database server 8 Database 9 Intranet server 10 Terminal device 11 Portable application server

 ──────────────────────────────────────────────────続 き Continued on the front page (72) Inventor Itaru Tamura 4-1-2, Hiranocho, Chuo-ku, Osaka-shi, Osaka F-term in Osaka Gas Co., Ltd. 5B085 AE02 AE03 BC02 5J104 AA07 KA01 NA05 PA02 PA08 PA09

Claims (4)

[Claims] 1. A user authentication method for authenticating a user who makes a session request with a communication area inside a computer or an intranet via a communication path using a portable communication terminal, comprising: A first authentication step of authenticating first authentication information input by the user who has accessed the public area, and a session identifier for authenticating a session between the authenticated user and the private area; A session identifier issuance step of storing the session identifier in a database; a URL transmission step of transmitting, to the portable communication terminal of the user, a URL of the public area in which the authentication of the session identifier is performed obtained by adding the session identifier; Provided by the mobile communication terminal that has re-accessed the public area. The second authentication information comprising the session identifier included in the URL is queried in the database to authenticate the second authentication information, whereby a session between the user and the private area is authenticated. 2. A user authentication method, comprising two authentication steps. 2. The method according to claim 2, wherein the URL transmitting step includes the step of transmitting the URL.
The user who received the notification has at least one
The user authentication method according to claim 1, wherein if the second authentication step is performed at least once, a first authentication step is performed before each of the second authentication steps. . 3. The user authentication method according to claim 1, wherein the first authentication information is a user identifier and a password unique to the user. 4. The user authentication method according to claim 1, wherein said session identifier has an expiration date.