JP4486567B2 - Authentication system, authentication method, and authentication program - Google Patents

Description

  The present invention relates to an authentication system, an authentication method, and an authentication program that authenticate a second terminal with respect to access from a first terminal and use the result of the authentication as authentication of the first terminal.

  Conventionally, authentication using an ID / password has been common for services on the Internet that require confirmation of the identity of a membership system site or the like. In this ID / password authentication, the user ID and password of an authorized user are registered in advance in a database (DB), and the user ID and password are input to the user who has requested access. The user ID and password input by the user are permitted to be accessed on condition that the user ID and password are registered in association with the DB. There is also a method that enables login to a plurality of Internet services by only one authentication operation.

  In recent years, an authentication method using biometric information (such as fingerprints) or an IC card may be employed as an authentication method instead of an ID / password.

  In Patent Document 1 (Japanese Patent Application Laid-Open No. 2004-213315), in response to a login request with an ID / password from a PC (personal computer) or the like, authentication by the PC is performed, and a mobile phone or the like possessed by the login requester Discloses a technique for performing authentication by inputting a “confirmation authentication password”.

JP 2004-213315 A

  By the way, as described below, the above-described conventional technology has problems as described below from the viewpoints of authenticity of accessor authentication, burden on accessor and service provider, leakage of user ID and password, and the like. is there.

  In other words, the above ID / password authentication is vulnerable to fraudulent acts such as so-called “spoofing” due to theft of passwords or guesses by third parties. In addition, it is necessary to avoid these fraudulent acts by changing the password regularly, and there is a problem that the user is burdened.

  In addition, the authentication method that enables login with only one authentication operation to the above-mentioned plurality of Internet services, once a password is stolen, all Internet services can be used even by a third party. There is a problem that there is a high risk of leakage of user information.

  In addition, the above-described authentication method using biometric information (such as fingerprints) or an IC card requires a biometric information or IC card reader, which incurs a cost burden on the user, and thus is widely used in general households. There is a problem that it is not. Furthermore, in the authentication method using biometric information, there is a problem that the operation is unstable, such as misauthenticating another person with the person or conversely not authenticating the person with the person.

  Further, in the authentication method of the above-mentioned patent document, there is a problem that if the “confirmation authentication password” that needs to be input at the time of authentication at the personal terminal is leaked, the spoofing such as “spoofing” is still possible. Furthermore, there is a problem that the user also has a trouble of newly managing the “password for confirmation authentication”.

  Therefore, the present invention has been made to solve the above-described problems of the prior art, and provides an authentication system, an authentication method, and an authentication program that can easily and safely confirm the identity of an accessor. Objective.

In order to solve the above-described problems and achieve the object, the present invention is an authentication system that authenticates the second terminal for access from the first terminal and uses the authentication result as the authentication of the first terminal. An access accepting means for accepting access from the first terminal, a notification means for notifying the authentication address to the second terminal address, and a first response based on a response from the second terminal to the authentication address. And authentication means for authenticating the terminal.

Further, the present invention is the above invention, wherein the access receiving means receives the second terminal address from the first terminal, and the notification means is addressed to the second terminal address received by the access receiving means. The authentication address is notified.

In the present invention, the present invention further comprises address information storage means for storing information relating to the second terminal address and the second terminal address in association with each other. Receiving information relating to the second terminal address, and the notifying means notifying an authentication address addressed to the second terminal address stored corresponding to the information relating to the second terminal address received by the access accepting means. It is characterized by.

The present invention further comprises an access code generating means for generating an access code including information relating to the second terminal address with a predetermined key in the above invention, wherein the access receiving means is generated by the access code generating means. And the notifying means acquires the second terminal address included in the access code accepted by the access accepting means and notifies the authentication address to the second terminal address. It is characterized by that.

The present invention, in the above invention, further comprises an authentication information storage means for storing information relating to authentication of the second terminal, wherein the authentication means accepts information relating to authentication of the second terminal from the second terminal, The information regarding the authentication of the second terminal is authenticated based on the correspondence with the information regarding the authentication of the second terminal stored by the authentication information storage means.

Further, the present invention is the above invention, wherein the access code generation unit generates an access code including information related to authentication of the second terminal by a predetermined key, and the authentication unit receives the second terminal from the second terminal. Information regarding authentication of two terminals is received, and the first terminal is authenticated based on correspondence with information regarding authentication of the second terminal acquired from the access code.

Further, the present invention is characterized in that, in the above invention, the authentication means accepts a terminal-specific second terminal identifier as information relating to the authentication of the second terminal, and authenticates the first terminal based on the terminal identifier. And

Also, in the present invention according to the above invention, the address information storage unit stores information related to the effective condition and the second terminal address in association with each other, and the notification unit stores the information in association with the second terminal address. The authentication address is notified to the second terminal address on condition that the valid condition is satisfied.

Further, in the present invention according to the above invention, the access code generation unit generates an access code including information related to the validity condition, and the notification unit determines the validity condition acquired based on the access code. The authentication address is notified to the second terminal address on condition that the condition is satisfied.

Further, the present invention is the above invention, wherein the notifying means is provided on the condition that information relating to the validity condition includes information relating to a deadline, time, number of times, originating domain, or a combination thereof, satisfying the validity condition. In addition, the authentication address is notified to the second terminal address.

Further, the present invention provides the above-described invention, wherein the access accepting unit, the notifying unit, and the authenticating unit authenticate the first terminal, and the authentication address notified by the notifying unit is provided. A transfer server having transfer means for transferring to the second terminal, wherein the address accepting means of the authentication server receives a transfer address corresponding to the second terminal address instead of the second terminal address from the first terminal; The notification means of the authentication server notifies the address for authentication addressed to the transfer address received by the address reception means, and the transfer means of the transfer server receives the authentication address notified by the notification means. It is characterized by forwarding to a two-terminal address.

Further, according to the present invention, in the above invention, the transfer means includes a transfer address corresponding to the second terminal address including information related to the transfer condition, and determines whether or not transfer is possible based on the transfer condition. The authentication address is transferred to the second terminal address on the condition that can be transferred.

Also, in the present invention according to the above-mentioned invention, the transfer means performs transfer feasibility determination based on information related to the time limit, time, number of times, caller domain, or a combination thereof as information related to the transfer condition, The authentication address is transferred to the second terminal address on condition that the determination is transferable.

Further, the present invention is the above invention, comprising an authentication server for authenticating the second terminal, and a content providing server for providing content, wherein the content providing means of the content providing server is configured to authenticate the authentication server. The content is provided to the first terminal according to the result of authentication obtained by the means.

Further, the present invention provides the authentication server according to the above invention, wherein the authentication server includes the notification unit and the authentication unit, and authenticates the second terminal, and the access providing unit and the content providing unit that provides the content to the first terminal. Having a content providing server for providing content to the first terminal, wherein the authentication means of the authentication server authenticates the second terminal when receiving a request for authentication from the content providing server, The content providing means of the content providing server provides the content to the first terminal according to the result of authentication obtained by the authenticating means.

Also, the present invention provides the content providing the authentication server according to the above invention, the authentication server including the notification unit and the authentication unit and authenticating the second terminal, and the access reception unit and the content providing unit. An authentication server that authenticates the second terminal when receiving a request for authentication from the content providing server, and from the content providing server according to a result of the authentication, The content to be provided to the terminal is acquired, and the content is provided to the first terminal.

Further, the present invention provides the authentication server according to the above invention, comprising: an authentication server that includes the access receiving unit, a notification unit, and an authentication unit to authenticate the second terminal; and a content providing server that provides content. The authentication means authenticates the second terminal, generates an authentication identifier for accessing the content providing server according to the result of the authentication, transmits the authentication identifier to the first terminal, and transmits the content When the providing server receives the authentication identifier, the providing server provides the content to the first terminal.

Further, the present invention provides the authentication server according to the above invention, comprising: an authentication server that includes the access receiving unit, a notification unit, and an authentication unit to authenticate the second terminal; and a content providing server that provides content. The authentication means authenticates the second terminal, acquires content to be provided to the first terminal from the content providing server according to the authentication result, and provides the content to the first terminal. And

Further, the present invention is an authentication method for authenticating the second terminal with respect to access from the first terminal and using the result of the authentication as the authentication of the first terminal, and accepting access from the first terminal An access receiving step, a notification step of notifying the address for authentication to the second terminal address, and an authentication step of authenticating the first terminal based on a response from the second terminal to the authentication address. It is characterized by that.

The present invention is also an authentication program for causing a computer to execute an authentication method for authenticating the second terminal with respect to access from the first terminal and using the result of the authentication as the authentication of the first terminal. Authenticate the first terminal based on an access acceptance procedure for accepting access from one terminal, a notification procedure for notifying the authentication address to the second terminal address, and a response from the second terminal to the authentication address And causing the computer to execute an authentication procedure.

According to the present invention, in response to the authentication request from the first terminal, the second terminal is notified, and the legitimacy of the access is confirmed by the response from the second terminal. Even if an unauthorized authentication request is received from a third party that is not, the authentication request is not accepted unless an authorized accessor responds from the second terminal, so that unauthorized access can be avoided.

In addition, according to the present invention, the second terminal address is received from the first terminal, and the authentication address is notified to the received second terminal address. Therefore, it is possible to notify the response request to any second terminal. It is.

Further, according to the present invention, the information related to the received second terminal address and the second terminal address are stored in association with each other, the information related to the second terminal address is received from the first terminal, and the information stored in the address is stored. Since the authentication address is notified to the second terminal address corresponding to the information related to the second terminal address among the two terminal addresses, it is not necessary to input the second terminal address every time an authentication request is made from the first terminal. It is possible to protect the address of the second terminal from leakage (for example, collecting addresses with a key logger or the like at the time of input from a PC terminal that is not used everyday such as an Internet cafe).

Further, according to the present invention, an access code including information related to the received second terminal address is generated using a predetermined key, the access code is received from the first terminal, and the second terminal address included in the access code is generated. And the authentication address is notified to the second terminal address, so that a means for storing the second terminal address can be dispensed with.

Moreover, according to this invention, the information regarding the authentication of the second terminal is stored, the information regarding the authentication of the second terminal is received from the second terminal, and the information regarding the authentication of the second terminal is stored. Since the first terminal is authenticated on the basis of the correspondence with the information regarding the response, it is possible to refuse a response from other than the unique second terminal. For example, only a terminal owned by an authorized accessor is assigned as the second terminal. It is possible.

Further, according to the present invention, an access code including information related to authentication of the second terminal using a predetermined key is generated, information related to authentication of the second terminal is received from the second terminal, and the second code acquired from the access code Since the first terminal is authenticated based on the correspondence with the terminal authentication information, it is possible to eliminate the need for storing the second terminal authentication information.

Further, according to the present invention, since the terminal unique identifier is accepted as information relating to the authentication of the second terminal and the first terminal is authenticated based on the authentication identifier, the second terminal identifier that cannot be changed is stored in advance, As a result of enabling authentication when the identifier received at the time of a response from the second terminal corresponds to the stored second terminal identifier, it is possible to prevent unauthorized authentication by a third party.

Further, according to the present invention, since an effective condition is set for transmission of a response request from the second terminal, it is possible to eliminate unnecessary response requests from the second terminal.

Further, according to the present invention, an access code including a valid condition is generated, and an authentication request is returned from the first terminal together with the access code. Therefore, a means for storing the valid condition can be eliminated.

Further, according to the present invention, the deadline, the time, the number of times, the access source, or a combination thereof is set as the effective condition, so it is possible to eliminate unnecessary response requests from the second terminal.

Further, according to the present invention, a response request to the second terminal is transmitted to a separately installed transfer address, and further transferred from the transfer address to the second terminal address. For example, an unauthorized authentication request from a third party, etc. Even when an unnecessary authentication request is transmitted from the first terminal, it is possible to suppress unnecessary response requests by simply eliminating the transfer address without deleting or changing the second terminal address.

In addition, according to the present invention, since a communication request that does not match the transfer condition is not transferred by determining whether transfer is possible based on the transfer condition at the time of transfer from the transfer address, an unnecessary response request is not required without abolishing the transfer address. Can be suppressed.

In addition, according to the present invention, since the deadline, time, number of times, originator domain, or a combination thereof is used as a valid condition, a response request that does not meet the valid condition is not forwarded. Response requests can be suppressed.

Further, according to the present invention, since the authentication result is provided to the content providing server, the content providing server can provide the content only to the authenticated content requester without providing the authentication means itself.

According to the present invention, since the content providing server accepts an authentication request from the first terminal and provides an authentication result to the content providing server, the content requester can send the content providing server through the first terminal. It is possible to reduce the operation of the content requester.

Further, according to the present invention, when the first terminal transmits an authentication request to the content providing server, the content providing server requests the authentication server to perform authentication, and when receiving an appropriate response from the second terminal, Since the content is sent to the first terminal, the content is sent to the first terminal, so that all content is provided via the authentication server. Content sizing based on each access environment is possible.

According to the present invention, when the first terminal transmits an authentication request to the authentication server, the authentication server returns an authentication result after receiving a reasonable response from the second terminal, and this time, the content providing server this time Therefore, the content request can be transmitted to any content providing server only by receiving the authentication result once.

According to the present invention, when the first terminal transmits an authentication request to the authentication server, the authentication server requests the content providing server together with the authentication result after receiving an appropriate response from the second terminal, and the content By transmitting to the first terminal, the content requester only needs to access the authentication server through the first terminal at the time of access, so that the operation of the content requester can be reduced. Is possible.

  Embodiments of an authentication system, an authentication method, and an authentication program according to the present invention will be described below in detail with reference to the accompanying drawings.

  In the following embodiments, the outline and features of the authentication system according to the first embodiment, the configuration of the authentication system, and the flow of processing will be described in order, and finally the effects of the first embodiment will be described.

[System overview and features]
First, the outline and features of the authentication system according to the first embodiment will be described with reference to FIG. FIG. 1 is a diagram for explaining the outline and features of the authentication system according to the first embodiment.

  The outline of the authentication system of the first embodiment is that the second terminal (mobile phone etc.) is authenticated for the access from the first terminal (PC etc.), and the result of the authentication is the authentication of the first terminal. . Then, in response to an authentication request from the first terminal with low reliability of identity verification, it notifies the second terminal with high reliability of identity verification and confirms the legitimacy of access with the response from the second terminal Therefore, even if an unauthorized authentication request from a third party who is not an allowed accessor is received from the first terminal, the authentication request is not accepted unless the permitted accessor responds from the second terminal. The main feature is that unauthorized access can be avoided.

  Specifically, as shown in FIG. 1, when the access requester makes an access request to the authentication server from the first terminal (PC or the like), the authentication server displays the login page on the first terminal. Send to. And the 1st terminal which received this login page transmits the login request | requirement containing a 2nd terminal address to an authentication server (refer (1)-(3) of FIG. 1). Specifically, the authentication server transmits a login page as exemplified in FIGS. 19 and 20 to the first terminal, and inputs and transmits a mobile mail address on the login page.

  Then, after the authentication server that has received the login request generates an authentication URL and transmits the generated authentication URL as an authentication request mail to the second terminal, the second terminal transmits the individual identification number, the session as the authentication request. The ID and passcode are transmitted to the authentication server (see (4) to (6) in FIG. 1). Specifically, after the authentication server transmits an authentication request mail as illustrated in FIG. 24 to the second terminal, the second terminal accesses the authentication URL included in the authentication request mail to access the individual identification number. The session ID and passcode are transmitted to the authentication server. When the authentication request mail is transmitted to the second terminal, a screen as illustrated in FIG. 23 is transmitted to the first terminal.

  Thereafter, the authentication server authenticates the second terminal and transmits the authentication result to the first terminal (see (7) to (8) in FIG. 1). Specifically, it is checked whether the session ID and state (authenticating) are registered in the connection information table 121. If registered, authentication is possible, and if not registered, authentication is impossible. If authentication is possible, it is checked whether the individual identification number and passcode in the management information table 120 corresponding to the second terminal address acquired from the connection information table 121 correspond to the received individual identification number and passcode. If it does not correspond, it will be NG. Then, the result is transmitted to the first terminal (see FIG. 25).

  Thus, according to the authentication system according to the first embodiment, in response to the authentication request from the first terminal, the second terminal is notified, and the validity of the access is confirmed by the response from the second terminal. Even if an unauthorized authentication request of a third party who is not an authorized accessor is received from the first terminal, the unauthorized access is not accepted unless the authorized accessor responds from the second terminal, so unauthorized access Can be avoided.

[Configuration of authentication system]
Next, the configuration of the authentication system according to the first embodiment will be described with reference to FIG. FIG. 2 is a diagram illustrating the configuration of the authentication system according to the first embodiment. As shown in the figure, this authentication system includes a first terminal 210, a first terminal IP network 200, the Internet 300, an authentication server 100, a second terminal 420, a second terminal mail server 410, and a second terminal IP network 400. Have.

  The authentication server 100 also includes a management information table 120 that stores authentication information, a connection information table 121 that stores a session of the authentication process, a registration unit 130 that registers information on the second terminal, and a request from the first terminal. And an authentication unit 140 that authenticates the second terminal and a communication unit 110 that performs Internet connection.

  Among these, as shown in FIG. 3, the management information table 120 stores the individual identification number used as the authentication information, the second terminal address, and the passcode by the user in association with each other. This individual identification number is a character string that can uniquely identify a terminal, such as a mobile phone terminal ID. Such an individual identification number is not directly stored, but a value uniquely associated, for example, a hash value may be stored. On the other hand, the passcode is composed of a combination of numbers, alphabets, symbols and the like. Such a passcode is not stored directly, but a value uniquely associated such as a hash value may be stored.

  Further, as shown in FIG. 4, the connection information table 121 stores a unique session ID, a second terminal address, and a session state in association with each other. The session status includes, for example, “authenticated”, “authentication process in progress”, “registered”, “registration process in progress”, and the like.

  In addition, the registration unit 130 accesses the registration URL, a registration URL generation unit 131 that generates a URL used for registration of the second terminal, a registration URL transmission unit 132 that transmits the registration URL to the second terminal, and the registration URL. A registration processing unit 133 that stores information of two terminals in a management information table, and a registration result transmission unit 134 that transmits a registration result to the first terminal are provided.

  In addition, the authentication unit 140 has an authentication URL generation unit 141 that creates a URL used for authentication of the second terminal, an authentication URL transmission unit 142 that transmits the authentication URL to the second terminal, and the second that has accessed the authentication URL. An authentication processing unit 143 that authenticates the terminal and an authentication result transmission unit 144 that transmits the authentication result to the first terminal are provided.

[Registration process by authentication system]
Next, the flow of registration processing by the authentication system will be described with reference to FIG. FIG. 5 is a flowchart showing the flow of registration processing by the authentication system.

  As shown in the figure, when an HTTP request message is transmitted as an access request from the first terminal 210 to the authentication server 100 (step S1010), the authentication server 100 transmits a registration page (step S1020).

  Subsequently, when the second terminal address is transmitted as an HTTP request message from the first terminal 210 to the authentication server 100 (step S1030), the authentication server 100 generates a registration URL (step S1040). The process for generating the registration URL will be described in detail later with reference to FIG.

  Subsequently, the authentication server 100 transmits the generated registration URL to the second terminal by mail (step S1050). The second terminal 420 that has received the mail transmits the individual identification number, the session ID, and the passcode based on the registration URL as an HTTP request message to the authentication server 100 (step S1060). The authentication server 100 that has received the HTTP request message performs registration processing (step S1070). This registration process will be described in detail later with reference to FIG. Thereafter, the authentication server 100 transmits the registration result as an HTTP response message to the first terminal 210 (step S1080).

  Next, a registration URL generation process (a process corresponding to step S1040 shown in FIG. 5) by the authentication server 100 will be described in detail with reference to FIG. FIG. 6 is a flowchart showing details of the registration URL generation process.

  First, it is checked whether the second terminal address is stored in the management information table. If it is stored, registration is possible, and if not, registration is not possible (step S1041). If registration is possible, a unique session ID such as a hash value of a character string made up of time and a random number is generated (step S1042). Next, the session ID, the second terminal address, and the state (during registration processing) are registered in the connection information table (step S1043). Next, a registration URL is generated by adding a session ID to the end of the registration address (step S1044).

  Next, a registration process (a process corresponding to step S1070 shown in FIG. 5) by the authentication server 100 will be described in detail with reference to FIG. FIG. 7 is a flowchart showing details of the registration process.

  First, it is checked whether the session ID and state (during registration processing) are stored in association with the connection information table 121. If stored, registration is possible, and if not stored, registration is not possible (step S1071). If registration is possible, the state of the session information corresponding to the session ID stored in the connection information table 121 is changed from “registration processing” to “registered”, the second terminal address, the transmitted individual identification number, and The passcode is registered in the management information table 120. Also, when the validity condition is set, the expiration date of the expiration date counted from January 1, 2004 and digitized in the daily unit is registered in the management information table. "Is registered in the management information table (step S1072).

[Login processing by authentication system]
Next, the flow of login processing by the authentication system will be described with reference to FIG. FIG. 8 is a flowchart showing the flow of login processing by the authentication system.

  As shown in the figure, when an HTTP request message is transmitted as an access request from the first terminal 210 to the authentication server 100 (step S2010), the authentication server 100 transmits a login page (step S2020).

  Subsequently, when the second terminal address is transmitted as an HTTP request message from the first terminal 210 to the authentication server 100 (step S2030), the authentication server 100 generates an authentication URL (step S2040). The process for generating the authentication URL will be described in detail later with reference to FIG.

  Then, the authentication server 100 transmits the generated authentication URL to the second terminal 420 by mail (step S2050). The second terminal 420 that has received such mail transmits the individual identification number, the session ID, and the passcode based on the authentication URL to the authentication server 100 as an HTTP request message (step S2060). The authentication server 100 that has received the HTTP request message performs an authentication process (step S2070). The authentication process will be described later in detail with reference to FIG. Thereafter, the authentication server 100 transmits the authentication result as an HTTP response message to the first terminal 210 (step S2080).

  In the first embodiment, the second terminal address is transmitted as an HTTP request message from the first terminal 210 to the authentication server 100. However, information (ID or the like) related to the second terminal address may be transmitted. In this case, the management information table 120 further holds information regarding the second terminal address, and the authentication server 100 generates information regarding the unique second terminal address at the time of registration processing using a random number or the like using time as a key. The second terminal address is acquired from the management usage table using the received information relating to the second terminal as a key, and the authentication process is performed after transmitting the authentication URL to the second terminal.

  Next, an authentication URL generation process (process corresponding to step S2040 shown in FIG. 8) by the authentication server 100 will be described in detail with reference to FIG. FIG. 9 is a flowchart showing details of the authentication URL generation process.

  First, it is checked whether the second terminal address is stored in the management information table 120. If it is stored, authentication is possible, and if it is not stored, authentication is not possible. If the authentication is possible and the valid condition is set in the management information table (not 0), the expiration date of the expiration date is calculated by adding January 1, 2004 to the set numerical value. It is determined whether the date of has passed the expiration date. If it is determined that the determination has passed, authentication is not possible (step S2041). If authentication is possible, a unique session ID such as a hash value of a character string composed of time and a random number is generated (step S2042). Next, the session ID, the second terminal address, and the state (during authentication processing) are registered in the connection information table 121 (step S2043). Next, an authentication URL with a session ID added to the end of the authentication address is generated (step S2044).

  Next, the authentication process (process corresponding to step S2070 shown in FIG. 8) by the authentication server 100 will be described in detail with reference to FIG. FIG. 10 is a flowchart showing details of the authentication process.

  First, it is checked whether the session ID and state (authentication processing is in progress) are registered in the connection information table 121. If registered, authentication is possible, and if not registered, authentication is not possible (step S2071). If authentication is possible, it is checked whether the individual identification number and passcode in the management information table 120 corresponding to the second terminal address acquired from the connection information table 121 correspond to the received individual identification number and passcode. If it does, it is OK, otherwise it is NG (step S2072). If OK, the information of the corresponding session ID stored in the connection information table 121 is changed from the state “authenticating” to “authenticated” (step S2073).

[Effect of Example 1]
As described above, according to the first embodiment, in response to the authentication request from the first terminal, the second terminal is notified and the validity of the access is confirmed by the response from the second terminal. Even if an unauthorized authentication request from a third party who is not an authorized accessor is received from the terminal, the authentication request is not accepted unless the authorized accessor responds from the second terminal, thus preventing unauthorized access. Is possible.

  Further, according to the first embodiment, the second terminal address is received from the first terminal, and the authentication address is notified to the received second terminal address. Therefore, a response request can be notified to an arbitrary second terminal. Is possible.

  Moreover, according to Example 1, the information regarding the received 2nd terminal address and the 2nd terminal address were matched and memorize | stored, the information regarding the 2nd terminal address was received from the 1st terminal, and it memorize | stored in the address Since the authentication address is notified to the second terminal address corresponding to the information related to the second terminal address among the second terminal addresses, it is not necessary to input the second terminal address every time an authentication request is made from the first terminal. It is possible to protect the second terminal address from leakage due to input (for example, collecting addresses with a key logger or the like at the time of input from a PC terminal not used everyday such as an Internet cafe).

  Moreover, according to Example 1, the information regarding the authentication of the second terminal is stored, the information regarding the authentication of the second terminal is received from the second terminal, and the information regarding the authentication of the second terminal is stored. Since the first terminal is authenticated based on the correspondence with the authentication-related information, it is possible to refuse a response from other than the unique second terminal. For example, only the terminal owned by the authorized accessor is used as the second terminal. Can be assigned.

  Further, according to the first embodiment, the terminal-specific authentication identifier is received as information related to the authentication of the second terminal, and the first terminal is authenticated based on the authentication identifier. As a result of enabling authentication when the stored identifier received at the time of a response from the second terminal corresponds to the stored second terminal identifier, unauthorized authentication by a third party can be prevented.

  Further, according to the first embodiment, the effective condition is set for the transmission of the response request from the second terminal, so that it is possible to eliminate an unnecessary response request to the second terminal.

  In addition, according to the first embodiment, the deadline, the time, the number of times, the access source, or a combination thereof is set as the valid condition, so it is possible to eliminate an unnecessary response request to the second terminal.

  By the way, in the above-described first embodiment, the case where authentication is performed by associating and storing an individual identification number or the like with the second terminal address has been described, but the present invention is not limited to this, and the second terminal Authentication may be performed by generating an access code including an address and an individual identification number using a predetermined key.

  Therefore, in the following second embodiment, an authentication system according to the second embodiment will be described with reference to FIGS. 11 to 16 as a case where authentication is performed by generating an access code including a second terminal address with a predetermined key. To do.

  First, the configuration of the authentication system according to the second embodiment will be described with reference to FIG. FIG. 11 is a diagram illustrating the configuration of the authentication system according to the second embodiment. As shown in the figure, compared with the authentication system according to the first embodiment shown in FIG. 2, the authentication server 100 includes an issue key storage unit 122, an access code generation unit 135, and the authentication system according to the second embodiment. The access code decoding unit 145 is newly provided.

  Among these, the issuance key storage unit 122 stores a key generated by the access code. Further, the access code generation unit 135 generates an access code. Further, the access code decrypting unit 145 decrypts the access code.

  Next, an access code issuing process by the authentication system according to the second embodiment will be described with reference to FIG. The access code issuance process according to the second embodiment is different from the registration process performed by the authentication system according to the first embodiment illustrated in FIG. 5 in that an access code is generated.

  That is, as shown in FIG. 12, the second terminal transmits an individual identification number and a session ID as an HTTP request message to the authentication server 100 (see FIG. 21) (step S3060), and then performs an accessor authentication process (step S3070). ). Specifically, as shown in FIG. 13, the accessor authentication process first checks whether the received session ID and state (during registration process) are registered in the connection information table 121 and is registered. If it is not registered, it cannot be generated (step S3071). If it can be generated, the session information corresponding to the session ID stored in the connection information table 121 is changed from the state “registration processing” to “registered” (step S3072). Further, the second terminal address associated with the session ID is acquired from the connection information table 121 (step S3073).

  Thereafter, processing for generating an access code is performed. Specifically, in the access code generation process, as shown in FIG. 14, first, “|” is added to the end of the second terminal address, and this is used as data A (step S3081). Next, an individual identification number is added after the data A, and “|” is added at the end (step S3082). Next, 1-bit data of “1” if the valid condition is set and “0” if it is not set is set as data B (step S3083). Then, when the validity condition is set, the expiration date of the expiration date is digitized in units of days from January 1, 2004, the number of days is encoded as a 13-bit integer value to generate data B1, and this data B1 Is added to the end of data B (step S3084). An example of valid conditions included in such an access code is illustrated in FIG. An access code including information (for example, a child body identification number) relating to authentication of the second terminal corresponds to an “authentication code” recited in the claims.

  Thereafter, data obtained by concatenating data A and data B is encrypted with an issue key, and encoded data obtained by BASE32 encoding this encrypted data is added to the end of the server URL, which is illustrated in FIG. Such an access code is generated (step S3085). Thereafter, the generated access code is transmitted as an HTTP request message (see FIG. 22). The valid condition included in the access code is not limited to the access permission period, but may be an access permission time, an access permission count, an access permission host, or a combination thereof, as shown in FIG.

  Next, a login process according to the second embodiment will be described with reference to FIG. The login process according to the second embodiment is different from the login process according to the first embodiment illustrated in FIG. 8 in that an access code decoding process is performed.

  That is, as shown in FIG. 15, after the access code is transmitted as the HTTP request message from the first terminal 210 to the authentication server 100 (step S4010), the access code decoding process is performed (step S4020). Specifically, in the access code decryption process, as shown in FIG. 16, first, the data obtained by decrypting the access code with the BASE32 composite data is combined with the issue key of the issue key storage unit 122 as data X, The data “X” from the head of the data X to the second stroke “|” is restored as “data A”, and the subsequent strokes are restored as “data B” (step S4021).

  Next, the first bit of the data B is confirmed, and when the first bit is “1” (when an expiration date is set), the number obtained as a 13-bit integer value following the first bit (number of days) is set to 2004. The expiration date of the expiration date is calculated by adding January 1 of the year, and it is determined whether the current date has passed the expiration date. If it has passed, authentication information notification is disabled (step S4022). When authentication notification is possible, the data from the top of data A to the first “|” is acquired as the second terminal address, and the data after the second “|” from the top of data A is used as the terminal identification number. Obtain (step S4023).

  As described above, in the second embodiment, an access code including information regarding the received second terminal address is generated using a predetermined key, the access code is received from the first terminal, and the second terminal included in the access code is generated. Since the address is acquired and the authentication address is notified to the second terminal address, a means for storing the second terminal address can be eliminated.

  In the second embodiment, an access code including information related to authentication of the second terminal is generated using a predetermined key, information related to authentication of the second terminal is received from the second terminal, and the second terminal acquired from the access code Since the first terminal is authenticated based on the correspondence with the authentication information, it is possible to dispense with a means for storing the authentication information of the second terminal.

  Further, in the second embodiment, an access code including a valid condition is generated, and an authentication request is returned from the first terminal together with the access code. Therefore, a means for storing the valid condition can be eliminated.

  By the way, in the first embodiment, the case where the authentication server for authenticating the accessor is provided has been described. However, the present invention is not limited to this, and the registration request mail received from the authentication server is transferred to the second terminal. A transfer server may be further provided.

  Therefore, in the following third embodiment, the authentication system according to the third embodiment will be described with reference to FIGS. 26 to 29 as a case where a transfer server that transfers the registration request mail received from the authentication server to the second terminal is further provided. .

  Specifically, as illustrated in FIG. 26, the authentication system according to the third embodiment includes a transfer server 500 together with the authentication server 100. The transfer server 500 includes a transfer information table 520 that stores transfer conditions, a mail decryption processing unit 530 that receives a mail transmitted to a transfer address and makes a transfer determination, and a mail transfer processing unit 531 that transfers the mail. And a communication unit 510 that performs Internet connection.

  Among these, the transfer information table 520 stores a transfer address, a second terminal address, and transfer conditions in association with each other as shown in FIG.

  Next, registration processing by the authentication system according to the third embodiment will be described with reference to FIG. The registration process by the authentication system according to the third embodiment is such that the transfer server forwards the registration request mail received from the authentication server to the second terminal as compared with the registration process by the authentication system of the first embodiment shown in FIG. Is different.

  That is, as shown in FIG. 27, after receiving the registration page (step S5020), the first terminal 210 transmits the address of the transfer server to the authentication server 100 instead of the second terminal address (step S5030). The authentication server 100 that has received the transfer address generates a registration URL as in the first embodiment (step S5040), and transmits a registration request mail to the transfer address (step S5050).

  Thereafter, the transfer server 500 that has received the mail acquires transfer conditions from the transfer information table 520 using the transfer address as a key, and determines whether the transfer conditions are satisfied. If the transfer condition is satisfied, the second terminal address stored in the transfer information table 520 is acquired using the transfer address as a key, the destination of the corresponding mail is changed from the transfer address to the second terminal address (step S5060), A registration request mail is transmitted to the second terminal (step S5070). Specifically, when the sending domain is set in the forwarding condition, only mail sent from the set domain is forwarded, and when the forwarding time is set, it is sent at the set time. Forward only mail that has been sent. Subsequent registration processing is the same as in the first embodiment.

  As shown in FIG. 28, the log-in process according to the third embodiment uses the transfer address in the same manner as the registration process according to the first embodiment, uses the transfer address for log-in, and the transfer method according to the first embodiment. The same process as the registration process is performed.

  As described above, in the third embodiment, a response request to the second terminal is transmitted to the separately installed transfer address, and further transferred from the transfer address to the second terminal address. For example, an unauthorized authentication request from a third party Even when an unnecessary authentication request is transmitted from the first terminal, it is possible to suppress unnecessary response requests by simply eliminating the transfer address without deleting or changing the second terminal address.

  Further, in the third embodiment, since a communication request that does not meet the transfer condition is not transferred by determining whether transfer is possible based on the transfer condition at the time of transfer from the transfer address, an unnecessary response request is made without abolishing the transfer address. It can be deterred.

  Further, in the third embodiment, since the response request that does not meet the valid condition is not transferred by setting the deadline, time, number of times, caller domain or a combination thereof as a valid condition, the transfer address is not abolished and unnecessary. It is possible to suppress response requests.

  By the way, in the second embodiment, the case where the authentication server that authenticates the accessor is provided has been described. However, the present invention is not limited to this, and further includes a content providing server that provides content to the first terminal. When the content providing server receives an authentication request from the first terminal and requests authentication from the authentication server, the authentication server may perform authentication and transmit an authentication result to the content providing server.

  Therefore, in Example 4 below, a content providing server that provides content to the first terminal is further provided. When the content providing server accepts an authentication request from the first terminal and requests authentication from the authentication server, the authentication server As an example in which authentication is performed and an authentication result is transmitted to the content providing server, an authentication system according to the fourth embodiment will be described with reference to FIGS. 30 and 31. FIG.

  Specifically, as shown in FIG. 30, the configuration of the authentication system according to the fourth embodiment is different from the authentication system according to the second embodiment shown in FIG. To do. The content providing server 600 generates a session that links the connection between the content table 620 that stores content information, the content providing unit 630 that provides content to the first terminal, and the connection between the first terminal and the authentication server. It comprises a session generation unit 631, an authentication request transmission unit 632 that requests authentication from the authentication server, and a communication unit 610 that performs Internet connection.

  Next, content providing processing by the authentication system according to the fourth embodiment will be described with reference to FIG. The content providing process by the authentication system according to the fourth embodiment is compared with the login process by the authentication system according to the second embodiment illustrated in FIG. 15, and the content providing server sends the content to the first terminal according to the authentication result. The point to provide is different.

  That is, as shown in FIG. 31, the content server receives an access request from the first terminal (step S7010), transmits a login page to the first terminal 210 (step S7020), and then obtains an access code from the first terminal 210. The included login request is accepted (step S7030). Then, the content providing server 600 generates a session that connects the connection with the first terminal and the connection with the authentication server (step S7040), and transmits the access code and the session ID as an HTTP request message to the authentication server 100 (step S7050). ).

  Thereafter, after performing the same authentication process as in the second embodiment, the content providing server 600 receives the authentication result from the authentication server 100 (step S7110), and transmits the content to the first terminal based on the received result. (Step S7120).

  As described above, according to the fourth embodiment, the content providing server receives the authentication request from the first terminal and provides the authentication result to the content providing server. Only the content providing server needs to be accessed, and the operation of the content requester can be reduced.

  By the way, in the second embodiment, the case where the authentication server that authenticates the accessor is provided has been described. However, the present invention is not limited to this, and further includes a content providing server that provides content to the first terminal. When the first terminal sends an authentication request to the content providing server, the content providing server requests the authentication server for authentication, and when receiving a reasonable response from the second terminal, sends the content to the authentication server, The authentication server may transmit the content to the first terminal.

  Therefore, in Example 5 below, a content providing server that provides content to the first terminal is further provided, and when the first terminal transmits an authentication request to the content providing server, the content providing server requests the authentication server for authentication. Then, when a reasonable response is received from the second terminal, the content is transmitted to the authentication server, and the authentication server transmits the content to the first terminal as shown in FIG. Such an authentication system will be described.

  Specifically, as shown in FIG. 32, the configuration of the authentication system according to the fifth embodiment is different from the authentication system according to the fourth embodiment shown in FIG. 30 in that the content request unit 148, the content processing unit 146, and the content The difference is that a transmission unit 147 is newly provided. Specifically, the authentication unit 140 is based on a content request unit 148 that requests content from the content providing server according to the authentication result, content distribution history storage on the authentication server side, billing, and access environment for each content requester. A content processing unit 146 that performs sizing of the content and a content transmission unit 147 that sends the content acquired from the content providing server to the first terminal.

  Next, content providing processing by the authentication system according to the fifth embodiment will be described with reference to FIG. The content providing process by the authentication system according to the fifth embodiment transmits and receives a content request between the content providing server and the authentication server, as compared with the content providing process by the authentication system according to the fourth embodiment illustrated in FIG. The point is different.

  That is, as shown in FIG. 33, after the authentication server performs the authentication process (step 8100), the authentication server 100 transmits a content request as an HTTP request message to the content providing server based on the authentication result (step 8100). 8110). Then, the content providing server 600 transmits the content as an HTTP response message to the authentication server 100 (step 8120).

  Then, after the authentication server 100 processes the content as illustrated in FIG. 34 (step 8130), the content providing server 600 transmits the content to the first terminal 210 as an HTTP response message (step 8140).

  As described above, according to the fifth embodiment, when the first terminal transmits an authentication request to the content providing server, the content providing server requests the authentication server for authentication and receives an appropriate response from the second terminal. Then, the content is transmitted to the authentication server, and the authentication server transmits the content to the first terminal. Therefore, any content is provided via the authentication server. Billing, content sizing based on the access environment for each content requester, and the like are possible.

  By the way, in the second embodiment, the case where the authentication server that authenticates the accessor is provided has been described. However, the present invention is not limited to this, and further includes a content providing server that provides content to the first terminal. When the first terminal sends an authentication request to the authentication server, the authentication server sends back an authentication result after receiving a valid response from the second terminal, and this time, the content request is sent to the content providing server. Also good.

  Therefore, in Example 6 below, a content providing server that provides content to the first terminal is further provided, and when the first terminal transmits an authentication request to the authentication server, the authentication server receives a valid response from the second terminal. An authentication system according to the sixth embodiment will be described with reference to FIGS. 35 to 39 as a case where an authentication result is returned later and a content request is made to the content providing server this time.

  Specifically, as shown in FIG. 35, the configuration of the authentication system according to the sixth embodiment is different from the authentication system according to the second embodiment shown in FIG. To do. The content providing server 600 includes a content table 620 that stores content information, a content providing unit 630 that provides content to the first terminal, an authentication identifier verification processing unit 633 that verifies an authentication identifier, and communication that connects to the Internet. Part 610.

  Next, content providing processing by the authentication system according to the sixth embodiment will be described with reference to FIG. In the content providing process by the authentication system according to the sixth embodiment, the authentication identifier indicating the authentication result in the authentication server is received from the first terminal as compared with the login process by the authentication system according to the second embodiment illustrated in FIG. The difference is that content is provided to the first terminal.

  That is, as shown in FIG. 36, after performing the authentication process (step 9080), the authentication server 100 performs an authentication identifier generation process as illustrated in FIG. 37 (step 9090). Then, after the authentication server 100 transmits an authentication identifier indicating the authentication result to the first terminal 210 as an HTTP response message (step 9100), the first terminal 210 transmits the authentication identifier to the content providing server 600 as an HTTP request message. (Step 9110).

  Thereafter, after the content providing server 600 performs an authentication identifier verification process as illustrated in FIG. 37 (step 9120), the content providing server 600 transmits the content to the first terminal 210 as an HTTP response message (step 9130). ).

  Thus, according to Example 6 above, when the first terminal transmits an authentication request to the authentication server, the authentication server returns an authentication result after receiving a valid response from the second terminal, and together with the result, Since the content request is requested from the content providing server this time, it is possible to transmit the content request to any content providing server by receiving the authentication result once.

  By the way, in the second embodiment, the case where the authentication server that authenticates the accessor is provided has been described. However, the present invention is not limited to this, and further includes a content providing server that provides content to the first terminal. When the first terminal transmits an authentication request to the authentication server, the authentication server requests the content providing server together with the authentication result after receiving a reasonable response from the second terminal, and transmits the content to the first terminal. You may do it.

  Specifically, as illustrated in FIG. 38, the configuration of the authentication system according to the seventh embodiment is different from the authentication system according to the sixth embodiment illustrated in FIG. 35 in that the content request unit 148, the content processing unit 146, and the content The difference is that the transmitter 147 is provided. The content request unit 148, the content processing unit 146, and the content transmission unit 147 are the same as those in the fifth embodiment.

  The content providing server 600 includes a content table 620 that stores content information, a content providing unit 630 that provides content to the first terminal 210, and a communication unit 610 that connects to the Internet.

  Next, content providing processing by the authentication system according to the seventh embodiment will be described with reference to FIG. The content providing process by the authentication system according to the seventh embodiment transmits and receives a content request between the content providing server and the authentication server, as compared with the content providing process by the authentication system according to the sixth embodiment illustrated in FIG. The point is different.

  That is, as shown in FIG. 39, after performing the authentication process (step 10800), the authentication server 100 transmits a content request as an HTTP request message to the content providing server based on the authentication result (step 10800). 10900). Then, the content providing server 600 transmits the content as an HTTP response message to the authentication server 100 (step 11000).

  Then, after the authentication server 100 processes the content as illustrated in FIG. 34 (step 11100), the content providing server 600 transmits the content to the first terminal 210 as an HTTP response message (step 11200).

  As described above, according to the seventh embodiment, when the first terminal transmits an authentication request to the authentication server, the authentication server receives the valid response from the second terminal and then sends the content to the content providing server together with the authentication result. By requesting and sending the content to the first terminal, the access always passes through the authentication server at the time of access. Therefore, the content requester only needs to access the authentication server through the first terminal. Can be reduced.

  The embodiment of the present invention has been described so far, but the present invention will be described as an eighth embodiment in addition to the above-described embodiment.

(1) Registration URL Notifying Means For example, in the above-described first embodiment, the authentication server has described the case where the registration URL generated using mail is transmitted to the second terminal. However, the present embodiment is not limited to this. For example, notification may be made using a telephone or the like.

(2) Means for Notifying Individual Identification Number etc. In the first embodiment, the second terminal has explained the case where the second terminal transmits the individual identification number, the session ID, and the passcode to the authentication server 100. The notification is not limited to this, and notification may be made using, for example, HTTPS, telephone, mail, infrared communication, or the like.

(3) Access Code In the second embodiment, the case where the address of the second terminal and the individual identification number are included in the address code in the access code generation process has been described. However, the present embodiment is not limited to this. For example, either the address of the second terminal or the individual identification number may be included.

(4) System configuration, etc. Of the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or can be performed manually. All or part of the described processing can be automatically performed by a known method. In addition, the processing procedure, control procedure, specific name, and information including various data and parameters shown in the above-mentioned document and drawings can be arbitrarily changed unless otherwise specified.

  Each component of each illustrated device is functionally conceptual and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. Further, all or any part of each processing function performed in each device may be realized by a CPU and a program analyzed and executed by the CPU, or may be realized as hardware by wired logic.

  The authentication system, authentication method, and authentication program described in the above embodiments can be realized by executing a program prepared in advance on a computer such as a personal computer or a workstation. This program can be distributed via a network such as the Internet. The program can also be executed by being recorded on a computer-readable recording medium such as a hard disk, a flexible disk (FD), a CD-ROM, an MO, and a DVD and being read from the recording medium by the computer.

  As described above, the authentication system, the authentication method, and the authentication program according to the present invention are useful for authenticating an accessor, and in particular, can easily and safely confirm the identity of the accessor from the first terminal. Suitable for.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a diagram for explaining an overview and features of an authentication system according to a first embodiment. 1 is a diagram illustrating a configuration of an authentication system according to Embodiment 1. FIG. It is a figure for demonstrating the example of a management information table. It is a figure for demonstrating the example of a connection information table. It is a sequence diagram which shows the flow of the registration process by the authentication system which concerns on Example 1. FIG. It is a flowchart which shows the detail of a registration URL production | generation process. It is a flowchart which shows the detail of a registration process. It is a sequence diagram which shows the flow of the login process by the authentication system which concerns on Example 1. FIG. It is a flowchart which shows the detail of an authentication URL production | generation process. It is a flowchart which shows the detail of an authentication process. It is a figure which shows the structure of the authentication system which concerns on Example 2. FIG. FIG. 10 is a sequence diagram illustrating a flow of access code issuing processing by the authentication system according to the second embodiment. It is a flowchart which shows the detail of an access person authentication process. It is a flowchart which shows the detail of an access code production | generation process. FIG. 10 is a sequence diagram illustrating a flow of login processing by the authentication system according to the second embodiment. It is a flowchart which shows the detail of an access code decoding process. It is a figure for demonstrating the example of an access code. It is a figure for demonstrating the example of the effective conditions contained in an access code. It is a figure which shows the example of the screen which concerns on a registration request / login request. It is a figure which shows the example of the screen which concerns on the response of a registration request. It is a figure which shows the example of the screen which concerns on a registration request mail. It is a figure which shows the example of the screen which concerns on registration result transmission. It is a figure which shows the example of the screen which concerns on the response of a login request | requirement. It is a figure which shows the example of the screen which concerns on an authentication request | requirement mail. It is a figure which shows the example of the screen which concerns on an authentication result notification. It is a figure which shows the structure of the authentication system which concerns on Example 3. FIG. FIG. 10 is a sequence diagram illustrating a flow of registration processing by an authentication system according to a third embodiment. FIG. 10 is a sequence diagram illustrating a flow of login processing by the authentication system according to the third embodiment. It is a figure for demonstrating the example of a transfer information table. It is a figure which shows the structure of the authentication system which concerns on Example 4. FIG. It is a sequence diagram which shows the flow of the content provision process by the authentication system which concerns on Example 4. FIG. It is a figure which shows the structure of the authentication system which concerns on Example 5. FIG. It is a sequence diagram which shows the flow of the content provision process by the authentication system which concerns on Example 5. FIG. It is a figure for demonstrating the example of a content process. It is a figure which shows the structure of the authentication system which concerns on Example 6. FIG. It is a sequence diagram which shows the flow of the content provision process by the authentication system which concerns on Example 6. FIG. It is a figure for demonstrating the example of an authentication identifier production | generation process and a verification process. It is a figure which shows the structure of the authentication system which concerns on Example 7. FIG. FIG. 10 is a sequence diagram illustrating a flow of content providing processing by the authentication system according to the seventh embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Authentication server 110 Communication part 120 Management information table 121 Connection information table 122 Issuance key memory | storage part 130 Registration part 131 Registration URL generation part 132 Registration URL transmission part 133 Registration process part 134 Registration result transmission part 135 Access code generation part 140 Authentication part 141 Authentication URL generation unit 142 Authentication URL transmission unit 143 Authentication processing unit 144 Authentication result transmission unit 145 Access code decoding unit 146 Content processing unit 147 Content transmission unit 148 Content request unit 200 First terminal IP network 210 First terminal 300 Internet 400 Second Terminal IP network 410 Second terminal mail server 420 Second terminal 500 Transfer server 510 Communication unit 520 Transfer information table 530 Address decryption processing unit 531 Address transfer processing unit 600 Content provision Over bus 610 communication unit 620 the content table 630 content sending unit 631 a session generation unit 632 authentication request transmission unit

Claims (6)

An authentication system in which the authentication server authenticates the second terminal for access from the first terminal, and the result of the authentication is authentication of the first terminal,
The authentication server is
Registration access accepting means for accepting access of a registration request from the first terminal;
When receiving an access request from the first terminal by the registered access receiving means, a registered address requesting means for requesting the address of the second terminal;
When the address of the second terminal requested by the registration address requesting unit is received from the first terminal, a session ID is generated, a registration URL to which the session ID is added is generated, and the session ID and the second terminal are generated. Registration URL transmission means for associating the address of the terminal with the status information indicating that the terminal is in the registration process, storing it in the connection information table, and transmitting the registration URL to the second terminal;
When the session ID is received from the second terminal using the registration URL, the state information associated with the session ID is read from the connection information table, and the state information associated with the session ID is registered. Registration determination means for determining whether or not processing is in progress;
A registration processing unit that registers a session ID in a management information table when the registration determination unit determines that the state associated with the session ID is a state during registration processing;
Authentication access accepting means for accepting access of an authentication request from the first terminal;
When an access request is received from the first terminal by the authentication access receiving means, an authentication address requesting means for requesting an address of the second terminal;
Receiving the address of the second terminal requested by the authentication address requesting means from the first terminal, second terminal address determining means for determining whether the address of the second terminal is registered in the management information table;
When the second terminal address determination means determines that the address of the second terminal is registered in the management information table, an authentication URL with a session ID added is generated, and the session ID and the second address are generated. Authentication URL transmission means for associating and storing the address of the two terminals and the status information indicating that the authentication process is in progress in the connection information table, and transmitting the authentication URL to the address of the second terminal;
Using the authentication URL, the session ID is received from the second terminal, the state information associated with the session ID is read from the connection information table, and the state information associated with the session ID is being authenticated. Authentication determination means for determining whether the state is
If it is determined by the authentication determining means that the state associated with the session ID is an authentication process, the authentication process is performed, and the state associated with the session ID is an authentication process. If it is determined that it is not in a state, an authentication processing means for processing that authentication is impossible;
An authentication system characterized by comprising: The authentication server is
When a registration request access is received from the first terminal by the registration access receiving means, an access code is generated by encrypting the address of the second terminal and the individual identification number of the second terminal with a predetermined key. Access code generating means;
Access code transmitting means for transmitting the access code generated by the access code generating means to the first terminal;
An access code decoding means for acquiring the address of the second terminal by decoding the access code when the access code is received from the first terminal;
The authentication system according to claim 1, wherein the authentication URL transmitting unit transmits the authentication URL to the address of the second terminal acquired by the access code decoding unit . An authentication method in which the authentication server authenticates the second terminal for access from the first terminal, and the result of the authentication is authentication of the first terminal,
The authentication server is
A registration access accepting step for accepting access of a registration request from the first terminal;
If an access request is received from the first terminal by the registration access reception step, a registration address request step for requesting an address of the second terminal;
When the address of the second terminal requested by the registration address requesting step is received from the first terminal, a session ID is generated, a registration URL added with the session ID is generated, and the session ID and the second terminal are generated. A registration URL transmission step of storing the address of the terminal and the state information indicating that the terminal is in a registration process in association with each other in the connection information table and transmitting the registration URL to the second terminal;
When the session ID is received from the second terminal using the registration URL, the state information associated with the session ID is read from the connection information table, and the state information associated with the session ID is registered. A registration determination step for determining whether the state is being processed;
If the registration determination step determines that the state associated with the session ID is a state during registration processing, a registration processing step of registering the session ID in the management information table;
An authentication access accepting step for accepting access of an authentication request from the first terminal;
When receiving an access request from the first terminal by the authentication access receiving step, an authentication address requesting step for requesting an address of the second terminal;
When receiving the address of the second terminal requested by the authentication address requesting step from the first terminal, a second terminal address determining step of determining whether the address of the second terminal is registered in the management information table;
If it is determined in the second terminal address determination step that the address of the second terminal is registered in the management information table, an authentication URL to which a session ID is added is generated, and the session ID and the first address are generated. An authentication URL transmitting step of associating the address of the two terminals with the status information indicating that the authentication process is being performed and storing the information in the connection information table and transmitting the authentication URL to the address of the second terminal;
Using the authentication URL, the session ID is received from the second terminal, the state information associated with the session ID is read from the connection information table, and the state information associated with the session ID is being authenticated. An authentication determination step of determining whether the state is
If it is determined in the authentication determination step that the state associated with the session ID is an authentication processing state, the authentication process is performed, and the state associated with the session ID is an authentication process. If it is determined that it is not in a state, an authentication processing step for processing as unauthenticated,
The authentication method characterized by including. The authentication server is
When a registration request access is received from the first terminal in the registration access receiving step, an access code is generated by encrypting the address of the second terminal and the individual identification number of the second terminal with a predetermined key. An access code generation process;
An access code transmitting step of transmitting the access code generated by the access code generating step to the first terminal;
An access code decrypting step of decrypting the access code to obtain the address of the second terminal when the access code is received from the first terminal;
4. The authentication method according to claim 3 , wherein the authentication URL transmission step transmits the authentication URL to the address of the second terminal acquired by the access code decoding step . An authentication program for causing the computer to execute an authentication method in which the authentication server authenticates the second terminal for access from the first terminal, and the authentication result of the first terminal is the authentication result,
In the computer as the authentication server,
A registration access acceptance procedure for accepting registration request access from the first terminal;
If an access request is accepted from the first terminal by the registration access acceptance procedure, a registration address request procedure for requesting the address of the second terminal;
When the address of the second terminal requested by the registration address request procedure is received from the first terminal, a session ID is generated, a registration URL to which the session ID is added is generated, and the session ID and the second terminal are generated. A registration URL transmission procedure for storing the address of the terminal and the state information indicating that the terminal is in a registration process in the connection information table and transmitting the registration URL to the second terminal;
When the session ID is received from the second terminal using the registration URL, the state information associated with the session ID is read from the connection information table, and the state information associated with the session ID is registered. A registration determination procedure for determining whether the processing is in progress;
If it is determined by the registration determination procedure that the state associated with the session ID is a state during registration processing, a registration processing procedure for registering the session ID in the management information table;
An authentication access acceptance procedure for accepting an authentication request access from the first terminal;
If an access request is accepted from the first terminal by the authentication access acceptance procedure, an authentication address request procedure for requesting the address of the second terminal;
When receiving the address of the second terminal requested by the authentication address request procedure from the first terminal, a second terminal address determination procedure for determining whether the address of the second terminal is registered in the management information table;
When it is determined by the second terminal address determination procedure that the address of the second terminal is registered in the management information table, an authentication URL to which a session ID is added is generated, and the session ID and the first An authentication URL transmission procedure for associating and storing the address of the two terminals and the status information indicating that the authentication process is in progress in the connection information table, and transmitting the authentication URL to the address of the second terminal;
Using the authentication URL, the session ID is received from the second terminal, the state information associated with the session ID is read from the connection information table, and the state information associated with the session ID is being authenticated. An authentication determination procedure for determining whether the state is
If it is determined by the authentication determination procedure that the state associated with the session ID is an authentication process, the authentication process is performed, and the state associated with the session ID is an authentication process. If it is determined that it is not in a state, an authentication processing procedure for processing as unauthenticated,
The authentication program for causing runs. In the computer as the authentication server,
When a registration request access is accepted from the first terminal by the registration access acceptance procedure, an access code is generated by encrypting the address of the second terminal and the individual identification number of the second terminal with a predetermined key. Access code generation procedure;
An access code transmission procedure for transmitting the access code generated by the access code generation procedure to the first terminal;
When the access code is received from the first terminal, an access code decoding procedure for decoding the access code and obtaining the address of the second terminal is further executed,
6. The authentication program according to claim 5 , wherein the authentication URL transmission procedure transmits the authentication URL to the address of the second terminal obtained by the access code decoding procedure .

Images