JP7574158B2 - Terminal and authentication device - Google Patents

Description

The present invention relates to a terminal that is subject to authentication in order to use a specific function on the terminal itself, and an authentication device related to said authentication.

Conventionally, methods have been proposed to facilitate authentication of a terminal in order to use a specific function on the terminal itself. As one such method, Patent Document 1 describes a method in which a terminal reads a code displayed on another terminal and issues an authentication request including the read code. With this type of authentication, the terminal to be authenticated can be authenticated without the user having to input an ID, password, etc.

JP 2019-75140 A

In the method described in Patent Document 1 above, if the code displayed on another terminal is illegally obtained, a third party's terminal that should not be authenticated can be authenticated.

The present invention has been made in consideration of the above, and aims to provide a terminal and authentication device that can prevent fraudulent authentication when using a code displayed on the terminal.

In order to achieve the above object, the terminal according to the present invention includes a reading unit that reads a code that includes authentication information used for authentication to use a specific function in the terminal itself and is displayed on another terminal, a location acquisition unit that acquires local terminal location information indicating the location of the terminal itself, an authentication request unit that makes an authentication request including the authentication information included in the code read by the reading unit according to the local terminal location information acquired by the location acquisition unit, and a function utilization unit that utilizes a specific function in the terminal itself according to an authentication result for the authentication request made by the authentication request unit. The reading unit reads a code that further includes other terminal location information that indicates the location of the other terminal, and the authentication request unit compares the other terminal location information included in the code read by the reading unit with the local terminal location information and makes an authentication request according to the comparison result. Alternatively, the authentication request unit makes an authentication request that also includes the local terminal location information acquired by the location acquisition unit, and the authentication device to which the authentication request is made performs authentication based on the authentication information and the local terminal location information included in the authentication request and outputs the authentication result to the terminal.

In addition, the authentication device of the present invention has a code generation unit that receives a request for generation of a code that includes authentication information used for authentication to use a specified function on the terminal itself and is to be displayed on another terminal, and other terminal location information that indicates the location of the other terminal, and generates the code that includes the other terminal location information , and the code generation unit determines whether to generate the code based on the other terminal location information .

In addition, the authentication device of the present invention includes an authentication request receiving unit that receives from a terminal an authentication request including authentication information used for authentication to use a specified function on the terminal, which is contained in a code read from another terminal, and own terminal location information indicating the location of the terminal; an authentication unit that performs authentication based on the authentication information and own terminal location information contained in the authentication request received by the authentication request receiving unit and outputs the authentication result to the terminal; and a code generation unit that receives a request for code generation and other terminal location information indicating the position of the other terminal, determines whether or not to generate the code based on the received other terminal location information, and generates the code .

The terminal and authentication device according to the present invention perform authentication when a function is used on the terminal according to the terminal's own terminal location information. Therefore, the terminal and authentication device according to the present invention can prevent fraudulent authentication when using a code displayed on another terminal based on the terminal's location.

The present invention makes it possible to prevent fraudulent authentication using a code displayed on a terminal.

1 is a diagram showing a configuration of a system including an authentication target terminal which is a terminal according to an embodiment of the present invention, and a server which is an authentication device according to an embodiment of the present invention. 2 is a sequence diagram showing a process executed in a system including an authentication target terminal which is a terminal according to an embodiment of the present invention, and a server which is an authentication device according to an embodiment of the present invention. FIG. 1 is a diagram showing a hardware configuration of an authentication target terminal which is a terminal according to an embodiment of the present invention, and a server which is an authentication device according to an embodiment of the present invention.

Below, an embodiment of a terminal and an authentication device according to the present invention will be described in detail with reference to the drawings. Note that in the description of the drawings, the same elements are given the same reference numerals, and duplicated descriptions will be omitted.

First Embodiment
1 shows an authentication target terminal 10 which is a terminal according to this embodiment, and a server 20 which is an authentication device according to this embodiment. The authentication target terminal 10 is a computer used by a user. For example, the authentication target terminal 10 is a device carried or worn by a user, and may be a head-mounted display or the like. The authentication target terminal 10 may also be one which displays MR (mixed reality), or the like.

The authentication target terminal 10 has a predetermined function according to this embodiment. For example, the authentication target terminal 10 is used by a user who is a worker at a predetermined work site such as a factory, and has a function necessary for work at the work site. The function is, for example, a function to present the user with work procedures and work materials such as equipment operation manuals, and a function to make calls between the user and a remote location for work. Note that the place where the function is used and the function itself are not limited to those described above and may be any function.

The function may be realized, for example, by a business support app, which is a specific application installed in the authentication target terminal 10. The authentication target terminal 10 is authenticated as to whether it is permitted to use the functions of the business support app. That is, the authentication target terminal 10 logs in to use the functions of the business support app. If the authentication is successful, that is, if the login is successful, the functions of the business support app become available in the authentication target terminal 10. Note that the functions possessed by the authentication target terminal 10 may be realized by something other than the business support app.

The server 20 is a device that performs the above authentication. The server 20 is realized by a computer such as a PC (personal computer) or a server device, for example.

The code display terminal 30 is also used for the above authentication. The code display terminal 30 is a computer used by the user. For example, the code display terminal 30 is a device carried by the user, and may be a smartphone or the like. The code display terminal 30 has at least an information display function. The authentication target terminal 10, the server 20, and the code display terminal 30 have a communication function. The authentication target terminal 10 and the server 20 can send and receive information to each other via a network using their respective communication functions. In addition, the code display terminal 30 and the server 20 can send and receive information to each other via a network using their respective communication functions.

Authentication is performed by transmitting authentication information used for authentication from the authentication target terminal 10 to the server 20. The code display terminal 30 displays a code including the authentication information. The authentication target terminal 10 reads the code displayed on the code display terminal 30, obtains authentication information from the read code, and transmits it to the server 20 to receive authentication. This type of authentication allows the user to easily receive authentication without having to input information such as an ID and password used for authentication in the authentication target terminal 10 by user operation. In particular, authentication can be easily received even if the authentication target terminal 10 does not have an interface that makes it easy for the user to input information such as an ID and password.

Next, the functions of the authentication target terminal 10 and the server 20 according to this embodiment will be explained. In the following explanation, the functions of the code display terminal 30 corresponding to these functions will also be explained. First, the functions of the server 20 will be explained, and then the functions of the authentication target terminal 10 will be explained. As shown in FIG. 1, the server 20 according to this embodiment is configured to include a code generation unit 21, an authentication request reception unit 22, and an authentication unit 23.

The code generation unit 21 is a functional unit that receives a request to generate a code that includes authentication information used for authentication to use a specific function on the own terminal and is also displayed on another terminal, and generates the code. The code generation unit 21 also receives other terminal location information that indicates the location of the other terminal, and generates the code that includes the other terminal location information. The code generation unit 21 may determine whether or not to generate a code based on the other terminal location information. The code generation unit 21 generates the code as follows.

The request for code generation is made by another terminal, the code display terminal 30. The request for code generation must be made when the code display terminal 30 is located at the position where the authentication target terminal 10 is authenticated. Note that the position where the authentication target terminal 10 is authenticated and the position where the code display terminal 30 requests code generation do not need to exactly match, and may be within a certain distance, for example, within a few meters.

For example, the location where the authentication target terminal 10 is authenticated and the location where the code display terminal 30 requests the generation of a code are a specified work location such as a factory where the business support app is used. As a result, even if an attempt is made to receive authentication for using the business support app at a location other than the specified work location after a code is generated in response to a request from the code display terminal 30, the authentication will not be successful and the business support app cannot be used. For example, even if the ID and password for generating the code or the business support app is leaked, the code display terminal 30 is lost or stolen, or a third party who does not have the authority to use the business support app illegally obtains the code, it is possible to prevent unauthorized use of the business support app by a third party or a malicious user. This makes it possible to prevent the leakage of confidential information that can be referenced when using the business support app.

The code display terminal 30 makes a request to the server 20 to generate a code, for example, as follows. The code display terminal 30 accesses the server 20 and receives authentication for generating a code. For example, the code display terminal 30 accepts a user's operation on the code display terminal 30, inputs an ID and password for the authentication, and transmits the ID and password to the server 20 as a request for generating a code.

The code generation unit 21 receives the ID and password sent from the code display terminal 30. The code generation unit 21 compares the received ID and password combination with a previously set and stored ID and password combination. If the comparison shows that the combinations match, the code generation unit 21 determines that the authentication is successful, and if the combinations do not match, the authentication is unsuccessful.

The code display terminal 30 also acquires other terminal location information indicating the location of the other terminal, i.e., the own terminal. The other terminal location information may be, for example, information on the latitude and longitude of the location of the code display terminal 30, or may be other information indicating a conventional location. The code display terminal 30 has a positioning function for its own terminal, such as a positioning function using GPS (Global Positioning System), and acquires the other terminal location information using the positioning function. The positioning function of the code display terminal 30 may be other than the above. When the code is generated, the code display terminal 30 acquires other terminal location information obtained by positioning at the timing of receiving the above authentication, for example, and transmits it to the server 20 together with a request for generating the code. The code display terminal 30 may transmit the other terminal location information to the server 20 after the above authentication is successful, or may transmit the other terminal location information to the server 20 together with the ID and password.

The code generation unit 21 receives and accepts the other terminal location information transmitted from the code display terminal 30. If the above authentication is successful, the code generation unit 21 determines whether or not to generate a code based on the accepted other terminal location information. The code generation unit 21 pre-stores the location for which code generation is permitted. For example, the code generation unit 21 stores the location of a specified work place as the location. The stored information indicating the location may be latitude and longitude information, or may be other conventional information indicating a location. The location for which code generation is permitted is, for example, set in advance by an administrator who manages the functions of the business support app, and registered in the server 20.

The code generation unit 21 compares the stored location where code generation is permitted with the location indicated by the other terminal location information as follows: The code generation unit 21 calculates the distance between the location where code generation is permitted and the location indicated by the other terminal location information. The code generation unit 21 compares the calculated distance with a preset and stored threshold. If the distance is equal to or less than the threshold, the code generation unit 21 determines to generate a code. If the distance exceeds the threshold, the code generation unit 21 determines not to generate a code. The above determination by comparing the locations is intended to generate a code only when the code display terminal 30 is located in a position close to a preset location where code generation is permitted. For example, the code is generated only when the code display terminal 30 is located in a specified work location when the code is generated.

The location where code generation is permitted may be information indicating a range of locations. In this case, the decision as to whether or not to generate a code may be made by determining whether or not the location indicated by the other terminal location information is included in that range. For example, if the location indicated by the other terminal location information is included in that range, it is determined that a code should be generated, and if the location indicated by the other terminal location information is not included in that range, it is determined that a code should not be generated.

The code generation unit 21 may also perform the above-mentioned location matching before the authentication using the ID and password, rather than after the authentication. In this case, if the location matching is successful (i.e., if the above-mentioned distance is equal to or less than the threshold), the code generation unit 21 performs the above-mentioned authentication using the ID and password. If the location matching is unsuccessful (i.e., if the above-mentioned distance is greater than the threshold), the code generation unit 21 determines not to perform the above-mentioned authentication using the ID and password and not to generate a code. If the above-mentioned authentication using the ID and password after the location matching is successful, the code generation unit 21 determines to generate a code. If the above-mentioned authentication using the ID and password after the location matching is unsuccessful, the code generation unit 21 determines not to generate a code. Note that, when the location matching is performed before the authentication using the ID and password, the code display terminal 30 may transmit the other terminal location information and the ID and password to the server 20 at the same time, or may transmit the other terminal location information first, and transmit the ID and password to the server 20 after the location matching is successful.

When the code generation unit 21 determines to generate a code, it generates a code including authentication information used for authentication to use a specific function on its own terminal, specifically, authentication to use a business support app. The authentication information may be an ID and password transmitted from the code display terminal 30. The authentication information may also include a one-time password generated by the code generation unit 21. The ID and password may also be encrypted. Alternatively, the authentication information may be any information that can be used for authentication. The code generation unit 21 also includes other terminal location information in the code it generates. The code generation unit 21 outputs the authentication information included in the code to the authentication unit 23. The authentication information is used for authentication in the authentication unit 23.

The code generated by the code generation unit 21 may be a conventional two-dimensional code. However, the code does not necessarily have to be a two-dimensional code, and may be any code (e.g., a barcode) from which information can be read from a display. The generation of the code by the code generation unit 21 may be performed by a conventional code generation method. The code generation unit 21 transmits the generated code to the code display terminal 30, which is the request source.

If the code generation unit 21 determines not to generate a code, it does not perform the above process. In this case, the code generation unit 21 may notify the code display terminal 30 that a code will not be generated.

The code display terminal 30 may perform the above-mentioned communication with the code generation unit 21 and display the code using a web browser provided in the code display terminal 30. By using a general-purpose application such as a web browser, any terminal having the application can be used as the code display terminal 30. In addition, the manufacturing costs of dedicated applications can be reduced.

In addition, authentication of the code display terminal 30 by the code generation unit 21 may be performed by a method other than the above-mentioned ID and password authentication. For example, iris authentication may be performed.

The authentication request receiving unit 22 is a functional unit that receives from a terminal an authentication request including authentication information used for authentication to use a specific function in the terminal, which is included in a code read from another terminal. The authentication request receiving unit 22 receives and accepts an authentication request transmitted from the authentication target terminal 10. The transmission of an authentication request by the authentication target terminal 10 will be described later. The authentication request receiving unit 22 outputs the authentication information included in the authentication request received from the authentication target terminal 10 to the authentication unit 23.

The authentication unit 23 is a functional unit that performs authentication based on the authentication information included in the authentication request accepted by the authentication request acceptance unit 22 and outputs the authentication result to the terminal. The authentication unit 23 inputs the authentication information from the code generation unit 21 and stores it. The authentication unit 23 inputs the authentication information from the authentication request acceptance unit 22. The authentication unit 23 performs authentication based on the stored authentication information and the authentication information input from the authentication request acceptance unit 22. The authentication itself may be performed in the same manner as in the past. For example, the authentication unit 23 compares the stored authentication information with the authentication information input from the authentication request acceptance unit 22, and if they match, the authentication is successful, and if they do not match, the authentication is unsuccessful. The authentication unit 23 transmits the authentication result to the authentication target terminal 10 that sent the authentication request and outputs it.

If the authentication is successful, the functions of the business support app become available on the authentication target terminal 10. If the authentication fails, the use of the functions of the business support app is prohibited (not permitted) on the authentication target terminal 10. These are the functions of the server 20 according to this embodiment.

Next, the functions of the authentication target terminal 10 will be described. As shown in FIG. 1, the authentication target terminal 10 according to this embodiment is configured to include a reading unit 11, a position acquisition unit 12, an authentication request unit 13, and a function utilization unit 14. Note that the above functions of the authentication target terminal 10 may be realized by a business support app. In this case, the functions for receiving authentication in the business support app can be used without receiving authentication.

The reading unit 11 is a functional unit that reads a code displayed on another terminal, including authentication information used for authentication to use a specific function on the terminal itself. The reading unit 11 reads a code that further includes other terminal location information that indicates the location of the other terminal.

The code display terminal 30, which is another terminal, receives the code transmitted from the server 20 as described above. The code display terminal 30 displays the received code. The reading unit 11 reads the code displayed by the code display terminal 30. The authentication target terminal 10 has an imaging device such as a conventional camera, and the reading unit 11 images and reads the code using the imaging device. The reading unit 11 reads the code when, for example, a user operates the authentication target terminal 10 to make the authentication target terminal 10 ready to read the code and the authentication target terminal 10 is held over the displayed code. Note that the reading of the code itself may be performed in the same manner as in the past. The reading unit 11 transmits information about the read code to the authentication request unit 13.

The location acquisition unit 12 is a functional unit that acquires local terminal location information indicating the location of the local terminal. The local terminal location information may be, for example, latitude and longitude information of the location of the authentication target terminal 10, or other conventional information indicating a location. The authentication target terminal 10 has a local terminal positioning function such as a GPS positioning function, and the location acquisition unit 12 acquires other terminal location information by this positioning function. Note that the positioning function possessed by the authentication target terminal 10 may be one other than the above.

The location acquisition unit 12 performs positioning at the timing when the authentication target terminal 10 receives authentication, and acquires its own terminal location information. For example, the location acquisition unit 12 acquires its own terminal location information at the timing when the code is read by the reading unit 11. The location acquisition unit 12 outputs the acquired own terminal location information to the authentication request unit 13.

The authentication request unit 13 is a functional unit that issues an authentication request including authentication information contained in the code read by the reading unit 11 in accordance with the own terminal location information acquired by the location acquisition unit 12. The authentication request unit 13 compares the other terminal location information included in the code read by the reading unit 11 with the own terminal location information, and issues an authentication request in accordance with the comparison result. For example, the authentication request unit 13 issues an authentication request as follows.

The authentication request unit 13 inputs the information of the code read by the reading unit 11. The read code includes the authentication information and the other terminal location information as described above. The authentication request unit 13 inputs the own terminal location information from the location acquisition unit 12.

The authentication request unit 13 compares the other terminal location information included in the read code with the own terminal location information as follows. The authentication request unit 13 calculates the distance between the location indicated by the other terminal location information and the location indicated by the own terminal location information. The authentication request unit 13 compares the calculated distance with a preset and stored threshold. If the distance is equal to or less than the threshold, the authentication request unit 13 determines to make an authentication request to the server 20. If the distance exceeds the threshold, the authentication request unit 13 determines not to make an authentication request to the server 20. The determination based on the comparison of the other terminal location information with the own terminal location information is for making an authentication request only when the authentication target terminal 10 is located in a position close to the position of the code display terminal 30 when the code is generated, that is, for making the business support app available only in that case. For example, for making the business support app available only when the code display terminal 30 and the authentication target terminal 10 are located in the same work place.

When the authentication request unit 13 determines that an authentication request should be made to the server 20, it generates an authentication request including the authentication information contained in the read code and transmits it to the server 20.

The function utilization unit 14 is a functional unit that utilizes a predetermined function in its own terminal according to the authentication result in response to the authentication request made by the authentication request unit 13. When the authentication request unit 13 makes an authentication request to the server 20, the authentication result is transmitted from the server 20 to the authentication target terminal 10 as described above. The function utilization unit 14 receives the authentication result transmitted from the server 20. If the authentication result indicates successful authentication, the function utilization unit 14 makes the function of the business support app available (releases the function). This allows the user to use the function of the business support app. If the authentication result indicates unsuccessful authentication, the function utilization unit 14 prohibits (does not permit) the use of the function of the business support app. These are the functions of the authentication target terminal 10 according to this embodiment.

Next, the process executed by the authentication target terminal 10, the server 20, and the code display terminal 30 according to this embodiment (the operation method performed by the authentication target terminal 10, the server 20, and the code display terminal 30) will be described using the sequence diagram in FIG. 2. This process is performed when the business support app is used in the authentication target terminal 10 after being authenticated by the server 20.

In this process, first, an ID and password used for authentication to generate a code are input into the code display terminal 30 and transmitted to the server 20 (S01). At this time, the code display terminal 30 also acquires other terminal location information and transmits it to the server 20 (S02).

In the server 20, the code generation unit 21 receives the ID and password transmitted from the code display terminal 30 (S03). The code generation unit 21 also receives other terminal location information from the code display terminal 30 (S04). Next, the code generation unit 21 authenticates the code display terminal 30 based on the received ID and password (S05). If the authentication is successful, the code generation unit 21 generates a code and transmits it to the code display terminal 30 (S06). Here, the stored location at which code generation is permitted may be compared with the location indicated by the other terminal location information to determine whether or not to generate a code. As described above, the order of the location comparison and the authentication using the ID and password does not matter. The generated code includes authentication information and other terminal location information. If the authentication fails, the subsequent processing is not performed.

Then, the code is received by the code display terminal 30 (S07). The received code is displayed on the code display terminal 30 (S08). The displayed code is read by the reading unit 11 of the authentication target terminal 10 (S09). At this timing, the authentication target terminal 10 acquires its own terminal location information by the location acquisition unit 12 (S10). Next, the authentication request unit 13 compares the other terminal location information with its own terminal location information (S11). If the result of the comparison indicates that an authentication request should be made to the server 20, the authentication request unit 13 makes an authentication request to the server 20 (S12). The authentication request includes the authentication information contained in the read code. If the result of the comparison indicates that an authentication request should not be made to the server 20, no further processing is performed.

In the server 20, the authentication request receiving unit 22 receives and accepts the authentication information sent from the authentication target terminal 10 (S13). Next, the authentication unit 23 performs authentication based on the authentication information included in the authentication request and transmits the authentication result to the authentication target terminal 10 (S14).

In the authentication target terminal 10, the function utilization unit 14 receives the authentication result from the server 20 (S15). If the authentication result indicates successful authentication, the function of the business support app is released by the function utilization unit 14 (S16). In this case, the user can use the function of the business support app. If the authentication result indicates unsuccessful authentication, the function of the business support app is not released by the function utilization unit 14, and the user cannot use the function of the business support app. The above is the process executed by the authentication target terminal 10, the server 20, and the code display terminal 30 according to this embodiment.

According to this embodiment, when the function of the business support app is used in the authentication target terminal 10, authentication is performed according to the terminal's own location information. Specifically, a code including the other terminal location information is generated in the server 20, and the authentication target terminal 10 compares the other terminal location information with the terminal's own location information, and performs an authentication request according to the comparison result. For example, authentication is performed only when the code display terminal 30 at the time of code generation (e.g., when the code generation is requested) and the authentication target terminal 10 at the time of authentication are located, for example, in the same work place. Therefore, even if the code is obtained illegally, it is possible to prevent authentication from being performed in a place other than a specific place. Therefore, according to this embodiment, it is possible to prevent illegal authentication in authentication using a code displayed on the code display terminal 30 based on the location of the authentication target terminal 10.

Also, as in this embodiment, the server 20 may determine whether or not to generate a code based on other terminal location information. With this configuration, for example, a code can be generated according to the location of the code display terminal 30 at the time the code is generated. Specifically, a code can be generated only if the code display terminal 30 is located at a pre-set location, such as a predetermined work area, at the time the code is generated. Therefore, code generation can be prevented when a request for code generation is made from an unexpected location, and fraudulent authentication can be appropriately prevented. However, the above determination does not necessarily have to be made.

Second Embodiment
In the first embodiment, the other terminal location information is used in the authentication target terminal 10 to determine whether or not to make an authentication request to the server 20. In the second embodiment, the other terminal location information is used in a manner different from that of the first embodiment. In the following description, differences from the first embodiment will be described, and points that are not particularly described may be the same as those of the first embodiment. Furthermore, the first embodiment and the second embodiment may be combined as long as they do not contradict each other.

As in the first embodiment, the system configuration according to this embodiment also includes the authentication target terminal 10, the server 20, and the code display terminal 30 shown in FIG. 1. Next, the differences from the first embodiment will be described for the functional parts of the server 20 according to this embodiment, that is, the code generation part 21, the authentication request reception part 22, and the authentication part 23.

The code generation unit 21 generates a code in the same manner as in the first embodiment. The code generation unit 21 may receive a request for code generation and other terminal location information in the same manner as in the first embodiment, and generate a code by determining whether or not to generate the code based on the received other terminal location information. When generating a code, the code generation unit 21 outputs the other terminal location information received from the code display terminal 30 to the authentication unit 23. Note that in this embodiment, the code generation unit 21 does not need to include other terminal location information in the code to be generated.

The authentication request receiving unit 22 receives from a terminal an authentication request including authentication information used for authentication to use a specific function in the terminal, which is included in a code read from another terminal, and own terminal location information indicating the location of the terminal. The authentication request receiving unit 22 receives and accepts an authentication request transmitted from the authentication target terminal 10, as in the first embodiment. As will be described later, the authentication request includes, in addition to the authentication request shown in the first embodiment, own terminal location information indicating the location of the authentication target terminal 10. The authentication request receiving unit 22 outputs the authentication information and own terminal location information included in the authentication request received from the authentication target terminal 10 to the authentication unit 23.

The authentication unit 23 performs authentication based on the authentication information and the own terminal location information included in the authentication request accepted by the authentication request acceptance unit 22, and outputs the authentication result to the terminal. The authentication unit 23 may acquire other terminal location information indicating the location of the other terminal, and perform authentication by comparing the acquired other terminal location information with the own terminal location information. The authentication unit 23 inputs the authentication information and other terminal location information from the code generation unit 21, acquires them, and stores them. The authentication unit 23 inputs the authentication information and the own terminal location information from the authentication request acceptance unit 22.

The authentication unit 23 performs authentication based on the stored authentication information and the authentication information input from the authentication request reception unit 22. The authentication is performed in the same manner as in the first embodiment. The authentication unit 23 further performs authentication by comparing the stored other terminal location information with the own terminal location information input from the authentication request reception unit 22.

The authentication unit 23 compares the stored other terminal position information with the own terminal position information input from the authentication request receiving unit 22 as follows. The authentication unit 23 calculates the distance between the position indicated by the other terminal position information and the position indicated by the own terminal position information. The authentication unit 23 compares the calculated distance with a preset and stored threshold. If the distance is equal to or less than the threshold, the authentication unit 23 determines that the authentication is successful. If the distance exceeds the threshold, the authentication request unit 13 determines that the authentication is unsuccessful. The purpose of authentication by comparing the other terminal position information with the own terminal position information is the same as the purpose of judgment by the authentication request unit 13 in the first embodiment by comparing the other terminal position information with the own terminal position information.

If the authentication unit 23 determines that both the authentication based on the authentication information and the authentication based on the other terminal location information and the own terminal location information are successful, the authentication unit 23 finally determines that the authentication is successful. If the authentication unit 23 determines that either the authentication based on the authentication information or the authentication based on the other terminal location information and the own terminal location information is unsuccessful, the authentication unit 23 finally determines that the authentication is unsuccessful. The two authentications, the authentication based on the authentication information and the authentication based on the other terminal location information and the own terminal location information, may be performed in a preset order, and if the first authentication fails, the other authentication may not be performed. The authentication unit 23 transmits and outputs the final authentication result to the authentication target terminal 10 that sent the authentication request. These are the functions of the server 20 according to this embodiment.

Next, we will explain the differences between the first embodiment and the functional parts of the authentication target terminal 10 according to this embodiment, that is, the reading unit 11, the position acquisition unit 12, the authentication request unit 13, and the function utilization unit 14.

The reading unit 11 reads the code displayed by the code display terminal 30, as in the first embodiment. Note that the code generated by the server 20 and read by the reading unit 11 as described above does not need to include other terminal location information. The location acquisition unit 12 acquires its own terminal location information, as in the first embodiment.

The authentication request unit 13 makes an authentication request including the own terminal location information acquired by the location acquisition unit 12. The authentication request unit 13 generates an authentication request including the own terminal location information acquired by the location acquisition unit 12 in addition to the authentication information included in the code read by the reading unit 11, and transmits the generated request to the server 20. Note that in this embodiment, it is not necessary to determine whether or not to make an authentication request by comparing the other terminal location information with the own terminal location information.

The function usage unit 14 receives the authentication result sent from the server 20 in the same manner as in the first embodiment, and enables the use of the functions of the business support app or prohibits (does not permit) the use of the functions of the business support app depending on the authentication result. These are the functions of the authentication target terminal 10 according to this embodiment.

Next, the process executed by the authentication target terminal 10, the server 20, and the code display terminal 30 according to this embodiment (the operation method performed by the authentication target terminal 10, the server 20, and the code display terminal 30) will be described using the sequence diagram in FIG. 2. This process is performed when the business support app is used in the authentication target terminal 10 after being authenticated by the server 20.

In this process, first, as in the first embodiment, an ID and password used for authentication to generate a code are input in the code display terminal 30 and transmitted to the server 20 (S01). At this time, the code display terminal 30 also acquires other terminal location information and transmits it to the server 20 (S02).

In the server 20, the code generation unit 21 receives the ID and password transmitted from the code display terminal 30 (S03). The code generation unit 21 also receives other terminal position information from the code display terminal 30 (S04). Next, the code generation unit 21 authenticates the code display terminal 30 based on the received ID and password (S05). If the authentication is successful, the code generation unit 21 generates a code and transmits it to the code display terminal 30 (S06). Here, the stored position at which code generation is permitted may be compared with the position indicated by the other terminal position information to determine whether or not to generate a code. As described above, the order of the position comparison and the authentication by ID and password does not matter. The generated code includes authentication information. Unlike the first embodiment, the generated code does not need to include other terminal position information. If the authentication fails, the subsequent processing is not performed. Next, the code is received by the code display terminal 30.

The received code is displayed on the code display terminal 30 (S08). The displayed code is read by the reading unit 11 of the authentication target terminal 10 (S09). At this timing, the authentication target terminal 10 acquires its own terminal location information by the location acquisition unit 12 (S10). Unlike the first embodiment, the authentication request unit 13 does not need to compare the other terminal location information with its own terminal location information (S11). Next, the authentication request unit 13 makes an authentication request to the server 20 (S12). The authentication request includes the authentication information included in the read code. Unlike the first embodiment, the authentication request includes the own terminal location information in addition to the authentication information.

In the server 20, the authentication request receiving unit 22 receives and accepts the authentication information transmitted from the authentication target terminal 10 (S13). Next, the authentication unit 23 performs authentication based on the authentication information included in the authentication request. Also, unlike the first embodiment, the authentication unit 23 performs authentication by comparing the other terminal location information with the own terminal location information. If both the authentication based on the authentication information and the authentication based on the other terminal location information and the own terminal location information are successful, the authentication is finally successful. If either the authentication based on the authentication information and the authentication based on the other terminal location information and the own terminal location information is unsuccessful, the authentication is finally unsuccessful. The final authentication result is transmitted from the authentication unit 23 to the authentication target terminal 10 (S14).

In the authentication target terminal 10, the function utilization unit 14 receives the authentication result from the server 20 (S15). If the authentication result indicates successful authentication, the function of the business support app is released by the function utilization unit 14 (S16). In this case, the user can use the function of the business support app. If the authentication result indicates unsuccessful authentication, the function of the business support app is not released by the function utilization unit 14, and the user cannot use the function of the business support app. The above is the process executed by the authentication target terminal 10, the server 20, and the code display terminal 30 according to this embodiment.

In this embodiment as well, when the functions of the business support app are used on the authentication target terminal 10, authentication is performed according to the terminal's own location information. Specifically, the server 20 performs authentication by comparing the other terminal's location information with the terminal's own location information. Therefore, in this embodiment as well, as in the first embodiment, even if the code is obtained fraudulently, it is possible to prevent authentication from being performed in places other than a specific location. Therefore, in this embodiment as well, it is possible to prevent fraudulent authentication when using the code displayed on the code display terminal 30 based on the location of the authentication target terminal 10.

Also, as in this embodiment, authentication using the own terminal location information in the server 20 may be based on a comparison between the other terminal location information and the own terminal location information. With this configuration, authentication can be performed taking into account the location of the code display terminal 30, and unauthorized authentication can be more appropriately prevented. However, the other terminal location information does not necessarily need to be used for authentication using the own terminal location information, and authentication using only the own terminal location information may be performed. For example, authentication using only the own terminal location information may be performed, similar to the determination in the server 20 of whether or not to generate a code using the other terminal location information. Also, as in the first embodiment, the server 20 may determine whether or not to generate a code based on the other terminal location information. However, the above determination does not necessarily need to be performed.

The block diagrams used to explain the above embodiments show functional blocks. These functional blocks (components) are realized by any combination of at least one of hardware and software. Furthermore, the method of realizing each functional block is not particularly limited. That is, each functional block may be realized using one device that is physically or logically coupled, or may be realized using two or more devices that are physically or logically separated and directly or indirectly connected (for example, using wires, wirelessly, etc.). The functional blocks may be realized by combining the one device or the multiple devices with software.

Functions include, but are not limited to, judgement, determination, judgment, calculation, computation, processing, derivation, investigation, search, confirmation, reception, transmission, output, access, resolution, selection, selection, establishment, comparison, assumption, expectation, regard, broadcasting, notifying, communicating, forwarding, configuring, reconfiguring, allocating, mapping, and assignment. For example, a functional block (component) that performs the transmission function is called a transmitting unit or transmitter. As mentioned above, there are no particular limitations on the method of realization for either of these.

For example, the authentication target terminal 10 and server 20 in one embodiment of the present disclosure may function as a computer that performs the information processing of the present disclosure. FIG. 3 is a diagram showing an example of the hardware configuration of the authentication target terminal 10 and server 20 according to one embodiment of the present disclosure. The above-mentioned authentication target terminal 10 and server 20 may be physically configured as a computer device including a processor 1001, memory 1002, storage 1003, communication device 1004, input device 1005, output device 1006, bus 1007, etc. In addition, the hardware configuration of the code display terminal 30 may also be as described here.

In the following description, the term "apparatus" may be interpreted as a circuit, device, unit, etc. The hardware configuration of the authentication target terminal 10 and server 20 may be configured to include one or more of the devices shown in the figure, or may be configured to exclude some of the devices.

The functions of the authentication target terminal 10 and the server 20 are realized by loading specific software (programs) onto hardware such as the processor 1001 and memory 1002, causing the processor 1001 to perform calculations, control communications by the communication device 1004, and control at least one of the reading and writing of data in the memory 1002 and storage 1003.

The processor 1001, for example, operates an operating system to control the entire computer. The processor 1001 may be configured with a central processing unit (CPU) including an interface with peripheral devices, a control device, an arithmetic unit, a register, etc. For example, each function in the authentication target terminal 10 and the server 20 described above may be realized by the processor 1001.

The processor 1001 also reads out programs (program codes), software modules, data, etc. from at least one of the storage 1003 and the communication device 1004 into the memory 1002, and executes various processes according to these. The programs used are those that cause a computer to execute at least some of the operations described in the above-mentioned embodiments. For example, the functions of the authentication target terminal 10 and the server 20 may be realized by a control program stored in the memory 1002 and running on the processor 1001. Although the above-mentioned various processes have been described as being executed by one processor 1001, they may be executed simultaneously or sequentially by two or more processors 1001. The processor 1001 may be implemented by one or more chips. The programs may be transmitted from a network via a telecommunications line.

The memory 1002 is a computer-readable recording medium, and may be composed of at least one of, for example, a ROM (Read Only Memory), an EPROM (Erasable Programmable ROM), an EEPROM (Electrically Erasable Programmable ROM), a RAM (Random Access Memory), etc. The memory 1002 may also be called a register, a cache, a main memory (primary storage device), etc. The memory 1002 can store executable programs (program codes), software modules, etc., for performing information processing related to one embodiment of the present disclosure.

Storage 1003 is a computer-readable recording medium, and may be composed of at least one of, for example, an optical disk such as a CD-ROM (Compact Disc ROM), a hard disk drive, a flexible disk, a magneto-optical disk (e.g., a compact disk, a digital versatile disk, a Blu-ray (registered trademark) disk), a smart card, a flash memory (e.g., a card, a stick, a key drive), a floppy (registered trademark) disk, a magnetic strip, etc. Storage 1003 may also be called an auxiliary storage device. The storage medium provided in the authentication target terminal 10 and server 20 may be, for example, a database including at least one of memory 1002 and storage 1003, a server, or other appropriate medium.

The communication device 1004 is hardware (transmitting/receiving device) for communicating between computers via at least one of a wired network and a wireless network, and is also referred to as, for example, a network device, a network controller, a network card, a communication module, etc.

The input device 1005 is an input device (e.g., a keyboard, a mouse, a microphone, a switch, a button, a sensor, etc.) that accepts input from the outside. The output device 1006 is an output device (e.g., a display, a speaker, an LED lamp, etc.) that performs output to the outside. Note that the input device 1005 and the output device 1006 may be integrated into one configuration (e.g., a touch panel).

In addition, each device such as the processor 1001 and memory 1002 is connected by a bus 1007 for communicating information. The bus 1007 may be configured using a single bus, or may be configured using different buses between each device.

The authentication target terminal 10 and the server 20 may be configured to include hardware such as a microprocessor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a programmable logic device (PLD), or a field programmable gate array (FPGA), and some or all of the functional blocks may be realized by the hardware. For example, the processor 1001 may be implemented using at least one of these pieces of hardware.

The processing steps, sequences, flow charts, etc. of each aspect/embodiment described in this disclosure may be reordered unless inconsistent. For example, the methods described in this disclosure present elements of various steps using an example order and are not limited to the particular order presented.

The input and output information may be stored in a specific location (e.g., memory) or may be managed using a management table. The input and output information may be overwritten, updated, or added to. The output information may be deleted. The input information may be transmitted to another device.

The determination may be based on a value represented by one bit (0 or 1), a Boolean (true or false) value, or a comparison of numerical values (e.g., with a predetermined value).

Each aspect/embodiment described in this disclosure may be used alone, in combination, or switched depending on the execution. In addition, notification of specific information (e.g., notification that "X is the case") is not limited to being done explicitly, but may be done implicitly (e.g., not notifying the specific information).

Although the present disclosure has been described in detail above, it is clear to those skilled in the art that the present disclosure is not limited to the embodiments described herein. The present disclosure can be implemented in modified and altered forms without departing from the spirit and scope of the present disclosure as defined by the claims. Therefore, the description of the present disclosure is intended as an illustrative example and does not have any limiting meaning on the present disclosure.

Software shall be construed broadly to mean instructions, instruction sets, code, code segments, program code, programs, subprograms, software modules, applications, software applications, software packages, routines, subroutines, objects, executable files, threads of execution, procedures, functions, etc., whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise.

Software, instructions, information, etc. may also be transmitted and received via a transmission medium. For example, if the software is transmitted from a website, server, or other remote source using wired technologies (such as coaxial cable, fiber optic cable, twisted pair, Digital Subscriber Line (DSL)), and/or wireless technologies (such as infrared, microwave), then these wired and/or wireless technologies are included within the definition of a transmission medium.

As used in this disclosure, the terms "system" and "network" are used interchangeably.

In addition, the information, parameters, etc. described in this disclosure may be expressed using absolute values, may be expressed using relative values from a predetermined value, or may be expressed using other corresponding information.

As used in this disclosure, the terms "determining" and "determining" may encompass a wide variety of actions. "Determining" and "determining" may include, for example, judging, calculating, computing, processing, deriving, investigating, looking up, searching, inquiring (e.g., searching in a table, database, or other data structure), ascertaining, and the like. "Determining" and "determining" may also include receiving (e.g., receiving information), transmitting (e.g., sending information), input, output, accessing (e.g., accessing data in memory), and the like. Additionally, "judgment" and "decision" can include considering resolving, selecting, choosing, establishing, comparing, etc., to have been "judged" or "decided." In other words, "judgment" and "decision" can include considering some action to have been "judged" or "decided." Additionally, "judgment (decision)" can be interpreted as "assuming," "expecting," "considering," etc.

The terms "connected," "coupled," or any variation thereof, refer to any direct or indirect connection or coupling between two or more elements, and may include the presence of one or more intermediate elements between two elements that are "connected" or "coupled" to each other. The coupling or connection between elements may be physical, logical, or a combination thereof. For example, "connected" may be read as "access." As used in this disclosure, two elements may be considered to be "connected" or "coupled" to each other using at least one of one or more wires, cables, and printed electrical connections, as well as electromagnetic energy having wavelengths in the radio frequency range, microwave range, and optical (both visible and invisible) range, as some non-limiting and non-exhaustive examples.

As used in this disclosure, the phrase "based on" does not mean "based only on," unless expressly stated otherwise. In other words, the phrase "based on" means both "based only on" and "based at least on."

Any reference to elements using designations such as "first," "second," etc., used in this disclosure does not generally limit the quantity or order of those elements. These designations may be used in this disclosure as a convenient way to distinguish between two or more elements. Thus, a reference to a first and a second element does not imply that only two elements may be employed or that the first element must precede the second element in some way.

When the terms "include," "including," and variations thereof are used in this disclosure, these terms are intended to be inclusive, similar to the term "comprising." Additionally, the term "or," as used in this disclosure, is not intended to be an exclusive or.

In this disclosure, where articles have been added through translation, such as a, an, and the in English, this disclosure may include that the nouns following these articles are in the plural form.

In this disclosure, the term "A and B are different" may mean "A and B are different from each other." The term may also mean "A and B are each different from C." Terms such as "separate" and "combined" may also be interpreted in the same way as "different."

10... terminal to be authenticated, 11... reading unit, 12... position acquisition unit, 13... authentication request unit, 14... function utilization unit, 20... server, 21... code generation unit, 22... authentication request reception unit, 23... authentication unit, 30... code display terminal, 1001... processor, 1002... memory, 1003... storage, 1004... communication device, 1005... input device, 1006... output device, 1007... bus.

Claims (5)

a reading unit that reads a code displayed on another terminal and that includes authentication information used for authentication to use a predetermined function in the terminal;
A location acquisition unit that acquires own terminal location information indicating the location of the own terminal;
an authentication request unit that issues an authentication request including authentication information included in the code read by the reading unit in response to the terminal's own terminal location information acquired by the location acquisition unit;
a function utilizing unit that utilizes a predetermined function in the terminal according to an authentication result in response to an authentication request made by the authentication request unit;
Equipped with
The reading unit reads a code further including other terminal location information indicating a location of the other terminal,
The authentication request unit is a terminal that compares other terminal location information included in the code read by the reading unit with the own terminal location information, and makes an authentication request depending on a comparison result . a reading unit that reads a code displayed on another terminal and that includes authentication information used for authentication to use a predetermined function in the terminal;
A location acquisition unit that acquires own terminal location information indicating the location of the own terminal;
an authentication request unit that issues an authentication request including authentication information included in the code read by the reading unit in response to the terminal's own terminal location information acquired by the location acquisition unit;
a function utilizing unit that utilizes a predetermined function in the terminal according to an authentication result in response to an authentication request made by the authentication request unit;
Equipped with
the authentication request unit issues an authentication request including the terminal's own location information acquired by the location acquisition unit;
The authentication device to which the authentication request is made is a terminal that performs authentication based on the authentication information included in the authentication request and its own terminal location information and outputs the authentication result to the terminal . a code generating unit that receives a request for generating a code including authentication information used for authentication to use a predetermined function in the terminal itself and to be displayed on another terminal, and other terminal location information indicating the location of the other terminal, and generates the code including the other terminal location information ;
The code generating unit is an authentication device that determines whether or not to generate the code based on the other terminal location information . an authentication request receiving unit that receives, from a terminal, an authentication request including authentication information used for authentication to use a predetermined function in the terminal, the authentication information being included in a code read from another terminal, and own terminal location information indicating the location of the terminal;
an authentication unit that performs authentication based on authentication information included in the authentication request accepted by the authentication request acceptance unit and its own terminal location information and outputs an authentication result to the terminal;
a code generating unit that receives a request for generating the code and other terminal location information indicating the location of the other terminal, determines whether or not to generate the code based on the received other terminal location information, and generates the code;
An authentication device comprising: 5. The authentication device according to claim 4 , wherein the authentication unit acquires other terminal location information indicating the location of the other terminal, and performs authentication by comparing the acquired other terminal location information with the terminal's own location information.

Images