JP2006323871A - Apparatus and method for authenticating user - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform user authentication for every IP by using personally-identifying information without making a specific contract with a mobile communication carrier. <P>SOLUTION: An IP server W and a gateway server GWS each transmits data with an HTML format in accordance with a request from a mobile device MS. In the HTML data, a personally-identifying information request data row is added to a URL for a page which is associated with a service requiring user authentication. A user performs input operation for designating the URL with a screen corresponding to the HTML data displayed on a liquid crystal display part after the mobile device MS has received the HTML data. Then, the mobile device MS transmits the personally-identifying information to a mobile packet communication network MPN by reading the information from a ROM. The IP server W performs the user authentication based on the personally-identifying information which is thus sent off from the mobile device MS. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a method and apparatus for end-to-end user authentication between different networks.

  In recent years, as mobile devices such as mobile phones have become more sophisticated, WWW (World Wide Web) browsers (hereinafter referred to as “WWW browsers”) have been installed in mobile devices, making it possible for mobile devices to browse the WWW alone. The product to be sold is commercially available. By using such a mobile device, the user can receive various services from an information provider (hereinafter referred to as “IP”) on the Internet.

  Here, among services provided by IP, there are services provided only to contract users and services requiring confidentiality. For this reason, an IP that provides this type of service performs user authentication when providing the service from the viewpoint of preventing unauthorized use by a third party. As this user authentication method, a method generally used conventionally is a method using a password. However, in the user authentication method using a password, there is a risk that the password is leaked to a malicious third party, and if the password is leaked, anyone can use it illegally. For this reason, for example, when providing services that require security, such as banking services using networkware (hereinafter referred to as “net banking”), a user authentication method that can ensure more reliability is provided. It is necessary to use it.

Therefore, in an IP that provides such a service, user authentication is performed using unique information (hereinafter referred to as “personal identification information”) that can identify a mobile device such as a calling ID held by a mobile communication network. This user authentication method will be briefly described as follows.
i. When providing a service to a user of a mobile device, first, a server owned by IP (hereinafter referred to as “IP server”) transmits a transmission request for personal identification information to the mobile communication network.
ii. Based on this transmission request, the mobile communication network returns personal identification information to the IP server.
iii. The IP server performs user authentication based on the personal identification information returned from the mobile communication network.
Conventionally, unauthorized use by a third party is effectively prevented by the user authentication method described above.

  However, the personal identification information is important information relating to the user's privacy and property. For this reason, if a mobile communication provider provides this personal identification information to the IP without any limitation, there is a risk of causing an unexpected disadvantage to the user of the mobile device. In order to prevent such unforeseen disadvantages, the mobile carrier contracts in advance with the IP that provides the personal identification information that it holds, thereby ensuring the reliability of the personal identification information provision destination. is doing. As described above, in this method, a prior contract is required. As a result, it is impossible for an IP that has not signed a contract with a mobile carrier to use personal identification information for user authentication. There was a problem that authentication using identification information could not be performed.

  An object of the present invention is to provide a user authentication method and a communication system that can perform user authentication using personal identification information in all IPs without signing a special contract with a mobile communication carrier. .

  To achieve the above object, the present invention provides a reception process in which a mobile terminal accommodated in a first network receives data from the first network, and data received by the mobile terminal in the reception process. Only when a detection process for detecting whether or not a predetermined data string exists and when it is detected that the data string exists in the detection process, the mobile terminal is stored in advance in the terminal itself Personal identification information transmitted from the portable terminal by a relay process for relaying data transmission between the first network and the second network, and a transmission process for transmitting personal identification information for uniquely identifying A transfer process of transferring information to the second network, and a server connected to the second network, the user of the portable terminal is based on the personal identification information. It provides a user authentication method characterized by comprising an authentication step of authenticating THE.

  In this configuration, the personal identification information transmitted by the portable terminal in the transmission process may be transmitted in a format that cannot be decoded by a device other than the server. In this case, in the authentication process, the server decrypts the personal identification information transmitted from the mobile terminal and authenticates the user of the mobile terminal based on the personal identification information.

  Prior to the reception process, the relay apparatus may provide a search process for searching for the address of the server in the second network in accordance with a request from the mobile terminal. In this case, the data received by the mobile terminal in the reception process is data corresponding to the search result searched by the relay device in the search process. In a preferred aspect, the data may be described in a markup language, and the data string may be marked up with a predetermined identifier in the data.

  Furthermore, prior to the transmission process, only when it is detected that the data string exists in the detection process, the mobile terminal determines whether or not the personal identification information can be transmitted to the user of the terminal itself. A determination promoting process for urging may be further provided, and only when the user's permission is obtained in this process, the portable terminal may transmit the personal identification information in the transmitting process. In this case, in the determination promotion process, not only an image for asking the user's determination is displayed, but also the user is prompted to input the input identification information, and the input identification information input by the user is transmitted in the transmission process. You may make it transmit with personal identification information.

  In addition, after the authentication process, the server distributes input data that prompts the portable terminal to input the input identification information, and the portable terminal that has received the input data distributed in the distribution process Prompting the user to input the input identification information based on the input data, a second transmission process for transmitting the input identification information input in the process of prompting the input, and a transmission in the second transmission process And a second authentication process for authenticating the user of the portable terminal based on the input identification information.

  Preferably, a serial number of the mobile terminal is used as the personal identification information. In this case, if the combination of the manufacturing number of the portable terminal and the information stored in the user identification module connected to the portable terminal is used as the personal identification information, the authentication reliability can be improved. It becomes. A mobile communication network may be used as the first network.

  The present invention further receives data from the first network, detects whether a predetermined data string exists in the data, and only when it is detected that the data string exists. A portable terminal that transmits personal identification information for uniquely identifying a user stored in advance in the terminal to the first network; and a second terminal that is interconnected with the first network via a relay device. A communication system comprising a network and a server connected to the second network and performing authentication based on the personal identification information is provided.

  In addition, the present invention provides a communication unit that communicates with others via a first network, the second network connected to the first network by the communication unit, and the second network connected thereto. Communication with a server in the network, and when receiving data including a predetermined data string from the server, the personal identification information is read from a memory provided in the mobile terminal or a memory connected to the mobile terminal, There is provided a portable terminal comprising a control unit that transmits to the server via a connection.

  The present invention is also implemented in such a mode that a program for operating the function as a portable terminal is distributed to the user via a network, or stored in a storage medium such as a CD or FD and distributed to the user. obtain.

  Embodiments of the present invention will be described below with reference to the drawings. The present embodiment is realized by applying the present invention to a mobile communication network connected to the Internet.

<1-1. Configuration of Embodiment>
<A. Overall system configuration>
FIG. 1 is a block diagram showing a configuration of a communication system according to the present embodiment.
As shown in the figure, the communication system 1 according to the present embodiment includes a plurality of mobile stations MS, a plurality of base stations BS, a mobile packet communication network MPN, a gateway server GWS, an Internet INET, and a plurality of IP servers. W. In FIG. 1, only predetermined mobile devices, base stations, and IP servers among the mobile devices MS, base stations BS, and IP servers W accommodated in the communication system 1 are shown in order to prevent the drawing from becoming complicated. Has been.

  The mobile device MS is a portable electronic device such as a mobile phone, and is capable of data communication via the mobile packet communication network MPN shown in FIG. 1 and performs a voice call via a mobile phone network (not shown). The mobile device MS receives various services from the IP server W by data communication via the mobile packet communication network MPN. Further, the mobile device MS stores personal identification information, and transmits the personal identification information to the IP server W when receiving a service requiring user authentication. Here, as the personal identification information, any information may be used as long as it is unique information that can uniquely identify the user. In the present embodiment, the serial number of the mobile device MS is used. To do.

  The IP server W is a WWW (World Wide Web) server owned by the IP, such as “net banking” (for example, “bank transfer”, “balance inquiry”, etc.) and membership services for the mobile device MS. Provide various services.

  FIG. 2 is a block diagram showing the configuration of the IP server W. As shown in the figure, the IP server W includes a data distribution management unit 111, an authentication unit 112, a personal identification information database 113, and a communication unit 114.

  The data distribution management unit 111 includes, for example, a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Randam Access Memory), and a hard disk (all not shown). The hard disk stores HTML (Hyper Text markup Language) format data (hereinafter referred to as “HTML data”) corresponding to resources such as a home page and a Web page, and a URL is set for each. In the ROM, when receiving an HTTP (Hyper Text Transfer Protocol) or HTTPS message (hereinafter referred to as “GET request”) using the GET method from the mobile device MS, a control for distributing data according to the GET request. The program is stored. The CPU executes various processes according to these programs. The RAM is used as a work area for the CPU.

Here, the HTML data transmitted from the data distribution management unit 111 to the Internet INET in the present embodiment has a characteristic configuration that has not existed before.
FIG. 3 shows an example of the HTML data source according to the present embodiment, and FIG. 4 shows an example of an image corresponding to the data shown in FIG. In FIG. 3, <A herf=“”></A> is an anchor tag, and a URL corresponding to a page related to a service that the IP server W can provide to the mobile station MS is designated by the anchor tag. ing.

  In the menu item “bank transfer” shown in FIG. 4, the anchor tag <A herf=“http://www.XX.co.jp/ΔΔ#utn”> </A> shown in FIG. Although associated with each other, a data string “utn” is added to the end of the URL specified by the anchor tag. This data string “utn” is a data string indicating that the IP server W requests transmission of personal identification information (hereinafter, the character string “utn” is referred to as “personal identification information request data string”). ).

As described above, the services provided by the IP server W to the mobile device MS include those requiring user authentication such as a “net banking” service and a membership service. The HTML data described above includes data obtained by adding a personal identification information request data string “utn” to the URL of a page related to this type of service. Then, when the mobile device MS receives the HTML data including the URL to which the personal identification information request data string “utn” is added, and the mobile device MS designates the URL, the mobile device MS receives the GET including the URL. The personal identification information stored in the request is added to the request and transmitted. In this way, when a GET request including personal identification information is transmitted from the mobile device MS, the data distribution management unit 111 extracts the URL included in the GET request and sends it to the authentication unit 112. .
The authentication unit 112 performs user authentication based on the personal identification information sent from the data distribution management unit 111 and the information stored in the personal identification information database 113.

  FIG. 5 is a diagram illustrating the stored contents of the personal identification information database 113. As shown in the figure, the personal identification information database 113 stores personal identification information in association with each user ID. Here, the user ID stored in the personal identification information database 113 is an ID that the IP server W pays out to each user when the user registers his / her personal identification information in the IP server W. When the service provided to the user by the IP server W is, for example, a “net banking” service, this user ID is used to identify the bank account of the user. On the other hand, when the service provided by the IP server W is content distribution, the user ID is used for processing for charging.

  Registration of personal identification information and user ID in the personal identification information database 113 can be realized by various methods. For example, the configuration may be such that the user goes to the IP service window having the IP server W and presents the serial number of the mobile device MS to the employee at the window to perform registration. Alternatively, a site capable of communicating by SSL (Secure Sockets Layer) may be opened on the IP side, and the user may access the site using the mobile device MS and register personal identification information. When this method is adopted, a personal information request data string is described in the HTML data corresponding to the page of the site so that personal identification information such as a manufacturing number stored in the mobile device MS is transmitted. good.

  When personal identification information is sent from the data distribution management unit 111, the authentication unit 112 searches the personal identification information database 113 based on the personal identification information. When information that matches the personal identification information is stored in the personal identification information database 113, a user ID corresponding to the personal identification information is read. Various services are provided according to the user ID. On the other hand, when information matching the personal identification information does not exist in the personal identification information database 113, the authentication unit 112 determines that the user of the mobile device MS is not a user having a legitimate authority, Reject service provision.

  The communication unit 114 mediates exchange of data between the Internet INET and the data distribution management unit 111. Specifically, the communication unit 114 sends the data sent from the Internet INET to the data distribution management unit 111 and sends the data sent from the data distribution management unit 111 to the Internet INET.

  Next, the mobile packet communication network MPN is a communication network for providing a packet communication service to the mobile station MS, and accommodates a gateway server GWS and a plurality of base stations BS, as well as packet subscriber processing (not shown). Have the device.

  The gateway server GWS is a computer system provided in a mobile packet gateway relay exchange that interconnects the Internet INET and the mobile packet communication network MPN, and mediates exchange of data between different networks. Specifically, the gateway server GWS is a protocol for adapting data transmitted from the mobile device MS on the mobile packet communication network MPN side to TCP / IP (Transmission Control Protocol / Internet Protocol) that the Internet INET follows. Convert it and send it to the Internet INET side. The gateway server GWS converts the data transmitted from the Internet INET side into a transmission protocol for the mobile packet communication network MPN and transmits the data to the mobile packet communication network MPN side.

  When the gateway server GWS receives the HTTP GET request transmitted from the mobile station MS, the gateway server GWS checks the URL included in the GET request, and if the URL is a general URL on the Internet INET, The GET request is transferred to the Internet INET side. Then, the data returned from the Internet INET side in response to this GET request is transferred to the mobile packet communication network MPN.

  When the gateway server GWS receives an HTTPS GET request from the mobile device MS, the gateway server GWS checks the URL included in the GET request, and enables the mobile device MS to directly communicate with the SSL site corresponding to the URL. .

  Further, the gateway server GWS generates HTML data corresponding to, for example, a home page or a Web page in accordance with a request from the mobile device MS. The gateway server GWS provides various services to the mobile device MS by distributing the HTML data to the mobile device MS. As a service provided by the gateway server GWS to the mobile station MS, for example, there is a search service of the IP server W. In order to provide this search service, the gateway server GWS has a search database GWS1.

  FIG. 6 is a diagram illustrating the stored contents of the search database GWS1. As shown in the figure, the search database GWS1 stores a search keyword and a URL corresponding to the page in association with the title of each page of the IP server W. Here, among the URLs stored in the search database GWS1, the personal identification information data string (that is, “utn”) is added to the URL of the page related to the service that requires user authentication. For example, in the example shown in the figure, the URL stored in association with the title “XX bank” or “△△ bank” (that is, “http: //www.XX bank.co.jp/index”). .html # utn "and" http: //www.△△bank.co.jp/index.html#utn ").

  The gateway server GWS searches the search database GWS1 based on a request from the mobile device MS. Then, HTML data in which the URL hit as a result of the search is designated by an anchor tag is generated and sent to the Internet INET. For example, in the case shown in FIG. 6, when the title “XX bank” is hit, the gateway server GWS reads the URL “https: //www.XX bank.co.jp/index.html#” from the search database. utn "is read out, HTML data including the URL is generated and transmitted to the mobile packet communication network MPN.

<B. Configuration of mobile station MS>
FIG. 7 is a block diagram illustrating the configuration of the mobile device MS according to the present embodiment.
As shown in the figure, the mobile station MS includes a control unit 21, a transmission / reception unit 22, an instruction input unit 23, a liquid crystal display unit 24, and a bus 25 that mediates data exchange between the elements.

The transmission / reception unit 22 performs wireless communication with the base station BS of the mobile packet communication network MPN.
The instruction input unit 23 includes various buttons such as a PB (push button) and cursor keys. When an input operation is performed by the user, operation data corresponding to the input operation is supplied to the CPU 211 of the control unit 22. The CPU 211 determines a user input command from the operation data and performs control corresponding to the command.
The liquid crystal display unit 24 includes a display device such as a liquid crystal panel, and displays various information under the control of the control unit 21.

  The control unit 21 includes a CPU 211, a ROM 212, a RAM 213, and a flash memory 214, and controls each unit of the mobile device MS. The ROM 212 stores desired data from other communication devices (for example, the IP server W), in addition to a control number for controlling the manufacturing number of the mobile device MS as personal identification information, the entire mobile device MS, and various control information. Is stored, and a WWW browser for displaying an image corresponding to the acquired data is stored. The RAM 213 is used as a work area for the CPU 211.

  The CPU 211 executes various processes according to various control programs stored in the ROM 212. For example, when the CPU 211 reads and executes a WWW browser stored in the ROM 212, the following processing is performed in the execution process. That is, when the user designates a desired URL in the instruction input unit 23, the CPU 211 sends an HTTP or HTTPS GET request including the URL to the mobile packet communication network MPN based on an input command from the instruction input unit 23. Process.

  At this time, the personal identification information request data string “utn” may be added to the URL specified from the instruction input unit 23. In such a case, the CPU 211 reads the personal identification information (manufacturing number) stored in the ROM 212 and transmits a GET request to which the personal identification information request data string “utn” is added. When the HTML data corresponding to the GET request is returned from the IP server W or the gateway server GWS, the CPU 211 writes the HTML data in the RAM 213 and displays an image corresponding to the HTML data on the liquid crystal display unit 24. Display.

  The flash memory 214 is provided with a history storage table TBL as shown in FIG. 8 in order to register the access destination history. As shown in the figure, in the history storage table TBL, the URL of the resource actually accessed by the user using the mobile station MS is stored as the access history (hereinafter, the URL as the access history is referred to as “history URL”). "). Further, a request data string flag F indicating whether or not the personal identification information request data string “utn” has been added to the URL is stored in association with each history URL. When the request data string flag F is “1”, it indicates that the request data string is added to the URL, and when it is “0”, it indicates that the request data string is not added. Show.

  The mobile station MS may fail to download the HTML data from the IP server W and download the HTML data again. In such a case, the mobile station MS reads the request data string flag F in the history storage table TBL and determines whether or not to transmit personal identification information. Specifically, when the request data string flag F of the URL corresponding to the page to be read again is “1”, the control unit 21 adds a personal identification information to the IP server W and transmits a GET request. On the other hand, when the request data string flag F is “0”, the control unit 21 simply transmits a GET request including a URL corresponding to the page without adding personal identification information.

<1-2. Operation of Embodiment>
The operation of the communication system according to the present embodiment will be described below with reference to the drawings. In the following description, in order to make the description more specific, the storage contents of the personal identification information database 113 and the search database GWS1 are the same as those shown in FIGS. The serial number of the mobile station MS is “ΔΔΔΔΔΔ”.

  First, a user who realizes that he / she has forgotten to transfer the rent of his / her apartment on the go uses the search service of the gateway server GWS to search the homepage of “XX Bank” where he / she has opened an account Then, in order to receive the “net banking” service, an input for browsing is made to the instruction input unit 23 of the mobile device MS. In accordance with the input to the instruction input unit 23, the CPU 211 reads a WWW browser from the ROM 212 and registers a packet in a packet subscriber processing device (not shown). This packet registration is a registration procedure for the mobile station MS to exchange packets with the mobile packet communication network MPN. When packet registration is performed in this way, the mobile station MS can exchange packets with the gateway server GWS.

  Thereafter, when the user inputs a URL corresponding to the search service of the gateway server GWS to the instruction input unit 23 of the mobile device MS, the mobile device MS transmits a GET request including the URL to the mobile packet communication network MPN. To do. Upon receiving this GET request, the gateway server GWS sends out HTML data corresponding to the search screen to the mobile packet communication network MPN. The configuration of this search screen is arbitrary, but in the present embodiment, as shown in FIG. 9, a search character string is input to the box portion below the character string “keyword”. It has become.

  Next, the HTML data corresponding to this search screen is received by the transmission / reception unit 22 of the mobile device MS and sent to the CPU 211. As a result, a search screen (see FIG. 9) corresponding to the HTML data is displayed on the liquid crystal display unit 24. In this state, the user inputs a search character string corresponding to the service he / she wants to search (that is, a search character string “net banking”) to the instruction input unit 23 of the mobile device MS and decides it. Perform an input operation to perform As a result, the CPU 211 of the mobile station MS sends a GET request with the character string added thereto to the mobile packet communication network MPN.

  When the GET request is received by the gateway server GWS, the gateway server GWS extracts a search character string (that is, a search character string “net banking”) included in the GET request. The gateway server GWS searches the search database GWS1 based on the search character string “net banking”. As a result, URLs corresponding to “XX bank” and “ΔΔ bank” are hit based on the keyword “net banking” in the search database GWS1 (see FIG. 6).

  Next, the gateway server GWS uses URLs “https://www.XXbank.co.jp/index.html#utn” or “http: /” corresponding to these “XX bank” and “△△ bank”. /www.ΔΔbank.co.jp/index.html#utn ”is read from the search database GWS1. Here, since “net banking” is a service that requires security as described above, the URL of a page related to these services includes a personal identification information request data string “utn”. Then, the gateway server GWS generates HTML data in which the URL corresponding to “XX bank” or “△△ bank” read from the search database GWS1 is specified by an anchor tag, and sends it to the mobile packet communication network MPN. To do.

  Next, the HTML data is received by the transmission / reception unit 22 of the mobile device MS and sent to the CPU 211. The CPU 211 causes the liquid crystal display unit 24 to display an image corresponding to the sent HTML data. As a result, on the liquid crystal display unit 24 of the mobile device MS, as shown in FIG. 10, the titles hit as a result of the search in the gateway server GWS (for example, “XX bank”, “△ Δ bank”, etc.) Displayed as an item.

  In this state, when the user performs an input operation on the instruction input unit 23 of the mobile device MS to select a menu item (that is, “XX bank”) corresponding to the name of the bank in which the user has an account. The character string corresponding to the menu item is highlighted. When the user performs an input operation to make a decision on the instruction input unit 23 in the highlighted state, the CPU 211 of the mobile device MS executes the process shown in FIG.

  In this process, the CPU 211 first extracts the URL “https://www.XXbank.co.jp/index.html#utn” corresponding to the selected menu item “XX bank”, and the URL Is included in the personal identification information request data string (ie, “utn”) (steps S1 and S2).

If the extracted URL does not include the personal information request data string (“No” in step S2), the CPU 211 determines whether the URL specifies communication by SSL (step S9). At this time, the CPU 211 determines whether or not the URL specifies SSL communication depending on whether the URL starts with “http” or “https”. If the URL specifies SSL communication (step S9 “Yes”), the CPU 211 executes processing for starting SSL communication (step S10) and transmits a GET request (step S11). ). On the other hand, when the URL does not specify SSL communication (“No” at step s9), the CPU 211 transmits a GET request without establishing an SSL handshake (step S11). Then, the CPU 211 stores the URL as an access history in the history storage table TBL of the flash memory 214 and stores “0” as the request data string flag F (step S12).
The difference in processing at this time will be described in detail later.

  On the other hand, in this case, the menu item “XX bank” is selected. For this reason, the URL extracted by the CPU 211 includes a personal information request data string (step S2 “Yes”). In such a case, the CPU 211 displays a screen as shown in FIG. 12 on the liquid crystal display unit 24 (step S3). That is, on the liquid crystal display 24 of the mobile device MS, “Yes” and “No” buttons are displayed along with characters for prompting the user's judgment such as “Personal identification information is requested. It is displayed. In this state, if the user selects the “No” button, the CPU 211 determines “No” in step S4 and ends the process.

  On the other hand, when the user performs an input operation to select “Yes”, the CPU 211 determines “Yes” in step S4, and determines whether or not the URL extracted in step S1 specifies SSL communication. Determine (step S5). At this time, the CPU 211 determines whether or not the URL specifies SSL communication depending on whether the URL starts with “http” or “https”. Then, depending on the result of the determination in step S5, the communication system 1 executes the following two different processes.

(I) Process 1
This process is a process performed when it is determined that the URL specifies SSL communication (that is, in the case of step S5 “Yes”). For example, when a URL starting from “https” is specified such as the URL “https://www.XXbank.co.jp/index.html#utn” corresponding to the menu item “XX bank” This processing 1 is executed.

  In this process 1, as a result of the CPU 211 executing a process for starting SSL communication (step S6), in the communication system 1, data as shown in FIG. 13 is exchanged. In this process, first, the CPU 211 of the mobile station MS transmits a “connect” signal DS1 to the gateway server GWS via the transmission / reception unit 22. When this signal DS1 is received, the gateway server GWS transmits a “TCP Connect” signal DS2 to the IP server W. When the transmission of the signal DS2 to the IP server W is thus completed, the gateway server GWS transmits a “Connection established” signal DS3 to the mobile device MS.

  On the other hand, upon receiving this “Connection established” signal DS 3, the CPU 211 of the mobile station MS transmits a “Client hello” signal DS 4 to the IP server W. Thus, when the “Client hello” signal DS4 transmitted from the mobile device MS is received by the communication unit 114 of the IP server W, the data distribution management unit 111 sends the “Server hello” signal DS5 to the mobile device MS. Send. When the signals DS1 to DS5 described above are exchanged, an SSL handshake is performed between the mobile station MS and the IP server W, and end-to-end SSL communication is performed between the mobile station MS and the IP server W. Is possible.

  Next, the CPU 211 of the mobile device MS executes Step S7 and includes a URL “https://www.XXbank.co.jp/index.html” corresponding to the menu item “XXbank”. In response to the request DS6, personal identification information (that is, a serial number) “ΔΔΔΔΔΔ” is added and sent to the mobile packet communication network MPN (step S7). Then, the CPU 211 stores the URL “http://www.XXbank.co.jp/index.html” as an access history in the history storage table TBL of the flash memory 214 and requests data string flag F "1" is stored as (step S8).

  On the other hand, when the GET request DS6 transmitted from the mobile device MS is received by the communication unit 114 of the IP server W, the data distribution management unit 111 sends the URL “https: // www added to the GET request DS6. .Xxx bank.co.jp/index.html "is extracted and stored in the RAM. Next, the data distribution management unit 111 determines based on the URL stored in the RAM whether or not the service desired by the user of the mobile device MS requires user authentication. If it is determined that user authentication is not necessary as a result of the determination, the data distribution management unit 111 returns HTML data corresponding to the URL stored in the RAM, and the process is terminated.

  On the other hand, in the present example, the service desired by the user of the mobile device MS is the “net banking” service. Therefore, in this determination, the data distribution management unit 111 determines that user authentication is necessary, extracts the personal identification information “ΔΔΔΔΔΔ” added to the GET request DS6, This is sent to the authentication unit 112. When personal identification information is sent from the data distribution management unit 111 in this way, the authentication unit 112 searches the personal identification information database 113 using the personal identification information “ΔΔΔΔΔΔ” as a search key. To do. If the personal identification information “ΔΔΔΔΔΔ” is not hit as a result of this search, the authentication unit 112 regards that the user of the mobile device MS that is the transmission source of the GET request DS6 is not a valid user. Then, an instruction to end the processing is sent to the data distribution management unit 111.

  On the other hand, in the case shown in FIG. 5, the personal identification information database 113 stores personal identification information “ΔΔΔΔΔΔ”. In such a case, the authentication unit 112 reads the user ID “user.a” corresponding to the personal identification information “ΔΔΔΔΔΔ” from the personal identification information database 113 and sends it to the data distribution management unit 111. Then, the data distribution management unit 111 determines that the user of the mobile device MS is a valid user, and stores the URL “https://www.XXbank.co.jp/index” stored in the RAM. HTML data DS7 corresponding to “.html” is sent to the Internet INET.

(Ii) Processing 2
This process is performed when it is determined that the URL does not specify SSL communication (that is, in the case of step S5 “No”). When the CPU 221 of the mobile device MS executes the process 2, the communication system 1 exchanges data as shown in FIG. For example, when a URL starting from “http” is specified such as the URL “http: //www.△△bank.co.jp/index.html#utn” corresponding to the menu item “△△ bank” This process 2 is executed.

  In this process 2, the CPU 211 identifies the personal identification in response to the GET request D1 including the URL “http: // www. ΔΔbank.co.jp / index.html # utn” corresponding to the menu item “ΔΔ bank”. Information (namely, serial number) “ΔΔΔΔΔΔ” is added and sent to the mobile packet communication network MPN (step S7). Next, the CPU 211 stores the URL “http: //www.ΔΔbank.co.jp/index.html” in the history storage table TBL of the flash memory 214 as an access history, and requests data string flag “1” is stored as F (step S8). In this way, the GET request D1 sent from the mobile device MS is thereafter received by the gateway server GWS, converted in protocol, and transferred to the Internet INET as the GET request D2.

  Next, when the GET request D2 is received by the communication unit 114, the data distribution management unit 111 executes the same process as the process 1 described above, and the URL “” http: //www.ΔΔbank. HTML data D3 corresponding to “co.jp/index.html” ”is sent to the Internet INET and transferred as HTML data D4 by the gateway server GWS.

  When the HTML data D4 or DS7 transmitted through the processing 1 or processing 2 described above is received by the mobile device MS, a screen as shown in FIG. 15 is displayed on the liquid crystal display unit 24 of the mobile device MS. The Here, each menu item shown in the figure is associated with a URL for jumping to a page for receiving provision of a service corresponding to the menu item. Whether or not to use the URL to which the personal identification information request data string “utn” is added as the URL associated with each menu item is arbitrary. If further user authentication is required, the URL to which the personal identification information request data string “utn” is added may be used. If user authentication is not required, the personal identification information request data string “utn” is used. It is sufficient to use a URL without “

  In this state, the user who intends to transfer the rent performs an input operation of selecting “bank transfer” on the instruction input unit 23 of the mobile device MS. Then, in the mobile station MS, the same processing as in FIG. 11 described above is executed, and personal identification information “ΔΔΔΔΔΔ” is added to the GET request including the URL corresponding to “bank transfer”. To the mobile packet communication network MPN. At this time, the same process as the process 1 or 2 described above is executed depending on whether or not the URL corresponding to the menu item specifies SSL communication.

  When HTML data corresponding to the GET request is transmitted from the IP server W, a screen for bank transfer as shown in FIG. 16 is displayed on the liquid crystal display unit 24 of the mobile device MS. After that, the user performs an input operation for entering and determining the account number of the transfer destination and the amount corresponding to the rent. Then, the mobile device MS transmits a GET request including these pieces of information and personal identification information “ΔΔΔΔΔΔ”. In this way, when a GET request is transmitted from the mobile device MS, the IP server W extracts various information from the received GET request and performs bank transfer.

  On the other hand, when the mobile station MS downloads HTML data corresponding to the screen of FIG. 16 and the communication state deteriorates and the download of the HTML data fails, the mobile station MS again displays the screen of FIG. It is necessary to download the corresponding HTML data. In such a case, the mobile station MS reads the request data string flag F in the history storage table TBL. Then, the processing is changed as follows depending on whether the request data string flag F is “0” or “1”.

(A) When the request data string flag F = “1” In this case, when the CPU 211 of the mobile station MS transmits a GET request corresponding to the screen to be reloaded, the personal identification information “ΔΔΔ” is included in the GET request. Add "△△△" and send. For example, when the personal information transmission request data string “utn” is added to the URL, such as the URL corresponding to the menu items “XX bank” and “ΔΔ bank” in FIG. 10 described above, FIG. As a result of the processing in step S8, “1” is stored as the request data string flag F in the history storage table TBL of the mobile device MS. In this case, when re-reading the HTML data corresponding to the screen, the CPU 211 of the mobile station MS adds personal identification information to the IP server W and transmits a GET request. As a result, the screen shown in FIG. 16 is displayed on the liquid crystal display unit 24 of the mobile device MS. Similarly, services such as “bank transfer” are provided.

(B) When the request data string flag F = “0” In this case, when the CPU 211 of the mobile station MS transmits a GET request including a URL corresponding to the screen to be re-read, the personal identification information “ "△△△△△△" is not added.

  The operation of this embodiment has been described above by taking the case where the user makes a bank transfer as an example, but the same processing is performed in the communication system 1 when the user of the mobile device MS receives a registration service from the IP server W. Will be.

  As described above, according to the user authentication method according to the present embodiment, when the personal identification information request data string is added to the URL in the HTML data, the mobile device obtains the user's consent and obtains the personal identification information. The information is transmitted to the IP server, and the IP server performs user authentication based on the personal identification information. For this reason, it is possible to perform user authentication using personal identification information in all IPs without signing a special contract with a mobile communication carrier.

  In addition, when transmitting the personal identification information, the mobile device according to the present embodiment displays an image for obtaining the user's approval on the liquid crystal display unit, and the personal identification information is obtained only when the user's consent is obtained. It is configured to transmit. For this reason, it is possible to effectively prevent the personal identification information from being transmitted until the user does not intend it, and the personal identification information from being illegally used.

  In this embodiment, even when the gateway server search service is used, a personal identification information request data string is added to the URL of a page that provides a service that requires user authentication. For this reason, even when an IP server is accessed using the search service, a GET request with the personal identification information added is transmitted reliably, so that user authentication can be performed more reliably.

  Furthermore, in this embodiment, since the data of HTML format is used as the format of data transmitted from the IP server or the like, the effects of the present invention can be achieved using existing equipment.

  In the present embodiment, the configuration in which the manufacturing number of the mobile device MS is used as unique information used for personal identification information has been described, but information such as the telephone number of the mobile device MS may be used as a matter of course.

  In the present embodiment, the data string “utn” is used as the personal identification information, but other data strings may be used as a matter of course.

  In the present embodiment, a case has been described in which the mobile station MS performs communication via the mobile packet communication network MPN. However, the present invention is not limited to this, and can also be applied to a case where communication is performed using a terminal such as a personal computer housed in a fixed telephone network. In this case, it is possible to execute the same processing as in the above embodiment by giving the personal computer the same function as the mobile device MS in the above embodiment.

  In the present embodiment, the data transmitted from the IP server W or the gateway server GWS to the mobile device MS is described as data in HTML format. However, the present invention is not limited to this, and other markup languages such as XML (eXtensive Markup Language) may be used.

<1-3. Modification>
<Modification 1>
In this embodiment, the gateway server GWS is provided with a search function to provide a search service to the mobile station MS. However, the search service provider may be a search engine on the Internet INET, not the gateway server GWS. In this case, by providing the search engine with a search database, it is possible to achieve the same effects as in the present embodiment.

<Modification 2>
In this embodiment, the gateway server GWS is configured to search the search database according to the keyword sent from the mobile device MS. However, the method by which the gateway server GWS introduces various services to the mobile station MS may be other methods. For example, a menu item corresponding to various services such as “net banking” and “game” may be provided on the homepage of the gateway server GWS, and a page corresponding to each menu item may be created. In this case, a menu item such as “XX bank” is provided in the page corresponding to each menu item. Then, the personal identification information request data string “utn” is added when the URL corresponding to the menu item is designated by the anchor tag. With this configuration, the user of the mobile device MS can find a desired site on the gateway server GWS as in the present embodiment.

<Modification 3>
In the present embodiment, the IP server W is configured to perform user authentication only in accordance with the personal identification information transmitted from the mobile device MS. However, other information may be used together in order to perform more reliable user authentication. For example, the following method can be considered.

i) Method a
This method is a method for allowing a user to input a password after performing user authentication based on personal identification information.
When this method is adopted, the stored contents of the personal identification information database 113 of the IP server W are changed as shown in FIG. That is, personal identification information and a password are stored in association with each user ID. Here, this password is a password issued by the IP when the user of the IP and the mobile station MS has signed a service provision contract.

  When the GET request DS6 or D2 (FIG. 13, FIG. 14) with the personal identification information added is transmitted from the mobile device MS, the data distribution management unit 111 of the IP server W adds the GET request DS6 or D2 to the GET request DS6 or D2. The extracted URL is extracted and stored in the RAM, and the personal identification information is extracted from the GET request DS6 or D2 and sent to the authentication unit 112. The authentication unit 112 searches the personal identification information database 113 based on the personal identification information, reads a user ID corresponding to the personal identification information, and sends the user ID to the data distribution management unit 111.

  Then, when the user ID is sent from the authentication unit 112, the data distribution management unit 111 stores the user ID in the RAM and also displays a screen for inputting a password or the like as shown in FIG. HTML data corresponding to “password input screen” is sent to the Internet INET.

  When the HTML data is received by the mobile device MS and the password input screen shown in FIG. 18 is displayed on the liquid crystal display unit 24, the password and the user ID are input to the instruction input unit 23 of the mobile device MS and determined. When the input operation for performing the above is performed, the control unit 21 of the mobile station MS sends a GET request including the password and the like to the mobile packet communication network MPN. When receiving the GET request, the data distribution management unit 111 of the IP server W extracts a password and a user ID from the GET request and sends the password and the user ID to the authentication unit 112.

  The authentication unit 112 reads the password corresponding to the user ID sent from the data distribution management unit 111 from the personal identification information database 113. Then, the authentication unit 112 determines whether the read password matches the password transmitted from the data distribution management unit 111, and sends the authentication result to the data distribution management unit 111. Next, the data distribution management unit 111 provides a service only when it is determined that the user is a valid user as a result of the user authentication.

  In this case, for each service provided by the IP server W, the authentication method may be changed according to the need to ensure security, or only user authentication based on personal identification information may be performed. Moreover, it is good also as a structure which transmits biometrics information, such as fingerprint information, instead of a password.

ii) Method b
In this method, when the mobile device MS transmits personal identification information, the user is prompted to input a user ID, and the user ID and personal identification information input by the user are transmitted to the IP server W to perform user authentication. Is the method.
In this case, a box for inputting the user ID is added to the screen (FIG. 12) displayed on the liquid crystal display unit 24 of the mobile device MS in step S3 of FIG. FIG. 19 is a diagram showing an example of a screen displayed on the liquid crystal display unit 24 of the mobile device MS at this time. Here, when the user inputs his / her user ID and performs an input operation for selecting a transmission button in a state where the screen shown in FIG. 11 is displayed, the control unit 21 of the mobile station MS receives the input user. A GET request DS6 or D2 (FIGS. 13 and 14) to which the ID and personal identification information are added is transmitted to the mobile packet communication network MPN.

  On the other hand, in the IP server W, the data distribution management unit 111 extracts the personal identification information and the user ID from the GET request DS6 or D2 and sends the personal identification information and the user ID to the authentication unit 112, and the authentication unit 112 performs user authentication based on the information. I do. Specifically, the authentication unit 112 reads the personal identification information corresponding to the user ID sent from the data distribution management unit 111 from the personal identification information database 113, and sends the personal identification information and the data distribution management unit 111 to the personal identification information. It is determined whether the personal identification information that has been received matches. Then, the authentication unit 112 sends the authentication result to the data distribution management unit 111. The data distribution management unit 111 provides a service only when it is determined that the user is a valid user as a result of the user authentication.

  Thus, not only user authentication based on personal identification information but also other authentication methods can be used together to ensure the reliability of user authentication. In particular, for services related to user property such as “net banking”, not only user authentication based on personal identification information but also the combined use of other authentication methods has a very large effect.

<Modification 4>
FIG. 20 is a block diagram showing the configuration of the mobile device MS2 according to this modification. In the figure, elements similar to those in FIG. 7 described above are denoted by the same reference numerals.

  As a characteristic configuration in the present modification, the mobile device MS2 has a UIM interface unit 26 (hereinafter, “interface” is abbreviated as “I / F”) for connecting a UIM (User Identity Module) 2000, Used in connection with UIM2000. Here, the UIM 2000 is a module having user-specific information such as a user's subscriber number. The control unit 21 of the mobile device MS2 exchanges data with the UIM 2000 through the UIMI / F unit 26 and receives a packet switching service of the mobile packet communication network MPN. Further, in this modification, when receiving a packet switching service in the mobile packet communication network MPN, for example, a subscriber number is issued for each UIM2000 as in SIM in GSM (Global System for Mobile Communications), Billing is also performed in units of UIM2000.

  Next, UIM2000 will be described in more detail. FIG. 21 is a block diagram showing the configuration of UIM2000. As shown in the figure, the UIM 2000 includes a CPU 2001, an external I / F unit 2002, a ROM 2003, a RAM 2004, and an EEPROM 2005.

  The external I / F unit 2002 mediates data exchange between the CPU 2001 and the UIMI / F unit 26 of the mobile device MS2. The ROM 2003 is a non-volatile memory, and stores a program for performing analysis, execution, response, data management, and the like of the control command supplied from the mobile device MS2 in addition to the control program. The CPU 2001 controls each unit of the UIM 2000 by executing a program stored in the ROM 2003. The RAM 2004 is used as a work area for the CPU 2001. The EEPROM 2005 stores user-specific information such as user subscriber information and information such as the UIM2000 serial number.

  Here, among services provided by the IP server W to the mobile device MS2, there are services that distribute character content, music content, and the like. In these services, charging is performed in units of content, so that charging is often not performed when a distribution request from the same user is made again. For this reason, in a communication system in which charging is performed in units of UIM2000 as in this modification, by using the same UIM2000, unauthorized use is possible in which the same content is downloaded to a plurality of mobile devices MS2 with a single charge. turn into. Therefore, in this modified example, user authentication is performed by using not only the manufacturing number of mobile device MS2 but also unique information unique to UIM2000 (in this modified example, “the manufacturing number of UIM2000”) as personal identification information. It is the composition which performs.

Hereinafter, in the operation of this modified example, a part different from the above-described embodiment will be described.
First, in the present modification, the mobile station MS2 executes the same processing as steps S1 to S6 in FIG. Then, when the mobile device MS2 transmits a GET request in step S7 in FIG. 11, the CPU 211 requests the UIM 2000 to transmit the serial number of the UIM 2000. When a transmission request for a manufacturing number is sent from the mobile device MS2, the CPU 2001 of the UIM2000 reads its own manufacturing number from the EEPROM 2005 and sends it to the mobile device MS2 via the external I / F unit 2002.

  Then, the CPU 211 of the mobile device MS2 sends a GET request with the UIM manufacturing number acquired from the UIM 2000 added as personal identification information to the mobile packet communication network MPN together with the manufacturing number of the mobile device MS2 read from the ROM 212. The IP server W performs user authentication based on the manufacturing number of the mobile device MS2 added to the GET request and the manufacturing number of the UIM2000.

  Accordingly, the stored contents of the personal identification information database 113 of the IP server W are changed as shown in FIG. That is, in association with each user ID, the manufacturing number of mobile unit MS2 and the manufacturing number of UIM are stored as personal identification information. The authentication unit 112 determines a match between the two serial numbers sent from the mobile device MS2 and the information stored in the personal identification information database 113. If they match, the authentication is successful.

  Thus, according to the present modification, the user authentication is performed using not only the manufacturing number of the mobile device but also the manufacturing number of the UIM as personal identification information. For this reason, it is possible to perform simple and reliable user authentication not only when charging is performed on a mobile unit basis, but also on a system where charging is performed on a module basis such as UIM, and the validity of the authentication is ensured. It can be secured.

1 is a diagram illustrating an overall configuration of a communication system 1 according to an embodiment. It is a block diagram which illustrates the composition of IP server W concerning the embodiment. It is a figure which shows the example of a source of HTML data concerning the embodiment. It is a figure which shows an example of the image corresponding to the data shown in FIG. It is a figure which illustrates the memory content of the personal identification information database 113 concerning the embodiment. It is a figure which illustrates the memory content of database for search GWS1 concerning the embodiment. It is a block diagram which illustrates the composition of mobile equipment MS concerning the embodiment. It is a figure which illustrates the memory content of history storage table TBL concerning the embodiment. It is a figure which shows an example of the screen displayed on the liquid crystal display part 24 of the mobile station MS concerning the embodiment. It is a figure which shows an example of the screen displayed on the liquid crystal display part 24 of the mobile station MS concerning the embodiment. It is a flowchart which shows the process which CPU211 of the mobile station MS performs in the same embodiment. It is a figure which shows an example of the screen displayed on the liquid crystal display part 24 of the mobile station MS concerning the embodiment. It is a sequence chart which shows the flow of the signal in the communication system 1 in the embodiment. It is a sequence chart which shows the flow of the signal in the communication system 1 in the embodiment. It is a figure which shows an example of the screen displayed on the liquid crystal display part 24 of the mobile station MS concerning the embodiment. It is a figure which shows an example of the screen displayed on the liquid crystal display part 24 of the mobile station MS concerning the embodiment. It is a figure which illustrates the memory content of the personal identification information database 113 concerning the modification 1. It is a figure which shows an example of the screen displayed on the liquid crystal display part 24 of the mobile apparatus MS concerning the modification 2. It is a figure which shows an example of the screen displayed on the liquid crystal display part 24 of the mobile station MS concerning the modification. It is a block diagram which illustrates composition of mobile station MS2 concerning modification 3. It is a block diagram which illustrates the composition of UIM2000 concerning the modification. It is a figure which illustrates the memory content of the personal identification information database 113 concerning the modification.

Claims (14)

A receiving process in which a mobile terminal accommodated in the first network receives data from the first network;
A detection process for detecting whether or not a predetermined data sequence exists in the data received by the mobile terminal in the reception process;
Only when it is detected that the data string is present in the detection process, the mobile terminal transmits personal identification information for uniquely identifying a user stored in advance in the terminal,
A transfer process in which a relay device that relays data exchange between the first network and the second network transfers personal identification information transmitted from the mobile terminal to the second network;
A server connected to the second network comprises an authentication process for authenticating a user of the portable terminal based on the personal identification information. In the transmission process, the mobile terminal
Sending the personal identification information in a form unreadable by a device other than the server,
In the authentication process, the server
The user authentication method according to claim 1, wherein the personal identification information is decrypted, and the user of the portable terminal is authenticated based on the personal identification information. The relay apparatus further includes a search process of searching for the address of the server in the second network according to a request from the mobile terminal,
The user authentication method according to claim 1, wherein the data received by the mobile terminal in the reception process is data corresponding to a search result searched by the relay device in the search process. The data is described in a markup language,
The user authentication method according to claim 1, wherein the data string is a predetermined identifier included in the data. Only when it is detected that the data string exists in the detection process, the portable terminal further includes a determination promotion process that prompts the user of the terminal to determine whether the personal identification information can be transmitted. ,
2. The user authentication method according to claim 1, wherein in the transmission process, the mobile terminal transmits the personal identification information only when the user's permission is obtained in the determination promotion process. In the determination promotion process, the mobile terminal
While displaying an image for asking the user's judgment, prompting the user to input input identification information,
In the transmission process, the portable terminal transmits the input identification information input by the user together with the personal identification information,
The user authentication method according to claim 5, wherein the server performs user authentication based on the personal identification information transmitted in the transmission process and the input identification information in the authentication process. A distribution process in which the server distributes input data that prompts the portable terminal to input input identification information after the authentication process;
The process of prompting the user to input the input identification information based on the input data when the mobile terminal receives the input data distributed in the distribution process;
A second transmission process of transmitting the input identification information input in the process of prompting the input;
The user authentication method according to claim 1, further comprising: a second authentication step of authenticating a user of the portable terminal based on the input identification information transmitted in the second transmission step.   The user authentication method according to claim 1, wherein the personal identification information is a manufacturing number of the portable terminal.   2. The user authentication according to claim 1, wherein the personal identification information is configured by a combination of a manufacturing number of the mobile terminal and information stored in a user identification module connected to the mobile terminal. Method. The first network is a mobile communication network;
The user authentication method according to claim 1, wherein the mobile terminal is a mobile device that performs communication via the mobile communication network. Only when data is received from the first network, a predetermined data string is detected in the data, and it is detected that the data string is present, the data is stored in advance in the own terminal. A mobile terminal that transmits personal identification information for uniquely identifying a user to the first network;
A second network interconnected with the first network via a relay device;
And a server connected to the second network and performing authentication based on the personal identification information. A communication unit for communicating with others via a first network;
When the communication unit communicates with a server in the second network via the first network and the second network connected thereto, and receives data including a predetermined data string from the server A mobile terminal comprising: a control unit that reads personal identification information from a memory provided in the mobile terminal or a memory connected to the mobile terminal and transmits the personal identification information to the server via the connection.   When the communication unit communicates with the server in the second network via the first network and the second network connected thereto, and receives data including a predetermined data string from the server, A program for causing a computer to execute a process of reading personal identification information from a memory provided in a terminal or a memory connected to the portable terminal and transmitting the personal identification information to the server by the communication unit.   When the communication unit communicates with the server in the second network via the first network and the second network connected thereto, and receives data including a predetermined data string from the server, A recording medium storing a program for reading out personal identification information from a memory provided in a terminal or a memory connected to the portable terminal, and causing the computer to execute a process of transmitting the information to the server by the communication unit.

Images