JP2012005037A - Website login method and website login system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform login through simple operation while utilizing an electronic signature function of a mobile terminal and to ensure sufficient security at low costs.SOLUTION: In a Website login method, a Web service server generates an authentication ticket and generation time information of the authentication ticket and stores them in an authentication ticket information DB, encodes the authentication ticket and transmits image information of the authentication ticket. A display terminal communication section displays the image information of the authentication ticket. A mobile terminal reads the image information of the authentication ticket and decodes it to acquire the authentication ticket, generates an authentication response ticket by adding signature information which is electronically signed, and transmits it to a display terminal. The display terminal receives the authentication response ticket and transmits it to the Web service server. The Web service server receives and verifies the authentication response ticket.

Description

  The present invention relates to an authentication technique for login and access to a website on a network, and more particularly to a website login method and website login system using an electronic signature function of a mobile terminal.

  2. Description of the Related Art Conventionally, a method of guiding viewers from a TV program (data broadcasting or the like) viewed by an unspecified number of people to a Web service server that can provide Web services (various services such as ticket reservation and product purchase) is known. ing. For example, a TV broadcaster displays a URL on a TV screen, a user notes it, inputs the URL from a keyboard or remote control into a personal computer (PC) or digital TV browser, and a predetermined authentication method (for example, There is a method of starting a service after user authentication by an ID / password method or an authentication method using an IC card. Also, the TV broadcaster displays the URL converted into a two-dimensional barcode on the screen, the user reads it with a device such as a mobile phone, starts the device browser and displays the screen. There is a method of starting a service after authenticating a user by a different authentication method.

  However, in any of the methods, until the service can be used, the user is forced to perform a complicated operation, has a high hurdle until the service is started, and is difficult to smoothly guide to the Web service server. is there. In the latter method using the two-dimensional bar code, access to the service is relatively easy, but the user receives the service with a mobile phone, the screen is small, and a numeric keypad such as an elderly person is used. For users who are unfamiliar with the operation, the service is difficult to use.

  As a method for authenticating with the Web service server, a method using a user ID and a password is generally used. However, this method requires the user to store or record IDs and passwords, and in order to maintain safety, the password is changed periodically, and the user can easily guess the password. There was a need to think about strings that are not. In addition, when the user forgets the password, the management has to be complicated because it takes time and cost to reset the server. As a method for solving this problem, a technique of authenticating with a one-time password is known (for example, see Non-Patent Document 1). A one-time password is a disposable password that is generated according to certain rules and can be used only once.

Yuichi Deguchi, “One Time Password” [online], Nikkei Business Publications, Inc. [Search June 21, 2010], Internet <URL: http://itpro.nikkeibp.co.jp/article/COLUMN/20060414/ 235357 />

  However, with the exception of some exceptions, the TV remote controller is the only means for inputting the user ID and password to the digital TV. Since the TV remote control has a limited number of buttons and is not suitable as an interface for character string input, complicated operations are required to enter a password (length and character variations are required) to ensure sufficient security. Is needed.

  In addition, the technique of authenticating with a one-time password has high security, but has a problem that the user needs to have hardware for generating a password and is expensive.

  An object of the present invention is to solve the above problems by using a digital signature function of a mobile terminal, logging in with a simple operation, and ensuring a sufficient security at a low cost It is to provide a login system and a method thereof.

  In order to solve the above problems, in the present invention, the infrared function and the image reading function of a mobile phone are used to securely access a website from a home digital TV browser without the user directly entering an ID / password. A web site log-in system and method for log-in authentication and displaying a necessary web page (service screen) are provided.

  That is, in order to solve the above-described problem, a website login method according to the present invention includes a web service server that provides a web service, a display terminal connected to the web service server via a network, and a mobile terminal. A Web site login method in a system, wherein the Web service server stores a user DB pre-stored in association with a unique user ID and a verification key used for authentication, and Web content storing Web service content data An information DB, an authentication ticket generation unit, an authentication ticket encoding unit, an authentication ticket verification unit, a Web content processing unit, and a Web service server communication unit, the display terminal including a display terminal communication unit, a Web interpretation Unit, a display unit, and a wireless reception unit, the portable terminal, A user ID / secret key storage unit that stores a user ID and a secret key used for authentication in association with each other, an image reading unit, an authentication ticket decoding unit, a signature adding unit, and a wireless transmission unit, (A) The authentication ticket generation unit generates an authentication ticket including a unique authentication ticket ID, authentication challenge information, and expiration date information of the authentication ticket, and generation time information of the authentication ticket associated with the authentication ticket And storing in the authentication ticket information DB; (b) generating the authentication ticket image information by encoding the authentication ticket by the authentication ticket encoding unit; and (c) the Web service server communication unit. Transmitting image information of the authentication ticket, and (d) the authentication by the display terminal communication unit Receiving the image information of the ticket, (e) displaying the image information of the authentication ticket by the display unit, and (f) the authentication ticket displayed on the display terminal by the image reading unit. A step of reading image information; (g) a step of obtaining an authentication ticket by decoding the image information of the read authentication ticket by the authentication ticket decoding unit; and (h) a user ID by the signature giving unit. The user ID acquired from the private key storage unit and the signature time are added to the authentication ticket, and the authentication ticket added with the user ID and signature time is the authentication acquired from the user ID / private key storage unit. A step of generating an authentication response ticket to which signature information that has been electronically signed using a private key is added, and (i) by the wireless transmission unit, Transmitting the authentication response ticket to the display terminal; and (j) receiving the transmitted authentication response ticket by the wireless reception unit, and transmitting the authentication response ticket to the Web service server by the display terminal communication unit. (K) a step of receiving the transmitted authentication response ticket by the Web service server communication unit; and (l) a use included in the received authentication response ticket by the authentication ticket verification unit. The user DB is searched using a user ID as a key, a verification key associated with the user ID is obtained, the electronic signature is verified using the verification key, and if the signature verification is successful, the reception The authentication ticket information DB is searched using the authentication ticket ID included in the authentication response ticket as a key, and the authentication ticket associated with the authentication ticket ID is searched. When the range information and the expiration date information of the authentication ticket are acquired, the authentication challenge information is the same as the authentication challenge information included in the received authentication response ticket, and the current time is before the expiration date of the authentication ticket The step of determining that the authentication is successful.

  In the Web site login method according to the present invention, the step (c) is a step of transmitting image information of the authentication ticket to the display terminal by the Web service server communication unit, and the step (d) The display terminal communication unit receives image information of the authentication ticket from the Web service server, and the step (e) is a step of displaying the authentication ticket image information on the Web by the display unit. It is characterized by being.

  In the website login method according to the present invention, the step (c) is a step of transmitting image information of the authentication ticket to a television station system by the web service server communication unit, and the step (d) The display terminal communication unit receives image information of the authentication ticket in conjunction with program information downloaded and broadcast from the television station system, and the step (e) includes: Image information is displayed together with the program broadcast.

  Also, in the Web site login method according to the present invention, in the step (a), the authentication ticket generation unit generates URL information of a jump destination that is associated with the authentication ticket and that is to be displayed after login. A step of storing in the ticket information DB, and after the step (l), (m) the Web content processing unit acquires jump destination URL information from the authentication ticket information DB, and the Web content information DB Acquiring Web content of a jump destination URL, transmitting the acquired Web content to the display terminal by the Web service server communication unit; and (n) displaying the Web content by the display unit. It is characterized by including.

  In the Web site login method according to the present invention, the Web service server includes an authentication history DB that stores a user ID, an authentication ticket ID, an authentication count, and a final signature time, which are associated with each other. ) Stores the user ID and the authentication ticket ID included in the received authentication response ticket in the authentication history DB, and when the user ID and the authentication ticket ID are already stored in the authentication history DB, Updating and storing the number of times of authentication, and updating and storing the final signature time to a signature time included in the received authentication response ticket, wherein the step (l) includes: Access to the authentication history DB and associate with the user ID and authentication ticket ID included in the received authentication response ticket Authentication times and final signature times exist, and the number of times of authentication does not exceed the specified number of times and / or the number of authentications associated with the user ID and authentication ticket ID included in the received authentication response ticket And a step of determining that the authentication is successful when the final signature time exists and the signature time included in the authentication response ticket is later than the final signature time.

  Furthermore, in order to solve the above problems, a website login system according to the present invention includes a web service server that provides a web service, a display terminal connected to the web service server via a network, and a mobile terminal. In the web site login system, the web service server stores a user DB stored in advance in association with a unique user ID and a verification key used for authentication, and a web content information DB for storing content data of the web service. And an authentication ticket including a unique authentication ticket ID, authentication challenge information, and expiration date information of the authentication ticket, and generation time information of the authentication ticket associated with the authentication ticket, and stored in the authentication ticket information DB And an authentication ticket generation unit that performs the authentication ticket An authentication ticket encoding unit that generates image information of the authentication ticket by encoding, a Web service server communication unit that transmits and receives information to and from the display terminal via a network, and an electronic signature for the authentication ticket acquired from the display terminal An authentication ticket verification unit that verifies the validity of the authentication response ticket that has been made, and a Web content processing unit that acquires Web content from the Web content information DB and transmits the Web content by the Web service server communication unit, and the display terminal Includes a display terminal communication unit that transmits and receives information to and from the Web service server via a network, a Web interpretation unit that has a browser function for interpreting the Web content, and a display that displays image information and the Web content of the authentication ticket. And the authentication response ticket A wireless reception unit that transmits to a Web service server, and the portable terminal is displayed on the display terminal and a user ID / secret key storage unit that associates and stores the user ID and a secret key used for authentication. An image reading unit that reads image information of the authentication ticket, an authentication ticket decoding unit that decodes the read image information of the authentication ticket to acquire an authentication ticket, and a user acquired from the user ID / private key storage unit An ID and a signature time are added to the authentication ticket, and an electronic signature is added to the authentication ticket to which the user ID and the signature time are added using the authentication private key acquired from the user ID / private key storage unit A signature adding unit that adds signature information to generate the authentication response ticket; and a wireless transmission unit that transmits the authentication response ticket to the display terminal. The authentication ticket verification unit searches the user DB using a user ID included in the authentication response ticket as a key, verifies the electronic signature using a verification key associated with the user ID, If the verification is successful, the authentication ticket information DB is searched using the authentication ticket ID included in the authentication response ticket as a key, the authentication challenge information associated with the authentication ticket ID and the expiration date information of the authentication ticket are acquired, and the authentication challenge It has means for judging that the authentication is successful when the information is the same as the authentication challenge information included in the authentication response ticket and the current time is before the expiration date of the authentication ticket.

  In the Web site login system according to the present invention, the Web service server communication unit includes means for transmitting image information of the authentication ticket to the display terminal, and the display terminal communication unit includes the image of the authentication ticket. It has means for receiving information from the Web service server, and the display unit has means for displaying the image information of the received authentication ticket on the Web.

Further, in the website login system according to the present invention, the web service server communication unit includes means for transmitting image information of the authentication ticket to a television station system,
The display terminal communication unit includes means for receiving image information of the authentication ticket in conjunction with program information downloaded and broadcast from the television station system, and the display unit receives the image information of the received authentication ticket. It has the means to display with a program broadcast, It is characterized by the above-mentioned.

  Further, in the Web site login system according to the present invention, the authentication ticket generation unit generates URL information of a jump destination associated with the authentication ticket and desired to be displayed after login, and stores the URL information in the authentication ticket information DB. And the Web content processing unit has means for acquiring jump destination URL information from the authentication ticket information DB and acquiring Web content of the jump destination URL from the Web content information DB. .

  In the Web site login system according to the present invention, the Web service server includes an authentication history DB that stores a user ID, an authentication ticket ID, an authentication count, and a final signature time associated with each other, and the Web service server The communication unit stores the user ID and the authentication ticket ID included in the received authentication response ticket in the authentication history DB, and when the user ID and the authentication ticket ID are already stored in the authentication history DB. , Updating and storing the number of times of authentication, and updating and storing a final signature time to a signature time included in the received authentication response ticket, and the authentication ticket verification unit accesses the authentication history DB And the user ID included in the received authentication response ticket and the number of authentications associated with the authentication ticket ID, and When a final signing time exists and the number of times of certification does not exceed a specified number of times, and / or the number of authentications and the last signing time associated with the user ID and the authentication ticket ID included in the received authentication response ticket The authentication response ticket includes means for determining that the authentication is successful when the signature time included in the authentication response ticket is later than the final signature time.

  According to the present invention, it is possible to log in with a simple operation and secure sufficient security.

  In addition, it is possible to build a system only by adding software, using only the functions (hardware) that are almost standardized on mobile phones and Web display terminals that are currently widely used. It becomes possible to start relatively easily.

It is a block diagram which shows the outline of the website login system of one Example by this invention. It is a block diagram which shows the structure of the website login system of one Example by this invention. It is a figure which shows the information stored in authentication ticket information DB of one Example by this invention. It is a figure which shows the information stored in user DB of one Example by this invention. It is a figure which shows the structure of the authentication ticket data and authentication response ticket data of one Example by this invention. 3 is a flowchart illustrating a website login method according to an embodiment of the present invention. It is a figure which shows the information stored in authentication log | history DB of one Example by this invention.

[Web site login system configuration]
FIG. 1 is a block diagram showing an outline of a website login system according to an embodiment of the present invention. The website login system 1 includes a web service server 11, a web display terminal 12, and a mobile terminal 13, and the web service server 11 and the web display terminal 12 are connected via a network 14. The network 14 is a WAN such as the Internet.

  The web service server 11 is a server that can provide a web service.

  The Web display terminal 12 is a device having a function of accessing the Web service server 11 via the network 14 and a function of receiving data wirelessly (infrared rays or radio waves). For example, a home digital television or personal computer (PC) equipped with a network connection function, a network Web browser function, and an infrared reception function.

  The mobile terminal 13 is a device used for Web site login authentication, which has a function of transmitting data wirelessly (infrared rays or radio waves). For example, a camera-equipped mobile phone having a two-dimensional barcode reading function and an infrared transmission function. The user U reads the authentication image data displayed on the Web display terminal 12 using the mobile terminal 13 and transmits the authentication response data generated by the mobile terminal 13 to the Web display terminal 12 wirelessly. Even when a mobile phone is used as the mobile terminal, the log-in method of the present system does not need to be connected to the mobile phone network, so it can be used even in a place where radio waves do not reach, and no telephone charges are incurred.

  FIG. 2 is a block diagram showing a configuration of a website login system according to an embodiment of the present invention. The Web service server 11 includes a control unit 111, a communication unit 112, an authentication ticket information DB 113, a user DB 114, and a Web content information DB 115. When the Web service server 11 transmits information to the Web display terminal 12 via the TV station system 15, the Web service server 11 further includes a program insertion unit 116, and the TV station system 15 inserts information transmitted from the program insertion unit 116 into the program. To the Web display terminal 12.

  As shown in FIG. 3, the authentication ticket information DB 113 includes an authentication ticket ID composed of a number uniquely indicating an authentication ticket, expiration date information of the authentication ticket, authentication challenge information, and a URL (jump to be displayed after login). The combination of the information of (destination URL) and the authentication ticket generation time information is stored as one record. Among these, the information displayed on the Web display terminal 12 including the authentication ticket ID, the expiration date of the authentication ticket, and the authentication challenge information is referred to as an authentication ticket. FIG. 5A is a diagram illustrating an example of the authentication ticket data. Information on the jump destination URL is not essential, but by providing a URL jump, even if the user does not enter the URL, the service provider can automatically jump to the desired URL and use it for necessary services. Person can be guided.

  As shown in FIG. 4, the user DB 114 records one combination of a user ID assigned to each user, a verification key used for authentication, and user attribute information (user name, etc.). Store as. The verification key uses a public key of the public key encryption at the time of authentication using the public key encryption, and a common key at the time of authentication when the common key encryption is used.

  The Web content information DB 115 stores Web service content data.

  The program insertion unit 116 transmits the authentication ticket to the television station system 15.

  The control unit 111 includes a processing request control unit 1111, an authentication ticket generation unit 1112, an authentication ticket encoding unit 1113, an authentication ticket verification unit 1114, and a Web content processing unit 1115.

  The processing request control unit 1111 performs control so that necessary functions are executed in a necessary order using information input from the communication unit 112 and processing results of the respective processing units as a trigger.

  The authentication ticket generation unit 1112 generates a unique authentication ticket ID using a random number or the like, and stores it in the authentication ticket information DB 113 together with attribute information. Furthermore, it is also possible to store in the authentication ticket information DB 113 information on URLs that jump after authentication.

  The authentication ticket encoding unit 1113 encodes the authentication ticket acquired from the authentication ticket information DB 113 to create image information such as a two-dimensional barcode, and then outputs the image information to the communication unit 112 or the program insertion unit 116. When output to the communication unit 112, it is transmitted to the Web display terminal 12 via the network 14, and when output to the program insertion unit 116, it is transmitted to the Web display terminal 12 via the television station system 15.

  The authentication ticket verification unit 1114 compares the signature time included in the authentication response ticket input from the communication unit 112 with the current time, and checks whether it is within the specified time. The authentication response ticket will be described later. If it is within the specified time, the authentication ticket ID is checked against the contents of the authentication ticket information DB 113. If the verification is successful, the user ID included in the authentication response ticket is verified with the user DB 114. If the verification is successful, the signature information included in the authentication response ticket is verified using the verification key associated with the user ID in the user DB 114. If the verification is successful, login authentication of the Web service is performed.

  The web content processing unit 1115 acquires web content from the web content information DB 115, converts it into a form that can be displayed on the web display terminal 12 if necessary, and outputs it via the communication unit 112. It is also possible to acquire a jump destination URL stored in the authentication ticket information DB 113 after login authentication and jump to the jump destination URL.

  The communication unit 112 transmits and receives information to and from the Web display terminal 12 via the network 14. The communication unit 112 includes a reception data processing unit 1121 and a transmission data processing unit 1122.

  The reception data processing unit 1121 acquires information from the Web display terminal 12 via the network 14 and converts the reception data into an appropriate format.

  The transmission data processing unit 1122 converts the information into an appropriate format and outputs it to the Web display terminal 12 via the network 14.

  The web display terminal 12 includes a control unit 121, a communication unit 122, a web interpretation unit 123, a display unit 124, and an infrared reception unit 125.

  The control unit 121 performs control so that necessary functions are executed in a necessary order using information input from the communication unit 122 and processing results of the respective processing units as a trigger.

  The communication unit 122 transmits / receives information to / from the Web service server 11 via the network 14.

  The web interpretation unit 123 has a browser function for interpreting the web content data received from the communication unit 122 and causes the display unit 124 to display the web content data.

  The display unit 124 displays TV programs distributed from the TV station system 15 and Web contents distributed from the Web service server 11. When the image information of the authentication ticket is received from the Web service server 11, the image information of the received authentication ticket is displayed on the Web, and the image information of the authentication ticket is received in conjunction with the program information downloaded from the TV station system 15. In such a case, the image information of the received authentication ticket is displayed together with the program broadcast. Note that the display location of the authentication ticket image information is not limited to the Web display terminal 12, and can be displayed on another device (such as a PC or a TV) having the function of the display unit 124. Therefore, a generic term for the Web display terminal and other devices having the function of the display unit 124 is defined as “display terminal”, and in this embodiment, a case where the display terminal is only the Web display terminal 12 will be described.

  The infrared receiving unit 125 receives data from the mobile terminal 13 using infrared rays. Note that radio waves may be received instead of infrared rays.

  The portable terminal 13 includes a control unit 131, an authentication ticket decoding unit 132, a signature adding unit 133, a user ID / secret key storage unit 134, an image reading unit 135, and an infrared transmission unit 136.

  The control unit 131 performs control so that necessary functions are executed in a necessary order using a user operation or a processing result of each processing unit as a trigger.

  The user ID / private key storage unit 134 stores in advance a user ID associated with the user ID stored in the user DB 114 of the Web service server 11. Also, an authentication private key used for signature by the user is stored in advance. When using a public key cryptosystem, a public key cryptography private key is used, and when using a common key cryptosystem, a common key is used. This secret key is associated with a verification key having the same user ID as the user ID stored in the user ID / secret key storage unit 134 stored in the user DB 114 of the Web service server 11. is there.

  The image reading unit 135 reads an encoded image displayed on the display unit 124 of the Web display terminal 12 and outputs the encoded image to the authentication ticket decoding unit 132.

  The authentication ticket decoding unit 132 acquires the authentication ticket by decoding the encoded image input from the image reading unit 135, and outputs the authentication ticket to the signature adding unit 133.

  The signature assigning unit 133 assigns a signature with an electronic signature to the authentication ticket input from the authentication ticket decoding unit 132 together with the user ID information. When it is desired to ensure high security, it is preferable to execute the operation for assigning a signature in a tamper-resistant device such as a USIM (Universal Subscriber Identity Module).

  The infrared transmission unit 136 transmits data to the Web display terminal 12 using infrared rays. Note that radio waves may be transmitted instead of infrared rays.

[Website login method]
Next, a website login method according to the present invention will be described. FIG. 6 is a flowchart illustrating a website login method according to an embodiment of the present invention.

  The website login system pays out a unique user ID to the user in advance, and correspondingly generates a public key and a secret key of a public key cryptosystem used for authentication. The Web service server 11 stores the user ID and the public key used for authentication in the user DB 114 in association with each other, and the mobile terminal 13 downloads the user ID and the secret key used for authentication (via a network or the like). And stored in the user ID / private key storage unit 134. The user DB 114 may also store user attribute information (such as address, name, age and gender) necessary for providing the Web service.

  In step S101, the authentication ticket generation unit 1112 of the Web service server 11 uses an authentication ticket ID that is unique in the system as an authentication ticket, authentication challenge information that is difficult to guess based on a sufficiently long random number, and the like. A ticket expiration date is generated and stored in the authentication ticket information DB 113. Further, authentication ticket generation time information and jump destination URL information to be displayed on the Web screen when authentication is successful are generated and stored in the authentication ticket information DB 113.

  In step S102, the authentication ticket encoding unit 1113 of the Web service server 11 encodes the authentication ticket to generate two-dimensional barcode image information.

  In step S103, the transmission data processing unit 1122 of the Web service server 11 converts the authentication ticket image converted into the two-dimensional barcode into a format (html, flash, etc.) that can be displayed on the Web browser, and transmits it to the Web display terminal 13. To do. Alternatively, it is set to be transmitted to the television station system 15 and inserted into the television program.

  In step S104, authentication ticket image information is received by the communication unit 122 of the Web display terminal 12, and a two-dimensional barcode authentication ticket image is displayed by the display unit 124 (Web screen or television program screen). When the image information of the authentication ticket is received from the Web service server 11, the image information of the received authentication ticket is displayed on the Web, and the image information of the authentication ticket is received in conjunction with the program information downloaded from the TV station system 15. In such a case, the image information of the received authentication ticket is displayed together with the program broadcast. Note that the display location of the image information of the authentication ticket is not limited to the display unit 124, but can be displayed on the display unit of another display terminal such as a PC or TV.

  In step S105, the image reading unit 135 of the portable terminal 13 reads the two-dimensional barcode authentication ticket image displayed on the Web display terminal 12, and the authentication ticket decoding unit 132 decodes the read image to authenticate the ticket. To get.

  In step S106, the signature assigning unit 133 of the portable terminal 13 adds the user ID and the signature time acquired from the user ID / private key storage unit 134 to the authentication ticket, and obtains a hash value for the authentication ticket to authenticate the user. An authentication response ticket to which signature information that has been digitally signed using a private key is added is generated. The operation of digitally signing the hash value is preferably executed in the USIM that is a tamper resistant device of the mobile phone.

  In step S <b> 107, the infrared transmission unit 136 of the mobile terminal 13 transmits an authentication response ticket to the Web display terminal 12 by infrared.

  In step S108, the infrared receiving unit 125 of the Web display terminal 12 receives the authentication response ticket transmitted from the portable terminal 13 by infrared, and the communication unit 122 transmits the authentication response ticket to the Web service server 11 via the network 14. To do.

  In step S109, the reception data processing unit 1121 of the Web service server 11 receives the authentication response ticket transmitted from the Web display terminal 12.

  In step S110, the authentication ticket verification unit 1114 of the Web service server 11 searches the user DB 114 using the user ID included in the authentication response ticket as a key to identify the user, and is registered in the user DB 114 in advance. The identity of the user is confirmed by verifying the electronic signature using the public key. If the signature verification is successful, the authentication ticket information DB 113 is searched using the authentication ticket ID included in the authentication response ticket as a key, and the authentication ticket is specified. By confirming that the authentication challenge information included in the authentication response ticket is the same as the authentication challenge information registered in the authentication ticket information DB 113, the authenticity of the authentication response ticket is confirmed, and further registered in the authentication ticket information DB 113. The validity of the authentication ticket is checked by comparing the authentication ticket expiration date and the current time. If all of the above are confirmed, the user can successfully log in. The order of confirmation does not matter.

  The Web service server 11 further includes an authentication history DB, and can store a user ID, an authentication ticket ID, an authentication count, and a final signature time each time an authentication response ticket is received from a user. FIG. 7 is a diagram illustrating an example of information stored in the authentication history DB. When the authentication history DB is provided, in step S110, the authentication ticket verification unit 1114 of the Web service server 11 accesses the authentication history DB, and the number of authentications and the last signature time associated with the user ID and the authentication ticket ID are obtained. If it exists, it is confirmed that the number of times of sending does not exceed the specified number of times and / or that the signature time included in the authentication response ticket is later than the last signature time.

  In step S111, the Web content processing unit 1115 of the Web service server 11 acquires jump destination URL information from the authentication ticket information DB 113. Although it is possible to use only login authentication without providing a URL jump, by providing a URL jump, the service provider can automatically use the URL desired by the user without entering the URL. Jump to the desired service and guide the user to the required service.

  In step S112, the web content processing unit 1115 of the web service server 11 acquires the web content of the jump destination URL from the web content information DB 115.

  In step S113, the web interpretation unit 123 of the web display terminal 12 interprets the corresponding page sent from the web service server 11 and displays it on the display unit 124. Since user authentication has already been completed, the user can immediately use the service for members.

  Here, the Web server 11, the Web terminal 12, and the portable terminal 13 according to the present invention can be configured by a computer. In this case, a program describing processing contents for realizing each function is stored in an internal or external storage unit of the computer, and the program is read and executed by a central processing unit (CPU) of the computer. Can be realized. In addition, such a program can be distributed by selling, transferring, or lending a portable recording medium such as a DVD or a CD-ROM, and such a program is stored in a storage unit of a server on a network, for example. And the program can be distributed by transferring the program from the server to another computer via the network. In addition, a computer that executes such a program can temporarily store, for example, a program recorded on a portable recording medium or a program transferred from a server in its own storage unit. As another embodiment of the program, the computer may directly read the program from a portable recording medium and execute processing according to the program, and each time the program is transferred from the server to the computer. In addition, the processing according to the received program may be executed sequentially.

  According to the present invention, even if another person obtains an authentication ticket with an electronic signature, the Web service server 11 changes the authentication ticket every time it logs in, and verifies the expiration date of the authentication ticket. Login requests can be eliminated. In addition, the Web service server 11 can eliminate logins from other persons who do not hold a pre-registered mobile terminal by verifying the electronic signature given to the authentication response ticket.

  Further, according to the present invention, since the authentication ticket issued from the Web service server 11 is not associated with the user but only associated with the service (jump destination URL), an unspecified number of users use the same authentication ticket. It is possible. For this reason, authentication tickets can be posted on HP or distributed using mass media such as terrestrial digital data broadcasting, and can be expanded to various application services such as linking with TV programs. Become. In addition, since an unspecified number of users can easily obtain an authentication ticket, it is necessary to reliably specify the user. Therefore, it is preferable to perform an electronic signature using a tamper resistant device.

  Although the above embodiments have been described as representative examples, it will be apparent to those skilled in the art that many changes and substitutions can be made within the spirit and scope of the invention. Therefore, the present invention should not be construed as being limited by the above-described embodiments, and various modifications and changes can be made without departing from the scope of the claims. For example, since the user ID and secret key information stored and managed in the user ID / private key storage unit 134 must be strictly managed so as not to be used illegally, a mobile phone with a built-in USIM is used as the mobile terminal 13. It is also possible to use it. If it is set to enter a PIN (Personal Identity Number) code at the time of USIM startup, even if a malicious third party obtains a mobile phone, it is very difficult to use USIM and prevent impersonation. be able to.

  As described above, according to the present invention, when logging in to a Web site connected to a network, the present invention is useful for any application for performing login authentication using a mobile terminal.

DESCRIPTION OF SYMBOLS 1 Web site login system 11 Web service server 12 Web display terminal 13 Portable terminal 14 Network 15 Television station system 111 Control part 112 Communication part 113 Authentication ticket information DB
114 User DB
115 Web content information DB
116 Program Insertion Unit 121 Control Unit 122 Communication Unit 123 Web Interpretation Unit 124 Display Unit 125 Infrared Receiving Unit 131 Control Unit 132 Authentication Ticket Decoding Unit 133 Signature Assignment Unit 134 User ID / Secret Key Storage Unit 135 Image Reading Unit 136 Infrared Transmission Unit 1111 Processing Request Control Unit 1112 Authentication Ticket Generation Unit 1113 Authentication Ticket Encoding Unit 1114 Authentication Ticket Verification Unit 1115 Web Content Processing Unit 1121 Reception Data Processing Unit 1122 Transmission Data Processing Unit

Claims (10)

A website login method in a system comprising a web service server that provides a web service, a display terminal connected to the web service server via a network, and a mobile terminal,
The Web service server includes a user DB stored in advance in association with a unique user ID and a verification key used for authentication, a Web content information DB storing content data of the Web service, an authentication ticket generating unit, An authentication ticket encoding unit, an authentication ticket verification unit, a Web content processing unit, and a Web service server communication unit;
The display terminal includes a display terminal communication unit, a Web interpretation unit, a display unit, and a wireless reception unit,
The portable terminal includes a user ID / private key storage unit that associates and stores the user ID and a secret key used for authentication, an image reading unit, an authentication ticket decoding unit, a signature adding unit, a wireless transmission unit, With
(A) The authentication ticket generation unit generates an authentication ticket including a unique authentication ticket ID, authentication challenge information, and expiration date information of the authentication ticket, and generation time information of the authentication ticket associated with the authentication ticket And storing it in the authentication ticket information DB;
(B) The authentication ticket encoding unit generates the authentication ticket image information by encoding the authentication ticket;
(C) transmitting image information of the authentication ticket by the Web service server communication unit;
(D) receiving image information of the authentication ticket by the display terminal communication unit;
(E) displaying the image information of the authentication ticket by the display unit;
(F) reading image information of the authentication ticket displayed on the display terminal by the image reading unit;
(G) Decoding image information of the read authentication ticket by the authentication ticket decoding unit to obtain an authentication ticket;
(H) The signature giving unit adds the user ID and the signature time acquired from the user ID / private key storage unit to the authentication ticket, and adds the user ID and the signature time to the authentication ticket. Generating an authentication response ticket to which signature information that has been digitally signed using a secret key for authentication acquired from the user ID / private key storage unit is added;
(I) transmitting the authentication response ticket to the display terminal by the wireless transmission unit;
(J) receiving the transmitted authentication response ticket by the wireless reception unit, and transmitting the authentication response ticket to the Web service server by the display terminal communication unit;
(K) receiving the transmitted authentication response ticket by the Web service server communication unit;
(L) The authentication ticket verification unit searches the user DB using a user ID included in the received authentication response ticket as a key, acquires a verification key associated with the user ID, and performs the verification The electronic signature is verified using the key for authentication, and if the signature verification is successful, the authentication ticket information DB is searched using the authentication ticket ID included in the received authentication response ticket as a key, and the authentication challenge associated with the authentication ticket ID Information and the expiration date information of the authentication ticket, the authentication challenge information is the same as the authentication challenge information included in the received authentication response ticket, and the current time is before the expiration date of the authentication ticket Determining authentication is successful;
A Web site login method comprising: The step (c) is a step of transmitting image information of the authentication ticket to the display terminal by the Web service server communication unit.
The step (d) is a step of receiving image information of the authentication ticket from the Web service server by the display terminal communication unit,
The method of claim 1, wherein the step (e) is a step of displaying the image information of the authentication ticket on the web by the display unit. The step (c) is a step of transmitting image information of the authentication ticket to the television station system by the Web service server communication unit,
The step (d) is a step of receiving image information of the authentication ticket in conjunction with program information downloaded and broadcast from the television station system by the display terminal communication unit,
The method of claim 1, wherein the step (e) is a step of displaying the image information of the authentication ticket together with the program broadcast on the display unit. The step (a) includes a step of generating, by the authentication ticket generation unit, URL information of a jump destination associated with the authentication ticket that is to be displayed after login and storing the URL information in the authentication ticket information DB;
After step (l),
(M) The Web content processing unit acquires jump destination URL information from the authentication ticket information DB, acquires the jump destination URL Web content from the Web content information DB, and the Web service server communication unit Transmitting the acquired web content to the display terminal;
(N) displaying the web content by the display unit;
The Web site login method according to claim 1, further comprising: The Web service server includes an authentication history DB that stores a user ID, an authentication ticket ID, an authentication count, and a final signature time associated with each other,
The step (k) stores the user ID and authentication ticket ID included in the received authentication response ticket in the authentication history DB, and the user ID and authentication ticket ID are already stored in the authentication history DB. And updating and storing the number of authentications, and updating and storing the final signature time to a signature time included in the received authentication response ticket,
In the step (l), the authentication ticket verification unit accesses the authentication history DB, and the user ID included in the received authentication response ticket and the number of times of authentication and the last signature time associated with the authentication ticket ID exist. When the number of times of authentication does not exceed a specified number of times and / or there is a user ID included in the received authentication response ticket and the number of times of authentication and the last signature time associated with the authentication ticket ID. 5. The Web site login method according to claim 1, further comprising a step of determining that the authentication is successful when the signature time included in the response ticket is later than the final signature time. A website login system comprising a web service server that provides a web service, a display terminal connected to the web service server via a network, and a mobile terminal,
The Web service server includes a user DB stored in advance in association with a unique user ID and a verification key used for authentication;
A Web content information DB for storing Web service content data;
Authentication that generates an authentication ticket including a unique authentication ticket ID, authentication challenge information, and expiration date information of the authentication ticket, and generation time information of the authentication ticket associated with the authentication ticket, and stores it in the authentication ticket information DB A ticket generator,
An authentication ticket encoding unit that encodes the authentication ticket to generate image information of the authentication ticket;
A web service server communication unit that transmits and receives information to and from the display terminal via a network;
An authentication ticket verification unit that verifies the authenticity of the authentication response ticket obtained from the display terminal and having an electronic signature on the authentication ticket;
A Web content processing unit that acquires Web content from the Web content information DB and causes the Web service server communication unit to transmit the Web content,
The display terminal includes a display terminal communication unit that transmits and receives information to and from the Web service server via a network;
A web interpretation unit having a browser function for interpreting the web content;
A display unit for displaying the image information of the authentication ticket and the Web content;
A wireless receiver that transmits the authentication response ticket to the Web service server,
The portable terminal includes a user ID / secret key storage unit that stores the user ID and a secret key used for authentication in association with each other;
An image reading unit for reading image information of the authentication ticket displayed on the display terminal;
An authentication ticket decoding unit that acquires the authentication ticket by decoding the image information of the read authentication ticket;
The user ID and the signature time acquired from the user ID / private key storage unit are added to the authentication ticket, and the user ID / secret key storage unit adds the user ID and the signature time to the authentication ticket. A signature attaching unit that generates signature authentication ticket by adding signature information that is digitally signed using the acquired authentication private key;
A wireless transmission unit for transmitting the authentication response ticket to the display terminal,
The authentication ticket verification unit searches the user DB using a user ID included in the authentication response ticket as a key, verifies the electronic signature using a verification key associated with the user ID, If the verification is successful, the authentication ticket information DB is searched using the authentication ticket ID included in the authentication response ticket as a key, the authentication challenge information associated with the authentication ticket ID and the expiration date information of the authentication ticket are acquired, and the authentication challenge Web site login characterized in that it has means for judging that authentication is successful when the information is the same as the authentication challenge information included in the authentication response ticket and the current time is before the expiration date of the authentication ticket system. The web service server communication unit includes means for transmitting image information of the authentication ticket to the display terminal;
The display terminal communication unit has means for receiving image information of the authentication ticket from the Web service server,
7. The website login system according to claim 6, wherein the display unit includes means for displaying image information of the received authentication ticket on the web. The web service server communication unit includes means for transmitting image information of the authentication ticket to a television station system;
The display terminal communication unit includes means for receiving image information of the authentication ticket in conjunction with program information downloaded and broadcast from the television station system,
The Web site login system according to claim 6, wherein the display unit includes means for displaying image information of the received authentication ticket together with the program broadcast. The authentication ticket generation unit includes means for generating URL information of a jump destination associated with the authentication ticket and desired to be displayed after login and storing the URL information in the authentication ticket information DB,
The Web content processing unit includes means for acquiring jump destination URL information from the authentication ticket information DB, and acquiring Web content of the jump destination URL from the Web content information DB. The Web site login system according to any one of 1 to 8. The Web service server includes an authentication history DB that stores a user ID, an authentication ticket ID, an authentication count, and a final signature time associated with each other,
The Web service server communication unit stores the user ID and the authentication ticket ID included in the received authentication response ticket in the authentication history DB, and the user ID and the authentication ticket ID are already stored in the authentication history DB. The authentication count is updated and stored, and the final signature time is updated and stored in the signature time included in the received authentication response ticket.
The authentication ticket verification unit accesses the authentication history DB, includes a user ID included in the received authentication response ticket and an authentication count and a final signature time associated with the authentication ticket ID, and the number of certifications is defined. If the number of times does not exceed the number of times, and / or the user ID included in the received authentication response ticket and the number of times of authentication and the last signature time associated with the authentication ticket ID exist, the signature time included in the authentication response ticket 10. The website login system according to claim 6, further comprising means for determining that the authentication is successful when is after the final signature time.

Images