JP5078675B2

JP5078675B2 - Member authentication system and portable terminal device

Info

Publication number: JP5078675B2
Application number: JP2008051500A
Authority: JP
Inventors: 謙一斎藤
Original assignee: Mitsubishi Electric Corp
Current assignee: Mitsubishi Electric Corp
Priority date: 2008-03-03
Filing date: 2008-03-03
Publication date: 2012-11-21
Anticipated expiration: 2028-03-03
Also published as: JP2009212625A

Description

この発明は、会員の認証を行う会員認証システム及び携帯端末装置に関する。 The present invention relates to a member authentication system and a mobile terminal device for authenticating a member.

従来の技術（例えば特許文献１）では、移動体内に配置されている移動ネットワークから離れた場所に配置された第１認証サーバとは別に、第２認証サーバを移動ネットワーク内に配置して、第２認証サーバにおいても移動端末の認証が行えるようにしている。特に、移動体側の移動ネットワークと地上側の第１認証サーバとの間の接続が不可能となった場合に、第２認証サーバが、移動ネットワークへの参加を試みる移動端末の認証を行うとしている。 In the conventional technology (for example, Patent Document 1), a second authentication server is arranged in the mobile network separately from the first authentication server arranged in a place away from the mobile network arranged in the mobile body. 2 The authentication server can also be authenticated in the authentication server. In particular, when the connection between the mobile network on the mobile body and the first authentication server on the ground side becomes impossible, the second authentication server authenticates the mobile terminal attempting to join the mobile network. .

特許文献１では、第２認証サーバは第１認証サーバと同様の認証データを保持し、第１認証サーバと第２認証サーバ間の通信ができない場合に限り、第２認証サーバが保持する認証データを用いて認証を行うように構成されている。 In Patent Document 1, the second authentication server holds the same authentication data as the first authentication server, and the authentication data held by the second authentication server only when communication between the first authentication server and the second authentication server is not possible. It is comprised so that it may authenticate using.

しかし、特許文献１の場合は、第２認証サーバで移動端末の認証を行うためには、移動端末を認証するための情報が第１認証サーバに認証データとして登録されてから、移動端末が第２認証サーバに認証要求を送るまでの間に、第１認証サーバと第２認証サーバとの間で必ず通信を行うことができ、第２認証サーバが第１認証サーバの認証データを取得している必要がある。 However, in the case of Patent Document 1, in order to authenticate the mobile terminal with the second authentication server, the mobile terminal must be registered after the information for authenticating the mobile terminal is registered as authentication data in the first authentication server. 2 Before the authentication request is sent to the authentication server, the first authentication server and the second authentication server can always communicate, and the second authentication server acquires the authentication data of the first authentication server. Need to be.

つまり、移動端末を認証するための情報が第１認証サーバに認証データとして登録されてから、移動端末が第２認証サーバに認証要求を送るまでの間に、第１認証サーバと第２認証サーバとの間で通信を行うことができなかった場合は、第２認証サーバは認証情報を持っていないので、第２認証サーバは、移動端末の認証を行うことはできない。 That is, the first authentication server and the second authentication server after the information for authenticating the mobile terminal is registered as authentication data in the first authentication server and before the mobile terminal sends an authentication request to the second authentication server. If the second authentication server does not have the authentication information, the second authentication server cannot authenticate the mobile terminal.

また、仮に通信を行うことができた場合でも、通信回線の容量に対して、認証データのサイズが膨大だった場合には、認証要求までに認証データの取得が完了していないことも起こり得る。 Even if communication can be performed, if the size of the authentication data is enormous with respect to the capacity of the communication line, acquisition of the authentication data may not be completed by the authentication request. .

図７を用いて具体的に説明する。 This will be specifically described with reference to FIG.

通常、会員登録を受け付ける会員サーバは地上システムとして構成される。したがって、携帯電話を持つユーザは、この地上システムの会員サーバにアクセスし、会員登録を行う。 Normally, a member server that accepts member registration is configured as a ground system. Therefore, a user having a mobile phone accesses the member server of the ground system and performs member registration.

このユーザが、列車などに搭載されている車内システムの会員限定コンテンツにアクセスする場合、車内サーバ（第２認証サーバ）にアクセス要求を出す。一般的な構成では、車内サーバ（第２認証サーバ）は会員サーバ（第１認証サーバ）に問い合わせを行うが、列車は常時移動しているため、無線通信を行えない環境にいる可能性がある。 When this user accesses the member-only content of the in-vehicle system mounted on the train or the like, an access request is issued to the in-vehicle server (second authentication server). In a general configuration, the in-vehicle server (second authentication server) makes an inquiry to the member server (first authentication server). However, since the train is constantly moving, there is a possibility of being in an environment where wireless communication cannot be performed. .

そのような場合、ユーザは無線通信が行える環境に移動するまで、車内コンテンツにアクセスすることはできない。 In such a case, the user cannot access the in-vehicle content until moving to an environment where wireless communication is possible.

特許文献１では、認証データのコピーを車内システムにおくことにより、このような課題を解決しようとしている。 In patent document 1, it is going to solve such a subject by putting the copy of authentication data in a vehicle interior system.

しかし、現状、列車に搭載されている車内システムと地上システムの間は、ＤｏＰａ（登録商標）やデジタル無線、無線ＬＡＮ（ＬｏｃａｌＡｒｅａＮｅｔｗｏｒｋ）やミリ波などで接続されているが、ＤｏＰａ（登録商標）やデジタル無線はリアルタイム通信が可能であるものの、通信回線の容量はそれほど大きくない。また、運行制御に必要な情報が多く流れているため、このような用途に使える容量は非常に少ない。一方、無線ＬＡＮやミリ波は大容量であるが、駅などの限られたエリアにしか設置されていないため、リアルタイム通信は不可能である。 However, currently, the in-vehicle system mounted on the train and the ground system are connected by DoPa (registered trademark), digital wireless, wireless LAN (Local Area Network), millimeter wave, etc., but DoPa (registered trademark) ) And digital radio can perform real-time communication, but the capacity of the communication line is not so large. In addition, since a large amount of information necessary for operation control flows, there is very little capacity available for such use. On the other hand, wireless LANs and millimeter waves have large capacities, but real-time communication is impossible because they are installed only in limited areas such as stations.

さらに、鉄道会社がターゲットとしているユーザ数は非常に多く、認証データも膨大になることが想定される。 Furthermore, it is assumed that the number of users targeted by the railway company is very large, and the authentication data is enormous.

したがって、認証データを地上システム（第１認証サーバ）と車内システム（第２認証サーバ）の間で、リアルタイムに同期することは不可能である。
特開２００４−１２０６４５号公報、「端末認証システム及び端末認証方法及び端末認証サーバ」 Therefore, it is impossible to synchronize authentication data in real time between the ground system (first authentication server) and the in-vehicle system (second authentication server).
JP 2004-120645 A, “Terminal Authentication System, Terminal Authentication Method, and Terminal Authentication Server”

本発明は、上記のような課題を解決するためになされたもので、第１認証サーバと第２認証サーバの間で通信ができない場合でも、第２認証サーバで移動端末の認証を行うことを目的としている。 The present invention has been made in order to solve the above-described problems. Even when communication is not possible between the first authentication server and the second authentication server, the second authentication server authenticates the mobile terminal. It is aimed.

この発明の会員認証システムは、
会員の登録処理を行なう第１サーバ装置と、会員の認証処理を行なう第２サーバ装置と、前記第１サーバ装置及び前記第２サーバ装置と通信可能な携帯端末装置とを備えた会員認証システムにおいて、
前記携帯端末装置は、
前記第１サーバ装置及び第２サーバ装置と通信可能な携帯側通信部と、
携帯側情報管理部と、
携帯側情報格納部と
を備え、
第１サーバ装置は、
前記携帯側通信部と通信可能な第１側通信部と、
第１側会員登録部と、
会員データベースを格納している第１側会員データベース格納部と
を備え、
前記第２サーバ装置は、
前記携帯側通信部と通信可能な第２側通信部と、
第２側会員認証部と
を備え、
前記携帯端末装置の前記携帯側情報管理部は、
会員登録を要求する会員登録要求を生成し、生成した前記会員登録要求を前記携帯側通信部を介して前記第１サーバ装置に送信し、
前記第１サーバ装置の前記第１側会員登録部は、
前記携帯側通信部から送信された前記会員登録要求を前記第１側通信部を介して受信すると、認証処理に使用される特定の情報である会員情報を前記第２サーバ装置により復号可能に暗号化した暗号化会員情報を生成し、生成した前記暗号化会員情報を前記第１側通信部を介して前記携帯端末装置に送信すると共に前記会員情報を前記第１側会員データベース格納部の前記会員データベースに登録し、
前記携帯端末装置の前記携帯側情報管理部は、
前記第１側通信部から送信された前記暗号化会員情報を前記携帯側通信部を介して受信すると、受信した前記暗号化会員情報を前記携帯側情報格納部に格納すると共に、ユーザの所定の操作があると所定の認証情報と前記携帯側情報格納部に格納した前記暗号化会員情報とを含むと共に会員であるかどうかを認証する認証処理を要求する会員認証要求を生成し、生成した前記会員認証要求を前記携帯側通信部を介して前記第２サーバ装置に送信し、
第２サーバ装置の前記第２側会員認証部は、
前記携帯側通信部から送信された前記会員認証要求を前記第２側通信部を介して受信すると、前記会員認証要求に含まれる前記暗号化会員情報を前記会員情報に復号し、復号した前記会員情報を用いて前記会員認証要求に含まれる前記所定の認証情報を検証することを特徴とする。 The member authentication system of this invention is
In a member authentication system comprising: a first server device that performs member registration processing; a second server device that performs member authentication processing; and a portable terminal device capable of communicating with the first server device and the second server device. ,
The portable terminal device
A mobile communication unit capable of communicating with the first server device and the second server device;
A mobile information manager,
A portable information storage unit,
The first server device
A first communication unit capable of communicating with the portable communication unit;
A first-side member registration department;
A first-side member database storage unit storing a member database;
The second server device is
A second communication unit capable of communicating with the portable communication unit;
A second-side member authentication unit,
The portable information management unit of the portable terminal device is
Generating a member registration request for requesting member registration, and transmitting the generated member registration request to the first server device via the mobile communication unit;
The first-side member registration unit of the first server device is
When the member registration request transmitted from the mobile communication unit is received via the first communication unit, the member information, which is specific information used for the authentication process, is decrypted by the second server device. Encrypted member information is generated, the generated encrypted member information is transmitted to the portable terminal device via the first communication unit, and the member information is transmitted to the member of the first member database storage unit. Register in the database,
The portable information management unit of the portable terminal device is
When the encrypted member information transmitted from the first side communication unit is received via the portable side communication unit, the received encrypted member information is stored in the portable side information storage unit, and a predetermined user's predetermined When there is an operation, it generates a member authentication request that includes a predetermined authentication information and the encrypted member information stored in the portable information storage unit and requests an authentication process for authenticating whether or not the member is a member. A member authentication request is transmitted to the second server device via the mobile communication unit,
The second-side member authentication unit of the second server device is
When the member authentication request transmitted from the mobile communication unit is received via the second communication unit, the encrypted member information included in the member authentication request is decrypted into the member information, and the decrypted member The predetermined authentication information included in the member authentication request is verified using information.

本発により、第１認証サーバと第２認証サーバとの間で通信ができない場合でも、第２認証サーバで移動端末の認証を行うことができる。 Even if communication between the first authentication server and the second authentication server is not possible, the mobile terminal can be authenticated by the second authentication server.

実施の形態１．
図１は、コンピュータで実現される第１認証サーバ１００（第１サーバ装置）あるいは第２認証サーバ２００（第２サーバ装置）あるいは携帯端末３００（携帯端末装置）のハードウェア資源の一例を示す図である。これらはいずれもコンピュータであり、図１に示すような同様のハードウェア構成であるので、第１認証サーバ１００の場合を想定して説明するが、第１認証サーバ１００についての説明は、第２認証サーバ２００、携帯端末３００にも同様に当てはまる。 Embodiment 1 FIG.
FIG. 1 is a diagram illustrating an example of hardware resources of a first authentication server 100 (first server device), a second authentication server 200 (second server device), or a mobile terminal 300 (mobile terminal device) realized by a computer. It is. Since these are computers and have the same hardware configuration as shown in FIG. 1, description will be made assuming the case of the first authentication server 100. The same applies to the authentication server 200 and the portable terminal 300.

図１において、第１認証サーバ１００は、プログラムを実行するＣＰＵ８１０（ＣｅｎｔｒａｌＰｒｏｃｅｓｓｉｎｇＵｎｉｔ：中央処理装置、処理装置、演算装置、マイクロプロセッサ、マイクロコンピュータ、プロセッサともいう）を備えている。ＣＰＵ８１０は、バス８２５を介してＲＯＭ（ＲｅａｄＯｎｌｙＭｅｍｏｒｙ）８１１、ＲＡＭ（ＲａｎｄｏｍＡｃｃｅｓｓＭｅｍｏｒｙ）８１２、表示装置８１３、操作キー８１４、通信部８１６、磁気ディスク装置８２０と接続され、これらのハードウェアデバイスを制御する。磁気ディスク装置８２０の代わりに、光ディスク装置、フラッシュメモリなどの記憶装置でもよい。 In FIG. 1, the first authentication server 100 includes a CPU 810 (Central Processing Unit: also called a central processing unit, processing unit, arithmetic unit, microprocessor, microcomputer, processor) that executes a program. The CPU 810 is connected to a ROM (Read Only Memory) 811, a RAM (Random Access Memory) 812, a display device 813, operation keys 814, a communication unit 816, and a magnetic disk device 820 via a bus 825, and these hardware devices are connected. Control. Instead of the magnetic disk device 820, a storage device such as an optical disk device or a flash memory may be used.

ＲＡＭ８１２は、揮発性メモリの一例である。ＲＯＭ８１１、磁気ディスク装置８２０、フラッシュメモリ等の記憶媒体は、不揮発性メモリの一例である。これらは、記憶装置あるいは記憶部、格納部、バッファの一例である。通信８１６、操作キー８１４、ＦＤＤ８１７などは、入力部、入力装置の一例である。また、通信部８１６、表示装置８１３などは、出力部、出力装置の一例である。 The RAM 812 is an example of a volatile memory. Storage media such as the ROM 811, the magnetic disk device 820, and the flash memory are examples of nonvolatile memories. These are examples of a storage device or a storage unit, a storage unit, and a buffer. Communication 816, operation keys 814, FDD 817, and the like are examples of an input unit and an input device. The communication unit 816, the display device 813, and the like are examples of an output unit and an output device.

磁気ディスク装置８２０（あるいはフラッシュメモリ）には、オペレーティングシステム８２１（ＯＳ）、ウィンドウシステム８２２、プログラム群８２３、ファイル群８２４が記憶されている。プログラム群８２３のプログラムは、ＣＰＵ８１０、オペレーティングシステム８２１、ウィンドウシステム８２２により実行される。 The magnetic disk device 820 (or flash memory) stores an operating system 821 (OS), a window system 822, a program group 823, and a file group 824. The programs in the program group 823 are executed by the CPU 810, the operating system 821, and the window system 822.

上記プログラム群８２３には、以下に述べる実施の形態の説明において「〜部」として説明する機能を実行するプログラムが記憶されている。プログラムは、ＣＰＵ８１０により読み出され実行される。 The program group 823 stores a program that executes a function described as “˜unit” in the description of the embodiment described below. The program is read and executed by the CPU 810.

ファイル群８２４には、以下に述べる実施の形態の説明において、「会員データベース」、「アクセス履歴データベース」などとして説明する情報や、「〜の判定結果」、「〜の算出結果」、「〜の抽出結果」、「〜の生成結果」、「〜の処理結果」として説明する情報や、データや信号値や変数値やパラメータなどが、「〜ファイル」や「〜データベース」の各項目として記憶されている。「〜ファイル」や「〜データベース」は、ディスクやメモリなどの記録媒体に記憶される。ディスクやメモリなどの記憶媒体に記憶された情報やデータや信号値や変数値やパラメータは、読み書き回路を介してＣＰＵ８１０によりメインメモリやキャッシュメモリに読み出され、抽出・検索・参照・比較・演算・計算・処理・出力・印刷・表示などのＣＰＵの動作に用いられる。抽出・検索・参照・比較・演算・計算・処理・出力・印刷・表示のＣＰＵの動作の間、情報やデータや信号値や変数値やパラメータは、メインメモリやキャッシュメモリやバッファメモリに一時的に記憶される。 In the file group 824, information described as “member database”, “access history database”, etc., “determination result”, “calculation result”, “ Information described as “extraction results”, “generation results”, “processing results of”, data, signal values, variable values, parameters, etc. are stored as items of “˜file” and “˜database”. ing. The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 810 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. Used for CPU operations such as calculation, processing, output, printing, and display. Information, data, signal values, variable values, and parameters are temporarily stored in the main memory, cache memory, and buffer memory during the CPU operations of extraction, search, reference, comparison, operation, calculation, processing, output, printing, and display. Is remembered.

また、以下に述べる実施の形態の説明においては、データや信号値は、ＲＡＭ８１２のメモリ、磁気ディスク装置８２０の磁気ディスク、その他光ディスク、ミニディスク、ＤＶＤ（Ｄｉｇｉｔａｌ・Ｖｅｒｓａｔｉｌｅ・Ｄｉｓｋ）等の記録媒体に記録される。また、データや信号は、バス８２５や信号線やケーブルその他の伝送媒体によりオンライン伝送される。 In the description of the embodiment described below, data and signal values are stored on a recording medium such as a memory of the RAM 812, a magnetic disk of the magnetic disk device 820, another optical disk, a mini disk, a DVD (Digital Versatile Disk), or the like. To be recorded. Data and signals are transmitted on-line via the bus 825, signal lines, cables, and other transmission media.

また、以下に述べる実施の形態の説明において、「〜部」として説明するものは、「手段」、「〜回路」、「〜機器」であってもよく、また、「〜ステップ」、「〜手順」、「〜処理」であってもよい。すなわち、「〜部」として説明するものは、ＲＯＭ８１１に記憶されたファームウェアで実現されていても構わない。或いは、ソフトウェアのみ、或いは、素子・デバイス・基板・配線などのハードウェアのみ、或いは、ソフトウェアとハードウェアとの組み合わせ、さらには、ファームウェアとの組み合わせで実施されても構わない。ファームウェアとソフトウェアは、プログラムとして、磁気ディスク、フラッシュメモリ等の記録媒体に記憶される。プログラムはＣＰＵ８１０により読み出され、ＣＰＵ８１０により実行される。すなわち、プログラムは、以下に述べる「〜部」としてコンピュータを機能させるものである。あるいは、以下に述べる「〜部」の手順や方法をコンピュータに実行させるものである。 Further, in the description of the embodiments described below, what is described as “to part” may be “means”, “to circuit”, and “to device”, and “to step” and “to”. “Procedure” and “˜Process” may be used. That is, what is described as “˜unit” may be realized by firmware stored in the ROM 811. Alternatively, it may be implemented only by software, or only by hardware such as elements, devices, substrates, and wirings, by a combination of software and hardware, or by a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk or a flash memory. The program is read by the CPU 810 and executed by the CPU 810. That is, the program causes the computer to function as “to part” described below. Alternatively, the procedure or method of “to part” described below is executed by a computer.

図２に実施の形態１の会員認証システム１０００のシステム構成を示す。 FIG. 2 shows a system configuration of the member authentication system 1000 according to the first embodiment.

（システム構成）
本システムの最小構成は、第１認証サーバ１００と、第２認証サーバ２００と、携帯端末３００とからなる。さらに、本システムはコンテンツサーバ４００を備えてもよい。第１認証サーバ１００は通常地上に設置され、第２認証サーバ２００は通常列車などの移動体内に設置されることを想定する。また、携帯端末３００はユーザが携帯可能な端末装置であり、携帯電話、携帯情報端末、携帯ゲーム機などが想定される。 (System configuration)
The minimum configuration of this system includes a first authentication server 100, a second authentication server 200, and a mobile terminal 300. Further, the system may include a content server 400. It is assumed that the first authentication server 100 is usually installed on the ground and the second authentication server 200 is usually installed in a moving body such as a train. The mobile terminal 300 is a terminal device that can be carried by a user, and a mobile phone, a mobile information terminal, a mobile game machine, and the like are assumed.

（通信方式）
（１）第１認証サーバ１００と第２認証サーバ２００との間は、デジタル無線などの無線通信で接続されてもよいが、その回線はさほど太くなく、また、常時リアルタイム通信できるような状態ではないことを想定する。
（２）第１認証サーバ１００と携帯端末３００との間は、携帯電話のパケット網などの無線通信で接続される。
（３）第２認証サーバ２００と携帯端末３００との間は、無線ＬＡＮやＢｌｕｅｔｏｏｔｈ（登録商標）、赤外線通信、ＦｅｌｉＣａ（登録商標）などの近距離無線通信で接続される。 (Communication method)
(1) The first authentication server 100 and the second authentication server 200 may be connected by wireless communication such as digital wireless, but the line is not so thick and in a state where real-time communication is always possible. Assume no.
(2) The first authentication server 100 and the mobile terminal 300 are connected by wireless communication such as a mobile phone packet network.
(3) The second authentication server 200 and the mobile terminal 300 are connected by short-range wireless communication such as a wireless LAN, Bluetooth (registered trademark), infrared communication, or FeliCa (registered trademark).

（第１認証サーバ１００の構成）
第１認証サーバ１００は、第１側通信部１０１、第１側会員登録部１０２、第１側会員ＤＢ１０４を備える。会員データベースは、第１認証サーバ１００にのみ第１側会員ＤＢ（ＤａｔａＢａｓｅ：データベース）１０４として存在する。第１側会員ＤＢ１０４は、第１側会員ＤＢ格納部に格納されている。なお、以下の実施の形態における第１認証サーバ１００の動作は、第１側会員登録部１０２自身が行ない、あるいは、第１側会員登録部１０２が第１側通信部１０１等を用いて行うものである。 (Configuration of the first authentication server 100)
The first authentication server 100 includes a first side communication unit 101, a first side member registration unit 102, and a first side member DB 104. The member database exists as the first-side member DB (DataBase) 104 only in the first authentication server 100. The first side member DB 104 is stored in the first side member DB storage unit. The operation of the first authentication server 100 in the following embodiment is performed by the first side member registration unit 102 itself, or performed by the first side member registration unit 102 using the first side communication unit 101 or the like. It is.

（第２認証サーバ２００の構成）
第２認証サーバ２００は、第２側通信部２０１、第２側会員認証部２０２を備える。なお、以下の実施の形態における第２認証サーバ２００の動作は、第２側会員認証部２０２自身が行ない、あるいは、第２側会員認証部２０２が第２側通信部２０１等を用いて行うものである。 (Configuration of the second authentication server 200)
The second authentication server 200 includes a second side communication unit 201 and a second side member authentication unit 202. The operation of the second authentication server 200 in the following embodiment is performed by the second side member authentication unit 202 itself, or performed by the second side member authentication unit 202 using the second side communication unit 201 or the like. It is.

（携帯端末３００の構成）
また、携帯端末３００は、第１認証サーバ１００と通信するための携帯側第１通信部３０１、第２認証サーバ２００と通信するための携帯側第２通信部３０２、携帯側情報管理部３０３、携帯側情報格納部３０４を備える。なお、以下の実施の形態における携帯端末３００の動作は、携帯側情報管理部３０３自身が行ない、あるいは、携帯側情報管理部３０３が携帯側第１通信部３０１、携帯側第２通信部３０２、携帯側情報格納部３０４を用いて行うものである。 (Configuration of mobile terminal 300)
The portable terminal 300 includes a portable first communication unit 301 for communicating with the first authentication server 100, a portable second communication unit 302 for communicating with the second authentication server 200, a portable information management unit 303, A portable information storage unit 304 is provided. Note that the operation of the portable terminal 300 in the following embodiment is performed by the portable information management unit 303 itself, or the portable information management unit 303 performs the portable first communication unit 301, the portable second communication unit 302, This is performed using the portable information storage unit 304.

また、図２にはコンテンツサーバ４００を表している。コンテンツサーバ４００は、コンテンツ４０１、コンテンツ提供部４０２を備える。 FIG. 2 shows the content server 400. The content server 400 includes a content 401 and a content providing unit 402.

（暗号鍵）
第１認証サーバ１００は、第２認証サーバ２００で復号可能な形で情報を暗号化するための第１側暗号鍵１０３をもつ。また、第２認証サーバ２００は、第１認証サーバ１００で暗号化された情報を復号するための第２側復号鍵２０３をもつ。これは、一般に用いられている共通鍵のような仕組みで実現してもよい。 (Encryption key)
The first authentication server 100 has a first encryption key 103 for encrypting information in a form that can be decrypted by the second authentication server 200. Further, the second authentication server 200 has a second side decryption key 203 for decrypting the information encrypted by the first authentication server 100. This may be realized by a mechanism like a commonly used common key.

（会員登録の動作）
図３は、会員登録時の動作を示す図である。図３を参照して会員登録時の動作を説明する。 (Membership registration)
FIG. 3 is a diagram illustrating an operation at the time of member registration. The operation at the time of member registration will be described with reference to FIG.

（携帯端末３００の動作）
会員認証システム１０００に会員登録する場合、携帯端末３００は、第１認証サーバ１００に対し会員登録要求を送信する（ステップＳ１）。すなわち携帯端末３００の携帯側情報管理部３０３が「会員登録要求」を生成し、生成した「会員登録要求」を携帯側第１通信部３０１を介して第１認証サーバ１００に送信する。 (Operation of mobile terminal 300)
When registering as a member in the member authentication system 1000, the mobile terminal 300 transmits a member registration request to the first authentication server 100 (step S1). That is, the mobile information management unit 303 of the mobile terminal 300 generates a “member registration request” and transmits the generated “member registration request” to the first authentication server 100 via the mobile side first communication unit 301.

（第１認証サーバ１００の動作）
第１認証サーバ１００の第１側会員登録部１０２は、第１側通信部１０１を介して「会員登録要求」を受信すると、新規に「ユーザＩＤとパスワード」を発行するとともに（ステップＳ２）、「ユーザＩＤとパスワード」の正当性を検証するための検証用情報（特定の情報の一例）である「会員情報」を作成し（ステップＳ３）、この「会員情報」を第１側暗号鍵１０３で暗号化（ステップＳ４）して「暗号化会員情報」を生成する。そして、第２側会員認証部２０２は、「ユーザＩＤとパスワード」、及び「暗号化会員情報」を第１側会員ＤＢ１０４に登録するとともに（ステップＳ５）、第１側通信部１０１を介して、携帯端末３００に対し、「ユーザＩＤとパスワード」、及び「暗号化会員情報」を送信する（ステップＳ６）。なお、「ユーザＩＤとパスワード」との正当性を検証するための検証用情報（会員情報）としては、「ユーザＩＤとパスワード」とをそのままでもよいし、あるいはハッシュ関数を適用することにより生成される値などでもよい。 (Operation of the first authentication server 100)
When receiving the “member registration request” via the first communication unit 101, the first side member registration unit 102 of the first authentication server 100 issues a new “user ID and password” (step S2). “Member information” which is verification information (an example of specific information) for verifying the validity of “user ID and password” is created (step S3), and this “member information” is stored in the first encryption key 103. And encrypting (step S4) to generate “encrypted member information”. Then, the second-side member authentication unit 202 registers “user ID and password” and “encrypted member information” in the first-side member DB 104 (step S5), and via the first-side communication unit 101, “User ID and password” and “encrypted member information” are transmitted to the portable terminal 300 (step S6). As the verification information (member information) for verifying the validity of the “user ID and password”, the “user ID and password” may be used as they are, or generated by applying a hash function. It may be a value.

なお、「ユーザＩＤとパスワード」は、携帯端末３００のユーザに指定させ、携帯端末３００から送信してもよい。 The “user ID and password” may be specified by the user of the mobile terminal 300 and transmitted from the mobile terminal 300.

（携帯端末３００の動作）
携帯端末３００の携帯側情報管理部３０３は、携帯側第１通信部３０１を介して「ユーザＩＤとパスワード」及び「暗号化会員情報」を第１認証サーバ１００から受信する。携帯側情報管理部３０３は、受信した「ユーザＩＤとパスワード」をユーザに提示する（図示していない表示部に表示する）とともに、「暗号化会員情報」を携帯側情報格納部３０４に格納する。携帯側情報格納部３０４の具体例としては、アプリケーションに与えられたデータ保存領域やＦｅｌｉＣａ（登録商標）チップ内などが想定される。 (Operation of mobile terminal 300)
The mobile-side information management unit 303 of the mobile terminal 300 receives “user ID and password” and “encrypted member information” from the first authentication server 100 via the mobile-side first communication unit 301. The mobile-side information management unit 303 presents the received “user ID and password” to the user (displays on a display unit not shown) and stores “encrypted member information” in the mobile-side information storage unit 304. . As a specific example of the portable information storage unit 304, a data storage area given to an application, a FeliCa (registered trademark) chip, and the like are assumed.

（会員認証の動作）
図４は、会員認証時の動作を示す図である。図４を参照して会員認証時の動作を説明する。 (Member authentication operation)
FIG. 4 is a diagram illustrating an operation during member authentication. The operation at the time of member authentication will be described with reference to FIG.

（携帯端末３００の動作）
会員認証システム１０００を利用する場合、まず、ユーザから「ユーザＩＤとパスワード」（所定の認証情報の一例）が入力される（Ｓ１１）。そして、携帯端末３００の携帯側情報管理部３０３は、ユーザから入力される「ユーザＩＤとパスワード」（所定の認証情報の一例）と携帯側情報格納部３０４に格納されている「暗号化会員情報」とを含む「会員認証要求」を生成する（Ｓ１２）。そして、携帯側情報管理部３０３は、携帯側第２通信部３０２を介して、第２認証サーバ２００に「会員認証要求」を送信する（Ｓ１３）。この「会員認証要求」は、会員であるかどうかを認証する認証処理の要求である。 (Operation of mobile terminal 300)
When using the member authentication system 1000, first, the user inputs "user ID and password" (an example of predetermined authentication information) (S11). The mobile-side information management unit 303 of the mobile terminal 300 then receives “user ID and password” (an example of predetermined authentication information) input from the user and “encrypted member information” stored in the mobile-side information storage unit 304. "Member authentication request" including "is generated (S12). Then, the portable information management unit 303 transmits a “member authentication request” to the second authentication server 200 via the portable second communication unit 302 (S13). This “member authentication request” is a request for authentication processing for authenticating whether or not a member is a member.

（第２認証サーバ２００の動作）
第２認証サーバ２００は、会員情報を復号化できること、及び、暗号化会員情報を復号化して生成される「ユーザＩＤとパスワード」の正当性を検証するための検証用情報（会員情報）により、受信した「ユーザＩＤ、パスワード」が検証されることをもって、この携帯端末３００が会員であることを認証する。すなわち、第２側会員認証部２０２は、携帯側第２通信部３０２から送信された「会員認証要求」を第２側通信部２０１を介して受信し、受信した「会員認証要求」に含まれる「暗号化会員情報」を第１側暗号鍵１０３に対応する第２側復号鍵２０３によって復号し（Ｓ１４）、復号した「会員情報」を用いて「会員認証要求」に含まれる「ユーザＩＤとパスワード」（所定の認証情報）を検証する（Ｓ１５）。 (Operation of the second authentication server 200)
The second authentication server 200 can decrypt the member information and verify information (member information) for verifying the validity of the “user ID and password” generated by decrypting the encrypted member information. When the received “user ID, password” is verified, the mobile terminal 300 is authenticated as a member. That is, the second-side member authentication unit 202 receives the “member authentication request” transmitted from the mobile-side second communication unit 302 via the second-side communication unit 201 and is included in the received “member authentication request”. The “encrypted member information” is decrypted by the second side decryption key 203 corresponding to the first side encryption key 103 (S14), and the “user ID and the user ID” included in the “member authentication request” are used by using the decrypted “member information”. The “password” (predetermined authentication information) is verified (S15).

第２側会員認証部２０２は、第２側通信部２０１を介して、「会員認証結果」をコンテンツサーバ４００などに送信する（Ｓ１６）。コンテンツサーバ４００のコンテンツ提供部４０２は、この認証結果を利用して、コンテンツ４０１を携帯端末３００に提供するなどの、アクセス制限を行うことが可能となる（Ｓ１７）。 The second side member authentication unit 202 transmits a “member authentication result” to the content server 400 or the like via the second side communication unit 201 (S16). Using the authentication result, the content providing unit 402 of the content server 400 can perform access restriction such as providing the content 401 to the mobile terminal 300 (S17).

以上のような構成により、第２認証サーバ２００が第１認証サーバ１００のもつ第１側会員ＤＢ１０４と直接通信することができないような環境においても、会員限定サービス、例えば、会員限定コンテンツへのアクセスサービス、などを享受することが可能となる。 With the configuration described above, even in an environment where the second authentication server 200 cannot directly communicate with the first-side member DB 104 of the first authentication server 100, access to member-limited services such as member-limited content is possible. It is possible to enjoy services and the like.

実施の形態２．
図５を用いて、実施の形態２における会員認証システム１０００のシステム構成を説明する。図５に示すシステムの実施の形態１（図２）との違いは、図５の第１認証サーバ１００が図２で説明した第２側会員認証部２０２と同様の機能を持つ第１側会員認証部１０６を備え、また、図５の第２認証サーバ２００が図２で説明した第１側会員登録部１０２と同様の機能を持つ第２側会員登録部２０５を備えたところにある。 Embodiment 2. FIG.
The system configuration of the member authentication system 1000 according to the second embodiment will be described with reference to FIG. The first embodiment of the system shown in FIG. 5 is different from the first embodiment (FIG. 2) in that the first authentication member 100 in FIG. 5 has the same function as the second member authentication unit 202 described in FIG. The authentication unit 106 is provided, and the second authentication server 200 in FIG. 5 includes a second side member registration unit 205 having the same function as the first side member registration unit 102 described in FIG.

（暗号鍵／復号鍵）
さらに、第２認証サーバ２００は、第１認証サーバ１００で復号可能な形で情報を暗号化するための第２側暗号鍵２０４を持つ。また、第１認証サーバ１００は、第２認証サーバ２００で第２側暗号鍵２０４により暗号化された情報を復号するための第１側復号鍵１０５をもつ。これらは、一般に用いられている共通鍵のような仕組みで、実施の形態１で説明した暗号鍵、及び、復号鍵を兼ねてもよい。 (Encryption key / Decryption key)
Further, the second authentication server 200 has a second encryption key 204 for encrypting information in a form that can be decrypted by the first authentication server 100. The first authentication server 100 also has a first side decryption key 105 for decrypting information encrypted by the second authentication server 200 using the second side encryption key 204. These are mechanisms such as commonly used common keys, and may also serve as the encryption key and the decryption key described in the first embodiment.

（第２認証サーバ２００における会員登録の動作）
実施の形態２の会員認証システム１０００では、第２認証サーバ２００が第２側会員登録部２０５を備えたので、第２認証サーバ２００による会員登録処理が可能となる。この場合、第２認証サーバ２００における会員登録手順は、実施の形態１で説明した第１認証サーバ１００における会員登録手順と、ほぼ同様である。会員登録手順で違いのある点は、第２認証サーバ２００は会員データベースを備えていないため、会員登録処理において、会員データベースへの登録処理を行わないことである。 (Member Registration Operation in Second Authentication Server 200)
In the member authentication system 1000 according to the second embodiment, since the second authentication server 200 includes the second-side member registration unit 205, member registration processing by the second authentication server 200 is possible. In this case, the member registration procedure in the second authentication server 200 is substantially the same as the member registration procedure in the first authentication server 100 described in the first embodiment. The difference in the member registration procedure is that the second authentication server 200 does not include a member database, and therefore does not perform registration processing in the member database in the member registration processing.

（第１認証サーバ１００における会員認証の動作）
実施の形態２の会員認証システム１０００では、第１認証サーバ１００が第１側会員認証部１０６を備えたので、第１認証サーバ１００による会員認証処理が可能となる。この場合、第１認証サーバ１００における会員認証手順も、実施の形態１で説明した第２認証サーバ２００における会員認証手順とほぼ同様である。会員認証手順で違いのある点は、会員認証処理において、第１側会員認証部１０６は、第１側会員ＤＢ１０４との照合を行い、第１側会員ＤＢ１０４に登録されていない場合には、そのタイミングで第１側会員ＤＢ１０４への登録を行うことである。例えば、この場合の動作は次の様になる。
（１．携帯端末３００）
携帯側情報管理部３０３は、生成した「会員登録要求」を携帯側第２通信部３０２を介して第２認証サーバ２００に送信する。
（２．第２認証サーバ２００）
第２側会員登録部２０５は、携帯端末３００から送信された「会員登録要求」を第２側通信部２０１を介して受信すると共に、会員登録要求を受信すると第１認証サーバ１００の第１側会員認証部１０６による認証処理に使用される「ユーザＩＤ、パスワード」（特定の情報の一例）を第２側暗号鍵２０４により暗号化した暗号化会員情報を生成し、生成した暗号化会員情報を第２側通信部２０１を介して携帯端末３００に送信する。
（３．携帯端末３００）
携帯側情報管理部３０３は、第２側通信部２０１から送信された暗号化会員情報を携帯側第２通信部３０２を介して受信すると、受信した暗号化会員情報を携帯側情報格納部３０４に格納すると共に、ユーザから「ユーザＩＤ、パスワード」の入力（所定の操作）があると、「ユーザＩＤ、パスワード」と携帯側情報格納部３０４に格納した暗号化会員情報とを含むと共に会員であるかどうかを認証する認証処理を要求する会員認証要求を生成し、生成した会員認証要求を携帯側第１通信部３０１を介して第１認証サーバ１００に送信する。
（４．第１認証サーバ１００）
第１側会員認証部１０６は、携帯端末３００から送信された会員認証要求を第１側通信部１０１を介して受信し、受信した会員認証要求に含まれる暗号化会員情報を第１側復号鍵１０５を用いて復号し、復号した会員情報を用いて会員認証要求に含まれる「ユーザＩＤ、パスワード」を検証する。さらに第１側会員認証部１０６は、検証の結果、認証成立と判定したときは、この会員情報と同じデータが第１側会員ＤＢ１０４に既に登録されているかどうかを判定し、登録されていないと判定すると、この会員情報を第１側会員ＤＢ１０４に登録する。 (Operation of Member Authentication in the First Authentication Server 100)
In the member authentication system 1000 according to the second embodiment, since the first authentication server 100 includes the first-side member authentication unit 106, the member authentication process by the first authentication server 100 is possible. In this case, the member authentication procedure in the first authentication server 100 is substantially the same as the member authentication procedure in the second authentication server 200 described in the first embodiment. The difference in the member authentication procedure is that, in the member authentication process, the first side member authentication unit 106 collates with the first side member DB 104, and if it is not registered in the first side member DB 104, Registration to the first member DB 104 is performed at the timing. For example, the operation in this case is as follows.
(1. mobile terminal 300)
The portable information management unit 303 transmits the generated “member registration request” to the second authentication server 200 via the portable second communication unit 302.
(2. Second authentication server 200)
The second-side member registration unit 205 receives the “member registration request” transmitted from the mobile terminal 300 via the second-side communication unit 201, and receives the member registration request, the first side of the first authentication server 100 Encrypted member information is generated by encrypting “user ID, password” (an example of specific information) used for authentication processing by the member authenticating unit 106 with the second side encryption key 204, and the generated encrypted member information is The data is transmitted to the mobile terminal 300 via the second side communication unit 201.
(3. Mobile terminal 300)
When the mobile side information management unit 303 receives the encrypted member information transmitted from the second side communication unit 201 via the mobile side second communication unit 302, the mobile side information management unit 303 stores the received encrypted member information in the mobile side information storage unit 304. When the user inputs “user ID and password” (predetermined operation), the user includes “user ID and password” and the encrypted member information stored in the portable information storage unit 304 and is a member. A member authentication request for requesting an authentication process for authenticating whether or not is generated, and the generated member authentication request is transmitted to the first authentication server 100 via the portable first communication unit 301.
(4. First authentication server 100)
The first-side member authentication unit 106 receives the member authentication request transmitted from the mobile terminal 300 via the first-side communication unit 101, and the encrypted member information included in the received member authentication request is the first-side decryption key. Decrypt using 105, and verify the “user ID, password” included in the member authentication request using the decrypted member information. Further, when the first-side member authentication unit 106 determines that the authentication has been established as a result of the verification, the first-side member authentication unit 106 determines whether the same data as the member information has already been registered in the first-side member DB 104. If determined, this member information is registered in the first member DB 104.

（第２認証サーバ２００で登録処理した場合）
なお、第１認証サーバ１００と第２認証サーバ２００が接続可能な形態の場合には、第２認証サーバ２００における第２側会員登録部２０５による会員登録処理の際に、その「登録履歴」を記録しておき、接続可能なタイミングで、第２側会員登録部２０５は、第２側通信部２０１を介して、第１認証サーバ１００に記録した「登録履歴」を送信し、第１認証サーバ１００で第１側会員ＤＢ１０４に登録するようにしてもよい。動作は、例えば次の様である。
（１．第２認証サーバ２００）
第２認証サーバ２００の第２側会員登録部２０５は、生成した会員情報（検証用情報）を履歴として記憶し、この会員情報を第２側暗号鍵２０４で暗号化し、第２側通信部２０１を介して第１認証サーバ１００に送信する。
（２．第１認証サーバ１００）
第１認証サーバ１００の第１側会員認証部１０６は、第２認証サーバ２００から送信された暗号化会員情報を第１側通信部１０１を介して受信し、受信した暗号化会員情報を第１側復号鍵１０５で復号して第１側会員ＤＢ１０４に登録する。 (When the registration process is performed by the second authentication server 200)
In the case where the first authentication server 100 and the second authentication server 200 are connectable, the “registration history” is stored at the time of member registration processing by the second side member registration unit 205 in the second authentication server 200. The second-side member registration unit 205 transmits the “registration history” recorded in the first authentication server 100 via the second-side communication unit 201 at a timing that can be recorded and connected, and the first authentication server 100 may be registered in the first member DB 104. The operation is as follows, for example.
(1. Second authentication server 200)
The second-side member registration unit 205 of the second authentication server 200 stores the generated member information (verification information) as a history, encrypts this member information with the second-side encryption key 204, and the second-side communication unit 201. To the first authentication server 100.
(2. First authentication server 100)
The first side member authentication unit 106 of the first authentication server 100 receives the encrypted member information transmitted from the second authentication server 200 via the first side communication unit 101, and receives the received encrypted member information as the first. Decrypted with the side decryption key 105 and registered in the first side member DB 104.

以上のような構成により、第１側会員ＤＢ１０４と直接通信することができないような環境において、あらかじめ会員登録をしていない場合でも、会員限定サービス、例えば、会員限定コンテンツへのアクセスサービス、などを享受することが可能となる。 With the above configuration, in an environment where direct communication with the first-side member DB 104 is not possible, a member-limited service, for example, an access service to member-limited content, etc., even if membership registration is not performed in advance. It can be enjoyed.

実施の形態３．
実施の形態２において、「会員登録要求」の際に、携帯端末３００の個体を識別可能な端末識別情報、例えば、端末固有のＩＤなどをあわせて送信するようにする。 Embodiment 3 FIG.
In the second embodiment, at the time of “member registration request”, terminal identification information that can identify an individual mobile terminal 300, for example, an ID unique to the terminal is transmitted together.

例えば第１認証サーバ１００の第１側会員登録部１０２では、第１側会員ＤＢ１０４に登録の際には、会員情報と端末識別情報とを対応付けて登録する。第１側会員登録部１０２は、新たに「会員登録要求」を受信した場合は、受信した「会員登録要求」に含まれる端末識別情報を第１側会員ＤＢ１０４と照合し、重複していない場合にのみ会員登録を行う。 For example, the first-side member registration unit 102 of the first authentication server 100 registers member information and terminal identification information in association with each other when registering in the first-side member DB 104. When the first-side member registration unit 102 newly receives the “member registration request”, the first-side member registration unit 102 checks the terminal identification information included in the received “member registration request” with the first-side member DB 104 and does not overlap. Register as a member only.

処理内容は例えば次の様である。
（１．携帯端末３００）
携帯側情報管理部３０３は、自己である携帯端末装置の個体を識別可能な端末識別情報を会員登録要求に含めて会員登録要求を生成する。
（２．第１認証サーバ１００）
第１側会員登録部１０２は、端末識別情報を含む会員登録要求を第１側通信部１０１を介して受信すると、会員登録要求に含まれる端末識別情報に対応する会員情報が第１側会員ＤＢ１０４に登録されているかどうかを判定し、登録されていないと判定すると端末識別情報と会員情報とを対応付けて第１側会員ＤＢ１０４に登録する。 The processing content is as follows, for example.
(1. mobile terminal 300)
The mobile-side information management unit 303 generates a member registration request by including in the member registration request terminal identification information that can identify the individual mobile terminal device.
(2. First authentication server 100)
When the first side member registration unit 102 receives the member registration request including the terminal identification information via the first side communication unit 101, the member information corresponding to the terminal identification information included in the member registration request is the first side member DB 104. If it is determined that it is not registered, the terminal identification information and the member information are associated with each other and registered in the first member DB 104.

以上のような構成により、会員データベースと直接通信することができないような環境において、同じ携帯端末３００が重複して登録されることを防止することが可能となる。 With the configuration as described above, it is possible to prevent the same portable terminal 300 from being registered repeatedly in an environment where direct communication with the member database is not possible.

実施の形態４．
実施の形態４は、実施の形態２もしくは実施の形態３において、「会員認証」を行う際に、「アクセス履歴」を記録するようにする実施形態である。 Embodiment 4 FIG.
The fourth embodiment is an embodiment in which “access history” is recorded when “member authentication” is performed in the second or third embodiment.

第１認証サーバ１００は図６に示すように、アクセス履歴を記録するアクセス履歴データベース１０７を持つ。アクセス履歴データベース１０７は、格納部に格納されている。「アクセス履歴」は、第１認証サーバ１００のアクセス履歴データベース１０７に保存される。 As shown in FIG. 6, the first authentication server 100 has an access history database 107 that records an access history. The access history database 107 is stored in the storage unit. The “access history” is stored in the access history database 107 of the first authentication server 100.

（第１認証サーバ１００による会員認証の場合）
第１認証サーバ１００における会員認証手順にて、会員認証要求を受けた際、その会員認証要求に使われた情報（会員情報）、認証結果を時刻とともにアクセス履歴データベース１０７に記録する。
処理内容は例えば次の様である。
第１側会員認証部１０６は、携帯端末３００から会員認証要求を受信すると、受信した会員認証要求に含まれる暗号化会員情報を第１側復号鍵１０５で復号した会員情報と、認証結果とを含むアクセス履歴を生成し、このアクセス履歴をアクセス履歴データベース１０７に登録する。 (In the case of member authentication by the first authentication server 100)
When a member authentication request is received in the member authentication procedure in the first authentication server 100, the information used for the member authentication request (member information) and the authentication result are recorded in the access history database 107 together with the time.
The processing content is as follows, for example.
When receiving the member authentication request from the portable terminal 300, the first side member authentication unit 106 obtains the member information obtained by decrypting the encrypted member information included in the received member authentication request with the first side decryption key 105, and the authentication result. An access history including the access history is generated, and the access history is registered in the access history database 107.

（第２認証サーバ２００による会員認証の場合）
（１．第２認証サーバ２００）
第２認証サーバ２００における「会員認証手順」にて、会員認証要求を受けた際、第２側会員認証部２０２は、その会員認証要求に使われた情報（会員情報、「ユーザＩＤ及びパスワード」など）、認証結果を時刻とともに第２側暗号鍵２０４で暗号化した「暗号化アクセス履歴」を第２側通信部２０１を介して携帯端末３００に送信する。
（２．携帯端末３００）
携帯端末３００は携帯側第２通信部３０２を介して「暗号化アクセス履歴」を受信し、受信した情報（暗号化アクセス履歴）を会員情報とともに携帯側情報格納部３０４に保存する。そして、携帯側情報管理部３０３は、第１認証サーバ１００に「会員認証要求」を送る際に、「暗号化会員情報」とあわせて「暗号化アクセス履歴」送信する。
（３．第１認証サーバ１００）
第１認証サーバ１００は、受信した「会員認証要求」に「暗号化会員情報」とともに「暗号化アクセス履歴」が含まれる場合には、「暗号化アクセス履歴」を第１側復号鍵１０５で復号し、復号したアクセス履歴をアクセス履歴データベース１０７に登録する。 (In the case of member authentication by the second authentication server 200)
(1. Second authentication server 200)
When the member authentication request is received in the “member authentication procedure” in the second authentication server 200, the second side member authentication unit 202 receives the information (member information, “user ID and password”) used for the member authentication request. Etc.), the “encrypted access history” obtained by encrypting the authentication result together with the time with the second side encryption key 204 is transmitted to the portable terminal 300 via the second side communication unit 201.
(2. Mobile terminal 300)
The mobile terminal 300 receives the “encrypted access history” via the mobile side second communication unit 302 and stores the received information (encrypted access history) in the mobile side information storage unit 304 together with the member information. Then, when sending the “member authentication request” to the first authentication server 100, the portable information management unit 303 transmits “encrypted access history” together with “encrypted member information”.
(3. First authentication server 100)
When the received “member authentication request” includes “encrypted access history” together with “encrypted member information”, the first authentication server 100 decrypts the “encrypted access history” with the first side decryption key 105. Then, the decrypted access history is registered in the access history database 107.

なお、第１認証サーバ１００と第２認証サーバ２００とが接続可能な形態の場合には、
第２認証サーバ２００における「会員認証」の際に、その履歴を残しておき、接続可能なタイミングで第２認証サーバ２００から第１認証サーバ１００に前記の「暗号化アクセス履歴」送信し、第１認証サーバ１００側で復号してアクセス履歴データベース１０７に追記するようにしてもよい。 In the case where the first authentication server 100 and the second authentication server 200 are connectable,
At the time of “member authentication” in the second authentication server 200, the history is left, and the “encrypted access history” is transmitted from the second authentication server 200 to the first authentication server 100 at a connectable timing. One authentication server 100 may decrypt the data and add it to the access history database 107.

以上のような構成により、アクセス履歴データベースと直接通信することができないような環境においても、アクセス履歴を記録することが可能となる。 With the configuration described above, it is possible to record the access history even in an environment where direct communication with the access history database is not possible.

実施の形態５．
実施の形態５は、会員登録の際に生成される「会員情報」に、登録処理を行なったサーバの個体を識別可能な情報、例えば、サーバ固有のＩＤなどを含める実施形態である。 Embodiment 5 FIG.
In the fifth embodiment, the “member information” generated at the time of member registration includes information that can identify the individual server that has performed the registration process, such as a server-specific ID.

以上のような構成により、第１側会員ＤＢ１０４と直接通信することができないような環境において会員登録を行った際に、どのサーバで登録されたユーザかを識別することが可能となる。 With the configuration as described above, it is possible to identify which server is the registered user when member registration is performed in an environment where direct communication with the first-side member DB 104 is not possible.

実施の形態６．
実施の形態６は、会員登録の際に生成される「会員情報」に、ユーザ固有の情報、例えば、使用する言語、性別、年齢などを含める実施形態である。これらの情報は、「会員登録」の際にユーザに入力を求めることにより得る。 Embodiment 6 FIG.
In the sixth embodiment, user-specific information such as language used, gender, age, and the like is included in the “member information” generated at the time of member registration. These pieces of information are obtained by asking the user for input during “membership registration”.

コンテンツサーバ４００におけるコンテンツ提供部４０２は、これらの情報を利用して、ユーザに応じた情報提供サービス、例えば、使用する言語に応じた言語のコンテンツを提供する、などを行うことが可能となる。 The content providing unit 402 in the content server 400 can use these pieces of information to provide an information providing service according to the user, for example, provide content in a language corresponding to the language to be used.

以上のような構成により、会員データベースと直接通信することができないような環境において、ユーザに応じた情報提供サービスを行うことが可能となる。 With the configuration as described above, it is possible to provide an information providing service according to the user in an environment where direct communication with the member database is not possible.

以上の実施の形態では、以下の構成された会員認証システムを説明した。
（１）会員データベース、及び、第２認証サーバでのみ復号可能な形で暗号化された会員情報を生成する会員登録手段を備えた第１認証サーバ。
（２）会員登録の際に送信された会員情報を保存し、会員認証の際にその会員情報とユーザから入力されたユーザＩＤ、パスワードをあわせて送信する情報管理手段を備えた携帯端末。
（３）携帯端末から送信された会員情報を復号化し、あわせて送信されたユーザ名、パスワードを検証する会員認証手段を備えた第２認証サーバ。
（４）第１認証サーバと携帯端末は不安定な無線通信で接続される。
（５）第２認証サーバと携帯端末は近距離無線で接続される。 In the above embodiment, the following member authentication system was described.
(1) A first authentication server including a member database and member registration means for generating member information encrypted in a form that can be decrypted only by the second authentication server.
(2) A portable terminal provided with information management means for storing member information transmitted at the time of member registration and transmitting the member information together with the user ID and password input by the user at the time of member authentication.
(3) A second authentication server comprising member authentication means for decrypting member information transmitted from the mobile terminal and verifying the user name and password transmitted together.
(4) The first authentication server and the portable terminal are connected by unstable wireless communication.
(5) The second authentication server and the portable terminal are connected by short-range wireless.

以上の実施の形態では、会員認証システムにおいて以下の構成を追加したものを説明した。
（１）第２認証サーバに、第１認証サーバでのみ復号可能な形で暗号化された会員情報を生成する会員登録手段を備える。
（２）第１認証サーバに、携帯端末から送信された会員情報を復号化し、あわせて送信されたユーザ名、パスワードを検証し、会員登録されていない場合には追加する会員認証手段を備える。 In the above embodiment, the member authentication system with the following configuration added has been described.
(1) The second authentication server includes member registration means for generating member information encrypted in a form that can be decrypted only by the first authentication server.
(2) The first authentication server includes member authentication means for decrypting the member information transmitted from the portable terminal, verifying the user name and password transmitted together, and adding the member information if the member is not registered.

以上の実施の形態では、会員認証システムにおいて以下の構成を追加したものを説明した。
（１）第２認証サーバに、会員登録手段から会員登録履歴を受け取り、接続可能なタイミングで第１認証サーバに送信する会員情報送信手段を備える。
（２）第１認証サーバに、第２認証サーバから送られた会員登録履歴を会員データベースに登録する会員情報管理手段を備える。
（３）第１認証サーバと第２認証サーバは不安定な通信路で接続される。 In the above embodiment, the member authentication system with the following configuration added has been described.
(1) The second authentication server is provided with member information transmission means for receiving the member registration history from the member registration means and transmitting it to the first authentication server at a connectable timing.
(2) The first authentication server includes member information management means for registering the member registration history sent from the second authentication server in the member database.
(3) The first authentication server and the second authentication server are connected via an unstable communication path.

以上の実施の形態では、会員認証システムにおいて以下の構成を追加したものを説明した。
（１）携帯端末に、会員登録の際に端末の個体を識別可能な情報を合わせて送信する情報管理手段を備える。
（２）認証サーバに、端末の個体を識別可能な情報を会員データベースと照合し、重複していない場合にのみ会員登録を行うとともに、会員データベースの際に端末の個体を識別可能な情報をあわせて登録する会員登録手段を備える。 In the above embodiment, the member authentication system with the following configuration added has been described.
(1) The mobile terminal is provided with an information management means for transmitting information that can identify the individual terminal at the time of member registration.
(2) The information that can identify the individual of the terminal is collated with the member database in the authentication server, and the member registration is performed only when there is no duplication, and the information that can identify the individual of the terminal is added to the member database. Member registration means.

以上の実施の形態では、会員認証システムにおいて以下の構成を追加したものを説明した。
（１）第１認証サーバに、アクセス履歴データベースを備える。
（２）第１認証サーバに、会員認証要求を受けた際、その要求に使われた情報（会員情報）、認証結果を時刻とともにアクセス履歴データベースに記録し、会員情報とともにアクセス履歴が送られてきた場合には、復号鍵で復号し、アクセス履歴データベースに追記する会員認証手順を備える。
（３）第２認証サーバに、会員認証要求を受けた際、その要求に使われた情報、認証結果を時刻とともに暗号鍵で暗号化し、携帯端末に送信する会員認証手順を備える。
（４）携帯端末に、受け取った情報を会員情報とともに保存し、第１認証サーバに認証要求を送る際に、会員情報とあわせて送信する情報管理手段を備える。 In the above embodiment, the member authentication system with the following configuration added has been described.
(1) The first authentication server includes an access history database.
(2) When the first authentication server receives a member authentication request, the information (member information) used for the request and the authentication result are recorded in the access history database together with the time, and the access history is sent together with the member information. If there is a member authentication procedure, it is decrypted with a decryption key and added to the access history database.
(3) When a member authentication request is received by the second authentication server, a member authentication procedure for encrypting the information used in the request and the authentication result with an encryption key together with the time and transmitting it to the mobile terminal is provided.
(4) The mobile terminal includes information management means for storing the received information together with the member information and transmitting the information together with the member information when sending an authentication request to the first authentication server.

以上の実施の形態では、会員認証システムにおいて以下の構成を追加したものを説明した。
（１）第２認証サーバに、会員認証手段から会員認証履歴を受け取り、接続可能なタイミングで第１認証サーバに送信する認証情報送信手段を備える。
（２）第１認証サーバに、第２認証サーバから送られた会員認証履歴をアクセス履歴データベースに登録するアクセス履歴管理手段を備える。
（３）第１認証サーバと第２認証サーバは不安定な通信路で接続される。 In the above embodiment, the member authentication system with the following configuration added has been described.
(1) The second authentication server is provided with authentication information transmission means for receiving the member authentication history from the member authentication means and transmitting it to the first authentication server at a connectable timing.
(2) The first authentication server includes access history management means for registering the member authentication history sent from the second authentication server in the access history database.
(3) The first authentication server and the second authentication server are connected via an unstable communication path.

以上の実施の形態では、会員認証システムにおいて以下の構成を追加したものを説明した。
（１）認証サーバに、会員登録の際に生成される会員情報にサーバの個体を識別可能な情報、例えば、サーバ固有のＩＤなどを含める会員登録手段を備える。 In the above embodiment, the member authentication system with the following configuration added has been described.
(1) The authentication server includes a member registration unit that includes information that can identify an individual server, for example, an ID unique to the server, in the member information generated at the time of member registration.

以上の実施の形態では、会員認証システムにおいて以下の構成を追加したものを説明した。
（１）認証サーバに、会員登録の際に生成される会員情報に、ユーザ固有の情報を含める会員登録手段を備える。
（２）携帯電話に、会員登録要求の際にユーザ固有の情報をあわせて送る情報管理手段を備える。 In the above embodiment, the member authentication system with the following configuration added has been described.
(1) The authentication server includes member registration means for including user-specific information in the member information generated at the time of member registration.
(2) An information management means is provided for sending information specific to the user together with the mobile phone when a member registration request is made.

実施の形態１における第１認証サーバのハードウェア構成の例を示す図。FIG. 3 is a diagram illustrating an example of a hardware configuration of a first authentication server in the first embodiment. 実施の形態１における会員認証システム１０００の構成を示す図。1 is a diagram showing a configuration of a member authentication system 1000 according to Embodiment 1. FIG. 実施の形態１における会員認証システム１０００の会員登録時の動作を示す図。The figure which shows the operation | movement at the time of member registration of the member authentication system 1000 in Embodiment 1. FIG. 実施の形態１における会員認証システム１０００の会員認証時の動作を示す図。The figure which shows the operation | movement at the time of the member authentication of the member authentication system 1000 in Embodiment 1. FIG. 実施の形態２における会員認証システム１０００の構成を示す図。The figure which shows the structure of the member authentication system 1000 in Embodiment 2. FIG. 実施の形態４における会員認証システム１０００の構成を示す図。FIG. 10 shows a configuration of a member authentication system 1000 according to the fourth embodiment. 従来の技術を示す図。The figure which shows the prior art.

Explanation of symbols

１００第１認証サーバ、１０１第１側通信部、１０２第１側会員登録部、１０３第１側暗号鍵、１０４第１側会員ＤＢ、１０５第１側復号鍵、１０６第１側会員認証部、１０７アクセス履歴データベース、２００第２認証サーバ、２０１第２側通信部、２０２第２側会員認証部、２０３第２側復号鍵、２０４第２側暗号鍵、２０５第２側会員登録部、３００携帯端末、３０１携帯側第１通信部、３０２携帯側第２通信部、３０３携帯側情報管理部、３０４携帯側情報格納部、４００コンテンツサーバ、４０１コンテンツ、４０２コンテンツ提供部、１０００会員認証システム。 100 first authentication server, 101 first side communication unit, 102 first side member registration unit, 103 first side encryption key, 104 first side member DB, 105 first side decryption key, 106 first side member authentication unit, 107 access history database, 200 second authentication server, 201 second side communication unit, 202 second side member authentication unit, 203 second side decryption key, 204 second side encryption key, 205 second side member registration unit, 300 mobile phone Terminal, 301 Mobile side first communication unit, 302 Mobile side second communication unit, 303 Mobile side information management unit, 304 Mobile side information storage unit, 400 content server, 401 content, 402 content provision unit, 1000 Member authentication system.

Claims

In a member authentication system comprising: a first server device that performs member registration processing; a second server device that performs member authentication processing; and a portable terminal device capable of communicating with the first server device and the second server device. ,
The portable terminal device
A mobile communication unit capable of communicating with the first server device and the second server device;
A mobile information manager,
A portable information storage unit,
The first server device
A first communication unit capable of communicating with the portable communication unit;
A first-side member registration department;
A first-side member database storage unit storing a member database;
The second server device is
A second communication unit capable of communicating with the portable communication unit;
A second-side member authentication unit,
The portable information management unit of the portable terminal device is
Generating a member registration request for requesting member registration, and transmitting the generated member registration request to the first server device via the mobile communication unit;
The first-side member registration unit of the first server device is
When the member registration request transmitted from the mobile communication unit is received via the first communication unit, the member information, which is specific information used for the authentication process, is decrypted by the second server device. Encrypted member information is generated, the generated encrypted member information is transmitted to the portable terminal device via the first communication unit, and the member information is transmitted to the member of the first member database storage unit. Register in the database,
The portable information management unit of the portable terminal device is
When the encrypted member information transmitted from the first side communication unit is received via the portable side communication unit, the received encrypted member information is stored in the portable side information storage unit, and a predetermined user's predetermined When there is an operation, it generates a member authentication request that includes a predetermined authentication information and the encrypted member information stored in the portable information storage unit and requests an authentication process for authenticating whether or not the member is a member. A member authentication request is transmitted to the second server device via the mobile communication unit,
The second-side member authentication unit of the second server device is
When the member authentication request transmitted from the mobile communication unit is received via the second communication unit, the encrypted member information included in the member authentication request is decrypted into the member information, and the decrypted member A member authentication system characterized by verifying the predetermined authentication information included in the member authentication request using information.

The portable information management unit of the portable terminal device is
The generated member registration request is transmitted to the second server device via the mobile communication unit,
The second server device further includes:
The member registration request transmitted from the mobile communication unit is received via the second communication unit, and when the member registration request is received, the member information is encrypted by the first server device so that it can be decrypted. A second-side member registration unit that generates the second-side encrypted member information and transmits the generated second-side encrypted member information to the portable terminal device via the second-side communication unit;
The portable information management unit of the portable terminal device is
When the second side encrypted member information transmitted from the second side communication unit is received via the portable side communication unit, the received second side encrypted member information is stored in the portable side information storage unit. In addition, when there is a predetermined operation of the user, the member that includes the predetermined authentication information and the second-side encrypted member information stored in the portable information storage unit and requests an authentication process for authenticating whether the user is a member Generate an authentication request, send the generated member authentication request to the first server device via the mobile communication unit,
The first server device further includes
The member authentication request transmitted from the mobile communication unit is received via the first communication unit, and the second encrypted member information included in the received member authentication request is decrypted into the member information. The member authentication system according to claim 1, further comprising a first-side member authentication unit that verifies the predetermined authentication information included in the member authentication request using the decrypted member information.

The first side communication unit and the second side communication unit are:
Can communicate with each other,
The second member registration section
Storing the generated second-side encrypted member information, and transmitting the stored second-side encrypted member information to the first server device via the second-side communication unit;
The first-side member authentication unit
The second side encrypted member information transmitted from the second side communication unit is received via the first side communication unit, and the received second side encrypted member information is decrypted into member information to obtain the member 3. The member authentication system according to claim 2, wherein the member authentication system is registered in a database.

The portable information management unit
Including the terminal identification information that can identify the individual mobile terminal device in the member registration request, and generating the member registration request;
The first-side member registration unit
When the member registration request including the terminal identification information is received via the first communication unit, it is determined whether the member information corresponding to the terminal identification information included in the member registration request is registered, The member authentication system according to claim 1, wherein if it is determined that the terminal is not registered, the terminal identification information and the member information are associated and registered in the member database.

The first server device further includes:
An access history beta base storage unit for storing an access history database is provided.
The first-side member authentication unit
When the member authentication request is received from the mobile communication unit, an access history including the member information acquired from the received member authentication request and an authentication result is generated, and the generated access history is stored in the access history database. 5. The member authentication system according to claim 2, wherein registration is performed.

The second-side member authentication unit
When the member authentication request is received from the mobile communication unit via the second communication unit, an access history including the member information acquired from the received member authentication request and an authentication result is generated and generated. The access history is encrypted so that it can be decrypted by the first server device, and the encrypted encrypted access history is transmitted to the mobile terminal device via the second-side communication unit,
The portable information management unit
The encrypted access history is received via the portable communication unit, the received encrypted access history is stored in the portable information storage unit, and the first server device is connected via the portable communication unit. When transmitting the member authentication request, send the encrypted access history included in the member authentication request,
The first-side member authentication unit
When the member authentication request including the encrypted access history is received via the first side communication unit, the encrypted access history is decrypted, and the decrypted access history is registered in the access history database. The member authentication system according to claim 5.

The first side communication unit and the second side communication unit are:
Can communicate with each other,
The second-side member authentication unit
Transmitting the encrypted access history to the first server device via the second-side communication unit;
The first-side member authentication unit
7. The encrypted access history is received via the first communication unit, the received encrypted access history is decrypted, and the decrypted access history is registered in the access history database. Member authentication system.

The member information is
8. The member authentication system according to claim 1, further comprising server identification information for identifying the server device that created the member information.

The member information is
9. The member authentication system according to claim 1, further comprising user information indicating information about the user.

In a mobile terminal device communicating with a server device,
A mobile information management unit that generates a member registration request for requesting a member registration;
When the member registration request is received, encrypted member information obtained by encrypting the member information, which is specific information used in the authentication process, is decrypted by the second server device, and the generated encrypted member information is returned. A portable communication unit that transmits the member registration request generated by the portable information management unit to the first server device and receives the encrypted member information from the first server device;
A portable information storage unit that stores the encrypted member information received by the portable communication unit;
The portable information management unit
When a user's predetermined operation is performed, a member authentication request is generated that includes predetermined authentication information and the encrypted member information stored in the portable information storage unit and requests an authentication process for authenticating whether the user is a member. And
The mobile communication unit is
When the member authentication request is received, the encrypted member information included in the member authentication request is decrypted into the member information, and the predetermined authentication information included in the member authentication request is verified using the decrypted member information. The mobile terminal device, wherein the member authentication request generated by the mobile information management unit is transmitted to the second server device.