JP2002163234A - User authentication system and processing method therefor, and recording medium recorded with the program therefor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make an ID and a password common to each other between different service providing systems SS. SOLUTION: The service providing system SS transmits an authentication request of a user who is about to log in to a network banking system NT through a public network 20. The user inputs ID and the password to the network banking system NT, and transmits the authentication result from the network banking system NT to the service providing system SS through the public network 20. Since the authentication result includes information on whether the user is a legal user or not, the service providing system SS determines whether log-in is permitted or not according to the authentication result.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a user authentication system, a processing method therefor, and a recording medium on which a program for the user authentication system is recorded, and more particularly to a user authentication system for authenticating a user based on a request from another system. And a processing method thereof, and a recording medium on which a program for the processing is recorded.

[0002]

2. Description of the Related Art Today, various services are provided to users as customers using networks such as the Internet. For example, it is a service for answering a user's mortgage consultation or periodically transmitting specific information to the user. When a service is provided to a user using a network as described above, a service providing system that provides the service negotiates and holds an ID and a password for identifying the user for each user. Therefore, when logging in to the service providing system, the user needs to input an ID and a password determined for each service providing system that provides the service.

[0003]

However, there are cases where one user subscribes to a plurality of service providing systems. In such a case, the customer manages a different ID and password for each service providing system. There is a need. However, separately managing a plurality of different IDs and passwords is complicated for the user. Moreover, in recent years, not only service providing systems provided by different companies but also a single company may be provided with a plurality of service providing systems via a network. May be provided with an ID and a password separately.

Accordingly, the present invention has been made in view of the above-mentioned problems, and a user who has registered identification information such as an ID and a password in a user authentication system is not required to use a different service providing system. An object of the present invention is to provide a network service system capable of authenticating a user with identification information registered in an authentication system.

[0005]

In order to solve the above problems, a user authentication system according to the present invention comprises: identification information holding means for holding identification information for identifying a user;
A receiving unit that receives an authentication request of a certain user from another system via a network, an identification information inputting unit that causes the one user to input identification information, and an identification information input by the one user. Determining, based on the information and the identification information held in the identification information holding means, whether the one user is a legitimate user registered in the identification information holding means; Transmitting means for transmitting a result of the determination by the determining means to the another system via a network.

Further, a user authentication system according to the present invention receives user information holding means for holding IDs and passwords of a plurality of users and an authentication request for a certain user from another system via a network. Receiving means, allowing the one user to input an ID and password, user information input means, an ID and password input by the one user, and an ID and password held by the user information holding means Determining whether the one user is a legitimate user registered in the user information holding means based on And transmission means for transmitting the data via the transmission line.

A processing method of a user authentication system according to the present invention is a processing method of a user authentication system having identification information holding means for holding identification information for identifying a user. Receiving an authentication request of a certain user, receiving the identification information, causing the one user to input identification information, identifying information input by the one user, and holding the identification information. Based on the identification information held by the means,
Determining whether the one user is a legitimate user registered in the identification information holding means, and transmitting a determination result in the determination step to the another system via a network; And a transmitting step.

Further, a processing method of a user authentication system according to the present invention is a processing method of a user authentication system having user information holding means for holding IDs and passwords of a plurality of users. Receiving a request for authentication of a certain user through the receiving step; allowing the one user to input an ID and a password; a user information inputting step; an ID and a password input by the one user; Determining, based on the ID and password held in the user information holding means, whether the one user is a valid user registered in the user information holding means; Transmitting the result of the determination in the determining step to the another system via a network.

A recording medium according to the present invention is a recording medium on which a program for controlling a user authentication system having identification information holding means for holding identification information for identifying a user is recorded. Receives an authentication request of a certain user via a network from
A receiving step, an identification information input step of causing the one user to input identification information, and identification information input by the one user, and identification information held in the identification information holding means, Determining whether the one user is a legitimate user registered in the identification information holding unit, and transmitting a determination result in the determination step to the another system via a network; And a transmission step.

[0010] A recording medium according to the present invention is a recording medium in which a program for controlling a user authentication system having user information holding means for holding a plurality of user IDs and passwords is recorded. Receiving, via a network, an authentication request of a certain user; a receiving step; allowing the one user to input an ID and a password; a user information inputting step; A judging step of judging whether the one user is a legitimate user registered in the user information holding means based on a password, an ID and a password held in the user information holding means; Transmitting a result of the determination in the determining step to the another system via a network, Program comprising is characterized in that it is recorded.

[0011]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present embodiment is directed to a user authentication system for determining whether an ID and a password used when a user who is a customer logs in to a service providing system via a network are valid. Provided separately from the service providing system. The service providing system requested to log in by the user requests the user authentication system for the authentication, and receives the authentication result from the user authentication system. If the received authentication result indicates that the user is a valid user, the service providing system allows login. This eliminates the need for the service providing system to manage identification information such as an ID and a password for authenticating the user, and eliminates the need for the user to manage different identification information such as an ID and password for each service providing system. That is. Hereinafter, the present embodiment will be described in detail.

First, an overall configuration of a network service system according to an embodiment of the present invention will be described with reference to FIG. FIG. 1 is a block diagram showing the overall configuration of a network service system to which the present embodiment is applied.

In this embodiment, the network banking system NT provided by one financial institution also serves as a user authentication system, and the service providing system SS for making an authentication request to this user authentication system is also the same financial institution. It is provided in. The network banking system NT is a system for a user to make an account balance inquiry and fund transfer via the public network 20. The service providing system SS allows a user to consult a mortgage loan via the public network 20,
This is a system for consulting financial institutions for borrowing funds.

As shown in FIG. 1, a user who is a customer of a financial institution such as a bank operates a personal computer 12, a mobile phone 14, a television set 16 and the like to access the network banking NT and the service providing system SS. I do. The personal computer 12 is connected to a telephone line or the like via a modem or the like.
Connected to. And, through this provider 22,
It is connected to an external public network 20. The public network 20 is, for example, the Internet.

The mobile phone 14 is also connected to the public network 20 via the provider 24 by appropriately operating. In the case of the mobile phone 14, for example, one of the services provided by NTT DoCoMo, Inc.
I-mode (a registered trademark of NTT DoCoMo, Inc.) is connected to the public network 20. The television set 16 has a function of connecting to a telephone line or the like, and is connected to the public network 20 via the telephone line or the like via a provider 26.
In the present embodiment, user terminals capable of performing information processing such as the personal computer 12, the mobile phone 14, and the television set 16 are collectively referred to as an information processing terminal 10.

The financial institution is provided with a network banking system NT and a service providing system SS. In the network banking system NT, a network banking reception server 30 connected to the public network 20 is provided. Instructions related to various financial transactions such as account balance inquiry and fund transfer procedures are input to the network banking reception server 30 from the information processing terminals 10 of a plurality of users via the public network 20. Further, the network banking reception server 30 transmits various responses to the information processing terminal 10 of each user via the public network 20.

This network banking reception server 3
0 is connected to a network banking processing system 40, also located at the financial institution. As will be described later in detail, the network banking processing system 40 is provided with a customer information database 42. In addition, the network banking processing system 40 is a system in which a plurality of users log in and receive financial-related instructions such as a user's account balance inquiry and a fund transfer procedure. In the present embodiment, the system part that manages the login of the user is used as a user authentication system.

On the other hand, the service providing system SS is provided with a customer service reception server 50 connected to the public network 20. The customer service reception server 50 receives the service providing system S from the information processing terminals 10 of a plurality of users via the public network 20.
An instruction for a service provided by S is input. Further, the customer service reception server 50 transmits various responses to the information processing terminal 10 of each user via the public network 20.

This customer service reception server 50 is connected to a customer service processing system 60 also located at a financial institution. As will be described in detail later, the customer service processing system 60 is provided with a customer information database 62. Further, this customer service processing system 60
This is a system for performing processing for providing various information services by logging in from a plurality of users. In the present embodiment, the service providing system SS provides a service called a money plan support site.

In this embodiment, the network banking system NT is realized by two computers including the network banking reception server 30 and the network banking processing system 40, and the customer service reception server 50 and the customer service processing system 60 are realized.
Although the service providing system SS is realized by two computers consisting of the following, the present invention is not limited to this mode. For example, the network banking reception system 30
And the network banking processing system 40 may be integrated to realize the network banking system NT by one computer, or may be realized by being distributed to more computers. Similarly, the customer service reception server 50 and the customer service processing system 60 are integrated and the service providing system S
S may be realized, or may be realized by being distributed to more computers.

Further, the network banking system N
The division of various databases provided in the T and the service providing system SS is not limited to the above example. Further, the database provided in the network banking system NT and the service providing system SS may include other databases.

Next, a member registration process performed by the service providing system SS and the network banking system NT according to the present embodiment will be described with reference to FIG. This member registration process is a process when the user newly registers as a member on the money plan support site provided by the service providing system SS.

The member registration process shown in FIG. 2 is started when the user clicks the “site member registration” button B10 on the initial screen W10 of the service providing system SS shown in FIG.

As shown in FIG. 2, in the member registration process, the service providing system SS first displays the member registration screen W20 shown in FIG. 4 on the information processing terminal 10 of the user (step S10). As shown in FIG. 4, on the member registration screen W20, the merits of becoming a member and the membership rules are displayed. The member registration screen W20 includes an “integrated ID authentication” button B20 and a normal “registration” button.
Button B21 is provided.

A user who has registered in the network banking system NT has an "integrated ID authentication" button B20.
Click. On the other hand, a user who has not registered in the network banking system NT is in the field F20.
Enter the kanji name in the field, enter the kana name in the field F21, enter the date of birth in the field F22, enter the e-mail address in the field F23,
After inputting an address in 24, a "register" button B21 is clicked.

As shown in FIG. 2, when the "integrated ID authentication" button B20 is clicked (step S11: Ye
In s), an authentication request is sent from the service providing system SS.
The data is transmitted to the network banking system NT (step S12). This authentication request is transmitted from the service providing system SS to the network banking system NT via the public network 20 shown in FIG. In the present embodiment, accompanying this authentication request,
A redirect destination URL, which is a return destination after the completion of the authentication, and a request source URL that transmitted the authentication request are transmitted from the service providing system SS to the network banking system NT.

As shown in FIG. 2, the network banking system NT having received the authentication request determines whether or not the authentication request has been transmitted from the service providing system SS registered in advance in the user authentication system. A determination is made (step S13). In the present embodiment, the network banking system NT sends the authentication request source IP address (internet protocol addres
Using s), it is determined whether the service providing system SS that has transmitted the authentication request is registered in advance in the user authentication system. In addition, this judgment
The determination may be made based on the request source URL sent along with the authentication request.

If it is determined in step S13 that the received authentication request has been transmitted from the service providing system SS registered in advance in the user authentication system (step S13: Yes), the network banking system NT Is a user information processing terminal 10
Then, an ID password input screen W30 shown in FIG. 5 is displayed (step S14). This ID password input screen W
At 30, the user enters a network banking ID in field F30 and a login password in field F31.

These fields F30 and F
The network banking ID and the login password input to 31 are the ID and password used by the user in the network banking system NT.
After completing these inputs, the user can click the “Next” button B30.
Click.

Next, as shown in FIG. 2, the network banking system NT searches the network banking user table stored in the customer information database 42, and the network banking ID and the login password are transmitted to the network banking system NT. It is determined whether or not it matches the registered one (step S15).

FIG. 6 is a diagram showing a configuration of the network banking user table TB10 according to the present embodiment. As shown in FIG. 6, the network banking user table TB10 has store items C10,
Subject C11, account number C12, network banking ID C13, and login password C14,
Have. Store number C10, subject C11 and account number C12
Thus, the representative account registered in the network banking system NT by the user is specified. This representative account is the network banking system NT
Is a unique identification code, and one user can be specified using the representative account. The network banking ID C13 is an I that the user inputs when logging in to the network banking system NT.
D, and the login password C14 is also a password that the user inputs when logging in to the network banking system NT. In the network banking system NT according to the present embodiment, the network banking ID C13 and the login password C14 can be arbitrarily changed by the user.

In step S15 of FIG. 2, the network banking ID and the login password entered by the user are stored in the network banking user table TB.
If they do not match those registered in the service 10 (step S15: No), an authentication result indicating that the user is not a valid user is transmitted to the service providing system SS via the public network 20. In the service providing system SS, the processing from step S11 described above is repeated.

On the other hand, in step S15, the network banking ID and the login password input by the user are stored in the network banking user table TB.
10 matches the one registered in step 10 (step S
15: Yes), the network banking system NT searches the integrated ID information table stored in the customer information database 42, and obtains predetermined information on the user (Step S16).

FIG. 7 is a diagram showing the structure of the integrated ID information table TB20 according to the present embodiment. As shown in FIG. 7, the integrated ID information table TB20 includes items such as a store number C20, a subject C21, an account number C22,
Integrated ID C23, integrated ID cancellation date C24, kana name C25, kanji name C26, and e-mail address C
27 and a contract date C28.

In the integrated ID information table TB20, the network banking user table T
Similar to B10, store number C20, subject C21, and account number C
22, the user can be uniquely specified. Therefore, the network banking system NT
Is the store number C20, the subject C21, and the account number C of the user.
22, the personal information of the user is retrieved from the integrated ID information table TB20.

The integrated ID C23 is an integrated ID for specifying the user. The integrated ID C23 is systematically assigned by the network banking system NT, and is a once assigned integrated ID.
C23 remains unchanged thereafter. The network banking system NT notifies the service providing system SS of the integrated ID C23 together with the authentication result.

The integrated ID cancellation date C24 is an item set when the user cancels the user registration to the network banking system NT. Specifically, when the user cancels the user registration to the network banking system NT, the date of the cancellation is stored.
Therefore, the fact that the integrated ID cancellation date C24 is NULL indicates that the user has not been canceled and is still a valid integrated ID.

In the kana name C25, the name of the user is stored in kana. The kanji name C26 stores the user's name in kanji. The e-mail address C27 stores the e-mail address of the user. Contract date C2
8 stores the date when the user registered the network banking system NT.

What kind of personal information should be acquired in step S16 of FIG. 2 is determined in advance between the network banking system NT and the service providing system SS. Therefore, only the necessary personal information about the user is transferred to the network banking system NT.
Is obtained from the integrated ID information table TB20.

Next, the network banking system N
T transmits the integrated ID and the personal information obtained from the integrated ID information table TB20 to the service providing system SS via the public network 20 together with the authentication result (step S17). In the present embodiment, for example,
For the redirect destination URL specified with the authentication request, the authentication result indicating that the user is a valid user, the URL of the request source, the authentication date and time, the integrated ID, the kanji name, the kana name, and the electronic Send the e-mail address.

At the time of transmission, the transmission contents are encrypted and then transmitted to the service providing system SS. The transmission content is encrypted on the public network 20.
Personal information such as the integrated ID and kanji name is eavesdropped by a third party,
This is to prevent leakage. Further, in the present embodiment, the encryption key for decrypting the encryption is different for each service providing system SS. This is because even if there is a malicious third party who attempts to acquire personal information by spoofing the service providing system SS, the authentication result and the personal information cannot be understood by the spoofing system. .

The service providing system SS receiving this message
Displays a registration confirmation screen W40 shown in FIG. 8 on the information processing terminal 10 of the user (step S18). On the registration confirmation screen W40, the user clicks the "Yes" button B40 when registering as a member of the money plan support site, and the "No" button B41 when not registering.
Click.

When the "Yes" button B40 is clicked, the service providing system SS registers the user in the service system user table of the customer information database 62 (step S19). FIG. 9 is a diagram showing a configuration of the service system user table TB30 of the customer information database 62.

As shown in FIG. 9, the service system user table TB30 has an integrated ID C
30, a kanji name C31, a kana name C32, an e-mail address C33, a consultation content 1 C34, and an answer content 1 C35.

The integrated ID C30, the kanji name C31,
Kana name C32 and e-mail address C33
Information corresponding to these transmitted from the network banking system NT is stored. In the service providing system SS, the integrated ID C30 is a unique identification code for identifying a user.

The consultation content 1 C34 and the answer content 1 C35 include the service providing system S
In S, the contents of the mortgage consultation and the contents of the answer are stored.

Next, as shown in FIG. 2, the service providing system SS displays a thank-you screen W50 shown in FIG. 10 on the information processing terminal 10 of the user (step S2).
0). In this thank-you screen W50, when the user clicks the "go to site top screen" button B50, the service providing system SS displays the initial screen W shown in FIG.
10 is displayed on the information processing terminal 10 of the user. Thus, the process in the case where the member registration has been properly processed is completed.

On the other hand, when the network banking system NT determines in step S13 that the authentication request is not from the service providing system SS registered in advance (step S13: N
In o), the network banking system NT displays an error screen on the information processing terminal 10 of the user to notify that the error is present (Step S30). Then, the member registration process ends.

Further, in step S11 described above, that is, when it is determined that the “integrated ID authentication” button B20 has not been clicked on the member registration screen W20 of FIG. 4 (step S11: No), the service providing system SS Determines whether the normal "register" button B21 has been clicked (step S40).
If the “registration” button B21 has not been clicked (step S40: No), the processing from step S11 described above is repeated to wait.

When the "register" button B21 is clicked (step S40: Yes), the service providing system SS performs a normal user registration process (step S40).
41). Specifically, fields F20 to F24 in FIG.
, Input the kanji name, kana name, date of birth,
A new user is registered in the service system user table TB30 based on the e-mail address and the address.
Then, the member registration process ends.

Up to this point, the processing in the case where the user newly registers as a member in the service providing system SS has been described. Next, a user who has already registered in the service providing system SS logs in to the service providing system SS and logs in. ,
A process for receiving a mortgage consultation service will be described.

FIG. 11 is a flowchart illustrating a mortgage consultation process when a user receives a mortgage consultation in the service providing system SS.

When the user clicks the "consultation" button B11 on the initial screen W10 shown in FIG.
2 is displayed on the information processing terminal 10. This mortgage consultation initial screen W60
In, the user using the integrated ID clicks the “login” button B60, and the user not using the integrated ID clicks the “login” button B61. When the “login” button B60 is clicked among these buttons B60 and B61, the mortgage consultation processing shown in FIG. 11 is started.

As shown in FIG. 11, the service providing system SS sends the user's authentication request to the network banking system N via the public network 20.
T is transmitted to T (step S50). In the present embodiment, a redirect destination URL that is a return destination after the completion of the authentication and a request source URL that has transmitted the authentication request are transmitted from the service providing system SS to the network banking system NT accompanying the authentication request. .

The network banking system NT that has received the authentication request sends the authentication request to the service providing system SS registered in advance in the user authentication system.
It is determined whether or not the message is transmitted from (step S51). In the present embodiment, the service providing system SS to which the network banking system NT has transmitted the authentication request using the IP address (internet protocol address) of the authentication request source is registered in the user authentication system in advance. Determine if it is. Note that this determination may be made based on the request source URL sent along with the authentication request.

If it is determined in step S51 that the received authentication request is transmitted from the service providing system SS registered in the user authentication system in advance (step S51: Yes), the network banking system NT Is a user information processing terminal 10
Then, an ID password input screen W70 shown in FIG. 13 is displayed (step S52). On the ID password input screen W70, the user inputs a network banking ID in a field F70, and inputs a login password in a field F71.

These fields F70 and F
The network banking ID and the login password input to 71 are the ID and password used by the user in the network banking system NT.
After completing these inputs, the user can click the “Next” button B70.
Click.

Next, as shown in FIG. 11, the network banking system NT
Is searched in the network banking user table TB10 (see FIG. 6) stored in the network banking ID and the login password entered by the user.
It is determined whether it matches the one registered in the network banking system NT (step S5)
3).

In this step S52, the network banking ID and the login password entered by the user are stored in the network banking user table TB1.
If it does not match the one registered in “0” (step S53: No), an authentication result indicating that the user is not a valid user is transmitted to the service providing system SS via the public network 20 (step S54).

In the service providing system SS that has received the authentication result indicating that the user is not a valid user, an error screen is displayed on the information processing terminal 10 of the user (step S55). Then, the mortgage consultation process ends.

On the other hand, in step S53, the network banking ID and the login password entered by the user are stored in the network banking user table TB.
10 matches the one registered in step 10 (step S
53: Yes), the network banking system NT displays the integrated ID authentication completion screen W80 shown in FIG. 14 on the information processing terminal 10 of the user (step S5).
6). When the user clicks the “Next” button B80 on the integrated ID authentication completion screen W80, the network banking system NT searches the integrated ID information table TB20 (see FIG. 7), and checks the integrated ID C23 of the user. Is acquired (step S57).

In the present embodiment, step S
At 53, the network banking ID entered by the user
When the password and the login password match those registered in the network banking user table TB10, the integrated ID authentication completion screen W80 shown in FIG. 14 is displayed in step S56. The display of W80 may be omitted. That is,
In step S53, if the network banking ID and the login password input by the user match those registered in the network banking user table TB10, the process may directly proceed to step S57.

Next, the network banking system N
T sends the integrated ID to the service providing system SS via the public network 20 together with the authentication result indicating that the user is a valid user (step S58). In the present embodiment, for example, an authentication result indicating that the user is a valid user and an integrated ID are transmitted to the redirect destination URL. Further, at the time of transmission, the transmission content is encrypted and then transmitted to the service providing system SS. The transmission content is encrypted on the public network 20 using the integrated ID.
This is to prevent a third party from eavesdropping and leaking. Further, in the present embodiment, the encryption key for decrypting the encryption is different for each service providing system SS. This is so that even if there is a malicious third party who attempts to acquire the integrated ID by impersonating the service providing system SS, the integrated ID cannot be recognized by the impersonation system.

Note that personal information of a user other than the integrated ID may be obtained from the integrated ID information table TB20 and transmitted to the service providing system SS. In this case, step S17 in the above-described member registration process is performed.
Similarly to the above, the data may be transmitted after being encrypted.

The service providing system SS receiving this
Displays the consultation input screen W90 shown in FIG. 15 on the information processing terminal 10 of the user (step S59). On this consultation input screen W90, the user enters the field F90
Of the consultation, and the contents to be consulted are entered in the field F91. Then, the “send” button B90 is clicked.

Next, as shown in FIG. 11, the service providing system SS displays a consultation content confirmation screen W100 shown in FIG. 16 on the user's information processing terminal 10 (step S10).
60). On this consultation content confirmation screen W100, the user confirms the input content, and clicks a "correction" button B100 when he / she wants to make a correction, and clicks an "OK" button B101 when it is not necessary to make a correction. When the user clicks the “Modify” button B100,
It returns to the consultation content input screen W90 shown in FIG.

When the user clicks the "OK" button B101, as shown in FIG. 11, the service providing system SS displays a thank-you screen W110 shown in FIG. 17 on the information processing terminal 10 of the user (step S110). S6
1). Then, the mortgage consultation process ends.

On the other hand, when the network banking system NT determines in step S51 that the authentication request is not from the service providing system SS registered in advance (step S51: N
In o), the network banking system NT displays, on the information processing terminal 10 of the user, an error screen notifying that an error has occurred (step S70). Then, the mortgage consultation process ends.

As described above, according to the network service system according to the present embodiment, the user of the network banking system NT needs the network banking ID used in the network banking system NT.
By using the password and the login password, the user can log in to the service providing system SS, which is a system different from the network banking system NT.
For this reason, the user is released from the trouble of having to manage a plurality of IDs and passwords for each service providing system.

Since the management of the network banking ID and the login password is performed by the network banking system NT, the management of the ID and password in the service providing system SS can be omitted. Therefore, system management and user management of the service providing system SS are facilitated.

Further, even if the network banking ID and the login password are commonly used in this way, it is not necessary to use or hold a common file between the service providing system SS and the network banking system NT. For this reason, a network service system that uses an ID and a password in common can be easily constructed. In particular, although the ID and the password are commonly used, it is not necessary to share the file holding the ID and the password, so that the security level of the ID and the password can be extremely high.

Further, the network banking system NT according to the present embodiment is to notify only the authentication result and the integrated ID of the network banking ID and the login password input by the user without notifying the service providing system SS. And For this reason, it is possible to use the network banking system NT and the service providing system SS in common without lowering the security level of the network banking ID and the login password in the network banking system NT. That is, the network banking system NT does not disclose unnecessary user personal information, and
Only the authentication of the valid user of T can be returned to the service providing system SS.

In particular, in the network banking system NT, the network banking I of the user
For D and the login password, the user is forcibly and periodically changed by the user, or if the user makes a mistake several times in a row, the network banking ID is blocked for a certain period of time so that the user cannot use it. It has an extremely high security level. Since the ID and the password that secure the extremely high security level can be used for user authentication in another service providing system SS, the other service providing system SS
In this case, user management can be performed with a high security level.

In the above-described embodiment, when a new member is registered in the service providing system SS, the personal information of the user such as the kanji name and the kana name is also transmitted to the network banking together with the integrated ID assigned to the user. The transmission is performed from the system NT to the service providing system SS. Therefore, in the service providing system SS, it is not necessary for the user to newly input personal information such as a kanji name and a kana name. Moreover, since what kind of personal information is transmitted from the network banking system NT to the service providing system SS is determined in advance, the personal information can be managed with a high security level.

The present invention is not limited to the above embodiment, but can be variously modified. For example, in the above-described embodiment, the case where the service providing system SS and the network banking system NT are systems of the same financial institution has been described as an example, but these two systems are completely different companies' systems. It may be. In this case, the network banking system NT provides a user authentication service to another company as a user authentication system, and it is possible to obtain a price for the service.

Further, in step S17 of FIG. 2 in the above-described embodiment, the user information is transmitted from the network banking system NT to the service providing system SS together with the authentication result. However, in order to further increase the security level of the user's personal information, only the authentication result and the integrated ID may be transmitted.

Further, in the above-described embodiment, the case where the user authentication system is a system integrated with the network banking system NT has been described as an example, but the user authentication system is a system separate from the network banking system NT. You may prepare as.

In the above-described embodiment, the network banking ID and the login password are used as identification information for identifying one user from other users, but other information for identifying the user is used. It may be used as identification information.

Further, with respect to each process described in the above embodiment, a program for executing each process is stored in a floppy (registered trademark) disk, a CD-ROM (Co-ROM).
It can be recorded on a recording medium such as a mpact disc-read only memory (ROM), a ROM, or a memory card and distributed in the form of a recording medium. In this case, the above-described embodiment can be realized by causing a computer constituting the network banking system NT or the service providing system SS to read and execute the recording medium on which the program is recorded.

The network banking system N
The computer constituting the T or the service providing system SS may include another program such as an operating system or another application program. In this case, another program included in the computer constituting the network banking system NT or the service providing system SS is utilized, and the program for realizing the same processing as that of the present embodiment is selected from the programs included in the computer. You may record the command which calls.

Further, such a program can be distributed not as a recording medium but as a carrier through a network. The program transmitted in the form of a carrier wave on the network is taken into a computer constituting the network banking system NT or the service providing system SS, and the above-described embodiment can be realized by executing the program.

Further, when a program is recorded on a recording medium or transmitted as a carrier over a network, the program may be encrypted or compressed.
In this case, the computer constituting the network banking system NT or the service providing system SS that has read the program from the recording medium or the carrier wave needs to execute the program after decoding and decompressing the program.

[0083]

As described above, according to the user authentication system of the present invention, the identification information for identifying the user held in the user authentication system is used to respond to the authentication request from another system. Then, the determination result as to whether or not the user is a legitimate user is returned, so that the authentication of the user can be omitted in another system.

[Brief description of the drawings]

FIG. 1 is a diagram showing an overall configuration of a network service system to which the present invention is applied.

FIG. 2 is a flowchart illustrating a member registration process according to an embodiment of the present invention.

FIG. 3 is an exemplary view showing an example of an initial screen displayed on the information processing terminal of the user according to the embodiment.

FIG. 4 is a view showing an example of a member registration screen displayed on the information processing terminal of the user in the member registration process according to the embodiment.

FIG. 5 is a view showing an example of an ID password input screen displayed on the information processing terminal of the user in the member registration process according to the embodiment.

FIG. 6 is a view showing an example of the configuration of a network banking user table according to the embodiment;

FIG. 7 is a view showing an example of the configuration of an integrated ID information table according to the embodiment;

FIG. 8 is a view showing an example of a registration confirmation screen displayed on the information processing terminal of the user in the member registration process according to the embodiment.

FIG. 9 is a view showing an example of the configuration of a service system user table according to the embodiment.

FIG. 10 is a view showing an example of a thank-you screen displayed on the information processing terminal of the user in the member registration process according to the embodiment.

FIG. 11 is a flowchart illustrating a mortgage consultation process according to an embodiment of the present invention.

FIG. 12 is an exemplary view showing an example of a mortgage consultation initial screen displayed on the information processing terminal of the user according to the embodiment.

FIG. 13 is a view showing an example of an ID password input screen displayed on the information processing terminal of the user in the mortgage consultation process according to the embodiment.

FIG. 14 is a diagram showing an example of an integrated ID authentication completion screen displayed on the information processing terminal of the user in the mortgage consultation process according to the embodiment.

FIG. 15 is a view showing an example of a consultation input screen displayed on the information processing terminal of the user in the mortgage consultation processing according to the embodiment.

FIG. 16 is a diagram showing an example of a consultation content confirmation screen displayed on the information processing terminal of the user in the mortgage consultation process according to the embodiment.

FIG. 17 is an exemplary view showing an example of a thank-you screen displayed on the information processing terminal of the user in the mortgage consultation process according to the embodiment.

[Explanation of symbols]

 Reference Signs List 10 information processing terminal 12 personal computer 14 mobile phone 16 television set 20 public network 30 network banking reception server 40 network banking processing system 42 customer information database 50 customer service reception server 60 customer service processing system 62 customer information database NT network banking system SS service Provision system

Claims (9)

[Claims] 1. An identification information holding means for holding identification information for identifying a user; a receiving means for receiving an authentication request of a certain user from another system via a network; An identification information input unit for allowing a user to input identification information; and the first information based on the identification information input by the one user and the identification information held in the identification information holding unit.
Determining whether or not the user is a valid user registered in the identification information holding means; and transmitting the determination result of the determining means to the another system via a network. A user authentication system, comprising: 2. A user information holding unit that holds IDs and passwords of a plurality of users; a receiving unit that receives an authentication request of a certain user from another system via a network; To enter the ID and password,
The user is registered in the user information holding unit based on the user information input unit, the ID and password input by the one user, and the ID and password held in the user information holding unit. A user authentication system, comprising: a determination unit that determines whether or not the user is a valid user, and a transmission unit that transmits a determination result of the determination unit to the another system via a network. . 3. The transmitting means, together with the judgment result,
The user authentication system according to claim 2, wherein an integrated ID commonly assigned to each user with the another system is transmitted to the another system. 4. The user authentication system according to claim 1, wherein said user information holding means also holds personal information of each user. 5. When the authentication request is an authentication request for new registration of the one user, the transmitting unit sends the one of the user information held in the user information holding unit together with the determination result. The user authentication system according to claim 4, wherein predetermined personal information of the user's personal information is transmitted to the another system. 6. A processing method of a user authentication system having identification information holding means for holding identification information for identifying a user, wherein a request for authentication of a certain user is sent from another system via a network. Receiving, a receiving step, an identification information input step of causing the one user to input identification information, and an identification information input by the one user and identification information held in the identification information holding means. Based on said 1
Determining whether the user is a valid user registered in the identification information holding unit; and transmitting a determination result in the determining step to the another system via a network. A processing method for a user authentication system, comprising: 7. A processing method of a user authentication system having user information holding means for holding IDs and passwords of a plurality of users, comprising: receiving an authentication request of a certain user from another system via a network. Receiving, and causing the one user to input an ID and a password;
A user information inputting step, the one user is registered in the user information holding unit based on the ID and password input by the one user and the ID and password held in the user information holding unit. A user authentication system, comprising: a determination step of determining whether or not the user is a valid user, and a transmission step of transmitting a determination result in the determination step to the another system via a network. Processing method. 8. A recording medium on which a program for controlling a user authentication system having identification information holding means for holding identification information for identifying a user is recorded. Receiving an authentication request of a certain user, receiving the identification information, causing the one user to input identification information, identification information input by the one user, and the identification information holding means Based on the identification information held in
Determining whether or not the user is a valid user registered in the identification information holding unit; and transmitting the determination result in the determining step to the another system via a network. A recording medium characterized by recording a program comprising: 9. A user authentication system having user information holding means for holding IDs and passwords of a plurality of users,
A recording medium on which a program for controlling is recorded, wherein a receiving step of receiving an authentication request of a certain user from another system via a network; and transmitting an ID and a password to the one user Input,
A user information input step, the first user is registered in the user information holding unit based on the ID and password input by the one user, and the ID and password held in the user information holding unit. A determination step of determining whether or not the user is a valid user, and a transmission step of transmitting a determination result in the determination step to the another system via a network, wherein a program is recorded. Recording medium.