JP2008152666A - Authentication system, authentication control program, and authentication control method - Google Patents

Abstract

Authentication is simplified when a plurality of information devices access a network service site on a network.
In an authentication system for performing authentication in order to determine whether or not an information device connected to a communication network can use a network service, a parent-child relationship storage unit that stores parent-child relationship information between information devices, and an information device If the authentication is successful, the information device set in the parent-child relationship storage means as the child having the information device as a parent takes over the authentication state of the parent information device, and the child information device is authenticated. The authentication control means permits the use of the network service of the child information device without performing the operation.
[Selection] Figure 1

Description

  The present invention relates to authentication for determining whether or not an information device having a network access function can use a network service by accessing the network service site, and in particular, a plurality of information devices are connected to the network service site. The present invention relates to a technique for simplifying user authentication for access.

  An increasing number of information home appliances have a function to access networks such as the Internet. For example, when an information home appliance that acquires video such as a video camera connects to the Internet, the video is stored using a storage service provided on the Internet, and the stored video is used by another information home appliance. And the convenience of information home appliances is improved.

  In network services such as the above-described storage service, services are generally provided based on user accounts registered in advance, so user authentication by entering a password or the like is required when using the services. In addition, when it is necessary to check whether the accessed information home appliance is a legitimate information home appliance, device authentication processing is also required.

There is a technique described in Patent Document 1 as a conventional technique related to authentication processing of information home appliances and the like. In the technique described in Patent Document 1, device authentication information is incorporated in an information device in a safe manner, the authentication system performs device authentication using device authentication information sent from the information device, and the user has a short number. The user authentication is performed by the authentication system by inputting the password into the information device.
JP 2004-355396 A JP-A-2005-122651

  As information appliance devices are connected to the Internet and receive network services, the number of devices accessing the Internet during the same time period will increase. For example, when using the storage service provided on the Internet as an album or library of videos shot with a video camera, upload the uploaded video while uploading the shot video from the video camera to the storage service site. A case of viewing on TV can be considered. In addition, when using the above storage service to save the video recorded by the HDD recorder, it may be possible to upload the video recorded on the HDD recorder and download other video content saved in the past and view it on the TV. .

  In this way, when connecting a plurality of information home appliances to the Internet at the same time and accessing a network service site, it is cumbersome to perform user authentication for each information home appliance by entering a password. Impairs convenience.

  In addition, not all information home appliances have a user interface such as a simple remote controller for password entry, and some devices may require complicated operations for password entry. Furthermore, user convenience is impaired.

  Furthermore, in order to maintain high security on the service provider side, there may be cases where authentication such as IC card authentication or biometric authentication is required for user authentication, but information home appliances that have such authentication means are limited. In some cases, the information home appliance that the user wants to use cannot use this service.

  When using multiple user terminals, when switching from one user terminal that has established a session with the communication destination terminal to another user terminal, the session is continued on the other user terminal by copying the session information. There is a method (for example, Patent Document 2), and it is conceivable to apply this method to Internet access of a plurality of information home appliances. However, all information home appliances must have a special function corresponding to the above method. It is not realistic from the viewpoint of increase in apparatus cost, feasibility, and the like.

  The above problem is not limited to information home appliances but also applies to general information devices such as PCs.

  The present invention has been made in view of the above points, and an object thereof is to provide a technique for simplifying authentication when a plurality of information devices access a network service site on a network.

  The above-described problem is an authentication system that performs authentication to determine whether or not a network service of an information device connected to a communication network can be used, and includes a parent-child relationship storage unit that stores parent-child relationship information between information devices, and certain information When the authentication of the device is successful, the information device set in the parent-child relationship storage means as the child having the information device as a parent takes over the authentication state of the parent information device, and the child information device This is solved by an authentication system comprising authentication control means for permitting the use of the network service of the child information device without performing the authentication.

  In addition, the authentication system further includes an authentication state storage unit that records an authentication state of the information device, and the authentication control unit includes the authentication state storage unit when the authentication of the parent information device is successful. When the authentication state of the parent information device is authenticated, and the child information device accesses the authentication system, the parent information that becomes the parent of the child information device is referred to by referring to the parent-child relationship information The use of the network service of the child information device may be permitted by grasping the device and confirming that the authentication state in the authentication state storage unit of the parent information device has been authenticated.

  In addition, when the authentication of the parent information device is successful, the authentication control unit sets the authentication state of the parent information device in the authentication state storage unit as authenticated and refers to the parent-child relationship information. To grasp the child information device that is a child of the parent information device, record information indicating that the child information device is authenticated as the authentication state of the child information device in the authentication state storage means, When an information device accesses the authentication system, the use of the network service of the child information device may be permitted by checking the authentication state of the child information device in the authentication state storage unit.

  According to the present invention, when the authentication for a certain information device is successful, the authentication state for the parent information device is taken over by the information device set as a child whose parent is the information device, and the child information device is Since the use of the network service of the child information device is permitted without performing authentication, it is possible to simplify the authentication when a plurality of information devices access the network service site on the network. .

  Embodiments of the present invention will be described below with reference to the drawings.

(System configuration and operation overview)
FIG. 1 shows a system configuration in the embodiment of the present invention. As shown in FIG. 1, the system in the present embodiment is configured by connecting a plurality of information home appliances 1, an authentication system 3, and a service providing system 5 to a communication network 7.

  Each information home appliance 1 has at least a network communication function and an automatic device authentication function, and the plurality of information home appliances shown in FIG. 1 is provided in a certain home, for example. The authentication system 3 has a device authentication function for authenticating the information home appliance 1, a user authentication function by password check or the like, and an authentication database that stores setting information and status information related to authentication.

  Further, the service providing system 5 has a function of providing a network service to information home appliances that have succeeded in device authentication and user authentication by the authentication system 3. The network service refers to all services provided via the network. The service providing system 5 includes a subscriber management database for user account management and billing, an information home appliance service provision condition database storing service provision conditions for each information home appliance. Note that the authentication system 3 or the service providing system 5 may have a single sign-on function, and the services of a plurality of service providing systems can be used with a single authentication.

  The communication network 7 includes, for example, the Internet and a network for connecting each device to the Internet.

  When the information home appliance 1 uses a network service, since it is common for a user to access a site (such as a Web site) that provides the network service, the authentication system 3 and the service providing system 5 Are collectively referred to as a network service site. In addition, when the user performs an operation to access the network service site, the authentication system is not actually accessed first, but may be the service providing system 5 or a device (not shown). The information home appliance 1 is redirected to the authentication system 3 from the first accessed device. However, in the following description, it is assumed that the network service site is the authentication system 3.

  In the present embodiment, when a user uses a network service provided by the service providing system 5 with a plurality of information home appliances in the home, a password is input on one information home appliance among the plurality of information home appliances. If user authentication is performed and the user authentication is successful, the user authentication result is taken over by another information home appliance linked to the information home appliance, and the user performs an operation for user authentication in the other information home appliance. The network service can be used with a user account that has succeeded in user authentication first. Hereinafter, the fact that the user authentication of another information home appliance can be omitted by the user authentication of one information home appliance will be referred to as authentication cooperation. In addition, there is a direction in the cooperation of authentication, and when the user authentication of a certain information home appliance is executed, if the user authentication of another information home appliance is omitted, the former information home appliance is called a parent. The latter information home appliance is called a child. Which set of information home appliances is subject to authentication cooperation is registered in the authentication database of the authentication system 3 in advance.

(Authentication processing sequence)
The authentication processing sequence in the system shown in FIG. 1 will be described with reference to FIG. FIG. 2 shows an operation sequence of the system, and details of the authentication database and details of the processing operation of the authentication system 3 will be described later.

  The sequence shown in FIG. 2 authenticates an information home appliance (noted as a home information appliance (parent)) that does not have a parent home information appliance in a state that allows user authentication to be omitted in order to use the network service. The system 3 is accessed and authenticated, and then the home information appliance (parent) child information home appliance (referred to as information home appliance (child)) accesses the authentication system 3 to use the network service. An example of doing this is shown.

As a device authentication method here, a client authentication method in SSL / TLS is used. That is, the information home appliance previously acquires and holds its own digital certificate in a secure manner, and transmits the digital certificate to the authentication system 3 to thereby authenticate the authentication system 3.
Certifies information home appliances. The device authentication method is not limited to the SSL / TLS client authentication method, and other authentication methods may be used as long as the required authentication strength can be ensured.

  In FIG. 2, first, the information home appliance (parent) accesses the authentication system 3 when the user performs an operation for accessing the network service site using the information home appliance (parent) (step 1). The authentication system 3 that has received access from the information home appliance (parent) performs device authentication and sets up an SSL encryption path with the information home appliance (parent) (step 2). Specifically, the authentication system 3 requests the information home appliance (parent) to transmit a digital certificate, and performs client authentication for the information home appliance (parent) using the digital certificate received from the information home appliance (parent). Do. After that, the SSL encryption communication channel is set by sharing the common key.

  The authentication system 3 registers the information home appliance (parent) whose device authentication has been completed in the authentication database. Next, the authentication system 3 performs processing for determining whether or not there is a parent having the information home appliance (parent) as a child, and the user authentication of the information home appliance (parent) can be omitted. It is determined that no parent exists, and the process proceeds to the next process.

  Note that in normal SSL client authentication between a terminal such as a PC and a server, an operation to select a digital certificate occurs on the client-side PC. In this embodiment, the information home appliance (parent) Has a function of using a digital certificate corresponding to the accessed network service site, and an operation for selecting a digital certificate does not occur.

  Next, the authentication system 3 obtains a user name registered as being able to use the information home appliance (parent) from the authentication database, selects one of the user names, and inputs a password. The screen to be transmitted is transmitted to the information home appliance (parent) using the SSL encrypted communication path (step 3).

  The information home appliance (parent) displays the screen received from the authentication system and prompts the user to select a user name and enter a password. The user selects a user name and inputs a password using a user interface (such as a remote controller) of the information home appliance (parent). Then, the information home appliance (parent) transmits the selected user name and the input password to the authentication system (step 4).

  The authentication system 3 reads the user name and the corresponding password from the authentication database, confirms the match with the user name and password received from the information home appliance (parent), and if it can be confirmed, the user is authenticated. Register success in the authentication database.

  Then, the authentication system 3 permits the information home appliance (parent) to use the network service provided by the service providing system 5, and the network service is provided to the information home appliance (parent) (step 5). Here, for example, redirect destination information including information indicating that the authentication of a specific user is OK is transmitted to the information home appliance (parent), and the information home appliance (parent) uses the received redirect destination information for service. The service providing system 5 performs access to the providing system 5, confirms that the authentication of the user is OK, accepts access from the information home appliance (parent), and provides a network service.

  Next, the user accesses the network service site using the information home appliance (child) (step 6). As in step 2, the authentication system 3 performs device authentication of the information home appliance (child) and sets the SSL encryption communication path (step 7).

  Next, the authentication system 3 performs a process of determining whether or not a user-authenticated parent exists in the information home appliance (child) and the user authentication of the information home appliance (child) can be omitted. Here, since device authentication and user authentication of the information home appliance (parent) have already been completed, it is determined that user authentication of the information home appliance (child) can be omitted, and user authentication is performed on the information home appliance (child). Assume that user authentication is successful without requiring it. That is, the information home appliance (child) takes over the authentication state of the information home appliance (parent). Then, the authentication system 3 registers information indicating that the user authentication of the information home appliance (child) is successful in the authentication database, and the information home appliance (child) is registered in the service providing system 5 in the same manner as in Step 5. Is permitted to use the network service provided by (step 8).

(Device configuration)
Next, functional configuration examples of the information home appliance 1 and the authentication system 3 will be described. FIG. 3 shows a functional configuration diagram of the information home appliance 1. As shown in FIG. 3, the information home appliance 1 includes a main body 11 that provides the functions inherent to the information home appliance, a network communication unit 12 for performing data communication via the network, and device authentication and user authentication in the present embodiment. Control unit 13 that performs processing for network processing and processing for network service use, input unit 14 that receives input of a password, a display unit 15 that displays a user selection screen, and a data storage unit that stores a digital certificate and the like 16. Note that the information home appliance 1 shown in FIG. 3 is a device that can be a parent. When functioning only as a child that does not require user authentication, the input unit 14 and the display unit 15 may not be provided.

  FIG. 4 shows a functional configuration diagram of the authentication system 3. As shown in FIG. 4, the authentication system 3 includes a network communication unit 31 that performs data communication via a network, a device authentication unit 32 that performs device authentication, a user authentication unit 33 that performs user authentication, and an authentication result. The authentication control unit 34 for determining whether or not the update of the authentication database 35 and the user authentication can be omitted, and the cooperation with the service providing system 5, and the registration information and the authentication status information regarding the authentication of the user and the information home appliance The authentication database 35 is stored. The device authentication unit 32, the user authentication unit 33, and the authentication control unit 34 perform processing with reference to the authentication database 35 as appropriate.

  The authentication system 3 can be realized using a computer having a communication function, for example. In this case, the data of the authentication database 35 is stored in the storage device of the computer, and the device authentication unit 32, the user authentication unit 33, and the authentication control unit 34 can be realized by causing the computer to execute a program. The authentication system 3 may be realized by a plurality of computers. For example, the authentication database 35 and other parts can be realized by separate computers.

(Authentication database details)
FIG. 5 shows an example of data in the authentication database 35. As shown in FIG. 5, the authentication database 35 includes a device authentication information table (a), a user authentication information table (b), a device authentication state table (c), a user authentication state table (d), and an authentication linkage information table ( e).

  The device authentication information table includes a contract number, a target, a management number, and a device ID, and the user authentication information table includes a contract number, a target, a management number, a user ID, a user name, and a password. These data in the device authentication information table and the user authentication information table are data registered by application from the user. The contract number is, for example, a number assigned at the time of applying for a network service. In many cases, one contract number is assigned to one household. FIG. 5 shows each table corresponding to one household whose contract number is 12345567890.

  The device authentication status table is a table that stores information indicating whether the device is device-authenticated or unauthenticated for each device management number. In the sequence shown in FIG. 2, when device authentication using a digital certificate is successful for a certain device, “authenticated” is set for the management number of the device. In addition, when the communication session with the network service site by the device is completed, the device becomes “unauthenticated”.

  The user authentication state table includes a management number of the user and the device, an authentication state indicating whether or not authentication has been performed, and an authentication confirmation time indicating a time when the user authentication is successful. The user and device management number data may be automatically set by extracting the device and user management number of the same contract number from the device authentication information table and the user authentication information table, or a combination of the user and the device. You may set based on the contents of application about. As for the authentication status, after the device authentication is successful, when the user authentication for the device is successful, the authentication status column corresponding to the combination of the device and the user becomes “authenticated”. Further, the time at that time is recorded in the column of the authentication confirmation time. When the device authentication of the device having a child relationship with the device is completed within a predetermined time from that time, the authentication status column corresponding to the parent user and the child device becomes “authenticating”. . This is information indicating that the child device can be regarded as authenticated for the user.

  The authentication linkage information table is a table for storing information for defining the relationship between the parent and the child, and includes a parent linkage source device, a child linkage destination device, a user, and presence / absence of linkage. For example, the first line of the data shown in FIG. 5 indicates that “cooperation” is ○ (present), and therefore, regarding the user “01”, the device “01” is the parent and the device “02” is the child. It shows that there is cooperation to do. That is, after the device authentication of the device “01” is successful, the user authentication by the user “01” from the device “01” succeeds, and the device “02” is connected within a predetermined time from that time. If the authentication is successful, the device “02” is considered to have been successfully authenticated by the user “01” without performing user authentication, and receives a network service as a device successfully authenticated by the user “01”. It becomes possible. The authentication cooperation information table is set based on the application contents from the user regarding the authentication cooperation.

The authentication linkage information table also includes a linkage possible time. The cooperation possible time is a time from the time when the parent user authentication is completed, to allow a device having a child relationship to access the network service by omitting the user authentication. Although FIG. 5 shows an example in which the cooperation possible time is set for each contract number (each home, etc.), it may be set for each user or for each device.
(Detailed operation flowchart of authentication system 3)
<First example>
Next, a first example of the operation of the authentication system 5 having the authentication database 35 shown in FIG. 5 will be described in detail with reference to the flowchart of FIG.

  First, the authentication system 3 receives access from the information home appliance 1 via the network (step 11). The authentication system 3 requests the information home appliance 1 to transmit a digital certificate, and performs device authentication of the information home appliance 1 using the transmitted digital certificate (step 12). That is, it checks whether the digital certificate is legitimate and has been tampered with using the public key of the CA (the certificate authority (the authentication system itself may be CA)).

  If device authentication fails in step 12, the authentication system 3 performs error processing such as transmitting information indicating that access is not possible to the information home appliance 1 (step 13). If the device authentication is successful in step 12, the authentication system 3 sets the SSL communication path by having a common key with the information home appliance 1 (step 14). Further, the authentication system 3 identifies the accessing device based on the information of the digital certificate, and sets the device authentication state of the device in the authentication database 35 to “authenticated” (step 15).

  Next, the authentication system 3 refers to the authentication linkage information table of the authentication database 35, and there is a linkage source device (parent) when the information home appliance 1 that has been authenticated is the linkage destination device (child). In addition, it is checked whether or not the cooperation destination device and the cooperation source device are in a cooperation relationship (“cooperation” is ○). That is, it is checked whether there is a device having a parent relationship with the information home appliance 1 (step 16). If there is a parent device, the authentication system 3 acquires the device identification information and the corresponding user identification information from the authentication linkage information table, refers to the user authentication status table, Check whether the authentication status corresponding to the user is "authenticated". That is, it is checked whether or not the parent device has been user-authenticated (step 17).

  If the user has been authenticated, the authentication system 3 checks whether or not the current time is within the “cooperation available time” recorded in the authentication cooperation information table from the “authentication confirmation time” (step 18). If it is within the “cooperation possible time”, the authentication system 3 sets the “authentication status” column corresponding to the information home appliance 1 that has accessed the user (in this case, a child) to “authenticating” ( Step 19), information indicating that the authentication is OK and the service providing system 5 may be accessed is transmitted to the information home appliance 1 (Step 20).

  In step 16, if there is no device having a parent relationship with the accessed information home appliance 1, if the parent “authentication status” has not been authenticated in step 17, or within “cooperation available time” in step 18. If not, the authentication system 3 performs user authentication processing on the accessed information home appliance 1 (step 21). Here, authentication is performed using a password as described above. If the user authentication has failed, error processing in step 13 is performed. If the user authentication is successful, the authentication system 3 sets the authentication status column corresponding to the information home appliance 1 and the user who has been authenticated in the user authentication status table to “authenticated” (step 22). Then, the process of step 20 is performed.

<Second example>
Next, a second example of the operation of the authentication system 3 will be described in detail with reference to the flowchart of FIG. Here, parts different from the first example will be mainly described.

  First, processing when user authentication from step 37 is required will be described. The authentication system 3 performs user authentication processing in step 37, performs error processing if the user authentication processing fails, and if authentication is successful, the information home appliance 1 in the user authentication status table and the user who has been authenticated successfully The authentication status column corresponding to the above is set to “authenticated” (step 38), and network service use permission information is transmitted to the information home appliance 1 (step 39).

  Then, the authentication system 3 refers to the authentication linkage information table, sets the information home appliance 1 that has been authenticated as a linkage source device, and “linkage” corresponding to the linkage source device and the user who has succeeded in user authentication is ○ Check whether there is a linkage destination device. That is, for the user, it is checked whether or not there is a device having a child relationship with the information home appliance 1 (step 40).

  If there is a device having a child relationship, the authentication system 3 sets “authentication reservation” as the authentication state corresponding to the child device and the user in the user authentication state table (step 41).

  Next, the processing from step 36 after the device authentication of the accessed information home appliance 1 is completed will be described.

  In step 36, the authentication system 3 refers to the user authentication state table and checks whether there is an “authentication reservation” in the authentication state corresponding to the information home appliance 1 for which device authentication has been completed. If there is no “authentication reservation”, the processing from step 37 described above is performed.

  If there is an “authentication reservation” in step 36, information indicating that the network service is available to the information home appliance 1 and the corresponding user is transmitted to the information home appliance 1 (step 42).

  FIG. 8 is a flowchart of the “cooperation available time” check in the second example. After setting the authentication state in the user authentication state table to “authentication reservation” (step 51), the authentication system 3 performs “authentication confirmation” in which the current time corresponds to the cooperation source device that is the parent of the child device and the user. It is periodically checked whether or not “cooperation possible time” has elapsed from “time” (step 52). If it has elapsed, “authentication reservation” is set to “unauthenticated” (step 53).

  In the procedure of the second example, as soon as the parent device is authenticated, the child device to be linked is set to the “authentication reservation” state, and when the child device is accessed, the authentication linkage information table is not referred to. By confirming “authentication reservation” in the user authentication status table, it becomes possible to permit service use to the child device.

  In the first example and the second example, while the parent home information appliance (for example, a television) is connected to the network and watching a video, the television includes a device ID, a password, and the like. Information such as a cookie is periodically transmitted to the authentication system 3, and the authentication system 3 can update the "authentication confirmation time" in the user authentication state table by confirming the information included in the cookie. By such processing, it is possible to avoid that the authentication of the child device cannot be omitted after a certain period of time even though the parent device is connected to the network. It should be noted that how much the “authentication confirmation time” can be updated can be changed by setting.

  In the above example, a digital certificate is used for device authentication. However, instead of a digital certificate, for example, information including a device password may be used. Further, when only user authentication is required and authentication of the device itself is not required, it is only necessary to perform processing for identifying the accessed device instead of the device authentication processing.

(Registering authentication linkage information)
Next, registration of authentication cooperation information in the authentication system 3 will be described. Registration can be performed on the basis of the contents of an application form sent by a user by FAX or mail, or online using the information home appliance 1 as described below.

  FIG. 9 shows a sequence for online registration. In addition, this example is an example in the case where the device registration and the user registration have already been completed for the information home appliance 1 that the user is a parent, and thereafter the authentication linkage relationship is registered / changed. Further, it is assumed that this user is registered in the authentication system 3 as having the user authority to register / change the authentication cooperation relationship.

  First, a user in a certain home uses the information home appliance 1 to perform an operation to access an application screen of “automatic device authentication service” on the network service site, whereby the information home appliance 1 accesses the authentication system 3. (Step 61).

  The authentication system 3 performs device authentication in the same procedure as the device authentication process described so far, and sets an SSL encryption communication path with the information home appliance 1 (step 62). The authentication system 3 performs user authentication in the same procedure as the user authentication process described so far (steps 63 and 64).

  The authentication system 3 transmits an application screen for automatic device authentication service to the information home appliance 1 (step 65). The information home appliance 1 displays the screen transmitted from the authentication system 3, and the user selects “application for authentication cooperation” on the screen, so that the information home appliance 1 requests the authentication system 3 to apply for authentication cooperation. Transmit (step 66). Upon receiving the request for authentication cooperation application, the authentication system 3 transmits an authentication cooperation application screen to the information home appliance 1 (step 67). The information home appliance 1 displays the screen, and the user inputs a device that cooperates for each user in the home or cooperation disapproval. Then, the information home appliance 1 transmits the input information to the authentication system 3 (step 68), the authentication system 3 registers the information in the authentication database, and transmits a data transfer registration completion notification to the information home appliance 1 ( Step 69).

(Specific usage example)
As explained in the section “Problems to be solved by the invention”, when uploading video shot with a video camera to a storage service site provided on the Internet and immediately checking the image on a nearby TV Can be considered. In general, since a television has an input function such as a remote controller, a password can be easily input. On the other hand, inputting a password from a video camera generally requires a troublesome operation. In such a case, if you log in to the storage service site with a valid user account by first performing user authentication by entering a password using the TV as the parent device, and then accessing with a video camera The service can be used with the same account without entering a password, and convenience for the user is improved.

  Also, when using a medical network service site, it is conceivable to use fingerprint authentication, which is an authentication means stronger than a password, as user authentication.

  On the other hand, even though the use of information home appliances has become sophisticated and biometric authentication has become commonplace, home appliances generally have a long period of use, so it is considered that there is no fingerprint authentication device in information home appliances that are to receive services. It is done. For example, there may be a case where a television used for receiving medical network services does not have a fingerprint authentication device, and a new hard disk recorder installed near the television has a fingerprint authentication device together with a network connection function. In such a case, by applying the authentication method of the present embodiment, by performing user authentication by fingerprint authentication with a hard disk recorder, a medical-related network service using the TV without performing user authentication on the TV Can be used.

  Note that the above is merely an example, and the system of this embodiment can be used in various situations. Further, the authentication method of the present embodiment can be applied to all information devices other than information home appliances.

  The present invention is not limited to the above-described embodiment, and various modifications and applications can be made within the scope of the claims.

It is a system configuration figure in an embodiment of the invention. It is a sequence chart of an authentication process. It is a functional block diagram of information household appliances. It is a functional block diagram of an authentication system. It is a figure which shows an example of the data in an authentication database. It is a flowchart which shows the 1st example of operation | movement of an authentication system. It is a flowchart which shows the 2nd example of operation | movement of an authentication system. It is a flowchart of the check of the cooperation possible time in the 2nd example of operation | movement of an authentication system. It is a sequence chart of a registration process of authentication cooperation information.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Information home appliance 3 Authentication system 5 Service provision system 7 Communication network 11 Main part 12 Network communication part 13 Control part 14 Input part 15 Display part 16 Data storage part 31 Network communication part 32 Device authentication part 33 User authentication part 34 Authentication control part 35 Authentication database

Claims (7)

An authentication system that performs authentication to determine whether a network service of an information device connected to a communication network can be used,
Parent-child relationship storage means for storing parent-child relationship information between information devices;
When the authentication for a certain information device is successful, the information device set in the parent-child relationship storage means as a child having the information device as a parent takes over the authentication state of the parent information device, and the child information An authentication system comprising: an authentication control unit that permits use of a network service of the child information device without performing authentication of the device. The authentication system further includes an authentication state storage unit that records an authentication state of the information device,
The authentication control means includes
If the authentication of the parent information device is successful, the authentication state of the parent information device in the authentication state storage means is authenticated,
When the child information device accesses the authentication system, the parent information device that is a parent of the child information device is grasped by referring to the parent-child relationship information, and the parent information device 2. The authentication system according to claim 1, wherein use of a network service of the child information device is permitted by confirming that the authentication state in the authentication state storage means is authenticated. The authentication system further includes an authentication state storage unit that records an authentication state of the information device,
The authentication control means includes
When authentication of the parent information device is successful, the authentication state of the parent information device in the authentication state storage means is authenticated, and the parent information device is referred to by referring to the parent-child relationship information. The child information device as a child is grasped, and information indicating that the child information device has been authenticated in the authentication state storage unit is recorded,
When the child information device accesses the authentication system, by confirming the authentication state of the child information device in the authentication state storage means, permitting use of the network service of the child information device. The authentication system according to claim 1, wherein:   The authentication system according to any one of claims 1 to 3, wherein the authentication is user authentication that requires information input by a user to an information device.   The authentication system further includes a device authentication unit that authenticates an information device, and the authentication control unit performs user authentication for the information device when the device authentication by the device authentication unit is successful. The authentication system according to claim 4. A computer having a function of performing authentication in order to determine whether or not a network service of an information device connected to a communication network can be used;
Means for accessing parent-child relationship storage means storing parent-child relationship information between information devices;
When the authentication for a certain information device is successful, the information device set in the parent-child relationship storage means as a child having the information device as a parent takes over the authentication state of the parent information device, and the child information An authentication control means for permitting use of the network service of the child information device without authenticating the device;
Authentication control program to function as. An authentication control method executed by an authentication system comprising authentication means for determining whether or not a network service of an information device connected to a communication network can be used, and parent-child relationship storage means for storing parent-child relationship information between information devices Because
When the authentication for a certain information device is successful, the information device set in the parent-child relationship storage means as a child having the information device as a parent takes over the authentication state of the parent information device, and the child information An authentication control method comprising an authentication control step of permitting use of a network service of the child information device without performing authentication of the device.

Images