JP2012226594A - Authentication server device, authentication method, and authentication program - Google Patents

Abstract

An object of the present invention is to provide an authentication server device, an authentication method, and an authentication program that can be used without distinction between a mobile phone and a smartphone.
The authentication server 10 refers to a mobile terminal DB in which a telephone number or an SMS address of the mobile terminal 100 is stored, and obtains a telephone number or an SMS address associated with an ID. The authentication information notifying unit 17 that receives the authentication information from the acquisition unit 14, the authentication information notifying unit 17 that notifies the terminal having the telephone number or SMS address acquired by the user information acquiring unit 14, and the authentication information notifying unit 17 And an authentication determination unit 12 for determining whether or not the authentication information is the same.
[Selection] Figure 1

Description

  The present invention relates to an authentication server device, an authentication method, and an authentication program using multi-factor authentication in a mobile terminal such as a mobile phone or a smartphone.

  In content distribution management, the authentication of the other party via the network is the most important process, and this is intended to prevent the wrong user from being impersonated as a legitimate user and passing the content by mistake. In current cloud computing, partner authentication is performed by plain text authentication called ID and password, but it is difficult to ensure security. This is because if the ID and password are stolen, there is no way to strike them. In addition, there are one-time passwords, but there are problems such as the distribution of new devices, which are not decisive. Multi-factor authentication such as a bank ATM (Automated Teller Machine) that confirms the partner by various means in such a situation is attracting attention and effective, but there are few application examples in network services including cloud computing.

  Multi-factor authentication using a mobile phone has been proposed (see, for example, Non-Patent Documents 1 and 2). Multi-factor authentication using mobile phones means that mobile phones are already widespread and do not require the distribution of new devices, that they will be immediately noticed if they are lost or stolen, biometric authentication and GPS (Global Positioning System) functions, etc. This is a very effective method because it can use the functions installed in mobile phones. The multi-factor authentication here is an authentication method that uses a combination of other authentication elements such as terminal identification information and image storage in addition to a combination of conventional ID passwords. This method is based on security because unique information such as a cellular phone number is sent through a unique network. In SoftBank (registered trademark) Synclock (registered trademark) and DCIn arena, which are classified as multi-factor authentication using existing mobile phones, this unique information is separated from IP packets in the Internet. I can not cope.

An authentication method using a mobile phone by Softbank. http: // www. syncclock. jp / A multi-factor authentication method based on the Digital Content Institute. http: // www. dcin. or. jp / actives / ip003 / c01. html

  Multi-factor authentication using a conventional mobile phone uses a line authentication service unique to mobile phone carriers. Therefore, various services such as Android (registered trademark) and iPhone (registered trademark) are used by directly communicating with the Internet. Smartphones that can be used are not supported, and authentication across carriers and providers that provide services only on the Internet website cannot freely authenticate using mobile phone terminals.

  In order to solve the above-described problems, an object of the present invention is to provide an authentication server device, an authentication method, and an authentication program that can be used without discrimination between a mobile phone and a smartphone.

  In the present invention, the authentication server notifies the authentication information to a terminal having the user's telephone number or SMS (Short Message Service) address, and collates the authentication information received from the user with the notified authentication information. It is characterized by performing authentication.

  Specifically, the authentication server device according to the present invention refers to an ID receiving unit that receives an ID from a portable terminal, and a portable terminal DB that stores the telephone number or SMS address of the portable terminal together with the ID, and receives the ID A user information acquisition unit for acquiring a telephone number or SMS address associated with the ID received by the unit, and authentication information for notifying the terminal having the telephone number or SMS address acquired by the user information acquisition unit A notification unit, an authentication information receiving unit that receives authentication information from the mobile terminal, and whether or not the authentication information received by the authentication information receiving unit matches the authentication information notified by the authentication information notification unit An authentication determination unit.

  Since the authentication server device of the present invention includes an ID receiving unit, a user information acquisition unit, and an authentication information notification unit, the authentication server device notifies the authentication information to a terminal having a telephone number or an SMS address determined by the user ID. can do. Since the authentication server device of the present invention includes the authentication information receiving unit and the authentication determining unit, it is possible to confirm whether or not the authentication information received from the mobile terminal is correct. Here, in order to notify the authentication information to the terminal having the telephone number or the SMS address, the authentication server device of the present invention can be used without discrimination between a mobile phone and a smartphone. Therefore, the authentication server device of the present invention can provide an authentication server device that can be used regardless of whether it is a mobile phone or a smartphone.

In the authentication server device of the present invention, the user information acquisition unit acquires a plurality of telephone numbers or SMS addresses or combinations of telephone numbers and SMS addresses associated with the ID received by the ID reception unit, and performs the authentication. The information notification unit may divide and notify the authentication information for each of a plurality of telephone numbers or SMS addresses acquired by the user information acquisition unit or a combination of telephone numbers and SMS addresses.
Since the authentication server device according to the present invention notifies authentication information by combining a plurality of communication networks, security can be ensured even when there is a possibility of eavesdropping in some communication networks.

  Specifically, in the authentication method of the present invention, the authentication server device receives an ID from a portable terminal, refers to the portable terminal DB in which the telephone number or SMS address of the portable terminal is stored together with the ID, and the received ID An authentication information notification procedure for acquiring a telephone number or an SMS address associated with the terminal and notifying the terminal having the acquired telephone number or SMS address of the authentication information, and the authentication server device receiving the authentication information from the portable terminal And an authentication determination procedure for determining whether or not the received authentication information matches the authentication information notified in the authentication information notification procedure.

  Since the authentication method of the present invention has an authentication information notification procedure, the authentication information can be notified to a terminal having a telephone number or SMS address determined by the user ID. Since the authentication method of the present invention has an authentication determination procedure, it can be confirmed whether or not the authentication information received from the mobile terminal is correct. Here, in order to notify the authentication information to the terminal having the telephone number or the SMS address, the authentication method of the present invention can be used without discrimination between a mobile phone and a smartphone. Therefore, the authentication method of the present invention can provide an authentication server device that can be used regardless of whether it is a mobile phone or a smartphone.

In the authentication method of the present invention, in the authentication information notification procedure, a plurality of telephone numbers or SMS addresses or combinations of telephone numbers and SMS addresses associated with the received ID are acquired, and the acquired plurality of telephone numbers or SMS The authentication information may be divided and notified to each of an address or a combination of a telephone number and an SMS address.
Since the authentication method of the present invention notifies authentication information by combining a plurality of communication networks, security can be ensured even if there is a possibility of eavesdropping in some communication networks.

Specifically, the authentication program of the present invention is an authentication program for causing a computer to execute an authentication information notification procedure and an authentication determination procedure.
Since the authentication program of the present invention causes the computer to execute the authentication information notification procedure and the authentication determination procedure, the authentication method of the present invention can be executed. Therefore, the authentication program of the present invention can provide an authentication server device that can be used regardless of whether it is a mobile phone or a smartphone.

  Specifically, the authentication server device of the present invention includes an ID receiving unit that receives an ID from a portable terminal, and user information in which a telephone number or SMS address of the portable terminal and a question and an answer to the question are stored together with the ID. A user information acquisition unit that acquires a telephone number or an SMS address associated with the ID received by the ID reception unit and a question and an answer to the question with reference to the DB, and a telephone acquired by the user information acquisition unit A question notification unit for notifying the terminal having a number or an SMS address of the question acquired by the user information acquisition unit, an answer receiving unit for receiving an answer to the question from the portable terminal, and reception of the answer receiving unit An authentication determination unit that determines whether or not the received answer matches the answer to the question acquired by the user information acquisition unit.

  Since the authentication server device of the present invention includes an ID receiving unit, a user information acquiring unit, and a question notifying unit, the authentication server device notifies a question to a terminal having a telephone number or SMS address determined by the user ID. Can do. Since the authentication server device according to the present invention includes the answer receiving unit and the authentication determining unit, it is possible to confirm whether or not the answer received from the mobile terminal is correct. Here, in order to notify the authentication information to the terminal having the telephone number or the SMS address, the authentication server device of the present invention can be used without discrimination between a mobile phone and a smartphone. Therefore, the authentication server device of the present invention can provide an authentication server device that can be used regardless of whether it is a mobile phone or a smartphone.

In the authentication server device of the present invention, the user information acquisition unit acquires a plurality of telephone numbers or SMS addresses or combinations of telephone numbers and SMS addresses associated with the ID received by the ID reception unit, and the question The notification unit may divide and notify the question to each of a plurality of telephone numbers or SMS addresses acquired by the user information acquisition unit or a combination of telephone numbers and SMS addresses.
Since the authentication server device according to the present invention notifies authentication information by combining a plurality of communication networks, security can be ensured even when there is a possibility of eavesdropping in some communication networks.

  Specifically, in the authentication method of the present invention, the authentication server device receives an ID from a portable terminal, and the user information in which the telephone number or SMS address of the portable terminal and the question and the answer to the question are stored together with the ID. A question notification procedure for referring to the DB, acquiring a telephone number or SMS address associated with the received ID, a question and an answer to the question, and notifying the terminal having the acquired telephone number or SMS address of the question; The authentication server apparatus receives an answer to the question from the portable terminal, and determines whether the received answer matches the answer to the question notified in the question notification procedure.

  Since the authentication method of the present invention has a question notification procedure, it is possible to notify a question to a terminal having a telephone number or SMS address determined by the user ID. Since the authentication method of the present invention has an authentication determination procedure, it can be confirmed whether or not the answer received from the mobile terminal is correct. Here, since the question is notified to the terminal having the telephone number or the SMS address, the authentication method of the present invention can be used without distinction between a mobile phone and a smartphone. Therefore, the authentication method of the present invention can provide an authentication server device that can be used regardless of whether it is a mobile phone or a smartphone.

In the authentication method of the present invention, in the question notification procedure, a plurality of telephone numbers or SMS addresses or combinations of telephone numbers and SMS addresses associated with the received ID are acquired, and the acquired plurality of telephone numbers or SMS addresses are acquired. Alternatively, the question may be divided and notified to each combination of a telephone number and an SMS address.
Since the authentication method of the present invention notifies authentication information by combining a plurality of communication networks, security can be ensured even if there is a possibility of eavesdropping in some communication networks.

Specifically, the authentication program of the present invention is an authentication program for causing a computer to execute a question notification procedure and an authentication determination procedure.
Since the authentication program of the present invention causes the computer to execute the question notification procedure and the authentication judgment procedure, the authentication method of the present invention can be executed. Therefore, the authentication program of the present invention can provide an authentication server device that can be used regardless of whether it is a mobile phone or a smartphone.

  According to the present invention, it is possible to provide an authentication server device, an authentication method, and an authentication program that can be used without discrimination between a mobile phone and a smartphone.

An example of the authentication system which concerns on Embodiment 1 is shown. 4 shows an exemplary sequence of an authentication system according to the first embodiment. An example of the authentication system which concerns on Embodiment 2 is shown. An example of the sequence of the authentication system which concerns on Embodiment 2 is shown. An example of the authentication system which concerns on Embodiment 3 is shown. An example of the sequence of the authentication system which concerns on Embodiment 3 is shown. An example of the authentication system which concerns on Embodiment 4 is shown. An example of the sequence of the authentication system which concerns on Embodiment 4 is shown.

  Embodiments of the present invention will be described with reference to the accompanying drawings. The embodiments described below are examples of the present invention, and the present invention is not limited to the following embodiments. In the present specification and drawings, the same reference numerals denote the same components.

(Embodiment 1)
FIG. 1 shows an example of an authentication system according to this embodiment. The authentication system according to the present embodiment includes a mobile terminal 100 and an authentication server 10. The mobile terminal 100 is a terminal that has a telephone number or an SMS address and can make a call using a unique managed network called a telephone carrier. The portable terminal 100 and the authentication server 10 can communicate with each other through a managed unique network such as a telephone carrier in addition to a released communication network such as the Internet. SMS, which is a message service equivalent to the telephone service, can be used as long as the telephone service is provided on the carrier's own network, whether it is Feature Phone or a smartphone.

  The authentication system according to the present embodiment uses a telephone number or an SMS address. The telephone number or SMS address communicates through a managed network that is operated and monitored by a specific vendor with a telephone carrier. As described above, the authentication system according to the present embodiment uses a managed network in which the closedness, safety, and reliability of arrival and departure are guaranteed by a telephone carrier for effective authentication with minimum procedures. For this reason, it is possible to perform authentication in which closedness, safety and reliability of arrival and departure are guaranteed.

  Specifically, the authentication method according to the present embodiment sequentially includes an authentication information notification procedure and an authentication determination procedure. In the authentication information notification procedure, authentication information is notified from the authentication server 10 on the service providing side to the portable terminal 100 using a telephone carrier. In the authentication determination procedure, the authentication server 10 collates authentication information transmitted from the mobile terminal 100. As described above, the function of the telephone carrier is used as a method of notifying information from the authentication server 10 for device identification in one direction.

  The authentication server 10 includes, for example, a message reception unit 11, an authentication determination unit 12, a message transmission unit 13, a user information acquisition unit 14, a user information DB 15, a temporary authentication information generation unit 16, and authentication information. A notification unit 17. The user information DB 15 stores each user's ID, password, telephone number, and SMS address, and functions as a mobile terminal DB. For one ID, both the telephone number and the SMS address may be stored, only the telephone number may be stored, or only the SMS address may be stored.

  FIG. 2 shows an exemplary sequence of the authentication system according to the present embodiment. After identifying an individual by authentication using a combination of ID and password, carrier management that is completely independent of the Internet using the personal information of the individual's mobile phone (phone number managed by the telephone carrier and SMS address associated with it) Multi-factor authentication is realized by transmitting a key for authentication to the same personal mobile phone (and a smartphone) via the network and performing authentication using the information. The specific method is as follows.

  In the user identification and authentication step, the procedure from step S101 to step S103 is executed. In the user confirmation authentication step, the procedure from step S104 to step S108 is executed. Among these, steps S103 to S105 correspond to the authentication information notification procedure according to the present embodiment, and steps S106 to S108 correspond to the authentication determination procedure.

  In step S101, the mobile terminal 100 accesses the authentication server 10 with a browser. In step S <b> 102, the message transmission unit 13 transmits a request for an ID and password to the mobile terminal 100. In step S <b> 103, the mobile terminal 100 transmits the ID and password input from the user to the authentication server 10. Then, the message receiving unit 11 receives an ID from the portable terminal 100 as an ID receiving unit.

  In step S104, the user information acquisition unit 14 refers to the user information DB 15 and acquires user information based on the ID and password. The authentication determination unit 12 confirms the user information by determining whether the ID and password received by the message reception unit 11 and the ID and password acquired by the user information acquisition unit 14 match. When the confirmation is completed, the user information acquisition unit 14 refers to the user information DB 15 and acquires the telephone number associated with the ID received by the message reception unit 11. Then, the authentication determination unit 12 outputs the telephone number to the temporary authentication information generation unit 16.

  In step S <b> 105, the temporary authentication information generation unit 16 generates authentication information and outputs the authentication information and the telephone number to the authentication information notification unit 17. The authentication information is, for example, an authentication number, and any symbol such as letters or numbers may be used. Then, the authentication information notification unit 17 calls the telephone number and notifies the user of the authentication number through a call. Thereby, only the user who has the mobile phone or smart phone of the telephone number linked | related with ID can notify an authentication number. Here, the validity period of this authentication number is set to a certain period. Thereby, it is possible to prevent the use of the authentication number by a person other than the user of the mobile terminal 100 that has accessed.

  In S <b> 106, the mobile terminal 100 acquires the authentication number input by the user and transmits the authentication number to the authentication server 10. Then, the message receiving unit 11 receives an authentication number from the portable terminal 100 as an authentication information receiving unit.

  In step S <b> 107, the authentication determination unit 12 determines whether or not the authentication number received by the message reception unit 11 matches the authentication number notified by the authentication information notification unit 17. At this time, the authentication determination unit 12 may determine whether the user ID, password, telephone number, and authentication number match. In step S <b> 108, the message transmission unit 13 notifies the mobile terminal 100 of success or failure of authentication by the authentication determination unit 12.

  In the present embodiment, the example in which the authentication server 10 notifies the authentication information to the terminal having the telephone number associated with the ID received by the message receiving unit 11 has been described, but the present invention is not limited to this. For example, the authentication information notification unit 17 may notify the authentication information described in the text data to the terminal having the SMS address acquired by the user information acquisition unit 14.

  Further, the authentication server 10 of the present embodiment can be realized by a computer and a program, and the program can be recorded on a recording medium or provided through a network.

  As described above, since the authentication server 10 and the authentication method according to the present embodiment authenticate the authentication information notification unit 17 by notifying the authentication number as authentication information to the terminal having the user's telephone number, User authentication necessary for ensuring sufficient security, which is the most basic in future network services including computing, will be possible using smartphones and the like that are already in widespread use. This allows for widespread use of all network services, including content distribution and very expensive payments.

  Since the authentication server 10 and the authentication method according to the present embodiment notify the authentication information to the terminal having the user's telephone number or SMS address, a device that is expected to be widely used in the future, such as a smartphone, is used. It can be used for user authentication to ensure sufficient security of network services. The authentication server 10 and the authentication method according to the present embodiment can also be applied to future LTE (Long Term Evolution). Furthermore, the authentication server 10 and the authentication method according to the present embodiment have the flexibility to actively incorporate the developed multi-factor authentication.

(Embodiment 2)
FIG. 3 shows an example of an authentication system according to this embodiment. The authentication system according to the present embodiment includes a plurality of mobile terminals 100A and 100B instead of the mobile terminal 100. The portable terminals 100A and 100B have telephone numbers and SMS addresses managed by different telephone carriers. In this case, the user information DB 15 stores the telephone number A and the SMS address A of the mobile terminal 100A, and stores the telephone number B and the SMS address B of the mobile terminal 100B.

  FIG. 4 shows an exemplary sequence of the authentication system according to the present embodiment. The authentication system according to the present embodiment is different in steps S104 and S105 in the sequence of the authentication system according to the first embodiment. In the authentication information notification procedure, the authentication server device 10 transmits authentication information to a plurality of portable terminals 100A and 100B. Is divided and notified.

  In step S104, the user information acquisition unit 14 refers to the user information DB 15 and acquires user information based on the ID and password. The authentication judgment unit 12 confirms user information based on the ID and password. Then, the user information acquisition unit 14 refers to the user information DB 15 and acquires the telephone number A and the telephone number B associated with the ID received by the message reception unit 11.

  In step S <b> 105, the temporary authentication information generation unit 16 generates authentication information and outputs the authentication information, the telephone number A, and the telephone number B to the authentication information notification unit 17. Then, the authentication information notification unit 17 divides the authentication number generated by the temporary authentication information generation unit 16 into two, notifies one authentication number to the telephone number A, and notifies the other authentication number to the telephone number B. To do. Thereby, only the user who has the mobile phone or smart phone of the telephone number A and has the mobile phone or smart phone of the telephone number B can be notified of the correct authentication number.

  In this embodiment, the case where the divided authentication information is notified to the telephone number A and the telephone number B has been described, but the present invention is not limited to this. The divided authentication information may be notified to SMS address A and SMS address B, or may be notified to telephone number A and SMS address B. Further, when the user information DB 15 stores telephone numbers or SMS addresses of three or more mobile terminals, the user information DB 15 may notify the three or more mobile terminals. As described above, the authentication server 10 and the authentication method according to the present embodiment may divide and notify the authentication information for each of a plurality of telephone numbers or SMS addresses or combinations of telephone numbers and SMS addresses.

  As described above, in the authentication server 10 and the authentication method according to the present embodiment, the user can use a (mobile) terminal (such as a home computer) that can communicate with a plurality of carriers, or a plurality of mobile phones of different carriers. If a terminal (or one line may be a fixed telephone line) can be used at the same time, the temporary authentication number is divided, and multiple carrier lines (independently managed networks) are used separately. Send. According to this method, the temporary authentication number is divided and transmitted over a plurality of managed networks, so that the policy of some of the managed networks in it may not be trusted or there is a possibility of eavesdropping. Security can be guaranteed even if there is.

  Furthermore, in the first and second embodiments, when information such as GPS and base stations can be used, the authentication server 10 is configured not to transmit a temporary authentication number unless it is a specific base station or position. It is also possible to increase safety. In this case, the position where the user operates the mobile terminal is based on information such as line authentication if it is a fixed terminal, and if it is a mobile terminal, the base station position information or the terminal is GPS or the like. It is possible to detect each using the measured information. These are authentication safety enhancement methods that are made possible by increasing the functionality of mobile terminals such as smartphones.

(Embodiment 3)
FIG. 5 shows an example of an authentication system according to this embodiment. The authentication system according to the present embodiment includes a mobile terminal 100 and an authentication server 10. The mobile terminal 100 is a terminal that has a telephone number or an SMS address and can make a call using a unique managed network called a telephone carrier. The portable terminal 100 and the authentication server 10 can communicate with each other through a managed unique network such as a telephone carrier in addition to a released communication network such as the Internet. SMS, which is a message service equivalent to the telephone service, can be used as long as the telephone service is provided on the carrier's own network, whether it is Feature Phone or a smartphone.

  The authentication system according to the present embodiment uses a telephone number or an SMS address. A network in which the closedness, safety, and reliability of arrival and departure are guaranteed by the telephone carrier is used for effective authentication with a minimum number of procedures. Specifically, the authentication method according to the present embodiment sequentially includes a question notification procedure and an authentication determination procedure. In the question notification procedure, a question is notified from the authentication server 10 on the service providing side to the portable terminal 100 using a telephone carrier. In the authentication determination procedure, the authentication server 10 verifies the answer transmitted from the mobile terminal 100. As described above, the function of the telephone carrier is used as a method of notifying information from the authentication server 10 for device identification in one direction.

  Moreover, if the authentication system according to the present embodiment is authentication information generated on the spot by combining with the user's memory, the safety is further improved. For example, only the password hint questions that have been registered in advance are communicated by telephone (voice) or SMS (eg, maternal maiden name, pet's name, attended elementary school, etc.) and the answer is entered as authentication information. . Alternatively, matrix authentication is used to indicate numbers arranged in a matrix by SMS, and numbers arranged in the order of positions stored by the user are input as authentication information.

  The authentication server 10 includes, for example, a message reception unit 11, an authentication determination unit 12, a message transmission unit 13, a user information acquisition unit 14, a user information DB 15, a temporary authentication information generation unit 16, and authentication information. A notification unit 17. The user information DB 15 stores each user's ID, password, telephone number, SMS address, secret question, and question answer. Here, the answer to the question is not limited to one, but may be plural.

  FIG. 6 shows an exemplary sequence of the authentication system according to this embodiment. After identifying an individual through authentication using a combination of ID and password, the carrier's unique information (such as the phone number managed by the carrier and the SMS address associated with it) is used to manage the carrier completely independent of the Internet. Multi-factor authentication is realized by transmitting a key for authentication to the same mobile phone (and a smartphone) via the network and performing authentication using the information. The specific method is as follows.

  In the user identification and authentication step, the procedure from step S111 to step S113 is executed. In the user confirmation authentication step, the procedure from step S114 to step S118 is executed. Among these, Steps S113 to S115 correspond to the question notification procedure according to the present embodiment, and Steps S116 to S118 correspond to the authentication determination procedure.

  In step S111, the mobile terminal 100 accesses the authentication server 10 using a smartphone browser. In step S <b> 112, the message transmission unit 13 transmits a request for an ID and a password to the mobile terminal 100. In step S <b> 113, the mobile terminal 100 transmits the ID and password input from the user to the authentication server 10. Then, the message receiving unit 11 receives an ID from the portable terminal 100 as an ID receiving unit.

  In step S114, the user information acquisition unit 14 acquires user information based on the ID and password with reference to the user information DB 15. The authentication determination unit 12 confirms the user information by determining whether the ID and password received by the message reception unit 11 and the ID and password acquired by the user information acquisition unit 14 match. When the confirmation is completed, the user information acquisition unit 14 refers to the user information DB 15 and acquires the telephone number associated with the ID received by the message reception unit 11. Then, the authentication determination unit 12 outputs the telephone number to the temporary authentication information generation unit 16.

  In step S115, the temporary authentication information generation unit 16 generates authentication information. The authentication information is, for example, a question associated with the user ID. And the authentication information notification part 17 calls a mobile telephone number as a question notification part, and notifies a user of a question by telephone call. Thereby, a question can be notified only to the user who has the mobile phone or smart phone of the telephone number linked | related with ID. Here, the validity period of this question is set to a certain period. Thereby, it is possible to prevent the use of the authentication information by a person other than the user of the mobile terminal 100 that has accessed.

  In S <b> 116, the mobile terminal 100 acquires the question input by the user, and transmits the question to the authentication server 10. Then, the message receiving unit 11 receives an answer from the portable terminal 100 as an answer receiving unit.

  In step S <b> 117, the authentication determination unit 12 determines whether the answer received by the message reception unit 11 matches the answer to the question notified by the authentication information notification unit 17. At this time, the authentication determination unit 12 may determine whether the user ID, password, telephone number, and answer match. In step S <b> 118, the message transmission unit 13 makes a success or failure of authentication by the authentication determination unit 12 to the mobile terminal 100.

  In the present embodiment, an example has been described in which the authentication server 10 notifies a question to a terminal having a telephone number associated with the ID received by the message receiving unit 11, but the present invention is not limited to this. For example, the authentication information notification unit 17 may notify a question described in text data to a terminal having the SMS address acquired by the user information acquisition unit 14.

  Further, the authentication server 10 of the present embodiment can be realized by a computer and a program, and the program can be recorded on a recording medium or provided through a network.

  As described above, the authentication server 10 and the authentication method according to the present embodiment include cloud computing because the authentication information notification unit 17 performs authentication by notifying the terminal having the user's telephone number of the question. User authentication necessary for ensuring sufficient security, which is the most basic in future network services, will be possible using smartphones and the like that are already in widespread use. This allows for widespread use of all network services, including content distribution and very expensive payments.

  Since the authentication server 10 and the authentication method according to the present embodiment notify a question to a terminal having a user's telephone number or SMS address, a device that is expected to be widely used in the future, such as a smartphone, is used as the most basic use of a network service. Can be used to ensure sufficient security of network services. The authentication server 10 and the authentication method according to the present embodiment can also be applied to future LTE (Long Term Evolution). Furthermore, the authentication server 10 and the authentication method according to the present embodiment have the flexibility to actively incorporate the developed multi-factor authentication.

(Embodiment 4)
FIG. 7 shows an example of an authentication system according to this embodiment. The authentication system according to the present embodiment includes a plurality of mobile terminals 100A and 100B instead of the mobile terminal 100. The portable terminals 100A and 100B have telephone numbers and SMS addresses managed by different telephone carriers. In this case, the user information DB 15 stores the telephone number A and the SMS address A of the mobile terminal 100A, and stores the telephone number B and the SMS address B of the mobile terminal 100B.

  FIG. 8 shows an exemplary sequence of the authentication system according to the present embodiment. The authentication system according to the present embodiment is different in steps S114 and S115 in the sequence of the authentication system according to the third embodiment. In the question notification procedure, the authentication server device 10 divides a question into a plurality of portable terminals 100A and 100B. And notify.

  In step S114, the user information acquisition unit 14 acquires user information based on the ID and password with reference to the user information DB 15. The authentication judgment unit 12 confirms user information based on the ID and password. Then, the user information acquisition unit 14 refers to the user information DB 15 and acquires the telephone number A and the telephone number B associated with the ID received by the message reception unit 11.

  In step S <b> 115, the temporary authentication information generation unit 16 generates a question and outputs the question, the phone number A, and the phone number B to the authentication information notification unit 17. Then, the authentication information notification unit 17 divides the question generated by the temporary authentication information generation unit 16 into two as a question notification unit, notifies one question to the phone number A, and sends the other question to the phone number B. Notify For example, in the case of a pet name, “PET” is notified to the telephone number A, and “NAME” is notified to the telephone number B. Thereby, only the user who has the mobile phone or smart phone of the telephone number A and has the mobile phone or smart phone of the telephone number B can be notified of a correct question.

  In this embodiment, the case where the divided questions are notified to the telephone number A and the telephone number B has been described. However, the present invention is not limited to this. The divided questions may be notified to the SMS address A and the SMS address B, or may be notified to the telephone number A and the SMS address B. Further, when the user information DB 15 stores telephone numbers or SMS addresses of three or more mobile terminals, the user information DB 15 may notify the three or more mobile terminals. As described above, the authentication server 10 and the authentication method according to the present embodiment may divide and notify the question to each of a plurality of telephone numbers or SMS addresses or a combination of telephone numbers and SMS addresses.

  As described above, in the authentication server 10 and the authentication method according to the present embodiment, the user can use a (mobile) terminal (such as a home computer) that can communicate with a plurality of carriers, or a plurality of mobile phones of different carriers. If a terminal (or one line may be a fixed telephone line) can be used at the same time, the temporary question is divided and sent separately on multiple carrier lines (independently managed networks) To do. According to this method, a temporary question is divided and transmitted over a plurality of managed networks, so that the policy of some of the managed networks may not be trusted or there is a possibility of eavesdropping. Security can be secured even if

  Further, in the third and fourth embodiments, when information such as GPS and base stations is available, the authentication server 10 is configured so as not to transmit a question unless it is a specific base station or location. It is also possible to increase. In this case, the position where the user operates the mobile terminal is based on information such as line authentication if it is a fixed terminal, and if it is a mobile terminal, the base station position information or the terminal is GPS or the like. It is possible to detect each using the measured information. These are authentication safety enhancement methods that are made possible by increasing the functionality of mobile terminals such as smartphones.

  The present invention can be applied to the information communication industry.

10: Authentication server 11: Message reception unit 12: Authentication determination unit 13: Message transmission unit 14: User information acquisition unit 15: User information DB
16: Temporary authentication information generation unit 17: Authentication information notification unit 100, 100A, 100B: Mobile terminal

Claims (10)

An ID receiving unit for receiving an ID from the mobile terminal;
A user who obtains a telephone number or an SMS address associated with the ID received by the ID receiving unit by referring to the portable terminal DB storing the telephone number or SMS (Short Message Service) address of the portable terminal together with the ID. An information acquisition unit;
An authentication information notifying unit for notifying the terminal having the telephone number or SMS address acquired by the user information acquiring unit;
An authentication information receiving unit for receiving authentication information from the mobile terminal;
An authentication determination unit for determining whether the authentication information received by the authentication information receiving unit matches the authentication information notified by the authentication information notification unit;
An authentication server device comprising: The user information acquisition unit acquires a plurality of telephone numbers or SMS addresses or combinations of telephone numbers and SMS addresses associated with the ID received by the ID receiving unit,
The authentication information notification unit divides and notifies the authentication information to each of a plurality of telephone numbers or SMS addresses acquired by the user information acquisition unit or a combination of telephone numbers and SMS addresses. Item 4. The authentication server device according to Item 1. The authentication server device receives the ID from the portable terminal, refers to the portable terminal DB storing the portable terminal's telephone number or SMS address together with the ID, and obtains the telephone number or SMS address associated with the received ID. An authentication information notification procedure for notifying the terminal having the acquired telephone number or SMS address of the authentication information;
An authentication determination procedure for determining whether or not the authentication server apparatus receives authentication information from the mobile terminal, and the received authentication information matches the authentication information notified in the authentication information notification procedure;
An authentication method. In the authentication information notification procedure, a plurality of telephone numbers or SMS addresses or combinations of telephone numbers and SMS addresses associated with the received ID are acquired, and the acquired plurality of telephone numbers or SMS addresses or telephone numbers and SMS addresses are acquired. The authentication method according to claim 3, wherein the authentication information is divided and notified to each of the combinations.   An authentication program for causing a computer to execute the authentication information notification procedure and the authentication determination procedure according to claim 3. An ID receiving unit for receiving an ID from the mobile terminal;
The telephone number or SMS (Short Message Service) address of the portable terminal together with the ID, and the user information DB in which the question and the answer to the question are stored, and the telephone number associated with the ID received by the ID receiving unit Or a user information acquisition unit for acquiring an SMS address and a question and an answer to the question;
A question notifying unit for notifying the question acquired by the user information acquiring unit to a terminal having the telephone number or SMS address acquired by the user information acquiring unit;
An answer receiving unit for receiving an answer to the question from the mobile terminal;
An authentication determination unit that determines whether or not the response received by the response reception unit matches the response to the question acquired by the user information acquisition unit;
An authentication server device comprising: The user information acquisition unit acquires a plurality of telephone numbers or SMS addresses or combinations of telephone numbers and SMS addresses associated with the ID received by the ID receiving unit,
The question notifying unit divides and notifies the question to each of a plurality of telephone numbers or SMS addresses or combinations of telephone numbers and SMS addresses acquired by the user information acquiring unit. The authentication server device described in 1. The authentication server device receives the ID from the mobile terminal, refers to the user information DB in which the telephone number or SMS address of the mobile terminal and the question and the answer to the question are stored together with the ID, and is associated with the received ID A telephone number or SMS address and a question and an answer to the question, and a question notification procedure for notifying the question to a terminal having the acquired telephone number or SMS address;
An authentication server that receives an answer to the question from the mobile terminal and determines whether the received answer matches the answer to the question notified in the question notification procedure;
An authentication method. In the question notification procedure, a plurality of telephone numbers or SMS addresses or a combination of telephone numbers and SMS addresses associated with the received ID is acquired, and a plurality of acquired telephone numbers or SMS addresses or telephone numbers and SMS addresses are obtained. The authentication method according to claim 8, wherein the question is divided and notified to each combination.   An authentication program for causing a computer to execute the question notification procedure and the authentication determination procedure according to claim 8.

Images