JP5559760B2 - Authentication system - Google Patents

Description

  The present invention relates to an authentication system for determining whether an application program is authentic.

A mobile terminal or the like accesses a website using an application program called a web browser. Here, in order to ensure security and safety, websites that make payments for shopping, etc., require the user to enter a user ID and password when logging in, and check the user ID and password in the server-side database. The method to do is generally done.
Also, in such a website, a method of checking a user ID and a manufacturing number of a portable terminal at the time of login (for example, see Patent Document 1) is also known.

  In addition, a technique for reducing the number of times of manual input of a user ID and a password when performing ID authentication on a website is also known (see, for example, Non-Patent Document 1).

Japanese Patent Laid-Open No. 2003-281997

Felica Networks, Inc., search on August 3, 2011, Internet (URL: http://www.felicaneworks.co.jp/news/topics/index2010.html)

By the way, in the technique which concerns on a nonpatent literature 1, it is implement | achieved by the plug-in system which performs function expansion directly with respect to a web browser.
Therefore, when the technology according to Non-Patent Document 1 is used, for example, when a plurality of web browsers are installed in the mobile terminal, it is necessary to plug in each web browser, which increases the burden on the user. Also, depending on the type of web browser, if the application according to Non-Patent Document 1 cannot be plugged in, when accessing a website that requires the input of a user ID and password, a compatible web browser is started. It becomes necessary to redo, and the burden on the user increases.

  The present invention does not employ a plug-in method, and any web browser can be used to reduce the number of input of a user ID or the like for ID authentication, and to increase the degree of freedom in screen design. One object is to provide an authentication system capable of performing the above.

  In order to solve the above problems, an authentication system according to the present invention is an authentication system in which predetermined communication is performed between a mobile terminal and a server via a network. The server includes a predetermined image and the predetermined image. A first storage unit that stores an image size corresponding to the first URL, a first authentication server corresponding to the first URL, and a second authentication server corresponding to the second URL. Analyzing data acquired via the network and displaying the analysis result on the display unit, an authentication application program for performing authentication, a second storage unit for storing a unique authentication key, and the first 1 URL is designated as a destination, and the browsing application program connects to the first authentication server via the network. A first processing unit that analyzes information acquired from the first authentication server and displays an authentication page including an image size corresponding to a predetermined image and information of the second URL as a result of the analysis on the display unit The authentication key is read from the second storage unit, the second URL included in the authentication page is designated as a destination, and the authentication key is sent to the second authentication server by the authentication application program. And a second processing unit for requesting acquisition of the predetermined image, wherein the second authentication server is configured to verify the validity of the authentication key based on the authentication key transmitted from the portable terminal. And a transmission for reading the predetermined image stored in the first storage unit and transmitting it to the portable terminal when the validity of the authentication key is confirmed by the determination unit The second processing unit transmits the predetermined image transmitted from the second authentication server to the first processing unit by the authentication application program, and the first processing unit Whether the image size of the predetermined image transmitted from the second processing unit by the authentication page is compared with the image size corresponding to the predetermined image included in the authentication page, and matches? In this case, the authentication application program is determined to be a genuine application program if they match.

  According to such a configuration, the authentication system accesses the first authentication server by the browsing application program (web browser), and obtains the image size and the second URL corresponding to the predetermined image from the first authentication server. After the authentication page including the authentication URL is acquired, the second URL is the destination, the authentication key is assigned by the authentication application program to access the second authentication server, and the validity of the authentication key is confirmed by the second authentication server A predetermined image is received. Then, the authentication system passes the received predetermined image from the authentication application program to the authentication page operated by the browsing application program, and the image size of the predetermined image received from the second authentication server by the authentication page and the authentication The image sizes corresponding to the predetermined images included in the page are compared to determine whether or not they match. If they match, it is determined that the authentication application program is a genuine application program.

  Therefore, the authentication system can determine whether or not the installed authentication application program is a genuine program from the authentication page acquired by the web browser. Therefore, if the authentication application program is determined to be authentic, the authentication system By using the application program, it is possible to reduce the number of times of inputting a user ID or the like during ID authentication. Further, since the authentication application program uses a socket method, there is an advantage that it can be used by any web browser.

  Further, in the authentication system, the second storage unit stores a plurality of different browsing application programs, and the first processing unit is one browsing application program from the second storage unit. The result of analyzing the information acquired from the first authentication server, specifying the first URL as a destination, connecting to the first authentication server via the network, and analyzing the information acquired from the first authentication server As another example, an authentication page including an image size corresponding to a predetermined image and information on the second URL may be displayed on the display unit.

  Accordingly, since the authentication application program adopts the socket method, the authentication system performs ID authentication using one browsing application program arbitrarily selected from a plurality of different browsing application programs (web browsers). It can be carried out.

  Further, in the authentication system, when the first processing unit determines that the authentication application program is a genuine application program, the first processing unit uses a predetermined authentication page displayed on the display unit by the browsing application program. The second processing unit may transmit the predetermined application program to the first processing unit by the authentication application program in accordance with the request.

  Accordingly, in the authentication system, if it can be determined that the authentication application program is authentic, it is proved that the authentication application program is not a malicious application program. Therefore, the predetermined application transmitted from the authentic authentication application program is proved. The program can be executed as it is without verifying safety or the like in advance.

  According to the present invention, it is possible to reduce the number of times of input of a user ID or the like during ID authentication, and to increase the degree of freedom of screen design.

It is a figure which shows the structure of an authentication system. It is a figure explaining the flow of a process at the time of judging the authenticity of an authentication application by an authentication system. It is a figure explaining the flow of a process at the time of executing an execution program by an authentication system.

  Hereinafter, an example of an embodiment of the present invention will be described with reference to the drawings. In the authentication system 1 according to the embodiment of the present invention, a mobile terminal 20 and a server 10 are connected via a network N.

As shown in FIG. 1, the server 10 includes a first storage unit 11, a first authentication server 12, and a second authentication server 13.
The first storage unit 11 stores a predetermined image and an image size corresponding to the predetermined image. The first authentication server 12 corresponds to the first URL. Therefore, the first authentication server 12 is connected via the network N when the first URL is designated as a destination by a browsing application program AP1 (hereinafter referred to as a web browser AP1) such as a mobile terminal, and the web In response to a request from the browser AP1 (such as an HTTP request), predetermined information is transmitted to the web browser AP1. The second authentication server 13 corresponds to the second URL.

  The first authentication server 12 and the second authentication server 13 are connectable to the network N, and have a web server function that is partially or entirely compliant with W3C (World Wide Web Consortium) specifications.

  As illustrated in FIG. 1, the mobile terminal 20 includes a display unit 21, a second storage unit 22, a first processing unit 23, and a second processing unit 24.

  The second storage unit 22 analyzes data acquired via the network N, displays a result of the analysis on the display unit 21, and an authentication application program AP2 that performs authentication (hereinafter referred to as an authentication application AP2). ) And a unique authentication key. When the mobile terminal 20 is a mobile phone device, the unique authentication key is not limited to IMEI (International Mobile equipment Identifier) or IMEI, but may be IMSI (International Mobile Subscriber Identity) It may be a password specified in

  The first processing unit 23 specifies the first URL as a destination, connects to the first authentication server 12 via the network N by the web browser AP1, and acquires the information acquired from the first authentication server 12. As a result of the analysis, an authentication page P1 including the image size corresponding to the predetermined image and the information of the second URL is displayed on the display unit 21.

  The second processing unit 24 reads the authentication key from the second storage unit 22, designates the second URL included in the authentication page P1 as a destination, and sends it to the second authentication server 13 by the authentication application AP2. An authentication key is transmitted to request acquisition of a predetermined image.

  In the present embodiment, the web browser AP1 is executed by the first processing unit 23 and the authentication application AP2 is executed by the second processing unit 24. However, the present invention is not limited to this. The processing unit may execute both application programs.

  Further, the mobile terminal 20 has a communication function that can be connected to the network N and a function that can operate an application program.

  The web browser AP1 is a web page display program that partially or entirely complies with the W3C specifications operating on the mobile terminal 20. The web browser AP1 is a program that can display a web page using various web servers on the network N.

  Further, from the viewpoint of maintaining security, the program on the web page is generally restricted so that data cannot be acquired by making a request to other than the same domain / subdomain. The web browser AP1 according to the present embodiment can acquire data by making a request to other than the same domain / subdomain. However, the web browser AP1 executes (reads) a program (or a file that may contain a program) other than the same domain / subdomain without verifying the safety in advance, and the same domain / subdomain. It is assumed that it has a function of acquiring the image size to other than the above.

The authentication application AP2 is a program that runs on the mobile terminal 20. Further, it is assumed that the authentication application AP2 is in a state where the user can be identified before performing the main authentication.
The authentication page P1 is display data transmitted from the first authentication server 12 and partially or entirely compliant with W3C specifications, and is interpreted and executed by the web browser AP1.

The second authentication server 13 includes a determination unit 31 and a transmission unit 32 as shown in FIG.
The determination unit 31 determines the validity of the authentication key based on the authentication key transmitted from the mobile terminal 20.
When the determination unit 31 confirms the validity of the authentication key, the transmission unit 32 reads a predetermined image stored in the first storage unit 11 and transmits it to the mobile terminal 20.

  With this configuration, the second processing unit 24 transmits the predetermined image transmitted from the second authentication server 13 to the first processing unit 23 by the authentication application AP2.

  The first processing unit 23 acquires the image size of the predetermined image transmitted from the second processing unit 24 and the first authentication server 12 by the authentication page P1 operating by the web browser AP1. The image sizes corresponding to the predetermined image are compared to determine whether or not they match, and if they match, it is determined that the authentication application AP2 is a genuine application program.

  The authentication system 1 receives a predetermined image from the second authentication server 13 because the authentication key cannot be transmitted to the second authentication server 13 when the authentication application is not authentic. I can't. Accordingly, in such a case, the authentication system 1 cannot compare with the image size corresponding to the predetermined image included in the authentication page P1, and thus the installed authentication application AP2 is authentic. Judge that it is not an application program.

  In this way, the authentication system 1 can determine whether or not the installed authentication application AP2 is a genuine application program based on the authentication page P1 acquired by the web browser AP1. Therefore, if the authentication system AP2 can determine that the authentication application AP2 is authentic, it is proved that the authentication application AP2 is not a malicious application program. Therefore, ID authentication is automatically performed using the authentication application AP2. This can be performed, and the number of times the user inputs ID can be reduced.

  Further, since this authentication application AP2 uses a socket method instead of a plug-in method, there is an advantage that it can be used by any web browser AP1.

Further, in the authentication system 1, the probability of erroneous determination can be reduced to 1 / N ² by performing determination using an image of 1 × 1 to N × N size. Further, the authentication system 1 can further increase the probability of erroneous determination to 1 / M ² by increasing the maximum value of the image size from N to M. Furthermore, the authentication system 1 can set the probability of erroneous determination to (1 / N ² ) ^X by performing determination using an image X times.

  That is, the mobile terminal 20 receives a plurality of different image sizes having a small capacity from the first authentication server 12, performs a series of processes, and then receives a plurality of different images from the second authentication server 13. Whether the authentication application AP2 is authentic depending on whether the size of each image received from the second authentication server 13 matches the size of each image received from the first authentication server 12 or not. Judging.

  According to such a configuration, the authentication system 1 can dramatically reduce the probability of erroneous determination by performing determination using an image a plurality of times, and is practical while suppressing the transfer amount of image data. Authentication strength can be obtained.

Further, the second storage unit 22 stores a plurality of different web browsers AP1.
The first processing unit 23 reads and executes one web browser AP1 from the second storage unit 22, designates the first URL as a destination, and passes the network N to the first authentication server 12. , The information acquired from the first authentication server 12 is analyzed, and as a result of the analysis, the authentication page P1 including the image size corresponding to the predetermined image and the information of the second URL is displayed on the display unit 21. .

  The second storage unit 22 stores the downloaded web browser AP1 via the network N.

  Therefore, since the authentication application AP2 employs the socket method, the authentication system 1 can perform ID authentication using one web browser AP1 arbitrarily selected from a plurality of different web browsers AP1.

  When the first processing unit 23 determines that the authentication application AP2 is a genuine application program, the first processing unit 23 requests acquisition of a predetermined application program by the authentication page P1 displayed on the display unit 21 by the web browser AP1. To do.

  The second processing unit 24 transmits a predetermined application program to the first processing unit 23 by the authentication application AP2 in accordance with the request.

  Therefore, in the authentication system 1, if it can be determined that the authentication application AP2 is authentic, it is proved that the authentication application AP2 is not a malicious application program. Therefore, the predetermined authentication information AP2 transmitted from the authentic authentication application AP2 is used. The application program can be executed as it is without verifying safety or the like in advance.

Next, the flow of processing when the authentication system 1 determines the validity of the authentication application AP2 will be described in detail with reference to FIG.
In step ST1, the web browser AP1 accesses the first authentication server 12 and acquires the authentication page P1. The authentication page P1 includes information on the image size corresponding to the predetermined image and the second URL. Whether the authentication page P1 matches the image size acquired from the first authentication server 12 with the image size of the image acquired from the second authentication server 13 via the authentication application AP2. A program to judge is also included.

  In step ST2, the authentication application AP2 acquires the second URL included in the authentication page P1.

  In step ST3, the authentication application AP2 gives an authentication key, accesses the second authentication server 13 through the second URL, and makes an image acquisition request.

  In step ST4, the second authentication server 13 confirms the validity of the authentication key, and then transmits an image having an image size corresponding to the image key to the portable terminal 20.

  In step ST5, the authentication application AP2 transmits the image transmitted from the second authentication server 13 to the authentication page P1.

  In step ST6, the authentication page P1 determines whether or not the image size of the image acquired in step ST5 matches the image size acquired in step ST1. If the authentication page P1 determines that the image sizes match, the authentication page AP1 determines that the authentication application AP2 is a genuine application program.

  Note that even if the execution program is transmitted from the authentication application AP2 together with the image, the authentication page P1 does not execute the execution program because the validity of the authentication application AP2 has not yet been confirmed.

  In this way, the authentication system 1 can confirm the validity of the authentication application AP2 in a limited environment of the web browser AP1.

  Next, as described above, after confirming the validity of the authentication application AP2, the flow of processing when executing the execution program by the authentication system 1 will be described with reference to FIG. In the following embodiments, it is assumed that the execution program is a program in which a user ID is programmed in a predetermined format (CSS (Cascading Style Sheets), JavaScript (registered trademark), image, etc.). Not limited to this.

  In step ST11, the authentication page P1 requests the authentication application AP2 to acquire an execution program.

  In step ST12, the authentication application AP2 transmits the execution program to the authentication page P1.

  Here, the authentication application AP2 reads information stored in the mobile terminal 20 in response to the request for the authentication page P1 (for example, IMEI (International Mobile equipment Identifier), IMSI (International Mobile Subscriber Identity), etc.). A configuration (configuration 1) that is embedded in the execution program and transmitted to the authentication application AP2 may be employed.

  Further, the authentication application AP2 may be configured to prompt the user to input a password in response to a request for the authentication page P1, embed the input password in an execution program, and transmit the password to the authentication application AP2 (Configuration 2). .

  Further, the authentication application AP2 may have the following configuration (configuration 3). In response to the request for the authentication page P1, the authentication application AP2 accesses a server corresponding to a predetermined URL included in the request, assigns an authentication key, and makes an execution program acquisition request. The server transmits the requested execution program to the mobile terminal 20 after confirming the validity of the authentication key. The authentication application AP2 transmits the execution program transmitted from the predetermined server to the authentication page P1.

  In response to the request for the authentication page P1, the authentication application AP2 issues an instruction to the user to bring the IC card close to a predetermined distance via the display unit 21, and uses the RFID function from the adjacent IC card. Then, a configuration (configuration 4) in which the data is read, the read data is embedded in the execution program, and transmitted to the authentication application AP2 may be used.

  Note that the mobile terminal 20 may include all of the configurations 1 to 4 described above, and in this case, two or more may be used together as necessary.

  In this way, the authentication system 1 confirms the validity of the authentication application AP2 in the limited environment of the web browser AP1, and immediately regards the execution program acquired through the authentication application AP2 as a safe program. Can be executed.

  Further, the authentication application AP2 waits for ServerSocket when communicating with the website, and can communicate by performing localhost access from the website.

  Since the authentication application AP2 requires a cross-domain request, access means are limited from the website, and the authentication application AP2 normally uses a JSONP format or the like capable of transferring data. At this time, if a malicious application in the portable terminal 20 is waiting at the same port, an arbitrary code can be executed on the website, which causes a problem.

  The authentication system 1 according to the present invention makes a request to acquire an image from the authentication page P1 to the authentication application AP2 in the mobile terminal 20 with the URL including the authentication key from the authentication page P1 before performing the JSONP access, and supports the URL The authenticity of the authentication application AP2 is authenticated using the image acquired from the authentication server. In this way, since the authentication system 1 secures a safe communication path before performing the JSONP access, communication between the authentication application AP2 and the website can be performed safely, and the above-described problems occur. Absent.

  The authentication system 1 can be used, for example, when accessing a website for purchasing a product and purchasing the product, or when accessing and logging in to a website that requires a login password.

  In addition, since the authentication system 1 uses a valid authentication application AP2, the expiration date is longer than the method of managing the ID password by the web browser, and it is possible to omit a periodic ID password input operation and the like. it can.

  Further, since the authentication application AP2 adopts the socket method, there is an advantage that the authentication application AP2 operates without selecting a web browser and is not affected even if the version of the web browser is changed.

DESCRIPTION OF SYMBOLS 1 Authentication system 10 Server 11 1st memory | storage part 12 1st authentication server 13 2nd authentication server 20 Portable terminal 21 Display part 22 2nd memory | storage part 23 1st process part 24 2nd process part 31 Determination part 32 Transmitter

Claims (3)

In an authentication system that performs predetermined communication between a mobile terminal and a server via a network,
The server
A first storage unit that stores a predetermined image and an image size corresponding to the predetermined image;
A first authentication server corresponding to the first URL;
A second authentication server corresponding to the second URL;
The portable terminal is
Analyzing data acquired via the network and displaying the result of the analysis on the display unit, an authentication application program for performing authentication, a second storage unit for storing a unique authentication key,
The first URL is designated as a destination, the browsing application program connects to the first authentication server via the network, analyzes the information acquired from the first authentication server, and analyzes the information As a result, a first processing unit that displays an authentication page including an image size corresponding to a predetermined image and information on the second URL on the display unit;
Read the authentication key from the second storage unit, specify the second URL included in the authentication page as a destination, and transmit the authentication key to the second authentication server by the authentication application program And a second processing unit that requests acquisition of the predetermined image,
The second authentication server is
A determination unit that determines the validity of the authentication key based on the authentication key transmitted from the mobile terminal;
A transmission unit that reads the predetermined image stored in the first storage unit and transmits it to the mobile terminal when the determination unit confirms the validity of the authentication key;
The second processing unit transmits the predetermined image transmitted from the second authentication server to the first processing unit by the authentication application program,
The first processing unit uses the authentication page to transmit an image size of the predetermined image transmitted from the second processing unit and an image size corresponding to the predetermined image included in the authentication page. An authentication system that determines whether or not they match, and if they match, determines that the authentication application program is a genuine application program. The second storage unit stores a plurality of different browsing application programs,
The first processing unit reads and executes one browsing application program from the second storage unit, designates the first URL as a destination, and transmits the first URL via the network. Connect to the authentication server, analyze the information acquired from the first authentication server, and, as a result of the analysis, an authentication page including an image size corresponding to a predetermined image and information of the second URL is displayed on the display unit. The authentication system according to claim 1 to be displayed. When the first processing unit determines that the authentication application program is a genuine application program, the first processing unit obtains a predetermined application program from the authentication page displayed on the display unit by the browsing application program. Request,
The authentication system according to claim 1, wherein the second processing unit transmits the predetermined application program to the first processing unit by the authentication application program according to the request.

Images