WO2006114906A1 - Service providing system, service utilization device, service providing device, service relay device, authentication method, authentication program, and recording medium for the program - Google Patents

Abstract

At the initial authentication, a portable telephone (service utilization device)(10) sends non-encrypted authentication information (user ID, password) inputted by a user to a server (service providing device)(20), and the server (20) performs authentication processing based on the non-encrypted authentication information received from the portable telephone (10). Then, when the authentication processing is succeeded, the server (20) encrypts the authentication information and returns the result to the portable telephone (10). The portable telephone (10) memorizes the encrypted authentication information received from the server (20). After that, when service is requested to the server (20) the next time onward, the portable telephone (10) sends the encrypted information memorized as above to the server (20), and the server (20) decrypts the received encrypted information to perform authentication processing. In a service providing system including both the service utilization device and the service providing device for providing service to the service utilization device, burden on a user performing input operation of authentication information is reduced and security on authentication information can be enhanced.

Description

 Specification

 Service providing system, service using device, service providing device, service relay device, authentication method, authentication program, and recording medium thereof

 Technical field

 The present invention relates to an authentication method for authenticating a user of a service using device in a service providing system including a service using device and a service providing device that provides a service to the service using device, The present invention relates to a service providing system, an information terminal device, a service providing device, a service relay device, an authentication program for causing a computer to execute the authentication method, and a recording medium thereof.

 Background art

 [0002] Conventionally, technologies for providing various services from a service providing device on a network such as the Internet to an information terminal device (service using device) such as a personal computer or a mobile phone connected via the network Is used.

 [0003] Among these services, for example, there are services that provide services only to users who have registered in advance. In this case, generally, prior to providing the service, the service providing apparatus performs user authentication processing based on authentication information such as a user ID (user name) and password that has received the power of the connected information terminal apparatus.な っ て Service is provided only when authentication is successful!

 FIG. 12 is an explanatory diagram showing an example of a conventional service providing system that performs user authentication. A service providing system 100 shown in this figure includes a mobile phone 101 and a service providing apparatus 102. The mobile phone 101 and the service providing apparatus 102 are connected via the Internet. In addition, the service providing apparatus 102 stores a combination of a user ID and a password set in advance for a user permitted to provide the service.

When the user of the mobile phone 101 uses the service of the service providing device 102, the user inputs the user ID and password to the mobile phone 101 and transmits it to the service providing device 102. When the service providing device 102 receives the user ID and password from the mobile phone 101, the service providing device 102 provides the combination of the received user ID and password, and provides the service. The user ID and password combination stored in the device 102 are collated. If they match, the user is authenticated as a user who is permitted to provide the service, and the contents of the provided service are transmitted to the mobile phone 101.

 [0006] Japanese Patent Laid-Open Publication No. 2001-320366 (published on November 16, 2001) discloses a server via the Internet so as to eliminate password mistakes in portable information terminals. A technology has been disclosed in which a personal information terminal that exchanges information with the sano has a means for entering a password in a text field and authenticating the password.

 [0007] Also, Microsoft, “Save time with autocomplete”, Internet <UR L: http: / 1 www.microsoft.com/ windows / ie_intl / en / using / howto / customizing / autocom plete.mspx>, Released on March 16, 2003, [Search April 13, 2005] stores information once entered by the user in a web browser used on a personal computer, and stores the information when new information is entered. On the basis of this, a technique called autocomplete is described, in which the user's input contents are predicted to display possible matching items. Also, it is suggested that you complete the above autocomplete!

 [0008] However, in the conventional technique, it is necessary to input a user ID and a password every time a service is used, which is very troublesome. In particular, in an information terminal device such as a mobile phone, generally, a character to be input is specified by pressing one key multiple times, and it is very troublesome to input a user ID and a password each time.

 [0009] Although the above-mentioned technique of "saving time by auto-complete" reduces the input operation by auto-complete, it is necessary to perform the input operation every time. The problem of power cannot be solved essentially.

[0010] In addition, in each of the conventional technologies described above, when the user ID or password is entered, the input content of the surrounding force is stolen, or the user ID or password is transmitted in the transmission path between the information terminal and the server. There are security issues such as passwords being eavesdropped. In addition, with the above-mentioned technology of “saving time by auto-complete”, information such as user ID and password is stored in the browser as it is entered, so the user ID and password are leaked to third parties. There is a high risk of Disclosure of the invention

 [0011] The present invention has been made in view of the above problems, and an object thereof is a service providing system including a service using device and a service providing device that provides a service to the service using device. This is to reduce the authentication information input operation by the user and to increase the security of the authentication information.

 [0012] In order to solve the above problems, the first service providing system of the present invention provides a predetermined service in response to a request for a service using device and a service using device connected via a network. A service providing system including a service providing device, wherein the service using device stores an input unit that receives an input instruction from a user for specifying a requested service and the received encrypted authentication information An encryption storage unit, and a utilization device control unit that transmits encrypted authentication information corresponding to the requested service to the service providing device that provides the requested service, wherein the service providing device provides the service The authentication information storage unit for storing the authentication information of the user who permits the authentication and the authentication information of the user who has requested the provision of the service are An authentication processing unit that performs an authentication process for collating with authentication information of a user permitted to provide a service stored in the storage unit, a decryption unit that decrypts the encrypted authentication information to create decrypted authentication information, and a service usage When receiving the encrypted authentication information from the apparatus, the decryption key unit decrypts the received encrypted authentication information, and the authentication processing unit performs the authentication process of the decryption key authentication information obtained by the decryption key. And a providing device control section to be executed.

 [0013] According to the above configuration, when the use device control unit requests provision of a service, the use device control unit transmits the encrypted authentication information to the service providing device. The service providing apparatus decrypts the received encrypted authentication information and performs authentication processing. For this reason, the user does not need to perform an operation of inputting authentication information corresponding to the requested service every time a service is requested as in the prior art, so that the convenience of authentication processing can be improved.

[0014] According to the configuration described above, encrypted authentication information is stored in the service using apparatus. For this reason, even if the storage area of the service using device is analyzed, for example, the authentication information related to the service is not stolen. Therefore, the security information The utility (safety) can be increased.

 [0015] In order to solve the above problems, a second service providing system of the present invention provides a service using device and a service providing device that provides the service using device with a service requested by the service using device via a network. A service relay device connected to the service relay device and a service providing device connected to the service relay device via a network, wherein the service using device is a user for specifying a requested service. An input unit that receives an input instruction, a cryptographic storage unit that stores the received cryptographic key authentication information, a utilization device control unit that transmits the cryptographic key authentication information corresponding to the requested service to the service relay device, The service providing apparatus includes an authentication information storage unit that stores authentication information of a user who is permitted to provide the service. An authentication processing unit that performs an authentication process for verifying authentication information received from a service relay device with authentication information of a user permitted to provide a service stored in the authentication information storage unit. The service relay device decrypts the encrypted authentication information to create the decrypted authentication information, and when receiving the encrypted authentication information from the service using device, the encrypted relay information is sent to the decryption unit. A relay control unit that decrypts and transmits the decryption key authentication information obtained by the decryption key to a service providing device that provides a service requested by the service using device that has transmitted the cipher key authentication information; It is characterized by being equipped with.

 [0016] According to the above configuration, the utilization device control unit transmits the encrypted authentication information to the service relay device when requesting the provision of a service. Then, the service relay device decrypts the received encrypted authentication information and transmits it to the service providing device, and the service providing device performs an authentication process on the decrypted key authentication information received from the service relay device. For this reason, the user does not need to perform an operation of inputting authentication information corresponding to the requested service every time the service is requested, so that the convenience of the authentication processing can be improved.

[0017] According to the above configuration, encrypted authentication information is stored in the service using device. For this reason, even if the storage area of the service using device is analyzed, for example, the authentication information related to the service is not stolen. Therefore, the security (security) regarding authentication information can be improved. [0018] Other objects, features, and advantages of the present invention will be fully understood from the following description. The advantages of the present invention will be apparent from the following description with reference to the accompanying drawings.

 Brief Description of Drawings

 [FIG. 1 (a)] is an explanatory diagram showing a schematic configuration of a service providing system according to an embodiment of the present invention.

 FIG. 1 (b) is an explanatory diagram showing a schematic configuration of a service providing system according to an embodiment of the present invention.

 FIG. 2 is a block diagram showing a schematic configuration of a service using apparatus and a service providing apparatus that constitute a service providing system according to an embodiment of the present invention.

 FIG. 3 is a flowchart showing a flow of initial authentication processing in a service providing system according to an embodiment of the present invention.

 FIG. 4 is a flowchart showing the flow of authentication processing for the second and subsequent times in the service providing system according to one embodiment of the present invention.

FIG. ⁵ (a) is an explanatory diagram showing a schematic configuration of a service providing system according to another embodiment of the present invention.

 [FIG. 5 (b)] is an explanatory view showing a schematic configuration of a service providing system according to another embodiment of the present invention.

 FIG. 6 is a block diagram showing a schematic configuration of a service utilization device, a service relay device, and a service provision device that constitute a service provision system according to another embodiment of the present invention.

 FIG. 7 is a flowchart showing a flow of initial authentication processing in a service providing system according to another embodiment of the present invention.

 FIG. 8 is a flowchart showing the flow of authentication processing for the second and subsequent times in the service providing system according to another embodiment of the present invention.

 FIG. 9 (a) is an explanatory diagram showing a schematic configuration of still another service providing system of the present invention.

 FIG. 9 (b) is an explanatory diagram showing a schematic configuration of still another service providing system of the present invention.

FIG. 10 is a flowchart showing a flow of initial authentication processing in a service providing system according to still another embodiment of the present invention. FIG. 11 is a flowchart showing a flow of authentication processing for the second and subsequent times in a service providing system according to still another embodiment of the present invention.

 FIG. 12 is an explanatory diagram showing an example of a conventional service providing system.

 FIG. 13 is an explanatory diagram showing a schematic configuration of still another service providing system according to the present invention.

 14 is a block diagram showing a schematic configuration of a service using device, a service providing device, and a broadcast base station that constitute the service providing system shown in FIG.

 FIG. 15 is a flowchart showing a process flow in the service providing system shown in FIG. 13.

 FIG. 16 is an explanatory diagram showing a modification of the service providing system shown in FIG.

 FIG. 17 is an explanatory diagram showing a modification of the service providing system shown in FIG.

 FIG. 18 is an explanatory diagram showing a schematic configuration of still another service providing system according to the present invention.

 FIG. 19 is a block diagram showing a schematic configuration of a service using device, a service providing device, a service relay device, and a broadcast base station that constitute the service providing system shown in FIG.

 FIG. 20 is a flowchart showing the flow of processing in the service providing system shown in FIG.

 BEST MODE FOR CARRYING OUT THE INVENTION

[Embodiment 1]

 An embodiment of the present invention will be described with reference to the drawings. FIG. 1 (a) and FIG. 1 (b) are explanatory diagrams showing a schematic configuration of a service providing system 1 according to the present embodiment.

As shown in these drawings, the service providing system 1 includes a mobile phone (information terminal device, service using device) 10 and a server (service providing device) 20, and these power interfaces It is connected to be able to communicate via a network such as the Internet.

[0022] The server 20 provides a service to a service using device. Here, the services provided by the server 20 include, for example, a blog providing service that provides a blog (blog, Weblog; a general term for a diary-like website updated daily), a book author, publisher, price, etc. A book information providing service that provides information, an online storage service that stores image data, photo data, etc. sent from an information terminal device can be considered. Of course, these services are provided by the service delivery system 1 It is only an example of a service that can be used, and a variety of other services are possible.

 In addition, in FIG. 1 (a) and FIG. 1 (b), only one server 20 is depicted. Many servers 20 are connected on the network, and each server 20 has a predetermined service. Is to provide.

FIG. 2 is a block diagram showing a schematic configuration of the mobile phone 10 and the server 20.

As shown in FIG. 2, the mobile phone 10 includes a control unit 11, a communication unit 12, a display unit 13, an input unit 14, an encryption storage unit 15, a ROM 16, and a RAM 17.

The control unit 11 is a central part of the mobile phone 10 that controls the operation of each component in the mobile phone 10.

 [0027] ROM (Read Only Memory) 16 includes various programs used by the control unit 11.

 This is a memory for storing (such as a program for authentication processing).

 [0028] A RAM (Random Access Memory) 17 is a primary storage unit used by the control unit 11, and temporarily stores various types of information handled by the control unit 11. Further, the control unit 11 reads the program in the ROM 16 into the RAM 17 when using the program.

 [0029] The communication unit 12 communicates with an external device connected through the Internet. In the present embodiment, the mobile phone 10 performs two-way communication with the server 20 via the communication unit 12! /.

[0030] The display unit 13 displays various information and presents it to the user. The display means used as the display unit 13 is not particularly limited, but for example, a liquid crystal display panel or the like is used.

[0031] The input unit 14 receives various instructions from the user. The mobile phone 10 is provided with an input unit 14 that also has a plurality of keys (operation buttons), and the user operates these keys in combination to input characters, numbers, symbols, etc. Various processes to be executed by the telephone 10 can be selected. The configuration of the input unit 14 is not limited to this, and various input means such as a keyboard, mouse pointer, jog dial, pen input device, touch panel, and voice input can be used. These input means may be those provided in the mobile phone 10 or may be provided to the mobile phone 10. Then, they may be connected by radio or wire.

 The encryption storage unit 15 stores encryption information received from the server 20, that is, authentication information such as a user ID (user name) and a password encrypted by the server 20.

As shown in FIG. 2, the server 20 includes a server control unit 21, a communication unit 22, an authentication processing unit 23, an encryption unit 24, a decryption unit 25, an authentication information storage unit 26, a ROM 27, and a RAM 28. I have.

 The server control unit 21 is a central part of the server 20 that controls the operation of each component in the server 20.

 A ROM (Read Only Memory) 27 is a memory for storing various programs (such as a program for authentication processing) used by the server control unit 21.

 A RAM (Random Access Memory) 28 is a primary storage unit used by the server control unit 21 and temporarily stores various information handled by the server control unit 21. In addition, when using the program in the ROM 27, the server control unit 21 reads this into the RAM 28! /.

 [0037] The communication unit 22 communicates with an external device (such as an information terminal device) connected through the Internet. In the present embodiment, the server 20 performs two-way communication with the mobile phone 10 via the communication unit 22.

 The authentication information storage unit 26 stores a combination (non-encrypted authentication information) of a user ID and a password set in advance for a user who is permitted to provide a service from the server 20. The preset authentication information may be input (set) by an input means (not shown) provided in the server 20, or may be from an information processing terminal (mobile phone 10 in the present embodiment). It may be configured to be input (set) via the communication unit 22.

[0039] The authentication processing unit 23 sets (registers) a user who requests the provision of a service from the information terminal device connected via the communication unit 22 as a user permitted to provide the service. It is verified whether or not the user is a force. Specifically, the authentication processing unit 23 has a preset user ID and password (unencrypted authentication information) received through the communication unit 22 and the authentication information storage unit 26. Authentication information Check the information. Then, when the collation results of both match, the user who requests service provision via the communication unit 22 is authenticated as a user who is permitted to provide the service.

 [0040] The encryption key unit 24 encrypts the authentication information received by the service using device through the communication unit 22. The encryption method is not particularly limited.

[0041] The decryption unit 25 decrypts the encrypted authentication information (encrypted authentication information) received from the service using apparatus via the communication unit 22.

[0042] Next, authentication processing in the service providing system 1 (operation during authentication processing of the mobile phone 10 and the server 20) will be described. In the following description, it is assumed that authentication information (user ID and password) of a user permitted to provide a service is registered (stored) in the authentication information storage unit 26 of the server 20 in advance.

First, the initial authentication process in the service providing system 1 will be described with reference to FIG. FIG. 3 is a flowchart showing the flow of the initial authentication process.

[0044] First, the control unit 11 of the mobile phone 10 accepts a selection instruction of the server 20 that requests the provision of service, in which user power is also input via the input unit 14 (Sl). That is, a selection instruction for selecting a server 20 that provides a desired service from one or more servers 20 that can be connected via a network is accepted.

[0045] Upon receiving the selection instruction of the server 20 in S1, the control unit 11 searches the encryption storage unit 15, and the encryption authentication information corresponding to the server 20 to be selected (or the encryption key corresponding to the requested service). It is determined whether or not (authentication information) is stored (S2). Details of the encryption authentication information will be described later.

[0046] When the corresponding encryption recognition information is stored in the cipher storage unit 15, the first authentication process is not necessary, so the second and subsequent authentication processes (see FIG. 4) described later are performed (see FIG. 4). S3

) o

 [0047] On the other hand, if it is determined in S2 that the corresponding encrypted authentication information is not stored in the encryption storage unit 15, the control unit 11 performs the initial authentication process described below (S4 to S4 in the mobile phone 10). The process of S9 and the process of S21 to S26 in the server 20 are performed.

[0048] In this case, the control unit 11 receives initial authentication information input from the user via the input unit 14. (User ID and password) are accepted (S4). In this case, the control unit 11 may cause the display unit 13 to display an image for prompting input of the initial authentication information as necessary. Table 1 shows an example of authentication information (user ID and password) input via the input unit 14.

[0049] [Table 1]

Next, the control unit 11 transmits the initial authentication information received in S4 to the server 20 that requests service provision (S5). At this point, the initial authentication information is unencrypted authentication information that is not encrypted.

[0051] When the server control unit 21 of the server 20 receives the initial authentication information transmitted from the mobile phone 10 via the communication unit (service authentication window) 22 (S21), the server control unit 21 performs authentication processing of the initial authentication information. (S22) ₀ Specifically, the initial authentication information received from the mobile phone 10 and the preset authentication information stored in the authentication information storage unit 26 are collated.

 Then, the server control unit 21 determines whether or not the collation results of the two match as a result of the authentication processing in S22, that is, whether or not the authentication is successful (S23).

 If it is determined in S23 that the authentication has failed, the server control unit 21 transmits a signal (information) indicating that the authentication has failed to the mobile phone 10, and notifies the authentication failure (S24).

 On the other hand, if it is determined in S23 that the authentication has succeeded, the server control unit 21 causes the encryption unit 24 to encrypt the authentication information and create encrypted authentication information (S25). The encryption method is not particularly limited. Table 2 is an example of encryption authentication information obtained by encrypting the authentication information shown in Table 1 by the encryption unit 24.

[0055] [Table 2] (User ID% iIF3i) #Ro # $ #

 No Sword% 0g09j40-982

Next, the server control unit 21 returns the encryption key authentication information created by the processing of S25 to the mobile phone 10 via the communication unit 22 (S26).

 On the other hand, when receiving the information returned from server 20 (S 6), control unit 11 of mobile phone 10 determines whether the received information is an authentication failure notification (S 7).

 [0058] When it is determined that the received information is an authentication failure notification, that is, when it is determined that the received information is not encryption authentication information, the control unit 11 indicates that the authentication processing has failed and the authentication A question as to whether or not to continue processing is displayed on the display unit 13 (not shown). If the input unit 14 is instructed not to continue the authentication process, or if no instruction is given, the authentication process ends. If the input unit 14 is instructed to continue the authentication process, the process from S4 is performed again. Or, omit the instruction to continue and allow the user to re-enter the authentication information for the first time when continuing the authentication process.

 [0059] If it is determined in S7 that the received information is not an authentication failure notification, that is, if it is determined that the received information is encrypted authentication information, the control unit 11 The received encrypted authentication information is stored in the encryption storage unit 15 in association with information for identifying the server 20 (or service corresponding to the encrypted authentication information) corresponding to the encrypted authentication information (S9). This completes the initial authentication process.

 [0060] Next, the second and subsequent authentication processes, that is, encryption key recognition information corresponding to the requested service (or the server 20 providing the requested service) is stored in the encryption storage unit 15. The authentication process in the case of being present will be described with reference to FIG. Fig. 4 is a flowchart showing the flow of authentication processing for the second and subsequent times.

First, the control unit 11 of the mobile phone 10 performs the processes S1 and S2 described in FIG. In S2, the encryption key authentication information corresponding to the server 20 to be selected (or requested) If it is determined that the encryption authentication information corresponding to the service is not stored, the control unit 1

1 performs the above-described initial authentication process (the process after S4 in FIG. 3).

[0062] On the other hand, when it is determined that the corresponding encryption key information is stored in S2, the control unit 11 performs the second and subsequent authentication processes (S31 to S10 in the mobile phone 10) described below. The process of S34 and the process of S41 to S44 in the server 20 are performed.

In this case, the control unit 11 first reads out the corresponding encryption authentication information stored in the encryption storage unit 15 (S31).

Next, the control unit 11 receives input of service request information input via the input unit 14 (S32). Here, the service request information is various information necessary for requesting the provision of service.

Next, the control unit 11 transmits the encryption key authentication information read in S31 and the service request information received in S32 to the server 20 via the communication unit 12 (S33).

[0066] Table 3 shows an example of encryption authentication information and service request information when a blog providing service is requested. In the example shown in this table, the service identifier and the URL of the blog to be acquired correspond to the service request information.

[0067] [Table 3]

[0068] Upon receiving the encrypted authentication information and the service request information from the mobile phone 10 via the communication unit 22 (S41), the server control unit 21 of the server 20 receives the encrypted key authentication information received by the decryption key unit 25. Is decrypted (S42).

Next, the server control unit 21 performs an authentication process on the decrypted authentication information (S43). Specifically, the authentication information received and decrypted from the mobile phone 10 is collated with preset authentication information stored in the authentication information storage unit 26. Since the decrypted authentication information is authentication information that has been successfully authenticated during the initial authentication process, the authentication information storage unit 26 stores the decrypted authentication information. As long as the stored authentication information has not been rewritten thereafter, it always matches. Here, if such rewriting is not performed, if rewriting is performed, authentication failure may be notified to the mobile phone, and the initial authentication processing may be performed again (not shown). )

 [0070] After performing the authentication process of S43 (after confirming the authentication success), the server control unit 21 transmits the service content to be provided to the mobile phone 10 (S44).

 [0071] The control unit 11 of the mobile phone 10 receives the service provided from the server 20 (S34) and stores the received content in the RAM 17 or displays it on the display unit 13 to perform necessary processing. . This completes the second and subsequent authentication processing and service reception processing.

 As described above, in the present embodiment, when the server 20 receives the initial authentication information from the mobile phone 10, it performs an authentication process on the received initial authentication information. When the initial authentication is successful, the server 20 encrypts the initial authentication information to create encrypted authentication information and transmits it to the mobile phone 10. Then, the mobile phone 10 stores the encrypted authentication information received from the server 20. When the server 20 requests service from the next time onward, the encrypted authentication information stored as described above is transmitted from the mobile phone 10 to the server 20, and the encrypted authentication information received by the server 20 is transmitted. The authentication process is performed by decrypting the above.

 [0073] Thus, the user of the mobile phone (service utilization device) 10 only needs to input authentication information (user ID and password) during the initial authentication process. That is, when the user uses the service provided by the server (service providing apparatus) 20 using the mobile phone 10, it is not necessary to input authentication information every time. Therefore, the convenience of the user when using the service can be improved.

 [0074] Further, since the encrypted authentication information is stored in the mobile phone 10, for example, even if the storage area of the mobile phone 10 is analyzed, the authentication information for the server 20 leaks (is stolen). There is no. Therefore, the security (safety) related to the authentication information can be enhanced by the authentication method that works on the present embodiment.

In the present embodiment, the case where the mobile phone 10 requests the server 20 to provide the service has been described. However, the server (service providing apparatus) 20 that can request the mobile phone 10 to provide the service includes: It is not limited to one. In other words, from mobile phone 10 to the Internet Select the server that provides the desired service from the multiple servers 20 that can be connected via the work, and request the service to be provided.

 In addition, in this way, in the case of realizing an authentication method that works on the present embodiment between the mobile phone 10 and the plurality of servers 20, authentication information (user ID and password) set in advance in each server 20. ) May be different for each server (or for each service to be used).

 Further, in the present embodiment, at the time of initial authentication, initial authentication information (unencrypted authentication information) is transmitted from the mobile phone 10 to the server 20, and if the authentication process in the server 20 is successful, the server 20 The encryption key authentication information is returned to the mobile phone 10. However, the present invention is not limited to this. For example, during the initial authentication, the initial authentication information and the service request information are transmitted from the mobile phone 10 to the server 20 and provided together with the encryption key authentication information when the server 20 succeeds in the authentication process. The content of the service to be sent may be sent from the server 20 to the mobile phone 10.

 In this embodiment, the power for encrypting both the user ID and the password is not necessarily limited to this. For example, only one of them may be encrypted. Yes.

 In this embodiment, a user ID and a password are used as authentication information. However, the present invention is not limited to this. For example, each mobile phone (service utilization device) is changed into a user ID and a password. ) A terminal ID unique to 10 may be used as authentication information. In this case, even if the encryption key recognition information is leaked to a third party, other information processing terminals (service usage devices) can use the service using the encryption key authentication information. Absent. Therefore, the security related to the authentication information can be further improved.

In this case, the terminal ID may be information unique to the terminal. For example, the telephone number, the line contract number, the manufacturing number, etc. of the mobile phone 10 can be used. Since the terminal ID is information unique to each mobile phone 10, for example, it may be stored in the ROM 16 and read out by the control unit 11. In this case, the user does not need to input the terminal ID. Further, when the terminal ID is included in the authentication information, the terminal ID may be encrypted. Table 4 shows an example of the initial authentication information sent from the mobile phone 10 to the server 20 during the initial authentication process when the serial number of the mobile phone 10 is used as the terminal ID. The

 [0081] [Table 4]

In this embodiment, the initial authentication information transmitted from the mobile phone 10 to the server 20 at the time of initial authentication is non-encrypted authentication information that is not encrypted, but is not limited thereto. It is not a thing. For example, the mobile phone 10 is provided with an encryption means and the server 20 is provided with a corresponding decryption means. At the time of initial authentication, the initial authentication information is encrypted with the mobile phone 10 and the mobile phone 10 encrypts it to the server 20. It is also possible to transmit the entered initial authentication information and decryption information for decrypting it. In this case, the encrypted initial authentication information transmitted from the mobile phone 10 to the server 20 at the time of the initial authentication is the same as the encrypted authentication information transmitted from the server 20 to the mobile phone 10 after the initial authentication is successful. There is no need.

 In this embodiment, the authentication information is encrypted when the initial authentication process is successful, and the authentication information encrypted at this time is used continuously thereafter. This is not a limitation. For example, in the second and subsequent authentication processes, the encryption key process may be executed again each time the authentication process is successful, and the encryption key authentication information different from the previous time may be transmitted to the mobile phone 10. Also, update the encrypted authentication information (re-encryption) every time a predetermined number of authentication processes are executed, and send the encryption authentication information different from the previous one to the mobile phone 10.

 [Embodiment 2]

 Another embodiment of the present invention will be described with reference to the drawings. For convenience of explanation, members having the same functions as those described in the first embodiment are denoted by the same reference numerals as those in the first embodiment, and the description thereof is omitted.

FIG. 5 (a) and FIG. 5 (b) are explanatory diagrams showing a schematic configuration of the service providing system 2 that works on the present embodiment. As shown in these figures, the service providing system 2 is a mobile phone. (Information terminal device) 10, server (service providing device) 30, and relay server (service relay device) 40. Further, the mobile phone 10 and the relay server 40, and the relay server 40 and the server 30 are connected to each other via a network such as the Internet.

 FIG. 6 is a block diagram showing a schematic configuration of the mobile phone 10, the relay server 40, and the server 30. The configuration of the mobile phone 10 is the same as that of the first embodiment.

The relay Sano 0 relays between the mobile phone 10 and the server 20, and as shown in FIG. 6, the relay server control unit 41, the communication unit 42, the encryption unit 43, and the decryption unit 44 , A server identification information storage unit 45, a ROM 46, and a RAM 47 are provided.

The relay server control unit 41 is a central part of the relay server 40 that controls the operation of each component in the relay server 40.

A ROM (Read Only Memory) 46 is a memory for storing various programs (programs such as encryption process, decryption process, and server identification process) used by the relay server control unit 41.

A RAM (Random Access Memory) 47 is a primary storage unit used by the relay server control unit 41, and temporarily stores various types of information handled by the relay server control unit 41. Further, the relay server control unit 41 reads the program in the ROM 46 into the RAM 47 when using the program in the ROM 46! /.

[0091] The communication unit 42 communicates with a service using device (mobile phone 10 in the present embodiment) and a service providing device (server 30 in the present embodiment) connected through the Internet. In this embodiment, the relay server 40 performs bidirectional communication between the mobile phone 10 and the server 30 via the communication unit 42.

The encryption key unit 43 encrypts the authentication information that has also received the service using device capability via the communication unit 42. The encryption method is not particularly limited.

When receiving the encrypted authentication information (encrypted authentication information) from the service using apparatus via the communication unit 22, the decryption key unit 44 decrypts it.

[0094] The server identification information storage unit 45 has information (services) for identifying services provided by each server 30 for one or more servers 30 that are communicably connected via the Internet. Identifier) and the destination of each server 30 are stored in association with each other.

 The server 30 provides a service to the service using device such as the mobile phone 10 via the relay server 40. The service provided by the server 30 is the same as that of the server 20 in the first embodiment. In addition, in FIG. 5 (a) and FIG. 5 (b), only one server 30 is depicted, but a large number of servers 30 are connected on the network, and each server 30 is a predetermined server 30. I started to provide services.

 Note that the server 30 includes an encryption key unit and a decryption key unit, and is different from the server 20 in the first embodiment in that respect. Further, the point that the communication unit 22 does not directly communicate with the mobile phone 10 but communicates with the relay server 40 is different from the first embodiment.

 [0097] Next, authentication processing in the service providing system 2 (operation at the time of authentication processing of the mobile phone 10, the relay server 0, and the server 30) will be described. It is assumed that authentication information (user ID and password) of a user permitted to provide a service is registered (stored) in the authentication information storage unit 26 of the server 30 in advance.

 First, the initial authentication process in the service providing system 2 will be described with reference to FIG. FIG. 7 is a flowchart showing the flow of the initial authentication process.

 [0099] First, the control unit 11 of the mobile phone 10 receives an instruction to select a service to be used, in which user power is also input via the input unit 14 (S51). In other words, it accepts a selection instruction for selecting a desired service among the services provided by one or more servers 20 connectable via a network. Then, the control unit 11 generates information (service identifier) that identifies the selected service (not shown). Alternatively, the user may directly input information (service identifier) for specifying a desired service via the input unit 14.

 [0100] Next, the control unit 11 searches the encryption storage unit 15 and determines whether or not the encryption authentication information corresponding to the service selected in S51 is stored (S52).

 [0101] Then, when the corresponding cipher key recognition information is stored in the cipher storage unit 15, the first authentication process is not necessary, so the second and subsequent authentication processes (see FIG. 8) described later are performed. (S5 3).

On the other hand, in S52, the corresponding encrypted authentication information is stored in the encryption storage unit 15. If not, the control unit 11 performs the initial authentication process described below (the process of S54 to S59 in the mobile phone 10, the process of S61 to S67 in the intermediate Sano 40, and the process of S71 to S73 in the Sirno 30. Process).

In this case, the control unit 11 receives the initial authentication information input from the user via the input unit 14.

 (User ID and password) are accepted (S54). In this case, the control unit 11 may cause the display unit 13 to display an image that prompts input of the initial authentication information as necessary.

 [0104] Next, the control unit 11 transmits the initial authentication information and the service identifier to the relay server 40 via the communication unit 12 (S55). At this point, the initial authentication information is non-encrypted authentication information that is not encrypted. Table 5 shows an example of information transmitted in S55 when a blog provision service is requested.

 [0105] [Table 5]

[0106] When relay server control unit 41 of relay server 40 receives the initial authentication information and the service identifier transmitted from mobile phone 10 via communication unit 42 (S61), the service corresponding to the received service identifier is received. The server 30 that provides the server 30 searches the server identification information storage unit 45 to identify the destination, and transmits the initial authentication information to the identified destination server 30 via the communication unit 42 (S62). Further, the relay server control unit 41 stores the initial authentication information in the RAM 47.

[0107] When the server control unit 21 of the server 30 receives the initial authentication information transmitted from the relay server 40 via the communication unit (service authentication window) 22 (S71), the server control unit 21 performs authentication processing of the initial authentication information. (S72). Specifically, the initial authentication information received from the relay server 40 and the preset authentication information stored in the authentication information storage unit 26 are collated, and whether or not the collation results match, that is, authentication. To determine whether or not And sir The control unit 21 notifies the determination result (authentication processing result) to the relay server 40 (S73).

On the other hand, when receiving the notification of the authentication processing result from the server 30 (S63), the relay server control unit 41 of the relay Sano 0 determines whether or not the authentication processing in the server 30 is successful (S64).

 Here, when it is determined that the authentication process has failed, the relay server control unit 41 notifies the mobile phone 10 of the authentication failure (S65). On the other hand, if it is determined in S64 that the authentication process is successful, the relay server control unit 41 reads the initial authentication information stored in the RAM 47 and encrypts the initial authentication information in the encryption unit 43. To create encryption key authentication information (S66). Note that the encryption method is not particularly limited.

[0110] Next, the relay server control unit 41 transmits the encryption key authentication information created in the process of S66 to the mobile phone 10 via the communication unit 42 (S67).

On the other hand, when the control unit 11 of the mobile phone 10 receives the information returned from the relay server 40 (S56), it determines whether or not the received information is an authentication failure notification (S57).

[0112] When it is determined that the received information is an authentication failure notification, that is, when it is determined that the received information is not encryption authentication information, the control unit 11 indicates that the authentication processing has failed and the authentication A question as to whether or not to continue processing is displayed on the display unit 13 (not shown).

 [0113] If there is an instruction to the input unit 14 not to continue the authentication process, or if no instruction is given, the authentication process ends. If the input unit 14 is instructed to continue the authentication process, the process from S54 is performed again. Or, omit the instruction to continue and allow the user to re-enter the initial authentication information when continuing the authentication process.

[0114] If it is determined in S57 that the received information is not an authentication failure notification, that is, if it is determined that the received information is encrypted authentication information, the control unit 11 receives the received encryption. The authentication information is stored in the encryption storage unit 15 in association with the service identifier corresponding to the encryption authentication information (S59). This completes the initial authentication process. [0115] Next, the second and subsequent authentication processes, that is, the authentication process when the cipher key recognition information corresponding to the selected service is stored in the cipher storage unit 15 will be described with reference to FIG. To do. FIG. 8 is a flowchart showing the flow of authentication processing for the second and subsequent times.

 First, the control unit 11 of the mobile phone 10 performs the processes of S51 and S52 described with reference to FIG.

 If it is determined in S52 that the encryption authentication information corresponding to the service identifier of the selected service is not stored, the control unit 11 performs the initial authentication process described above (the process after S54 in FIG. 7). I do.

 [0117] On the other hand, if it is determined in S52 that the corresponding encryption key information is stored, the control unit 11 performs the second and subsequent authentication processing described below (the processing of S81 to S84 in the mobile phone 10, The processing of S91 to S95 in Nakano Sano 40 and the processing of S101 to S103 in server 30) is performed.

 In this case, the control unit 11 first reads and obtains the encryption authentication information corresponding to the service identifier of the selected service stored in the encryption storage unit 15 (S81).

 [0119] Next, the control unit 11 receives input of detailed information related to a service input via the input unit 14 (S82). Here, the detailed information on the service is, for example, the URL of the blog to be acquired when requesting a blog providing service. In addition, when requesting a book information providing service, the information acquired! /, Information for identifying the book, etc., correspond to the detailed information about the service. In the following description, information including such detailed information and service identification information is referred to as service request information.

 [0120] Next, the control unit 11 sends the encryption key authentication information read in S81, the detailed information received in S82, and the service request information including the service identifier of the service selected in S51, to the communication unit 12. To the relay server 40 (S83).

 [0121] When the relay server control unit 41 of the relay server 40 receives the encryption authentication information and the service request information from the mobile phone 10 via the communication unit 42 (S91), the encryption received by the decryption unit 25 is received. The authentication information is decrypted (S92).

[0122] Next, the relay server control unit 41 searches the server identification information storage unit 45 for the destination of the server 30 that provides the service corresponding to the service identifier received from the mobile phone 10, and specifies the destination. The authentication information decrypted and transmitted to the server 30 via the communication unit 42. Service request information is transmitted (S93).

 [0123] When the server control unit 21 of the server 30 receives the authentication information and the service request information decrypted from the relay sano O (S101), the server control unit 21 performs an authentication process on the received authentication information (decrypted authentication information). Perform (S102). Specifically, the authentication information decrypted by the relay server 40 and the preset authentication information stored in the authentication information storage unit 26 are collated. Since the decrypted authentication information is authentication information that has been successfully authenticated at the time of the initial authentication process, the authentication information stored in the authentication information storage unit 26 is sure to match unless the authentication information is subsequently rewritten. . Here, when such force rewriting is performed, if rewriting is performed, the mobile phone 10 is notified of the authentication failure via the relay server 40, and the initial authentication processing power is also restarted. If you do this (not shown).

 [0124] After performing the authentication process of S102 (after confirming the authentication success), the server control unit 21 transmits the service content to be provided to the relay server 40 (S103).

 [0125] When the relay server control unit 41 of the relay server 40 receives the service content provided by the server 30 (S94), it transmits the received service content to the mobile phone 10 (S95).

 [0126] Upon receiving the service content from the relay server 40 (S84), the control unit 11 of the mobile phone 10 performs the necessary processing by storing the received service content in the RAM 17 or displaying it on the display unit 13 or the like. . This completes the second and subsequent authentication processing and service reception processing.

 As described above, in the present embodiment, the authentication information that has been successfully subjected to the initial authentication process is encrypted by the relay server 40 and then stored in the mobile phone 10. When the service is requested from the next time, the encrypted authentication information stored as described above is transmitted from the mobile phone 10 to the relay server 40, and the encrypted key authentication information received by the relay server 40 is decrypted. Then, the decrypted authentication information is transmitted to the server 30 that provides the requested service.

As a result, the user of the mobile phone (service utilization device) 10 only needs to input authentication information (user ID and password) during the initial authentication process. That is, when the user uses the service provided by the server (service providing apparatus) 30 using the mobile phone 10, it is not necessary to input authentication information every time. Therefore, the convenience of the user when using the service can be improved. [0129] Further, since the encrypted authentication information is stored in the mobile phone 10, for example, even if the storage area of the mobile phone 10 is analyzed, the authentication information for the server 30 is leaked (stolen). There is no. Therefore, the security (safety) related to the authentication information can be enhanced by the authentication method that works on the present embodiment.

 [0130] Also, in the service providing system 2 according to the present embodiment, the encryption unit and the decryption unit are provided in the relay sano O. For this reason, it is not necessary for the server 30 to include an encryption unit and a decryption unit, and therefore the authentication method and service providing system of the present invention can be realized using the existing server 30 (service providing device). .

 [0131] Relay Sano O associates information (service identifier) for identifying the service provided by each server with the destination of each server for one or more servers that are communicably connected. A server identification information storage unit 45 for storage is provided. As a result, the mobile phone 10 can also transmit the service identifier to the relay Sano O, so that the relay server 40 can search for the destination of the server that provides the service corresponding to the service identifier. In other words, the cellular phone 10 only needs to store the encryption authentication information for the service that has been successfully authenticated for the first time in association with the service identifier of the service. In addition, the user can easily use the desired service of each service provided by multiple servers simply by selecting (inputting) the service (or service identifier) to be used.

[0132] Also, according to the present embodiment, when a service relay device is provided, services provided by one or more service providing devices can be authenticated and used without entering a password each time. improves. As described above, when using a service provided by one or more service providing apparatuses, authentication information (user ID and password) set in advance for each server 30 is set for each server (or each service). ) May be different.

[0133] Also, in the present embodiment, at the time of the initial authentication, the initial authentication information (unencrypted authentication information) and the service identifier are transmitted from the mobile phone 10 to the relay server 40, and the authentication process in the server 30 is successful. The encryption key authentication information is returned from the relay server 40 to the mobile phone 10. However, the present invention is not limited to this. For example, in the initial authentication, the mobile phone 10 requests to the relay server 40 in addition to the initial authentication information and the service identifier. When the server 30 succeeds in the authentication process, the service details provided by the server 30 and the encryption authentication information created by the relay server 40 are transmitted from the relay server 40. Send it to mobile phone 10.

 [0134] Also, at the time of initial authentication, only one of the user ID and password may be encrypted. In addition to the user ID and password, a terminal ID unique to each mobile phone (service using device) 10 may be used as authentication information. Also, the mobile phone 10 is provided with an encryption means, and the relay server 40 is provided with a corresponding decryption means. At the time of the initial authentication, the initial authentication information is encrypted with the mobile phone 10, and the mobile phone 10 power is also stored. The initial authentication information encrypted and the decryption information for decrypting it may be transmitted to the relay server 40. In this case, the encrypted initial authentication information transmitted from the mobile phone 10 to the relay server 40 at the time of the initial authentication does not have to be the same as the encrypted authentication information generated by the relay server 40 after the initial authentication is successful. .

 [0135] In the present embodiment, the authentication information is encrypted when the initial authentication process is successful, and the encrypted authentication information is used continuously thereafter. This is not a limitation. For example, in the second and subsequent authentication processes, every time a service is used, the encryption process of the authentication process related to the service is executed again, and the encryption authentication information different from the previous one is transmitted to the mobile phone 10. May be. Also, every time the service is used a specified number of times, update the encrypted authentication information (re-encryption) and send the encrypted authentication information different from the previous one to the mobile phone 10.

 [Embodiment 3]

 Still another embodiment of the present invention will be described. For convenience of explanation, members having the same functions as those described in the first or second embodiment are denoted by the same reference numerals as those in the first or second embodiment, and the description thereof is omitted.

FIG. 9 (a) and FIG. 9 (b) are explanatory diagrams showing a schematic configuration of a service providing system 2a that works on the present embodiment. As shown in these drawings, the service providing system 2a includes a mobile phone (information terminal device) 10, a relay server (service relay device) 40, and servers (service providing devices) 30a and 30b. The mobile phone 10 and the relay server 40, and the relay server 40 and the servers 30a and 30b are respectively connected via a network such as the Internet. Are connected to communicate. The configuration of the mobile phone 10 is the same as that of the first and second embodiments, the configuration of the relay server 40 is the same as that of the second embodiment, and the configuration of each server 30a, 30b is the same as that of the server 30 of the second embodiment. It is.

 However, in the present embodiment, when the mobile phone 10 requests the provision of services to a plurality of servers 30a and 30b, the authentication information transmitted to the servers 30a and 30b is collectively collected from the mobile phone 10. The authentication information transmitted to the relay server 40 and received by the relay server 40 is distributed for each server and transmitted. Further, the service contents provided by the servers 30a and 30b are collected together by the relay server 40 and transmitted to the mobile phone 10.

 [0139] An authentication process (operation during the authentication process of the mobile phone 10, relay sano 0, and servers 30a and 30b) in the service providing system 2a will be described. It is assumed that the authentication information storage unit 26 of the servers 30a and 30b has previously registered (stored) authentication information (user ID and password) of a user permitted to provide a service.

 First, the initial authentication process in the service providing system 2a will be described with reference to FIG. FIG. 10 is a flowchart showing the flow of the initial authentication process.

 [0141] First, the control unit 11 of the mobile phone 10 receives an instruction to select all the services to be used, in which user power is also input via the input unit 14 (S111). That is, the selection instruction for selecting all desired services is also accepted as the central force of each service provided by one or more servers 20 that can be connected via the network. Then, the control unit 11 generates information (service identifier) that identifies each selected service (not shown). Alternatively, the user may directly input information (service identifier) identifying each desired service via the input unit 14.

 [0142] Next, the control unit 11 searches the encryption storage unit 15 and determines whether encryption authentication information corresponding to all the services selected in S111 is stored (S112). ).

 [0143] Then, when all corresponding encryption key recognition information is stored in the encryption storage unit 15, the first authentication process is not necessary, so the second and subsequent authentication processes (see Fig. 11) described later are performed. Perform (S 113).

On the other hand, in S112, all corresponding encryption authentication information is stored in the encryption storage unit 15. If not, the control unit 11 performs the initial authentication process described below (the process of S114 to S119 in the mobile phone 10, the process of S121 to S129 in the intermediate Sano 40, the S131 in the Sano 30a, 30b. To S133).

 [0145] In this case, the control unit 11 also receives user power through the input unit 14. The encrypted authentication information is stored in S112, and the initial authentication information (user ID and password) are accepted (S114). In this case, if necessary, the control unit 11 stores the encrypted authentication information on the display unit 13 and displays an image prompting the user to input the initial authentication information for the service! / Even so,

 [0146] Next, the control unit 11 transmits the initial authentication information input in S114 and the service identifier of the service related to the initial authentication information to the relay server 40 via the communication unit 12 (S115). . At this time, the initial authentication information is non-encrypted authentication information that is not encrypted. Table 6 shows an example of information transmitted in S115 when the blog providing service and the book information (book information) providing service are used. In the example shown in Table 6, in addition to the user ID and password, a terminal ID that is unique to each mobile phone 10 is used as the authentication information.

 [0147] [Table 6]

中継サーバ 40の中継サーバ制御部 41は、通信部 42を介して携帯電話 10から送 信された利用する全てのサービスに関する初回認証情報およびサービス識別子を受 信すると (S121)、受信した各サービス識別子に対応するサービスを提供するサーバ の宛先をサーバ識別情報記憶部 45から検索して特定し、特定した宛先のサーバに

When the relay server control unit 41 of the relay server 40 receives initial authentication information and service identifiers for all services to be used transmitted from the mobile phone 10 via the communication unit 42 (S121), the received service identifiers Server that provides services corresponding to Is searched from the server identification information storage unit 45 and specified.

The initial authentication information is transmitted via the communication unit 42 (S122). In addition, the relay server control unit 41 stores the initial authentication information of each service in the RAM 47.

[0149] For example, when using the blog providing service as shown in Table 6, the initial authentication information shown in Table 7 is transmitted to the server 30a that is a server providing the blog providing service.

[0150] [Table 7]

[0151] Further, when using the book information providing service as shown in Table 6, the initial authentication information shown in Table 8 is transmitted to the server 30b which is a server providing the book information providing service.

[0152] [Table 8]

[0153] When the server control unit 21 of the servers 30a and 30b receives the initial authentication information transmitted from the relay server 40 via the communication unit (service authentication window) 22 (S131), it authenticates the received initial authentication information. Processing is performed (S132). Specifically, the initial authentication information received from the relay server 40 and the preset authentication information stored in the authentication information storage unit 26 are collated, and whether or not the collation results of the two match, That is, it is determined whether or not the authentication is successful. Then, the server control unit 21 notifies the determination result (authentication processing result) to the relay server 40 (S133).

[0154] When the relay server control unit 41 of the relay server 40 receives the notification of the authentication processing result from the servers 30a and 30b (S123), it determines whether or not the authentication processing in each of the servers 30a and 30b is successful ( S 124). [0155] Then, the relay server control unit 41 reads from the RAM 47 the initial authentication information of the service for which the authentication process has been determined to be successful, and causes the encryption key unit 43 to encrypt the initial authentication information, thereby encrypting the authentication. Information is created (S 125). Further, the created encrypted authentication information is stored in the RAM 47 (S 126).

 On the other hand, for the service that is determined to have failed the authentication process in S124, authentication failure information indicating that the authentication process for the service has failed is stored in RAM 47 (S127).

 Thereafter, relay server control unit 41 determines whether or not the authentication process has been completed for the services corresponding to all service identifiers received from mobile phone 10 (S128). If there is a service for which authentication processing has not been completed, the processing from S122 is repeated, and authentication processing is performed for all services. On the other hand, if it is determined that the authentication process has been completed for all the services to be used, the relay server control unit 41 determines each encrypted authentication information stored in the RAM 47 in S126 and each authentication failure information stored in the RAM 47 in S127. And the read information is collected and transmitted to the mobile phone 10 (S129).

 [0158] Table 9 shows information (service identifier and encryption key) transmitted from the relay server 40 to the mobile phone 10 when the authentication process is successful for both the blog providing service and the book information providing service. An example of (authentication information) is shown. In this example, the terminal ID must be encrypted for V, but not limited to this! /.

 [0159] [Table 9] Service identifier a

 User ID (Encrypted authentication information A ')% iIF3i) #Ro # $ #

 Password (encrypted authentication information A ')% 0gO9j4O-982

 Terminal ID (Encryption authentication information A ') 037323290383

 Service identifier b information

 User ID (Encryption authentication information B ')% 41bs09ETIJ9

 Password (Encryption authentication information B,)% 23E34GDRo

Terminal ID (encrypted authentication information B ') 037323290383 [0160] Upon receiving the information returned from the relay server 40 (S116), the control unit 11 of the mobile phone 10 stores the encrypted authentication information included in the received information in association with each service identifier. Stored in section 15 (S 117).

 [0161] Next, the control unit 11 determines whether or not the information received from the relay server 40 includes authentication failure information (S118). If it is determined that the authentication failure information is included, the control unit 11 displays on the display unit 13 an inquiry as to whether the authentication process has failed for the service and whether or not to continue the authentication process. (Not shown).

 [0162] Then, if the input unit 14 is instructed not to continue the authentication process, or if no instruction is given, it is determined that the use of the service that has failed in authentication is abandoned. Then, the authentication process ends. If the input unit 14 is instructed to continue the authentication process, the process from S114 is performed again. Or, omit the instruction to continue and allow the user to re-enter the initial authentication information for the service when continuing the authentication process.

 [0163] Also, in S118, when it is determined that the received information does not include authentication failure information, that is, when it is determined that all the received information is encryption authentication information, the control unit 11 performs initial authentication. The process ends.

 [0164] Next, the second and subsequent authentication processing, that is, authentication processing in the case where encryption key recognition information corresponding to all selected services is stored in the encryption storage unit 15, This will be described with reference to FIG. Fig. 11 is a flowchart showing the flow of authentication processing after the second time.

[0165] First, the control unit 11 of the mobile phone 10 performs the processing of S111 and S112 described with reference to FIG. When it is determined in S112 that the encryption key authentication information corresponding to all the services to be used is not stored in the encryption storage unit 15, the control unit 11 performs the above-described initial authentication process (S114 in FIG. 10). Perform the following processing).

On the other hand, if it is determined in S112 that the corresponding encryption key information is stored, the control unit 11 performs the second and subsequent authentication processing described below (from S141 to S143 in the mobile phone 10). Processing, intermediate Sano 40, S151 to S157, and Sano 30a, 30b, S161 to S163). In this case, the control unit 11 receives input of detailed information (other information) related to the service input via the input unit 14 (S141). Here, the detailed information about the service is, for example, the URL of the blog to be acquired when requesting a blog provision service. In addition, when requesting a book information service, information such as the number that identifies the book for which information is to be obtained corresponds to the detailed information about the service. In the following description, information including such detailed information and service identification information is referred to as service request information.

 [0168] Next, the control unit 11 reads out the encryption authentication information corresponding to the service identifiers of all the services to be used from the encryption storage unit 15, and reads out the encrypted authentication information about each read service and each service. The service request information (service identifier of each service and detailed information of each service) is transmitted to the relay server 40 via the communication unit 12 (S142). Table 10 shows an example of information transmitted in the process of S142.

 [0169] [Table 10]

中継サーバ 40の中継サーバ制御部 41は、携帯電話 10から通信部 42を介して、 利用する全てのサービスについての暗号ィ匕認証情報およびサービス要求情報を受 信すると（S151)、復号ィ匕部 25に受信した各暗号ィ匕認証情報を復号ィ匕させる（S15 2)。 [0171] 次に、中継サーバ制御部 41は、利用する各サービスを提供するサーバの宛先をサ ーバ識別情報記憶部 45から検索して特定し、特定した各サーバに、通信部 42を介 して、復号化した認証情報とサービスに関する詳細情報とを送信する（S153)。

When the relay server control unit 41 of the relay server 40 receives the encryption key authentication information and the service request information for all the services to be used from the mobile phone 10 via the communication unit 42 (S151), the decryption key unit Each encrypted key authentication information received is decrypted in 25 (S152). [0171] Next, the relay server control unit 41 searches the server identification information storage unit 45 to identify the destination of the server that provides each service to be used, and passes the communication unit 42 to each identified server. Then, the decrypted authentication information and detailed information about the service are transmitted (S153).

 That is, the decrypted authentication information shown in Table 11 and the detailed information about the service are transmitted to the server 30a that is a server that provides the blog providing service.

 [0173] [Table 11]

[0174] Also, the decrypted authentication information and detailed information on the service shown in Table 12 are transmitted to the server 30b which is a server that provides the information providing service of the book.

[0175] [Table 12]

サーバ 30a,30bのサーバ制御部 21は、中継サーノ 0から復号ィ匕された認証情報 とサービス要求情報とを受信すると (S161)、受信した認証情報 (復号化認証情報） の認証処理を行う（S162)。具体的には、中継サーバ 40で復号ィ匕された認証情報と 、認証情報記憶部 26に記憶されている予め設定された認証情報とを照合する。なお 、この復号ィ匕した認証情報は、初回認証処理時に認証に成功した認証情報であるの で、認証情報記憶部 26に記憶されて 、る認証情報がその後書き換えられて 、な!/ヽ 限り、必ず一致する。ここでは、そのような書き換えは行われていないものとするが、 書き換えが行われている場合には、中継サーバ 40を介して携帯電話 10に認証失敗 を通知し、初回認証処理からやり直させるようにすればよ!ヽ（図示せず)。

When the server control unit 21 of the servers 30a and 30b receives the authentication information decrypted from the relay server 0 and the service request information (S161), it performs an authentication process on the received authentication information (decrypted authentication information) ( S162). Specifically, the authentication information decrypted by the relay server 40 is compared with preset authentication information stored in the authentication information storage unit 26. Note that the decrypted authentication information is authentication information that has been successfully authenticated at the time of the initial authentication process, so that the authentication information stored in the authentication information storage unit 26 is subsequently rewritten and Always match. Here, it is assumed that such rewriting has not been performed, If the rewriting has been performed, the mobile phone 10 is notified of the authentication failure via the relay server 40, and the initial authentication process is performed again! (Not shown).

 [0177] After performing the authentication process of S162 (after confirming the authentication success), the server control unit 21 transmits the service content to be provided to the relay Sano O (S163). In FIG. 9 (b), the service content transmitted from the server 30a that provides the program is the service content oc, and the service content transmitted from the server 30b that provides the book information is the service content β.

 [0178] When the relay server control unit 41 of the relay server receives the service content that also provides the servers 30a and 30b (S94), the received service content is stored in the RAM 47 in association with the service identifier of each service ( S 155).

 Thereafter, the relay server control unit 41 determines whether or not the service content of the service corresponding to all the service identifiers to be used has been received from each Sano (S 156). If there is a service that has not received the service content, the relay server control unit 41 repeats the processing from S 152 onward, and receives the service content for all the services.

 [0180] On the other hand, when it is determined that the service contents for all the services to be used have been received, the relay server control unit 41 reads the service contents of each service stored in the RAM 47 in S155 and reads each service that has been read. The service contents are collectively sent to the mobile phone 10 (S157). The service content of each service is transmitted to the mobile phone 10 in a state associated with the service identifier of each service.

 [0181] Upon receiving the service content from the relay server 40 (S143), the control unit 11 of the mobile phone 10 performs the necessary processing by storing the received service content in the RAM 17 or displaying it on the display unit 13 or the like. . This completes the second and subsequent authentication processing and service reception processing.

 [0182] As described above, in the service providing system 2a that is effective in the present embodiment, the mobile phone 10 (service using device) also requires the provision of services to the plurality of servers 30a, 30b (service providing devices). Authentication information to be sent to each server 30a, 30b is collectively sent from the mobile phone 10 to the relay server 40 (service relay device), and the authentication information received by the relay server 40 is distributed to each server. To send.

[0183] Therefore, when a user wants to use multiple services (at the time of initial authentication), each service By inputting all the authentication information in a lump and sending the input authentication information for each service together to the relay server 40, it is possible to receive provision of a plurality of desired services. This further improves the convenience of the user at the first authentication of each service.

 [0184] Note that authentication information (for example, user ID and password) for multiple services may be set in common for multiple services or set differently for each service. Also good.

 [0185] In the service providing system 2a, service contents that are also provided with a plurality of servers 30a and 30b are collected together by the relay server 0 and transmitted to the mobile phone 10. As a result, the user can use the services provided by multiple servers at the same time, or use them in combination.

 [0186] Relay Sano 0 associates information (service identifier) that identifies a service provided by each server and the destination of each server with respect to one or more servers that are communicably connected. A server identification information storage unit 45 for storage is provided. Accordingly, the mobile phone 10 can also transmit the service identifier to the relay server 0, so that the relay server 40 can search for the destination of the server that provides the service corresponding to the service identifier. In other words, the cellular phone 10 only needs to store the encryption authentication information for the service that has been successfully authenticated for the first time in association with the service identifier of the service. In addition, the user can easily use the desired service of each service provided by multiple servers simply by selecting (inputting) the service (or service identifier) to be used.

[Embodiment 4]

 Still another embodiment of the present invention will be described. For convenience of explanation, the embodiment

For members having the same functions as the members described in 1-3, the same reference numerals as in Embodiments 1-3 are used, and the description thereof is omitted.

FIG. 13 is an explanatory diagram showing a schematic configuration of a service providing system la according to the present embodiment. As shown in this figure, the service providing system la is a mobile phone (information terminal device).

, A service using device) 10a and a server (service providing device) 20a. Power S It is connected so that it can communicate via a network such as the Internet. In the service providing system la, the encrypted authentication information, the terminal ID, and the service connection destination of the user permitted to provide the service are transmitted from the server 20a to the broadcast base station 50 via the Internet or the like. 50 is transmitted via the broadcast network. Here, as the broadcasting network, for example, terrestrial digital broadcasting, BS digital broadcasting, mopile broadcasting, broadcasting for mobile phones, and the like can be used.

FIG. 14 is a block diagram showing a schematic configuration of the mobile phone 10a, the server 20a, and the broadcast base station 50. As shown in FIG.

 [0190] The broadcast base station 50 includes a control unit 51, a communication unit 52, and a transmission unit 53. The control unit 51 controls operations of the communication unit 52 and the transmission unit 53. The communication unit 52 communicates with the communication unit 22 provided in the server 20a. Note that the communication medium that connects the communication unit 52 and the communication unit 22 so as to communicate with each other is not particularly limited, but for example, the Internet can be used.

 [0191] In addition to the configuration of the mobile phone 10 shown in FIG. 2, the mobile phone 10a includes a tuner part 18 that receives a broadcast transmitted from the broadcast base station 50. Further, a terminal ID determination unit 1 la for determining whether or not the terminal ID of the mobile phone 10a is included in the information received by the tuner part 18 is provided in the control unit 11. .

 [0192] The server 20a includes an authentication information input unit 29 in addition to the configuration of the server 20 shown in FIG. This authentication information input unit 29 accepts input of the user ID and password of the user who is permitted to provide the service from the server 20a and the terminal ID of the mobile phone 10a that provides the service. The configuration of the authentication information input unit 29 is not particularly limited. For example, various input means such as a keyboard, a mouse pointer, a jog dial, a pen input device, a touch panel, and a voice input can be used. These input means may be provided in the mobile phone 10a or may be connected to the mobile phone 10a by radio or wire.

[0193] Next, operations of the mobile phone 10a and the server 20a in the service providing system la will be described. FIG. 15 is a flowchart showing the flow of the initial authentication process in the service providing system la. [0194] First, the server control unit 21 of the server 20a accepts input of authentication information (user ID, password, terminal ID) permitted to provide a service, which is input via the authentication information input unit 29 (S171). ). For example, the service provider inputs authentication information of a user who has contracted in advance through the authentication information input unit 29.

 Next, the server control unit 21 causes the encryption unit 24 to encrypt the authentication information input in S171, and creates encryption authentication information (S172). The encryption method is not particularly limited.

 [0196] Next, the server control unit 21 uses the encryption key authentication information created in the processing of S172, the terminal ID and the service connection destination (address for communicating with the server 20a) input in S171, as the communication unit. The data is transmitted to the broadcast base station 50 via 22 (S173). Table 13 shows an example of encryption authentication information (user ID and password), terminal ID, and service connection destination transmitted from the server 20a to the broadcast base station 50.

 [0197] [Table 13]

[0198] When the control unit 51 of the broadcast base station 50 receives the encryption key authentication information, the terminal ID, and the service connection destination via the communication unit 52 (S181), the received encryption key authentication information, terminal, and service are received. The connection destination is transmitted from the transmission unit 53 to the broadcast network (S182).

 [0199] On the other hand, when the control unit 11 of the mobile phone 10a receives the encryption key authentication information, the terminal, and the service connection destination transmitted from the broadcast base station 50 (S191), the control is received by the terminal ID determination unit 11a. It is determined whether the terminal ID is its own terminal ID (S192).

 [0200] If the control unit 11 determines that the terminal ID is its own terminal ID, the control unit 11 stores the received encryption key authentication information, terminal, and service connection destination in the encryption storage unit 15 (S193). finish.

[0201] On the other hand, if it is determined that the terminal ID is not its own, the control unit 11 receives the received encryption key. The authentication information, terminal, and service connection destination are discarded (S194), and the process ends.

 [0202] Thereafter, when the mobile phone 10a requests the server 20a to provide a service, the same processing as that of the service providing system 1 shown in Fig. 4 is performed. However, in the service providing system la, the terminal ID is included in the service request information transmitted from the mobile phone 10a to the server 20a! /.

 [0203] As described above, in the service providing system la according to the present embodiment, the server 20a permits the provision of the encrypted authentication information and the service obtained by encrypting the authentication information permitting the provision of the service. The terminal ID of the mobile phone 10a and the service connection destination (the connection destination when the mobile phone 10a requests the service provided by the mobile phone 10a) are transmitted via the broadcast network.

 [0204] When the mobile phone 10a receives the encrypted authentication information, the terminal ID, and the service connection destination, the mobile phone 10a determines whether the received terminal ID is its own terminal ID, and is the own terminal ID. In this case, the encryption authentication information and the service connection destination received together with the terminal ID are stored in the encryption storage unit 15.

 [0205] Thus, when the user of the mobile phone 10a requests the server 20a to provide a service, it is not necessary to input authentication information (user ID and password). That is, when using the service provided by the server 20a using the mobile phone 10a, the user does not need to input authentication information even once. Therefore, the convenience of the user when using the service can be improved.

 [0206] In the above description, the server 20a transmits the encryption key authentication information, the terminal, and the service connection destination to the mobile phone 10a via the broadcast network. However, the present invention is not limited to this. You may make it transmit via. In this case, data may be transmitted from the server 20a to the mobile phone 10a by designating the address of the mobile phone 10a so that the terminal ID is not included in the transmitted data. Also, in the mobile phone 10a, the process of determining whether or not the received data includes its own terminal ID may be omitted, and all received encryption key authentication information and service connection destinations may be stored.ヽ.

[0207] In addition, in the processing of S171, the power that authentication information (user ID, password, terminal ID) permitting service provision is input via the authentication information input unit 29 is not limited to this. . For example, instead of the process of S171, the user power of the mobile phone 10a and other services The initial authentication may be completed by the same method as in FIG. 3 of the first embodiment via the one-service device (other mobile phone or personal computer), and the terminal ID of the mobile phone 10a may be designated. Alternatively, a user who has previously used the service on another service using device (contracted with the service) specifies the terminal ID of the mobile phone 10a to use the service using the mobile phone 10a. It can also be applied to

[0208] In the present embodiment, when the user of the mobile phone 10a requests service provision, the mobile phone 10a transmits the encryption authentication information, the terminal ID, and the service request information to the server 20a. It is not limited to this. For example, encryption authentication information, terminal, and service request information (or service identifier) are transmitted from the mobile phone 10a to the server 20a via the relay Sano O shown in FIGS. 5 (a) and 5 (b). Moho. That is, as shown in FIG. 16, in the service providing system 2a shown in FIG. 9 (a), the server 20a may be provided instead of the server 30a, and the mobile phone 10a may be provided instead of the mobile phone 10. .

 In the configuration shown in FIG. 16, by performing the same processing as in FIG. 10, it is possible to perform the initial authentication of the service in which the encryption authentication information is not stored in the mobile phone 10a. In other words, when the user of the mobile phone 10a authenticates for the first time, he / she only has to enter the authentication information for the service if the encryption authentication information is stored in the mobile phone 10a.

 [0210] In addition, in the configuration shown in FIG. 16, when using the service in which the encryption key authentication information is stored in the mobile phone 10a, the service is used only by performing the same process as in FIG. can do. That is, even when the service provided by the server 20a is used, the cellular phone 1 Oa may perform the same process as in FIG. Therefore, for services that receive encrypted authentication information from the broadcast network, users do not have to enter authentication information themselves when using the service from the mobile phone 10a! Even if you use it, you can easily use the service.

 [0211] The encryption of the authentication information may be performed not by the server 20a but by the relay sano O. FIG. 17 is an explanatory diagram showing the state of the initial authentication process in the service providing system la in this case.

[0212] As shown in Fig. 17, it is permitted to provide the service via the authentication information input unit 29 of the Sano 20a. When valid authentication information (user ID, password, terminal ID) is input, the server control unit 21 input authentication information, terminal ID, service connection destination (or service identifier), and successful authentication ( The relay server 40 is notified of the authentication result indicating that the authentication is permitted. Then, the relay server control unit 41 of the relay server 40 causes the received authentication information to be encrypted, and the encrypted authentication information, terminal ID, and service connection destination (or service identifier) are transmitted to the communication unit. 42 is transmitted to the broadcast base station 50 via the Internet or the like. Then, the broadcast base station 50 transmits the received encrypted authentication information, terminal ID, and service connection destination (or service identifier) using the broadcast network. The relay server control unit 41 of the relay Sano 0 transmits the encrypted authentication information, the terminal ID, and the service connection destination (or service identifier) from the communication unit 42 that does not transmit to the mobile phone 10a via the broadcast network. Send directly to the mobile phone 10a via a mobile phone.

 [0213] In this case as well, for services that receive encryption authentication information from the broadcast network, the user does not have to input authentication information when using the service from the mobile phone 10a. Even if you use the service at the same time, you can easily use the service.

 [Embodiment 5]

 Still another embodiment of the present invention will be described. For convenience of explanation, members having the same functions as those described in the first to fourth embodiments are denoted by the same reference numerals as those in the first to fourth embodiments, and the description thereof is omitted.

 [0215] FIG. 18 is an explanatory diagram showing a schematic configuration of a service providing system 2b according to the present embodiment. As shown in this figure, the service providing system 2b includes a mobile phone (information terminal device, service using device) 10a, Sano (service providing devices) 30a and 30b, and a relay server 4 Oa. It is connected to be able to communicate via a network such as the Internet. In the service providing system 2b, the encrypted authentication information, the terminal ID, and the service connection destination of the user permitted to provide the service are transmitted from the relay server 40a to the broadcasting base station 50 via the Internet or the like. The broadcast base station 50 transmits the data via the broadcast network.

FIG. 19 is a block diagram showing a schematic configuration of the mobile phone 10a, the relay server 40a, the servers 30a and 30b, and the broadcast base station 50. As shown in this figure, the relay Sano Oa is shown in Figure 6. In addition to the configuration of the relay server 40, an authentication information input unit 48 is provided.

[0217] The authentication information input unit 48 accepts input of the user ID, password, and terminal ID of the mobile phone 10a that provides the service for the user who performs the initial authentication process. The configuration of the authentication information input 48 is not particularly limited. For example, various input means such as a keyboard, a mouse pointer, a jog dial, a pen input device, a touch panel, and a voice input can be used. These input means may be provided in the mobile phone 10a, or may be connected to the mobile phone 10a by radio or wire.

 Next, the operation at the time of initial authentication in the service providing system 2b will be described. FIG. 20 is a flowchart showing the flow of the initial authentication process in the service providing system 2b.

[0219] First, the relay server control unit 41 of the relay server 40a accepts initial authentication information (user ID, password, terminal ID) and service connection destination input via the authentication information input unit 48 ( S201).

 [0220] Next, the relay server control unit 41 transmits the initial authentication information input in S211 to the service connection destination server (in this case, the server 30a) (S202). Also, the relay server control unit 41 stores the authentication information and the service connection destination in the RAM 47.

 [0221] Upon receiving the authentication information transmitted from the server relay server Oa (S211), the server control unit 31 of the server 30a causes the authentication processing unit 23 to perform authentication processing of the received authentication information (S212). Then, the server control unit 31 transmits the authentication result to the relay server 40a via the communication unit 22 (S213).

 [0222] When receiving the notification of the authentication processing result from the server 30a (S203), the relay server control unit 41 of the relay server 40a determines whether the authentication process in the server 30a is successful (S204). If it is determined that the authentication process has failed, the relay server control unit 41 waits for re-input of the initial authentication information and the service connection destination. The relay server 40a may be provided with a display means, a voice output means, etc. so that the input person who has entered the initial authentication information is notified via the authentication information input section 48 that the authentication has failed.

On the other hand, if it is determined in S204 that the authentication is successful, the relay server control unit 41 The first authentication information stored in the RAM 47 is read out, and the user ID and password included in the initial authentication information are encrypted in the encryption unit 43 to generate encrypted authentication information (S205).

 [0224] Next, the relay server control unit 41 uses the encryption key authentication information, terminal I, created in the process of S205.

D, The service connection destination is transmitted to the broadcast base station 50 via the communication unit 42 (S206).

[0225] Upon receiving the encryption key authentication information, the terminal ID, and the service connection destination via the communication unit 52 (S221), the control unit 51 of the broadcast base station 50 receives the received encryption key authentication information, the terminal, and the service. The connection destination is transmitted from the transmission unit 53 to the broadcast network (S222).

[0226] When the control unit 11 of the mobile phone 10a receives the encryption authentication information, the terminal ID, and the service connection destination transmitted from the broadcast base station 50 (S231), the terminal ID received by the terminal ID determination unit 11a is received. It is determined whether or not is its own terminal ID (S232).

If it is determined that the terminal ID is its own terminal ID, the control unit 11 stores the received encryption key authentication information, terminal, and service connection destination in the encryption storage unit 15 (S233), and ends the process. To do.

 On the other hand, when determining that it is not its own terminal ID, the control unit 11 discards the received encryption authentication information, terminal, and service connection destination (S234), and ends the process.

 [0229] After that, when the mobile phone 10a requests the server 30a to provide a service, the service providing system 2 shown in FIG. 8 or the same processing as the service providing system 2a shown in FIG. Do. However, in the service providing system 2b, the mobile phone 10a power is also included in the service request information transmitted to the Sano 30a.

[0230] As described above, in the service providing system 2b according to the present embodiment, the relay Sano Oa includes the authentication information input unit 48 that receives the input of the initial authentication information, and the initial authentication information for a certain service is input. Then, the initial authentication information is transmitted to the server 30a that provides the service. Then, when receiving the authentication result indicating that the initial authentication is successful, the relay server 40a causes the encryption unit 43 to encrypt the initial authentication information (user ID, password) and create encryption key authentication information. Then, the encrypted authentication information is transmitted to the broadcast base station 50, and transmitted from the broadcast base station 50 to the mobile phone 10a via the broadcast network. [0231] Thus, when the user of the mobile phone 10a requests the server 30a to provide a service, the mobile phone 10a does not need to input authentication information (user ID and password) using the mobile phone 10a. That is, when using the service provided by the server 20a using the mobile phone 10a, the user does not need to input authentication information even once. Therefore, the convenience of the user when using the service can be improved.

 [0232] In the above description, the relay server 40a transmits the encryption authentication information, the terminal ID, and the service connection destination to the mobile phone 10a via the broadcast network. However, the present invention is not limited to this. Alternatively, it may be transmitted via the Internet or the like. In this case, data may be transmitted from the relay Sano Oa to the mobile phone 10a by specifying the address of the mobile phone 10a, and the terminal ID may not be included in the transmitted data. Also, in this case, the mobile phone 10a omits the process of determining whether or not the received data includes its own terminal ID, and stores all received encrypted authentication information and service connection destinations. You can let it happen.

 [0233] Also, in the process of S201, the authentication information (user ID, password, terminal ID) and service connection destination permitting the provision of the service via the authentication information input unit 48 are input. It is not limited. For example, instead of the processing of S201, the user of the mobile phone 1 Oa completes the initial authentication in the same manner as in FIG. 7 or FIG. 11 through another service using device (other mobile phone or personal computer), The terminal ID of the mobile phone 10a may be specified. Alternatively, a user who has previously used the service (contracted with the service) on another service use device (mobile phone, PC, etc.) to use the service using the mobile phone 10a. It can also be applied when the mobile phone 10a terminal ID is specified for.

[0234] In addition, the control unit 11 of the mobile phones 10, 10a, the Sano control unit 21 of the servers 20, 20a, 30, 30a, 30b, the relay server control unit 41 of the relay servers 40, 40a, the server, The encryption unit 24, the decryption unit 25 of the servers 20, 20a, the encryption unit 43 of the relay servers 40, 40a, and the decryption unit 44 are stored in a recording medium such as a ROM or a RAM, with arithmetic means such as a CPU. This is a functional block realized by executing the program code. Therefore, an object of the present invention is to provide a program code (execution format program, intermediate code program, source program) of a program which is software for realizing the functions of the above-described members. This can be achieved by supplying a readable recording medium to a system or apparatus and reading and executing the program code recorded on the recording medium by a computer (or CPU) provided in the system or apparatus. .

 On the other hand, these members may be realized as hardware that performs the same processing as the above-described software. In this case, the object of the present invention is to provide the ff¾¾] §ll of the mobile phone 10, 10a as hardware, the Sano ffiU¾] §21 of the Sano 20,20a, 30,30a, 30b, and the relay server of the intermediate Sano 40, 40a. This is achieved by the control unit 41, the encryption unit 24 of the servers 20 and 20a, the decryption unit 25, the encryption unit 43 and the decryption unit 44 of the relay servers 40 and 40a. In addition, these members may be configured by combining hardware that performs a part of the processing and arithmetic means that executes program code for performing processing other than the control of the hardware and the processing performed by the hardware. realizable. Furthermore, even among the above-described members, even those described as hardware, hardware that performs part of the processing, and program code that performs processing other than control of the hardware and processing performed by the hardware It can also be realized as a configuration that combines with a calculation means for executing.

 [0236] The arithmetic means may have a single configuration, or a configuration in which a plurality of arithmetic means connected via a bus or various communication paths in the apparatus cooperate to execute program code. It may be.

 Therefore, the mobile phone 10, 10a control unit 11, the server 20, 20a, 30, 30a, 30b Sano control unit 21, the relay server 40, 40a relay server control unit 41, server The encryption unit 24 and the decryption unit 25 of 20, 20a, and the encryption unit 43 and the decryption unit 44 of the relay servers 40 and 40a can be provided in any place in the service providing system.

 [0238] In addition, the program code itself that can be directly executed by the arithmetic means, or a program as data that can generate a program code by a process such as decompression to be described later, is the program (the program or the data). It is stored in a recording medium and distributed, or the program is distributed by being transmitted by a communication means for transmission via a wired or wireless communication path, and is executed by the arithmetic means. Shall be executed.

[0239] Note that in the case of transmission via a communication path, various transmission media constituting the communication path may be The program is transmitted through the communication path by propagating a signal sequence indicating a gram. When transmitting the signal sequence, the transmission device may superimpose the signal sequence on the carrier by modulating the carrier with a signal sequence indicating a program. In this case, the signal sequence is restored by the receiving device demodulating the carrier wave. On the other hand, when transmitting the signal sequence, the transmission device may divide the signal sequence as a digital data sequence into packets. In this case, the receiving apparatus concatenates the received packet groups and restores the signal sequence. In addition, when transmitting a signal sequence, the transmission device may multiplex and transmit the signal sequence with another signal sequence by a method such as time division Z frequency division Z code division. In this case, the receiving apparatus extracts and restores the signal sequence from the multiplexed signal sequence. In either case, the same effect can be obtained if the program can be transmitted via the communication channel.

 [0240] Here, it is preferable that the recording medium for distributing the program is removable, but it does not matter whether the recording medium after distributing the program is removable. In addition, the recording medium may be any rewritable (writeable) power or volatile as long as the program is recorded, and the recording method and shape are also questioned. Absent. Examples of such recording media include tapes such as magnetic tape and cassette tape, magnetic disks such as floppy (registered trademark) disks and hard disks, CD-ROMs, magneto-optical disks (MO), mini-discs (MD), Digital video disks (DVDs and other discs. The recording medium may be a card such as an IC card or optical card, or a semiconductor memory such as a mask ROM, EPROM, EEPROM, or flash ROM. Alternatively, it may be a memory formed in a calculation means such as a CPU.

 [0241] The program code may be a code for instructing the arithmetic means of all the processes of the respective members, or may be a part of the processes of the respective members by calling in a predetermined procedure. If a basic program (for example, operating system or library) that can execute all of the program already exists, the basic program can be called by a code or pointer that instructs the arithmetic unit. Or you can replace everything.

[0242] The format for storing the program in the recording medium is, for example, allocated to the real memory. It may be stored in a storage format that can be accessed and executed by the computing means as in the state of being installed, or a local recording medium (for example, real memory) that is always accessible by the computing means before being placed in the real memory. The storage format after installation on the Nyanode disk, etc., or the storage format prior to installation on the local recording medium from a network or a transportable recording medium.

 [0243] Furthermore, the program may be stored in the recording medium as source code that is not limited to the object code after being compiled, or as intermediate code that is generated during the interpretation or compilation. In any case, by decompressing the compressed information, decompressing the encoded information, interpreting, compiling, linking, or placing in real memory, or a combination of these, If the intermediate code can be converted into a format that can be executed by the arithmetic means, the same effect can be obtained regardless of the format in which the program is stored in the recording medium.

[0244] Also, although cases have been described with the above embodiments where the mobile phone 10 is used as a service utilization device, the present invention is not limited to this. For example, it can be applied to a configuration using a mobile phone, PHS (Personal Handyphone System; registered trademark), PDA (personal digital assistants), personal computer, word processor, TV broadcast receiver, etc. as a service using device.

[0245] In order to solve the above-mentioned problem, the first service providing system of the present invention provides a predetermined service in response to a request for a service using device and a service using device connected via a network. A service providing system including a service providing device, wherein the service using device stores an input unit that receives an input instruction from a user for specifying a requested service and the received encrypted authentication information An encryption storage unit, and a utilization device control unit that transmits encrypted authentication information corresponding to the requested service to the service providing device that provides the requested service, wherein the service providing device provides the service The authentication information storage unit for storing the authentication information of the user who permits the authentication and the authentication information of the user who has requested the provision of the service are And authentication processing unit for performing an authentication process for collating the authentication information of users are allowed to provide the service stored in the storage unit, a decoding unit for creating a decrypted authentication information by decrypting the encrypted authentication information, When the encrypted authentication information is received from the service using device, the received encrypted authentication information is decrypted by the decryption key unit, and the authentication processing of the decryption key authentication information obtained by the decryption key is performed. And a providing device control unit to be executed by the processing unit.

 [0246] According to the configuration described above, the utilization device control unit transmits the encrypted authentication information to the service providing device when requesting the provision of the service. The service providing apparatus decrypts the received encrypted authentication information and performs authentication processing. For this reason, the user does not need to perform an operation of inputting authentication information corresponding to the requested service every time a service is requested as in the prior art, so that the convenience of authentication processing can be improved.

 [0247] Also, according to the above configuration, encrypted authentication information is stored in the service using device. For this reason, even if the storage area of the service using device is analyzed, for example, the authentication information related to the service is not stolen. Therefore, the security (security) regarding authentication information can be improved.

 [0248] Further, the use device control unit stores the encrypted authentication information corresponding to the requested service in the encryption storage unit! In such a case, the encryption authentication information corresponding to the requested service is stored in the encryption storage unit. In this case, the user input is made via the input unit. Authentication information related to the requested service is transmitted as initial authentication information to a service providing apparatus that provides the service, and the service providing apparatus encrypts the authentication information and creates a cipher authentication information. When the initial authentication information is received from the service using device, the providing device control unit causes the authentication processing unit to perform the authentication processing of the initial authentication information and succeeds in authenticating the initial authentication information. In this case, the encryption unit encrypts the initial authentication information, and transmits the encryption key authentication information obtained by the encryption key to the service using apparatus that has transmitted the initial authentication information. Yo ヽ even formed.

[0249] According to the above configuration, the user apparatus control unit stores the encryption authentication information corresponding to the requested service in the encryption storage unit! In such a case, the encryption key authentication information is transmitted to the service providing apparatus. Then, when the encrypted authentication information corresponding to the requested service is stored in the encryption storage unit, the user device control unit can determine whether the user is the user via the input unit. Authentication information related to the requested service is transmitted to the service providing apparatus.

 [0250] For this reason, the encrypted authentication information corresponding to the service requested by the user is stored in the encryption storage unit. In other words, the authentication processing of the authentication information related to the service has not been completed before. Only in such a case, an authentication information input operation may be performed. Therefore, it is not necessary to input authentication information by the user during the second and subsequent authentication processing, and there is no need to input service authentication information every time as in the conventional case. Can be improved.

 [0251] Also, according to the above configuration, when the initial authentication information is successfully authenticated, the authentication information is encrypted and stored in the service using apparatus. That is, encrypted authentication information is stored in the service using device. For this reason, even if the storage area of the service using device is analyzed, for example, authentication information related to the service is not stolen. Accordingly, security (safety) related to authentication information can be improved.

 [0252] Further, the service providing apparatus includes an authentication information input unit that receives input of authentication information of a user permitted to provide a service, an encryption unit that encrypts the authentication information and creates encrypted authentication information, The providing device control unit causes the encryption information unit to encrypt the authentication information input to the authentication information input unit, and uses the encryption authentication information obtained by the encryption to use the service. It is good also as a structure which transmits to an apparatus.

 [0253] According to the above configuration, the service providing apparatus receives the input of the authentication information of the user permitted to provide the service, encrypts it, and transmits it to the service using apparatus. In this case, since the user of the service using device does not need to perform an authentication information input operation, convenience related to the authentication process can be improved.

 [0254] Note that the providing apparatus control unit may transmit the encrypted authentication information to the service using apparatus via a broadcast network.

[0255] In this case, the authentication information input unit receives an input of a terminal ID for identifying a service using device that is permitted to provide a service, and the providing device control unit receives the encrypted authentication information and the encrypted authentication information. It is also possible to transmit the terminal ID to the service using device. When transmitting encrypted authentication information via a transmission network, a service using device may receive encrypted authentication information transmitted to another service using device. Therefore, encryption authentication By transmitting the terminal ID together with the information, the service using device can determine whether or not the encrypted authentication information is transmitted to itself.

 [0256] In order to solve the above problems, the second service providing system of the present invention provides a service using apparatus and a service providing apparatus that provides the service using apparatus with a service requested by the service using apparatus via a network. A service relay device connected to the service relay device and a service providing device connected to the service relay device via a network, wherein the service using device is a user for specifying a requested service. An input unit that receives an input instruction, a cryptographic storage unit that stores the received cryptographic key authentication information, a utilization device control unit that transmits the cryptographic key authentication information corresponding to the requested service to the service relay device, The service providing apparatus includes an authentication information storage unit that stores authentication information of a user who is permitted to provide the service. An authentication processing unit that performs an authentication process for verifying authentication information received from a service relay device with authentication information of a user permitted to provide a service stored in the authentication information storage unit. The service relay device decrypts the encrypted authentication information to create the decrypted authentication information, and when receiving the encrypted authentication information from the service using device, the encrypted relay information is sent to the decryption unit. A relay control unit that decrypts and transmits the decryption key authentication information obtained by the decryption key to a service providing device that provides a service requested by the service using device that has transmitted the cipher key authentication information; It is characterized by being equipped with.

 [0257] According to the above configuration, the utilization device control unit transmits the encrypted authentication information to the service relay device when requesting the provision of a service. Then, the service relay device decrypts the received encrypted authentication information and transmits it to the service providing device, and the service providing device performs an authentication process on the decrypted key authentication information received from the service relay device. For this reason, the user does not need to perform an operation of inputting authentication information corresponding to the requested service every time the service is requested, so that the convenience of the authentication processing can be improved.

[0258] Also, according to the above configuration, encrypted authentication information is stored in the service using device. For this reason, even if the storage area of the service using device is analyzed, for example, the authentication information related to the service is not stolen. Therefore, the security information The utility (safety) can be increased.

 [0259] In addition, the service providing apparatus includes a providing control unit that transmits authentication result information indicating a result of the authentication process to the service relay apparatus, and the using apparatus control unit provides the service requested. When it is determined whether the corresponding encryption authentication information is stored in the encryption storage unit and the authentication is not possible, and the encryption authentication information corresponding to the requested service is not stored in the encryption storage unit The authentication information regarding the requested service is transmitted to the service relay apparatus as initial authentication information, and the user power is also input via the input unit, and the service relay apparatus encrypts the authentication information and transmits the encrypted authentication information. When the relay control unit receives the initial authentication information, the relay control unit transmits the received initial authentication information to the initial authentication information. If the authentication processing result is transmitted to the service providing device that provides the service requested by the service using device and the authentication processing result indicating that the authentication processing for the initial authentication information is successful, the initial The authentication information may be encrypted by the encryption unit, and the encryption key authentication information obtained by the encryption key may be returned to the service using apparatus that has transmitted the initial authentication information.

 [0260] According to the above configuration, the user apparatus control unit stores the encryption authentication information corresponding to the requested service in the encryption storage unit! In such a case, the encryption key authentication information is transmitted to the service relay device. When the encrypted authentication information corresponding to the requested service is stored in the encryption storage unit, the using device control unit relays the authentication information related to the requested service from the user via the input unit. Send to device.

 [0261] For this reason, the encrypted authentication information corresponding to the service requested by the user is stored in the encryption storage unit. In other words, the authentication processing of the authentication information related to the service has not been completed before. Only in such a case, an authentication information input operation may be performed. Therefore, it is not necessary for the user to input authentication information during the second and subsequent authentication processes, and there is no need to input service authentication information every time as in the conventional case. Can be improved.

[0262] Also, according to the above configuration, when the initial authentication information is successfully authenticated, the authentication information is encrypted and stored in the service using device. In other words, service interest The authentication device stores encrypted authentication information. For this reason, even if the storage area of the service using device is analyzed, for example, authentication information related to the service is not stolen. Accordingly, security (safety) related to authentication information can be improved.

 [0263] Also, according to the above configuration, a service providing apparatus that has the above-described configuration of the service using device and includes the encryption unit and the decryption unit in the service relay device, the conventional service The service providing apparatus used in the providing system can be used as it is. Therefore, the existing service providing apparatus can be used effectively.

 [0264] Also, in this case, when requesting provision of a plurality of services, the utilization device control unit collectively transmits the initial authentication information for each requested service to the service relay device, The relay control unit provides a service corresponding to each initial authentication information from among a plurality of service providing apparatuses connected via the network, with respect to each initial authentication information received by the service utilization apparatus power. When the service providing device is selected and transmitted, and the authentication processing result is received from each service providing device, the initial authentication information that has been successfully authenticated is encrypted by the encryption unit and obtained by the encryption key. A configuration may be adopted in which each encrypted authentication information is returned to the service using apparatus that has transmitted each initial authentication information.

 [0265] According to the configuration described above, when using a plurality of services, the user only has to input authentication information for each service in a lump. As a result, provision of a plurality of desired services can be received with a single authentication information input operation. Therefore, the convenience of the user at the time of initial authentication of each service can be further improved.

[0266] Further, when the use device control unit requests provision of a plurality of services, whether or not encryption authentication information for each requested service is stored in the encryption storage unit. For each service, it accepts the input of authentication information of the user power and sends the input authentication information to the service relay device as initial authentication information, and the relay control unit For each initial authentication information received from the service using device, a service providing device that provides a service corresponding to each initial authentication information is selected from a plurality of service providing devices connected via the network. When the authentication process result is received from each service providing device, each initial authentication information that has been successfully authenticated is received. The information may be encrypted by the encryption unit, and each encryption key authentication information obtained by the encryption key may be returned to the service using apparatus that has transmitted each initial authentication information.

 [0267] According to the above configuration, when a user uses a plurality of services, the authentication process has been completed before that! /, NA! /, Service (encryption authentication information is stored! You only need to enter authentication information for /, na! /, Service). Therefore, the convenience of the user regarding the input of authentication information can be further improved.

 [0268] Further, the service providing apparatus includes an authentication information input unit that receives authentication information of a user permitted to provide a service, and the providing apparatus control unit includes the authentication information input from the authentication information input unit. The service relay device includes an encryption unit that encrypts authentication information to create encryption authentication information, and the relay control unit also receives the authentication information from the service providing device. In this case, the authentication information may be encrypted in the encryption key unit, and the encryption key authentication information obtained by the encryption key may be transmitted to the service using apparatus.

 [0269] According to the above configuration, when the service providing apparatus accepts the input of the authentication information of the user permitted to provide the service, the input authentication information (the authentication information of the user permitted to provide the service) Is transmitted to the service relay device. Then, the service relay device encrypts the received authentication information and transmits it to the service using device. In this case, since the user of the service using device does not need to perform an authentication information input operation, convenience related to the authentication processing can be improved.

[0270] Further, the service relay apparatus includes an authentication information input unit that receives input of authentication information and information specifying a service providing apparatus that performs authentication processing using the authentication information, and encrypts the authentication information by encrypting the authentication information. The relay control unit transmits the authentication information input via the authentication information input unit to a service providing apparatus that performs authentication processing using the authentication information. When the authentication processing result indicating that the authentication processing is successful is received from the service providing device, the authentication information that has succeeded in the authentication is encrypted by the encryption unit, and the encryption obtained by the encryption is encrypted. The authentication authentication information may be transmitted to the service using device. [0271] According to the above configuration, the service relay apparatus receives input of authentication information and information specifying a service providing apparatus that performs authentication processing using the authentication information, and transmits the authentication information to the service providing apparatus. To do. When the service relay device receives an authentication processing result indicating that the authentication processing is successful from the service providing device, the service relay device encrypts the authentication information and transmits it to the service using device. As a result, the user of the service using device does not need to perform an authentication information input operation, so that convenience related to authentication processing can be improved.

 [0272] Note that the providing apparatus control unit may transmit the encrypted authentication information to the service using apparatus via a broadcast network. In this case, the authentication information input unit accepts an input of a terminal ID for identifying a service using device permitted to provide the service, and the providing device control unit receives the encrypted authentication information and the terminal ID. May be transmitted to the service using device.

 [0273] Also, when the use device control unit requests provision of a plurality of services, whether or not the encryption authentication information for each requested service is stored in the encryption storage unit. If the encrypted key authentication information for each service is stored, the encrypted authentication information is transmitted to the service relay device, and the relay control unit Each of the encrypted authentication information received is decrypted by the decryption unit, and the decryption key authentication information obtained by the decryption key is transmitted from each of a plurality of service providing apparatuses connected via the network. The service providing device that provides the service corresponding to the decryption key authentication information is selected and transmitted, and the service content is received from each of the service providing devices described above, and the received service content is grouped. It may be configured to reply to the service using apparatus that requested to provide serial services.

 [0274] According to the above configuration, when a plurality of services are used, the service contents provided from each service providing device are collected together by the service relay device and sent to the service using device. As a result, the service using apparatus can use a plurality of services provided by a plurality of service providing apparatuses at the same time, or use them in combination.

[0275] The service using apparatus of the present invention is a service receiving apparatus providing service. An input unit that receives an input instruction from a user for specifying a requested service, an encryption storage unit that stores the received encrypted authentication information, and an encryption corresponding to the requested service. And a utilization device control unit that transmits the authentication request information to the service providing device that provides the requested service.

[0276] According to the configuration described above, the user can request provision of a service without performing an authentication information input operation only by performing an input instruction for specifying the requested service. Further, according to the above configuration, the authentication information encrypted is stored in the service using device. For this reason, for example, even if the storage area of the service using device is analyzed, authentication information about the service is not stolen. Therefore, it is possible to improve security (security) related to authentication information.

 [0277] Further, the use device control unit determines whether or not the encryption authentication information corresponding to the requested service is stored in the encryption storage unit, and is stored. The authentication information related to the requested service input by the user via the input unit may be transmitted to the service providing apparatus that provides the service as initial authentication information.

 [0278] According to the above configuration, the user apparatus control unit stores the encryption authentication information corresponding to the requested service in the encryption storage unit! In such a case, the encryption key authentication information is transmitted to the service providing apparatus. Then, when the encrypted authentication information corresponding to the requested service is stored in the encryption storage unit, the using device control unit provides the authentication information related to the service requested from the user via the input unit. Send to device.

 [0279] For this reason, the user only needs to perform the authentication information input operation at the time of the first authentication. The user does not need to input the authentication information at the second and subsequent authentication processing. Therefore, the convenience related to the authentication process can be improved.

[0280] Also, a receiving unit that receives the encryption key authentication information and the terminal ID transmitted using the broadcast network, and determines whether or not the received terminal ID is a terminal ID corresponding to the service using device. A terminal ID determination unit, and when the received terminal ID is a terminal ID corresponding to the service using device, the using device control unit receives the encryption received together with the terminal ID. The authentication information may be stored in the encryption storage unit.

 [0281] According to the configuration described above, it is possible to select and store only the encryption key authentication information transmitted via the broadcast network and the information transmitted to be received by itself.

 [0282] The service providing apparatus of the present invention is a service providing apparatus that provides a service to a service using apparatus, and an authentication information storage unit that stores authentication information of a user permitted to provide the service, and a request for providing the service The authentication processing unit that performs authentication processing for verifying the authentication information of the user who has been registered with the authentication information of the user permitted to provide the service stored in the authentication information storage unit, and the encrypted authentication information by encrypting the authentication information When the initial authentication information is received, the authentication process for the initial authentication information is the authentication process described above when the encryption unit to be created, the decryption unit for decrypting the encrypted authentication information to create the decryption authentication information, and the initial authentication information are received If the initial authentication information is successfully authenticated, the initial encryption information is encrypted by the encryption key unit, and the encryption key authentication information obtained by the encryption key is returned. When the authentication information is received, the received encrypted authentication information is decrypted by the decryption unit, and the authentication processing unit performs authentication processing of the decryption authentication information obtained by the decryption. And a providing device control unit.

 [0283] According to the above configuration, the service using apparatus only needs to transmit the encrypted authentication information to the service providing apparatus at the time of initial authentication. Therefore, it is possible to reduce the burden on the user who is required to input authentication information.

 [0284] A second service providing apparatus of the present invention is a service providing apparatus that provides a service to a service using apparatus, an authentication information storage unit that stores authentication information of a user permitted to provide the service, An authentication processing unit that performs authentication processing for verifying the authentication information of the user who has requested the provision of service with the authentication information of the user permitted to provide the service stored in the authentication information storage unit, and permits the provision of the service The authentication information input unit that accepts input of user authentication information, the encryption unit that encrypts the authentication information to create encrypted authentication information, and the authentication information of the user permitted to provide the service are stored in the encryption unit. It is characterized by comprising a providing device control unit that encrypts and transmits the encrypted authentication information obtained by the encryption to the service using device.

[0285] According to the above configuration, the service using device receives the encryption of the service providing device. The provision of the service may be requested using the authentication information. Accordingly, since the user does not need to input authentication information, the burden on the user for inputting authentication information can be reduced.

 [0286] Note that the providing apparatus control unit may transmit the encrypted authentication information to the service using apparatus via a broadcast network. The authentication information input unit accepts an input of a terminal ID for identifying a service using device permitted to provide a service, and the providing device control unit uses the encrypted authentication information and the terminal ID for the service use. As a configuration to send to the device.

 [0287] The service relay device of the present invention is a service relay device that relays between a service using device and a service providing device that provides services to the service using device, and encrypts authentication information to encrypt authentication. When the initial authentication information is received from the service using device, the decryption unit that creates the decryption authentication information by decrypting the encryption key authentication information, and the initial authentication information received from the service using device When the authentication information is transmitted to the service providing device that provides the service and the encryption key authentication information is received from the service using device, the encryption key information is decrypted by the decryption key unit. The decryption key authentication information obtained by the decryption key is transmitted to the service providing apparatus, and the initial authentication information is transmitted to the service providing apparatus. When the authentication process result indicating that the authentication process has been successfully completed is received, the initial authentication information is encrypted in the above cipher part and the cipher obtained by the cipher key is used. And a relay control unit that returns the authentication information to the service using apparatus that has transmitted the initial authentication information.

 [0288] According to the above configuration, the service using device only needs to transmit the encrypted authentication information to the service providing device only at the time of the initial authentication. Therefore, it is possible to reduce the burden on the user who is required to input authentication information.

[0289] A second service relay device of the present invention is a service relay device that relays between a service using device and a service providing device that provides a service to the service using device, and encrypts authentication information and encrypts the encrypted information. Cryptographic unit for creating authentication information and service providing device Encrypt the authentication information of the user who is permitted to provide the received service in the above ciphering unit. And a relay control unit for transmitting the encrypted authentication information obtained by the encryption to the service using device.

 [0290] According to the above configuration, the service using device stores the encrypted authentication information received from the service relay device, and when requesting the provision of service, the service using device stores the encrypted authentication information. To send to. Therefore, the burden on the user for inputting authentication information can be reduced.

 [0291] A third service relay device of the present invention is a service relay device that relays between a service using device and a service providing device that provides a service to the service using device, and uses authentication information and the authentication information. An authentication information input unit that receives input of information specifying a service providing apparatus that performs authentication processing, an encryption unit that encrypts authentication information to create encrypted authentication information, and the authentication information input unit. Authentication information is sent to a service providing device that performs authentication processing using the authentication information, and when the authentication processing result indicating that the authentication processing is successful is received from the service providing device, the authentication is successful. And a relay control unit that encrypts the encrypted authentication information in the encryption key unit and transmits the encrypted authentication information obtained by the encryption key to the service using device. It is characterized in that Ru.

 [0292] According to the above configuration, the service using device stores the encrypted authentication information received from the service relay device, and when requesting the provision of service, the service using device stores the encrypted authentication information. To send to. Therefore, the burden on the user for inputting authentication information can be reduced.

 [0293] Note that the relay control unit may be configured to transmit the encrypted authentication information to the service using apparatus via a broadcast network. In this case, the relay control unit may transmit a terminal ID for identifying a service using device permitted to provide a service to the service using device together with the encryption key authentication information.

[0294] An authentication method of the present invention provides a service providing apparatus including a service using apparatus and a service providing apparatus that provides a predetermined service in response to a request from a service using apparatus connected via a network. An authentication method for authenticating a user who requests a service in the system, and encrypting authentication information of a user who is permitted to provide the service. An encryption step for generating certificate information, an encryption storage step for storing the encrypted authentication information in the service using device, and an input step for accepting an input instruction of user power for specifying the requested service in the service using device. A service request step for transmitting encrypted authentication information corresponding to the requested service from the service using apparatus to the service providing apparatus; and decrypting the transmitted encrypted authentication information to decrypt the encrypted authentication information. A decryption step of generating information, and an authentication processing step of collating the decryption authentication information with the authentication information of the user who is permitted to provide the service.

 [0295] According to the above authentication method, it is not necessary to perform an operation for inputting authentication information corresponding to a requested service every time a service is requested, so that convenience related to authentication processing is improved. be able to. Further, according to the above configuration, the authentication information stored in the service use device is stored. Therefore, the security (security) related to authentication information can be improved.

 [0296] Also, a determination step for determining whether or not the encryption authentication information for the service specified by the input instruction is stored in the service using device, and for the service specified by the input instruction In the case where the encryption key authentication information is stored in the service using device, the initial authentication information input step for accepting the input of the authentication information from the user, and the authentication information input in the initial authentication information input step, A user who is permitted to provide the service by the authentication information input in the first authentication information input step as a result of the authentication processing step. If the authentication information matches the authentication information, the encryption step of encrypting the authentication information to create encrypted authentication information, and the encrypted authentication information to the service using device Yo, it is performed and the encryption storage step of memorize in.

 [0297] Further, the encryption step and the decryption step may be executed by a service relay device that relays between the service using device and the service providing device.

[0298] According to the authentication method described above, it is possible to improve the convenience of the user related to the authentication information input operation and to increase the security related to the authentication information. In addition, the service providing apparatus used in the conventional service providing system can be used as it is. Therefore, existing service providing devices are It can be used effectively.

 [0299] A first authentication program of the present invention is for causing a computer to execute processing of each step in the above-described authentication method. By causing the computer to read this program, the processing of each step in the authentication method of the present invention can be realized by the computer.

 [0300] Further, the second authentication program of the present invention performs the processes of the encryption storage step, the input step, and the service request step in the authentication method described above on the computer provided in the service use device or the service use device. It is intended to be executed by a connected computer. By causing the computer to read this program, it is possible to realize the encryption storage step, the input step, and the service request step in the authentication method of the present invention by the computer.

 [0301] Further, the third authentication program of the present invention provides a computer provided in the service providing apparatus or the service described above for the encryption process, the decryption process, and the authentication process in the authentication program. This is to be executed by a computer connected to the providing device. By causing the computer to read this program, the encryption process, the decryption process, and the authentication process in the authentication method of the present invention can be realized by the computer.

 [0302] Further, a fourth authentication program of the present invention comprises a service relay device that relays the process of encryption and decryption in the above authentication method between the service utilization device and the service providing device. To be executed by a connected computer or a computer connected to the service relay device. By causing the computer to read this program, the encryption process and the decryption process can be realized by the computer.

 [0303] Also, by storing any of the above authentication programs on a computer-readable recording medium, the program can be easily stored and distributed. Furthermore, by reading the recording medium, it is possible to carry out the processing of each step in the authentication method of the present invention by a computer.

[0304] The present invention is not limited to the embodiments described above, but within the scope of the claims. Various modifications are possible, and embodiments obtained by appropriately combining technical means disclosed in different embodiments are also included in the technical scope of the present invention.

 [0305] The specific embodiments or examples made in the detailed description section of the invention are to clarify the technical contents of the present invention, and are limited to such specific examples. Therefore, various modifications can be made within the spirit of the present invention and the scope of the following claims, which should not be interpreted in a narrow sense.

 Industrial applicability

[0306] The present invention is a service providing system including an information terminal device and a service providing device that provides a service to the information terminal device, and a service that authenticates a user when providing the service. The present invention can be applied to a providing system, an information terminal device used in the service providing system, a service providing device, a service relay device, and an authentication method.

Claims

The scope of the claims  [1] A service providing system comprising a service using device and a service providing device that provides a predetermined service in response to a request of a service using device connected via a network,  The service using device is  An input unit for receiving an input instruction of user power for specifying a requested service, an encryption storage unit for storing the received encrypted authentication information,  A utilization device controller that transmits encrypted authentication information corresponding to the requested service to a service providing device that provides the requested service, and  The service providing apparatus includes:  Authentication information storage unit for storing authentication information of a user who is permitted to provide a service, and authentication information of a user who is permitted to provide a service stored in the authentication information storage unit in which the authentication information of a user who has requested the service provision is stored An authentication processing unit that performs an authentication process for checking with  A decryption unit that decrypts the encrypted authentication information to create decryption authentication information, and when the encrypted authentication information is received from the service using device, the received encrypted authentication information is decrypted by the decryption unit. And a providing device control unit that causes the authentication processing unit to perform authentication processing of the decryption key authentication information obtained by the decryption key.  [2] The utilization device control unit  It is determined whether the encryption authentication information corresponding to the requested service is stored in the encryption storage unit, and the encryption authentication information corresponding to the requested service is stored in the encryption storage unit. If it is not stored, user power is also input via the input unit. Authentication information regarding the requested service is transmitted as initial authentication information to a service providing apparatus that provides the service.  The service providing apparatus includes: An encryption unit that encrypts the authentication information to create encryption authentication information, and the providing device control unit includes: When the initial authentication information is received from the service using device, the authentication processing unit performs the authentication process of the initial authentication information, and when the initial authentication information is successfully authenticated, the encryption unit performs the initial authentication. 2. The service providing system according to claim 1, wherein the information is encrypted, and the encryption key authentication information obtained by the encryption key is transmitted to the service using apparatus that has transmitted the initial authentication information. [3] The service providing apparatus is  An authentication information input unit that receives input of authentication information of a user permitted to provide a service;  An encryption unit that encrypts authentication information and creates encryption authentication information, and the providing device control unit includes:  The authentication information input to the authentication information input unit is encrypted by the encryption unit, and the encryption key authentication information obtained by the encryption key is transmitted to the service using device. Service providing system described in 1. [4] The providing device control unit  4. The service providing system according to claim 3, wherein the encrypted authentication information is transmitted to the service using apparatus via a broadcast network. [5] The authentication information input unit receives an input of a terminal ID for identifying a service using device permitted to provide a service,  5. The service providing system according to claim 4, wherein the providing device control unit transmits the encrypted authentication information and the terminal ID to the service using device. [6] A service use device, a service relay device that connects the service use device to a service providing device that provides a service requested by the service use device, and is connected to the service relay device via the network A service system comprising a service providing device,  The service using device is  An input unit for receiving an input instruction of user power for specifying a requested service, an encryption storage unit for storing the received encrypted authentication information, Send encrypted authentication information corresponding to the requested service to the service relay device. A utilization device control unit,  The service providing apparatus includes:  The authentication information storage unit that stores the authentication information of the user permitted to provide the service, and the authentication information received from the service relay device are compared with the authentication information of the user permitted to provide the service stored in the authentication information storage unit. An authentication processing unit for performing authentication processing to be performed, and  The service relay device  A decryption unit that decrypts the encrypted authentication information and creates the decryption authentication information; and when the encrypted authentication information is received from the service using device, the decryption unit decrypts the encrypted information, and A relay control unit for transmitting the decryption authentication information obtained by the decryption to the service providing device that provides the service requested by the service using device that has transmitted the encryption key authentication information. Service providing system characterized by  The service providing apparatus includes a provision control unit that transmits authentication result information indicating a result of the authentication processing to the service relay apparatus.  The utilization device controller is  It is determined whether the encryption authentication information corresponding to the requested service is stored in the encryption storage unit, and the encryption authentication information corresponding to the requested service is stored in the encryption storage unit. If it is not stored, user power is also input via the input unit. Authentication information regarding the requested service is transmitted to the service relay device as initial authentication information.  The service relay device  An encryption unit that encrypts authentication information and creates encryption key authentication information, and the relay control unit includes: Service use device capability When the initial authentication information is received, the received first authentication information is transmitted to the service providing device that provides the service requested by the service using device that has transmitted the initial authentication information, and the service providing device When the authentication process result indicating that the authentication process for V is successful for the above initial authentication information is received from 7. The authentication information is encrypted by the encryption unit, and the encrypted authentication information obtained by the encryption is returned to the service using apparatus that transmitted the initial authentication information. Service provision system. [8] The utilization device control unit  When requesting the provision of multiple services, the initial authentication information for each requested service is collectively sent to the service relay device,  The relay control unit  Select the service providing device that provides the service corresponding to each initial authentication information from among the plurality of service providing devices connected via the network. Send  When the authentication processing result is received from each service providing device, the initial authentication information that has been successfully authenticated is encrypted by the encryption unit, and each encryption authentication information obtained by the encryption key is stored in the corresponding encryption information. 8. The service providing system according to claim 7, wherein the service providing system replies to the service using apparatus that has transmitted the initial authentication information. [9] The utilization device control unit  When requesting the provision of multiple services, the encryption authentication information for each requested service is stored in the encryption storage unit! Judge whether or not, remember! Wow! / ヽ Each service accepts input of authentication information of all user power, sends the input authentication information to the service relay device as initial authentication information,  The relay control unit  Select the service providing device that provides the service corresponding to each initial authentication information from among the plurality of service providing devices connected via the network. Send  When the authentication processing result is received from each service providing device, the initial authentication information that has been successfully authenticated is encrypted by the encryption unit, and each encryption authentication information obtained by the encryption key is stored in the corresponding encryption information. 8. The service providing system according to claim 7, wherein the service providing system replies to the service using apparatus that has transmitted the initial authentication information. [10] The service providing apparatus includes: It has an authentication information input unit that accepts authentication information of users who are allowed to provide services.  The providing device control unit  The authentication information input from the authentication information input unit is transmitted to a service relay device.  A cryptographic key section for encrypting the authentication information to create the cryptographic key authentication information,  The relay control unit  When the authentication information is received from the service providing device, the authentication information is encrypted by the encryption key unit, and the encryption key authentication information obtained by the encryption key is transmitted to the service using device. The service providing system according to claim 7. [11] The service relay device  An authentication information input unit that receives input of authentication information and information specifying a service providing apparatus that performs authentication processing using the authentication information;  An encryption unit that encrypts authentication information and creates encryption authentication information, and the relay control unit includes:  Authentication processing result indicating that the authentication information input via the authentication information input unit is transmitted to a service providing apparatus that performs authentication processing using the authentication information, and that the authentication processing is successful from the service providing apparatus. 8. When receiving the authentication information, the authentication information successful in the authentication is encrypted by the encryption unit, and the encrypted authentication information obtained by the encryption is transmitted to the service using device. Service providing system described in 1.  [12] The relay control unit  12. The service providing system according to claim 10, wherein the encrypted authentication information is transmitted to the service using device via a broadcast network. [13] The relay control unit The service providing system according to claim 12, wherein a terminal ID for identifying a service using device permitted to provide a service is transmitted to the service using device together with the encrypted authentication information. [14] The utilization device control unit  When requesting the provision of a plurality of services, the encryption authentication information for each requested service is stored in the encryption storage unit, and it is determined whether or not it is powerful. If the information is stored, the encrypted authentication information is sent to the service relay device, and  The relay control unit  A plurality of service providing devices connected to each other through the network by causing the decryption unit to decrypt each encrypted authentication information received from the service using device, and decrypting the authentication information obtained by the decryption The service providing device that provides the service corresponding to each decryption key authentication information is selected and transmitted,  8. The service provision according to claim 7, wherein the service contents are received from each of the service provision apparatuses, and the received service contents are collectively returned to the service use apparatus that has requested the provision of the service. system. [15] Service providing device capability A service using device that receives a service,  An input unit for receiving an input instruction of user power for specifying a requested service, an encryption storage unit for storing the received encrypted authentication information,  A service utilization apparatus comprising: a utilization apparatus control unit that transmits encrypted authentication information corresponding to the requested service to a service provision apparatus that provides the requested service. [16] The utilization device control unit  The encryption authentication information corresponding to the requested service is stored in the encryption storage unit !, and is stored in the encryption storage unit. In such a case, it is input from the user via the input unit. 16. The service using apparatus according to claim 15, wherein authentication information related to the requested service is transmitted as initial authentication information to a service providing apparatus that provides the service. [17] A receiving unit that receives the encryption key authentication information and the terminal ID transmitted using the broadcast network, and a terminal ID that determines whether the received terminal ID is a terminal ID corresponding to the service using device. A determination unit, The utilization device controller is  The service use according to claim 15, wherein when the received terminal ID is a terminal ID corresponding to the service using device, the encrypted authentication information received together with the terminal ID is stored in the encryption storage unit. apparatus. [18] The service utilization device according to claim 15, wherein the service utilization device communicates with the service providing device via a service relay device. [19] A service providing device that provides a service to a service using device,  Authentication information storage unit for storing authentication information of a user who is permitted to provide a service, and authentication information of a user who is permitted to provide a service stored in the authentication information storage unit in which the authentication information of a user who has requested to provide a service is stored. An authentication processing unit that performs an authentication process for checking with  An encryption part for encrypting authentication information to create encryption key authentication information;  A decryption unit that decrypts encrypted authentication information to create decryption authentication information, and when initial authentication information is received, causes the authentication processing unit to perform authentication processing of the initial authentication information, and When the authentication of the information is successful, the initial authentication information is encrypted in the encryption key part, the encryption authentication information obtained by the encryption key is returned, and the encrypted authentication information is received. A providing device control unit that causes the decryption unit to decrypt the received encrypted authentication information and causes the authentication processing unit to perform authentication processing of the decryption authentication information obtained by the decryption. A service providing apparatus characterized by that.  [20] A service providing device that provides a service to a service using device,  Authentication information storage unit for storing authentication information of a user who is permitted to provide a service, and authentication information of a user who is permitted to provide a service stored in the authentication information storage unit in which the authentication information of a user who has requested to provide a service is stored. An authentication processing unit that performs an authentication process for checking with An authentication information input unit that receives input of authentication information of a user permitted to provide a service; An encryption part for encrypting authentication information to create encryption key authentication information;  A providing device control unit for encrypting authentication information of a user permitted to provide a service in the encryption key unit and transmitting the encryption key authentication information obtained by the encryption key to the service using device; A service providing apparatus characterized by that.  [21] The providing device control unit includes:  21. The service providing apparatus according to claim 20, wherein the encrypted authentication information is transmitted to the service using apparatus via a broadcast network. [22] The authentication information input unit receives an input of a terminal ID for identifying a service using device permitted to provide a service,  The service providing apparatus according to claim 21, wherein the providing apparatus control unit transmits the encrypted authentication information and the terminal ID to the service using apparatus. [23] A service relay device that relays between a service using device and a service providing device that provides a service to the service using device,  An encryption part for encrypting authentication information to create encryption key authentication information;  Decryption unit that decrypts encrypted authentication information to create decryption authentication information, and service use device power When initial authentication information is received, the received initial authentication information is transmitted to the service providing device that provides the service And  When receiving encrypted authentication information from the service using device, the decryption key is decrypted by the decryption key, and the decryption key authentication information obtained by the decryption key is transmitted to the service providing device. And  When the initial authentication information is transmitted to the service providing apparatus and the authentication process result indicating that the authentication process for the initial authentication information is successful is received from the service providing apparatus, the initial authentication information is A relay control unit that encrypts the cipher key unit and returns the cipher key authentication information obtained by the cipher key to the service using device that has transmitted the initial authentication information. This is a service relay device. [24] A service relay device that relays between a service using device and a service providing device that provides a service to the service using device, An encryption part for encrypting authentication information to create encryption key authentication information;  The authentication information of the user permitted to provide the service received from the service providing device is encrypted by the encryption unit, and the encrypted authentication information obtained by the encryption is transmitted to the service using device. A service relay device comprising a relay control unit.  [25] A service relay device that relays between a service using device and a service providing device that provides a service to the service using device,  An authentication information input unit that receives input of authentication information and information specifying a service providing apparatus that performs authentication processing using the authentication information;  An encryption part for encrypting authentication information to create encryption key authentication information;  Authentication processing result indicating that the authentication information input via the authentication information input unit is transmitted to a service providing apparatus that performs authentication processing using the authentication information, and that the authentication processing is successful from the service providing apparatus. A relay control unit that causes the encryption unit to encrypt authentication information that has been successfully authenticated, and transmits the encrypted authentication information obtained by the encryption to the service using device. Service relay device characterized by this. [26] The relay control unit  26. The service relay device according to claim 24, wherein the encrypted authentication information is transmitted to the service utilization device via a broadcast network. [27] The relay control unit  27. The service relay apparatus according to claim 26, wherein a terminal ID for identifying a service utilization apparatus permitted to provide a service is transmitted to the service utilization apparatus together with the encrypted authentication information. [28] Authenticates a user who requests a service in a service providing system including a service using device and a service providing device that provides a predetermined service in response to a request from a service using device connected via a network An encryption method for generating encrypted authentication information by encrypting authentication information of a user permitted to provide a service; and An encryption storage step of storing the encrypted authentication information in the service using device; an input step of accepting an input instruction of user power for specifying the requested service in the service using device;  A service requesting step for transmitting encrypted authentication information corresponding to the requested service from the service using device to the service providing device;  A decryption step for decrypting the transmitted encryption key authentication information to create decryption key authentication information;  An authentication method comprising: an authentication processing step of collating the decrypted authentication information with authentication information of a user permitted to provide a service.  [29] For a service specified by the input instruction, a determination step for determining whether or not all encryption authentication information is stored in the service using device;  In the case where the encryption key authentication information for the service specified by the input instruction is stored in the service using device, an initial authentication information input step for accepting input of authentication information from the user,  Including a first authentication processing step of verifying the authentication information input in the first authentication information input step with the authentication information of a user permitted to provide the service,  As a result of the authentication process, if the authentication information entered in the initial authentication information input process matches the authentication information of the user permitted to provide the service, the authentication information is encrypted to create encrypted authentication information. 30. The authentication method according to claim 28, further comprising: an encryption step for performing encryption, and an encryption storage step for storing the encrypted authentication information in a service using device.  30. The authentication method according to claim 28, wherein the encryption step and the decryption step are executed in a service relay device that relays between the service using device and the service providing device.  [31] An authentication program for causing a computer to execute processing of each step in the authentication method according to claim 28. [32] The computer or the service provided in the service using device performs the processes of the encryption storage step, the input step, and the service request step in the authentication method according to claim 28. An authentication program to be executed by a computer connected to a device using a service.  [33] A computer provided in the service providing apparatus or a computer connected to the service providing apparatus for performing the encryption process, the decryption process, and the authentication process in the authentication method according to claim 28. Authentication program to be executed.  [34] The computer or the service provided in the service relay device that relays the encryption process and the decryption process in the authentication method according to claim 28 between the service utilization device and the service providing device. An authentication program that is executed by a computer connected to a relay device.  [35] A computer-readable recording medium on which the authentication program according to any one of claims 31 to 34 is recorded.