Authentication system, authentication device, and authentication method

Abstract

To prevent account information of an unauthenticated user from being used for fraudulent registration of a device.SOLUTION: An authentication system according to the present invention has a device account generating unit 32 for generating a device account by generating a device key in addition to a device ID upon reception of a serial number from a printer 100 as a trigger, an encrypted device account information transmitting unit 33 for transmitting the device key and the device ID encrypted by key information simultaneously generated and the key information to the printer 100, and an encrypted device code transmitting unit 35 for authenticating the device ID an a decoded device key transmitted from the printer 100. Authentication by using the device key in addition to the device ID can effectively prevent a device from being fraudulently registered as compared with a prior art using authentication with a device ID only.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to an authentication system, an authentication device, and an authentication method, and more particularly to a technique for performing authentication when a user who wishes to use a device-related service registers a device to his or her user account. [Background technology]

[0002] Generally, a technology called authentication is used to verify the identity of the user accessing the service to ensure that only authorized users are permitted to use cloud services provided by servers on the Internet. In most cases, authentication is performed using account information consisting of a combination of an ID and a password. In addition to IDs and passwords, IC cards and biometric information (biometric information such as fingerprints or retina scans) may also be used.

[0003] In a system that provides users with device-related cloud services, when a specific user is authorized to use the service, the device must be registered with the specific user's account information. In this case, device-specific information such as a device ID is used to register the device. However, if the device ID is stolen due to improper management or an attack, there is a risk that an unauthorized third party could spoof the device and register the device with the unauthorized user's account information.

[0004] There is known a system that authenticates the legitimacy of a device using its serial number (for example, Patent Document 1). In the information processing system described in Patent Document 1, a higher-level device (host computer) generates device authentication information and a random number based on the serial number of the information processing device (card reader), and transmits them to the information processing device. Using the commonly held device authentication information and random number, the information processing device is authenticated as a legitimate device by a symmetric key cryptosystem. However, the technology described in Patent Document 1 is intended to authenticate the legitimacy of a device, and cannot prevent unauthorized users from fraudulently registering devices to account information. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2013-73299 Summary of the Invention [Problem to be solved by the invention]

[0006] The present invention has been made to solve such problems, and aims to prevent fraudulent registration of devices to fraudulent user account information in a system that provides device-related services to users. [Means for solving the problem]

[0007] To solve the above-mentioned problems, in the present invention, when device ownership information is sent from a device to an account management server, the account management server generates a device account by generating a device key required for using the management service in addition to a device ID that is information unique to the device, encrypts the device key with the generated key information, and then transmits the encrypted device key, device ID, and key information to the device.The authenticity of the device ID and decrypted device key subsequently sent from the device is then authenticated, and if they are confirmed to be authentic, further processing of linking the user account with the device account is permitted. [Effects of the Invention]

[0008] According to the present invention configured as described above, authentication is performed using a device key in addition to a device ID, so that in a system that provides device-related services to users, it is possible to more effectively prevent fraudulent registration of a device to the account information of a fraudulent user than in the conventional technology in which authentication was performed using only a device ID. [Brief explanation of the drawings]

[0009] [Figure 1] 1 is a diagram illustrating an example of the overall configuration of an authentication system according to an embodiment of the present invention. [Figure 2] FIG. 2 is a block diagram showing an example of the functional configuration of a printer according to the present embodiment. [Figure 3] FIG. 2 is a block diagram illustrating an example of a functional configuration of a service providing server according to the present embodiment. [Figure 4] 10 is a flowchart illustrating an example of the operation of the authentication system according to the present embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] An embodiment of the present invention will be described below with reference to the drawings. Fig. 1 is a diagram showing an example of the overall configuration of an authentication system according to this embodiment. As shown in Fig. 1, the authentication system according to this embodiment is configured to include a printer 100, which is an example of a device, a user terminal 200, a service providing server 300, and a device management server 400. The service providing server 300 includes a device account management server 301 that manages device accounts, and a user account management server 302 that manages user accounts. The device account management server 301 and the user account management server 302 correspond to the account management server and authentication device in the claims.

[0011] The printer 100 and the service providing server 300, the user terminal 200 and the service providing server 300, and the service providing server 300 and the device management server 400 are connected via a communication network 500 such as the Internet or a mobile phone network. The printer 100 and the user terminal 200 are connected via a wired cable or wireless communication means.

[0012] The authentication system of this embodiment is a system that authenticates a user who wishes to use a management service related to the printer 100 when the user registers the printer 100 in his or her own user account. The content of the management service related to the printer 100 is arbitrary. For example, the management service can be a service in which the service providing server 300 and the device management server 400 monitor the status of the printer 100 and notify the user terminal 200 of the detected status of the printer 100. When the user starts using this management service, the user is authenticated by the authentication system of this embodiment, and if the authentication is successful, the user is able to use the service.

[0013] The user terminal 200 is, for example, a smartphone, tablet, laptop, or desktop computer. An application having a function for executing printing using the printer 100 is installed on the user terminal 200, and it is possible to issue print instructions to the printer 100 through the application. The user terminal 200 also has a web browser function, and can communicate with the service providing server 300 using the web browser function or application function to use the management service.

[0014] The printer 100 executes printing in accordance with instructions from the user terminal 200. The printer 100 also detects various conditions and sends status information indicating the conditions to the service providing server 300. The detected conditions of the printer 100 include, for example, whether the cover is open or closed, whether paper is ejected, whether paper is present or absent, the remaining ink or toner level, the remaining battery level, the print result (print success / failure), and print setting information (paper settings, number of prints, print quality, color / black and white selection, image processing method, etc.). In addition, the status of devices connected as extension devices to the printer 100's USB port, wireless port, etc. may also be detected. Examples of extension devices include a camera module, audio equipment, and electronic locking mechanism. Detected conditions include whether or not an image has changed due to a camera module, whether or not sound has been changed or picked up by an audio equipment, and whether or not an electronic locking mechanism has been unlocked. It is preferable to have the service providing server 300 recognize the extension devices connected to the printer 100 in advance.

[0015] The service providing server 300 uses the status information sent from the printer 100 to manage the status of the printer 100 in cooperation with the device management server 400, provides the above-mentioned management service to the user terminal 200, and performs authentication processing when a user who wishes to use the management service registers the printer 100 in their own user account.

[0016] 1 shows a configuration in which the provision of the management service and the authentication process are performed by the same service providing server 300, but this is not limiting. For example, a configuration may be possible in which a device account management server 301 and a user account management server 302 are provided separately from the service providing server 300 that provides the management service.

[0017] 1 shows a configuration assuming that the management service is used on the user terminal 200 that performs printing using the printer 100, but the present invention is not limited to this. For example, a terminal (not shown) that performs printing using the printer 100 may exist separately from the user terminal 200 that uses the management service. As a specific example, a POS terminal and the printer 100 may be connected, and printing may be performed from the POS terminal to the printer 100, while the management service is used on the user terminal 200.

[0018] Fig. 2 is a block diagram showing an example of the functional configuration of the printer 100 according to this embodiment. Fig. 3 is a block diagram showing an example of the functional configuration of the service providing server 300 according to this embodiment. Figs. 2 and 3 mainly illustrate the main components related to the authentication process of this embodiment, and the contents of this authentication process will be explained in detail below. The process related to the provision and use of the management service is not the subject of this invention, so it will only be briefly explained.

[0019] 2, the printer 100 of this embodiment has, as its functional configuration, a device possession information transmission unit 11, an encrypted device account information reception unit 12, a decrypted device account information transmission unit 13, an encrypted device code reception unit 14, and a decrypted device code transmission unit 15. The printer 100 also has an internal storage device 10 as a storage medium.

[0020] Each of the functional blocks 11 to 15 can be configured by any of hardware, a DSP (Digital Signal Processor), and software. For example, when configured by software, each of the functional blocks 11 to 15 is actually configured with a CPU, RAM, ROM, etc. of a computer, and is realized by the operation of a program stored in a storage medium such as RAM, ROM, a hard disk, or a semiconductor memory (which may be the same as or different from the internal storage device 10).

[0021] 3, the service providing server 300 of this embodiment includes, as functional components of the device account management server 301 and the user account management server 302, a device possession information receiving unit 31, a device account generating unit 32, an encrypted device account information transmitting unit 33, a decrypted device account information receiving unit 34, an encrypted device code transmitting unit 35, a decrypted device code receiving unit 36, and an association registration unit 37. The service providing server 300 also includes an account information storage unit 30 as a storage medium. Of these, functional blocks 31 to 36 form the configuration of the device account management server 301, and functional block 37 forms the configuration of the device account management server 301 and the user account management server 302.

[0022] The above-mentioned functional blocks 31 to 37 can be configured by any of hardware, DSP, and software. For example, when configured by software, the above-mentioned functional blocks 31 to 37 are actually configured with a CPU, RAM, ROM, etc. of a computer, and are realized by the operation of a program stored in a storage medium such as RAM, ROM, a hard disk, or a semiconductor memory (which may be the same as or different from the account information storage unit 30).

[0023] The device ownership information transmission unit 11 of the printer 100 transmits device ownership information, which is unique information held by the printer 100, to the device account management server 301 of the service providing server 300. The device ownership information is information held by the printer 100, and may be any information that can uniquely identify each individual printer 100. For example, the serial number of the printer 100 can be used as the device ownership information. In the following description, it is assumed that the device ownership information is the serial number.

[0024] The device ownership information receiving unit 31 of the service providing server 300 receives the serial number transmitted from the printer 100. In response to the serial number received by the device ownership information receiving unit 31, the device account generating unit 32 generates a device ID, which is information unique to the device, a device key required to use the management service, and key information used to encrypt / decrypt the device key, and generates a device account using the device ID and device key. The device account information consisting of the device ID and device key and the key information used for encryption / decryption are then stored in the account information storage unit 30 in association with the serial number.

[0025] The device key required to use the management service is issued by the device management server 400, which manages the printer 100 in cooperation with the service provider server 300. The device management server 400 provides a cloud service, such as Azure IoT Hub, and the service provider server 300 and device management server 400 cooperate via an API (Application Programming Interface). The device key is a key required to access the device management server 400, and the service provider server 300 obtains the device key issued by the device management server 400. The key information used for encryption / decryption is, for example, key information used for encryption / decryption using a symmetric key cryptosystem, and includes an encryption / decryption symmetric key and an initialization vector. The initialization vector is a random bit string that makes data difficult to decipher, and its use allows the encryption result to be changed each time. Note that various types of initialization vectors can be generated using various encryption algorithms.

[0026] The account information storage unit 30 stores user account information including a user ID and a password in addition to the device account information generated by the device account generation unit 32. The user account can be set in advance at any timing different from the time the device account information is generated, and the user account information can be stored in advance in the account information storage unit 30. The authentication system of this embodiment performs authentication to determine whether or not to permit linking of the user account information with the device account information (registration of the printer 100 to the user account). Note that when a user who has not previously set up a user account attempts to register the printer 100, it is also possible for the device account generation unit 32 to generate device account information, and then subsequently set up a user account and store the set user account information in the account information storage unit 30.

[0027] The encrypted device account information sending unit 33 encrypts the device key stored in the account information storage unit 30 with key information, and sends the encrypted device key (hereinafter referred to as the encrypted device key), the device ID, and the key information to the printer 100. The encrypted device account information receiving unit 12 of the printer 100 receives the encrypted device key, the device ID, and the key information sent from the service providing server 300, and stores the received information in the internal storage device 10.

[0028] In response to an instruction from the user, the decrypted device account information sending unit 13 decrypts the encrypted device key using key information stored in the internal storage device 10, and sends the decrypted device key (hereinafter referred to as the decrypted device key) and the device ID to the device account management server 301 of the service providing server 300. For example, in response to an instruction from the user, the decrypted device account information sending unit 13 accesses an internal server of the printer 100 and displays a linking button on the display of the printer 100 to instruct the printer 100 to link the user account with the device account of the printer 100. When the user presses this linking button, the decrypted device account information sending unit 13 assigns the device ID as a parameter to a predetermined Uniform Resource Locator (URL) indicating the address of the device account management server 301, assigns the decrypted device key to the header, and sends the URL.

[0029] The decrypted device account information receiving unit 34 of the service providing server 300 receives the device ID and decrypted device key transmitted from the printer 100 after the transmission process by the encrypted device account information transmitting unit 33. The encrypted device code transmitting unit 35 of the service providing server 300 authenticates the validity of the device ID and decrypted device key received by the decrypted device account information receiving unit 34, and if the validity is confirmed, generates a unique device code used to link the user account with the device account and stores it in the account information storage unit 30. The encrypted device code is then encrypted using key information stored in the account information storage unit 30, and transmits the encrypted device code (hereinafter referred to as the encrypted device code) to the printer 100. The validity of the device ID and decrypted device key is authenticated by determining whether the device ID and decrypted device key received by the decrypted device account information receiving unit 34 match the device ID and device key stored in the account information storage unit 30.

[0030] The encrypted device code receiving unit 14 of the printer 100 receives the encrypted device code transmitted from the device account management server 301 after the transmission process by the decrypted device account information transmitting unit 13. The decrypted device code transmitting unit 15 decrypts the encrypted device code received by the encrypted device code receiving unit 14 using key information stored in the internal storage device 10, and transmits the decrypted device code (hereinafter referred to as the decrypted device code) to the device account management server 301, requesting that a linking screen be provided. The decrypted device code receiving unit 36 ​​of the device account management server 301 receives the decrypted device code transmitted from the printer 100 after the transmission process by the encrypted device code transmitting unit 35.

[0031] The linking registration unit 37 authenticates the authenticity of the decrypted device code received by the decrypted device code receiving unit 36, and if the authenticity is confirmed, provides the printer 100 with a linking screen for linking the user account with the device account. The authenticity of the decrypted device code is authenticated by determining whether the decrypted device code received by the decrypted device code receiving unit 36 ​​matches the device code stored in the account information storage unit 30.

[0032] The association screen provided by the association registration unit 37 is, for example, a screen for signing in to the service providing server 300 by inputting user account information. For example, when the association registration unit 37 confirms that the decrypted device code received by the decrypted device code receiving unit 36 ​​is valid, it requests the user account management server 302 for an association screen, and in response, the user account management server 302 provides the sign-in screen to the printer 100. Note that the sign-in screen may be provided to the user terminal 200 based on address information of the user terminal 200 that is stored in advance in the account information storage unit 30 together with the user account information. The association registration unit 37 then associates the user account information input by the user via the sign-in screen with the device account information generated by the device account generation unit 32, and registers them in the account information storage unit 30.

[0033] When the linking registration unit 37 links the user account information with the device account information, it grants the user corresponding to the user account the right to use the management service related to the printer 100 corresponding to the device account. After that, the user who has been granted the right to use the management service of the service providing server 300 can use it by inputting the user account information.

[0034] Furthermore, after the link registration unit 37 has registered the link between the user account information and the device account information, when the printer 100 accesses the service providing server 300 to transmit status information, the decrypted device account information transmitting unit 13 transmits the decrypted device key and device ID to the device account management server 301 to be authenticated.

[0035] 4 is a flowchart showing an example of the operation of the authentication system according to this embodiment configured as described above. In the example of operation shown in FIG. 4, it is assumed that user account information is stored in advance in the account information storage unit 30.

[0036] First, the user connects the printer 100 to the communication network 500 and instructs the printer 100 to transmit the serial number. The device possession information transmission unit 11 of the printer 100 transmits the serial number of the printer 100 to the device account management server 301 in accordance with the instruction from the user (step S1). When the device possession information reception unit 31 of the device account management server 301 receives the serial number from the printer 100, the device account generation unit 32 generates a device ID, a device key, and key information to generate a device account (step S2), and stores the generated device account information and key information in association with the serial number in the account information storage unit 30 (step S3).

[0037] Next, the encrypted device account information sending unit 33 encrypts the device key stored in the account information storage unit 30 with the key information, and sends the encrypted device key, device ID, and key information to the printer 100 (step S4). The encrypted device account information receiving unit 12 of the printer 100 receives the encrypted device key, device ID, and key information sent from the service providing server 300, and stores the received information in the internal storage device 10 (step S5).

[0038] Next, in response to an instruction from the user, the decrypted device account information sending unit 13 decrypts the encrypted device key using the key information stored in the internal storage device 10, and sends the decrypted device key and the device ID to the device account management server 301 (step S6). When the decrypted device account information receiving unit 34 of the device account management server 301 receives the device ID and decrypted device key from the printer 100, the encrypted device code sending unit 35 authenticates the validity of the received device ID and decrypted device key (step S7).

[0039] If the encrypted device code transmission unit 35 does not confirm that the received device ID and decryption device key are valid (step S8: No), it transmits an error message to the printer 100 (step S9) and terminates the processing of the flowchart shown in Fig. 4. On the other hand, if the encrypted device code transmission unit 35 confirms that the received device ID and decryption device key are valid (step S8: Yes), it generates a unique device code and stores it in the account information storage unit 30 (step S10). Then, it encrypts the device code using the key information stored in the account information storage unit 30 and transmits the encrypted device code to the printer 100 (step S11).

[0040] When the encrypted device code receiving unit 14 of the printer 100 receives the encrypted device code from the device account management server 301, the decrypted device code sending unit 15 decrypts the encrypted device code received by the encrypted device code receiving unit 14 using the key information stored in the internal storage device 10, and sends the decrypted device code to the device account management server 301, requesting the provision of a linking screen (step S12).

[0041] When the decrypted device code receiving unit 36 ​​of the device account management server 301 receives the decrypted device code from the printer 100, the association registration unit 37 (device account management server 301) authenticates the validity of the received decrypted device code (step S13). If the association registration unit 37 does not confirm that the received decrypted device code is valid (step S14: No), it sends an error message to the printer 100 (step S15) and ends the processing of the flowchart shown in FIG.

[0042] On the other hand, if the association registration unit 37 (device account management server 301) confirms that the received decrypted device code is valid (step S14: Yes), it requests a association screen from the user account management server 302 (step S16), and in response, the user account management server 302 provides the association screen to the printer 100 (or the user terminal 200, not shown in FIG. 4) (step S17). In response, the user inputs user account information on the association screen displayed on the display of the printer 100 (or the user terminal 200), and sends it to the user account management server 302 (step S18).

[0043] Next, the association registration unit 37 (user account management server 302) registers, in the account information storage unit 30, an association between the user account information input by the user via the association screen and the device account information generated by the device account generation unit 32 in step S2 and stored in the account information storage unit 30 (step S19). This ends the processing of the flowchart shown in FIG.

[0044] As explained in detail above, in this embodiment, transmission of a serial number from the printer 100 to the device account management server 301 is used as a trigger to generate a device account by generating a device key in addition to a device ID, and at the same time, the device key is encrypted using the generated key information, and the encrypted device key, device ID, and key information are then transmitted to the printer 100. The validity of the device ID and decrypted device key transmitted thereafter from the printer 100 is then authenticated, and if they are confirmed to be valid, further processing of linking the user account with the device account (the procedures from step S10 onwards in FIG. 4) is permitted.

[0045] According to this embodiment configured as described above, authentication is performed using a device key in addition to a device ID, so that in a system that provides users with management services related to the printer 100, it is possible to effectively prevent the printer 100 from being fraudulently registered using the account information of an unauthorized user, compared to conventional technology in which authentication was performed using only the device ID.

[0046] Furthermore, in this embodiment, when authentication of the device ID and decrypted device key is successful, the binding screen is not immediately provided, but a unique device code is generated, encrypted with key information, and then transmitted to the printer 100. The authenticity of the decrypted device code subsequently transmitted from the printer 100 is then authenticated, and the binding screen is provided only if the authenticity is confirmed. In this way, in this embodiment, double authentication processing is performed, which further enhances the effectiveness of preventing fraudulent registration of the printer 100 using the account information of an unauthorized user.

[0047] Furthermore, in this embodiment, after the association registration unit 37 has registered the association between the user account information and the device account information, when the printer 100 accesses the service providing server 300, the decrypted device account information sending unit 13 sends the decrypted device key and device ID to the device account management server 301 for authentication. This makes it impossible to access the service providing server 300 with only the device ID, and prevents unauthorized access to the status information managed by the service providing server 300 and tampering with the status information.

[0048] In the above embodiment, authentication using the decrypted device code may be omitted. In this case, the encrypted device code receiving unit 14 and the decrypted device code transmitting unit 15 of the printer 100 and the encrypted device code transmitting unit 35 and the decrypted device code receiving unit 36 ​​of the service providing server 300 are omitted. Furthermore, if the processes of steps S10 to S15 in the flowchart of FIG. 4 are omitted and the decrypted device key is confirmed to be valid (step S8: Yes), the device account management server 301 permits further processing of the procedures from step S16 onwards. Omitting authentication using the decrypted device code eliminates dual authentication, but since authentication is performed using not only the device ID but also the device key, it is possible to ensure security that is significantly stronger than conventional methods.

[0049] In the above embodiment, an example has been described in which the device key and device code are encrypted / decrypted using a common key cryptosystem, but the present invention is not limited to this. For example, the device key and device code may be encrypted / decrypted using a public key cryptosystem. In this case, the key information generated by the device account generation unit 32 is a public key and a private key. The encrypted device account information transmission unit 33 encrypts the device key and device code using the public key and transmits the private key to the printer 100. The printer 100 performs decryption using the private key.

[0050] Furthermore, in the above embodiment, an example has been described in which only the device key of the device account information is encrypted, but the device ID may also be encrypted. In this case, the encrypted device account information sending unit 33 of the device account management server 301 encrypts the device ID in addition to the device key using key information, and sends the encrypted device key, encrypted device ID, and key information to the printer 100. The encrypted device account information receiving unit 12 of the printer 100 receives the encrypted device key, encrypted device ID, and key information from the device account management server 301 and stores them in the internal storage device 10. The decrypted device account information sending unit 13 decrypts the encrypted device key and encrypted device ID using the key information, and sends the decrypted device key and decrypted device ID to the device account management server 301. The decrypted device account information receiving unit 34 of the device account management server 301 receives the decrypted device ID and decrypted device key from the printer 100.

[0051] In the above embodiment, a configuration using the printer 100 as an example of a device has been described, but the device is not limited to the printer 100. For example, a cash drawer, a customer display, a scanner, a scale, a card reader / writer, a payment device, etc. may also be used.

[0052] Furthermore, the above-described embodiments are merely examples of specific embodiments for carrying out the present invention, and the technical scope of the present invention should not be construed as being limited thereby. In other words, the present invention can be carried out in various forms without departing from the gist or main characteristics thereof. [Explanation of symbols]

[0053] 10 Internal storage 11. Device ownership information transmission unit 12 Encrypted device account information receiver 13 Decryption device account information transmission unit 14 Encrypted device code receiver 15 Decryption device code transmission unit 30 Account information storage unit 31 Device ownership information receiving unit 32 Device account generation unit 33 Encrypted device account information transmission unit 34 Decryption device account information receiver 35 Encrypted device code transmission unit 36 Decryption device code receiver 37 Linking Registration Section 100 printers (devices) 200 user terminals 300 Service provider server 301 Device Account Management Server 302 User Account Management Server 400 Device Management Server

Claims

1. An authentication system for authenticating a user who wishes to use a device-related management service when registering the device to his or her user account, comprising: The device includes an account management server that manages accounts, The account management server is a device ownership information receiving unit that receives device ownership information, which is unique information held by the device, from the device; a device account generation unit that generates, in response to receiving the device ownership information, a device ID that is information unique to the device, a device key required to use the management service, and key information used to encrypt / decrypt the device key, and generates a device account using the device ID and the device key; an encrypted device account information transmission unit that encrypts the device key with the key information and transmits the encrypted device key, the device ID, and the key information to the device; a decrypted device account information receiving unit that receives, after the transmission process by the encrypted device account information transmitting unit, a decrypted device key from the device, the decrypted device key being a device key decrypted using the device ID and the key information; The authenticity of the device ID and the decryption device key received by the decryption device account information receiving unit is authenticated, and if the authenticity is confirmed, a linking registration unit that provides a linking screen for linking the user account with the device account, and links and registers information about the user account input by a user through the linking screen with information about the device account generated by the device account generation unit; The device is a device ownership information transmission unit that transmits the device ownership information to the account management server; an encrypted device account information receiving unit that receives the encrypted device key, the device ID, and the key information from the account management server and stores them in an internal storage medium; a decrypted device account information transmitting unit that decrypts the encrypted device key using the key information and transmits the decrypted device key and the device ID to the account management server. An authentication system comprising:

2. The account management server is an encrypted device code sending unit that authenticates the authenticity of the device ID and the decrypted device key received by the decrypted device account information receiving unit, and if the authenticity is confirmed, generates a unique device code used to link the user account with the device account, encrypts the unique device code using the key information, and sends the encrypted device code to the device; a decrypted device code receiving unit that receives, from the device, a decrypted device code that is a device code decrypted using the key information after the transmission process by the encrypted device code transmitting unit, the association registration unit, instead of authenticating the validity of the device ID and the decrypted device key received by the decrypted device account information receiving unit, authenticates the validity of the decrypted device code received by the decrypted device code receiving unit, and when the validity is confirmed, provides a association screen for associating the user account with the device account, and associates and registers information about the user account input by a user through the association screen with information about the device account generated by the device account generation unit; The device is an encrypted device code receiving unit that receives the encrypted device code from the account management server after the transmission process by the decrypted device account information transmitting unit; a decrypted device code transmission unit that decrypts the encrypted device code using the key information and transmits the decrypted device code to the account management server.

2. The authentication system according to claim 1.

3. The authentication system described in claim 1 or 2, characterized in that after the linking registration unit has registered the linking between the user account information and the device account information, when the device uses the management service, the decrypted device account information sending unit receives authentication by sending the decrypted device key and the device ID to the account management server.

4. 4. The authentication system according to claim 3, wherein the device key is a key issued by a device management server that manages the device in cooperation with a service providing server that provides the management service.

5. the encrypted device account information transmission unit encrypts the device ID in addition to the device key using the key information, and transmits the encrypted device key, the encrypted device ID, and the key information to the device; the decrypted device account information receiving unit receives, after the transmission process by the encrypted device account information transmitting unit, a decrypted device ID, which is a device ID decrypted using the key information, and the decrypted device key from the device; the encrypted device account information receiving unit receives the encrypted device key, the encrypted device ID, and the key information from the account management server and stores them in an internal storage medium; The decrypted device account information transmission unit decrypts the encrypted device key and the encrypted device ID using the key information, and transmits the decrypted device key and the decrypted device ID to the account management server.

5. The authentication system according to claim 1, wherein:

6. An authentication device that authenticates a user who wishes to use a management service related to a device when registering the device to his or her user account, a device ownership information receiving unit that receives device ownership information, which is unique information held by the device, from the device; a device account generation unit that generates, in response to receiving the device ownership information, a device ID that is information unique to the device, a device key required to use the management service, and key information used to encrypt / decrypt the device key, and generates a device account using the device ID and the device key; an encrypted device account information transmission unit that encrypts the device key with the key information and transmits the encrypted device key, the device ID, and the key information to the device; a decrypted device account information receiving unit that receives, after the transmission process by the encrypted device account information transmitting unit, a decrypted device key from the device, the decrypted device key being a device key decrypted using the device ID and the key information; and a linking registration unit that authenticates the authenticity of the device ID and the decryption device key received by the decryption device account information receiving unit, and, if the authenticity is confirmed, provides a linking screen for linking the user account with the device account, and links and registers information about the user account input by a user through the linking screen with information about the device account generated by the device account generating unit. An authentication device characterized by:

7. an encrypted device code sending unit that authenticates the authenticity of the device ID and the decrypted device key received by the decrypted device account information receiving unit, and if the authenticity is confirmed, generates a unique device code used to link the user account with the device account, encrypts the unique device code using the key information, and sends the encrypted device code to the device; a decrypted device code receiving unit that receives, from the device, a decrypted device code that is a device code decrypted using the key information after the transmission process by the encrypted device code transmitting unit, The association registration unit authenticates the authenticity of the decrypted device code received by the decrypted device code receiving unit, instead of authenticating the authenticity of the device ID and the decrypted device key received by the decrypted device account information receiving unit, and when the authenticity is confirmed, provides a association screen for associating the user account with the device account, and associates and registers information about the user account input by a user through the association screen with information about the device account generated by the device account generation unit.

7. The authentication device according to claim 6.

8. An authentication method for authenticating a user who wishes to use a device-related management service when registering a device to his or her user account, comprising: a first step in which a device possession information receiving unit of an authentication device receives, from the device, device possession information that is unique information possessed by the device; a second step in which a device account generation unit of the authentication device generates, in response to receiving the device ownership information, a device ID that is information unique to the device, a device key required to use the management service, and key information used to encrypt / decrypt the device key, and generates a device account using the device ID and the device key; a third step in which an encrypted device account information transmission unit of the authentication device encrypts the device key with the key information and transmits the encrypted device key, the device ID, and the key information to the device; a fourth step in which a decrypted device account information receiving unit of the authentication device receives from the device a decrypted device key, the decrypted device key being a device key decrypted using the device ID and the key information, after the transmission process by the encrypted device account information transmitting unit; a fifth step in which an association registration unit of the authentication device authenticates the validity of the device ID and the decrypted device key received by the decrypted device account information receiving unit, and if the validity is confirmed, provides a association screen for associating the user account with the device account, and associates and registers information about the user account input by the user through the association screen with information about the device account generated by the device account generation unit.

1. An authentication method comprising:

9. Between the fourth step and the fifth step, a sixth step in which an encrypted device code transmitting unit of the authentication device authenticates the validity of the device ID and the decrypted device key received by the decrypted device account information receiving unit, and if the validity is confirmed, generates a unique device code to be used for linking the user account with the device account, encrypts the unique device code with the key information, and transmits the encrypted device code to the device; a seventh step of receiving, from the device, a decrypted device code that is a device code decrypted by the key information, by a decrypted device code receiving unit of the authentication device after the transmission process by the encrypted device code transmitting unit; In the fifth step, the association registration unit authenticates the authenticity of the decrypted device code received by the decrypted device code receiving unit, instead of authenticating the authenticity of the device ID and the decrypted device key received by the decrypted device account information receiving unit, and if the authenticity is confirmed, provides a association screen for associating the user account with the device account, and associates and registers the information of the user account input by the user through the association screen with the information of the device account generated by the device account generation unit.

9. The authentication method according to claim 8.

Images