JP2008071097A - Authentication device, authentication system, program, and recording medium - Google Patents

Abstract

An authentication device and an authentication system that are excellent in user operability and high in safety are provided.
A terminal device 7 accesses "URL-A" and makes a login request. When the first authentication information (user ID, PIN) is successfully authenticated by the first authentication unit 19, the random number generation unit 20 calculates information on the matrix position of the random number table 5 and presents it to the terminal device 7. The terminal device 7 accesses “URL-B”. When the second authentication processing unit 27 successfully authenticates the input second authentication information (user ID, random number), the second access processing unit 25 creates a one-time password and presents it to the terminal device 7. To do. When the one-time password is input from “URL-A”, the final authentication unit 22 collates with the value of the one-time password created by the OTP creation unit 21. If the authentication is successful, the content processing unit 23 permits login and provides a predetermined WEB screen to the terminal device 7.
[Selection] Figure 1

Description

  The present invention relates to an authentication device and an authentication system for authenticating the validity of a terminal device. More specifically, the present invention relates to an authentication device and an authentication system that authenticate the validity of a terminal device accessed via a network.

  In recent years, fraud / theft of user IDs and passwords on the Internet, represented by phishing scams, has become a problem. For this reason, there is a need for a technology that ensures high security and authenticates the user.

  For example, after authenticating the user ID and PIN (Personal Identification Number: password) input from the terminal device, specify a predetermined position in the random number table held by the user, and input the random number displayed at the corresponding position There is an authentication method to log in after checking again. The random number table is a card-like printed matter distributed to each user by, for example, a bank or a securities company.

In addition, there is an authentication method in which a user possesses a device (hard token) that displays a one-time password, and the one-time password updated and displayed every predetermined time is used as one of the authentication methods. In addition, there is an authentication method in which dedicated software for using a soft token is downloaded to a user terminal device and a one-time password displayed on the terminal device is used as one of authentication methods.
The one-time password is a unique single-use password that is created taking into account at least a part of user information, time information, device information, and the like.

  Further, the user sends a first authentication key (for example, a user ID) from a mobile communication terminal or the like to the first authentication support system to obtain a one-time password, and a second authentication key (for example, a password) from a different terminal device. There is a system in which the one-time password is sent to the second authentication support system, and login can be performed only after successful authentication (see, for example, [Patent Document 1]).

  In addition, as a user authentication method of the mobile terminal device, an authentication server installed in a closed network (a communication network of the mobile terminal device) performs first authentication, issues an access password, and sends it back to the mobile terminal device. There is a system that uses a password for second authentication to an open network (Internet) (see, for example, [Patent Document 2]).

Japanese Patent No. 3678417 JP 2002-152195 A

  However, when a random number table is distributed to users, there is a risk that the random number table itself may be stolen, copied, or photographed and misused. In addition, when the number of digits of the random number to be input is small, there is an increased risk that the random number will be searched and illegally logged into a third party.

  Introducing hard tokens has the problem of introducing equipment. In addition, there is a problem in operability that a hard token device must be carried and operated. Moreover, since the password is displayed as it is on the screen of the hard token, the risk level is high.

  Soft tokens require users to download and install dedicated software, and for users who are not used to computer operations, the threshold is high at the time of introduction of soft tokens.

  In the personal authentication system and system described in Patent Document 1, first, in order to obtain a one-time password, the user needs to operate another terminal device such as a mobile phone, and there is a problem in operability.

  The authentication server described in Patent Document 2 is for example that if a malicious third party obtains a mobile terminal device, a user ID, and a password, the mobile phone device is operated to impersonate the user and log in. There is a problem that cannot be prevented.

  The present invention has been made in view of the above problems, and an object thereof is to provide an authentication device and an authentication system that are excellent in user operability and high in safety.

  In order to achieve the above-described object, a first invention is an authentication device that is connected to at least one terminal device via a network and performs authentication of the terminal device, wherein the terminal device receives first net position information from the terminal device. A first authentication means for authenticating the terminal device based on the first authentication information sent in the form of a second authentication information, a second authentication information creating means for creating the second authentication information when the authentication by the first authentication means is successful, Authentication of the terminal device is performed based on the second authentication information transmitted from the terminal device via the second net position information and second authentication information transmitting means for transmitting information related to the second authentication information to the terminal device. A second authentication unit, a final authentication information creating unit for creating final authentication information when the authentication by the second authentication unit is successful, and a final authentication for sending information related to the final authentication information to the terminal device An authentication apparatus comprising: an information transmission unit; and a final authentication unit that authenticates the terminal device based on the final authentication information transmitted from the terminal device via first net position information. .

  The first net position information and the second net position information are information indicating positions on the network. For example, a predetermined URL (Uniform Resource Locator) or IP (Internet) specified by a terminal device such as a computer with a browser is used. Protocol) address. The first net position information is different from the second net position information.

The first authentication information, the second authentication information, and the final authentication information are information that is sent from the terminal device to the authentication device and used for authentication. The first authentication information is, for example, a user ID and a PIN. The second authentication information and the final authentication information are, for example, a random number or a one-time password.
The information related to the second authentication information and the information related to the final authentication information are information sent from the authentication device to the terminal device, such as a matrix position of a random number table, a character string of a one-time password, or an image showing the character string.

  When performing authentication using random numbers, the authentication device calculates and stores information related to the matrix position of the random number table. The authentication device transmits information related to the matrix position of the random number table to the terminal device. Based on the information on the matrix position of the random number table received by the terminal device, the user inputs the random number printed at the matrix position of the distributed random number table from the terminal device and transmits it to the authentication device. The authentication device authenticates the validity by comparing the received random number with the stored random number.

  When performing authentication using a one-time password, the authentication device creates a one-time password and transmits a character string of the one-time password and an image indicating the character string to the terminal device for display. The user inputs the one-time password from the terminal device based on the information on the one-time password displayed on the terminal device, and transmits it to the authentication device. The authentication device verifies the validity by comparing the received one-time password with the one-time password newly created by the same algorithm. The one-time password is a disposable password with a unique expiration date that is created based on a predetermined rule in consideration of user information, time information, and the like. The one-time password presented to the user and the one-time password newly created are created using the same algorithm, and are determined to be the same within a predetermined time.

The terminal device sends the first authentication information to the authentication device via the first net position information. If the authentication based on the first authentication information is successful, the authentication device creates information about the second authentication information and sends it to the terminal device.
The terminal device sends the second authentication information to the authentication device via the second net position information. If the authentication based on the second authentication information is successful, the authentication device creates information about the final authentication information and sends it to the terminal device.
The terminal device sends final authentication information to the authentication device via the first net position information. The authentication device performs authentication based on the final authentication information.

  With the authentication device of the first invention, the terminal device obtains independent authentication information from two different net position information (URLs) and individually authenticates, so that it is possible to easily realize highly secure authentication processing. it can. In addition, since no other device for authentication is used, the cost burden can be reduced. Further, since no other device for authentication or dedicated software is used, user operability is excellent.

  According to a second aspect of the present invention, there is provided an authentication device that is connected to at least one terminal device via a network and performs authentication of the terminal device, the first authentication information sent from the terminal device via the first net position information. The first authentication means for authenticating the terminal device based on the authentication information and the kth authentication information for creating the kth authentication information when the authentication by the k-1 (k = 2, 3,..., N) authentication means is successful. The terminal device based on the k-th authentication information sent from the terminal device via the k-th net position information; the creating device; the k-th authentication information sending device for sending information related to the k-th authentication information to the terminal device; If the authentication by the k-th authentication means and the n-th authentication means is successful, the final authentication information creating means for creating final authentication information, and the final authentication information transmission for sending information related to the final authentication information to the terminal device It means an authentication apparatus characterized by comprising a final authentication means for performing authentication of the terminal device based on the final authentication information sent via the first network location information from the terminal device.

With the authentication device according to the second aspect of the invention, the terminal device obtains different authentication information via independent net position information. Since the terminal device is independently authenticated for different authentication information, a more secure authentication system can be constructed easily.
The authentication device of the first invention allows the terminal device to access via two pieces of net position information, but the authentication device of the second invention allows the terminal device to access via more net location information and perform authentication. Do. Therefore, security can be improved.

  According to a third aspect of the present invention, there is provided an authentication system in which at least one terminal device and an authentication device for authenticating the terminal device are connected via a network, wherein the authentication device receives first net position information from the terminal device. A first authentication means for authenticating the terminal device based on the first authentication information sent via the first authentication information, and a second authentication information creating means for creating the second authentication information when the authentication by the first authentication means is successful. And authenticating the terminal device based on the second authentication information transmitting means for transmitting the second authentication information to the terminal device and the second authentication information transmitted from the terminal device via the second net position information. When the authentication by the second authentication means and the second authentication means is successful, final authentication information creating means for creating final authentication information, and final authentication information sending for sending information related to the final authentication information to the terminal device Means, and final authentication means for authenticating the terminal device based on the final authentication information sent from the terminal device via the first net position information, the terminal device to the authentication device First authentication request means for sending and requesting authentication of the first authentication information via the first net position information, and sending and authenticating the second authentication information via the second net position information to the authentication device. An authentication system comprising: a requesting second authentication requesting unit; and a final authentication requesting unit that sends the final authentication information to the authentication device via the first net position information and requests authentication. is there.

  A third invention is an invention relating to an authentication system comprising a terminal device and the authentication device of the first invention.

  A fourth invention is a program for causing a computer to function as the authentication device of the first invention.

  A fifth invention is a computer-readable recording medium on which a program for causing a computer to function as the authentication device of the first invention is recorded.

  Note that the above program may be distributed by being held on a recording medium such as a CD-ROM, or the program can be transmitted and received via a communication line.

  According to the present invention, it is possible to provide an authentication device and an authentication system that are excellent in user operability and high in safety.

  Hereinafter, preferred embodiments of an authentication device and an authentication system according to the present invention will be described in detail with reference to the accompanying drawings. In the following description and the accompanying drawings, the same reference numerals are given to components having substantially the same functional configuration, and redundant description will be omitted.

(1. Functional configuration of authentication system 1)
First, a functional configuration of the authentication system 1 will be described with reference to FIG.
FIG. 1 is a configuration diagram of the authentication system 1.

  The authentication system 1 is configured by connecting a terminal device 7, an authentication server 15, and the like to a network 13.

  The terminal device 7 is a device such as a computer that can be connected to the authentication server 15 via the network 13. The terminal device 7 includes an input unit 9 such as a keyboard, a mouse, and a button, and a display unit 11 such as a CRT monitor and a liquid crystal panel.

  The user 3 operates the terminal device 7 and performs a login operation to a predetermined server provided by a financial institution such as various banks and securities companies. In addition, the user 3 possesses a random number table 5 distributed from a corresponding financial institution for reference during a login operation to a predetermined server. Details of the random number table 5 will be described later.

  The authentication server 15 is a device such as a computer having the first access processing unit 17, the second access processing unit 25, the authentication table 31, and the content 33.

  The first access processing unit 17 performs access processing for the WEB page whose URL is “URL-A”. The first access processing unit 17 includes a first authentication unit 19, a random number generation unit 20, an OTP generation unit 21, a final authentication unit 22, and a content processing unit 23.

  The first authentication unit 19 authenticates the validity of the terminal device 7 based on the authentication information sent from the terminal device 7. The authentication information is, for example, the user ID and PIN.

  The random number creation unit 20 calculates the matrix position of the random number table 5 possessed by the user 3. The random number generation unit 20 transmits the calculated matrix position of the random number table 5 to the terminal device 7 of the user 3. The random number generation unit 20 extracts the value of the random number from the matrix position of the random number table 5 and the information of the random number table 5 possessed by the user 3 (which will be described later, the random number table data 205 of the authentication table 31) to authenticate. Register in table 31.

  When the final authentication information (one-time password created by the OTP creation unit 29) is sent from the terminal device 7, the OTP creation unit 21 creates a one-time password for authentication using the same algorithm as the OTP creation unit 29. . The one-time password is a disposable password created based on a predetermined rule with at least a part of user information, time information, and the like.

  The final authentication unit 22 finally authenticates the validity of the terminal device 7. The final authentication unit 22 verifies the final authentication information (one-time password) sent from the terminal device 7 with the one-time password for authentication created by the OTP creation unit 21 to authenticate the terminal device 7. The final authentication unit 22 permits the terminal device 7 to log in after successful authentication of the terminal device 7.

  When the terminal device 7 is permitted to log in, the content processing unit 23 provides the content 33 to the terminal device 7. For example, the content 33 is information for displaying a WEB site initial screen after login. The content processing unit 23 displays a predetermined WEB site on the display unit 11 of the terminal device 7.

  The second access processing unit 25 performs access processing for the WEB page whose URL is “URL-B”. The second access processing unit 25 includes a second authentication unit 27 and an OTP creation unit 29.

  The second authenticating unit 27 authenticates the authenticity of the terminal device 7 by comparing the authentication information sent from the terminal device 7 with the information registered in the authentication table 31. The authentication information is, for example, a random value determined based on the matrix position of the random number table 5 calculated by the random number generation unit 20 of the first authentication unit 19 and the random number table 5 of the user 3.

  The OTP creation unit 29 creates a one-time password to be presented as authentication information to the terminal device 7.

  Information related to authentication of the terminal device 7 is registered in the authentication table 31. Details of the authentication table 31 will be described later.

  The content 33 stores information related to the WEB screen display provided after the terminal device 7 is permitted to log in.

(2. Hardware configuration)
Next, the hardware configuration of the authentication server 15 and the terminal device 7 will be described with reference to FIG.
FIG. 2 is a hardware configuration diagram of the authentication server 15 and the terminal device 7. Note that the hardware configuration in FIG. 2 is an example, and various configurations can be adopted depending on the application and purpose.

  The authentication server 15 and the terminal device 7 are configured by connecting a CPU 101, a memory 103, a storage unit 105, a display unit 107, an input unit 109, an output unit 111, and a communication unit 113 via a system bus 115.

  A CPU 101 (Central Processing Unit) is a device that performs operation control of arithmetic devices (four arithmetic operations, comparison operations, etc.), hardware and software.

  The memory 103 is a memory such as a RAM and a ROM. A RAM (Random Access Memory) stores a ROM (Read Only Memory), an OS (Operating System) program read from the storage unit 105, an application program, and the like. The RAM functions as a main memory and work area for the CPU 101.

  The storage unit 105 is a device that stores various data, and is, for example, a hard disk. The storage unit 105 stores a program executed by the CPU 101, data necessary for program execution, an OS, various databases, and the like.

  The display unit 107 is a display device, such as a CRT monitor or a liquid crystal panel. The display unit 107 includes a logic circuit (such as a video adapter) for realizing the video function of the computer.

  The input unit 109 is an input device for various data, such as a keyboard and a mouse. The output unit 111 is an output device for various data, for example, a printer. Drive devices that perform data input / output with various media can also be used as the input unit 109 and the output unit 111.

The communication unit 113 is a communication control device that connects and communicates with an external device via the network 115. For example, Internet communication using TCP / IP is possible.
The system path 115 is a path that mediates transmission / reception of control signals, data signals, and the like between the devices.

  The authentication server 15 and the terminal device 7 load programs (application programs, OS programs, etc.) stored in the storage unit 105, ROM, or storage medium into the RAM of the memory 103, and perform various processes under the control of the CPU 101. Execute.

(3. Authentication table 31)
Next, the authentication table 31 will be described with reference to FIG.
FIG. 3 is a diagram illustrating an example of the configuration of the authentication table 31.
An authentication record 35 for each user 3 is registered in the authentication table 31. The authentication record 35 has items such as ID 201, PIN 203, random number table data 205, random number 207, and the like.

  ID 201 stores the user ID of user 3. The PIN 203 stores the password of the user 3. The random number table data 205 stores all data (see FIG. 4) regarding the correspondence between the matrix position of the random number table 5 owned by each user 3 and the random number. The random number 207 stores the value of the random number determined by the random number creation unit 20.

(4. Random number table 5)
Next, the random number table 5 will be described with reference to FIG.
FIG. 4 is a diagram illustrating an example of the random number table 5.
The random number table 5 is, for example, an array table of 5 rows (1, 2, 3, 4, 5) and 5 columns (a, i, c, d, o) printed on a plastic card. Digits are printed. The numbers printed on each element are different for each user 3. When a predetermined matrix position (for example, “A-3”) in the random number table 5 is designated by the authentication server 15, the user 3 inputs a two-digit number (“98”) printed at the designated matrix position. The authentication information is input from the terminal device 7 and transmitted to the authentication server 15.

(5. Authentication processing procedure of authentication server 15)
Next, an authentication processing procedure of the authentication server 15 will be described with reference to FIGS.
FIG. 5 is a diagram showing an authentication processing procedure. FIG. 6 is a diagram illustrating a display screen of the display unit 11 of the terminal device 7.

  Assume that the user 3 logs in to a predetermined WEB site provided by a financial institution such as various banks or securities companies from the terminal device 7. The terminal device 7 is assumed to be able to log in to a predetermined WEB site after receiving authentication of the validity of login at the authentication server 15.

  The terminal device 7 accesses “URL-A” of the authentication server 15 and makes a login request (step 1001). A screen 501 (see FIG. 6) for requesting input of ID 301 and PIN 303 is displayed on the display unit 11 of the terminal device 7 that has accessed “URL-A”.

  When “U01” that is the ID of the user 3 is input to the ID 301 of the screen 501 of the terminal device 7 and “P01” that is the password of the user 3 is input to the PIN 303 (step 1002), the ID 301 and the PIN 303 are transmitted to the authentication server 15. Is done.

  The first access processing unit 17 of the authentication server 15 authenticates the ID 301 “U01” and the PIN 303 “P01” in the first authentication unit 19 (step 1003). That is, the first authentication unit 19 refers to the authentication record 35 in which ID 301 “U01” is registered in the item of ID 201 from the authentication record for each user registered in the authentication table 31. If the value registered in the PIN 203 of the authentication record 35 matches the PIN 303 “P01”, the first authentication unit 19 determines that the authentication of the terminal device 7 is successful. If the combination of the ID 201 value and the PIN 203 value registered in the authentication record 35 is inappropriate, the first access processing unit 17 displays a screen prompting the terminal device 7 to input the ID 301 and the PIN 303 again, or refuses to log in. Is displayed (not shown).

  Next, the random number creation unit 20 of the first access processing unit 17 calculates the position of the random number table 5 presented as authentication information to the terminal device 7. The random number generation unit 20 calculates the matrix position of the random number table 5 (step 1004), transmits the matrix position to the terminal device 7 and causes the display unit 11 to display the matrix position (step 1006). For example, the random number generation unit 20 may generate random numbers and calculate the position of each row and column. For example, if the random number generation unit 20 calculates the positions of the column “D” and the row “3” in the random number table 5, “Please use the random number of D-3” on the screen 502 (see FIG. 6). Is displayed.

  Further, the random number creation unit 20 refers to the authentication record 35 in which ID 301 “U01” is registered in the item of ID 201 of the authentication table 31. The random number creation unit 20 acquires the value of the random number table data 205 corresponding to the calculated matrix position of the random number table 5. The random number creation unit 20 acquires the numerical value “07” registered at the position of the column “d” and the row “3” of the random number table data 205 and stores it in the item of the random number 207 of the authentication record 35 (step 1005). .

  Next, the terminal device 7 accesses “URL-B” of the authentication server 15 (step 1007). On the display unit 11 of the terminal device 7 having accessed “URL-B”, another window different from that when accessing “URL-A” is opened, and a screen 503 for requesting input of the ID 307 and the random number 309 (FIG. 6) is displayed.

  That is, the screen 502 accessed via “URL-A” and the screen 503 accessed via “URL-B” are independently displayed on the display unit 11 of the terminal device 7.

The user 3 obtains the value of the random number table 5 corresponding to the matrix position “D-3” presented on the screen 502. That is, the user 3 acquires a random number “07” as a random number value requested to be input to the screen 503.
When “U01” that is the ID of the user 3 is input to the ID 307 of the screen 503 of the terminal device 7 and the random number “07” is input to the random number 309 (step 1008), the ID 307 and the random number 309 are transmitted to the authentication server 15.

  The second access processing unit 25 of the authentication server 15 authenticates the ID 307 “U01” and the random number 309 “07” in the second authentication unit 27 (step 1009). That is, the second authentication unit 27 refers to the authentication record 35 in which ID 307 “U01” is registered in the item of ID 201 from the authentication record for each user registered in the authentication table 31. If the value registered in the random number 207 item of the authentication record 35 matches the random number 309 “07”, the second authenticating unit 27 determines that the authentication is successful. If the value registered in the item of the random number 207 of the authentication record 35 and the value of the random number 309 do not match, the second access processing unit 25 displays a screen prompting the terminal device 7 to input the ID 307 and the random number 309 again, or A login rejection message is displayed (not shown).

  Next, the OTP creation unit 29 of the second access processing unit 25 creates a one-time password (step 1010). The OTP creation unit 29 creates a unique one-time password by taking into account at least a part of, for example, information about the user 3, information about time, and information about the system. The one-time password is a one-time password used for authentication only once. Even if the one-time password is not used for authentication, it becomes invalid after a predetermined time has elapsed.

  The second access processing unit 25 transmits the character string indicating the created one-time password and the image indicating the character string to the terminal device 7 to display on the display unit 11 (step 1011). For example, if the one-time password is OTP311 “PX7QR”, the “one-time password (OTP) is“ PX7QR ”on the screen 504 of the terminal device 7 (see FIG. 6). Is displayed.

  Next, when the user 3 accesses “URL-A” and clicks a “go to login” button 305 on the screen 502 (see FIG. 6) on which the authentication processing up to step 1006 has been performed, the terminal device 7 performs authentication server. 15 is sent (step 1012), and a screen 505 (see FIG. 6) for requesting input of the OTP 313 is displayed on the terminal device 7.

  When the one-time password “PX7QR” is input to the OTP 313 on the screen 505 of the terminal device 7 (step 1013) and the “login” button 315 is clicked, the OTP 313 “PX7QR” is sent to the first access processing unit 17 of the authentication server 15. Is sent.

  The OTP creation unit 21 of the first access processing unit 17 creates an OTP 316 that is a one-time password for authentication (step 1014). The OTP creation unit 21 creates a one-time password using the same algorithm as the OTP creation unit 29 of the second access processing unit 25 described above. That is, the OTP creation unit 21 creates a unique one-time password with the same algorithm as the OTP creation unit 29, taking into account at least some of the information about the user 3, the information about the time, and the information about the system.

  However, the OTP creation unit 21 and the OTP creation unit 29 synchronize the time, and if the OTP creation unit 21 is within a predetermined time from the time when the OTP 313 was created, the OTP creation unit 21 has the same value as the OTP 313 created by the OTP creation unit 29. A one-time password OTP 316 may be created. When a predetermined time elapses from the time when the OTP 313 is created, the value of the OTP 316 created by the OTP creation unit 21 does not match the value of the OTP 313 because the time information is different.

  The final authentication unit 22 of the first access processing unit 17 performs authentication of the transmitted OTP 313 (step 1015). If the value of the one-time password OTP 316 created by the OTP creation unit 21 matches the OTP 313 “PX7QR”, the final authentication unit 22 determines that the terminal device 7 has been successfully authenticated. If the value of OTP 316 and the value of OTP 313 do not match, the final authentication unit 22 displays a screen prompting the terminal device 7 to input the OTP 313 again or displays login rejection (not shown). If the OTP creation unit 21 does not reflect the time at which the OTP 313 was created in creating the value of the OTP 316 for authentication, the final authentication unit 22 reversely uses the one-time password creation algorithm. The created time can be determined, the expiration date of the OTP 313 can be determined, and the OTP 316 can be authenticated.

  When the final authentication unit 22 succeeds in authenticating the terminal device 7, the content processing unit 23 reads out the predetermined content 33 and transmits it to the terminal device 7 (step 1016).

  A WEB screen based on the content 33 is displayed on the display unit 11 of the terminal device 7 (step 1017). For example, after the above-described authentication process is completed, the terminal device 7 is permitted to log in to a predetermined securities company WEB page, and an initial screen (screen 506) is displayed on the display unit 11.

  Through the above process, in the authentication system 1, the terminal device 7 accesses the authentication server 15 via “URL-A” for authentication, and if the authentication is successful, the authentication server 15 uses the URL for “URL-B”. Authentication information is created and sent to the terminal device 7. Next, the terminal device 7 accesses the authentication server 15 via “URL-B”, sends authentication information for “URL-B”, receives authentication, and if the authentication is successful, the authentication server 15 determines the final authentication information. Is created and presented to the terminal device 7. Next, the terminal device 7 receives the authentication by sending the final authentication information via “URL-A”.

  Thus, in the authentication system 1, the terminal device 7 is made to access a plurality of independent URLs of the authentication server 15. The authentication server 15 inputs authentication information issued by independent URLs from the terminal device 7 in the course of processing different URLs, and performs authentication processing, thereby realizing a highly secure authentication device. .

In addition, since the authentication system 1 does not require a device such as a hard token for obtaining authentication information, the cost burden can be reduced.
In addition, since a complicated operation such as downloading and installation of dedicated software for introducing a soft token for obtaining authentication information is not required, an authentication device with good operability for the user can be realized.

(6. Authentication system 51 of another embodiment)
Next, an authentication system 51 according to another embodiment will be described with reference to FIG.
FIG. 7 is a configuration diagram of the authentication system 51.

  The authentication system 51 includes a terminal device 67 and an authentication server 53 such as a server computer. Since the hardware configurations of the terminal device 67 and the authentication server 53 are the same as those of the authentication system 1 shown in FIGS. 1 and 2, description thereof will be omitted, and differences in functions will be described.

  The authentication server 53 includes access processing units 55-1 to 55-n. The access processing units 55-1 to 55-n perform access processing for “URL-1” to “URL-n”, respectively. The k-th access processing unit 55-k (k = 1 to (n−1)) includes the k-th authentication unit 57-k that performs authentication processing of the k-th authentication information 63-k and the (k + 1) -th authentication information 63-. A (k + 1) th authentication information creating unit 59-k that creates (k + 1). However, the nth access processing unit 55-n includes an nth authentication unit 57-n that performs authentication processing of the nth authentication information 63-n and a final authentication information creation unit 59-n that creates final authentication information 65. .

  In the authentication system 51, when the terminal device 67 accesses the “URL-1” of the authentication server 53 by inputting the first authentication information 63-1 (for example, the user ID and PIN), the first access processing unit 55-1 2 The authentication information 63-2 is created and transmitted to the terminal device 67. When the terminal device inputs the second authentication information 63-2 to "URL-2" different from the above, the second access processing unit 55-2 creates the third authentication information 63-3 and the terminal device. 67. That is, the authentication server 53 stores the (k + 1) th authentication information 63- (k + 1) in the (k + 1) th (k + 1) th access processing unit 55- (k + 1) different from the created kth access processing unit 55-k. ) Authentication is performed by the authentication unit 57- (k + 1), and the final authentication information 65 is authenticated by the final authentication unit 61.

  As described above, in another embodiment, the terminal device 67 accesses the authentication server 53 with a different URL and performs a multi-stage authentication process, whereby the security of the authentication system 51 can be further improved.

(7. Others)
As described above in detail, in the authentication system according to the embodiment of the present invention, the authentication server causes the terminal device to access an independent URL, and the independent access processing unit issues authentication information and performs authentication processing. A highly secure authentication device and authentication system can be realized.
In addition, since a dedicated device or software for authentication is not required, the cost burden can be reduced.
Also, since the user does not need to operate other devices or software, an authentication device with good operability can be realized.

  In the above embodiment, the random number value displayed in the random number table is used as the second authentication information and the one-time password is used as the final authentication information. However, both the second authentication information and the final authentication information are used. A one-time password may be used.

  In the above-described embodiment, the authentication server 15 is a single computer. However, the authentication server 15 may be composed of a plurality of server computers. For example, the processing may be distributed for each access processing unit.

  The preferred embodiments of the authentication device and the authentication system according to the present invention have been described above with reference to the accompanying drawings, but the present invention is not limited to such examples. It will be apparent to those skilled in the art that various changes or modifications can be conceived within the scope of the technical idea disclosed in the present application, and these are naturally within the technical scope of the present invention. Understood.

Configuration diagram of authentication system 1 The figure which shows the hardware constitutions of the authentication server 15 and the terminal device 7. The figure which shows the data structure of the authentication record 35 Figure showing random number table 5 Diagram showing the flow of authentication processing The figure which shows the screen display of the terminal device 7 The figure which shows the authentication system 51

Explanation of symbols

1, 51 ... Authentication system 3 ... User 5 ... Random number table 7, 67 ... Terminal device 9 ... Input unit 11 ... Display unit 13 ... Network 15, 53 ... Authentication server 17 ......... First access processing unit 19 ......... First authentication unit 20 ......... Random number creation unit 21 ......... OTP creation unit 22 ......... Final authentication unit 23 ......... Content processing unit 25 ... ... second access processing unit 27 ......... second authentication unit 29 ......... OTP creation unit 31 ......... authentication table 33 ......... content 35 ......... authentication record 55-k ......... kth access processing unit 57 -K ......... kth authentication unit 59-k ......... kth authentication information creation unit 59-n ......... final authentication information creation unit 61 ......... final authentication unit 63-1 to 63-n ......... k authentication information 65 ......... Final authentication information 101 ......... CPU
103 ......... Memory 105 ......... Storage unit 107 ......... Display unit 109 ......... Input unit 111 ......... Output unit 113 ......... Communication units 201, 301, 307 ......... ID
203, 303 ... PIN
205 ......... Random number table data 309 ......... Random numbers 209, 311, 313, 316 ......... OTP
501, 502, 503, 504, 505, 506 ... …… Screen

Claims (8)

An authentication device connected to at least one terminal device via a network and authenticating the terminal device,
First authentication means for authenticating the terminal device based on first authentication information sent from the terminal device via first net position information;
Second authentication information creating means for creating second authentication information when authentication by the first authentication means is successful;
Second authentication information transmitting means for transmitting information related to the second authentication information to the terminal device;
Second authentication means for authenticating the terminal device based on the second authentication information sent from the terminal device via second net position information;
If authentication by the second authentication means is successful, final authentication information creating means for creating final authentication information;
Final authentication information transmitting means for sending information on the final authentication information to the terminal device;
Final authentication means for authenticating the terminal device based on the final authentication information sent from the terminal device via first net position information;
An authentication device comprising:   The authentication apparatus according to claim 1, wherein at least one of the second authentication information and the final authentication information is a one-time password.   The authentication apparatus according to claim 1, wherein the second authentication information and the final authentication information are both one-time passwords.   The authentication apparatus according to claim 1, wherein the second authentication information is a random number, and the final authentication information is a one-time password. An authentication device connected to at least one terminal device via a network and authenticating the terminal device,
First authentication means for authenticating the terminal device based on first authentication information sent from the terminal device via first net position information;
K-th authentication information creating means for creating k-th authentication information when authentication by the k-1 (k = 2, 3,..., N) authentication means is successful;
K-th authentication information transmitting means for transmitting information related to the k-th authentication information to the terminal device;
K-th authentication means for authenticating the terminal device based on the k-th authentication information sent from the terminal device via the k-th net position information;
If authentication by the nth authentication means is successful, final authentication information creating means for creating final authentication information;
Final authentication information transmitting means for sending information on the final authentication information to the terminal device;
Final authentication means for authenticating the terminal device based on the final authentication information sent from the terminal device via first net position information;
An authentication device comprising: An authentication system in which at least one terminal device and an authentication device that performs authentication of the terminal device are connected via a network,
The authentication device
First authentication means for authenticating the terminal device based on first authentication information sent from the terminal device via first net position information;
Second authentication information creating means for creating second authentication information when authentication by the first authentication means is successful;
Second authentication information transmitting means for transmitting the second authentication information to the terminal device;
Second authentication means for authenticating the terminal device based on the second authentication information sent from the terminal device via second net position information;
If authentication by the second authentication means is successful, final authentication information creating means for creating final authentication information;
Final authentication information transmitting means for sending information on the final authentication information to the terminal device;
A final authentication means for authenticating the terminal device based on the final authentication information sent from the terminal device via the first net position information,
The terminal device
First authentication requesting means for sending the first authentication information to the authentication device via the first net position information and requesting authentication;
Second authentication requesting means for sending the second authentication information to the authentication device via the second net position information and requesting authentication;
Final authentication request means for sending the final authentication information to the authentication device via the first net position information and requesting authentication;
An authentication system comprising:   A program for causing a computer to function as the authentication device according to any one of claims 1 to 5.   A computer-readable recording medium on which a program for causing a computer to function as the authentication device according to any one of claims 1 to 5 is recorded.

Images