JP2011215753A - Authentication system and authentication method - Google Patents

Abstract

An object of the present invention is to prevent spoofing by a third party and perform more advanced user authentication that can be shared by companies.
When each of a plurality of business devices 6 receives a processing request from a user information storage unit 63 in which an authentication level, which is an authentication level performed by an authentication device 5, is stored for each user, and a first terminal 3. The authentication device 5 includes an authentication request unit 61 that reads an authentication level corresponding to the user who transmitted the processing request from the user information storage unit 63 and transmits an authentication request including the authentication level to the authentication device 5. The type of authentication to be performed is determined according to the authentication level of the authentication request transmitted from each business device 6, and the user who has transmitted the processing request under the control of the authentication control unit 51 is controlled by the authentication control unit 51. Authentication means 51 and 57 for transmitting the authentication result to the business apparatus 6.
[Selection] Figure 1

Description

  The present invention relates to a personal authentication technique for authenticating a user's validity.

  In recent years, there has been a problem of identity theft such as user IDs and passwords on the Internet, represented by phishing scams. For this reason, there is a need for a technique that ensures higher security and authenticates the legitimacy of the user. For example, Patent Document 1 describes a one-time password authentication system that performs user authentication using a one-time password.

JP 2002-259344 A

  By the way, in order to ensure high security, one-time password authentication using a one-time password, knowledge authentication using information known only to the person, property authentication authenticating with the property owned by the person, vein Various authentication techniques have been developed, such as biometric authentication using biometric information. Each company builds its own authentication system, taking into account the contents of services provided to users, user needs, and the cost of developing authentication systems.

  However, such advanced authentication systems generally have a large development cost, development period, and system developer burden. In addition, since the authentication technology is constantly evolving, even if the authentication system is once constructed, it may be necessary to reconstruct the authentication system using the latest authentication technology. In this way, when each company independently builds an authentication system, the load such as development cost and maintenance cost is large.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to prevent impersonation by a third party and to perform higher-level user authentication that can be shared by companies.

  In order to solve the above problems, the present invention provides a plurality of business devices that perform business processing in response to a request from a first terminal, an authentication device that performs authentication in response to requests from the plurality of business devices, Each of the plurality of business devices includes a user information storage unit in which an authentication level, which is an authentication level performed by the authentication device, is stored for each user, and a processing request from the first terminal. Receiving the authentication level corresponding to the user who transmitted the processing request from the user information storage unit, and transmitting the authentication request including the authentication level to the authentication device. The authentication control means for determining the type of authentication to be executed according to the authentication level of the authentication request transmitted from each business device and executing the determined authentication, and the control of the authentication control means. , It authenticates the user who sent the processing request has an authentication means for transmitting an authentication result to the business unit.

  Further, the present invention is an authentication method performed by a plurality of business devices that perform business processing in response to a request from a first terminal and an authentication device that performs authentication in response to a request from the plurality of business devices. Each of the plurality of business devices has a user information storage unit in which an authentication level that is an authentication level performed by the authentication device is stored for each user, and receives a processing request from the first terminal. And an authentication request step of reading an authentication level corresponding to the user who transmitted the processing request from the user information storage unit and transmitting an authentication request including the authentication level to the authentication device. A receiving step for receiving the authentication request from each business device, and a control step for determining the type of authentication to be executed according to the authentication level of the received authentication request and for executing the determined authentication. When, by the control of the authentication control step performs authentication of the user who sent the processing request, it performs an authentication step of transmitting the authentication result to the business unit.

  According to the present invention, it is possible to prevent spoofing by a third party and perform higher-level user authentication that can be shared by companies.

1 is an overall configuration diagram of an authentication system to which an embodiment of the present invention is applied. It is a figure which shows an example of an issue management table. It is a figure which shows an example of an authentication table. It is a figure which shows an example of a user information table. It is a figure which shows the hardware structural example of each apparatus. It is a sequence diagram of an authentication process. An example of the screen transition of a mobile phone and a user terminal is shown.

  Embodiments of the present invention will be described below.

  FIG. 1 is an overall configuration diagram of an authentication system to which an embodiment of the present invention is applied. The illustrated authentication system includes a one-time password issuing server 4 (hereinafter referred to as “OTP issuing server”), a high-level authentication server 5, and a plurality of business servers 6. The high-level authentication server 5 and the OTP issuing server 4 of this embodiment are shared by a plurality of business servers 6. That is, the advanced authentication server 5 and the OTP issuing server 4 are ASPs (Application Service Providers) and provide advanced user authentication functions to a plurality of business servers 6.

  In addition, when performing one-time password authentication, the user of this authentication system possesses the mobile phone 1 and / or the hard token 2 (offline token) as a device (token) that acquires or generates a one-time password. . And a user shall acquire a one-time password using the token of either the mobile telephone 1 or the hard token 2. FIG. In addition, when a user performs processing that requires advanced authentication from a user terminal 3 such as a PC (Personal Computer) or the like in the business server 6 and performs one-time password authentication, the user uses the mobile phone 1 or the hard token 2. The one-time password obtained in this way shall be used.

  It is assumed that the user is a user who can use the Web site service provided by the predetermined business server 6 and has also registered in advance in the advanced authentication server 5 to obtain an authentication ID (account). .

  The mobile phone 1 (second terminal) is a browser-type token that acquires a one-time password from the OTP issuing server 4 via a network 8 such as a mobile phone network. The mobile phone 1 includes an instruction receiving unit that receives user instructions and a display unit that displays various information and screens, and has the same function as a browser. The mobile phone 1 is assumed to store a mobile phone ID (terminal identification information) such as a machine identification number in advance in a storage device such as a memory (not shown). The memory or the like in which the mobile phone ID is stored may be an IC card that can be detached from the mobile phone 1.

  In addition to the mobile phone 1, the user may own an offline token that generates a one-time password. The off-line token is a token other than the case where a one-time password is acquired from the mobile phone 1, such as a hard token 2 or a soft token. In the present embodiment, it is assumed that the hard token 2 is used as the offline token. The hard token 2 includes a generation unit that generates a one-time password, a display unit that displays the generated one-time password, and a storage unit such as a memory that stores information for generating the one-time password.

  The user terminal 3 (first terminal) is connected to the advanced authentication server 5 and the business server 6 via a network 9 such as the Internet. The user terminal 3 includes an instruction receiving unit that receives user instructions and a display unit that displays various types of information and screens, and has the same function as a browser.

  The OTP issuing server 4 generates a one-time password in response to a request from the mobile phone 1 and transmits it to the mobile phone 1. The issue server 4 shown in the figure includes a generation unit 41 that generates a one-time password and an issue management table 42. In the issue management table 42, various types of information necessary for issuing a one-time password are registered.

  In response to a request from each business server 6, the high-level authentication server 5 performs advanced personal authentication for the user of the user terminal 3 that has accessed the business server 6 and notifies the requesting business server 6 of the authentication result. The advanced authentication server 5 shown in the figure determines an authentication type to be executed in accordance with a request from the business server 6, an authentication control unit 51 that controls to execute authentication of the determined type, and a risk base that performs risk-based authentication Authentication unit 52, table update unit 53 that updates access history table 54, access history table 54, question information table 55, generation unit 56 that generates a one-time password, and one-time password that authenticates a one-time password An authentication unit 57 (hereinafter referred to as “OTP authentication unit”) and an authentication table 58 are included.

  The access history table 54 stores history information that the user has accessed the desired business system 6 using the user terminal 3. In the question information table 55, when the risk-based authentication unit 52 performs risk-based authentication using the access history table 54 and determines that the risk is high, a question and an answer for performing additional authentication are displayed for the user (for authentication). ID) is stored in advance. In the authentication table 58, various types of information necessary for one-time password authentication are registered.

  Each of the plurality of business servers 6 includes an authentication request unit 61 that transmits an authentication request to the high-level authentication server 5 when a process requiring high-level authentication is requested from the user terminal 3, and a predetermined number of times when the authentication is successful. A business processing unit 62 that performs business processing and a user information table 63 are included.

  Next, the issue management table 42 of the OTP issue server 4, the authentication table 58 of the advanced authentication server 5, and the user information table 63 of the business server 6 will be described.

  FIG. 2 is a diagram illustrating an example of the issue management table 42 of the OTP issue server 4. The issue management table 42 shown in the figure includes an authentication ID, a PIN (Personal Identification Number), a mobile phone ID, and a password generation key.

  The authentication ID is identification information that can identify each user in the entire authentication system. The PIN is a personal identification number arbitrarily set by the user. As the mobile phone ID, for example, it is conceivable to use the machine identification number of the mobile phone 1, the phone number of the mobile phone, user information stored in the IC memory of the mobile phone, and the like.

  The password generation key is a predetermined character string (so-called seed) for generating a one-time password, and a unique character string is assigned to each mobile phone 1 in this embodiment. In the present embodiment, the one-time password is generated by a time synchronization method using time information (time stamp) as variable information for generating a different one-time password each time. The generation unit 41 of the OTP issuing server 4 generates a different one-time password each time using the password generation key and time information. The one-time password may be generated by a counter synchronization method using the number of one-time password generations as variable information.

  FIG. 3 is a diagram showing an example of the authentication table 58 of the advanced authentication server 5. The illustrated authentication table 58 includes an authentication ID, a token type, a password generation key, and a flag. In the present embodiment, since one user can possess two tokens of the mobile phone 1 and the hard token 2, the illustrated authentication table 58 has a password generation key and a flag for each token.

  The password generation key is a predetermined character string (so-called seed) for generating a one-time password, and a unique character string is assigned to each token. When the token is the mobile phone 1, the information set in the password generation key is the same as the information set in the password generation key of the corresponding authentication ID in the issue management table 42. When the token is the hard token 2, the information set in the password generation key is the same as the information stored in the storage unit of the hard token 2 owned by the user with the corresponding authentication ID.

  As described above, in the present embodiment, the one-time password is generated by the time synchronization method using the time information (time stamp) as variable information for generating a different one-time password each time. Therefore, the times of the OTP issuing server 4, the advanced authentication server 5, and the hard token 2 are all synchronized.

  Information for determining the token currently used by the user is set in the flag. In the present embodiment, it is assumed that a token whose flag is set to “ON” is currently used, and a token whose flag is set to “OFF” is not currently used. In the present embodiment, the user selects any one token according to the situation, and requests various processes from the user terminal 3 to the high-level authentication server 5 using the one-time password acquired with the token. .

  FIG. 4 is a diagram illustrating an example of the user information table 63 of the business server 6. Various types of user information are stored in advance in the user information table 63 for each user. The user information table 63 illustrated includes a user ID, a password, an authentication ID, an authentication level, and other information (such as name) not illustrated for each user. The user ID is identification information for identifying the user within each business server 6. The authentication ID is identification information for identifying each user in the entire authentication system. When a user registers with the high-level authentication server 5 (and the OTP issuing server 4) to receive high-level authentication, a unique authentication ID is assigned to the entire authentication system, and the authentication ID is set in the user information table 63. Shall be.

  The authentication level indicates the level of advanced authentication performed by the advanced authentication server 5. When a user registers on the Web site of the business server 6 and acquires a user ID (account), the user selects what level of advanced authentication is to be performed on the business server 6. In this way, by setting the authentication level in the user information table 63 of each business server 6, different authentication levels can be set for each business server 6 even for the same user. In the present embodiment, there are three authentication levels, “1”, “2”, and “3”. As the value is larger, more advanced authentication is performed.

  The mobile phone 1, the user terminal 3, the OTP issuing server 4, the advanced authentication server 5, and the business server 6 described above all include a CPU 901, a memory 902, and an external storage device such as an HDD as shown in FIG. A general-purpose computer system including an input device 904 such as a keyboard and mouse, an output device 905 such as a display and a printer, and a communication control device 906 for connecting to a network can be used. In this computer system, the CPU 901 executes a predetermined program loaded on the memory 902, thereby realizing each function of each device.

  For example, the functions of the OTP issuing server 4, the advanced authentication server 5, and the business server 6 are the advanced authentication when the CPU 901 of the OTP issuing server 4 is a program for the OTP issuing server 4 and the advanced authentication server 5 is a program for the advanced authentication server 5. The program is realized by the CPU 901 of the server 5 and the CPU 901 of the business server 6 in the case of a program for the business server 6. In addition, about the input device 904 and the output device 905, each apparatus shall be provided as needed.

  Next, the processing of this embodiment will be described.

  FIG. 6 is a sequence diagram showing the authentication process of this embodiment. The user operates the user terminal 3 to log in to a Web site provided by a desired business server 6 in advance, and selects and clicks a desired process (for example, a payment process) that requires advanced authentication. As a result, the user terminal 3 transmits a processing request selected by the user and requiring advanced authentication to the business server 6 (S11). This processing request includes the user ID and browser information (IP address, etc.) input in advance when logging in.

  The authentication request unit 61 of the business server 6 that has received the processing request sends a high-level authentication request for requesting high-level authentication of the user who has transmitted the processing request because the processing request is a processing request that requires high-level authentication. It transmits to the authentication server 5 (S12). At that time, the authentication request unit 61 reads the authentication ID and the authentication level corresponding to the user ID included in the processing request transmitted from the user terminal 3 from the user information table 63 (see FIG. 4). Then, the authentication request unit 61 transmits an authentication request including the authentication ID and authentication level read from the user information table 63 and the browser information to the advanced authentication server 5.

  The browser information includes device information (MAC address, OS version, browser version, etc.) of the user terminal 3, network information (IP address, etc.), date and time, and the like.

  In the storage unit (not shown) of the business server 6, it is assumed that whether or not each processing request transmitted from the user terminal 3 requires advanced authentication is stored in advance.

  Upon receiving the authentication request from the business server 6, the authentication control unit 51 of the advanced authentication server 5 determines advanced authentication to be executed according to the authentication level specified in the authentication request, and causes the corresponding authentication unit to perform authentication. (S13).

  In the present embodiment, when the authentication level is “1”, the risk-based authentication unit 52 is caused to execute risk-based authentication (S131-S134). When the authentication level is “2”, the OTP generation unit 56 and the OTP authentication unit 57 are caused to execute one-time password authentication (S141 to S148). When the authentication level is “3”, risk-based authentication is executed (S151), when risk-based authentication is successful (S151: OK), and one-time password authentication (S153) is executed. In the storage unit (not shown) of the high-level authentication server 5, it is assumed that the authentication level and the type of authentication executed at the authentication level are stored in association with each other.

  Hereinafter, the processing of each authentication level will be described in detail.

  First, when the authentication level is “1”, the authentication control unit 51 sends an authentication request received from the user terminal 3 to the risk-based authentication unit 52 to execute risk-based authentication. The risk-based authentication unit 52 performs risk-based authentication using the access history table 54 (S131).

  The access history table 54 stores access histories to all business servers 6 for each user (for each authentication ID). That is, the authentication ID and browser information included in each authentication request transmitted from each business server 6 are stored in association with each other. The risk-based authentication unit 52 extracts the access history data (record) of the authentication ID included in the authentication request transmitted in S12 from the access history table 54, and the extracted access history data and browser information included in the authentication request. Compared with the above, risk analysis is performed. If it is determined that the risk is high, additional authentication is performed to authenticate the person. It is assumed that determination conditions for determining that the risk is high are stored in advance in the storage unit (not shown) of the high-level authentication server 5. The risk-based authentication unit 52 compares the access history data with the browser information included in the authentication request, and determines that the risk is high if any of the determination conditions stored in the storage unit is satisfied. On the other hand, if none of the determination conditions is met, it is determined that the risk is low.

  For example, the risk-based authentication unit 52, when the user behavior characteristics (IP address, time zone, etc.) indicated by the browser information included in the authentication request is different from the past user behavior characteristics stored in the access history table 54, It can be considered that the risk is high. Further, the risk-based authentication unit 52 compares the time and IP address of the latest access history data with the time and IP address of the browser information included in the authentication request, and determines a predetermined distance that can be moved within a predetermined time. If it exceeds, it may be judged that the risk is high. The location or area of the user (user terminal 3) is specified from the IP address.

  When it is determined that the risk is high, the risk-based authentication unit 52 performs additional authentication. As additional authentication, for example, the risk-based authentication unit 52 transmits a question for the user (authentication ID) registered in advance in the question information table 55 to the user terminal 3. The user terminal 3 displays the transmitted question and transmits the answer input by the user to the advanced authentication server 5. The risk-based authentication unit 52 reads an answer to the question for the user (authentication ID) from the question information table, and if it matches the answer transmitted from the user terminal 3, the risk-based authentication unit 52 determines that the user is a valid user and performs risk-based authentication. If it is determined that the answer is not the same, it is determined that the risk-based authentication has failed because the user is an unauthorized user.

  When it is determined that the risk is high and the additional authentication fails (S131: NG), the risk-based authentication unit 52 transmits the authentication result (failure) to the business server 6 (S132). On the other hand, when it is determined that the risk is low and when the additional authentication is successful (S131: OK), the risk-based authentication unit 52 transmits the authentication result (success) to the business server 6 (S133), and the table update unit 53 Registers the authentication ID and browser information included in the authentication request in the access history table 54 in association with each other (S134).

  When the authentication request unit 61 of the business server 6 receives the authentication result of failure in S132, the authentication request unit 61 transmits an error message indicating that the authentication has failed to the user terminal 3. On the other hand, when a successful authentication result is received in S133, the business processing unit 62 of the business server 6 executes a desired process transmitted from the user terminal 3 in S11.

  Next, processing (S141 to S148) when the authentication level is “2” will be described.

  FIG. 7 shows an example of various screens (screen transitions) displayed on the output devices of the mobile phone 1 and the user terminal 3 when the authentication level is “2”.

  The authentication control unit 51 sends an authentication instruction including the authentication ID included in the authentication request transmitted in S12 and information capable of identifying the user terminal 3 such as an IP address to the OPT authentication unit 57, and one-time password authentication. Is executed. The OPT authentication unit 57 transmits, for example, a one-time password input screen 701 shown in FIG. 7 with the IP address specified in the authentication instruction as a destination (S141).

  As a result, the user acquires a one-time password using the mobile phone 1 or the hard token 2. First, processing for obtaining a one-time password from the mobile phone 1 will be described. In FIG. 6, a process for obtaining a one-time password using the mobile phone 1 is described.

  The cellular phone 1 receives a user instruction, designates a predetermined URL (Uniform Resource Locator), accesses the OTP issuing server 4, and transmits a one-time password acquisition request (S142). This one-time password acquisition request includes the PIN input to the mobile terminal 1 by the user and the mobile phone ID stored in the memory of the mobile phone 1 or the like.

  More specifically, the mobile phone 1 accesses the OTP issuing server 4 to display the top screen 702 (see FIG. 7) transmitted from the generating unit 41 of the OTP issuing server 4 on the output device, and to instruct the user. And a one-time password issuance request is transmitted to the OTP issuance server 4. When the generation unit 41 of the OTP issue server 4 receives the one-time password issue request, the generation unit 41 transmits a PIN input screen to the mobile phone 1. For example, the mobile phone 1 displays a PIN input screen 703 shown in FIG. 7 on the output device. The user inputs the PIN registered in advance in the OTP issuing server 4 on the PIN input screen 703 and clicks the send button. The mobile phone 1 transmits the input PIN to the OTP issuing server 4. It is assumed that the mobile phone 1 also transmits the mobile phone ID stored in the memory or the like of the mobile phone 1 when transmitting information to the OTP issuing server 4.

  The generation unit 41 of the OTP issue server 4 identifies the PIN corresponding to the mobile phone ID received from the issue management table 42 (see FIG. 2), and the PIN transmitted from the mobile phone 1 matches. Verify that. When the PINs match, the generation unit 41 refers to the issuance management table 42 and determines a predetermined algorithm (for example, a hash function) based on the password generation key corresponding to the received mobile phone ID and the time information (current time). The one-time password is generated by a one-way function) (S143). The time is assumed to be constantly held and measured by a timer unit (not shown).

  If the PINs do not match, the generation unit 41 determines that the request is from an unauthorized user, and transmits an error message to the mobile phone 1 without generating a one-time password.

  Then, the generation unit 41 transmits a one-time password display screen including the generated one-time password to the mobile phone 1 (S144). For example, the mobile phone 1 displays the one-time password issue screen 704 of FIG. 7 on the output device. The user inputs the one-time password displayed on the screen 704 into the one-time password input screen 701 displayed on the user terminal 3 in S141.

  Next, a one-time password issuing process using the hard token 2 will be described. In the storage unit of the hard token 2, a password generation key assigned to the user (authentication ID) who uses the hard token 2 is set. The same password generation key stored in the hard token 2 and the password generation key of the corresponding user (authentication ID) in the authentication table 58 are set. In the present embodiment, the hard token 5 includes a timer unit that measures time in order to generate a one-time password using a time synchronization method.

  The generation unit of the hard token 2 has a predetermined algorithm (for example, a hash function) similar to that of the OTP issuing server 4 based on the password generation key and time information stored in the storage unit at a predetermined timing (time interval). A one-time password is generated by a one-way function). Then, the display unit of the hard token 2 displays the generated one-time password on a display device such as a display. The user inputs the one-time password displayed on the hard token 2 on the one-time password input screen 701 displayed on the user terminal 3 in S141.

  The user terminal 3 receives the user instruction and transmits the one-time password input by the user on the one-time password input screen 701 to the advanced authentication server 5 (S145).

  The generation unit 56 of the high-level authentication server 5 obtains a password generation key corresponding to the authentication ID notified from the authentication control unit 51 and having the flag “ON” from the authentication table (see FIG. 3). get. Then, the generation unit 56 generates a one-time password based on the acquired password generation key and time information by a predetermined algorithm similar to that of the OTP issuing server 4 and the hard token 2 (S146). Note that the time is always held and measured by a timer unit (not shown).

  Then, the OTP authentication unit 57 authenticates whether or not the one-time password transmitted from the user terminal 3 in S145 matches the one-time password generated in S146 (S147). If the one-time passwords match, the OTP authentication unit 57 determines that the user is a legitimate user, and sends an authentication result indicating that the authentication has succeeded to the business server 6. On the other hand, if the one-time passwords do not match, It is determined that the user is an unauthorized user, and an authentication result indicating that the authentication has failed is transmitted to the business server 6 (S148).

  Thereby, in the business server 6, when the successful authentication result is received, the business processing unit 62 executes a desired process transmitted from the user terminal 3 in S11. When the authentication result of failure is received, the authentication request unit 61 transmits an error message indicating that the authentication has failed to the user terminal 3.

  Next, processing (S151 to S156) when the authentication level is “3” will be described. When the authentication level is “3”, the authentication control unit 51 first sends the authentication request of S12 to the risk-based authentication unit 52, and executes risk-based authentication. The risk-based authentication unit 52 executes risk-based authentication (S151). Since the risk-based authentication in S151 is the same as the process in S131 described above, description thereof is omitted here. When the risk-based authentication fails (S151: NG), the risk-based authentication unit 52 transmits an authentication result indicating that the authentication has failed to the business server 6 (S152).

  On the other hand, when it is determined that the risk is low, and when the additional authentication is successful (S151: OK), the authentication control unit 51 causes the OTP authentication unit 57 to perform one-time password authentication. That is, the authentication control unit 51 sends an authentication instruction including an authentication ID included in the authentication request of S12 and information that can identify the user terminal 3 such as an IP address to the OPT authentication unit 57, and performs one-time password authentication. Let it run. Thereby, the production | generation part 56 and the OTP authentication part 57 perform one-time password authentication (S153). Since the one-time password authentication in S153 is the same as the processing in S141 to S147 described above, description thereof is omitted here.

  When the one-time password authentication fails (S153: NG), the OTP authentication unit 57 transmits an authentication result indicating that the authentication has failed to the business server 6 (S154). On the other hand, when the one-time password authentication is successful (S153: YES), the OTP authentication unit 57 transmits an authentication result indicating that the authentication is successful to the business server 6 (S155). Then, the table updating unit 53 registers the authentication ID and the browser information included in the authentication request in the access history table 54 in association with each other as in S134 described above (S156).

  In the present embodiment described above, spoofing by a third party can be prevented, and more advanced user authentication that can be shared by companies can be performed. Specifically, in the present embodiment, in each business server 6, when a processing request that requires high-level authentication is transmitted from the user terminal 3, the high-level authentication processing is not performed in the self-business server 6. The authentication server 5 is requested to perform authentication, and the authentication result is received from the advanced authentication server 5.

  As a result, in this embodiment, each business server 6 does not need to maintain a high-level authentication system. Therefore, there is no development cost and maintenance cost when a high-level authentication system is constructed. Authentication technology can be used more easily.

  Further, the advanced authentication server 5 of the present embodiment performs authentication according to the authentication level included in the authentication request transmitted from the business server 6. Thereby, in this embodiment, according to the authentication level which the user set for every business server 6, the authentication which a user desires can be performed flexibly. In other words, even the high-level authentication server 5 shared by the business servers 6 can precisely cope with the user's needs without impairing the user's convenience.

  In addition, this invention is not limited to said embodiment, Many deformation | transformation are possible within the range of the summary.

  1: mobile phone 2: hard token 3: user terminal 4: OTP issue server 41: generation unit 42: issue management table 5: advanced authentication server 51: authentication control unit 52: risk-based authentication unit 53: Table update unit, 54: Access history table, 55: Question information table, 56: Generation unit, 57: OTP authentication unit, 58: Authentication table, 6: Business server, 61: Authentication request unit, 62: Business process Part 63: user information table 8: network 9: network

Claims (6)

An authentication system comprising: a plurality of business devices that perform business processing in response to a request from a first terminal; and an authentication device that performs authentication in response to a request from the plurality of business devices,
Each of the plurality of business devices is
User information storage means in which an authentication level, which is the level of authentication performed by the authentication device, is stored for each user;
Upon receiving a processing request from the first terminal, an authentication request unit that reads an authentication level corresponding to the user who transmitted the processing request from the user information storage unit, and transmits an authentication request including the authentication level to the authentication device. And having
The authentication device
An authentication control means for determining the type of authentication to be executed according to the authentication level of the authentication request transmitted from each business device, and executing the determined authentication;
An authentication system comprising: an authentication unit configured to authenticate a user who has transmitted the processing request and to transmit an authentication result to the business device under the control of the authentication control unit. The authentication system according to claim 1,
An issuing device that accepts a one-time password generation request from a second terminal, generates a one-time password, and transmits the one-time password to the second terminal;
The authentication means of the authentication device includes:
Generating means for generating a one-time password;
The one-time password issued by the issuing device to the second terminal or the one-time password issued by the offline token is received from the first terminal, and the received one-time password and the one-time password generated by the generation unit are received. And a one-time password authenticating means for authenticating whether or not they match and transmitting an authentication result to the business device. An authentication system according to claim 1 or claim 2, wherein
The authentication means of the authentication device includes:
Access history storage means for storing access history information from the first terminal to the business device;
An authentication system comprising: risk-based authentication means for performing risk-based authentication using access history information in the access history storage means and transmitting an authentication result to the business device. An authentication method performed by a plurality of business devices that perform business processing in response to a request from a first terminal and an authentication device that performs authentication in response to a request from the plurality of business devices,
Each of the plurality of business devices is
An authentication level, which is the level of authentication performed by the authentication device, has a user information storage unit stored for each user;
Receiving a processing request from the first terminal;
An authentication request step of reading an authentication level corresponding to the user who transmitted the processing request from the user information storage unit, and transmitting an authentication request including the authentication level to the authentication device, and
The authentication device
A receiving step of receiving the authentication request from each business device;
A control step of determining the type of authentication to be performed according to the authentication level of the received authentication request and executing the determined authentication;
An authentication method comprising: authenticating a user who has transmitted the processing request under the control of the authentication control step, and transmitting an authentication result to the business device. An authentication method according to claim 4, wherein
An issuing device for issuing a one-time password receives a one-time password generation request from a second terminal, generates a one-time password, and sends the second time to the second terminal;
The authentication step of the authentication device includes:
A receiving step of receiving, from the first terminal, the one-time password issued by the issuing device to the second terminal or the one-time password issued by the offline token in the issuing step;
A generation step for generating a one-time password;
A one-time password authentication step for authenticating whether or not the one-time password received in the reception step matches the one-time password generated in the generation step;
And a transmitting step of transmitting the authentication result to the business device. The authentication method according to claim 4 or 5, wherein:
The authentication device
An access history storage unit storing access history information from the first terminal to the business device;
The authentication step includes
A risk-based authentication step of performing risk-based authentication using the access history information of the access history storage unit;
And a transmitting step of transmitting the authentication result to the business device.

Images