JP2019200741A - Authentication device, method for authentication, authentication program, and authentication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To easily realize highly secure authentication processing. An authentication device according to the present application includes an acquisition unit and a model generation unit. The acquisition unit uses, as the context data of the first terminal used by the user, positional relationship information indicating a relative positional relationship between the first terminal and a second terminal that is a terminal different from the first terminal. get. The model generation unit generates an authentication model that authenticates the identity of the user based on the positional relationship information acquired by the acquisition unit. [Selection diagram] Figure 1

Description

  The present invention relates to an authentication device, an authentication method, an authentication program, and an authentication system.

  Communication terminal devices equipped with various sensors are spreading. A sensor mounted on a terminal acquires data indicating various situations (contexts) surrounding the terminal (hereinafter referred to as “context data”) by converting a physical event into a digital signal. . The context data is transmitted to a predetermined server via the network and used for various information processing.

  For example, a technique for performing user authentication based on a combination of context data (terminal usage status) acquired from a plurality of terminals is known.

Japanese Patent No. 6181716

  However, there is room for improvement in the above prior art. For example, in the above-described conventional technology, when authentication is attempted on a specific terminal installed in a home or company, the user can use the usage information such as location information indicating the transition of the user's movement to the home or company. Acquired from other terminals that you own, and authenticate yourself based on the acquired combination of usage conditions. In other words, in the above-described conventional technology, various information such as information for identifying the user's home or company and the position information of each terminal until the terminal is moved to the installation location of the terminal are used for the processing. There is a risk.

  The present application has been made in view of the above, and an object thereof is to provide an authentication device, an authentication method, an authentication program, and an authentication system that can easily realize highly secure authentication processing.

  The authentication apparatus which concerns on this application is the position which showed the relative positional relationship of the 2nd terminal which is a terminal different from the said 1st terminal as the context data of the 1st terminal utilized by the user. An acquisition unit that acquires relationship information, and a model generation unit that generates an authentication model for authenticating the identity of the user based on the positional relationship information acquired by the acquisition unit.

  According to one aspect of the embodiment, there is an effect that a highly secure authentication process can be easily realized.

FIG. 1 is a diagram (1) illustrating an example of an authentication process according to the embodiment. FIG. 2 is a diagram (2) illustrating an example of the authentication process according to the embodiment. FIG. 3 is a diagram for explaining context bag generation processing according to the embodiment. FIG. 4 is a diagram illustrating a configuration example of the authentication system according to the embodiment. FIG. 5 is a diagram illustrating a configuration example of the authentication device according to the embodiment. FIG. 6 is a diagram illustrating an example of a terminal information storage unit according to the embodiment. FIG. 7 is a diagram illustrating an example of the context data storage unit according to the embodiment. FIG. 8 is a diagram illustrating an example of the authentication model storage unit according to the embodiment. FIG. 9 is a diagram illustrating a configuration example of the first terminal according to the embodiment. FIG. 10 is a flowchart (1) illustrating a processing procedure according to the embodiment. FIG. 11 is a flowchart (2) illustrating a processing procedure according to the embodiment. FIG. 12 is a flowchart (3) illustrating a processing procedure according to the embodiment. FIG. 13 is a diagram illustrating a configuration example of an authentication apparatus according to a modification. FIG. 14 is a hardware configuration diagram illustrating an example of a computer that realizes the function of the authentication device.

  Hereinafter, an embodiment for implementing an authentication device, an authentication method, an authentication program, and an authentication system according to the present application (hereinafter referred to as “embodiment”) will be described in detail with reference to the drawings. Note that the authentication device, the authentication method, the authentication program, and the authentication system according to the present application are not limited to the embodiment. In addition, the embodiments can be appropriately combined within a range that does not contradict processing contents. In the following embodiments, the same portions are denoted by the same reference numerals, and redundant description is omitted.

[1. Example of authentication process)
First, an example of an authentication process according to the embodiment will be described with reference to FIGS. 1 to 3. FIG. 1 is a diagram (1) illustrating an example of an authentication process according to the embodiment. FIG. 1 shows an example in which the authentication apparatus 100 according to the present application executes an authentication model generation process used for a process for authenticating a user's identity.

  An authentication device 100 illustrated in FIG. 1 is a server device that executes authentication processing according to the embodiment. For example, in the service provided via the network, the authentication device 100 determines whether the user who intends to use the service is the user himself / herself registered in the service, and based on the determination result, Authenticate the user who has accessed

  A user U01 illustrated in FIG. 1 is an example of a user who intends to receive authentication by the authentication device 100. For example, the user U01 is a user who has been registered in the service provided by the authentication device 100 and has received a user account or the like from the service. The user U01 can use the personalized service by authenticating the identity of the user U01 to the authentication apparatus 100 by the authentication process described below.

  In the example shown in FIG. 1, the user U01 possesses a plurality of information processing terminals (devices). For example, the user U01 is a terminal mainly used when accessing the service, and transmits a context data required for the authentication processing according to the embodiment to the authentication apparatus 100 (hereinafter, the terminal is referred to as “ Smartphone 20 that is referred to as a “first terminal”. In addition to the smartphone 20, the user U01 includes a plurality of terminals that do not transmit the context data required for the authentication process according to the embodiment to the authentication device 100 (hereinafter, these terminals are referred to as “second terminals” for distinction). Have. For example, the user U01 possesses a so-called wearable device such as a watch-type terminal 30 that can be worn on the wrist and a glasses-type terminal 40 that is worn around the eyes. Hereinafter, when it is not necessary to distinguish the smartphone 20, the watch-type terminal 30, the spectacle-type terminal 40, and the like, these are collectively referred to as the “user terminal 10”. Hereinafter, the user may be read as the user terminal 10 or the like. For example, the description “the user transmits context data” may actually indicate the situation “the user terminal 10 used by the user transmits context data”.

  Generally, authentication processing in a service is performed by receiving authentication information from a registered user. The authentication information is, for example, a password set by the user or the user's biometric information (such as a fingerprint). However, since there are many services via the network, it is a burden for the user to store passwords corresponding to each service and to input information such as a fingerprint every time authentication is performed.

  Therefore, the authentication apparatus 100 according to the embodiment executes a user authentication process without receiving an input of authentication information such as a password from the user by using a method described below. Specifically, the authentication device 100 acquires positional relationship information indicating a relative positional relationship between the first terminal and the second terminal as the context data of the first terminal used by the user. And the authentication apparatus 100 produces | generates the authentication model for authenticating a user's identity based on the acquired positional relationship information. Thereby, the authentication apparatus 100 can authenticate the user's identity by using the context data of the first terminal acquired at the timing when the user accesses the service without the user performing a special operation in the future. it can. Further, the authentication device 100 does not necessarily require context data such as position information measured using a GPS (Global Positioning System) function, for example, and uses a relative positional relationship between the first terminal and the second terminal. By performing authentication, authentication processing can be performed simply. Hereinafter, the flow of the authentication processing according to the embodiment will be described with reference to FIGS. 1 to 3.

  In FIG. 1, the flow of processing in which the authentication apparatus 100 generates an authentication model corresponding to the user U01 will be described. In the example illustrated in FIG. 1, it is assumed that the user U01 is in a state in which predetermined authentication information (password or the like) is presented to the authentication device 100 and is authenticated by the authentication device 100. For example, the user U01 has successfully authenticated with the authentication information and is logged in to a service provided by the authentication device 100.

  In this state, the smartphone 20 as the first terminal detects the context of the own device (step S11). Here, the context refers to a situation in which the smartphone 20 is used by the user U01, a situation in which the user U01 is placed, and various situations related to the surrounding environment of the smartphone 20. And the smart phone 20 acquires context data based on the detected context.

  The context data is data indicating a context detected by the smartphone 20. For example, the context data is data that represents the context detected by various sensors included in the smartphone 20 as a physical numerical value. The context data corresponds to various data surrounding the smartphone 20. In the example of FIG. 1, the smartphone 20 acquires, as context data, positional relationship information indicating a relative positional relationship between the smartphone 20 and the watch-type terminal 30 or the glasses-type terminal 40 that are the second terminals.

  That is, the positional relationship information is information indicating that the smartphone 20 and the second terminal are in a predetermined spatial range (nearby). The smartphone 20 detects surrounding second terminals every predetermined time (for example, every 5 minutes). For example, the smartphone 20 detects a nearby second terminal by detecting a radio wave such as WiFi (registered trademark) or Bluetooth (registered trademark) or detecting a terminal using the same access point.

  Specifically, the smartphone 20 detects the identification information of the surrounding second terminals and the radio wave intensity emitted by each second terminal, and determines which second terminal is located in the vicinity. As an example, the smartphone 20 detects a relative positional relationship with the second terminal based on a numerical value of RSSI (Received Signal Strength Indication), and determines a second terminal located in the vicinity. Further, the smartphone 20 may detect the second terminal for which pairing has been completed based on the Bluetooth function regardless of the radio wave intensity.

  And the smart phone 20 extracts the 2nd terminal which is in the closest relation among the detected 2nd terminals. For example, the smartphone 20 extracts the second terminal located in the vicinity. Alternatively, the smartphone 20 may preferentially extract the second terminal that has been paired. Then, the smartphone 20 extracts the second terminal extracted within the range of the predefined maximum number (in the example of FIG. 1, the maximum number is “3” including its own device), the detected time, Are associated with each other to generate positional relationship information. In the example illustrated in FIG. 1, the positional relationship information is represented in a format such as [8:00; 20, 30], for example. The positional relationship information indicates that “smart phone 20 (own device)” and “clock type terminal 30” are located in the vicinity at 8:00. In other words, the positional relationship information indicates that the smart phone 20 has detected the clock-type terminal 30 as the second terminal that is close to the device at 8:00. Similarly, the positional relationship information expressed in the format of [8:05; 20, 30, 40] indicates that, as of the second terminal in which the smartphone 20 is in a close relationship with the device at 8:05, “ It shows that the “clock type terminal 30” and the “glasses type terminal 40” have been detected.

  Although details will be described later, the smartphone 20 uses the positional information of the own device when the positional relationship information is acquired as context data, or the detected terminal information of the second terminal (whether the second terminal is a mobile terminal or not. Various types of information such as a type such as a type) may be acquired.

  Subsequently, the smartphone 20 generates information (hereinafter referred to as “context bag”) including the acquired positional relationship information as a bundle (step S12). For example, the context bag is a bundle of positional relationship information acquired during a predefined time length (for example, 10 minutes). Note that the reason for generating a context bag is that more features are extracted when processing is performed using a context bag that includes multiple pieces of positional relationship information than when processing is performed using only one piece of positional relationship information. This is because the authentication apparatus 100 has an advantage that efficient learning (model generation) can be performed.

  In the example illustrated in FIG. 1, the smartphone 20 generates a context bag using a bundle of three pieces of positional relationship information acquired in the last 10 minutes. Specifically, the smartphone 20 has a bundle of positional relationship information such as “[8:00; 20, 30], [8:05; 20, 30, 40], [8:10; 20, 30, 40]”. The context bag BG01 that becomes is generated. Similarly, the smartphone 20 has a context in which positional relationship information such as “[8:05; 20, 30, 40], [8:10; 20, 30, 40], [8:15; 20]” is bundled. A bag BG02 is generated. Similarly, the smartphone 20 generates a context bag BG03 in which positional relationship information such as “[8:10; 20, 30, 40], [8:15; 20], [8:20; 20]” is bundled. To do. Note that the setting of how long the context bag includes the positional relationship information may be defined by the authentication device 100.

  The smartphone 20 periodically transmits the context bag generated every predetermined time to the authentication device 100 (step S13). For example, the smartphone 20 transmits the generated context bag to the authentication device 100 at a predefined time interval (for example, 5 minutes). Note that the smartphone 20 may accumulate the generated context bags and transmit them together at a predetermined timing.

  The authentication device 100 acquires the transmitted context bag, and stores the acquired context bag in association with the user U01 who is logged in to the service. Then, the authentication device 100 generates an authentication model related to the user U01 when a sufficient amount of context bags for model generation (for example, 10 days or 1 month) are accumulated (step S14).

  The context bag transmitted to the authentication device 100 while the smartphone 20 is logged in to the service, that is, what positional relationship between the smartphone 20 and the second terminal is in a situation where the user U01 is authenticated. (Hereinafter sometimes referred to as “device context”). For example, the context bag is information indicating that the watch-type terminal 30 and the glasses-type terminal 40 are in the vicinity in many cases in a situation where the user U01 is authenticated. As a result of accumulating a considerable number of context bags, the authentication device 100 determines that “the user U01 is authenticated (the user U01 is himself)” and “the relative relationship between the first terminal and the second terminal. The statistical tendency can be obtained with respect to the relationship with the “positional relationship (device context)”. Based on such information, the authentication device 100 generates an authentication model corresponding to the user U01.

  For example, the authentication device 100 generates a model that statistically analyzes the accumulated feature value of the context bag, such as logistic regression or linear regression analysis. Specifically, the authentication device 100 generates a model for calculating the probability that the watch-type terminal 30 and the glasses-type terminal 40 are in the vicinity in a state where the user U01 is authenticated. That is, the authentication apparatus 100 uses “the user U01” as the objective variable for the user who is making an authentication request using the smartphone 20, and “the watch-type terminal 30” or “the glasses-type terminal near the smartphone 20”. A regression equation having “40” is located ”as an explanatory variable is generated. Accordingly, the authentication device 100 indicates that the user is “user U01” when predetermined information (for example, positional relationship information at the time when the user U01 newly requests authentication) is input to the model. A score can be output. For example, when the authentication model is represented by a regression equation such as logistic regression, the authentication device 100 sets a score indicating the probability that the user who transmitted the information is “user U01” based on the input positional relationship information to 0. Can be represented by a numerical value from 1 to 1.

  Although details will be described later, the authentication device 100 may use position information when the smartphone 20 generates a context bag, time information when the context bag is generated, and the like when generating the authentication model. .

  The authentication device 100 stores the generated authentication model in the authentication model storage unit 123 (step S15). In the future, when the authentication apparatus 100 receives an authentication request from the user U01, the authentication apparatus 100 authenticates the user U01 using an authentication model regardless of authentication information such as a password. An authentication process according to the embodiment will be described with reference to FIG.

  FIG. 2 is a diagram (2) illustrating an example of the authentication process according to the embodiment. FIG. 2 shows an example in which the authentication process for the user U01 is executed by the authentication device 100 using the authentication model.

  In the example of FIG. 2, it is assumed that the user U01 has not received authentication from the authentication device 100. For example, the user U01 has once logged out from the service provided by the authentication device 100, and needs to be newly authenticated by the authentication device 100 in order to use the service. In this case, the user U01 transmits a request for authentication to the authentication device 100 via the smartphone 20 (step S21). For example, the user U01 requests login for the service.

  Here, the smartphone 20 transmits the context data detected at the present time to the authentication device 100 together with the request for authentication (step S22). For example, the smartphone 20 transmits the positional relationship information acquired at the time of the authentication request to the authentication device 100 as context data.

  In the example of FIG. 2, the smartphone 20 transmits the context data in a context bag manner in which the positional relationship information is bundled, similarly to the model generation time point. For example, the smartphone 20 has positional information such as “[12:00; 20, 30, 40], [12:05; 20, 30, 40], [12: XX; 20, 30, 40]” in a bundle. The resulting context data DT11 is transmitted. Note that “12: XX” indicates the time when the authentication request is transmitted.

  The authentication device 100 determines the identity of the user U01 based on the context data DT11 at the time of authentication acquired from the smartphone 20 (step S23). For example, the authentication device 100 specifies the authentication model of the user U01 stored in the authentication model storage unit 123 based on the identification information of the user U01 (smart phone 20) that has transmitted the authentication request. Then, the authentication apparatus 100 inputs the context data DT11 to the authentication model, and calculates a score indicating whether the user who transmitted the context data DT11 is the user U01 himself / herself based on the feature amount of the context data DT11.

  Then, when the calculated score exceeds a predetermined threshold (for example, when the score is shown in a range from 0 to 1, the score exceeds “0.6”, the context data) It is determined that the user who transmitted DT11 is the “user U01”. With this process, the authentication apparatus 100 can authenticate the user U01 without requiring the user U01 to input a password or the like (step S24). Subsequently, the authentication device 100 notifies the smartphone 20 that the authentication is successful (step S25).

  Note that if the identity of the user U01 cannot be confirmed in step S23 (for example, if the score is equal to or lower than a predetermined threshold value), the authentication apparatus 100 requests authentication information such as a password or a fingerprint from the user U01. Notifications may be sent.

  As described with reference to FIGS. 1 and 2, the authentication device 100 according to the embodiment uses the first terminal and the first terminal as context data of the first terminal (the smartphone 20 in the example of FIG. 1) used by the user U01. The positional relationship information indicating the relative positional relationship with the two terminals is acquired. And the authentication apparatus 100 produces | generates the authentication model which authenticates the identity of the user U01 based on the acquired positional relationship information. Further, when the authentication apparatus 100 receives an authentication request from the first terminal, the authentication apparatus 100 authenticates the identity of the user U01 based on the context data of the first terminal acquired together with the authentication request and the authentication model.

  As described above, the authentication apparatus 100 can identify the identity of the user U01 based on the positional relationship between the first terminal, which is a terminal mainly used by the user to be authenticated, and the second terminal located in a predetermined space range. Process to authenticate. As a result, the authentication device 100 allows the second terminal located in the vicinity of the first terminal at the time of authentication without specifying absolute position information using the GPS function or the like, or specifying the position where the terminal used for authentication is located. The user U01 can be authenticated based on the relationship with the terminal (for example, the terminal that the user U01 always carries). That is, the authentication apparatus 100 can authenticate the identity of the user U01 with simple processing without performing complicated processing such as analysis of absolute position information.

  In the example of FIGS. 1 and 2 described above, the authentication apparatus 100 generates an authentication model based on the context bag generated by the first terminal. Since the authentication apparatus 100 includes a plurality of pieces of positional relationship information in the context bag, the number of feature amounts that can be extracted is larger than that of the single positional relationship information, and thus the accuracy of the generated model can be improved.

  An example of context bag generation will be described with reference to FIG. FIG. 3 is a diagram for explaining context bag generation processing according to the embodiment. FIG. 3 conceptually shows a process in which the first terminal generates a context bag. In the example of FIG. 3, the first terminal is “terminal A (in FIG. 3, simply expressed as“ A ”. The same applies to other terminals)”, and the second terminal detected from the first terminal is “terminal. B ”,“ terminal C ”,“ terminal D ”, and“ terminal E ”.

  The terminal A detects the second terminal when a preset detection time arrives. For example, the terminal A detects the second terminal at “9:00”, and detects the terminal B as a result of the detection. Further, the terminal A detects a relative distance from the terminal B. For example, the terminal A measures the distance between its own device and the terminal B by using the radio wave intensity received from the terminal B.

  And the terminal A extracts the 2nd terminal detected that it exists in the distance relatively close from an own apparatus among the detected 2nd terminals, and produces | generates positional relationship information. Note that the terminal A may previously set the number of terminals included in the positional relationship information. For example, as illustrated in FIGS. 1 and 2, the terminal A generates the positional relationship information so that up to “three” terminals are included. In the example of FIG. 3, since the terminal A detects only the terminal B at the time of “9:00”, the positional relationship information (only the terminal A and the terminal B indicating the relationship is shown) In FIG. 3, [9:00: A, B] is generated.

  And the terminal A produces | generates the context bag which bundles positional relationship information at the timing which produced | generated positional relationship information. Since the terminal A has generated only one piece of positional relationship information at the time of “9:00”, the terminal A generates a context bag BG11 including one piece of positional relationship information. Note that, when the time range of the positional relationship information included in the context bag is set in advance, the terminal A generates the context bag according to the set time. For example, the terminal A generates a context bag whose time range is set to “10 minutes”. In this case, even if the terminal A holds the positional relationship information corresponding to the time of “8:40”, the positional relationship information of “8:40” and the positional relationship information of “9:00” are “10”. Since it is not included in the range of “minute”, the positional relationship information of “8:40” is not included in the context bag BG11.

  Thereafter, when the next detection timing arrives, the terminal A performs the process of detecting the second terminal again. For example, when the detection interval is set to “5 minutes”, the terminal A detects the surrounding second terminal at “9:05”. At this time, when the terminal A does not detect the second terminal other than the own device, the terminal A generates positional relationship information including only the own device.

  Then, the terminal A generates a context bag that bundles the positional relationship information at the timing when the positional relationship information of “9:05” is generated. For example, the terminal A generates a context bag BG12 in which the positional relationship information corresponding to “9:00” and the positional relationship information corresponding to “9:05” are bundled.

  Thereafter, the terminal A detects the second terminal at “9; 10”. For example, the terminal A detects the terminal C and the terminal D as the second terminal. In this case, the terminal A generates positional relationship information indicating only that the terminal A, the terminal C, and the terminal D have a relationship. Terminal A then generates the positional relationship information corresponding to “9:00”, the positional relationship information corresponding to “9:05”, and “9:10” at the timing when the positional relationship information “9:10” is generated. A context bag BG13 in which the positional relationship information corresponding to “10” is bundled is generated.

  Thereafter, the terminal A detects the second terminal at “9; 15”. For example, the terminal A detects the terminal C, the terminal D, and the terminal E as the second terminal. In this case, the terminal A compares the relative distances of the terminal C, the terminal D, and the terminal E with the own device. And terminal A extracts the 2nd terminal in the near distance from an own apparatus. At the time of “9:15”, since the terminal C and the terminal D are closer to each other than the terminal E, the terminal A extracts the terminal C and the terminal D as a second terminal having a relationship. And the terminal A produces | generates the positional relationship information which showed only that the terminal A, the terminal C, and the terminal D have a relationship.

  Then, the terminal A generates a context bag BG14 including the positional relationship information corresponding to “9:15”. Note that, at the time “9:15” when the context bag BG14 is generated, the positional relationship information corresponding to “9:00” exceeds the time range “10 minutes” of the context bag, and thus is not included in the context bag BG14. . That is, terminal A corresponds to each of “9:05”, “9:10”, and “9:15”, which are positional relationship information generated in a time range from “9:15” to “10 minutes”. The context bag BG14 is generated by bundling the positional relationship information.

  As illustrated in FIG. 3, the terminal A generates a context bag including a plurality of pieces of positional relationship information according to the generation timing. And the authentication apparatus 100 shows the relationship between the situation where the user has been authenticated, and the relative positional relationship between the first terminal and the second terminal, using a context bag including a plurality of positional relationship information. Generate an authentication model. As described above, the authentication apparatus 100 can efficiently learn by using a plurality of pieces of positional relationship information, and thus can improve the accuracy of the generated authentication model.

  As described above with reference to FIGS. 1 to 3, in the authentication device 100, based on the context data and the authentication model at the time of authentication, the user who made the authentication request is the user himself / herself corresponding to the authentication model. The user is authenticated by determining the probability of. The authentication device 100 that performs such processing and the authentication system 1 including the authentication device 100 will be described in detail with reference to FIG.

[2. Configuration of authentication system]
The configuration of the authentication system 1 including the authentication device 100 according to the embodiment will be described with reference to FIG. FIG. 4 is a diagram illustrating a configuration example of the authentication system 1 according to the embodiment. As illustrated in FIG. 4, the authentication system 1 according to the embodiment includes a user terminal 10 and an authentication device 100. In addition, the user terminal 10 includes a first terminal such as the smartphone 20 and a second terminal such as the watch-type terminal 30 and the glasses-type terminal 40. These various devices are communicably connected via a network N by wire or wireless.

  The user terminal 10 is, for example, an information processing terminal (device) such as a desktop PC (Personal Computer), a notebook PC, a tablet terminal, a mobile phone including a smartphone, or a PDA (Personal Digital Assistant). The user terminal 10 also includes a wearable device such as a watch-type terminal 30 and a glasses-type terminal 40. Furthermore, the user terminal 10 may include various smart devices having an information processing function. For example, the user terminal 10 may include a smart home appliance such as a TV (Television), a smart vehicle such as an automobile, a drone, and a home robot.

  Note that the second terminal may be a device that can communicate with the first terminal by a predetermined communication function, even if it is a device that does not have a function of performing processing such as an authentication request in response to a user operation. For example, the second terminal includes a router, a modem, a mobile router, etc. installed at home as a stationary device.

  The authentication device 100 generates an authentication model for authenticating the user's identity based on the positional relationship information indicating the relative positional relationship between the first terminal and the second terminal, and uses the generated authentication model to identify the user. A server device to be authenticated. In the embodiment, the authentication apparatus 100 also functions as a service server (for example, a web server) that provides a service. However, the authentication apparatus 100 and the service server may be separate apparatuses.

[3. Configuration of authentication device]
Next, the configuration of the authentication device 100 according to the embodiment will be described with reference to FIG. FIG. 5 is a diagram illustrating a configuration example of the authentication device 100 according to the embodiment. As illustrated in FIG. 5, the authentication device 100 includes a communication unit 110, a storage unit 120, and a control unit 130. The authentication device 100 includes an input unit (for example, a keyboard and a mouse) that receives various operations from an administrator who uses the authentication device 100, and a display unit (for example, a liquid crystal display) that displays various types of information. You may have.

(About the communication unit 110)
The communication unit 110 is realized by, for example, a NIC (Network Interface Card). The communication unit 110 is connected to the network N by wire or wireless, and transmits / receives information to / from the user terminal 10 or the like via the network N.

(About the storage unit 120)
The storage unit 120 is realized by, for example, a semiconductor memory device such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 120 includes a terminal information storage unit 121, a context data storage unit 122, and an authentication model storage unit 123.

(About the terminal information storage unit 121)
The terminal information storage unit 121 stores information related to the user terminal 10. Here, FIG. 6 illustrates an example of the terminal information storage unit 121 according to the embodiment. FIG. 6 is a diagram illustrating an example of the terminal information storage unit 121 according to the embodiment. In the example illustrated in FIG. 6, the terminal information storage unit 121 includes items such as “terminal ID”, “terminal name”, “terminal type”, and “pairing history”.

  “Terminal ID” indicates identification information for identifying the user terminal 10. “Terminal name” indicates the name of the user terminal 10. The “terminal type” indicates a type such as whether the user terminal 10 is a stationary device or a mobile terminal. The authentication device 100 may acquire the terminal type by inquiring of an external data server or the like based on the terminal ID or the terminal name, or may be acquired by being input by the administrator of the authentication device 100. . “Pairing history” indicates the terminal ID of the other party paired using the Bluetooth function or the like.

  That is, in the example of FIG. 6, the user terminal 10 identified by the terminal ID “C01” has the terminal name “smart phone 20”, the terminal type “mobile”, and the terminal ID “C02” “C03”. It has shown that it has the pairing log | history with the user terminal 10 identified by.

(About the context data storage unit 122)
The context data storage unit 122 stores context data acquired from the first terminal. Here, FIG. 7 illustrates an example of the context data storage unit 122 according to the embodiment. FIG. 7 is a diagram illustrating an example of the context data storage unit 122 according to the embodiment. In the example illustrated in FIG. 7, the context data storage unit 122 includes items such as “user ID”, “terminal ID”, and “context bag”. The items of the context bag include “bag ID”, “acquisition date / time”, “individual data ID”, “detection date / time”, “pairing information”, “peripheral terminal”, “position information”, “various sensor data”. It has a small item.

  “User ID” indicates identification information for identifying a user who uses the user terminal 10 that has transmitted the context data. “Terminal ID” corresponds to the same item shown in FIG. 6, and in the example of FIG. 7, indicates identification information for identifying the first terminal that transmitted the context data.

  The “context bag” is a bundle of context data transmitted from the first terminal, and is data including any number of positional relationship information and context data acquired together with the positional relationship information. “Bag ID” indicates identification information for identifying a context bag. “Acquisition date and time” indicates the date and time when the context bag is acquired. “Individual data ID” indicates identification information for identifying individual data (positional relationship information or the like) included in the context bag.

  “Pairing information” is information indicating which terminals are paired in the positional relationship information. In the example of FIG. 7, the pairing information is represented by a concept such as “F01”. Actually, the pairing information item includes information (terminal ID) for identifying each terminal in the pairing state. Etc.) is stored.

  “Peripheral terminal” indicates a terminal ID determined to be located in the vicinity of the first terminal that transmitted the context data (determined to be located relatively close) in the individual data. “Position information” indicates position information of the first terminal when the context bag is transmitted. FIG. 7 shows an example in which conceptual information such as “G01” is stored in the position information item. Actually, the position information item includes specific numerical values such as longitude and latitude, Information that can estimate the position information (for example, the IP address of the smartphone 20) is stored.

  “Various sensor data” indicates information detected by various sensors of the first terminal that has transmitted the context data. In FIG. 7, the sensor data is represented by the concept of “X01”. Actually, however, specific information acquired by various sensors such as temperature, humidity, and altitude is stored in the sensor data item. The The position information and the various sensor data may be information detected when each individual data is acquired.

  That is, in the example of FIG. 7, the context bag identified by the bag ID “BG01” is the terminal used by the user identified by the user ID “U01” and from the user terminal 10 identified by the terminal ID “C01”. Indicates that has been sent. This context bag is acquired by the authentication apparatus 100 at “8:10 on May 1, 2018”, and the individual data IDs “BG01-1”, “BG01-2”, “BG01-3” "including. For example, the individual data identified by the individual data ID “BG01-1” is detected by the user terminal 10 at “8:00 on May 1, 2018”, and the pairing information is “F01”. ”Indicating that a terminal identified by the terminal ID“ C01 ”is detected as a peripheral terminal. Further, the position information of the user terminal 10 when the context bag identified by the bag ID “BG01” is generated is “G01”, and the various sensor data is “X01”.

(Regarding the authentication model storage unit 123)
The authentication model storage unit 123 stores information related to the generated authentication model. Here, FIG. 8 illustrates an example of the authentication model storage unit 123 according to the embodiment. FIG. 8 is a diagram illustrating an example of the authentication model storage unit 123 according to the embodiment. In the example illustrated in FIG. 8, the authentication model storage unit 123 includes items such as “user ID”, “authentication target terminal”, “model ID”, and “learning data”.

  “User ID” corresponds to the same item shown in FIG. 7 and indicates identification information for identifying a user to be authenticated by the authentication model. The “authentication target terminal” corresponds to the item of “terminal ID” shown in FIG. 6 and is a target to which an authentication request is transmitted among the user terminals 10 used by the user to be authenticated by the authentication model. The identification information which identifies the user terminal 10 is shown. “Model ID” indicates identification information for identifying an authentication model. “Learning data” indicates learning data used to generate an authentication model. In FIG. 8, the learning data is represented by the concept of “H01”. Actually, however, the learning data item includes specific information such as context data (context bag) used for learning the authentication model. Is memorized.

  That is, in the example of FIG. 8, the user identified by the user ID “U01” is authenticated using the context data transmitted from the user terminal 10 whose authentication target terminal (first terminal) is identified by “C01”. The model ID of the authentication model corresponding to the user is “M01”, and the learning data is “H01”.

  The authentication model according to the embodiment is an input layer to which context data (positional relationship information) of the first terminal is input, an output layer, or any layer from the input layer to the output layer, and the output layer The configuration may include a first element belonging to a layer other than the first element and a second element whose value is calculated based on the first element and the weight of the first element. The authentication model performs the calculation based on the first element and the weight of the first element with respect to information input to the input layer, with each element belonging to each layer other than the output layer as the first element. The computer is caused to function so as to output a score indicating the probability of being from the output layer. When the model generation unit 132 does not perform learning of a multilayer structure such as deep learning, the above-described “any layer from the input layer to the output layer and other than the output layer” “Each layer other than the output layer” indicates an input layer.

For example, when the authentication model according to the embodiment is realized by a regression model such as logistic regression, the first element included in the model is a second terminal located in the vicinity of input data x _i (i is an arbitrary number)) And the weight of the first element corresponds to the coefficient ω _i corresponding to x _i . In general, the regression model can be regarded as a simple perceptron having an input layer and an output layer, but when the authentication model is regarded as a simple perceptron, the first element corresponds to any node of the input layer, and The two elements can be regarded as nodes included in the output layer.

  Furthermore, when each model is realized by a neural network having one or a plurality of intermediate layers such as DNN (Deep Neural Network), the first element included in each model is any of the input layer or the intermediate layer The second element corresponds to a node to which a value is transmitted from a node corresponding to the first element, that is, a node in the next stage, and the weight of the first element is the first element and A weight to be considered for a value transmitted from a corresponding node to a node corresponding to the second element, that is, a connection coefficient.

  The model generation unit 132 generates an authentication model having an arbitrary structure such as the above-described regression model or DNN. More specifically, the model generation unit 132 learns the relationship between the context data indicating the second terminal located at a relatively close distance to the first terminal and the event that the user is the user, and performs authentication. Generate a model.

(About the control unit 130)
The control unit 130 is, for example, a controller, and various programs (authentication according to the embodiment) stored in a storage device inside the authentication device 100 by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like. (Corresponding to an example of a program) is implemented by executing the RAM as a work area. The control unit 130 is a controller, and is realized by an integrated circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

  As shown in FIG. 5, the control unit 130 includes an acquisition unit 131, a model generation unit 132, an authentication unit 133, and a transmission unit 134, and realizes or executes information processing functions and operations described below. To do. Note that the internal configuration of the control unit 130 is not limited to the configuration illustrated in FIG. 5, and may be another configuration as long as information processing described later is performed. In addition, the connection relationship between the processing units included in the control unit 130 is not limited to the connection relationship illustrated in FIG. 5, and may be another connection relationship.

(About the acquisition unit 131)
The acquisition unit 131 acquires various types of information. When generating the authentication model, the acquiring unit 131 generates a context of a user who has requested authentication for the service or a user who has already completed authentication and is using the service (that is, a user whose identity has been authenticated). Get the data. In other words, the acquisition unit 131 acquires context data labeled as correct data “user is the person” until the generation of the authentication model corresponding to the user. Thus, the context data acquired from the authenticated user becomes learning data for generating the authentication model of the user.

  For example, the acquisition unit 131 uses the positional relationship information indicating the relative positional relationship between the first terminal and the second terminal, which is a terminal different from the first terminal, as the context data of the first terminal used by the user. To get. The acquisition unit 131 acquires context data from the first terminal of the user who has completed authentication, for example, every predetermined time (for example, every 5 minutes) set in advance.

  In addition, the acquisition part 131 may acquire the information which shows the context of a 1st terminal further with positional relationship information. For example, the acquisition unit 131 may acquire position information indicating the position of the first terminal together with the positional relationship information. Specifically, the acquisition unit 131 acquires the positional information detected by the first terminal using the GPS function and the positional relationship information.

  Moreover, the acquisition part 131 acquires the time information when the positional relationship information was generated together with the positional relationship information. For example, the acquisition unit 131 acquires positional relationship information including time information indicating the time when the first terminal detects the surrounding second terminal.

  The acquisition unit 131 may acquire positional relationship information indicating the relative positional relationship between each of the first terminal and the plurality of second terminals. For example, the acquisition unit 131 selects a second terminal that is closer to the first terminal among the plurality of second terminals (for example, the second terminal that is estimated to be located at a closer position based on the radio wave intensity). The positional relationship information including information to be identified is acquired. Thereby, the acquisition unit 131 not only indicates that any second terminal is located in the vicinity of the first terminal, but also indicates a position indicating which second terminal is closest to the first terminal. Relationship information can be acquired.

  The acquisition unit 131 may acquire information in which a plurality of pieces of positional relationship information are combined. Specifically, the acquisition unit 131 acquires a plurality of pieces of positional relationship information from the first terminal in the form of a context bag illustrated in FIG. That is, when acquiring the context data for each predetermined time, the acquiring unit 131 acquires a plurality of pieces of positional relationship information covering a certain time range, so that generation processing and authentication processing described later can be efficiently executed. .

  Note that the acquisition unit 131 acquires context data used for authentication from the first terminal when an authentication request is received from the first terminal after generating the authentication model.

  The acquisition unit 131 can acquire various types of information as long as the context data used for authentication is information indicating the relative positional relationship between the first terminal and the second terminal. For example, the acquisition unit 131 may acquire the positional relationship information from the first terminal, similarly to the case where it is used for generating the authentication model.

  Alternatively, the acquisition unit 131 may acquire the radio wave intensity between the first terminal and the second terminal as context data acquired together with the authentication request. In this case, the authentication unit 133 described later estimates the second terminal located in the vicinity of the first terminal based on the radio wave intensity between the first terminal and the second terminal. Then, the authentication unit 133 authenticates the user's identity based on the estimated information.

  Moreover, the acquisition part 131 may acquire the communication condition between a 1st terminal and a 2nd terminal as context data acquired with the request | requirement of authentication. For example, the acquisition unit 131 acquires information indicating whether or not the first terminal and the second terminal are paired. Note that the acquisition unit 131 performs not only pairing, but also, for example, information indicating that the first terminal and the second terminal are transmitting and receiving information to each other, and communication connection information between the first terminal and the second terminal ( For example, information indicating that the same access point is used) or information indicating that the first terminal and the second terminal are used by the same user (for example, in the same account on the cloud) Information indicating that linked data is used) may be acquired.

  In addition, as the context data acquired together with the authentication request, the acquisition unit 131 includes the context data of the first terminal at the time when the authentication request is made, the first terminal and the second data in the past from the time when the authentication request is made. You may acquire the positional relationship information which showed the relative positional relationship with a terminal. Specifically, the acquisition unit 131 acquires context data including a plurality of pieces of positional relationship information generated over a plurality of time points (context data DT11 corresponds in the example illustrated in FIG. 2).

  Further, the acquisition unit 131 detects the position data of the first terminal and various sensors of the first terminal in addition to the information indicating the positional relationship between the first terminal and the second terminal as context data acquired together with the authentication request. Information indicating the performed context may be acquired. In addition, the acquisition unit 131 may include attribute information of a user who uses the first terminal that transmitted the authentication request (gender, age, place of residence, etc. of the user registered in the service), or the first terminal and the second terminal. Terminal information (for example, whether it is a stationary device, a mobile terminal, or a wearable terminal) may be acquired.

  The acquisition unit 131 stores the acquired information in the storage unit 120 as appropriate. Further, the acquisition unit 131 may acquire information from the storage unit 120 as appropriate. In addition, when acquiring various information such as context data from the first terminal, the acquiring unit 131 acquires various information by crawling the first terminal regardless of transmission from the first terminal. Also good.

  Note that the acquisition unit 131 may acquire not only the context data in a state where the user has been authenticated or the state in which the user is authenticated, but also context data at the time when the user has not been authenticated. For example, the acquisition unit 131 may acquire context data acquired in a state where the user is not authenticated as a negative example in learning. Moreover, the acquisition part 131 may acquire the context data acquired at that time as a negative example in learning, when a user tries authentication but authentication fails.

(About the model generation unit 132)
The model generation unit 132 generates an authentication model for authenticating the user's identity based on the positional relationship information acquired by the acquisition unit 131.

  For example, the model generation unit 132 generates an authentication model corresponding to the user based on the positional relationship information acquired from the first terminal used by the user whose identity is authenticated based on the existing authentication information such as a password. To do.

  The model generation unit 132 may generate an authentication model based on various known methods. For example, the model generation unit 132 may generate an authentication model by statistically analyzing the position information. As an example, the model generation unit 132 generates a regression equation or the like based on context data (positional relationship information) that is correct data acquired from a user whose identity is authenticated, and determines a score indicating the identity of the user. An authentication model may be generated.

  For example, the model generation unit 132 generates an expression having the event “I am the user” as an objective variable and “the second terminal located around the first terminal” as an explanatory variable. For example, the model generation unit 132 generates an expression corresponding to the number of context data acquired by the acquisition unit 131. The model generation unit 132 generates an authentication model including weight values obtained recursively by advancing learning using an expression corresponding to the context data (that is, recursively calculating a sufficient number of samples). can do. More specifically, when the authentication is requested, the model generation unit 132 indicates that the information “which second terminal is located” in the vicinity of the first terminal is “the user is the user”. An authentication model is generated by calculating a weight value such as what kind of weight is given to.

  For example, when the authentication model is generated based on the context data indicating that the watch-type terminal 30 or the glasses-type terminal 40 is located in the vicinity of the first terminal when the user's identity is authenticated, At the time of authentication, a relatively high weight value is set for an event that the “clock type terminal 30” or the “glasses type terminal 40” is located in the vicinity of the first terminal. In other words, the context data transmitted together with the authentication request includes data indicating that the “watch type terminal 30” or the “glasses type terminal 40” is located in the vicinity of the first terminal. The probability that the performed user is determined to be the user himself / herself corresponding to the authentication model increases.

  Note that the model generation unit 132 can improve the accuracy of determining the identity by performing learning using not only the positional relationship information but also various kinds of context data. For example, the model generation unit 132 may generate an authentication model based on the positional relationship information and the positional information of the first terminal corresponding to the positional relationship information. As a result, the model generation unit 132 can generate an authentication model reflecting information such as at which position (the user's home or work place, etc.) the user tends to request authentication. The accuracy of authentication for a user who performs authentication can be improved.

  The model generation unit 132 may generate an authentication model based on the positional relationship information and time information corresponding to the positional relationship information. As a result, the model generation unit 132 can generate an authentication model reflecting information such as what time zone the user tends to request authentication. Accuracy can be improved. Note that the time information may include information on dates and days of the week.

  Note that the model generation unit 132 may generate an authentication model based on information obtained by combining a plurality of pieces of positional relationship information. Specifically, the model generation unit 132 generates an authentication model using a context bag, which is information obtained by combining a plurality of pieces of positional relationship information, as learning data. That is, the model generation unit 132 can perform learning efficiently by performing learning using a context bag having a larger amount of features as one piece of learning data.

  The model generation unit 132 may generate an authentication model using any context data, not limited to the position information and time information described above. For example, the model generation unit 132 determines the name and type of the second terminal (whether it is a stationary device or mobile), radio wave intensity, pairing state, temperature, luminance of the second terminal, ambient sound information, humidity, etc. For example, the authentication model may be generated using various information including the surrounding environment of the user.

  The model generation unit 132 stores the generated authentication model in the authentication model storage unit 123 in association with the user identification information corresponding to the authentication model.

(About the authentication unit 133)
When the authentication unit 133 receives an authentication request from the first terminal, the authentication unit 133 uses the context data of the first terminal acquired together with the authentication request, and the authentication model generated by the model generation unit 132, based on the user's authentication model. Authenticate your identity.

  For example, the authentication unit 133 uses the positional relationship information indicating the relative positional relationship between the first terminal and the second terminal as context data used for authentication, as in the case of acquisition in the generation of the authentication model. Authenticate the identity of the user. Specifically, when the authentication unit 133 receives an authentication request from the first terminal, the authentication unit 133 inputs the presence of the second terminal located near the first terminal to the authentication model, and outputs the score to the output score. Based on this, the identity of the user is authenticated.

  Note that the authentication unit 133 may authenticate the user's identity based on information indicating the radio wave intensity between the first terminal and the second terminal, not the positional relationship information, as the context data acquired together with the authentication request. Good. For example, the authentication unit 133 determines the second terminal located near the first terminal based on the radio field intensity between the first terminal and the second terminal, and inputs the determined presence of the second terminal to the authentication model. To authenticate the identity of the user.

  Moreover, the authentication part 133 may authenticate a user's identity based on the communication condition between a 1st terminal and a 2nd terminal as context data acquired with the request | requirement of authentication. For example, the authentication unit 133 authenticates the identity of the user based on the presence of the second terminal that is paired with the first terminal. For example, when the authentication model is generated, it is assumed that a relatively large number of situations in which the first terminal and the predetermined second terminal are paired are observed in the acquired context data. In this case, a relatively high weight value is set in the generated authentication model for the situation where the first terminal and the predetermined second terminal are paired. For this reason, in the context data at the time of the authentication request, when a situation in which the first terminal and the predetermined second terminal are paired is observed, it is estimated that a relatively high score is output from the authentication model. The The authentication unit 133 can authenticate the user's identity with high accuracy based on the score output in this way.

  Further, the authentication unit 133 includes, as context data acquired together with the authentication request, the context data of the first terminal at the time when the authentication request is made, the first terminal and the second data in the past from the time when the authentication request is made. The identity of the user may be authenticated based on information combined with positional relationship information indicating a relative positional relationship with the terminal. Specifically, the authentication unit 133 authenticates the user's identity based on a context bag including a plurality of context data, instead of the temporary context data at the time of the authentication request. That is, the authentication unit 133 can improve the accuracy of user authentication by performing authentication determination based on a context bag including more feature quantities. For example, the authentication unit 133 uses the context bag used for generating the authentication model (for example, the time interval at which the context bag is generated, the time range of information included in the context bag, and the second terminal included in one piece of positional relationship information. The user may be authenticated based on a context bag having the same amount of information as the number of information.

  Note that the authentication unit 133 may authenticate the identity of the user based on at least one of the time when the authentication request is received and the location information of the first terminal that transmitted the authentication request. As a result, the authentication unit 133 is located far away from the position where the user requests authentication on a daily basis, or when the authentication request is made at a time when the user does not normally request authentication. When a request is made in, processing can be performed so that the user who makes the request is not authenticated as the user himself / herself. That is, the authentication unit 133 can improve the security of authentication.

  Further, the authentication unit 133 authenticates the identity of the user based on at least one of the attribute information of the user who uses the first terminal that transmitted the authentication request or the terminal information of the first terminal and the second terminal. May be. As a result, the authentication unit 133 can usually more accurately determine the identity between the user corresponding to the authentication model and the user who newly authenticates, so that the accuracy of authentication can be improved.

(About the transmitter 134)
The transmission unit 134 transmits various types of information. For example, the transmission unit 134 transmits the result of the personal authentication by the authentication unit 133 to the first terminal that requested the authentication. In addition, when transmitting that the authentication has not been executed, the transmission unit 134 may also transmit a notification indicating that the existing authentication information such as a password is requested to be transmitted.

[4. Configuration of user terminal]
Next, the configuration of the user terminal 10 according to the embodiment will be described with reference to FIG. FIG. 9 is a diagram illustrating a configuration example of the user terminal 10 according to the embodiment. As illustrated in FIG. 9, the user terminal 10 includes a communication unit 11, an input unit 12, a display unit 13, a detection unit 14, a storage unit 15, and a control unit 16.

(About the communication unit 11)
The communication part 11 is implement | achieved by NIC etc., for example. The communication unit 11 is connected to the network N in a wired or wireless manner, and transmits / receives information to / from the authentication device 100 and an arbitrary second terminal via the network N.

(About the input unit 12 and the display unit 13)
The input unit 12 is an input device that receives various operations from the user. For example, the input unit 12 is realized by an operation key or the like provided in the user terminal 10. The display unit 13 is a display device for displaying various information. For example, the display unit 13 is realized by a liquid crystal display or the like. In addition, when a touch panel is employ | adopted for the user terminal 10, a part of input part 12 and the display part 13 are integrated.

(About the detector 14)
The detection unit 14 detects various information related to the user terminal 10. Specifically, the detection unit 14 detects a user operation on the user terminal 10, location information of the user terminal 10, information about a device connected to the user terminal 10, an environment in the user terminal 10, and the like. To do.

  For example, the detection unit 14 detects a user operation based on information input to the input unit 12. In other words, the detection unit 14 detects that there has been an input of an operation for touching the screen to the input unit 12, an input of audio, or the like. Further, the detection unit 14 may detect that a predetermined application program (hereinafter simply referred to as “application”) is started by the user. When such an application is an application that operates an imaging function (for example, a camera) in the user terminal 10, the detection unit 14 detects that the imaging function is used by the user. Further, the detection unit 14 may detect an operation in which the user terminal 10 itself is physically moved based on data detected by an acceleration sensor, a gyro sensor, or the like provided in the user terminal 10.

  Further, the detection unit 14 detects the current position of the user terminal 10. Specifically, the detection unit 14 receives radio waves transmitted from GPS satellites, and acquires position information (for example, latitude and longitude) indicating the current position of the user terminal 10 based on the received radio waves.

  Moreover, the detection part 14 may acquire position information with various methods. For example, when the user terminal 10 has a function equivalent to that of a contactless IC card used at a station ticket gate or a store (or the user terminal 10 has a function of reading a history of the contactless IC card) ), The used position is recorded together with the information on the settlement of the boarding fee at the station by the user terminal 10. The detection unit 14 detects such information and acquires it as position information. Moreover, the detection part 14 may detect the positional information acquirable from an access point, when the user terminal 10 communicates with a specific access point. The position information may be acquired by an optical sensor, an infrared sensor, a magnetic sensor, or the like included in the user terminal 10. Moreover, when the position of the user terminal 10 can be estimated from the IP address or the like, the detection unit 14 may acquire an IP address or the like as an example of the position information.

  The detection unit 14 detects an external device connected to the user terminal 10. Note that the external device is a device other than the target user terminal 10 and may include another user terminal 10 (that is, the second terminal) different from the target. For example, when the smartphone 20 is the first terminal, the watch-type terminal 30 and the glasses-type terminal 40 are recognized as external devices (second terminals).

  The detection unit 14 detects the external device based on, for example, exchange of communication packets with the external device, a signal generated by the external device, or the like. Specifically, the detection unit 14 detects radio waves such as WiFi and Bluetooth used by the external device. The detection unit 14 may detect the type of connection with the external device when communication with the external device is established. For example, the detection unit 14 detects whether it is connected to an external device by wire or wireless communication. Moreover, the detection part 14 may detect the communication system etc. which are used by radio | wireless communication. The detection unit 14 may detect the external device based on information acquired by a radio wave sensor that detects a radio wave emitted by the external device, an electromagnetic wave sensor that detects an electromagnetic wave, or the like.

  In addition, the detection unit 14 detects information about the environment using various sensors and functions provided in the user terminal 10. For example, the detection unit 14 is a microphone that collects sound around the user terminal 10, an illuminance sensor that detects illuminance around the user terminal 10, and an acceleration sensor that detects physical movement of the user terminal 10 (or A gyro sensor), a humidity sensor that detects the humidity around the user terminal 10, a geomagnetic sensor that detects a magnetic field at the location of the user terminal 10, and the like. And the detection part 14 detects various information using various sensors. For example, the detection unit 14 detects a noise level around the user terminal 10 and whether the surroundings of the user terminal 10 have illuminance suitable for imaging the user's iris. Further, the detection unit 14 may detect surrounding environment information based on a photograph or video taken by the camera.

  The user terminal 10 acquires the context data of the user terminal 10 based on the information detected by the detection unit 14. As described above, the user terminal 10 has various sensors such as position, acceleration, temperature, gravity, rotation (angular velocity), illuminance, geomagnetism, pressure, proximity, humidity, and rotation vector by various built-in sensors (detection unit 14). May be acquired as context data.

(About the storage unit 15)
The storage unit 15 stores various information. The storage unit 15 is realized by, for example, a semiconductor memory device such as a RAM or a flash memory, or a storage device such as a hard disk or an optical disk.

  For example, the storage unit 15 stores the context data detected by the detection unit 14 in association with the detected date and time. In addition, the storage unit 15 may store access information (cookie information or the like) to a service that requires authentication, a use history related to the service, or the like.

(About the control unit 16)
The control unit 16 is a controller, and is realized, for example, by executing various programs stored in a storage device inside the user terminal 10 using the RAM as a work area by a CPU, an MPU, or the like. The control unit 16 is a controller, and is realized by an integrated circuit such as an ASIC or FPGA, for example.

  As illustrated in FIG. 9, the control unit 16 includes an acquisition unit 161, a generation unit 162, and a transmission unit 163, and implements or executes information processing functions and operations described below. The internal configuration of the control unit 16 is not limited to the configuration illustrated in FIG. 9, and may be another configuration as long as the information processing described later is performed.

(About the acquisition unit 161)
The acquisition unit 161 acquires various types of information. For example, the acquisition unit 161 acquires various types of information detected by the detection unit 14 as context data. For example, the acquisition unit 161 detects the context of the own device for each preset time, and acquires context data based on the detected information. Note that the acquisition unit 161 may acquire context data for each time set by the authentication device 100 under the control of an application provided from the authentication device 100, for example.

(Regarding the generator 162)
The generation unit 162 generates various types of information based on the context data acquired by the acquisition unit 161. For example, the generation unit 162 generates positional relationship information indicating the second terminal located in the vicinity of the first terminal based on the radio wave intensity of each second terminal acquired by the acquisition unit 161. Moreover, the production | generation part 162 produces | generates the context bag which bundled several context data containing positional relationship information at the preset timing (for example, every 5 minutes or every 10 minutes).

(About transmitter 163)
The transmission unit 163 transmits various information. For example, the transmission unit 163 transmits the context data and the context bag generated by the generation unit 162 to the authentication device 100 according to the control of the authentication device 100.

  Further, when receiving an operation for requesting authentication from the user, the transmission unit 163 transmits an authentication request to the authentication device 100. In this case, the transmission unit 163 transmits the context data at the time of the authentication request to the authentication device 100 together with the authentication request. Note that the transmission unit 163 may transmit not only the context data at the time of the authentication request but also the context data acquired in a predetermined time range (for example, the past 10 minutes) to the authentication device 100 in a bundle.

[5. Processing procedure)
Next, an authentication process procedure according to the embodiment will be described with reference to FIGS. 10 to 12. First, the procedure of processing related to the user terminal 10 will be described with reference to FIG. FIG. 10 is a flowchart (1) illustrating a processing procedure according to the embodiment.

  As illustrated in FIG. 10, the user terminal 10 determines whether or not it is time to detect the context of the own device (step S <b> 101). When the detection timing has not arrived (step S101; No), the user terminal 10 stands by until the timing comes.

  On the other hand, when the detection timing has arrived (step S101; Yes), the user terminal 10 detects the context data (step S102).

  Thereafter, the user terminal 10 determines whether or not the timing for generating a context bag has arrived (step S103). When the timing for generating the context bag has not arrived (step S103; No), the user terminal 10 returns the process to step S101.

  On the other hand, when the timing for generating a context bag has arrived (step S103; Yes), the user terminal 10 generates a context bag (step S104). Thereafter, the user terminal 10 determines whether or not the timing for transmitting the context bag has arrived (step S105). When the timing for transmitting the context bag has not arrived (step S105; No), the user terminal 10 stands by until the timing comes.

  On the other hand, when the timing for transmitting the context bag has arrived (step S105; Yes), the user terminal 10 transmits the context bag to the authentication device 100 (step S106).

  Next, a generation process procedure performed by the authentication apparatus 100 will be described with reference to FIG. FIG. 11 is a flowchart (2) illustrating a processing procedure according to the embodiment.

  As illustrated in FIG. 11, the authentication device 100 determines whether a context bag has been acquired from the user terminal 10 (step S201). When the context bag has not been acquired (step S201; No), the authentication device 100 stands by until the context bag is acquired.

  On the other hand, when a context bag is acquired (step S201; Yes), the authentication device 100 stores the context bag in the storage unit 120 (step S202).

  Subsequently, the authentication apparatus 100 determines whether information (context bag) sufficient for model generation has been accumulated (step S203). When sufficient information is not accumulated (step S203; No), the authentication device 100 repeats the process of acquiring a context bag.

  On the other hand, when sufficient information is accumulated (step S203; Yes), the authentication apparatus 100 generates an authentication model corresponding to the user who transmitted the context bag based on the accumulated information (step S204). Then, the authentication device 100 stores the generated authentication model in the storage unit 120 (step S205).

  Next, an authentication process procedure performed by the authentication apparatus 100 will be described with reference to FIG. FIG. 12 is a flowchart (3) illustrating a processing procedure according to the embodiment.

  As illustrated in FIG. 12, the authentication apparatus 100 determines whether an authentication request has been received from the user terminal 10 (step S301). If an authentication request has not been received (step S301; No), the authentication apparatus 100 waits until an authentication request is received.

  On the other hand, when an authentication request is received (step S301; Yes), the authentication apparatus 100 acquires context data of the user terminal 10 at the time of authentication (at the time when authentication is requested) (step S302).

  Subsequently, the authentication device 100 inputs the acquired context data into the authentication model (step S303). Then, the authentication device 100 determines whether or not the output of the authentication model has exceeded a predetermined threshold (step S304). When the output exceeds a predetermined threshold (step S304; Yes), the authentication apparatus 100 authenticates the user who transmitted the authentication request with the user himself (step S305).

  On the other hand, when the output does not exceed the predetermined threshold (step S304; No), the authentication apparatus 100 does not authenticate the user who transmitted the authentication request with the user himself (step S306). Then, the authentication device 100 transmits the authentication result to the user (step S307).

[6. (Modification)
The authentication process by the authentication device 100 described above may be implemented in various different forms other than the above embodiment. Therefore, in the following, other embodiments relating to the authentication device 100 and the authentication processing will be described.

[6-1. (Generate context bag)
In the above-described embodiment, an example in which the context bag used for the authentication model generation process is generated by the first terminal has been described. However, the context bag may be generated on the device side that generates the authentication model. This point will be described with reference to FIG. FIG. 13 is a diagram illustrating a configuration example of the authentication device 200 according to the modification.

  As illustrated in FIG. 13, the authentication device 200 further includes a bag generation unit 232 as compared to the authentication device 100 illustrated in FIG. 5. In this case, for example, the acquisition unit 131 sequentially acquires context data for each predetermined time detected by the first terminal. Such context data may be information indicating a nearby second terminal, such as the positional relationship information shown in the embodiment, or simply information covering all the second terminals detected by the first terminal. May be. When the acquired context data is information covering all the second terminals detected by the first terminal, the bag generation unit 232 determines the first terminal's information based on the radio field intensity acquired together with the information. You may generate | occur | produce the positional relationship information which extracted the predetermined number of 2nd terminal located in the vicinity.

  The bag generation unit 232 follows information defined as a context bag (timing for generating a context bag, a time range of information included in the context bag, the number of second terminals included in one positional relationship information, and the like). Create a context bag. The model generation unit 132 generates an authentication model based on the context bag generated by the bag generation unit 232.

  Thus, the process which produces | generates a context bag and the process which produces | generates positional relationship information may be performed by the authentication apparatus 200 side. Thereby, the authentication device 200 can execute processing related to authentication with a flexible configuration.

[6-2. (Authentication process)
In the above embodiment, an example in which the authentication device 100 authenticates the identity of the user who uses the first terminal has been described. Here, the authentication process may be performed by the first terminal.

  For example, the process of authenticating the user's identity is not limited to being performed on the server as in the authentication apparatus 100, and may be performed on the first terminal side without going through the network. Specifically, the first terminal may authenticate the identity of the user who intends to log in to the own device.

  In this case, the first terminal may acquire the authentication model generated by the authentication device 100 or may authenticate the user using the authentication model generated by the own device. That is, the first terminal acquires the context data of its own device at the timing when the user requests authentication (for example, attempts to log in to the first terminal). Specifically, the first terminal detects a second terminal existing around. Then, the first terminal generates positional relationship information indicating a relative positional relationship with the second terminal based on the detected context.

  Then, the first terminal authenticates the user who made the authentication request based on the generated positional relationship information and the authentication model. For example, when the user wears the watch-type terminal 30 or the glasses-type terminal 40 on a daily basis, when the login to the first terminal is attempted, those terminals are detected as the second terminal. It is assumed. In this case, the authentication model is that “their terminals are located in the vicinity of the first terminal” and that the user who tries to log in is the “user himself” who is logged in to the first terminal on a daily basis. It is assumed that the relationship is learned relatively high. For this reason, even if the first terminal does not input authentication information such as a password from the user, the first terminal is sent to the first terminal based on the positional relationship information that the watch-type terminal 30 and the glasses-type terminal 40 are located nearby. A user who attempts to log in can be authenticated as “user himself / herself”.

  As described above, the authentication processing according to the embodiment is not necessarily performed by the server, but may be performed by the local side (first terminal side). In other words, the authentication device according to the embodiment is not limited to the authentication device 100 that is a server, but may be the first terminal (user terminal 10).

[6-3. Learning process)
In the above embodiment, in the authentication model generation process, the context bag is acquired from the first terminal of the user who has already been authenticated, and learning is performed using the acquired context bag as correct data (correct example). . Here, the authentication device 100 may accept a setting from the user as to what kind of context data is handled as a positive example (or a negative example).

  For example, it is assumed that the user uses the service while wearing only the clock-type terminal 30 on a daily basis. Under such circumstances, when learning of the authentication model by the authentication apparatus 100 proceeds, a phenomenon occurs in which the user authentication is successful as long as “only the clock-type terminal 30” is located in the vicinity of the first terminal. sell. For this reason, there exists a possibility that the safety | security of an authentication process may fall.

  Therefore, the authentication device 100 may accept in advance from the user what positional relationship information is defined as a positive example. For example, the user may perform a setting to define that “at least two types of second terminals” are located near the first terminal as a positive example. In this case, even if the authentication apparatus 100 acquires positional relationship information in which only one second terminal called the clock-type terminal 30 is observed as context data when the user succeeds in authentication, such information is used as a positive example. It may not be handled. On the other hand, when the authentication apparatus 100 acquires positional relationship information obtained by observing two second terminals, the watch-type terminal 30 and the glasses-type terminal 40, as the context data when the user succeeds in authentication, the authentication apparatus 100 Is treated as a positive example.

  As described above, the authentication apparatus 100 does not use all the positional relationship information (context data) when authentication is successful as a positive example, but uses the positional relationship information that is assumed to be more secure as a positive example. It may be used as Thereby, the authentication apparatus 100 can improve the safety | security of authentication. The setting of the positive example may be performed not by the user but by the administrator of the authentication device 100. Further, the setting of the positive example may be automatically set by the authentication device 100.

[6-4. First terminal]
The distinction between the first terminal and the second terminal shown in the above embodiment is relative, and the terminal that is the first terminal in one situation may be treated as the second terminal in another situation.

  For example, when the login to a certain service is performed not only by the smartphone 20 but also by the watch-type terminal 30, the user authentication models for the smartphone 20 and the watch-type terminal 30 are generated. Regarding the authentication model generation process and authentication process corresponding to the smartphone 20, the smartphone 20 serves as the first terminal, and the watch-type terminal 30 is treated as the second terminal. On the other hand, regarding the generation process and authentication process of the authentication model corresponding to the clock-type terminal 30, the clock-type terminal 30 is the first terminal and the smartphone 20 is handled as the second terminal.

[6-5. Acquisition process)
In the process of acquiring context data from the first terminal, the authentication device 100 may perform the acquisition process at a predetermined timing instead of always continuing the acquisition process. For example, the authentication device 100 may acquire past context data collectively as a predetermined timing when a predetermined application is activated on the smartphone 20. In addition, the authentication device 100 logs the position information only when specific position information is observed (a position of the user U01, such as a home or company, or a predetermined spot set in advance). You may make it hold | maintain.

  As described above, the authentication device 100 can appropriately select the timing for acquiring various types of information and the information to be held. Accordingly, the authentication device 100 can reduce the processing load according to the embodiment, reduce the burden on the storage device for holding information, or reduce the cost of the power amount and the communication amount related to the processing. .

[6-6. (User terminal)
In the above embodiment, the configuration example of the user terminal 10 is shown using FIG. 9, but the user terminal 10 does not necessarily have all the configurations shown in FIG. 9. As described above, the user terminal 10 includes not only smart devices such as the smartphone 20 and the watch-type terminal 30, but also a glasses-type terminal 40 having a communication function, or a heart rate measuring device for storing a user's heart rate, Various wearable devices are included. In this case, the user terminal 10 does not necessarily receive input from the user, but may have a function of automatically acquiring user information and transmitting such information to a communication network. That is, the user terminal 10 does not necessarily have the configuration illustrated in FIG. 9 as long as it is a device or information device having a function of communicating with the first terminal.

[6-7. (Authentication model)
In the above embodiment, an example in which the authentication model is generated by regression analysis such as logistic regression has been described, but the authentication model is not limited to this example. For example, the authentication device 100 may generate an authentication model based on information indicating the presence of a predetermined number of second terminals detected by the first terminal at the time when the user succeeds in authentication. For example, the authentication device 100 indicates the presence of the second terminal by a vector of a predetermined number of dimensions indicated as “Yes (1)” or “No (0)”, so that the user at the time when the user is successfully authenticated. An authentication model indicating the context of the second terminal around the terminal may be generated. In this case, the authentication apparatus 100 acquires, as context data, vector information indicating the presence of surrounding second terminals detected by the first terminal when the user newly requests authentication. Then, the authentication apparatus 100 authenticates the identity of the user by determining the similarity (such as cosine similarity) between the acquired vector information and the authentication model. Note that the authentication device 100 may make adjustments such as increasing the weight of the second terminal that is paired with the first terminal or the second terminal that is located closer to the first terminal. Also by such a method, the authentication device 100 can authenticate the user's identity based on the relationship between the first terminal and the second terminal located around the first terminal. That is, the authentication device 100 may generate the authentication model by any method as long as the authentication model can verify the user's identity based on the positional relationship between the first terminal and the second terminal.

[7. Hardware configuration)
The authentication device 100 and the user terminal 10 according to the above-described embodiments are realized by a computer 1000 having a configuration as shown in FIG. 14, for example. Hereinafter, the authentication apparatus 100 will be described as an example. FIG. 14 is a hardware configuration diagram illustrating an example of a computer 1000 that implements the functions of the authentication device 100. The computer 1000 includes a CPU 1100, RAM 1200, ROM 1300, HDD 1400, communication interface (I / F) 1500, input / output interface (I / F) 1600, and media interface (I / F) 1700.

  The CPU 1100 operates based on a program stored in the ROM 1300 or the HDD 1400 and controls each unit. The ROM 1300 stores a boot program executed by the CPU 1100 when the computer 1000 is started up, a program depending on the hardware of the computer 1000, and the like.

  The HDD 1400 stores a program executed by the CPU 1100, data used by the program, and the like. The communication interface 1500 receives data from other devices via the communication network 500 (corresponding to the network N shown in FIG. 4), sends the data to the CPU 1100, and transmits the data generated by the CPU 1100 to the other devices via the communication network 500. Send to device.

  The CPU 1100 controls an output device such as a display and a printer and an input device such as a keyboard and a mouse via the input / output interface 1600. The CPU 1100 acquires data from the input device via the input / output interface 1600. Further, the CPU 1100 outputs the data generated via the input / output interface 1600 to the output device.

  The media interface 1700 reads a program or data stored in the recording medium 1800 and provides it to the CPU 1100 via the RAM 1200. The CPU 1100 loads such a program from the recording medium 1800 onto the RAM 1200 via the media interface 1700, and executes the loaded program. The recording medium 1800 is, for example, an optical recording medium such as a DVD (Digital Versatile Disc) or PD (Phase change rewritable disk), a magneto-optical recording medium such as an MO (Magneto-Optical disk), a tape medium, a magnetic recording medium, or a semiconductor memory. Etc.

  For example, when the computer 1000 functions as the authentication device 100 according to the embodiment, the CPU 1100 of the computer 1000 executes the program loaded on the RAM 1200 (for example, the authentication program according to the embodiment), thereby Realize the function. The HDD 1400 stores data in the storage unit 120. The CPU 1100 of the computer 1000 reads these programs from the recording medium 1800 and executes them, but as another example, these programs may be acquired from other devices via the communication network 500.

[8. Others]
In addition, among the processes described in the above embodiment, all or part of the processes described as being automatically performed can be performed manually, or the processes described as being performed manually can be performed. All or a part can be automatically performed by a known method. In addition, the processing procedures, specific names, information including various data and parameters shown in the above-mentioned document and drawings can be arbitrarily changed unless otherwise specified. For example, the various types of information illustrated in each drawing is not limited to the illustrated information.

  Further, each component of each illustrated apparatus is functionally conceptual, and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. For example, the model generation unit 132 and the authentication unit 133 illustrated in FIG. 5 may be integrated. Further, for example, information stored in the storage unit 120 may be stored in a storage device provided outside via the network N.

  Further, for example, in the above-described embodiment, an example has been described in which the authentication apparatus 100 performs an acquisition process for acquiring context data, a generation process for generating an authentication model, and an authentication process for authenticating a user's identity. However, the authentication device 100 described above may be separated into an acquisition device that performs an acquisition process, a generation device that performs a generation process, and an authentication device that performs an authentication process. In this case, the processing by the authentication device 100 according to the embodiment is realized by the authentication system 1 including the acquisition device, the generation device, and the authentication device.

  In addition, the above-described embodiments and modification examples can be combined as appropriate within a range that does not contradict processing contents.

[9. effect〕
As described above, the authentication device 100 according to the embodiment includes the acquisition unit 131 and the model generation unit 132. The acquisition unit 131 uses the positional relationship information indicating the relative positional relationship between the first terminal and a second terminal, which is a terminal different from the first terminal, as context data of the first terminal used by the user. To get. The model generation unit 132 generates an authentication model for authenticating the user's identity based on the positional relationship information acquired by the acquisition unit 131.

  As described above, the authentication device 100 according to the embodiment is for authenticating a user based on the relationship with a second terminal (for example, a terminal that the user always carries) located in the vicinity of the first terminal. By generating an authentication model, highly secure authentication processing can be easily realized without performing complicated processing such as analysis of position information.

  Moreover, the acquisition part 131 acquires the positional information which shows the position of a 1st terminal with positional relationship information. The model generation unit 132 generates an authentication model based on the positional relationship information and the positional information of the first terminal corresponding to the positional relationship information.

  As described above, the authentication apparatus 100 according to the embodiment can perform authentication processing including a position where the user tends to authenticate, for example, by generating the authentication model by adding the position information. The security of authentication can be further increased.

  Moreover, the acquisition part 131 acquires the time information when the positional relationship information was generated together with the positional relationship information. The model generation unit 132 generates an authentication model based on the positional relationship information and time information corresponding to the positional relationship information.

  As described above, the authentication apparatus 100 according to the embodiment performs an authentication process including a time when the user tends to perform authentication, for example, by generating the authentication model by adding the time information that facilitates the authentication. Therefore, the security of authentication can be further improved.

  The acquisition unit 131 acquires positional relationship information indicating the relative positional relationship between the first terminal and the plurality of second terminals.

  As described above, the authentication device 100 according to the embodiment generates the authentication model using the information indicating the positional relationship with the plurality of second terminals, so that the situation of the second terminal located in the vicinity of the user can be further improved. Since the determination can be made in detail, the accuracy of authentication can be improved.

  The acquisition unit 131 acquires information in which a plurality of pieces of positional relationship information are combined. The model generation unit 132 generates an authentication model based on information obtained by combining a plurality of pieces of positional relationship information.

  As described above, the authentication device 100 according to the embodiment can generate an authentication model based on learning data including more feature amounts by using information (context bag) in which a plurality of pieces of positional relationship information are combined. The accuracy of authentication can be improved.

  In addition, when the authentication device 100 according to the embodiment receives an authentication request from the first terminal, the authentication apparatus 100 based on the context data of the first terminal acquired together with the authentication request and the authentication model. It further has an authentication unit 133 for authenticating the sex.

  As described above, the authentication apparatus 100 according to the embodiment can realize an authentication process that does not require authentication information such as a password by using the context data and the authentication model. Specifically, according to the authentication device 100, the user can input authentication information such as a password, or an explicit process for generating authentication information (for example, a gesture for holding a fingerprint, touching a screen, (Tap operation etc.) is not necessary. Thereby, the authentication apparatus 100 can improve the usability regarding authentication.

  Moreover, the acquisition part 131 acquires the electromagnetic wave strength between a 1st terminal and a 2nd terminal as context data acquired with the request | requirement of authentication. The authentication unit 133 authenticates the user's identity based on the radio wave intensity.

  As described above, the authentication device 100 according to the embodiment can specify the second terminal located in the vicinity of the first terminal by measuring the positional relationship between the first terminal and the second terminal using the radio wave intensity. it can. Accordingly, the authentication device 100 can determine the positional relationship between the first terminal and the second terminal at the time of the authentication request, and thus can accurately determine whether the user is the user himself / herself.

  Moreover, the acquisition part 131 acquires the communication condition between a 1st terminal and a 2nd terminal as context data acquired with the request | requirement of authentication. The authentication unit 133 authenticates the user's identity based on the communication status between the first terminal and the second terminal.

  As described above, the authentication device 100 according to the embodiment measures the positional relationship between the first terminal and the second terminal using the communication status (for example, pairing or the like), so that the second device located near the first terminal is used. The terminal can be specified. Accordingly, the authentication device 100 can determine the positional relationship between the first terminal and the second terminal at the time of the authentication request, and thus can accurately determine whether the user is the user himself / herself.

  In addition, as the context data acquired together with the authentication request, the acquisition unit 131 includes the context data of the first terminal at the time when the authentication request is made and the first terminal in the past from the time when the authentication request is made. And positional relationship information indicating the relative positional relationship between the second terminal and the second terminal. The authentication unit 133 authenticates the identity of the user based on information obtained by combining the context data of the first terminal and the positional relationship information at the time when the authentication request is made.

  As described above, the authentication device 100 according to the embodiment may perform the authentication process not only at the time of authentication request but also including past context data. As a result, the authentication device 100 can collate information having a larger amount of features, so that the accuracy of authentication can be improved.

  In addition, the authentication unit 133 authenticates the identity of the user based on at least one of the time when the authentication request is received and the position information of the first terminal that transmitted the authentication request.

  As described above, the authentication device 100 according to the embodiment performs the authentication process including the time information and the position information, so that the context data at the time of the authentication request has a time and position where the user tends to authenticate on a daily basis. Therefore, it is possible to determine the identity of the user including whether or not there is a close relationship, so that the accuracy of authentication can be improved.

  Further, the authentication unit 133 determines the identity of the user based on at least one of the attribute information of the user who uses the first terminal that transmitted the request for authentication or the terminal information of the first terminal and the second terminal. Authenticate.

  As described above, the authentication device 100 according to the embodiment performs the authentication process including the attribute information and the terminal information, so that the context data at the time of the authentication request indicates the attribute of the user himself / herself, or the first terminal It is possible to determine in detail whether the second terminal located near is a second terminal that exists on a daily basis. Thereby, the authentication device 100 can improve the accuracy of authentication.

  As described above, some of the embodiments of the present application have been described in detail with reference to the drawings. However, these are merely examples, and various modifications, including the aspects described in the disclosure section of the invention, based on the knowledge of those skilled in the art It is possible to implement the present invention in other forms with improvements.

  In addition, the “section (module, unit)” described above can be read as “means” or “circuit”. For example, the acquisition unit can be read as acquisition means or an acquisition circuit.

DESCRIPTION OF SYMBOLS 1 Authentication system 10 User terminal 20 Smartphone 30 Watch-type terminal 40 Eyeglass-type terminal 100 Authentication apparatus 110 Communication part 120 Storage part 121 Terminal information storage part 122 Context data storage part 123 Authentication model storage part 130 Control part 131 Acquisition part 132 Model generation part 133 Authentication unit 134 Transmission unit

Claims (14)

An acquisition unit that acquires positional relationship information indicating a relative positional relationship between the first terminal and a second terminal that is a terminal different from the first terminal, as context data of the first terminal used by the user When,
Based on the positional relationship information acquired by the acquisition unit, a model generation unit that generates an authentication model for authenticating the identity of the user;
An authentication apparatus comprising: The acquisition unit
Along with the positional relationship information, obtain positional information indicating the position of the first terminal,
The model generation unit
Generating the authentication model based on the positional relationship information and the positional information of the first terminal corresponding to the positional relationship information;
The authentication apparatus according to claim 1. The acquisition unit
Along with the positional relationship information, obtain the time information when the positional relationship information was generated,
The model generation unit
Generating the authentication model based on the positional relationship information and time information corresponding to the positional relationship information;
The authentication apparatus according to claim 1 or 2, wherein The acquisition unit
Obtaining the positional relationship information indicating a relative positional relationship between each of the first terminal and the plurality of second terminals;
The authentication device according to any one of claims 1 to 3, wherein The acquisition unit
Obtaining a combination of a plurality of the positional relationship information,
The model generation unit
Generating the authentication model based on information obtained by combining a plurality of the positional relationship information;
The authentication apparatus according to any one of claims 1 to 4, wherein An authentication unit for authenticating the identity of the user based on the context data of the first terminal acquired together with the request for authentication and the authentication model when an authentication request is received from the first terminal;
The authentication device according to claim 1, further comprising: The acquisition unit
As the context data acquired together with the authentication request, the radio field intensity between the first terminal and the second terminal is acquired,
The authentication unit
Authenticating the identity of the user based on the radio field intensity;
The authentication apparatus according to claim 6. The acquisition unit
As context data acquired together with the authentication request, a communication status between the first terminal and the second terminal is acquired,
The authentication unit
Authenticating the identity of the user based on the communication status between the first terminal and the second terminal;
The authentication apparatus according to claim 6 or 7, wherein The acquisition unit
As context data acquired together with the authentication request, the context data of the first terminal at the time when the authentication request is made, and the first terminal and the second terminal in the past from the time when the authentication request is made, And the positional relationship information indicating the relative positional relationship of
The authentication unit
Authenticating the identity of the user based on information obtained by combining the context data of the first terminal and the positional relationship information at the time of requesting the authentication;
The authentication device according to any one of claims 6 to 8, wherein The authentication unit
Authenticating the identity of the user based on the time at which the authentication request is received or at least one of the location information of the first terminal that has transmitted the authentication request;
The authentication apparatus according to any one of claims 6 to 9, wherein The authentication unit
Authenticating the identity of the user based on at least one of the attribute information of the user who uses the first terminal that has transmitted the request for authentication, or the terminal information of the first terminal and the second terminal;
The authentication device according to any one of claims 6 to 10, wherein An authentication method performed by a computer,
Acquisition step of acquiring positional relationship information indicating a relative positional relationship between the first terminal and a second terminal that is a terminal different from the first terminal, as context data of the first terminal used by the user When,
A model generation step for generating an authentication model for authenticating the identity of the user based on the positional relationship information acquired by the acquisition step;
The authentication method characterized by including. Acquisition procedure for acquiring positional relationship information indicating a relative positional relationship between the first terminal and a second terminal that is a terminal different from the first terminal, as context data of the first terminal used by the user When,
A model generation procedure for generating an authentication model for authenticating the identity of the user based on the positional relationship information acquired by the acquisition procedure;
An authentication program for causing a computer to execute. An authentication system including a first terminal used by a user and an authentication device that performs user authentication requested by the first terminal,
The first terminal is
A detection unit for detecting a second terminal which is a terminal different from the first terminal;
A generating unit that generates positional relationship information indicating a relative positional relationship between the second terminal detected by the detecting unit and the first terminal at a predetermined time;
A transmission unit that transmits the positional relationship information generated by the generation unit to the authentication device;
With
The authentication device
An acquisition unit for acquiring the positional relationship information transmitted by the transmission unit;
Based on the positional relationship information acquired by the acquisition unit, a model generation unit that generates an authentication model for authenticating the identity of the user;
An authentication system characterized by comprising:

Images