JP5345585B2 - Authentication system, authentication method and program - Google Patents

Description

  The present invention relates to an authentication system, an authentication method, and a program for authenticating a user when using a service on a network.

  When a service on a network such as the Internet is used, authentication using a user ID and a password is generally used to confirm the user. Recently, in addition to the user ID / password system, IC card authentication, fingerprint authentication, and the like have begun to be used for services that require higher security. When using IC card authentication, fingerprint authentication, etc. in a network service, an IC card reader / writer (see, for example, Non-Patent Document 1) or a fingerprint authentication device (for example, see Non-Patent Document 2) is connected to the user's terminal, Dedicated software that controls the authentication device needs to be added. Further, it is necessary to add dedicated software for controlling the authentication device (IC card reader / writer, fingerprint authentication device, etc.) to the server providing the service.

As described above, when using a method such as IC card authentication or fingerprint authentication as compared with the user ID / password method, it is necessary to add facilities on the service side and the user side. Conventionally, this addition of equipment has been a disincentive to dissemination. For example, with regard to IC card authentication, e-Tax (national tax electronic declaration and tax payment system) has spread the environment where IC cards can be used even in ordinary homes. It's getting on.
However, even under such circumstances, the IC card authentication is only used for a specific service, and has not yet been used for a general purpose in a network service.
The reason why it is not widely used in network services is that the software on the terminal and the software on the server are generally specialized for a specific service. It is conceivable that the configuration is not usable and that the development cost of software is high, making it difficult to install.

“IC Card Reader / Writer”, NTT Communication, [online], [March 15, 2010 search] Internet <URL: http://www.ntt.com/jpki/index.html> “Fingerprint authentication unit”, NEC, [online], [March 15, 2010 search] Internet <URL: http://www.nec.co.jp/pid/product/pc-logon/pu900.html> Three security elements related to IC cards, “PKI IC card authentication”, Pentio Co., Ltd., [online], [March 15, 2010 search] Internet <URL: http://www.atmarkit.co.jp /fsecurity/special/78ic/ic02.html>

  As described above, the user ID / password method is generally used for logging in to a service on the network, but the user ID / password method has a low security level. At present, authentication methods using IC cards and fingerprints with a high security level are being used, but they are not widespread due to problems such as introduction costs.

  The present invention has been made in view of such problems, and an object of the present invention is to enable a network service provider to easily introduce user authentication such as IC card authentication and fingerprint authentication into a network service. An authentication system, an authentication method, and a program are provided.

  In order to achieve the above object, an authentication system according to the present invention includes a user identification for identifying the identity of a user using a terminal connected to the authentication device and user authentication data transmitted from the terminal. An authentication system comprising a server and a service provider server that provides a network service, wherein the user identification server receives a user ID, a terminal ID of the terminal, and an authentication method ID of the authentication device from the service provider server Means for acquiring an authentication scheme ID from a database using the terminal ID of the terminal received from the service provider server as a key, an authentication scheme ID acquired from the database, and an authentication scheme ID received from the service provider server. When the verification method and the verification of the authentication method ID are successful, the authentication method ID is Means for acquiring an authentication device control script for controlling the authentication device from the database, means for transmitting the acquired authentication device control script and the authentication method ID to the terminal, and a user ID from the terminal. And means for receiving the authentication method ID and authentication data that is the execution result of the authentication device control script executed by the terminal, and a processing procedure for performing authentication from the database using the authentication method ID as a key. Based on the acquired evaluation data and the authentication data; means for acquiring the evaluation script; executing the evaluation script; acquiring the evaluation data from the database using the user ID and the authentication method ID as a key; Means for performing authentication and means for transmitting an authentication result to the service provider server. Means for transmitting a user ID, a terminal ID and an authentication method ID received from the terminal to the user identification server; a means for receiving the authentication result transmitted from the user identification server; Means for executing use control of a network service based on the authentication result, wherein the terminal transmits a user ID, a terminal ID, and an authentication method ID to the service provider server, and the user identification server Means for receiving the authentication method ID and the authentication device control script, means for executing the received authentication device control script and acquiring authentication data from the authentication device, the acquired authentication data, and a user ID And means for transmitting an authentication method ID to the user identification server.

  The authentication system of the present invention described above preferably further includes means for transmitting an error signal to the service provider server when the user identification server fails to verify the authentication method ID.

  The authentication method of the present invention includes a terminal to which an authentication device is connected, a user identification server for identifying the identity of the user using user authentication data transmitted from the terminal, a network service An authentication method for a system comprising a service provider server providing a service ID, wherein the processing procedure of the user identification server receives a user ID, a terminal ID of the terminal, and an authentication method ID of the authentication device from the service provider server A step of acquiring an authentication scheme ID from a database using the terminal ID of the terminal received from the service provider server as a key, and an authentication scheme ID acquired from the database and an authentication scheme ID received from the service provider server. The verification method, and when the verification of the authentication method ID is successful, the authentication method A step of acquiring an authentication device control script for controlling the authentication device from a database using D as a key; a step of transmitting the acquired authentication device control script and the authentication method ID to the terminal; Receiving a user ID, an authentication method ID, and authentication data that is an execution result of the authentication device control script executed by the terminal, and a processing procedure for performing authentication from a database using the authentication method ID as a key. Obtaining a written evaluation script; executing the evaluation script; obtaining evaluation data from a database using the user ID and the authentication method ID as keys; and the obtained evaluation data and the authentication data Authenticating based on the authentication and sending an authentication result to the service provider server A processing procedure of the service provider server is transmitted from the user identification server, a step of transmitting the user ID, the terminal ID, and the authentication method ID received from the terminal to the user identification server Receiving the authentication result, and executing a network service usage control based on the received authentication result, wherein the processing procedure of the terminal includes a user ID, a terminal ID, and an authentication method ID as the service provider. Transmitting to the server, receiving the authentication method ID and the authentication device control script from the user identification server, and executing the received authentication device control script to obtain authentication data from the authentication device And the acquired authentication data, user ID, and authentication method ID for the user And transmitting to the identification server.

  The authentication method of the present invention described above preferably further includes a step of transmitting an error signal to the service provider server when the processing procedure of the user identification server fails in the verification of the authentication scheme ID.

  The present invention also provides a terminal to which an authentication device is connected, a user identification server for identifying the identity of the user using user authentication data transmitted from the terminal, and a network service. Receiving a user ID, a terminal ID of the terminal, and an authentication method ID of the authentication device from the service provider server in a computer configured as a user identification server of an authentication system comprising a service provider server; and the service provider server Obtaining an authentication scheme ID from a database using the terminal ID of the terminal received from the key as a key, verifying an authentication scheme ID obtained from the database and an authentication scheme ID received from the service provider server, and an authentication scheme ID If the verification is successful, the authentication method ID is used as a key. A step of acquiring an authentication device control script for controlling the authentication device from a database, a step of transmitting the acquired authentication device control script and the authentication method ID to the terminal, a user ID from the terminal, An evaluation method in which an authentication method ID and authentication data that is an execution result of an authentication device control script executed on the terminal are received, and a processing procedure for performing authentication from a database using the authentication method ID as a key is described. Acquiring a script; executing the evaluation script; acquiring evaluation data from a database using the user ID and the authentication method ID as keys; and authenticating based on the acquired evaluation data and the authentication data And transmitting an authentication result to the service provider server; It characterized as a program for executing.

  The program of the present invention described above preferably further includes a step of transmitting an error signal to the service provider server when the verification of the authentication method ID fails.

  According to the present invention, a network service provider can easily introduce user authentication such as IC card authentication and fingerprint authentication into a network service.

It is a figure which shows the structural example of the authentication system of this invention. It is a figure which shows the example of a data structure of the database with which a database part is provided. It is a sequence diagram explaining the process sequence of the authentication system of this invention in case an authentication apparatus is an IC card and an IC card reader / writer. It is a figure which shows an example of the authentication apparatus control script in IC card authentication. It is a figure which shows an example of the evaluation script in IC card authentication. It is a sequence diagram explaining the process sequence of the authentication system of this invention in case an authentication apparatus is a fingerprint authentication apparatus. It is a figure which shows an example of the authentication apparatus control script in fingerprint authentication. It is a figure which shows an example of the evaluation script in fingerprint authentication.

Embodiments of the present invention will be described with reference to the drawings. The present invention includes a user identification server having an authentication function on a network, and enables an authentication device such as an IC card reader / writer or a fingerprint authentication device connected to a terminal to be easily used from a plurality of network services. It is.
FIG. 1 is a diagram illustrating a configuration example of an authentication system according to the present invention. The authentication system according to the present invention includes a user identification server 10, a service provider server 20 and a terminal 30 connected to a network, and an authentication device 40 connected to the terminal 30.
The user identification server 10 includes a database unit 11, a terminal management unit 12 that manages information of the terminal 30, an authentication unit 13 that identifies the identity of the user using authentication data transmitted from the terminal 30, It is comprised from the communication processing part 14 which provides the communication function with the service provider server 20 and the terminal 30. FIG.
The user identification server 10 stores a program describing processing contents for realizing each function of the user identification server 10 in a storage unit of the server, and the program is executed by a central processing unit (CPU) of the server. Can be realized by reading out and executing.

The database unit 11 includes a database (# 1), a database (# 2), and a database (# 3). FIG. 2 is a diagram illustrating a data structure example of a database provided in the database unit 11.
In the database (# 1), information on a set of a terminal ID and an authentication method ID is registered in advance as information on an authentication method supported by the terminal 30. The terminal ID is an ID that uniquely identifies the terminal 30. The authentication method ID is a value that uniquely identifies the authentication method (for example, IC card authentication, fingerprint authentication, etc.) of the authentication device 40. The terminal ID and the authentication method ID have a one-to-n relationship (one terminal supports a plurality of authentication methods).
In the database (# 2), information of a set of an authentication method ID, an authentication device control script, and an evaluation script (the authentication device control script and the evaluation script will be described later) is registered in advance. The authentication method ID, the authentication device control script, and the evaluation script have a one-to-one relationship.
In the database (# 3), information of a set of a user ID, an authentication method ID, and evaluation data is registered in advance as user authentication data. A user's public key is stored as evaluation data corresponding to IC card authentication. User's fingerprint data is stored as evaluation data corresponding to fingerprint authentication.
In FIG. 1, the database unit 11 is provided inside the user identification server 10. However, the database unit 11 may be provided outside the user identification server 10 as an apparatus independent of the user identification server 10.

  The terminal management unit 12 has a function of receiving a terminal ID and an authentication method ID from the communication processing unit 14, a function of acquiring an authentication method ID from the database (# 1) using the terminal ID as a key, and an acquisition from the database (# 1). A function for verifying the authentication method ID and the authentication method ID transmitted from the service provider server, a function for transmitting an error signal to the communication processing unit 14 when the verification of the authentication method ID fails, and a method for verifying the authentication method ID. If successful, it has a function of acquiring the authentication device control script from the database (# 2) using the authentication method ID as a key and a function of transmitting the authentication method ID and the authentication device control script to the communication processing unit 14.

  The authentication unit 13 evaluates from the database (# 3) with the function of acquiring the evaluation script from the database (# 2) using the authentication method ID as a key, the function of executing the evaluation script, and the user ID and the authentication method ID as keys. A function for acquiring data, a function for receiving authentication data, a user ID, and an authentication method ID transmitted from the communication processing unit 14 and a function for transmitting an authentication result (authentication success or authentication failure) to the communication processing unit 14 Have

  The communication processing unit 14 has a function of receiving a user identification request (user ID, terminal ID, authentication method ID) transmitted from the service provider server 20, and an authentication data request (terminal ID and authentication device control script) to the terminal 30. ), A function of receiving authentication data transmitted from the terminal 30, a function of transmitting a terminal ID and an authentication method ID to the terminal management unit 12, an authentication method ID transmitted from the terminal management unit 12, A function of receiving an authentication device script or an error signal, a function of transmitting authentication data to the authentication unit 13, a function of receiving an authentication result transmitted from the authentication unit 13, and an authentication result or error to the service provider server 20 It has a function of transmitting a signal.

The service provider server 20 has a function of providing a network service that can be used by a browser, a function of receiving a user ID, a terminal ID, and an authentication method ID transmitted from the terminal 30, and a user to the user identification server 10. A function of transmitting an identification request (user ID, terminal ID, authentication method ID), an authentication result (authentication success or authentication failure) transmitted from the user identification server 10, or a function of receiving an error signal, and authentication Based on the result, it has a function to execute the use control of the network service.
The service provider server 20 stores a program describing the processing contents for realizing each function of the service provider server 20 in a storage unit of the server, and reads the program by a central processing unit (CPU) of the server. It can be realized by executing.

The terminal 30 has a function for accessing a network service using a browser or the like, a function for a user to specify a user ID and an authentication method (authentication method ID), a user ID to the service provider server 20, and a terminal. A function of transmitting an ID and an authentication method ID, a function of receiving an authentication method ID and an authentication device control script transmitted from the user identification server 10, a function of selecting an authentication device 40 corresponding to the authentication method ID, and authentication It has a function of executing a device control script, a function of receiving authentication data transmitted from the authentication device, and a function of transmitting authentication data to the user identification server 10.
In addition, one or more authentication devices 40 are connected to the terminal 30.
The terminal 30 stores a program describing processing contents for realizing each function of the terminal 30 in a storage unit of the terminal, and reads and executes the program by a central processing unit (CPU) of the terminal. Can be realized.

The processing procedure of the authentication system of the present invention will be described below.
<When the authentication device is an IC card or IC card reader / writer>
FIG. 3 is a sequence diagram illustrating the processing procedure of the authentication system of the present invention when the authentication device 40 is an IC card and an IC card reader / writer.

  A user accesses a network service provided by the service provider server 20 from the terminal 30, and displays a login screen generated by the service provider server 20 on the terminal 30 (S101). On the screen, there are a user ID input box and a button for executing IC card authentication. The user ID is an ID that uniquely identifies the user. When the user inputs the user ID, inserts the IC card into the IC card reader / writer and clicks a button on the screen (S102), the user ID, terminal ID, and authentication are made from the terminal 30 to the service provider server 20. The system ID is transmitted (S103). The service provider server 20 transmits a user identification request to the user identification server 10 (S104). The user identification request is composed of a set of a user ID, a terminal ID, and an authentication method ID. When receiving the user identification request, the communication processing unit 14 of the user identification server 10 transmits the terminal ID and the authentication method ID to the terminal management unit 12 (S105).

  The terminal management unit 12 acquires the authentication method ID from the database (# 1) of the database unit 11 using the terminal ID as a key (S106), and is transmitted from the service provider server 20 and the authentication method ID acquired from the database (# 1). The authentication method IDs are collated (S107), and it is determined whether or not the terminal 30 supports the designated authentication method (S108). If the terminal 30 does not support the specified authentication method (if the authentication method IDs do not match), an error signal is transmitted to the service provider server 20 via the communication processing unit 14 (S109). When the terminal 30 supports the designated authentication method (when the authentication method IDs match), the authentication device control script is acquired from the database (# 2) of the database unit 11 using the authentication method ID as a key (S110). ). The authentication device control script is a script in which processing and parameters for controlling the authentication device 40 are described. FIG. 4 shows an example of an authentication device control script in IC card authentication.

  The terminal management unit 12 transmits the authentication method ID and the authentication device control script to the communication processing unit 14 (S111). The communication processing unit 14 transmits an authentication data request to the terminal 30 with the terminal ID (S112). The authentication data request is composed of a set of an authentication method ID and an authentication device control script.

The terminal 30 receives the authentication data request, and selects an authentication device (in this example, an IC card reader / writer and an IC card) 40 corresponding to the authentication method ID (in this example, IC card authentication) (S113). . The terminal 30 executes the authentication device control script (S114). In the case of the authentication device control script example shown in FIG. 4, the following processing is executed.
(1) A SELECT FILE command is transmitted to the IC card via the IC card reader / writer.
(2) Via the IC card reader / writer, an INTERNAL AUTHENTICATE command is transmitted to the IC card using the challenge data stored in [Parameter] of the authentication device control script as an argument.

  The terminal 30 receives the execution result (encrypted data) of the INTERNAL AUTHENTICATE command from the IC card via the IC card reader / writer (S115). The terminal 30 uses the execution result (encrypted data) of the INTERNAL AUTHENTICATE command as authentication data, and transmits the authentication data, the user ID, and the authentication method ID to the user identification server 10 (S116). The communication processing unit 14 transmits the user ID, authentication method ID, and authentication data to the authentication unit 13 (S117).

  The authentication unit 13 acquires an evaluation script from the database (# 2) of the database unit 11 using the authentication method ID as a key (S118). An evaluation script is a script that describes a processing procedure for determining authentication success (accessing by a correct user) and authentication failure (accessing by an unauthorized user) from authentication data and evaluation data. . FIG. 5 shows an example of an evaluation script for IC card authentication.

  Next, the authentication unit 13 executes the evaluation script. In the case of the evaluation script example of FIG. 5, evaluation data is acquired from the database (# 3) of the database unit 11 using the user ID and authentication method ID as keys (S119). The database (# 3) stores the user's public key as evaluation data corresponding to IC card authentication. The authentication data (encrypted challenge data) is decrypted with the public key of the user and collated with the challenge data stored in [Parameter] of the evaluation script (S120). If verification is successful, authentication is successful (the correct user is accessing). If the verification fails, authentication fails (an unauthorized user is accessing). An authentication result (authentication success or authentication failure) is transmitted from the authentication unit 13 to the communication processing unit 14 (S121). The communication processing unit 14 transmits an authentication result to the service provider server 20 (S122). The service provider server 20 determines whether or not the user can log in from the received authentication result (S123).

<When the authentication device is a fingerprint authentication device>
FIG. 6 is a sequence diagram for explaining the processing procedure of the authentication system of the present invention when the authentication device 40 is a fingerprint authentication device.
The user accesses the network service from the terminal 30 and displays the login screen generated by the service provider server 20 on the terminal 30 (S201). On the screen, there are a user ID input box and a button for executing fingerprint authentication. After the user ID is input, the user places a finger on the sensor unit of the fingerprint authentication device and clicks a button on the screen (S202). From the terminal 30 to the service provider server 20, the user ID, terminal ID, and authentication are performed. The system ID is transmitted (S203). The service provider server 20 transmits a user identification request to the user identification server 10 (S204). The user identification request is composed of a set of a user ID, a terminal ID, and an authentication method ID. When receiving the user identification request, the communication processing unit 14 of the user identification server 10 transmits the terminal ID and the authentication method ID to the terminal management unit 12 (S205).

  The terminal management unit 12 acquires the authentication method ID from the database (# 1) of the database unit 11 using the terminal ID as a key (S206), and is transmitted from the service provider server 20 and the authentication method ID acquired from the database (# 1). The authentication method IDs are collated (S207), and it is determined whether or not the terminal 30 supports the designated authentication method (S208). If the terminal 30 does not support the specified authentication method (if the authentication method IDs do not match), an error signal is transmitted to the service provider server 20 via the communication processing unit 14 (S209). When the terminal 30 supports the designated authentication method (when the authentication method IDs match), the authentication device control script is acquired from the database (# 2) of the database unit 11 using the authentication method ID as a key (S210). ). The authentication device control script is a script in which processing and parameters for controlling the authentication device 40 are described. FIG. 7 shows an example of an authentication device control script in fingerprint authentication.

  The terminal management unit 12 transmits the authentication method ID and the authentication device control script to the communication processing unit 14 (S211). The communication processing unit 14 transmits an authentication data request to the terminal 30 with the terminal ID (S212). The authentication data request is composed of a set of an authentication method ID and an authentication device control script.

  The terminal 30 receives the authentication data request, selects the authentication device (in this example, fingerprint authentication device) 40 corresponding to the authentication method ID (in this example, fingerprint authentication) (S213), and the authentication device control script Is executed (S214). In the case of the authentication device control script example shown in FIG. 7, the terminal 30 transmits a fingerprint data acquisition command to the fingerprint authentication device.

  The terminal 30 receives the execution result (fingerprint data) of the fingerprint data acquisition command from the fingerprint authentication device (S215). The terminal 30 uses the execution result (fingerprint data) of the fingerprint data acquisition command as authentication data, and transmits the authentication data, the user ID, and the authentication method ID to the user identification server 10. (S216). The communication processing unit 14 transmits the user ID, the authentication method ID, and the authentication data to the authentication unit 13 (S217).

  The authentication unit 13 acquires an evaluation script from the database (# 2) of the database unit 11 using the authentication method ID as a key (S218). An evaluation script is a script that describes a processing procedure for determining authentication success (accessing by a correct user) and authentication failure (accessing by an unauthorized user) from authentication data and evaluation data. . FIG. 8 shows an example of an evaluation script in fingerprint authentication.

  Next, the authentication unit 13 executes the evaluation script. In the case of the evaluation script example of FIG. 8, evaluation data is acquired from the database (# 3) of the database unit 11 using the user ID and authentication method ID as keys (S219). The database (# 3) stores user fingerprint data in advance as evaluation data corresponding to fingerprint authentication. Next, the authentication data and the fingerprint data of the user acquired from the database (# 3) are collated (S220). If verification is successful, authentication is successful (the correct user is accessing). If the verification fails, authentication fails (an unauthorized user is accessing). An authentication result (authentication success or authentication failure) is transmitted from the authentication unit 13 to the communication processing unit 14 (S221). The communication processing unit 14 transmits the authentication result to the service provider server 20 (S222). The service provider server 20 determines whether or not the user can log in from the received authentication result (S223).

  In the authentication system of the present invention, the network service provider receives the user ID, the terminal ID and the authentication method ID transmitted from the terminal 30 to the service provider server 20, and the user identification to the user identification server 10. A function for transmitting a request (user ID, terminal ID, authentication method ID), an authentication result (authentication success or authentication failure) transmitted from the user identification server 10, or a function for receiving an error signal, and an authentication result It is possible to use functions for IC card authentication and fingerprint authentication simply by adding a function for executing use control of network services based on the above. Further, by adding such a function, it is possible to support a plurality of authentication methods such as IC card authentication and fingerprint authentication with the same system configuration.

DESCRIPTION OF SYMBOLS 10 User identification server 11 Database part 12 Terminal management part 13 Authentication part 14 Communication processing part 20 Service provider server 30 Terminal 40 Authentication apparatus

Claims (6)

Authentication comprising a terminal to which an authentication device is connected, a user identification server for identifying the identity of the user using user authentication data transmitted from the terminal, and a service provider server for providing a network service A system,
The user identification server is
Means for receiving a user ID, a terminal ID of the terminal, and an authentication method ID of the authentication device from the service provider server;
Means for obtaining an authentication scheme ID from a database using the terminal ID of the terminal received from the service provider server as a key;
Means for collating the authentication scheme ID acquired from the database with the authentication scheme ID received from the service provider server;
Means for acquiring an authentication device control script for controlling the authentication device from a database using the authentication method ID as a key when the verification of the authentication method ID is successful;
Means for transmitting the acquired authentication device control script and the authentication method ID to the terminal;
Means for receiving, from the terminal, a user ID, an authentication method ID, and authentication data that is an execution result of an authentication device control script executed on the terminal;
Means for acquiring an evaluation script describing a processing procedure for performing authentication from a database using the authentication method ID as a key;
Means for executing the evaluation script and acquiring evaluation data from a database using the user ID and the authentication method ID as a key;
Means for performing authentication based on the acquired evaluation data and the authentication data;
Means for transmitting an authentication result to the service provider server,
The service provider server is
Means for transmitting the user ID, terminal ID and authentication method ID received from the terminal to the user identification server;
Means for receiving the authentication result transmitted from the user identification server;
Means for performing use control of a network service based on the received authentication result,
The terminal
Means for transmitting a user ID, terminal ID and authentication method ID to the service provider server;
Means for receiving the authentication scheme ID and the authentication device control script from the user identification server;
Means for executing the received authentication device control script to obtain authentication data from the authentication device;
Means for transmitting the acquired authentication data, user ID, and authentication method ID to the user identification server;
An authentication system comprising:   The authentication system according to claim 1, wherein the user identification server further includes means for transmitting an error signal to the service provider server when the verification of the authentication method ID fails. A system comprising a terminal to which an authentication device is connected, a user identification server for identifying the identity of the user using user authentication data transmitted from the terminal, and a service provider server for providing a network service Authentication method,
The processing procedure of the user identification server is as follows:
Receiving a user ID, a terminal ID of the terminal, and an authentication method ID of the authentication device from the service provider server;
Obtaining an authentication scheme ID from a database using the terminal ID of the terminal received from the service provider server as a key;
Collating the authentication scheme ID obtained from the database with the authentication scheme ID received from the service provider server;
Acquiring an authentication device control script for controlling the authentication device from a database using the authentication method ID as a key when the verification of the authentication method ID is successful;
Transmitting the acquired authentication device control script and the authentication method ID to the terminal;
Receiving from the terminal a user ID, an authentication scheme ID, and authentication data that is an execution result of an authentication device control script executed on the terminal;
Obtaining an evaluation script describing a processing procedure for performing authentication from a database using the authentication method ID as a key;
Executing the evaluation script and obtaining evaluation data from a database using the user ID and the authentication method ID as a key;
Authenticating based on the acquired evaluation data and the authentication data;
Transmitting an authentication result to the service provider server;
Including
The processing procedure of the service provider server is as follows:
Transmitting the user ID, terminal ID and authentication method ID received from the terminal to the user identification server;
Receiving the authentication result transmitted from the user identification server;
Executing use control of a network service based on the received authentication result;
Including
The processing procedure of the terminal is as follows:
Transmitting a user ID, a terminal ID, and an authentication method ID to the service provider server;
Receiving the authentication scheme ID and the authentication device control script from the user identification server;
Executing the received authentication device control script to obtain authentication data from the authentication device;
Transmitting the acquired authentication data, user ID, and authentication method ID to the user identification server;
An authentication method comprising:   The authentication method according to claim 3, wherein the processing procedure of the user identification server further includes a step of transmitting an error signal to the service provider server when the verification of the authentication method ID fails. Authentication comprising a terminal to which an authentication device is connected, a user identification server for identifying the identity of the user using user authentication data transmitted from the terminal, and a service provider server for providing a network service On the computer configured as the user identification server of the system,
Receiving a user ID, a terminal ID of the terminal, and an authentication method ID of the authentication device from the service provider server;
Obtaining an authentication scheme ID from a database using the terminal ID of the terminal received from the service provider server as a key;
Collating the authentication scheme ID obtained from the database with the authentication scheme ID received from the service provider server;
Acquiring an authentication device control script for controlling the authentication device from a database using the authentication method ID as a key when the verification of the authentication method ID is successful;
Transmitting the acquired authentication device control script and the authentication method ID to the terminal;
Receiving from the terminal a user ID, an authentication scheme ID, and authentication data that is an execution result of an authentication device control script executed on the terminal;
Obtaining an evaluation script describing a processing procedure for performing authentication from a database using the authentication method ID as a key;
Executing the evaluation script and obtaining evaluation data from a database using the user ID and the authentication method ID as a key;
Authenticating based on the acquired evaluation data and the authentication data;
Transmitting an authentication result to the service provider server;
A program for running   6. The program according to claim 5, further comprising a step of transmitting an error signal to the service provider server when the verification of the authentication method ID fails.

Images